JP3975061B2 - Authentication system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
  The present invention enables a user to connect to a specific information registration destination such as a web server of a shopping mall site from a communication terminal device via a communication line and transmit registration target information such as order contents. Authenticates whether or not the person isAuthentication systemIt is about.
[0002]
[Prior art]
In recent years, access to a web server that accepts shopping, questionnaires, etc. from a communication terminal device such as a computer via a communication line such as the Internet, etc. has been applied to purchase products or provide services, or to submit questionnaires Yes. It is also considered that voting in elections etc. is performed online via a communication line.
When using such shopping via a communication line, each user connects to a specific information registration destination such as the web server via a communication line from a communication terminal device, and transmits predetermined registration target information. To do. For example, when using online shopping, a user first receives information from a communication terminal device such as a personal computer through a shopping mall site on the Internet or a shopping-related portal site for ordering. Connect to a web server as a device and browse web pages. Then, from the order form page, enter information such as order details, user contact information (address, telephone number, e-mail address), product delivery address, payment method for payment, etc. Send to the vendor's web server and register. The web server that has received the information processes the information sent from the user according to predetermined data processing and stores the information in the data storage unit. Then, based on the information registered in the web server, the above-mentioned merchant performs a product shipping process or requests a predetermined financial institution for a payment process for a fee payment.
[0003]
In this way, a user tries to connect to a merchandise dealer's web server, questionnaire survey center server, election center server, etc. via a communication line from a communication terminal device, and send predetermined registration target information to register. In this case, it is important to authenticate whether or not the person who has actually transmitted such information is the person himself / herself.
[0004]
Conventionally, the following method is known as a method for authenticating whether or not the user who has transmitted information to the specific information registration destination is the person himself / herself.
For example, in Japanese Patent Application Laid-Open No. 11-45366, after the calling number stored in the storage means of the user's portable communication device is read by the reading means of the terminal that can communicate with the computer, the computer from the terminal A method is disclosed in which a read number is transmitted to the mobile communication device that is called from the call number and a personal identification code is transmitted from the mobile communication device that responds to the computer to the computer. In this method, the personal identification code received from the portable communication device and the personal identification code stored in association with the calling number of the portable communication device are collated in the computer, and the user is authenticated.
[0005]
Further, in Japanese Patent Laid-Open No. 2000-148845, when a user registers data in a predetermined data registration device, the user temporarily registers his / her e-mail address, first authentication data, and registration target data. The step of transmitting the request data to the data registration device, and the data registration device receiving the temporary registration request data performs temporary registration of the registration target data and transmits the registration address for the main registration to the e-mail address. And a method in which a user who has received a registration address via e-mail transmits second authentication data to the registration address. In this method, the data registration device that has received the second authentication data through the registration address compares the second authentication data with the first authentication data, authenticates the user based on the comparison result, and registers Decide whether to register the data.
[0006]
[Problems to be solved by the invention]
However, when the method disclosed in the above-mentioned Japanese Patent Application Laid-Open No. 11-45366 is adopted, the personal identification code must be immediately input and transmitted in response to the call from the computer. This is inconvenient because it limits the degree of freedom of operation. In addition, since it is necessary to read the call number from the mobile communication device to the terminal, the operation becomes complicated by the operation of reading the call number, and the mobile communication device and the terminal must be connected via a holder or the like. Is also inconvenient.
[0007]
Further, when the method disclosed in the above Japanese Patent Laid-Open No. 2000-148845 is adopted, two pieces of authentication data (first authentication data, 1) are sent from the user's communication terminal device to the information registration destination data registration device. Since it is necessary to transmit (second authentication data), the operation of transmitting the authentication data becomes complicated. Further, two authentication data (first authentication data and second authentication data) that are the basis for user authentication are both transmitted from the communication terminal device of the user to the data registration device of the information registration destination via a communication line or the like. Therefore, it is not preferable in terms of security.
[0008]
  The present invention has been made in view of the above problems.EyesSpecifically, it is possible to authenticate a user who wants to register information at an information registration destination more safely and easily than the conventional method.Authentication systemIs to provide.
