PROGRAM, AUTHENTICATION SYSTEM AND INFORMATION PROCESSING METHOD

Abstract

To provide a program, an authentication system, and an information processing method that provide a seamless UI to a user while ensuring information security.SOLUTION: In an authentication system, a program causes a server device 100 to achieve: an acquisition function of acquiring service authentication success / failure information indicating success / failure of user authentication; a settlement authentication reception function of receiving, in response to a settlement request, a settlement authentication request including both settlement account identification information for identifying a settlement account of a user in settlement means and settlement authentication information for executing user authentication of the settlement account, based on the service authentication success / failure information; a settlement authentication function of performing processing for the user authentication, based on the settlement authentication request and settlement account information by referring to a settlement storage unit for storing the settlement account information including the settlement account identification information; and a transmission function of transmitting, to a service provider device, settlement authentication success / failure information indicating success / failure of user authentication of the settlement account, based on a result of the processing.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to a program, an authentication system, and an information processing method. [Background technology]

[0002] 2. Description of the Related Art In cashless payments using payment methods such as bank transfers, credit card payments, and electronic money payments, user authentication techniques for using accounts for these payment methods (hereinafter also referred to as "payment accounts") are known.

[0003] As a technique for user authentication as described above, for example, 3D Secure is known for credit card payment. Patent Document 1 below discloses an authentication service method executed by a system including an OTP (One Time Password) token, a user terminal, a dedicated site for an online shop, and an authentication server. In this authentication service method, the dedicated site sends a request for user authentication of a credit card identified by a card number to the authentication server. When the authentication server receives this request, it generates challenge data and sends it to the terminal. When the user inputs the challenge data sent to the terminal into the OTP token, a one-time password is generated. The user inputs this one-time password into the terminal, and the one-time password is sent from the terminal to the authentication server, and the authentication server performs user authentication based on the one-time password. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2011-164821 A Summary of the Invention [Problem to be solved by the invention]

[0005] Here, when making a payment for a transaction in a service, even if an account for this service (hereinafter also referred to as a "service account") and a payment account are separately provided, there is a demand for providing a seamless UI for the user in user authentication of the payment account while ensuring information security. However, in the authentication service method of 3D Secure and Patent Document 1, in order to authenticate the user of the payment account when making a payment for a transaction in a service, an authentication site is provided to the user, which is provided by a server of a payment business operator such as an issuer that provides a payment method or an authentication server, separate from the service site that the user has used up to now. Then, the user needs to input authentication information such as a password into the provided site. For this reason, when the user makes a payment for a transaction in a service, the UI is not seamless in the series of steps from using the service to making the payment for the transaction, and there is room for improvement.

[0006] Therefore, in order to solve the above problem, the present invention aims to provide users with a seamless UI when making payments for transactions in services, while ensuring information security by authenticating users of a payment account separate from the service account. [Means for solving the problem]

[0007] A program according to one aspect of the present invention causes a computer to realize the following: an acquisition function for acquiring service authentication success / failure information indicating the success or failure of user authentication for a user's service account for a service for which a payment means provided by a payment service provider is available; a payment authentication reception function for accepting, from a service provider device of the service that has accepted a payment request for a user's transaction using the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, based on the service authentication success / failure information; a payment authentication function for, when the payment authentication request is accepted, referring to a payment memory unit that stores payment account information including the payment account identification information, and performing processing for user authentication based on the payment authentication request and the payment account information; and a transmission function for transmitting payment authentication success / failure information indicating the success or failure of user authentication of the payment account to the service provider device based on the result of the processing.

[0008] An authentication system according to one embodiment of the present invention includes an acquisition unit that acquires service authentication success / failure information indicating success or failure of user authentication for a user's service account for a service for which a payment means provided by a payment service provider is available; a payment authentication reception unit that accepts, from a service provider device of the service that has accepted a payment request for the user's transaction using the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, based on the service authentication success / failure information; when the payment authentication request is accepted, a payment authentication unit that refers to a payment memory unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information; and a transmission unit that transmits payment authentication success / failure information indicating success or failure of user authentication of the payment account to the service provider device based on a result of the processing.

[0009] An information processing method according to one aspect of the present invention includes a computer obtaining service authentication success / failure information indicating the success or failure of user authentication for a user's service account for a service for which a payment means provided by a payment service provider is available, accepting a payment authentication request corresponding to the payment request from a service provider device of the service that has accepted a payment request for the user's transaction using the payment means, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, based on the service authentication success / failure information, and when the payment authentication request is accepted, referring to a payment memory unit that stores payment account information including the payment account identification information, performing processing for the user authentication based on the payment authentication request and the payment account information, and transmitting payment authentication success / failure information indicating the success or failure of user authentication of the payment account to the service provider device based on the result of the processing. Effect of the Invention

[0010] According to the present invention, when making payments for transactions in services, a seamless UI can be provided to the user while ensuring information security by authenticating the user of a payment account separate from the service account. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram for explaining an example of a system configuration of an authentication system according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram for explaining an example of an overview of an authentication system according to an embodiment of the present invention. [Diagram 3] FIG. 1 is a diagram for explaining an example of an overview of an authentication system according to an embodiment of the present invention. [Figure 4] FIG. 1 is a diagram for explaining an example of an overview of an authentication system according to an embodiment of the present invention. [Diagram 5] FIG. 2 is a diagram illustrating an example of a functional configuration of a server device according to the present embodiment. [Figure 6]FIG. 2 is a diagram illustrating an example of the operation of the authentication system according to the present embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of a hardware configuration of a server device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] A preferred embodiment of the present invention (hereinafter, also referred to as "the present embodiment") will be described with reference to the attached drawings. In each drawing, the same reference numerals denote the same or similar configurations.

