WO2002041207A1

WO2002041207A1 - Security system for electronic commerce

Info

Publication number: WO2002041207A1
Application number: PCT/JP2001/009023
Authority: WO
Inventors: Toru Miura
Original assignee: Toru Miura
Priority date: 2000-11-15
Filing date: 2001-10-15
Publication date: 2002-05-23
Also published as: JP2004005001A

Abstract

A security system for electronic commerce. A medium such as a credit card or a cash card which enables commerce, other than cash, is marked with a pattern specific to the medium. An identification number specific to the medium by the patterns is collated with information stored in the magnetic data of the medium to judge the authenticity of the medium. Therefore, fraudulent acts cannot be committed even if the ID number, personal identification number, etc. of the credit card or cash card is grasped, and the unauthorized use of a credit card cannot be committed even if it is counterfeited.

Description

E-commerce crime prevention system Technical field

INDUSTRIAL APPLICABILITY The present invention relates to a security method for commerce, particularly in personal commerce using a credit card, a cache card, a computer network, or the like, and forgery of a medium such as a credit card in a computer network. It relates to a method for minimizing the damage caused by theft of ID numbers. Background art

Traditionally, credit card payments have been made when purchasing products and services, and more recently, a system has been introduced that allows immediate settlement using cash cards using information terminals, etc., located at stores and other places. . The credit card cash card displays information such as the number and name of an individual ID by embossing, and the magnetic stripe stores the same information. When purchasing products, etc. using these cards, check the signature on the back of the credit card against the signature on the product purchase slip, or in the case of a cash card, use your personal identification number. Is input to the information terminal and verified by the host computer.

In recent years, with the spread of computers and the establishment of the Internet infrastructure, personal commerce has been actively conducted on networks. In the case of network commerce, computers connected to the network In general, settlement is performed by transmitting an ID number such as a credit card. However, settlement by card / network commerce is based on the premise that individual information will not be leaked to other parties.For example, a credit card can be forged without the user's knowledge, or an ID number or PIN cannot be used. There is a problem that if it is grasped, it is impossible to prevent wrongdoing of others.

An object of the present invention is to solve such a conventional problem, and it is impossible to perform an illegal act even if an ID number or a password is grasped. An object of the present invention is to provide an e-commerce security system that cannot be used. Disclosure of the invention

In order to solve the above problem, in the invention according to claim 1, a medium unique to the medium is attached to a medium other than cash, such as a credit card or a cash card, which can be traded, and a medium unique identification number based on the pattern is provided. And the information stored in the magnetic data of the medium is compared to determine the authenticity of the medium.

The invention according to claim 2 of the electronic commerce security system according to the present invention is a medium that can be used for commercial transactions other than cash, such as a credit card and a cash card, and that reads a unique pattern of the medium. Judgment of the authenticity of the card by comparing the information terminal device provided with the reading means and the recording information reading means for reading the recording information such as the magnetic data of the medium with the medium unique identification information and the recording information transferred from the information terminal device Determining means for performing the determination.

The invention according to claim 3 of the electronic commerce security system according to the present invention is the invention according to claim 2, wherein the information terminal device is provided with a data input unit capable of inputting a personal identification number, and the determination unit is unique to the medium. Identification information, records It is characterized in that the authenticity of the password and the identity verification are determined based on the information and the password, and an updated password valid for the next and subsequent transactions is transmitted to the information terminal device when the transaction is completed.

The invention according to claim 4 of the electronic commerce security system according to the present invention is the invention according to claim 3, wherein the password is transmitted from the determination means to the card user every time one commercial transaction is completed. The invention described in claim 5 of the electronic commerce crime prevention system according to the present invention is characterized in that the updated personal identification number valid for the next and subsequent commercial transactions is public. It is characterized in that the card user is notified of the update by transmitting it to the portable terminal possessed by the card holder via a line.

The invention according to claim 6 of the electronic commerce security system according to the present invention relates to a system for performing settlement using a medium other than cash, such as a credit card or a cash card, capable of conducting a commercial transaction, which is related to the medium via a network or the like. Judgment means for receiving data such as an ID number and a password valid only for a predetermined number of commercial transactions to determine whether or not the commercial transaction has been completed, and performing the desired settlement processing when the commercial transaction has been completed, and A means is provided for notifying the card user of the update of the personal identification number by transmitting the updated personal identification number valid for commercial transactions to the cardholder's terminal or mobile terminal via a public line or the like.

The invention according to claim 7 of the electronic commerce security system according to the present invention is characterized in that, in the invention according to any one of claims 3 to 6, the information terminal device performs encrypted communication when transmitting and receiving various information. The personal identification number or an encoded number is used as a key for encrypted communication.