[0010]
[Means for Solving the Problems]
  In order to achieve the above object, the invention of claim 1A user connects to a server to which information is registered from a mobile phone via a communication line.Information registration destination serverWhen the registration target information including the user's mobile phone number is transmitted to and registered,An authentication system for authenticating a user's identity, a storage device for storing the user's mobile phone number and identity verification information in association with each other;When the information registration destination server receives the registration target information from the user's mobile phone,A receiving means configured using a communication device that receives a mobile phone number registered by the user from a server of an information registration destination via a communication line; and a short message service that designates the mobile phone number as a destination ( SMS), a transmission means configured using a communication device that transmits the URL of a one-time-use authentication site with the mobile phone number received by the reception means as the destination, and the user's mobile phone from the user The identity verification information sent to the authentication site is compared with the identity verification information stored in the storage means in association with the user's mobile phone number, and when both identity verification information matches. Is a means configured using a CPU that determines that the user is the person.A transmission unit configured using a communication device that transmits the result of the determination to the information registration destination server via a communication line;It is characterized by comprising.
[0012]
  Claim 1Authentication systemThenMobile phone number registered by the userOwned by users based onMobile phoneFor authenticationURL of the siteIn principle, only the user himself / herself is for authentication.URL of the siteYou will never know. And thisMobile phoneFor authentication sent toThe site URL isSince it is limited to one-time use, a third party different from the user can use thisURL of the siteGetThatFor authenticationURL of the siteI can't connect when I try to connect to.
  In addition, the userMobile phoneFor the above authenticationURL of the siteAuthenticates whether or not the user is the user based on this identity confirmation information and the pre-registered identity confirmation information by sending identity confirmation information that only the user can know. Can be performed more reliably. In addition, since only one of the two pieces of identity verification information used for user authentication is transmitted from the user via the communication line, compared to the case where the two pieces of identity verification information are transmitted via the communication line, respectively. As a result, the operation of the communication terminal device on the user side becomes simple and security can be ensured easily.
[0013]
According to a second aspect of the present invention, in the authentication system of the first aspect, the receiving means receives the mobile phone number from the server of the information registration destination different from the user authentication organization provided with the authentication system via the communication line. Is received.
[0014]
According to a third aspect of the present invention, in the authentication system according to the first or second aspect, the identity verification information is a user identification code dedicated for settlement.
[0015]
  Claim4The invention of claim1 or 2 authenticationIn the system,The identity verification information is one or more of information related to the user's biometrics, handwriting information of the user, and keystroke information indicating an interval at which the user presses the keyboard.It is characterized by this.
[0017]
  Claim5The invention of claimAny one of 1 to 4In the authentication system ofThe registration target information includes product order information or service application information.It is characterized by this.
[0019]
  Claim 6The invention of claim5. The authentication system according to claim 5, further comprising a payment management server that performs a payment process with a predetermined payment type based on the order information of the product or the application information of the service.It is characterized by this.
[0030]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings.
[Embodiment 1]
FIG. 1 is a conceptual diagram showing an overall framework of a user authentication method according to the first embodiment of the present invention. In the user authentication method of this embodiment, a user 10 is installed in a network store operating company 40 from a personal computer 20 (hereinafter referred to as “personal computer”) 20 as a first communication terminal device via the Internet 30 as a communication line. Access to the web server 41 when connecting to the web server (information processing apparatus) 41 as the specific information registration destination and transmitting the order information as registration target information to the web server 41 for registration The communication carrier 50 as a user authentication organization authenticates whether or not the user is the principal. The communication carrier 50 is a carrier that manages and operates communication by the mobile phone 60 as the second communication terminal device owned by the user 10, and includes terminal identification information for connecting to the mobile phone 60, the user And PIN (Personl Identification Number) code information as personal identification information used for authentication. The user authentication organization may be a provider who receives the terminal identification information and PIN code information from the communication carrier 50 in addition to the communication carrier 50.
[0031]
2 and 3 are a schematic configuration diagram and a functional block diagram of a user authentication information processing system (hereinafter referred to as “authentication system”) 51 used in the user authentication method, respectively.
The authentication system 51 is managed and operated by the communication carrier 50. As shown in FIG. 2, the authentication system 51 is an internal storage device including a system bus 100, a CPU 101, a RAM 102, a ROM 103, and an external storage device such as a hard disk drive (HDD) and an optical disk drive. Each user 10 is connected via the device 104, an input device 105 such as a mouse and a keyboard, an output device 106 such as a display and a printer, an Internet communication device 107 for connecting to the Internet 30, and a mobile phone communication network 70. A mobile phone communication device 108 for communicating with the mobile phone 60 is provided. Components such as the CPU 101 and the RAM 102 exchange data and program instructions with each other via the system bus 100. A program for operating the authentication system 51 according to a predetermined procedure is stored in the ROM 103 or the external storage device 104, and is called up and executed in the work area on the CPU 101 or the RAM 102 as necessary.
