JP2003337917A - Personal identification system by mobile terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal identification system by a mobile terminal which has high security and high certainty and is free of complexity. <P>SOLUTION: A store-side terminal 1 is connected to a center server 5 through a communication means 7 and the center server 5 is connected to a mobile terminal 3 of a user through the communication means 7; and the store-side terminal 1 reads user card information of the user out and sends the card information to the center server 5, which has a function of sending mail to the user's mobile terminal 3 when receiving the card information and a function of identifying the user according to a ciphered answer signal to the mail. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system for confirming the identity of a person using a portable terminal when shopping using a credit card or the like.

[0002]

2. Description of the Related Art In a conventional system, when shopping with a credit card, a customer hands over the credit card to a store clerk, and the store clerk sends it to a credit company from a card reader installed in the store. . When the purchase amount is large, the credit company calls the customer and confirms the purchase intention. At that time, in order to confirm whether or not the customer is the person himself, a staff member of the credit company asked the person's date of birth and the like to prevent any trouble.

[0003]

The above conventional system has the following problems. When shopping with a credit card, there was a high risk of being exposed to illegal activities called skimming. The problem is that a store clerk or the like reads the magnetic data of a credit card and copies it onto a counterfeit card for unauthorized use without the knowledge of the shopper. Also, calling a customer from a credit company is labor intensive. Further, personal information such as the date of birth of the customer is known to the store side. Therefore, an object of the present invention is to prevent damage even if the card information is copied due to an illegal act such as skimming by strict identification verification. In addition, it is to save manpower by the computer automatically performing identity verification. Furthermore, when the identity is confirmed by a phone call from a credit company or the like, the store side does not need to call the customer to confirm the identity. That is, it is to provide a personal identification system that has high security and certainty and is not complicated.

[0004]

According to a first aspect of the present invention, a store side terminal is connected to a center server via a communication means, and a center server is connected to a user's mobile terminal via a communication means. The side terminal reads the user card information of the user and transmits this card information to the center server, and when the center server receives the card information, a function of transmitting an email to the mobile terminal of the user,
It is characterized in that it has a function of confirming the identity based on the encrypted response signal to the mail.

In a second aspect based on the first aspect, the center server includes a processing section and a storage section, and the storage section stores the user identification information stored in the user card and the user identification information. The mobile terminal number and the personal identification number associated with are stored, the processing unit, when receiving the user identification information from the store side terminal, extracts the personal identification number associated with this user identification information from the storage unit, The personal identification number transmitted from the user's mobile terminal is compared with the extracted personal identification number, and if they match, it is determined that the person has been confirmed.

According to a third aspect of the present invention, in the second aspect of the present invention, information that can be used for the purpose of reinforcing identification of the personal identification number is transmitted from the user's mobile terminal to the center server. When the information that can be used for the above purpose is appropriate, the person is judged to be the person.

[0007]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT FIG. 1 shows an embodiment of the present invention. As illustrated, the shop-side terminal 1 in the shop A, the mobile terminal 3 of the user B, and the center server 5 are connected via the communication means 7. Further, the bank server 11 of the financial institution 9 is connected to the center server 5. As the store-side terminal 1, one having a card reading function and a connection function with a communication line like a POS terminal can be considered.

[0008] For the operation of this system, it is premised that a store that sells products is registered in the center as a member store and a person who wants to purchase the product is registered in the center as a user. Therefore, this system can be used only by registered shops and registered users. In this embodiment, when the user B tries to purchase a product at the member store A, the user card 13 is presented instead of paying in cash. The user card 13 has computer-readable card information. Here, the bar code is used as the card information. That is, the user card 13 is a card with a barcode. Further, the store-side terminal 1 of the member store A is provided with a card reader capable of reading a barcode. Then, the card information read by the card reader is transmitted to the center server 5 via the shop terminal 1. In addition,
The card reader is assumed to have a function of reading not only a user card but also a barcode attached to a product.

