Authentication system, authentication method, and computer program

Abstract

To provide a technique for implementing appropriate authentication related to the use of a credit card.SOLUTION: An authentication system 54 stores a public key of a user of a credit card registered in a member-only website 21 of the credit card. The authentication system 54 transmits, on receipt of a request for authentication on the user, a challenge code to a terminal (user terminal 30) of the user. The authentication system 54 receives signature data based on the challenge code and a secret key of the user, the signature data being transmitted from the user terminal 30, and verifies the signature data using the public key of the user registered in advance. The authentication system 54 outputs a result of the authentication on the user based on a result of verifying the signature data.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to data processing technology, and more particularly to an authentication system, an authentication method, and a computer program. [Background technology]

[0002] To prevent fraudulent use of credit cards, there is a need to improve the reliability of personal authentication. Personal authentication methods include, for example, authentication using a one-time password and risk-based authentication (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 7445074 Summary of the Invention [Problem to be solved by the invention]

[0004] One-time password authentication requires credit card users to enter a one-time password, which increases the user's workload, while risk-based authentication may miss fraud if the risk score is not calculated appropriately.

[0005] The present disclosure has been made in consideration of such problems, and one of its objectives is to provide a technology that realizes suitable personal authentication related to the use of credit cards. [Means for solving the problem]

[0006] In order to solve the above problems, an authentication system according to one aspect of the present disclosure includes a memory unit that stores the public key of a credit card user registered on a credit card member site, an authentication request receiving unit that receives a request for identity authentication for the user, a challenge sending unit that sends a challenge code to the user's terminal, a signature receiving unit that receives signature data based on the challenge code and the user's private key sent from the user's terminal, a signature verification unit that verifies the signature data using the user's public key stored in the memory unit, and an authentication result output unit that outputs the result of identity authentication for the user based on the verification result of the signature data.

[0007] Another aspect of the present disclosure is an authentication method, in which a computer that can access a storage unit that stores a public key of a user of a credit card registered on a credit card member site performs the following steps: accepting a request for personal authentication of the user, transmitting a challenge code to the user's terminal, accepting signature data based on the challenge code and the user's private key transmitted from the user's terminal, verifying the signature data using the user's public key stored in the storage unit, and outputting a result of personal authentication of the user based on the verification result of the signature data.

[0008] Any combination of the above components, or any expression of the present disclosure converted between an apparatus, a computer program, a recording medium storing a computer program, etc., is also valid as an aspect of the present disclosure. [Effects of the Invention]

[0009] According to the technology of the present disclosure, it is possible to realize suitable personal authentication for use of a credit card. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating a configuration of an information processing system according to an embodiment. [Figure 2] FIG. 2 is a sequence diagram illustrating an operation of the information processing system according to the embodiment. [Figure 3] FIG. 2 is a sequence diagram illustrating an operation of the information processing system according to the embodiment. [Figure 4] FIG. 2 is a sequence diagram illustrating an operation of the information processing system according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] The subject of the system, device, or method of the present disclosure includes a computer. The computer executes a computer program to realize the functions of the subject of the device or method of the present disclosure. The computer includes, as its main hardware configuration, a processor that operates according to the computer program. The type of processor is not important as long as it can realize the functions by executing the computer program. The processor is composed of one or more electronic circuits including semiconductor integrated circuits (IC, LSI, etc.). The computer program is recorded on a non-transitory recording medium such as a computer-readable ROM, optical disk, or hard disk drive. The computer program may be pre-stored on the recording medium or may be supplied to the recording medium via a wide area communication network including the Internet.

[0012] In the embodiment, we propose a technology that realizes suitable personal authentication for credit card use. Personal authentication in the embodiment is the act of confirming over a computer network that a person using a credit card to purchase goods or the like (hereinafter referred to as "user") is a legitimate individual who can use the credit card.