The invention according to claim 8 of the electronic commerce security system according to the present invention is a non-cash-enabled medium such as a credit card or a cash card. Recording means for recording the number of uses of the medium, and the authenticity of the medium is determined based on the number of uses.

The invention according to claim 9 of the electronic commerce security system according to the present invention is a recording system for recording the number of times of use of the medium in a non-cash medium such as a credit card, a cash card, etc. in a cumulative and non-subtractable manner. Means is provided, and the authenticity of the medium is determined by performing a rewriting operation by subtracting the number of uses. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a diagram showing an example of a card used in a security system for electronic commerce according to the present invention.

FIG. 2 is a diagram showing a schematic configuration of an electronic commerce security system according to the present invention.

FIG. 3 is a diagram showing an example of a data table included in the determination means in the electronic commerce security system according to the present invention.

FIG. 4 is a diagram showing one embodiment of the configuration of the electronic commerce security system according to the present invention.

FIG. 5 is a flowchart showing the operation of the electronic commerce security system according to the present invention.

FIG. 6 is a diagram showing another embodiment of the configuration of the electronic commerce security system according to the present invention.

FIG. 7 is a diagram showing another embodiment of the configuration of the electronic commerce security system according to the present invention. BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. First, fraudulent acts using cards and the like include physical acts such as counterfeiting cards, and non-physical acts such as illegally acquiring (frauding) ID numbers and PINs.

Therefore, in response to the physical act of force forgery, as shown in Fig. 1, it is assumed that no more than two identical patterns, such as a marble pattern, can be made as a pattern of force 1, and each pattern Correspondingly, a unique identification number is determined in advance. Note that a magnetic stripe is provided on the back surface of the card 1, and the magnetic stripe stores stored information such as the ID number of the card.

Therefore, at the time of commercial transaction, as shown in FIG. 2, the card 1 is inserted from the entrance 2a to the information terminal device 2 (unique identification information reading means and recorded information reading means), and the information terminal device 2 Reads the pattern of the card and transmits it to the host computer 4 via the network 3 such as a telephone line or a dedicated line together with the magnetic data information stored in the magnetic stripe of the force. The unique identification number based on the card pattern is compared with the magnetic data information to judge whether the card is a counterfeit card by a computer or other judging means to determine the success or failure of the commercial transaction.

FIG. 3 is a diagram showing a table of data collation data stored in the host computer 4. As shown in FIG. 3, one-to-one correspondence with recorded information (ID numbers, etc.) such as magnetic data is shown. The card unique identification number corresponding to the ID is stored, the card unique identification number is determined from the card pattern transferred from the information terminal device, and when the unique identification number and the magnetic data information such as the ID number match, Only allow commercial transactions.

In this way, the card itself can be provided with information (pattern) corresponding to a unique number and the authenticity of the card can be determined together with the magnetic data information stored in the magnetic stripe. Fraudulent acts such as unauthorized acquisition of information and transfer of various information to counterfeit information be able to. In the above embodiment, the data pattern of the force is transferred from the information terminal device 2 to the host computer 4 and the unique identification number of the card is determined by the host computer 4. 2 has a pattern reading device and a unique identification number judgment function, transfers the unique identification number and the information stored in the magnetic disk to the host computer 4, and transfers the information to the host computer 4. It may be configured to determine the authenticity of the password. By using a card having a unique identification number (pattern) as described above, the authenticity of the card can be determined, but if another person's card is found and the person who has found it misuses it, It is difficult to prevent fraudulent activities as long as the genuine force is used. Therefore, a system having an identity verification function will be described below.

FIG. 4 is a diagram showing the configuration of an electronic commerce security system according to the present invention. 2 is an information terminal device for reading patterns and magnetic data which are unique identification numbers of force, and 5 is for centrally managing an identity verification function. 6 is a host computer of a financial company (card issuing company), 7 is a display device that is attached to an information terminal device and displays information, etc., and 8 is a keyboard and other devices. It is a data input device (data input means). The security system for e-commerce is described below with reference to Figs.