Further, the authentication system 51 has various server functions such as a web server, and may be configured by a single computer system, and is called from the web server or web server via the CGI (Common Gateway Interface). A plurality of computers each having a plurality of server functions such as an application server for executing an external program and a database server for managing various data in association with each other may be connected via a network.
[0032]
The personal computer 20 and the web server 41 for the online store used by the user 10 have the same configuration as the authentication system 51 except for the mobile phone communication device 108, and detailed description thereof will be omitted.
[0033]
The authentication system 51 executes a predetermined program on the hardware shown in FIG. 2 to perform user information storage means 501, authentication request information receiving means 502, and authentication connection destination information sending means 503 shown in FIG. Each function of the personal identification information receiving unit 504 and the authentication processing unit 505 is realized.
The user information storage unit 501 is configured by using the external storage device 104 including the hard disk of the authentication system 51 and stores user information of the user 10 who owns the mobile phone 60. . As shown in FIG. 4, this user information includes, for each user, a mobile phone number as terminal identification information, a PIN code as identification information, and automatic debit account information (financial institution name, branch number, account number). Type, account number, name) or payment card transaction information such as credit card information (card type, issuing company name, card number, expiration date, name), usage package plan name, additional option name, applicable discount type, etc. Service information is registered in association with other information such as the name, address, telephone number, and mail address of the user.
[0034]
The authentication request information receiving means 502 is composed of the CPU 101 of the authentication system 51, the RAM 102, the Internet communication device 107, etc., and the terminal identification information received from the user's personal computer 20 by the web server 41 of the Internet store operating company 40. It has a function of receiving, from the web server 41, authentication request information for requesting user authentication together with (mobile phone number).
[0035]
  The authentication connection destination information transmitting means 503 includes the CPU 101 of the authentication system 51, the RAM 102, the mobile phone communication device 108, and the like, and terminal identification information (mobile phone) received from the web server 41 of the network store operating company 40. Number), a one-time URL as connection destination information for authentication is transmitted to the mobile phone 60 of the user. This one-time URL is used by the CPU 101 to connect the user 10 to the authentication connection destination (authentication site) limited to one-time use that is different for each authentication request using the mobile phone 60. Generated using random numbers. In addition, this one-time URL is a short message that is managed and operated by the communication carrier 50 so that the user 10 can easily connect using the link function of the mobile phone 60.service(SMS) to the mobile phone 60 of the user 10.
[0036]
The identity verification information receiving means 504 is configured by the CPU 101, the RAM 102, the mobile phone communication device 108, etc. of the authentication system 51, and the authentication connection destination (specified by the one-time URL from the mobile phone 60 of the user 10). It has a function of receiving a PIN code as identification information transmitted to the authentication site.
[0037]
The authentication processing unit 505 includes the CPU 101 and the RAM 102 of the authentication system 51 and is based on the PIN code received from the mobile phone 60 of the user 10 and the PIN code stored in the user information storage unit 501. , It has a function of authenticating whether or not the user 10 is the person himself / herself.
[0038]
FIG. 5 is a flowchart showing a flow of an authentication procedure in the user authentication method of the present embodiment. In FIG. 5, steps surrounded by a thin solid line are processes on the user 10 side, and steps surrounded by a thick solid line are processes in the authentication system 51. Further, the steps surrounded by a broken line in FIG. 5 are processes in the web server 41 of the online store management company 40.
First, the user 10 operates the personal computer 20, accesses the web server 41 of the internet store operating company 40 via the Internet 30, displays a web page for internet shopping, and registers it as registration target information from the order form page. Then, terminal identification information and order information for connecting to the user's mobile phone 60 are inputted and transmitted (step 1). As the terminal identification information, a telephone number of the mobile phone 60 owned by the user 10 is input, and as the order information, a product ID, a product delivery destination, a purchase intention, a payment method, and the like are input.
The web server 41 of the internet store management company 40 may be accessed via an internet shopping mall site, an internet shopping portal site, or directly from an internet service provider (ISP).
