Information processing device, information processing method, and program

Abstract

To improve security. [Solution] An information processing device that obtains the result of a first authentication process based on first identification information associated with the body of a card and second identification information stored in a separate storage unit from the card, and the result of a second authentication process based on third identification information associated with the body of a card and fourth identification information stored in a separate storage unit from the card, and determines that a card in which the second authentication process is successful and the first authentication process fails is highly likely to be counterfeit or is actually counterfeit.

Description

Technical Field

[0002] , , , , , ,

[0004] , ,

[0006] , , , , , , ,

[0005] , , ,

[0003] , , , , , ,

[0001] The present invention relates to an information processing apparatus, an information processing method, and a program.

Background Art

[0002] There is disclosed an authentication system that issues a one-time password request from a screen after login and allows the notification destination of the issued one-time password to be selected and specified from among three types: mobile email, mobile phone (voice), and landline phone, and performs authentication in online banking (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] [[ID=३५]]In the above technology, the security may not be sufficient.

[0005] The present invention has been made in consideration of such circumstances, and one of its objects is to provide an information processing apparatus, an information processing method, and a program that can improve security more.

Means for Solving the Problems

[0006] One aspect of the present invention is an information processing device that obtains the result of a first authentication process based on first identification information associated with the body of a card and second identification information stored in a storage unit separate from the card, and the result of a second authentication process based on third identification information associated with the body of the card and fourth identification information stored in a storage unit separate from the card, and determines that a card in which the second authentication process is successful and the first authentication process fails is highly likely to be counterfeit or is actually counterfeit. [Effects of the Invention]

[0007] According to one aspect of the present invention, it is possible to provide an information processing device, an information processing method, and a program that can further improve security. [Brief explanation of the drawing]

[0008] [Figure 1] This diagram shows an example of a configuration for implementing an electronic payment service. [Figure 2] This is a sequence diagram (part 1) illustrating the general flow of electronic payments. [Figure 3] This is a sequence diagram (part 2) illustrating the general flow of electronic payments. [Figure 4] This is a configuration diagram of the payment server 100 according to the embodiment. [Figure 5] This figure shows an example of the contents of user information 172. [Figure 6] This figure shows an example of the contents of authentication information 173. [Figure 7] This figure shows an example of the contents of merchant / store information 176. [Figure 8] This figure shows an example of a scenario in which authentication processing takes place. [Figure 9] This figure shows another example of a scenario in which authentication processing takes place. [Figure 10] This is a diagram to explain the authentication process. [Figure 11] This is a sequence diagram showing an example of the flow of processing (second authentication process) performed by the electronic payment system. [Figure 12] This is a sequence diagram showing an example of the flow of processing (first authentication process) performed by an electronic payment system. [Figure 13] This figure shows an example of authentication result information 178. [Figure 14] This sequence diagram shows an example of the processing flow for a new one-time code and a new write password. [Figure 15] This is a sequence diagram showing an example of the flow of processing (first authentication process) performed by an electronic payment system. [Figure 16] This sequence diagram shows another example of the flow of processing (second authentication process) performed by the electronic payment system. [Figure 17] This is a diagram illustrating the processing of modified examples. [Figure 18] This figure shows another example of a scenario where authentication is performed. [Modes for carrying out the invention]

[0009] Hereinafter, embodiments of an information processing apparatus, an information processing method, and a program of the present invention will be described with reference to the drawings. Various apparatuses such as a "server" that appears below for providing services to users or performing internal analysis may be realized by a decentralized group of apparatuses, and the operators of each apparatus may be different. Also, the holder of the hardware of the apparatus (provider of the cloud server) and the operator who actually operates the apparatus may be different. The application program and the settlement server cooperate to provide an electronic payment service. In the following description, the application program is referred to as a payment application. The electronic payment service is a service that supports the settlement related to the purchase of goods and services in a store. A store is, for example, a physical store (actual store) existing in the real space, but may include a virtual store for e-commerce. The virtual store may include those provided by a subject different from the operator of the electronic payment service. In that case, when making a purchase settlement in the virtual store, it may be controlled to transition to the interface screen of the electronic payment service. In the electronic payment service, a store is, for example, treated as belonging to a franchise (brand), and processes such as settlement when a purchase action is performed in the store are mainly carried out between the user and the franchise. Instead of this, processes such as settlement may be carried out between the user and the store.

[0010] [Electronic Payment Service] FIG. 1 is a diagram showing an example of the configuration of an electronic payment system in which an electronic payment service is realized. The electronic payment service is realized centering around the settlement server 100. The electronic payment system that realizes the electronic payment service includes, for example, one or more credit cards C, one or more user terminal devices 10, one or more first store terminal devices 50, one or more second store terminal devices 70, and the settlement server 100. These devices communicate with each other via, for example, a network NW. The network NW includes, for example, the Internet, a LAN (Local Area Network), a wireless base station, a provider device, and the like. Some or all of the functional configurations included in the electronic payment system may be distributed among a plurality of devices in an arbitrary form or integrated into an arbitrary device.

[0011] [User terminal device] The user terminal device 10 is, for example, a portable terminal device such as a smartphone or a tablet terminal. The user terminal device 10 is a computer device having at least an optical reading function, a communication function, a display function, an input reception function, and a program execution function. In the following description, the configurations for realizing these functions are respectively referred to as a camera, a communication device, a touch panel, a CPU (Central Processing Unit), etc. In the user terminal device 10, when the settlement application 20 is executed by a processor such as a CPU, it operates to provide an electronic settlement service to the user in cooperation with the settlement server 100. The settlement application 20 is installed in the user terminal device 10 from, for example, an application store, and controls a camera, a communication device, a touch panel, etc.