First, prior to use, the card user obtains a password that can be used only once from a card company or the like (step S1), and sends a password 1 to the information terminal device 2 when using the card. It is inserted (step S2), and the password is input from the data input device 8 (step S3). Then, from the information terminal device 2, the unique identification information (pattern) of the card 1, the recording information such as the ID number stored in the magnetic data of the card 1, and the password A are transmitted via the network. Transferred to the host computer overnight 5 and the host computer In step 5, referring to the table as shown in FIG. 3, it is determined whether or not the force unique identification number matches the magnetic data storage information (step S4). If it is determined that the password is genuine (YES in step S4), it is determined whether or not the entered passwords match (step 5), and the commercial transaction is permitted only when the passwords match (step S6). ) Then, data B such as the purchase amount information and payment method for performing settlement by force are transferred from the information terminal device 2 to the host computer 6 of the financial company via the host computer 5 (step S 7), a commercial transaction is executed.

Thereafter, a new password (updated password) valid at the next business transaction is returned to the information terminal device 2 via the network from the update notification means of the host computer 5 that centrally controls the personal identification function (step S8). ), The password is displayed on the display device 7 (step S9). The card user memorizes or keeps a record of the updated personal identification number and uses it for the next commercial transaction. When a new PIN is returned, the PIN stored in the host convenience store 5 is also rewritten to prepare for the next commercial transaction. On the other hand, if the card unique identification information does not match the magnetic data, or if the PIN does not match (NO in S4 or S5), the card has been forged or the identity of the card user cannot be verified. Judgment is made, the commercial transaction is rejected, and a message to that effect is displayed on the display device 7 attached to the information terminal device 2 (step S10).

In the case of a request for suspension of use of the card due to loss of the card or suspension of use due to delinquency of payment (including deregistration), the host computer which centrally manages the identity verification function from the host company 6 of the financial company. The night is transferred on evening 5, and the available flags (see Fig. 3) are changed by the judgment means in the host computer overnight 5.

In the above embodiment, the personal identification number is updated for each commercial transaction. It may be changed every time. In addition, a part for storing the security code to be updated on the card is provided, and the information terminal device is provided with a function to update the security code. Before using the card, the updated security code stored in the password and data input are entered. The identification of the force holder may be performed by comparing the password with the password input from the device.

The updated security code and the fixed security code are used to store the updated security code on the card.On the other hand, the fixed security code is entered by the user to confirm the identity when using the card. The security can be further improved by using a double password in such a manner.

That is, in the electronic commerce security system according to the present invention, the authenticity of the card itself is determined by the unique identification information based on the force pattern and the magnetic storage information, and is effective for one or a predetermined number of commercial transactions. The host computer, which centrally controls the personal identification function, notifies the card holder of a personal identification number, and performs personal identification by comparing the personal identification number entered during commercial transactions with the stored personal identification number. Secure electronic commerce can be realized.

In the above security system, the communication between the information terminal device 2 and the host computers 4 and 5 and the communication between the host computers 4 and 5 and the host computer 6 of the financial company are to improve security. Perform encrypted communication. In this case, a common key cryptosystem is used, and the personal identification number of the card is used as the common key. In the common key cryptosystem, usually, information intended only for encrypted communication is used as a common key.However, in the above-mentioned system, the password is changed every time a commercial transaction is made. Keys are changed frequently, and cryptographic communication is extremely secure, enabling more reliable e-commerce. If the password cannot be used directly as the common key, for example, when the data length of the password and the common key are different, What is encoded according to a predetermined rule may be used as a common key.

It is also possible to perform encrypted communication using public key cryptography instead of symmetric key cryptography, in which case the secret number is used for the public key. Since it becomes public and there is a security problem, it is only necessary to use a code obtained by encoding a personal identification number according to a certain rule as a public key.

Also, in this embodiment, the case where the variable password method is used for electronic settlement is described, but it is widely used for cryptographic communication for transmitting and receiving important data after inputting the variable password, such as data transmission with personal authentication. Applicable.

FIG. 6 is a diagram showing another configuration of the electronic commerce security system according to the present invention. In the embodiment shown in FIG. 4, the updated personal identification number is displayed on the display device 7 installed in the store or the like, so that the personal identification number can be visually recognized by anyone other than the force holder. Although the security was not perfect, as shown in Fig. 6, the updated PIN was transferred to the mobile terminal 9 owned by the force holder on a network such as a public network By transmitting the data as voice or electronic data via 0, the security can be further improved. Note that only the method of transmitting the updated personal identification number is different, and the other processes are the same as those in the above-described embodiment, and thus description thereof will be omitted.

FIG. 7 is a diagram showing another configuration of the electronic commerce security system according to the present invention. In recent years, personal commerce has often been conducted via the Internet, especially due to the spread of convenience stores and the establishment of the Internet infrastructure. This will be described with reference to FIG.