When the card information is transmitted to the center server 5, the processing unit 15 of the center server 5 can identify the attribute of the card from the bar code which is the card information. The attribute is a user ID. The center server can identify the user by this user ID. On the other hand, a storage unit 17 is connected to the processing unit 15 of the center server 5. The user ID is stored in the storage unit 17 at the time of user registration, and the user personal information associated with this user ID is stored. The user personal information includes a deposit account number, a mobile terminal number, a personal identification number, and the like. Processing unit 15 of the center server 5
When the user ID is obtained from the card information, the storage unit 1
From 7, the deposit account number corresponding to the above user ID,
User personal information such as mobile terminal number and personal identification number is extracted.

Further, the terminal 1 of the store A stores a store ID as store information, and when the card information is transmitted to the center server 5, this store information is also transmitted to the center server 5 at the same time. . Further, the bar code of the product that the user B intends to purchase is read by the card reader and the product information is transmitted to the center server 5. As the product information, at least the product price is required.

The storage unit 17 of the center server 5 stores the mobile terminal number and the personal identification number of the user B. Therefore, when the center server 5 receives the user ID, the shop ID, and the product information from the shop-side terminal 1, the center server 5 sends an email to the mobile terminal 3 of the user B for identity verification. User B
Enters his / her personal identification number and sends it to the center server 5.

The input personal identification number is encrypted and then transmitted to the center server 5 via the communication line. The reason for encrypting the personal identification number in this way is as follows. That is, if the personal identification number is transmitted without being encrypted, there is a risk that it will be eavesdropped during the transmission, so that the encryption is essential for ensuring security. Further, mail is not a suitable method for sending a personal identification number from the user to the center server. When a user sends an email, a transmission history remains in the user's mobile terminal. This is because it is easy to forget to delete this transmission history, and if the mobile terminal is stolen, the personal identification number will be known from the transmission history to a third party. So W
A method of transmitting the personal identification number using the eb page is suitable.

The processing unit 15 of the center server 5 compares the personal identification number extracted from the storage unit 17 with the personal identification number sent from the user B, and if they match, the user B identifies himself. To confirm. The center server 5
When the identity is confirmed, a signal for instructing payment is transmitted to the bank server 11. Here, the identity verification is to verify that the person who presented the user card and came to the shop is the person who has registered the user. It is to confirm that you are not the person who illegally uses the card by stealing or picking up another person's card.

[0014] In addition, only by confirming the identity by the personal identification number,
Not always enough. This is because the user card and the mobile terminal may be stolen by a third party and the personal identification number may be found. It is not impossible to guess the personal identification number because many people use the date of birth or the telephone number as the personal identification number. Therefore, in order to reinforce the personal identification by the personal identification number, it is desirable that the user input some information other than the personal identification number to make the personal identification more reliable. In this case, as the information other than the personal identification number, information that can be known only by a person who is actually shopping at the store is appropriate. Detailed description will be given later.

The information flow of the present system and the processing centering on the center server 5 along the information flow will be described below. For example, when the user B uses this system to purchase a product from the member store A, the user B presents his / her user card 13 to the staff member of the member store A. The above staff is
The user B deposits the card 3 and causes the card reader to read the bar code information of the card 3. Since the card reader is connected to the shop terminal 1, the read card information is transmitted to the center server 5.

The terminal 1 stores a store ID.
Therefore, when transmitting the above card information, the store ID is also transmitted. Further, the shop terminal 1 causes the connected card reader to read the barcode attached to the target product. Then, the shop terminal 1 transmits the read product information to the center server 5. As the product information, the product price is essential. In this way, the center server 5
Can receive a user ID, a shop ID, and product information from the shop terminal 1.