[0012] [First store terminal device] The first store terminal device 50 is installed in a store, for example. The first store terminal device 50 is a computer device having at least a product price acquisition function, an optical reading function, a program execution function, and a communication function. The first store terminal device 50 includes a so-called POS (Point of Sale) device, and the product price acquisition function and the optical reading function may be realized by the POS device. The store code image 60 is placed in the store and is a code image such as a QR code (registered trademark) printed on a paper or plastic medium. Note that the store code image 60 may be displayed by a display placed in the store (which may be a display of a terminal device such as a smartphone).

[0013] [Second store terminal device] The second store terminal device 70 is used by the operator of the affiliated store. The second store terminal device 70 is a smartphone, tablet, personal computer, etc. The affiliated store interface 72 operates on the second store terminal device 70. The affiliated store interface 72 may be an affiliated store application or a browser. The affiliated store interface 72 accepts coupon settings etc. from the affiliated store operator and transmits them to the payment server 100. The second store terminal device 70, which is a smartphone, has the function of displaying a code image corresponding to a store code image by running the affiliated store application, or reading a code image displayed by the user terminal device 10.

[0014] [Payment Server] The payment server 100 implements electronic payment based on payment information received from the user terminal device 10 or the first store terminal device 50. The first store terminal device 50 may include a POS device and a merchant server, in which case payment information is transmitted from the POS device to the payment server 100 via the merchant server. In the following description, this distinction will not be made, and it will be assumed that payment information is transmitted from the first store terminal device 50.

[0015] Figures 2 and 3 are sequence diagrams illustrating the general flow of electronic payments. There may be two patterns for electronic payments: Pattern 1 and Pattern 2.

[0016] In the case of Pattern 1 shown in Figure 2 (hereinafter referred to as User Scan), the user terminal device 10, with the payment application 20 running, decodes the store code image 60 using its optical reading function (S1). The store code image 60 contains information about the store URL (Uniform Resource Locator). This store URL is an electronic payment service domain to which information that can identify the store has been added, and is associated with the merchant ID and store ID, etc., at the payment server 100 (described later). The payment application 20 sends the first payment information, including the store URL and account ID, to the payment server 100 (S2). The payment server 100 searches for store information (described later) from the merchant ID and store ID corresponding to the store URL, obtains the merchant name and store name information (S3), and sends it to the payment application 20 (S4). The user enters the payment amount into the user terminal device 10 on the screen where the merchant name and store name are displayed (S5). The user terminal device 10 then generates second payment information, including at least the payment amount, and sends it to the payment server 100 (S6). The payment server 100 performs electronic payment based on the received second payment information (S7). The payment server 100 then sends a payment completion notification (information for displaying the payment completion screen) to the payment application 20 (S8), and the payment application 20 displays the payment completion screen (S9). If the store code image 60 is displayed on a display placed in the store, the store code image 60 may include payment amount information as well as the store URL. In this case, the procedure for the user to enter the payment amount is omitted, and the payment amount information is included in the first payment information and sent to the payment server 100. Merchant name and store name information may be included and displayed on the payment completion screen.

[0017] In the case of Pattern 2 shown in Figure 3 (hereinafter referred to as Store Scan), when the payment app 20 is launched, when a payment operation is performed in the payment app 20, when it is time for an automatic update (for example, every minute), and at other times, the payment app 20 sends a request to the payment server 100 to issue a one-time code (S11). The payment server 100 generates a one-time code (S12) and sends it to the payment app 20 (S13). The payment app 20 displays a code image such as a QR code or barcode that was generated based on the one-time code (S14). The user holds the display surface of the user terminal device 10 over the first store terminal device 50 (presents it), and the first store terminal device 50 decodes the code image using its optical reading function and obtains the one-time code, etc. (S15). Then, the first store terminal device 50 generates payment information including the one-time code, payment amount, merchant ID, store ID, etc., and sends it to the payment server 100 (S16). The payment amount information is obtained in advance by barcode scanning or manual input. Based on the received information, the payment server 100 identifies the user corresponding to the one-time code and performs the electronic payment (S17). The payment server 100 then sends a payment completion notification to the payment app 20 (S18), and the payment app 20 displays a payment completion screen (S19).

[0018] Furthermore, electronic payment may be performed using only one of the above patterns. Also, the "account ID" explained in Figure 2 may be other information that can be used as user identification information (for example, a phone number). In addition, the issuance of a one-time code may be omitted during store scanning, and the payment app 20 may display a code image generated based on the user's account ID. In that case, the payment server 100 will identify the user corresponding to the account ID instead of identifying the user corresponding to the one-time code.

[0019] [Payment Server Functional Configuration] Figure 4 is a diagram of the configuration of the payment server 100. The payment server 100 includes, for example, a communication unit 110, a content provision unit 120, a payment processing unit 130, an information management unit 140, an authentication processing unit 150, and a storage unit 170. Components other than the communication unit 110 and the storage unit 170 are realized, for example, by a hardware processor such as a CPU executing a program (software). Some or all of these components may be realized by hardware (including circuitry) such as LSI (Large Scale Integration), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), GPU (Graphics Processing Unit), and SOC (System On Chip), or by the cooperation of software and hardware. The program may be stored in advance on a storage device such as an HDD (Hard Disk Drive) or flash memory (a storage device equipped with a non-transient storage medium), or it may be stored on a removable storage medium such as a DVD or CD-ROM (a non-transient storage medium) and installed on the storage device when the storage medium is inserted into the drive device.