In the figure, 5 is a host computer for centrally managing the identity verification function, 6 is a host computer of a financial company (card issuing company), 10 is a network such as a public line or the Internet, and 11 is a product or service. etc Terminal device of a service provider that provides and provides services via the Internet, etc.

Reference numerals 1 and 2 denote terminal devices of purchasers of goods and services.

If the purchaser (card holder) wishes to purchase a product, the credit card is required to settle the personal information such as his / her address and the price to the service provider. The personal identification number used only is transferred to the terminal device of the service provider via the network 10. The service provider transfers the commercial transaction data to the host computer 5 using the terminal device 11 or the information terminal device 2 (not shown), and the host computer 5 determines whether or not the passwords match by the determination means. And decide whether or not to establish a commercial transaction.

If the password is correct, the host computer 5 performs a predetermined settlement process, and further updates the password used for the next and subsequent business transactions via the public line or the like to the terminal device 12 or the like of the purchaser. Alternatively, it is transmitted to the portable terminal 9 owned by the purchaser. As a result, even when conducting business transactions without physically using the card itself, the PIN for card use is updated for each prescribed transaction, and the updated PIN is only available to the cardholder. Because it can be grasped, it is possible to conduct secure transactions.

In addition, the present invention is not limited to commercial transactions using cards, but also to commercial transactions using no cards, for example, electronic transactions during a computer, etc., in which an ID number, a personal identification number, etc. are illegally used by others. It also works effectively to prevent illegal activities.

Next, another configuration of the electronic commerce security system according to the present invention will be described. Generally, data that is magnetically recorded on a cash card or credit card is rewritable and may be forged. For IC cards, card-specific information is stored in a non-rewritable memory (ROM) in advance, but information that needs to be changed when using the card is rewritable. May be forged because it is stored in a functional memory (RAM).

On the other hand, various information is recorded on the card, and the number of times the card has been used is often recorded, but the number of times the number of uses changes every moment with the use of the card. It has the characteristic that it does not decrease.

Therefore, the authenticity of the card is determined using the number of times of use. (E) A recording means such as a non-rewritable memory is installed in the C card in advance, and the number of times of use of the IC card is cumulatively recorded therein. The number of uses is added to the IC card according to the use.

For example, consider the case where there is an IC card that has been used three times and this IC card is used again. When the IC card is used, the IC card reader is taken into the IC terminal reader / writer as an information terminal device, and "3 times" In addition to the number of times of use, various types of data are read. Then, the number of uses of the IC card is added up, and a record of “4 times” is recorded. Before that, it is determined whether the card is a counterfeit card. Here, the number of times of use (for example, 3-1 = 2 times) less than the current number of uses is recorded on the IC card. After performing such a write operation using the IC reader / writer, read the IC card usage count data again from the IC card reader / writer and read it as "3 times". If the card is read as "Authentic C card" when it is rewritten and "2 times" after rewriting, it is judged as a fake IC card.

It also checks the number of uses with the host computer. The usage count read by the IC card reader is input to the host computer via the network, and if it does not match the usage count recorded on the host computer, it is determined to be a counterfeit card and matches. If so, the card is judged to be a true card. Since the number of times of use changes every moment with the use of the card, even if a fake card is created by reading the data from an authentic IC card Even if the IC card was subsequently used, the data on the number of times of use was rewritten and the information on the authentic IC card was changed, so the card was used afterwards. It can be determined that the missing IC code is counterfeit.

If it is determined that the card is an authentic IC card, write to add the number of uses, and record 3 + 1 = “4 times”. The number of times of use recorded in this way changes every moment with the use of the card, and can be increased by re-recording but cannot be reduced, so it is extremely effective in determining the authenticity of an IC card. is there.

There are various types of non-rewritable memory that can be incorporated into the IC at the manufacturing stage. For example, a method of cumulative writing to the write area of a memory that can be written only once Alternatively, an optical system such as a read-up-once CDR may be used.

It should be noted that the number of uses in the IC card may be recorded not only for each use but also for every predetermined number of uses, for example, every 10 times.

According to the first aspect of the present invention, it is not possible to create two or more identical cards, thereby preventing forgery of a card or the like, and preventing the storage data stored in the card from being physically forged. Since the authenticity of the password is determined by collating with the unique identification number of the card, it is possible to prevent the transaction by the counterfeit password and to perform the business transaction safely.

In the invention described in claim 2, since the authenticity of the card is determined by comparing the stored data stored in the force card with the unique identification number of the card, it is possible to prevent transactions with counterfeit cards and to conduct business transactions safely. it can.

According to the invention described in claim 3, by using a personal identification number and a unique identification information of a password, which are changed for each predetermined business transaction, and storage information stored in a card, Since the authenticity and identity of the card can be confirmed, business transactions can be performed more safely.