[0039]
Next, the web server 41 of the network store operating company 40 that has received an order for the product from the user 10 sends the mobile phone of the user 10 to the authentication system 51 managed and operated by the communication carrier 50 via the Internet 30. Authentication request information for requesting user authentication is transmitted together with 60 telephone numbers (step 2). At this time, information such as a product ordered by the user, a store, a purchase amount, and a settlement type (payment method) may be transmitted to the authentication system 51 together.
[0040]
Next, the authentication system 51 of the communication carrier 50 receives the telephone number and authentication request information of the user's mobile phone 60 from the web server 41 of the network store operating company 40, and then sends the information to the user's mobile phone 60. Information relating to the one-time URL as the connection destination information for authentication is transmitted via the cellular phone communication network 70 (step 3).
[0041]
Next, the user connects to an authentication site specified by the one-time URL set in the authentication system 51 via a communication line including the mobile phone communication network 70 and the like, and is used for user authentication. A PIN code is transmitted (step 4). In addition, when information such as a product ordered by the user, a store, a purchase price, and a payment method is transmitted from the web server 41 of the online store management company 40, the data for displaying these information is authenticated. It may be set in the site for use so that the user 10 can confirm the information.
[0042]
Next, the authentication system 51 of the communication carrier 50 receives the PIN code transmitted to the authentication site designated by the one-time URL, and the PIN code registered in the user information storage unit 501 in advance. When they are compared and they match, it is determined that the user operating the personal computer 20 and the mobile phone 60 is the person himself (steps 5 and 6).
On the other hand, when the two PIN codes do not match, it is determined that the user is not the person (step 7).
The determination result is transmitted, for example, as a user authentication result to the web server 41 of the internet store operating company 40 via a communication line such as the Internet 30. Here, when it is confirmed that the user 10 is the person himself / herself, the online store management company 40 transmits data indicating that the order of the product has been confirmed to the personal computer 20 of the user 10 and also supplies the product to the user 10. Can be started, or payment processing to a predetermined organization can be requested. On the other hand, when the user 10 is not confirmed to be the person, the online store management company 40 can transmit data indicating that the order of the product has not been accepted to the personal computer 20 of the user 10.
[0043]
As described above, according to the present embodiment, the mobile phone 60 of the user 10 is provided with a one-time URL that is limited to one-time use that is different for each authentication request from the web server 41 of the online store management company 40 and that only the user himself can know. Since the user 10 can be authenticated using the PIN code transmitted from the user 10 to the one-time URL, the user 10 who wants to register information in the web server 41 can be authenticated. It is possible to authenticate the above in a safer and simpler manner than in the conventional method.
Further, according to the present embodiment, the cellular phone 60 can connect to the authentication site specified by the one-time URL using TCP / IP that is standard on the Internet 30 as a communication protocol. A general-purpose mobile phone that can be connected to the Internet can be used for the user authentication.
[0044]
In the above embodiment, the case of authenticating a user who purchases a product by accessing the web server 41 of the online store management company 40 via the Internet 30 and transmitting order information has been described. It can also be applied when a user registers information in another information registration destination. For example, the present invention can also be applied to a case where information such as an application for passenger transport service is registered by a train or an aircraft by connecting to an information processing apparatus installed by a passenger transporter or the like via a communication line. Also, access the questionnaire summary center server via the communication line to send and register various questionnaire information, or access the election center server via the communication line to send and register election vote information. It can be applied to
[0045]
[Embodiment 2]
FIG. 6 is a conceptual diagram showing an overall framework of a settlement method using a mobile phone according to the second embodiment of the present invention. Hereinafter, description of the same parts as those of the user authentication method of the first embodiment will be omitted.
In the settlement method of the present embodiment, in addition to the components shown in FIG. 1, the information processing system for settlement of the communication carrier 50 (hereinafter referred to as “settlement support system” 52) and the financial institution 80 which is an external settlement organization. Information can be transmitted to and received from a settlement management server (information processing apparatus) 81 in the network via a dedicated line 90 as a communication line.
[0046]
FIG. 7 is a functional block diagram of the payment support system 52 used in this payment method. The settlement support system 52 has a hardware configuration for communicating with the settlement management server 81 of the financial institution 80 via the dedicated line 90 in the configuration of FIG. 2 shown in the first embodiment. A dedicated line communication device (not shown) can be used.