[0020] The storage unit 170 can be an HDD, flash memory, RAM (Random Access Memory), etc. The storage unit 170 may also be a NAS (Network Attached Storage) device accessible by the payment server 100 via the network. The storage unit 170 stores information such as user information 172 including authentication information 173, content information 174, merchant / store information 176, and authentication result information 178 (described later). Some of this information may also be stored in the storage unit of the user terminal device 10. Details of each piece of information will be described later.

[0021] The communication unit 110 is a communication interface for connecting to a network NW. The communication unit 110 is, for example, a network interface card.

[0022] The content provider unit 120, for example, has the functionality of a web server and provides information (content) for displaying various screens of the electronic payment service to the user terminal device 10. The content provider unit 120 reads the necessary content from the content information 174 as appropriate and provides it to the user terminal device 10. The user terminal device 10 accepts various inputs from the user while the content is being played by the payment application 20 and transmits the aforementioned payment information to the payment server 100. The above content may also be generated by the payment application 20. In this case, the content provider unit 120 provides the payment application 20 with the information necessary for generating the content.

[0023] The payment processing unit 130 performs payment processing based on payment information transmitted by the user terminal device 10 or the first store terminal device 50. The payment processing unit 130 performs payment processing while referring to the user information 172.

[0024] [User information] Figure 5 shows an example of the contents of User Information 172. User Information 172 is an example of user registration information. User Information 172 includes, for example, user URL, account ID, telephone number, password, as well as information such as email address, user ID, name, address, date of birth, registration date, charge balance, credit payment settings, credit payment limit, credit payment amount, available credit payment amount, payment method settings, bank account, credit card number, charge history information, and payment history information. The user URL is used for money transfer processing between users. When registering for a new electronic payment service, registration of a telephone number and password is mandatory. The account ID is issued to the user by the payment server 100, and the user ID is an ID that the user can set at will (or does not have to set). Similarly, the email address and name, address, and date of birth are also information that the user can set at will (or does not have to set). The registration date is the date the user registered for the electronic payment service (the date the account was created). Hereafter, the user instance (electronic payment account) to which this information is associated will be referred to as an account.

[0025] The charge balance is information indicating the balance of electronic money set by the user by sending money to their account in advance. Methods of sending money include sending from an ATM (Automatic Teller Machine) of a designated provider (bank) and sending from a registered bank account. The credit payment setting indicates whether or not the user has completed the settings to enable electronic payments via credit card using the payment app 20, and is set to either "Completed" or "Not Completed". The credit payment limit is the monthly limit for available credit payments, the credit payment amount is the amount already used for credit payments in the current month, and the available credit payment amount is the amount available for credit payments in the current month, calculated by subtracting the credit payment amount from the credit payment limit. While the diagram shows only one credit payment limit, in reality there are also daily limits, and the lower of these may be set as the credit payment limit. Further details on credit payments will be described later. The payment method setting indicates whether the user will use electronic payment with the charge balance or payment by credit card at that time. The bank account and credit card number information, respectively, refers to the bank account or credit card number (account number, card number) to which funds can be deposited into the electronic payment service. The charge history information is a record of when the user has previously sent money to the electronic payment service to increase the charge balance. The payment history information shows the details of each payment made by the user (date and time, store ID of the store where the purchase was made, payment amount, payment method, etc.).

[0026] [Authentication Information] Figure 6 shows an example of the contents of authentication information 173. Authentication information 173 stores, for example, user identification information, a write password, code information (one-time code), and information related to the credit card (credit card number, user's name, expiration date, etc.). The code information is the information used for authentication and stored in the storage unit C4 of credit card C. The write password is the password used by the payment application 20 to write the code information to the storage unit C4. In addition to this information, authentication information 173 may also include a URL (for example, a one-time URL: one-time Uniform Resource Locator).

[0027] [Franchise / Store Information] Figure 7 shows an example of the contents of the merchant / store information 176. The merchant / store information 176 includes, for example, a first table 176A in which the merchant ID and store ID are associated with the store URL, a second table 176B in which the merchant name and sales amount (as described above) are associated with the merchant ID, and a third table 176C in which the store name is associated with the store ID. In addition to this information, the merchant / store information 176 may also include information such as the merchant or store category, the store's location, and payment patterns.

[0028] The Information Management Unit 140 acquires information provided by other server devices, terminal devices, and the card server 400. Based on the information acquired from the user terminal device 10 and the second store terminal device 70, the Information Management Unit 140 manages user information 172 and merchant / store information 176. The Information Management Unit 140 performs operations such as adding, editing, and deleting new records for user information 172 and merchant / store information 176.

[0029] The authentication processing unit 150 performs a first authentication process and a second authentication process (details will be described later). The authentication processing unit 150 may perform either the first authentication process or the second authentication process.

[0030] [Electronic payment] When the payment processing unit 130 obtains payment information from the user terminal device 10 or the first store terminal device 50, it refers to the user information 172 to obtain the user's "payment method setting". For users whose "payment method setting" is set to "charge balance", the payment processing unit 130 performs electronic payment as follows: For example, the payment processing unit 130 performs electronic payment by decreasing the charge balance, which is managed in association with the user ID, and increasing the value of the merchant's sales proceeds item. For example, the value of the merchant's sales proceeds item is not used as electronic money itself, but rather the amount corresponding to the value of the sales proceeds item is transferred to the bank account in a cycle according to the agreement between the merchant and the electronic payment service.