The processing unit 15 of the center server 5 extracts the corresponding mobile terminal number and personal identification number from the storage unit 17 based on the user ID. The processing unit 15 sends an email to the mobile terminal 3 of the user B based on the extracted mobile terminal number. An example of transmission / reception between the center server 5 and the user B via the mobile terminal 3 will be described with reference to FIG. The content of the mail sent from the center server 5 to the mobile terminal confirms the intention of the user B, as illustrated in FIG. When user B wants to make a payment, a URL (https: // www) corresponding to [YES]
If you select w-yes) and do not wish to pay, click [N
URL corresponding to O] (https: // www-n
Select o). The web page specified by the above URL is displayed on the display screen of the mobile terminal of the user B. Here, when the user inputs the personal identification number and clicks the send button, the personal identification number is transmitted to the center server 5. Here, as a means of encrypting the personal identification number,
Several means are possible. For example, as a simple means, h
The use of the ttps protocol is conceivable. Normally, in the http protocol used, the personal identification number is transmitted in plain text, which poses a risk of being intercepted by another person. However, https
With the protocol, the personal identification number is encrypted and transmitted, and is decrypted when the other party receives it, so it is safe.

The processing unit 15 compares the personal identification number extracted from the storage unit 17 with the personal identification number sent from the user B. If the passwords match, the processing unit 1
No. 5 judges that the identity was confirmed. Unless there is a special circumstance such as the mobile terminal 3 being stolen, it can be considered that the owner of the mobile terminal 3 is the owner. What's more, if you receive a personal identification number that only you know,
With a high probability, you can judge that you are the person. Here, even if a third party steals the user card 13 and tries to impersonate the user B for shopping, the mobile terminal 3 must be stolen. Even if the mobile terminal 3 is stolen, it is difficult to know the personal identification number, so that the illegal attempt is unlikely to succeed.

However, it cannot be said that there is no case where the user card and the portable terminal are stolen by a third party and the personal identification number is found. Therefore, for example, as shown in FIG. 2, as the information other than the personal identification number, when the shopping amount (= product price) is input, the certainty of the identity confirmation is enhanced. Entering the product price has the following advantages. First, when the card presenter and the mobile device holder are in different places (for example, in the case of a criminal group)
Can prevent the crime from being established. This is because the amount of money for shopping must be decided in advance by colleagues, and at least an ad hoc crime can be prevented. Secondly, if the shopping amounts are the same, it is possible to judge the person with high probability. However, if the center server reports that the card and mobile device have been stolen, the current criminal can be arrested. In addition, a by-product that can prevent fraudulent billing of merchandise price on the store side can be expected. As shown in FIG. 2, the information other than the above-mentioned personal identification number may be input only when the user wants to make a payment.

When the processing unit 15 confirms the identity, the center server 5 determines that the bank server 11 of the financial institution 9
To the deposit account of the store A from the deposit account of the user B. When the bank server 11 receives the remittance command signal, the settlement process is started. The settlement process in the financial institution 9 is not a problem that the present invention intends to solve. Therefore, it will be briefly described below.

The center server 5 thus receives the user information and the like from the terminal 1, sends and receives mail, confirms the identity, and issues a settlement instruction to the bank server 11 to perform a series of processes. All of these processes are automatically performed without any human intervention. Therefore, labor costs can be reduced as compared with the conventional identification by telephone. In addition, the staff of the store A does not need to take the trouble of telephone transfer. Furthermore, after the user B purchases the product, the confirmation processing is instantly performed, and the processing proceeds to the settlement processing. As described above, the present invention can provide a system that is quick and hassle free for both a store and a customer.

Moreover, the portable terminal is used as a means for confirming the identity from the center server, and the personal identification number is collated. Further, the personal identification number is transmitted from the person himself / herself to the center server in an encrypted manner, and other information is appropriately transmitted to reinforce the identification by the personal identification number. In this way, double and triple security measures are taken. Therefore, the user of this system can safely receive the service provided by this system.

Further, the user can leave a transmission / reception record in the center server by transmitting / receiving information to / from the center server via the portable terminal. This is convenient when a dispute arises at a later date. This is an advantage that the conventional confirmation method using a telephone does not have.

In the above embodiment, the mobile terminal is used as the personal identification means, but a mobile terminal or the like may be used.
Further, the card reader connected to the terminal on the store side may be integrated with the terminal or may be independent. Furthermore, the user card is not limited to a card with a barcode. It may be a magnetic card or an IC card.