The settlement support system 52 executes a predetermined program on the hardware illustrated in FIG. 2, so that in addition to the units 501 to 505 in the authentication system, the settlement request information transmission unit 506 illustrated in FIG. The functions of the notification information receiving unit 507 and the settlement notification information transmitting unit 508 are realized.
The settlement request information transmitting means 506 is constituted by the CPU, RAM, leased line communication device, etc. of the settlement support system 52, and when the authentication processing means 505 authenticates the user as the user, Accordingly, the user 10 and the online store management company 40 have a function of transmitting settlement request information to the settlement management server 81 of the financial institution 80 with which a transaction contract is made. This settlement request information includes settlement type information such as account withdrawal, payment by credit card, payment by debit card, payment by electronic money, etc., in addition to the purchase amount of the product purchased by the user 10.
[0047]
The payment notification information receiving means 506 is constituted by the CPU, RAM, leased line communication device, etc. of the payment support system 52, and the payment management server 81 of the financial institution 80 that has made payment related to the user based on the payment request information. To the payment notification information for notifying that the payment has been completed via the dedicated line 90.
[0048]
The settlement notification information transmitting means 508 is constituted by a CPU, a RAM, a communication device for the Internet, etc. of the settlement support system 52, and receives settlement notification information received from the settlement management server 81 of the financial institution 80 via the Internet 30. It has the function to transmit to the web server 41 of the management company 40.
[0049]
FIG. 8 is a flowchart showing a flow of authentication and settlement procedures in the settlement method of the present embodiment. Steps surrounded by thin solid lines in FIG. 8 are processes on the user side, steps surrounded by thick solid lines are processes in the payment support system 52, and steps surrounded by broken lines are network store operating companies. This is a process in 40 web servers 41. Further, the steps surrounded by the alternate long and short dash line in FIG. 8 are the processes in the settlement management server 81 of the financial institution 80.
[0050]
In the flowchart shown in FIG. 8, processing from transmission of order information from the user 10 to user authentication by the settlement support system 52 is performed in the same manner as in the case of FIG. 5 described above (steps 1 to 7).
Next, when it is determined that the user is the principal, the settlement support system 52 transmits the settlement request information including the settlement type information to the settlement management server 81 of the financial institution 80 via the dedicated line 90 (step 8). ).
[0051]
Next, the settlement management server 81 of the financial institution 80 that has received the settlement request information performs credit processing and settlement processing in a predetermined procedure, and then sends settlement notification information indicating that settlement has been completed via the dedicated line 90. The data is transmitted to the settlement support system 52 of the communication carrier 50 (steps 9 and 10).
[0052]
Next, after receiving the payment notification information from the payment management server 81 of the financial institution 80, the payment support system 52 transmits the received payment notification information to the web server 41 of the online store operating company 40 via the Internet 30. (Steps 11 and 12). The web server 41 of the internet store management company 40 may be accessed via an internet shopping mall site, an internet shopping portal site, or directly from an internet service provider (ISP).
[0053]
The network store operating company 40 that has received the payment notification information by the web server 41 transmits data indicating that the payment for the product has been completed to the personal computer 20 of the user 10, and also performs processing for shipping the product to the user 10. Can start.
[0054]
As mentioned above, according to this embodiment, while performing the payment regarding the user 10 based on the authentication of the user 10 in the above-mentioned payment support system 52, the goods are shipped to the user based on the payment notification information after the payment. Since it can be performed, electronic transactions via the Internet accompanied by authentication of the user 10 who uses the online store can be performed more safely and easily than the conventional method.
[0055]
[Embodiment 3]
FIG. 9 is a conceptual diagram showing the overall framework of a settlement method using a mobile phone according to the third embodiment of the present invention. Hereinafter, description of the same parts as those of the user authentication method of the first embodiment and the settlement method of the second embodiment will be omitted.
In the settlement method of the present embodiment, instead of performing settlement using an external settlement organization as in the second embodiment described above, a settlement information processing system (hereinafter referred to as “settlement system” 53) of the communication carrier 50 is used. Settlement).
[0056]
FIG. 10 is a functional block diagram of the payment system 53 used in the present payment method. As the hardware configuration of the settlement system 53, the configuration of FIG. 2 shown in the first embodiment can be used.
The payment system 53 executes a predetermined program on the hardware shown in FIG. 2, thereby adding the transaction information storage means 509 and the payment processing means shown in FIG. 10 in addition to the means 501 to 505 in the authentication system. 510 and the payment notification information transmission unit 511 are realized.