[0031] The payment processing unit 130 performs electronic payment as follows for users whose "settings information" is set to "credit payment (credit payment using code information)". Credit payment is a payment method that is carried out in cooperation with a credit card company, which is a separate entity from the operator of the electronic payment service. The operator of the electronic payment service acts as the donor and allows electronic payment that does not depend on the charge balance within the credit payment limit. In order to use the credit payment service, it may be required to obtain a credit card provided by the operator of the electronic payment service. The amount used by credit payment is settled in a lump sum for the month on the payment date of the following month, for example, by withdrawal from a bank account. In this case, the payment processing unit 130 performs a provisional settlement by adding the settlement amount to the amount used by credit payment and subtracting the same amount from the available credit payment limit. When the closing date arrives, it processes the payment for the current month to be withdrawn on the payment date of the following month as described above, or requests the operator of the credit card company to perform the said process. If the settlement amount exceeds the available credit payment limit at the time of provisional settlement, an error notification is sent back to the payment app 20.

[0032] [overview] This embodiment relates to the authentication of credit cards linked to an electronic payment service. It provides a service that authenticates credit cards using a payment application 20. This authenticates whether the credit card is being used (owned) by a user authorized to use it.

[0033] When a linked credit card is used at a credit card merchant, information about various services, such as transaction history, may be transmitted to the payment server 100 or the payment application 20. For example, the payment application 20 may display the transaction history on the display unit of the user terminal device.

[0034] [Credit Card] The credit card mentioned above may be a credit card used for credit payments, or it may be a different credit card. For example, a credit card linked to an electronic payment service may be the credit card of this embodiment. In user information 172, information about the credit card and the user's authentication information 173 are associated with the user's identification information.

[0035] Credit card C includes a circuit unit C1 as shown in Figure 1. The circuit unit C1 is, for example, an integrated circuit chip (IC chip). The circuit unit C1 includes, for example, a communication unit C2, a control unit C3, and a storage unit C4. The communication unit C2 communicates with the communication unit of the user terminal device 10. As a result, the circuit unit C1 communicates with the payment application 20 to send and receive information. The control unit C3 works in cooperation with, for example, the communication unit C2 and the storage unit C4 to perform communication-related processing, information reading processing, and information writing processing. The storage unit C4 reads stored information and writes information to store information.

[0036] The memory unit C4 may store code information. For example, the information processing between the circuit unit C1 and the payment application 20 uses a predetermined format (e.g., NDEF: NFC Data Exchange Format). The code information is, for example, a one-time code that changes with each authentication process described later, but is not limited to this. This one-time code is written using a write password described later. The one-time code is information written to a different area from the EMV area where, for example, the credit card identification information and expiration date are written.

[0037] [Overview of Authentication Process] Figure 8 shows an example of a scenario in which authentication processing is performed. When a user performs a predetermined operation on the payment application 20, the payment application 20 displays interface screen IM1 on the display unit of the user terminal device. Interface screen IM includes information indicating that authentication processing will be performed and that the user should tap (bring close to) credit card C on the user terminal device 10. Next, when the user taps credit card C, authentication processing is performed. If the authentication processing is successful, the payment application 20 displays interface screen IM2 on the display unit. Interface screen IM2 displays information indicating, for example, that authentication (e.g., login authentication) has been performed. The authentication processing will be described later.

[0038] Authentication processing is performed, for example, when logging into the payment app 20. For example, if a user changes their smartphone model and logs into the payment app 20 with the new smartphone (user terminal device 10), authentication processing is performed by tapping (bringing close) a designated card, such as credit card C, to the smartphone. If the authentication processing is successful, information indicating that login authentication was successful is displayed as shown on the interface screen IM2. Authentication processing may also be prompted to be performed, for example, when pre-set conditions are met. Pre-set conditions include, for example, an operation to change the content of the service set for the user in the electronic payment service or an operation to use a designated service. Changing the content of the service includes changing the payment amount that can be used in the electronic payment service (raising the upper limit) or raising the payment limit of credit card C linked to the electronic payment service. Using a designated service includes using a service to transfer electronic money handled by the electronic payment service to another user's bank account, or using an application program linked to the electronic payment service to authenticate oneself via the payment app 20. For example, when using other services, the above-mentioned authentication may be a condition. Specifically, for bank services that partner with electronic payment services, identity verification will be required when making a transfer to an account number for the first time.

[0039] The pre-set conditions may include, for example, an attempt to use credit card C for a predetermined payment (e.g., a payment of a predetermined amount or a payment at a predetermined store). The pre-set conditions may also include a predetermined use of an electronic payment service, such as charging an electronic payment service using credit card C. In addition, the system may prompt the execution of authentication processing when a predetermined operation is performed in various services provided by the electronic payment service (e.g., financial services).

[0040] In this embodiment, authentication processing is described as being performed in relation to an electronic payment service or payment application 20, but instead (or in addition to), authentication processing may be performed in other services (for example, other services on their own). For example, the authentication processing of this embodiment may be applied when a provider of credit card C or a provider of banking services performs authentication processing in cooperation with the service user's application for that service. For example, the server of the provider of credit card C and the application for credit card C may cooperate to perform the authentication processing.

[0041] Figure 9 shows another example of a scenario in which authentication is performed. In Figure 8, authentication was performed to display login information, but in Figure 9, it is the authentication process to activate credit card C.

[0042] When a user performs a predetermined operation on the payment app 20, the payment app 20 displays interface screen IM1# on the display unit of the user terminal device 10. Interface screen IM# includes information indicating that activation should be performed and that the user should tap (bring close to) the credit card C on the user terminal device 10. Next, when the user taps the credit card C, an authentication process related to activation is performed. If the authentication process is successful, the payment app 20 displays interface screen IM2# on the display unit. Interface screen IM2# displays, for example, information indicating that activation has been performed. As a result, the user can begin using credit card C.

[0043] [Explanation of Authentication Process] The payment application 20 performs either or both of the following: a first authentication process using a written password, and a second authentication process using a one-time code. Figure 10 is a diagram illustrating the authentication process.