[0013] Specifically, the authentication system of the embodiment (authentication system 54 described below) strengthens authentication of the member-oriented website of a credit card issuer (hereinafter also referred to as "issuer") by using a passkey (in other words, FIDO2) to prevent unauthorized logins to the member-oriented website. Furthermore, the authentication system of the embodiment uses the member's passkey (specifically, a public key) registered on the issuer's member-oriented website as the EMV (trademark or registered trademark)-3D Secure identity authentication method when using a credit card. The authentication system of the embodiment applies challenge authentication to all identity authentication cases, thereby maintaining the reliability of identity authentication. Furthermore, the authentication system of the embodiment does not require the entry of a one-time password, thereby reducing the effort required of credit card users and improving the customer experience.

[0014] 1 shows the configuration of an information processing system 10 according to an embodiment. The information processing system 10 includes an issuer server 20, a user terminal 30, an affiliated store server 40, a payment agent server 50, a 3DS requester / server 52, and an authentication system 54. The devices and systems that make up the information processing system 10 are connected via a communication network, such as a LAN, a WAN, or the Internet.

[0015] The issuer server 20 is an information processing device that provides a member site 21, which is a website for members of credit cards issued by the issuer. The user terminal 30 is an information terminal operated by a credit card user. The user terminal 30 may be, for example, a PC, a tablet terminal, or a smartphone. The affiliated store server 40 is an information processing device that provides an e-commerce website (EC site 41) for affiliated stores, which are retail stores that have contracts with credit card companies.

[0016] The payment agency server 50 is an information processing device of a payment agency that acts as an intermediary between credit card companies and affiliated stores. The payment agency server 50 cooperates with a device of the credit card company (not shown) to execute payment processing based on the credit card user's confidential information (credit card number, etc.) transmitted from the user terminal 30. The 3DS requester / server 52 is an information processing device of an EMV-3D Secure personal authentication service provider. The EMV-3D Secure compatible version of the personal authentication service provider in this embodiment is 2.3.1.

[0017] The authentication system 54 includes an ACS 60 and an authentication server 70. The ACS 60 is an information processing device that serves as an access control server that realizes EMV-3D Secure. The authentication server 70 is an information processing device that performs authentication of the credit card user. In the embodiment, the authentication server 70 performs authentication of the credit card user by FIDO (Fast IDentity Online) authentication (challenge authentication in the embodiment).

[0018] 1 includes block diagrams showing functional blocks provided in the user terminal 30, functional blocks provided in the ACS 60, and functional blocks provided in the personal authentication server 70. Each block shown in the block diagrams in this specification can be realized in hardware terms by elements such as a computer processor (e.g., CPU) and memory, electronic circuits, or mechanical devices, and in software terms by a computer program, etc., but here, functional blocks realized by the cooperation of these elements are depicted. Therefore, it will be understood by those skilled in the art that these functional blocks can be realized in various ways by combining hardware and software.

[0019] The functions of the functional blocks of each device may be implemented in a computer program, which may be installed in the storage of each device. The processor of each device may load the computer program into a main memory and execute it to perform the functions of each functional block.

[0020] The user terminal 30 includes a key generation unit 31. The key generation unit 31 generates a pair of a private key and a public key of a credit card user. The private key may be shared by multiple user terminals 30 (for example, between a PC and a smartphone) used by the same user using a known method.

[0021] The ACS 60 includes an authentication request receiving unit 61, a challenge obtaining unit 62, a challenge transmitting unit 63, a signature receiving unit 64, a signature verification result obtaining unit 65, and an authentication result output unit 66. The authentication request receiving unit 61 receives a request for personal authentication of a credit card user. Specifically, the authentication request receiving unit 61 receives a request for personal authentication of a user transmitted from the 3DS requester / server 52 when the user uses a credit card at the affiliated store's e-commerce site 41.

[0022] The challenge acquisition unit 62 acquires a challenge code from the authentication server 70. The challenge code is, for example, a random character string. The challenge transmission unit 63 transmits the challenge code to the user terminal 30.

[0023] The signature acceptance unit 64 accepts signature data based on the challenge code and the user's private key transmitted from the user terminal 30. The signature data in this embodiment includes data obtained by encrypting the challenge code with the user's private key (hereinafter also referred to as a "signed challenge code").