Next, an example of the settlement method will be briefly described. The financial institution 9 includes a deposit account 19a for store A, a deposit account 19b for user B, and a deposit account 19c for a credit company. The center server 5 transmits a transfer command and a transfer amount (= product price) from the deposit account 19b of the user B to the deposit account 19a of the store A to the bank server 11 of the financial institution 9. The bank server 11 compares the deposit balance of the deposit account 19b of the user B with the transmitted product price. When the deposit balance is larger than the merchandise price, the merchandise price is transferred from the user B's deposit account 19b to the store A's deposit account 19a. When the remittance is completed in this way, the bank server 11 sends a remittance end signal to the center server 5,
The center server 5 sends a remittance end signal to the terminal 1 of the store A. The store A confirms this remittance and then the user B
You can hand the goods to.

On the other hand, when the deposit balance is less than or equal to the product price, the bank server 11 transmits to the center server 5 a message that the balance is insufficient. The center server 5 sends an email to the mobile terminal of the user B to confirm the intention of borrowing from the credit company. The user B returns the intention of borrowing to the center server 5 by YES or NO by e-mail. When YES is transmitted as the intention of borrowing, the center server 5 commands the bank server 11 to transfer money from the deposit account 19c of the credit company to the deposit account 19b of the user B. The amount of money to be sent once is determined by the contract between the credit company and the user B. The bank server 11 transfers the amount of money determined by this contract from the deposit account 19c of the credit company to the deposit account 19b of the user B. After that, the bank server 11 sends the amount corresponding to the product price from the deposit account 19b of the user B to the deposit account 19a of the store A. When the above process is completed, the bank server 11 sends a remittance end signal to the center server 5, and the center server 5 sends a remittance end signal to the terminal 1 of the store A. The store A confirms this remittance and then the user B
You can hand the goods to.

[0027]

According to the first and second aspects of the invention, the center server automatically contacts the terminal of the customer directly from the center server, and the center server also automatically confirms whether or not the customer himself or herself. It can save manpower. In addition, it is possible to prevent a secret code from being intercepted by a third party. According to the third invention, it is possible to increase the certainty of identity verification as compared with the first and second inventions.

[Brief description of drawings]

FIG. 1 is an overall conceptual diagram of an embodiment of the invention.

FIG. 2 is an example of a display screen when transmitting and receiving between a user and a center server via a mobile terminal.

[Explanation of symbols]

Store A B user 1 store side terminal 3 mobile terminals 5 Center server 7 Communication means 13 user card 15 Processor 17 Memory

─────────────────────────────────────────────────── ─── Continued Front Page (51) Int.Cl. ⁷ Identification Code FI Theme Coat (Reference) H04L 9/32 H04L 9/00 673A

Claims (3)

[Claims] 1. A store side terminal is connected to a center server via a communication means, a center server is connected to a user's mobile terminal via a communication means, and the store side terminal stores user's user card information. It reads and sends this card information to the center server, and when the center server receives the card information, it sends a mail to the mobile terminal of the user based on the function and the encrypted response signal to the mail. , A personal identification system using a mobile terminal, which has a function of performing personal identification. 2. The center server includes a processing unit and a storage unit, and the storage unit stores user identification information stored in a user card, and a mobile terminal number and a personal identification number associated with the user identification information. When the user identification information is received from the store-side terminal, the processing unit extracts the personal identification number associated with the user identification information from the storage unit, and is transmitted from the mobile terminal of the user. The personal identification system according to claim 1, wherein the personal identification number is compared with the extracted personal identification number, and if the personal identification numbers match, it is determined that the personal identification has been completed. 3. The center server sends information that can be used for the purpose of reinforcing the identification by the personal identification number from the mobile terminal of the user, and the processing unit of the center server receives the information that can be used for the above purpose. The personal identification system using a mobile terminal according to claim 2, wherein the personal identification is determined when appropriate.