[0044] (First authentication process) (0) The first one-time code is written to credit card C (storage unit C4) using the first write password. (1) The payment application 20 obtains a first write password associated with the user's identification information from the payment server 100. When the credit card C used by the user is brought close to the user terminal device 10, the payment application 20 uses the communication unit of the user terminal device 10 to wirelessly communicate with the communication unit C2 included in the credit card C and the circuit unit C1 which includes a storage unit C4 that can write information using the setting password set when writing information.

[0045] The payment application 20 executes a first authentication process to determine whether the user's first write password is the set password, and determines that the first authentication process was successful if a positive result is obtained. The payment application 20 obtains the user's first write password (write password) for credit card C from the payment server 100 and verifies the legitimacy of the first write password. For example, the payment application 20 may try to write information to the storage unit C4 using the first write password, or execute a predetermined process to verify its legitimacy. It is assumed that the legitimacy has been verified in this process.

[0046] (Second authentication process) (2) The payment application 20 obtains the first one-time code (one-time code) stored in the memory unit C4. The payment application 20 sends the obtained first one-time code to the payment server 100 and requests a second authentication process to determine whether the first one-time code matches the code information associated with the user's identification information. The payment server 100 determines whether the one-time code in the user's authentication information 173 matches the first one-time code and performs authentication. In this process, authentication is considered to have been successful.

[0047] (3) After the first and second authentication processes, the payment server 100 issues a second write password and a second one-time code. The payment server 100 manages the second write password and the second one-time code in the authentication information 173, associating them with the user's identification information. (4) The payment app 20 uses the issued second write password to write the second one-time code to the memory unit C4 of the credit card C. (5) As a result, the second one-time code is written to the memory unit C4 of credit card C in place of the first one-time code. The write password required for writing becomes the second write password.

[0048] As described above, security is enhanced by the execution of the first and second authentication processes. For example, security is improved because the one-time code and the write password are changed with each authentication process.

[0049] The first and second authentication processes will be explained in detail below. Figure 11 is a sequence diagram focusing on the second authentication process, and Figure 12 is a sequence diagram focusing on the first authentication process.

[0050] Figure 11 is a sequence diagram showing an example of the flow of processing (second authentication process) performed by the electronic payment system. The memory unit C4 of credit card C stores a one-time code written using a write password. Assume that the user has performed a process requiring authentication using the payment application 20.

[0051] The payment application 20 retrieves the one-time code stored in the memory unit C4 of the credit card C (S100), and sends the retrieved one-time code and the user's identification information to the payment server 100 (S102). Next, the payment server 100 retrieves the one-time code and the user's identification information sent by the payment application 20 (S104).

[0052] Next, the payment server 100 determines whether the one-time code authentication is successful (S106). The payment server 100 determines, for example, whether the one-time code associated with the user's identification information stored in the authentication information 173 matches the acquired one-time code, and if they match, determines that authentication is successful. If authentication fails, the payment server 100 performs a second process (S108). The second process may, for example, notify the payment application 20 that authentication has failed, or suspend the use of credit card C. The above authentication may also be performed by the payment application 20. In this case, the payment server 100 obtains a one-time code associated with the user's identification information from the payment application 20.

[0053] Next, the payment server 100 stores the authentication result in its storage unit (S109). For example, the payment server 100 stores the user's identification information in association with the authentication result. This makes it possible to verify the authentication result for each user retrospectively.

[0054] Figure 12 is a sequence diagram showing an example of the flow of processing (first authentication process) performed by the electronic payment system. In Figure 12, the user has tapped credit card C on the user terminal device 10, and credit card C and the payment application 20 are in a state where they can communicate.

[0055] The payment application 20 sends the user's identification information along with the write password to the payment server 100 (S150). Next, the payment server 100 receives the user's identification information and the request for the write password (S152). Next, the payment server 100 refers to the authentication information 173 to obtain the write password associated with the user's identification information and sends the obtained write password to the payment application 20 (S154). The write password may also be held in the user terminal device 10.

[0056] The payment app 20 obtains the transmitted write password (S156) and requests the user to tap (bring close) credit card C to the user terminal device 10 (S158). For example, an interface screen regarding the request is provided. In response, the user taps credit card C to the user terminal device 10.

[0057] Next, the payment application 20 verifies the validity of the write password (S160). For example, the payment application 20 checks whether it can write information to the storage unit C4 using the write password. Next, the payment application 20 determines whether or not the validity has been verified (S162). If the validity cannot be verified, the payment application 20 executes the first process (S164). If the payment application 20 has performed the process of verifying validity a predetermined number of times but has not been able to verify the validity, as the first process, it displays on the display unit of the user terminal device 10 that the authentication of credit card C could not be verified, or notifies the payment server 100 that the validity could not be verified. The payment server 100 may also suspend the use of credit card C in response to the notification from the payment application 20.

[0058] If legitimacy is confirmed, the payment application 20 notifies the payment server 100 of information indicating that legitimacy has been confirmed (S166). Next, the payment server 100 stores the authentication result in its storage unit (S167). For example, the payment server 100 stores the user's identification information in association with the authentication result. This makes it possible to verify the authentication result for each user retrospectively.

[0059] The payment server 100 generates authentication result information 178 that associates the user's identification information with the authentication result, as described above. Figure 13 shows an example of authentication result information 178. Authentication result information 178 is information that shows the result of the first authentication process and the result of the second authentication process for each user's identification information.

[0060] For example, if the second authentication process is successful and the first authentication process fails, it is possible that the IC chip on credit card C has been forged. For example, it is possible that the one-time code on credit card C has been illegally obtained, and a forged IC chip with this one-time code written on it is being used. As described above, by storing the results of the first and second authentication processes, the legitimacy of credit card C, which contains the user's identification information, can be managed.