[0024] The signature verification result acquisition unit 65 transmits the signature data accepted by the signature acceptance unit 64 to the personal authentication server 70 and acquires the verification result of the signature data by the personal authentication server 70. The verification result of the signature data includes information on whether the validity of the signature data has been confirmed, in other words, includes information indicating whether the signature data is valid or invalid.

[0025] The authentication result output unit 66 outputs the result of personal authentication for the user based on the result of signature data verification. In the embodiment, the authentication result output unit 66 transmits the result of personal authentication for the user to the 3DS requester / server 52, which is the source of the request for personal authentication. If the result of signature data verification indicates that the signature data is valid, the authentication result output unit 66 outputs a result indicating that personal authentication was successful. If the result of signature data verification indicates that the signature data is invalid, the authentication result output unit 66 outputs a result indicating that personal authentication failed.

[0026] The personal authentication server 70 includes a memory unit 71, an authentication request receiving unit 72, a challenge sending unit 73, a signature receiving unit 74, a signature verification unit 75, and an authentication result output unit 76. The memory unit 71 stores the public key of the user of the credit card (in other words, the card member) registered via the issuer's member-oriented site 21. The memory unit 71 stores the user's identification information in association with the user's public key. The user's identification information may be a unique ID assigned to the user by the issuer, or may be the user's login ID on the member-oriented site 21.

[0027] The authentication request receiving unit 72 receives a request for personal authentication of a credit card user. Specifically, the authentication request receiving unit 72 receives a request for personal authentication of a user transmitted from the member-only site 21 (issuer server 20) when the user requests to log in to the member-only site 21.

[0028] The challenge sending unit 73 sends a challenge code to the user terminal 30. In the embodiment, the challenge sending unit 73 sends the challenge code to the user terminal 30 via the issuer server 20 (member site 21). Furthermore, when a challenge code is requested from the ACS 60, the challenge sending unit 73 provides the challenge code to the ACS 60. The challenge sending unit 73 stores a challenge code issued in connection with the personal authentication of a certain user in the memory unit 71 in association with the identification information of the user.

[0029] The signature acceptance unit 74 accepts signature data based on the challenge code and the user's private key transmitted from the user terminal 30. The signature acceptance unit 74 of the embodiment accepts the signature data transmitted from the user terminal 30 via the issuer server 20 (member site 21).

[0030] The signature verification unit 75 verifies the signature data accepted by the signature acceptance unit 74 using the user's public key, which is registered in advance on the member-only site 21 and stored in the storage unit 71. In the embodiment, the signature verification unit 75 decrypts the signature data using the user's public key and obtains the decrypted challenge data. The signature verification unit 75 determines whether the decrypted challenge data matches the challenge code associated with the user stored in the storage unit 71. If the two challenge codes match, the signature verification unit 75 outputs a signature data verification result indicating that the signature data is valid. If the two challenge codes do not match, the signature verification unit 75 outputs a signature data verification result indicating that the signature data is invalid.

[0031] The authentication result output unit 76 outputs the result of personal authentication for the user based on the result of signature data verification. In the embodiment, the authentication result output unit 76 transmits the result of personal authentication for the user to the member-only site (issuer server 20). If the result of signature data verification indicates that the signature data is valid, the authentication result output unit 76 outputs a result indicating that personal authentication was successful. If the result of signature data verification indicates that the signature data is invalid, the authentication result output unit 76 outputs a result indicating that personal authentication was unsuccessful.

[0032] As described above, authentication system 54 of the embodiment includes authentication request receiving units (authentication request receiving unit 61, authentication request receiving unit 72) and authentication result output units (authentication result output unit 66, authentication result output unit 76). The authentication request receiving unit of authentication system 54 receives a request for personal authentication of a user transmitted from member-only site 21 when the user requests to log in to member-only site 21. After receiving the request for personal authentication transmitted from member-only site 21, the authentication result output unit of authentication system 54 transmits the result of personal authentication of the user to member-only site 21.