[0057]
The transaction information storage unit 509 is configured using an external storage device such as a hard disk of the payment system 53, and stores transaction contract information related to the payment exchanged in advance between the user 10 and the online store management company 40. It has a function to memorize. The transaction information storage unit 509 may also be used as the user information storage unit 501 described above.
[0058]
The payment processing unit 510 is constituted by the CPU, RAM, and the like of the payment system 53. When the authentication processing unit 505 authenticates the user, the credit processing related to the user 10 and the current product purchase are performed. It has a function to make a payment. Examples of the settlement method include account withdrawal, payment by credit card, and payment by debit card.
[0059]
The settlement notification information transmitting means 511 is constituted by the CPU, RAM, internet communication device, etc. of the settlement system 53, and the settlement notification information for notifying that the settlement is completed is sent to the internet store operating company 40 via the internet 30. It has a function of transmitting to the web server 41.
[0060]
FIG. 11 is a flowchart showing a flow of authentication and settlement procedures in the settlement method of the present embodiment. Steps surrounded by thin solid lines in FIG. 11 are processes on the user side, steps surrounded by thick solid lines are processes in the payment system 53, and steps surrounded by broken lines are net store management company 40. This processing is performed by the web server 41.
[0061]
In the flowchart shown in FIG. 11, processing from transmission of order information from the user 10 to user authentication by the payment system 53 is performed in the same manner as in the case of FIG. 5 described above (steps 1 to 7).
Next, when it is determined that the user is the person, the settlement system 52 uses the order contents transmitted from the web server 41 of the online store management company 40 and the transaction information stored in the transaction information storage unit 509. Based on the above, the credit processing for the user 10 and the settlement for the current product purchase are processed (step 8).
[0062]
Next, the settlement system 53 transmits the settlement notification information to the web server 41 of the internet store operating company 40 via the Internet 30 after the settlement process (step 9). The web server 41 of the internet store management company 40 may be accessed via an internet shopping mall site, an internet shopping portal site, or directly from an internet service provider (ISP).
[0063]
The network store operating company 40 that has received the payment notification information by the web server 41 transmits data indicating that the payment for the product has been completed to the personal computer 20 of the user 10, and also performs processing for shipping the product to the user 10. Can start.
[0064]
As mentioned above, according to this embodiment, while performing the payment regarding the user 10 based on the authentication of the user 10 in the above-mentioned payment support system 52, the goods are shipped to the user based on the payment notification information after the payment. Since it can be performed, electronic transactions via the Internet accompanied by authentication of the user 10 who uses the online store can be performed more safely and easily than the conventional method.
In particular, in the present embodiment, since the payment can be made within the communication carrier 50 without going through an external financial institution, the payment process is simplified and the payment can be executed promptly.
[0065]
In each of the above embodiments, the mobile phone number of the user 10 is used as the terminal identification information. However, only the authentication or settlement is performed together with the mobile phone number or instead of the mobile phone number. A dedicated user identification code (UID: User Identification Code) may be used. This user identification code (UID) accepts an application from a user who desires authentication or settlement using the systems 51, 52, 53 of the telecommunications carrier 50, performs credit examination for the user who applied, It is issued to users who satisfy a predetermined condition. A user identification code (UID) issued from the communication carrier 50 is stored as user information in the user information storage means 501 of each of the systems 51, 52, 53.
Further, the user identification code (UID) is communicated from the personal computer 20 of the user 10 via the web server 41 of the online store operating company 40 in such a state that the online store operating company 40 cannot read the product when ordering goods. It may be transmitted to the systems 51, 52, 53 of the business operator 50, or the system 51 of the communication business operator 50 from the mobile phone 60 of the user 10 via the mobile phone communication network 70 when transmitting the PIN code. You may make it transmit to 52,53.
By using the user identification code (UID) in this way, it is possible to grasp in advance the users who are likely to perform authentication processing or payment processing. Management becomes easy.
[0066]
Moreover, in each said embodiment, transmission / reception of the information via the internet 30 between the systems 51, 52, and 53 of the communication carrier 50 and the web server 41 of the internet store management company 40 uses an encryption system. preferable. By using the encryption system in this way, information can be prevented from leaking to the outside, so that the authentication process for the user 10 can be performed more safely.