[0061] The payment server 100 determines whether the card (credit card C) used by the user is counterfeit based on the authentication result information 178. For example, the payment server 100 generates authentication result information 178 that associates the results of the first authentication process and the second authentication process with the user's identification information, and determines whether it is counterfeit by referring to the generated authentication result information 178. If the payment server 100 determines that the card is counterfeit, it may notify the terminal device of the card administrator of an alert. For example, the payment server 100 may generate a blacklist by referring to the authentication result information 178. For example, a credit card C of a user whose second authentication process in the authentication result information 178 is successful but whose first authentication process is unsuccessful may be blacklisted as a counterfeit credit card C. In this way, the payment server 100 can perform blacklist management using the authentication process and the results of the authentication process.

[0062] Figure 14 is a sequence diagram showing an example of the processing flow for a new one-time code and a new write password. In the sequence diagram of Figure 12, after authentication is successful, the payment server 100 issues a new one-time code and a new write password, and sends the issued new one-time code and new write password to the payment application 20 (S180).

[0063] The payment application 20 obtains the new one-time code and new write password transmitted in S180, and uses the new write password to write the new one-time code to the storage unit C4 for storage (S182). At this time, the payment application 20 may, if necessary, control the storage unit C4 to a writable state using the write password obtained in S156 of Figure 12, and write the new one-time code using the new write password. If it is not necessary to use the write password obtained in S156 of Figure 12, the payment application 20 writes the new one-time code to the storage unit C using the new write password. Through this process, the storage unit C4 of the credit card C stores the new one-time code (S184). The issuance of the new one-time code or write password described above may be performed by the payment application 20. The payment application 20 may obtain the new one-time code or write password from the payment server 100, or it may obtain it itself.

[0064] Next, the payment application 20 determines whether the process of writing a new one-time code was successful (S186). If the process is unsuccessful, the payment application 20 executes a third process (S188). The third process is, for example, the payment application 20 displaying on the display unit of the user terminal device 10 that authentication of credit card C could not be confirmed, or notifying the payment server 100 that the process was unsuccessful. The payment server 100 may also suspend the use of credit card C in response to the notification from the payment application 20.

[0065] If the process is successful, the payment application 20 sends information to the payment server 100 indicating that the process was successful (S190). Next, the payment server 100 receives the information indicating that the process was successful, executes the fourth process, and notifies the payment application 20 that the authentication process is complete (S192). The fourth process is the process in which the payment server 100 registers a new one-time code and a new write password in the authentication information 173. The payment server 100 may overwrite the one-time code and write password registered in the authentication information 173 with a new one-time code and a new write password, or it may register the new one-time code and new write password as the one-time code and new write password to be used in the future. The new one-time code and new write password may be registered in the authentication information 173 after the process of S180 described above. This new one-time code and new write password are information that will be used in the next authentication process after the said authentication process.

[0066] Furthermore, the fourth process may include a process in which the payment server 100 confirms or confirms that both (or one) of the first and second authentication processes have been completed, and that the authentication process for credit card C has been completed.

[0067] When the payment application 20 receives notification from the payment server 100 that the authentication process has been completed, it displays information indicating that the authentication process has been completed on the display unit of the user terminal device 10 (S194). At this time, information appropriate to the purpose of the authentication process is also displayed. For example, if the authentication process was performed for login, information indicating that the login was successful is displayed on the display unit of the user terminal device 10. This completes one routine of the authentication process, and in the next authentication process, the newly registered one-time code and new write password are used to execute the first and second authentication processes.

[0068] As described above, electronic payment systems can improve security by performing either or both of the first and second authentication processes.

[0069] [Variations in the order of processing] The first and second authentication processes will be described in detail below. The second authentication process may be executed after the first authentication process. Figure 15 is a sequence diagram centered on the first authentication process, and Figure 16 is a sequence diagram centered on the second authentication process.

[0070] [Sequence Diagram (1)] Figure 15 is a sequence diagram showing an example of the flow of processing (first authentication process) performed by the electronic payment system. The memory unit C4 of credit card C stores a one-time code written using a write password. Assume that the user has performed a process requiring authentication using the payment application 20.

[0071] The payment application 20 sends the user's identification information along with the write password to the payment server 100 (S150). Next, the payment server 100 receives the user's identification information and the request for the write password (S152). Next, the payment server 100 refers to the authentication information 173 to obtain the write password associated with the user's identification information and sends the obtained write password to the payment application 20 (S154). The write password may also be held in the user terminal device 10.

[0072] The payment app 20 obtains the transmitted write password (S156) and requests the user to tap (bring close) credit card C to the user terminal device 10 (S158). For example, an interface screen regarding the request is provided. In response, the user taps credit card C to the user terminal device 10.

[0073] Next, the payment application 20 verifies the validity of the write password (S160). For example, the payment application 20 checks whether it can write information to the storage unit C4 using the write password. Next, the payment application 20 determines whether or not the validity has been verified (S162). If the validity cannot be verified, the payment application 20 executes the first process (S164). If the payment application 20 has performed the process of verifying validity a predetermined number of times but has not been able to verify the validity, as the first process, it displays on the display unit of the user terminal device 10 that the authentication of credit card C could not be verified, or notifies the payment server 100 that the validity could not be verified. The payment server 100 may also suspend the use of credit card C in response to the notification from the payment application 20.

[0074] If legitimacy is confirmed, the payment application 20 notifies the payment server 100 of information indicating that legitimacy has been confirmed (S166). This process may be omitted. In this case, the payment server 100 may recognize that legitimacy has been confirmed when the one-time code described in Figure 16 is sent. The process in S167 may also be performed as described above.