[0033] Furthermore, the authentication request receiving unit of the authentication system 54 receives a request for personal authentication of a user transmitted from the 3DS requester / server 52 when the user uses a credit card on the EC site 41. After receiving the request for personal authentication transmitted from the 3DS requester / server 52, the authentication result output unit of the authentication system 54 transmits the result of personal authentication of the user to the 3DS requester / server 52.

[0034] The operation of the information processing system 10 configured as above will now be described. Fig. 2 is a sequence diagram showing the operation of the information processing system 10. Fig. 2 shows the operation when a user's public key is registered in the identity authentication server 70. When a user operation to instruct registration of a public key is input, the key generation unit 31 of the user terminal 30 creates a pair of a private key and a public key (S10).

[0035] In S10, a pair of a private key and a public key is created on the condition that the user authentication is successful in the user terminal 30. In the embodiment, biometric authentication based on biometric information such as face, iris, or fingerprint is used for the user authentication in the user terminal 30. As a variation, while biometric authentication is used in principle for the user authentication in the user terminal 30, password authentication or pattern authentication may also be used to supplement the biometric authentication.

[0036] The user terminal 30 stores the private key in a storage unit (not shown) of the user terminal 30. At the same time, the user terminal 30 encrypts the public key using a pre-stored key that corresponds to the model number (type number) of the user terminal 30. The user terminal 30 transmits the user's identification information, the encrypted public key data, and the model number of the user terminal 30 to the issuer server 20 (S11).

[0037] The issuer server 20 transfers the user's identification information, the encrypted public key data, and the model number of the user terminal 30 to the authentication server 70 (S12). The authentication server 70 obtains a key corresponding to the model number of the user terminal 30 from a certificate authority device (not shown) and uses that key to decrypt the user's public key. The authentication server 70 associates the user's identification information with the user's public key and stores them in the storage unit 71 (S13).

[0038] Fig. 3 is also a sequence diagram showing the operation of the information processing system 10. Fig. 3 shows the operation related to identity authentication when a user logs in to the issuer's member-only site 21. When the user inputs an operation to instruct logging in to the member-only site 21, the user terminal 30 transmits data requesting login to the member-only site 21 to the issuer server 20 (S20). The issuer server 20 transmits data requesting identity authentication of the user, including the user's identification information, to the identity authentication server 70 (S21).

[0039] The authentication request receiving unit 72 of the personal authentication server 70 receives data requesting user authentication transmitted by the issuer server 20. The challenge transmitting unit 73 of the personal authentication server 70 generates a challenge code, associates the generated challenge code with the user's identification information, and stores the generated challenge code in the memory unit 71. The challenge transmitting unit 73 transmits the generated challenge code to the issuer server 20 (S22). The issuer server 20 transfers the challenge code transmitted from the personal authentication server 70 to the user terminal 30 (S23).

[0040] The user terminal 30 requests the user to input biometric information such as a fingerprint. The user terminal 30 authenticates the user based on the biometric information input by the user. If the user authentication (biometric authentication in this embodiment) is successful, the user terminal 30 encrypts the challenge code provided by the issuer server 20 using the private key generated in S10 of FIG. 2. The user terminal 30 transmits the encrypted challenge code to the issuer server 20 as a signed challenge code (S24). The issuer server 20 transmits the signed challenge code transmitted from the user terminal 30 and the user's identification information to the authentication server 70 (S25).

[0041] The signature acceptance unit 74 of the personal authentication server 70 accepts the signed challenge code and the user's identification information sent by the issuer server 20. The signature verification unit 75 of the personal authentication server 70 reads the user's public key associated with the user's identification information from the storage unit 71. The signature verification unit 75 decrypts the signed challenge code using the read user's public key and obtains the decrypted challenge code. The signature verification unit 75 reads the original challenge code associated with the user's identification information from the storage unit 71 and determines whether the original challenge code matches the decrypted challenge code (S26).