When this encryption system is used, for example, as shown in the partial functional block diagram of FIG. 12, transmission / reception to / from the systems 51, 52, and 53 of the telecommunications carrier 50 is performed with the web server 41 of the online store management company 40. Key information storage means 512 for storing a mission key as key information used for encryption and decryption of the information to be executed, and the web of the online store management company 40 based on the mission key stored in the key information storage means 512 Decryption means 513 for decrypting the authentication request information transmitted from the server 41 in an encrypted form is provided.
[0067]
The mission key is generated as follows, for example. First, an online store management company that desires authentication or settlement using the systems 51, 52, and 53 of the telecommunications carrier 50 applies to the telecommunications carrier 50 and receives a predetermined examination. As a result of this examination, software for connecting to the systems 51, 52, and 53 of the communication carrier 50, a smart card in which authentication key information is written, and a smart card for an online store operating company that satisfies a predetermined condition A smart card drive device or the like is issued in order to write and read data to and from. Prior to transmission / reception of a series of information, a random number is sent from the telecommunications carrier 50 side to the web server 41 of the network store operating company 40, and the encryption and decryption are performed based on the random number and the authentication key issued. The mission key used for is generated. Also in the systems 51, 52, 53 of the communication carrier 50, a mission key is generated based on the same random number and authentication key.
[0068]
In the second embodiment, information transmission / reception between the payment support system 52 of the communication carrier 50 and the payment management server 81 of the financial institution 80 is opened to the outside like the Internet instead of the dedicated line 90. It is preferable to use an encryption system even when the communication is performed via a communication line comprising a network.
[0069]
Further, in each of the above-described embodiments, information is transmitted and received between the system 51, 52, 53 of the communication carrier 50 and the mobile phone 60 from a network opened outside such as the Internet instead of the mobile phone communication network 70. It is preferable to use an encryption system even when it is performed via a communication line. By using the encryption system in this way, it is possible to prevent information with a high security level such as identification information from leaking to the outside, so that the authentication process of the user 10 can be performed safely.
In order to encrypt this information on the mobile phone 60 side, for example, a fingerprint module that can store an authentication key and a cryptographic operation algorithm, or a USIM (Universal Subscriber Identity Module) that is a SIM card for a next-generation mobile communication system. A secure memory is provided to the mobile phone 60.
[0070]
In each of the above embodiments, a PIN code is used as the personal identification information. However, the fingerprint information of the user, the iris information of the eyeball, the retina information, the hand, and the PIN code are used together with or instead of the PIN code. Information relating to biometrics (biological features) such as blood vessel information read from the surface, face shape, voice features and voiceprints, handprints and palmprints may be used as the identity verification information. In addition, information such as how to write characters, writing pressure, the direction in which the brush is released, handwriting information such as speed when inputting from the keyboard, and keystroke information such as the interval between pressing a key and another key are used. May be.
[0071]
Moreover, in each said embodiment, when accessing the web server 41 of the internet shop management company 40 from the user 10, and when accessing the systems 51, 52, and 53 of the communication carrier 50, communication terminal devices ( Although the personal computer 20 and the mobile phone 60) are used, access to the web server 41 and the systems 51, 52, and 53 may be completed by one mobile phone 60.
[0072]
  In each of the above embodiments, the case where a product is purchased by accessing an online store has been described. However, the present invention provides various services such as accommodation at a hotel, use of a train / airplane, use of a restaurant, etc. It is also applicable when applying for provision. In addition, the present invention allows users to purchase a product by accessing a predetermined connection destination via a communication line by watching a TV shopping program or a radio shopping program, or watching an advertisement published in a magazine or the like. It can also be applied when receiving services.
In addition, the “No. 1 In addition to personal computers, mobile communication devices, PHS ( Personal Handyphone System ) Phone etc. are also included. In addition to the mobile phone, the “second communication terminal device” includes a PHS, a car phone, a personal computer, and the like. Communication by the “second communication terminal device” is managed and operated by a communication carrier. The
In addition to the information processing device that accepts registration of information related to product purchases and application for service provision via a communication line, the above “information registration destination” also registers information related to questionnaires and election voting via a communication line. An information processing apparatus and the like to receive are also included.
The above "settlement" includes settlement by direct debit from the user's account in financial institutions such as banks, settlement by credit card owned by the user, settlement by debit card, settlement by electronic money, etc. It is. The “financial institutions” include banks, credit card companies, debit card management and management companies, electronic money management and management companies, and the like.