[0075] Figure 16 is a sequence diagram showing another example of the flow of processing (second authentication process) performed by the electronic payment system. In Figure 16, the user has tapped credit card C on the user terminal device 10, and credit card C and the payment application 20 are in a state where they can communicate.

[0076] The payment application 20 retrieves the one-time code stored in the memory unit C4 of the credit card C (S100), and sends the retrieved one-time code and the user's identification information to the payment server 100 (S102). Next, the payment server 100 retrieves the one-time code and the user's identification information sent by the payment application 20 (S104).

[0077] Next, the payment server 100 determines whether the one-time code authentication is successful (S106). The payment server 100 determines, for example, whether the one-time code associated with the user's identification information stored in the authentication information 173 matches the acquired one-time code, and if they match, determines that authentication is successful. If authentication fails, the payment server 100 performs a second process (S108). The second process may, for example, notify the payment application 20 that authentication has failed, or suspend the use of credit card C. The above authentication may also be performed by the payment application 20. In this case, the payment server 100 obtains a one-time code associated with the user's identification information from the payment application 20.

[0078] If authentication is successful, the payment server 100 issues a new one-time code and a new write password, and sends the issued new one-time code and new write password to the payment application 20 (S180).

[0079] The payment application 20 obtains the new one-time code and new write password transmitted in S180, and uses the new write password to write the new one-time code to the storage unit C4 for storage (S182). At this time, the payment application 20 may, if necessary, control the storage unit C4 to a writable state using the write password obtained in S156 of Figure 15, and write the new one-time code using the new write password. If it is not necessary to use the write password obtained in S156 of Figure 15, the payment application 20 writes the new one-time code to the storage unit C using the new write password. Through this process, the storage unit C4 of the credit card C stores the new one-time code (S184). The issuance of the new one-time code or write password described above may be performed by the payment application 20. The payment application 20 may obtain the new one-time code or write password from the payment server 100, or it may obtain it itself.

[0080] Next, the payment application 20 determines whether the process of writing a new one-time code was successful (S186). If the process is unsuccessful, the payment application 20 executes a third process (S188). The third process is, for example, the payment application 20 displaying on the display unit of the user terminal device 10 that authentication of credit card C could not be confirmed, or notifying the payment server 100 that the process was unsuccessful. The payment server 100 may also suspend the use of credit card C in response to the notification from the payment application 20.

[0081] If the process is successful, the payment application 20 sends information to the payment server 100 indicating that the process was successful (S190). Next, the payment server 100 receives the information indicating that the process was successful, executes the fourth process, and notifies the payment application 20 that the authentication process is complete (S192). The fourth process is the process in which the payment server 100 registers a new one-time code and a new write password in the authentication information 173. The payment server 100 may overwrite the one-time code and write password registered in the authentication information 173 with a new one-time code and a new write password, or it may register the new one-time code and new write password as the one-time code and new write password to be used in the future. The new one-time code and new write password may be registered in the authentication information 173 after the process of S160 described above. This new one-time code and new write password are information that will be used in the next authentication process after the said authentication process.

[0082] Furthermore, the fourth process may include a process in which the payment server 100 confirms or confirms that both (or one) of the first and second authentication processes have been completed, and that the authentication process for credit card C has been completed.

[0083] When the payment application 20 receives notification from the payment server 100 that the authentication process has been completed, it displays information indicating that the authentication process has been completed on the display unit of the user terminal device 10 (S194). At this time, information appropriate to the purpose of the authentication process is also displayed. For example, if the authentication process was performed for login, information indicating that the login was successful is displayed on the display unit of the user terminal device 10. This completes one routine of the authentication process, and in the next authentication process, the newly registered one-time code and new write password are used to execute the first and second authentication processes.

[0084] Furthermore, in the first and second authentication processes described above, the processes performed by the payment application 20 may be performed by the payment server 100, and the processes performed by the payment server 100 may be performed by the payment application 20. For example, as mentioned above, the verification of the validity of the write password may be performed by the payment server 100. For example, the determination of the one-time code match and the issuance of a new one-time code and a new write password may be performed by the payment application 20. In addition, some or all of the authentication information 173 may be held in the user terminal device 10.

[0085] Either the first or second authentication process described above may be omitted. For example, the second authentication process may be omitted, and the first authentication process may be executed. In this case, the process of determining whether the one-time code matches or issuing a new one-time code is omitted.

[0086] As described above, electronic payment systems can improve security by performing either or both of the first and second authentication processes.

[0087] [Differentiation] In addition to the one-time code, the memory unit C4 of credit card C may also store a URL (for example, a one-time URL: one-time Uniform Resource Locator).

[0088] Figure 17 is a diagram illustrating the processing of a modified example. (0#) The first one-time URL and the first one-time code are written to the credit card C (storage unit C4) using the first write password. When the credit card C is tapped on the user terminal device 10, the user terminal device 10 reads the first one-time URL and accesses the destination of the first one-time URL. For example, the user terminal device 10 may access the payment server 100, or it may access the payment application 20 as in this process.

[0089] (0##) The user terminal device 10, for example, reads the first one-time URL, launches the payment application 20 installed on the user terminal device 10, and displays the specified interface screen. If the user is not logged into the payment application 20, the payment application 20 displays a login screen on the display unit and prompts the user to log in. If the user is already logged in, the payment application 20 executes the first authentication process and the second authentication process.

[0090] The first authentication process in (1) and the second authentication process in (2) are the same as the process shown in Figure 10 above.