According to the invention described in claim 4, the authenticity of the card and the identity verification can be confirmed by using the personal identification number and the unique identification information of the password, which are changed for each commercial transaction, and the memory information stored in the card. It is possible to conduct business transactions even more safely.

According to the invention described in claim 5, since the variable update PIN is transmitted to the mobile terminal or the like of the card holder via the public line, only the card user can know the PIN notified of the update. Business transactions can be carried out even more securely.

According to the invention described in claim 6, an ID number such as a credit card and a valid PIN are transmitted only for a predetermined number of commercial transactions, the commercial transaction is permitted only when the PIN coincides with a predetermined PIN, and the next Since the updated security code valid for subsequent commercial transactions was transmitted to the cardholder's terminal or mobile terminal via a public line, etc., the security code was not leaked to a third party and secure business transactions were conducted. be able to.

According to the invention of claim 7, when the information terminal device transmits and receives various types of information, the information terminal device performs cryptographic communication and uses the personal identification number or a code obtained by encoding the personal identification number as a key for symbol communication. It can carry out extremely high-reliability electronic commerce.

In the invention described in claim 8, a recording means for recording the number of times the medium has been used is provided on a non-cash medium such as a credit card or a cash card that can be used for business transactions, and the authenticity of the medium is determined based on the number of uses. Therefore, it is possible to prevent transactions with counterfeit cards by making use of the characteristics of the ever-changing number of times of use, and to conduct business transactions safely.

According to the invention described in claim 9, a credit card, a cash card, etc. A recording means for recording the number of times of use, cumulatively and non-subtractably, is provided on a medium other than cash that can be traded, and the rewriting operation is performed by subtracting the number of uses to judge the authenticity of the medium. By utilizing the characteristic of the number of times of use that does not change even if the number changes and the number increases, it is possible to prevent transactions with counterfeit cards and conduct business transactions safely.

Claims

The scope of the claims

1. A medium unique to the medium, such as a credit card or a cash card, that can be used for commercial transactions, is provided with a pattern unique to the medium, and the medium is identified by comparing the medium-specific identification number based on the pattern with the information stored in the magnetic data of the medium. An electronic commerce security system characterized by determining the authenticity of the e-commerce.

2. A medium other than cash, such as a credit card or a cash card, which can be used for commercial transactions, and a medium-specific identification information reading means for reading a pattern unique to the medium and a recording information reading means for reading recording information such as magnetic data of the medium. An information terminal device comprising:

A security system for electronic commerce, comprising: means for comparing the information unique to the medium and the recorded information transferred from the information terminal device to determine the authenticity of the card. ·

3. The information terminal device includes a data input unit capable of inputting a personal identification number, and the determining unit determines the authenticity and identity of the card based on the medium unique identification information, the record information and the personal identification number, and completes the transaction. 3. The electronic commerce crime prevention system according to claim 2, wherein an updated personal identification number valid for the next and subsequent commercial transactions is sometimes transmitted to the information terminal device.

4. The electronic commerce security system according to claim 3, wherein the personal identification number is notified to the card user by the determination means every time one commercial transaction is completed.

5. The updated personal identification number valid for the next and subsequent commercial transactions is notified to the card user by transmitting the updated personal identification number to the portable terminal owned by the force holder via a public line. Electronic commerce security system described

6. Non-cash commercial transactions such as credit cards and cash cards are possible In a system for performing settlement using a medium, a means for receiving data such as an ID number related to the medium and a password valid only for a predetermined number of commercial transactions over a network or the like, and determining whether or not the commercial transaction has been established. ,

Perform the desired settlement processing when the commercial transaction is completed, and transmit the updated password valid for the next and subsequent business transactions to the terminal of the mobile phone holder or a mobile terminal via a public line or the like. A security system for e-commerce, characterized in that the system has a means for notifying a user of a password update.

7. The information terminal device performs cryptographic communication when transmitting and receiving various information, and uses the password or a code obtained by encoding the password as a key for cryptographic communication. An electronic commerce security system according to any one of the preceding claims.

8. A means for recording the number of times the medium has been used is provided on a medium other than cash, such as a credit card, cash card, etc., which can be used for commercial transactions, and the authenticity of the medium is determined based on the number of times the medium has been used. E-commerce security system.

9. A non-cash readable medium such as a credit card or a cash card is provided with a non-rewritable recording means, and the recorded contents of the recording means are rewritten to judge the authenticity of the medium. E-commerce crime prevention system.