[0042] The authentication result output unit 76 of the identity authentication server 70 transmits the result of identity authentication of the user based on the verification result of the signed challenge code to the issuer server 20 (S27). The issuer server 20 transmits information regarding whether login is possible based on the result of identity authentication of the user to the user terminal 30 (S28). For example, if identity authentication of the user is successful, the issuer server 20 transmits information regarding successful login (e.g., content after successful login) to the user terminal 30. On the other hand, if identity authentication of the user is unsuccessful, the issuer server 20 transmits information regarding unsuccessful login (e.g., content indicating that login is rejected) to the user terminal 30.

[0043] Figure 4 is also a sequence diagram showing the operation of the information processing system 10. Figure 4 shows the operation related to identity authentication when using a credit card. In response to a user's operation, the user terminal 30 accesses the affiliated store server 40 and displays the screen of the EC site 41 on a display device (not shown). The user enters credit card information (e.g., a credit card number) on the product order screen of the EC site 41. The product order screen of the EC site 41 specifies that the entered credit card information should be sent to the payment agency server 50.

[0044] The user terminal 30 transmits the credit card information entered on the product order screen to the payment agent server 50 (S30). The payment agent server 50 issues a token, which is a character string corresponding to the credit card information transmitted from the user terminal 30 but different from the credit card information, and transmits the token to the user terminal 30 (S31). The user terminal 30 transmits order information including the token provided by the payment agent server 50 and information about the product to be ordered to the affiliated store server 40 (S32). The affiliated store server 40 transmits a payment request including the token to the payment agent server 50 (S33).

[0045] Before sending an authorization request to the issuer's device (not shown), the payment agent server 50 sends an authentication request for the user to the 3DS requester / server 52 (S34). This authentication request includes the user's credit card information corresponding to the token specified in the authorization request of S33. By using the token in this way, the affiliated store does not retain the user's credit card information. The 3DS requester / server 52 sends an authentication request including the user's credit card information to the ACS 60 (S35).

[0046] The product order screen of the EC site 41 specifies that a challenge code should be requested from the ACS 60. The user terminal 30 transmits a challenge code request including the user's credit card information to the ACS 60 (S36). The authentication request receiving unit 61 of the ACS 60 receives the personal authentication request of S35 and the challenge code request of S36. The ACS 60 identifies the identification information of the user to be authenticated (e.g., an ID assigned to the user by the issuer) based on the user's credit card information.

[0047] The challenge acquisition unit 62 of the ACS 60 transmits a challenge code request including the user's identification information to the authentication server 70 (S37). The challenge transmission unit 73 of the authentication server 70 generates a new challenge code, associates the generated challenge code with the user's identification information, and stores the generated challenge code in the storage unit 71. The challenge transmission unit 73 of the authentication server 70 transmits the generated challenge code to the ACS 60 (S38). In response to the challenge code request of S36, the challenge transmission unit 63 of the ACS 60 transmits the challenge code provided by the authentication server 70 to the user terminal 30 (S39).

[0048] The user terminal 30 requests the user to input biometric information such as a fingerprint. The user terminal 30 authenticates the user based on the biometric information input by the user. If the user authentication (biometric authentication in this embodiment) is successful, the user terminal 30 encrypts the challenge code provided by the authentication server 70 using the private key generated in S10 of FIG. 2. The user terminal 30 transmits the encrypted challenge code to the ACS 60 as a signed challenge code (S40). The ACS 60 transmits the signed challenge code transmitted from the user terminal 30 and the user's identification information to the authentication server 70 (S41).

[0049] The signature acceptance unit 74 of the personal authentication server 70 accepts the signed challenge code and the user's identification information transmitted from the ACS 60. The signature verification unit 75 of the personal authentication server 70 reads the user's public key associated with the user's identification information from the storage unit 71. The signature verification unit 75 decrypts the signed challenge code using the read user's public key and obtains the decrypted challenge code. The signature verification unit 75 reads the original challenge code associated with the user's identification information from the storage unit 71 and determines whether the original challenge code matches the decrypted challenge code (S42). The signature verification unit 75 transmits the verification result of the signed challenge code to the ACS 60 (S43).

[0050] The authentication result output unit 66 of the ACS 60 transmits the result of the user authentication based on the verification result of the signed challenge code to the 3DS requester / server 52 (S44). The 3DS requester / server 52 transfers the result of the user authentication to the payment agent server 50 (S45).