[0091] (3#) After the first and second authentication processes, the payment server 100 issues a second write password, a second one-time URL, and a second one-time code. The payment server 100 manages the second one-time URL, the second write password, and the second one-time code in the authentication information 173, associating them with the user's identification information. (4#) The payment application 20 uses the issued second write password to write the second one-time URL and second one-time code to the memory unit C4 of credit card C. (5) As a result, the memory unit C4 of credit card C will be filled with the second one-time code and the second one-time URL instead of the first one-time code and the first one-time URL.

[0092] Figure 18 shows another example of an authentication process. For example, when a user taps credit card C on the user terminal device 10, the payment application 20 starts up, begins the first and second authentication processes, and displays the interface screen IM11 on the display unit. The interface screen IM11 displays information indicating that the authentication process is in progress. Once the first and second authentication processes are completed, the payment application 20 displays the interface screen IM12 on the display unit. The interface screen IM12 displays information indicating that the authentication process is complete, and information corresponding to the authentication process (such as successful login) is displayed.

[0093] As described above, since authentication is performed when the user brings credit card C close to the user terminal device 10, user convenience is improved.

[0094] The above example explains the use of a write password in the first authentication process. However, instead of (or in addition to) the write password, a read password for reading information stored in the memory unit C4 may be used, or any other password set for the circuit unit C may be used. If a read password is used, the first authentication process may be deemed successful if either or both of the credit card information and the one-time code can be read. If the above information cannot be read, the second authentication process cannot be performed. Therefore, the second authentication process is executed only when the first authentication process is successful (when the information can be read).

[0095] In the example above, the authentication process was described as being performed on credit card C, but instead (or in addition to), the authentication process may be performed on any medium. For example, the authentication process may be performed on an insurance card, a My Number card, a driver's license, or any other medium containing circuit part C.

[0096] Furthermore, although the above example describes the use of a payment application 20 for an electronic payment service for authentication processing, the application program is not limited to the payment application 20, and an application program appropriate to the medium may perform the processing of this embodiment.

[0097] According to the embodiments described above, security can be improved by having the computer perform a first authentication process to determine whether the user's first write password is a set password, and determining that the first authentication process was successful if a positive result is obtained. Furthermore, security can be improved by having the computer acquire the first code information stored in the storage unit, transmit the acquired first code information to the server device, and request a second authentication process to determine whether the first code information matches the code information associated with the user of the identification information.

[0098] Although embodiments for carrying out the present invention have been described above using examples, the present invention is not limited in any way to these embodiments, and various modifications and substitutions can be made without departing from the spirit of the present invention. [Explanation of Symbols]

[0099] 10. User terminal device 20 Payment Apps 100 Payment Servers 120 Content Provision Department 130 Payment Processing Unit 140 Information Management Department 150 Authentication Processing Unit

Claims

1. The system obtains the result of a first authentication process based on a first identification information associated with the card body and a second identification information stored in a separate storage unit from the card, and the result of a second authentication process based on a third identification information associated with the card body and a fourth identification information stored in a separate storage unit from the card. If the second authentication process is successful and the first authentication process fails, it is determined that the card is highly likely to be counterfeit or is actually counterfeit. Information processing device.

2. The first authentication process is a process that determines whether the first password associated with the user identification information of the card in the storage unit matches the set password configured for the card. The information processing apparatus according to claim 1.

3. The aforementioned setting password is a password set to write information to the memory section of the circuit part of the card. The information processing apparatus according to claim 2.

4. The second authentication process is a process that determines whether the first code information associated with the user identification information of the card in the storage unit matches the code information set for the card. The information processing apparatus according to claim 1.

5. The code information is code information stored in the memory unit of the circuit section of the card. The information processing apparatus according to claim 4.

6. The first authentication process is a process that determines whether the first password associated with the user identification information of the card in the storage unit matches the setting password set for the card. The second authentication process is a process that determines whether the first code information associated with the user identification information of the card in the storage unit matches the code information set for the card. The information processing apparatus according to claim 1.

7. The aforementioned setting password is a password set to write information to the memory section of the circuit part of the card. The code information is code information stored in the memory unit of the circuit section of the card. The information processing apparatus according to claim 6.

8. The first authentication process and the second authentication process are: When the card used by the user is brought close to the terminal device, the following actions are performed in response to wireless communication being made between the communication unit and the circuit unit containing the card, which includes a communication unit and a storage unit capable of writing information, using the communication unit of the terminal device. The information processing apparatus according to claim 1.

9. The first authentication process is a process that determines whether the first password associated with the user identification information of the card in the storage unit matches the setting password set for the card. The aforementioned setting password is a password set to write information to the memory section of the circuit part of the card. The second authentication process is a process that determines whether the first code information associated with the user identification information of the card in the storage unit matches the code information set for the card. The code information is code information stored in the memory unit of the circuit section of the card. The information processing apparatus according to claim 8.

10. Authentication result information is generated by associating the result of the first authentication process, the result of the second authentication process, and the identification information of the card user. Based on the generated authentication result information, it is determined whether or not the card used by the user is forged. The information processing apparatus according to any one of claims 1 to 9.

11. Computers The system obtains the result of a first authentication process based on a first identification information associated with the card body and a second identification information stored in a separate storage unit from the card, and the result of a second authentication process based on a third identification information associated with the card body and a fourth identification information stored in a separate storage unit from the card. If the second authentication process is successful and the first authentication process fails, it is determined that the card is highly likely to be counterfeit or is actually counterfeit. Information processing methods.

12. On the computer, The system obtains the result of a first authentication process based on a first identification information associated with the card body and a second identification information stored in a separate storage unit from the card, and the result of a second authentication process based on a third identification information associated with the card body and a fourth identification information stored in a separate storage unit from the card. If the second authentication process is successful and the first authentication process fails, the system determines that the card is highly likely to be counterfeit or is actually counterfeit. program.

Images