In addition, “information registration destination”, “product sales company” and “service provider” in the above payment methods include not only Internet store management and management companies on the Internet but also TV shopping management and management companies, magazines, etc. And companies that publish information on service provision.
Further, at the time of “settlement” in the settlement method, “credit” regarding the user may be performed.
[0073]
【The invention's effect】
  BookAccording to the invention,For authentication that only the user knowsURL of the siteUsing the identity verification information sent from the user toPersonBecause you can authenticate,There is an excellent effect that authentication for a user who intends to register information can be performed more safely and easily than the conventional method.
[Brief description of the drawings]
FIG. 1 is a conceptual diagram showing an overall framework of a user authentication method using a mobile phone according to a first embodiment of the present invention.
FIG. 2 is a schematic configuration diagram of an authentication system used in the user authentication method.
FIG. 3 is a functional block diagram of an authentication system used in the user authentication method.
FIG. 4 is an explanatory diagram of user information stored in a user information storage unit of the authentication system.
FIG. 5 is a flowchart showing a flow of an authentication procedure in the user authentication method.
FIG. 6 is a conceptual diagram showing an overall framework of a settlement method using a mobile phone according to a second embodiment of the present invention.
FIG. 7 is a functional block diagram of a payment support system used in the payment method.
FIG. 8 is a flowchart showing a flow of authentication and settlement procedures in the settlement method.
FIG. 9 is a conceptual diagram showing an overall framework of a settlement method using a mobile phone according to a third embodiment of the present invention.
FIG. 10 is a functional block diagram of a payment system used in the payment method.
FIG. 11 is a flowchart showing a flow of authentication and settlement procedures in the settlement method.
FIG. 12 is a partial functional block diagram of an authentication system used in a user authentication method according to a modification.
[Explanation of symbols]
10 users
20 PC (first communication terminal)
30 Internet
40 Internet store management company
41 Web server (information registration destination)
50 Telecom operators (user certification bodies)
51 Authentication system
52 Payment Support System
53 Payment system
60 Mobile phone (second communication terminal device)
70 Mobile phone communication network
80 Financial institutions
81 Payment management server
90 Dedicated line
100 system bus
101 CPU
102 RAM
103 ROM
104 External storage device
105 Input device
106 Output device
107 Communication device for Internet
108 Communication device for mobile phone
501 User information storage means
502 Authentication request information receiving means
503 Authentication connection destination information transmission means
504 Identity confirmation information receiving means
505 Authentication processing means
506 Payment request information transmission means
507 Payment notification information receiving means
508 Payment notification information transmission means
509 Transaction information storage means
510 Payment processing means
511 Payment notification information transmission means
512 Key information storage means
513 Decryption means

Claims (6)

When a user connects to an information registration destination server from a mobile phone via a communication line and transmits registration target information including the user's mobile phone number to the information registration destination server , the user is registered. An authentication system for authenticating the identity of
A storage device for associating and storing the user's mobile phone number and identification information;
When the information registration destination server receives the registration target information from the user's mobile phone, the mobile phone number registered by the user is received from the information registration destination server via a communication line. Receiving means configured using a communication device;
Using a short message service (SMS) that designates a mobile phone number as a destination, and using a communication device that transmits the URL of a one-time use authentication site with the mobile phone number received by the receiving means as a destination. Configured transmission means; and
The identity verification information transmitted from the user's mobile phone to the authentication site is compared with the identity verification information stored in the storage means in association with the user's mobile phone number. Means configured to use a CPU that determines that the user is the identity when the identity verification information matches ;
An authentication system comprising: a transmission unit configured using a communication device that transmits the result of the determination to the information registration destination server via a communication line . The authentication system of claim 1,
The receiving system receives the mobile phone number via the communication line from a server of an information registration destination different from a user authentication organization provided with the authentication system. The authentication system according to claim 1 or 2,
The authentication system characterized in that the identity verification information is a user identification code dedicated to payment. The authentication system according to claim 1 or 2,
The user authentication information is one or more of information related to a user's biometrics, user handwriting information, and keystroke information representing an interval at which the user presses the keyboard. system. The authentication system according to any one of claims 1 to 4,
2. The authentication system according to claim 1, wherein the registration target information includes product order information or service application information. The authentication system of claim 5,
An authentication system comprising: a payment management server that performs a payment process with a predetermined payment type based on the order information of the product or the application information of the service.

Images