[0051] If the result of the user authentication is successful, the payment agent server 50 sends an authorization request for the user's product purchase to an issuer device (not shown) and obtains the authorization result returned from the issuer device. The payment agent server 50 sends a payment result based on the authorization result to the affiliated store server 40 (S46). The affiliated store server 40 sends order result information based on the payment result to the user terminal 30 (S47). The user terminal 30 displays the order result information on a display device (not shown).

[0052] If the result of the user authentication is unsuccessful, the payment agent server 50 does not send an authorization request to the issuer's device, but instead sends information indicating that the user authentication has failed to the affiliated store server 40. The affiliated store server 40 then sends and displays information to the user terminal 30 indicating that the product cannot be purchased because the credit card payment has failed.

[0053] According to the authentication system 54 of the embodiment, passkey authentication (in other words, challenge authentication) is applied to all personal authentication, thereby improving the reliability of personal authentication. In addition, the challenge code is signed on the condition that personal authentication at the user terminal 30 is successful, thereby further improving the reliability of personal authentication. Furthermore, since the authentication system 54 does not require the input of a one-time password, the burden on credit card users can be reduced and the customer experience can be improved.

[0054] Furthermore, according to the authentication system 54 of the embodiment, the authentication of the issuer's member site 21 can be strengthened by passkey authentication, and unauthorized logins can be prevented more reliably. Furthermore, the authentication system 54 uses the public key registered for passkey authentication of the issuer's member site 21 for identity authentication when using a credit card, thereby saving the user the trouble of registering the public key multiple times and more reliably preventing fraudulent use of the credit card.

[0055] The present disclosure has been described above based on examples. The contents described in the examples are merely examples, and it will be understood by those skilled in the art that various modifications are possible in the combination of the components and processing steps of the examples, and that such modifications are also within the scope of the present disclosure.

[0056] A first modified example will be described. The information processing system 10 of the embodiment includes one affiliated store server 40 corresponding to one affiliated store. As a modified example, the information processing system 10 may include multiple affiliated store servers 40 corresponding to multiple affiliated stores (multiple EC sites 41). The authentication system 54 may provide identity authentication services for customers (credit card users) of multiple affiliated stores.

[0057] Specifically, the authentication request receiving unit 61 of the ACS 60 may receive a request for personal authentication of a user transmitted from the first 3DS requester / server 52 when the user uses a credit card at the e-commerce site 41 of the first affiliated store. The authentication result output unit 66 of the ACS 60 may transmit the result of personal authentication of the user to the 3DS requester / server 52.

[0058] Furthermore, when a user uses a credit card at the e-commerce site 41 of a second affiliated store, the authentication request receiving unit 61 of the ACS 60 may receive a request for personal authentication of the user transmitted from the second 3DS requester / server 52. The authentication result output unit 66 of the ACS 60 may transmit the result of personal authentication of the user to the 3DS requester / server 52. The first affiliated store and the second affiliated store are different affiliated stores. Meanwhile, the first 3DS requester / server 52 and the second 3DS requester / server 52 may be devices of the same personal authentication service provider or may be devices of different personal authentication service providers.

[0059] According to the first modification, it is possible to realize an authentication system 54 that provides identity authentication services for customers (credit card users) of multiple affiliated stores. By registering a public key with one issuer (one credit card), a credit card user can use identity authentication when purchasing products at multiple affiliated stores, thereby reducing the burden on the user.

[0060] A second modification will be described. The user terminal 30 may input the received challenge code into a predetermined hash function to obtain a hash value of the challenge code. The user terminal 30 may transmit data obtained by encrypting the hash value of the challenge code with the user's private key as signature data. The signature verification unit 75 of the personal authentication server 70 may decrypt the signature data using the user's public key to obtain the decrypted hash value. The signature verification unit 75 may also input a challenge code corresponding to the user's identification information into the hash function to obtain the true hash value of the challenge code. The signature verification unit 75 may determine that the signature data is valid when the decrypted hash value matches the true hash value.

[0061] A third modified example will be described. The personal authentication service provided by the authentication system 54 can be used for purposes other than personal authentication when purchasing goods at an affiliated store. For example, the personal authentication service provided by the authentication system 54 can also be used for personal authentication when pre-registering a user's credit card information (credit card number, etc.) with an affiliated store.

[0062] A fourth modified example will now be described. The physical configuration of the authentication system 54 (e.g., the number of devices) is not limited to the configuration of the embodiment shown in Fig. 1. For example, at least one of the functions of the ACS 60 and the functions of the personal authentication server 70 may be distributed and implemented on multiple computers. Furthermore, at least one of the functions of the ACS 60 and the functions of the personal authentication server 70 may be deployed on a known web service platform. Furthermore, both the functions of the ACS 60 and the functions of the personal authentication server 70 may be implemented on a single computer.

[0063] Any combination of the above-described examples and modifications is also useful as an embodiment of the present disclosure. A new embodiment resulting from a combination will have the combined effects of the combined examples and modifications. It will also be understood by those skilled in the art that the functions to be performed by each constituent element described in the claims can be realized by each component shown in the examples and modifications alone or in combination. [Explanation of symbols]

[0064] 10 Information processing system, 54 Authentication system, 60 ACS, 61 Authentication request reception unit, 63 Challenge transmission unit, 64 Signature reception unit, 66 Authentication result output unit, 70 Personal authentication server, 71 Memory unit, 72 Authentication request reception unit, 73 Challenge transmission unit, 74 Signature reception unit, 75 Signature verification unit, 76 Authentication result output unit.

Claims

1. a memory unit for storing a public key of a user of the credit card registered on a site for credit card members; an authentication request receiving unit that receives a request for personal authentication of the user; a challenge sending unit that sends a challenge code to the user terminal; a signature acceptance unit that accepts signature data based on the challenge code and the private key of the user, the signature data being transmitted from the user's terminal; a signature verification unit that verifies the signature data using the public key of the user stored in the storage unit; an authentication result output unit that outputs a result of personal authentication regarding the user based on a result of verifying the signature data; An authentication system comprising:

2. the authentication request receiving unit receives a request for personal authentication of the user transmitted from the member-only site when the user requests to log in to the member-only site of the credit card, and the authentication result output unit transmits a result of the personal authentication of the user to the member-only site; the authentication request receiving unit receives a request for personal authentication of the user transmitted from a personal authentication service provider when the user uses the credit card at the affiliated store's website, and the authentication result output unit transmits the result of the personal authentication of the user to the personal authentication service provider; The authentication system of claim 1 .

3. the authentication request receiving unit receives a request for personal authentication of the user transmitted from an authentication service provider when the user uses the credit card at a first affiliated store site, and the authentication result output unit transmits a result of the personal authentication of the user to the authentication service provider; the authentication request receiving unit receives a request for personal authentication of the user transmitted from the personal authentication service provider when the user uses the credit card at a site of a second affiliated store different from the first affiliated store, and the authentication result output unit transmits a result of the personal authentication of the user to the personal authentication service provider; 3. The authentication system according to claim 1 or 2.

4. A computer that can access a storage unit that stores a public key of a user of the credit card registered on a site for credit card members, receiving a request for authentication of the user; sending a challenge code to the user's terminal; receiving signature data based on the challenge code and the private key of the user, the signature data being transmitted from the terminal of the user; verifying the signature data using the public key of the user stored in the storage unit; outputting a result of identity authentication for the user based on a result of verifying the signature data; The authentication method to perform.

5. A computer that can access a storage unit that stores the public key of the credit card user registered on a credit card member site, a function of receiving a request for personal authentication of the user; a function of transmitting a challenge code to the user's terminal; a function of accepting signature data based on the challenge code and the private key of the user, the signature data being transmitted from the user's terminal; a function of verifying the signature data using the public key of the user stored in the storage unit; a function of outputting a result of personal authentication regarding the user based on a result of verifying the signature data; A computer program to achieve this.

Images