[0013] In the present invention, "unit", "means", "apparatus", and "system" do not simply mean physical means, but also include cases where the functions of the "unit", "means", "apparatus", and "system" are realized by software. Furthermore, the functions of one "unit", "means", "apparatus", or "system" may be realized by two or more physical means or devices, and the functions of two or more "units", "means", "apparatus", or "system" may be realized by one physical means or device.

[0014] The program of this embodiment can be installed or downloaded into a computer through various storage media such as optical disks such as CD-ROMs, magnetic disks, and semiconductor memories, or by downloading via a communications network (network N) or the like.

[0015] The authentication system 1 according to the present embodiment is a system for providing a seamless UI to a user by collectively performing user authentication when using a service or making a transaction for which a payment method provided by a payment service provider is available. In the present embodiment, an example will be described in which the payment method used for this service is credit card payment, but the purpose of the present invention is not to limit the payment method according to the present invention to this. The payment method according to the present invention may be any method of online payment, such as electronic money payment, carrier payment, debit card payment, etc.

[0016] In this embodiment, the service in which the payment means according to the present invention can be used will be described using VR commerce, which is one of the models of EC sites, as an example, as described later, but is not limited to this. The service in which the payment means according to the present invention can be used may be, for example, a service that uses another EC site model (for example, a general shopping mall type or a single-store type website, etc.), or may be a service in a real store that uses face-to-face online payment with a user (for example, biometric authentication of the user in the store or electronic payment using an NFC tag, etc.).

[0017] <1. System configuration> An example of the system configuration of an authentication system 1 according to this embodiment will be described with reference to FIG.

[0018] As shown in Fig. 1, authentication system 1 includes a server device 100, an affiliated store server 200, an issuer server 300, a user device 400, and a card brand server 500. Server device 100 is communicatively connected to affiliated store server 200, issuer server 300, and card brand server 500 via a network N to perform all or part of user authentication for services provided by affiliated stores and for payment methods provided by issuers. Affiliated store server 200 is communicatively connected to user device 400 via network N.

[0019] The network N is composed of a wireless network or a wired network. Examples of the network include a mobile phone network, a PHS (Personal Handy-phone System) network, a wireless LAN (Local Area Network), 3G (3rd Generation), LTE (Long Term Evolution), 4G (4th Generation), 5G (5th Generation), WiMax (registered trademark), infrared communication, Bluetooth (registered trademark), a wired LAN, a telephone line, a power line network, and a network conforming to IEEE1394, etc.

[0020] [Server device] The server device 100 is an information processing device capable of communicating with the affiliated store server 200 and the issuer server 300. In this embodiment, the server device 100 is, for example, a device used by a business that provides a wallet service to affiliated stores (hereinafter also referred to as a "wallet business operator"). A wallet service is a service that provides a wallet function that can be used online. Specifically, the wallet service is a service that provides a user with an aggregated form of a plurality of payment methods that can be used by the user by registering the plurality of payment methods. The server device 100 manages a plurality of payment method information related to each of a plurality of payment methods of a transaction by executing a predetermined program, receives authentication requests for various user authentications from the affiliated store server 200, etc., and executes a process for user authentication in cooperation with the issuer server 300, etc.

[0021] "Payment method information" is information related to a payment method. Payment method information includes, for example, type information indicating the type of payment method (e.g., credit card payment, debit card payment, electronic money payment, etc.), payment method identification information for identifying the payment method (e.g., card number, account number, etc.), payment business operator identification information providing the payment method, user identification information of a user who uses the payment method, security information for security of the payment method, etc. Furthermore, payment method information may be stored in the payment storage unit 132 in association with payment account information of the same user and the same payment method.

[0022] "Payment account information" is information related to a payment account. Payment account information may include, for example, payment account identification information (e.g., ID, card number, etc.) for identifying a user's payment account and payment method information for the corresponding payment method. Payment account information may include, for example, a password for the payment account as payment authentication information when authentication is performed on the device itself in user authentication of the payment account described below (case 2-4a). Furthermore, payment account information and service account information described below are collectively referred to as "account information."

[0023] For example, if the payment method is credit card payment, the payment method information may include the card number as payment method identification information, the cardholder's name as user information of the user using the payment method, and the expiration date and security code as security information.

[0024] "User information" is information about a user. User information may include, for example, user identification information for identifying a user, service account identification information, payment account identification information, personal information of the user such as name, telephone number, address, email address, personal identification number, gender, date of birth, etc. User information may also include, for example, biometric information related to the biometric characteristics of the user (for example, user's facial image data, fingerprint information, iris information, voiceprint information, etc.).

[0025] [Member store server] The affiliated store server 200 is a server used by an affiliated store (hereinafter simply referred to as "affiliated store") of the credit card used by the user, and is an information processing device for providing various services that allow the user to make credit card payments. In this embodiment, a service in which an affiliated store provides a virtual store on an EC site to users using VR technology (so-called VR commerce) will be described as an example. The affiliated store is one aspect of a service provider, and the affiliated store server 200 is one aspect of the service provider device of the service provider. The service provider in this embodiment is not limited to the affiliated store, and may be a payment agency such as a PSP (Payment Service Provider) or PF (Payment Facilitator) that provides an agency service related to payments to the affiliated store.

[0026] [Issuer Server] The issuer server 300 is a server used by the issuer of the credit card used by the user, and is an information processing device for providing a credit card payment function. The issuer is one aspect of a payment service provider, and the issuer server 300 is one aspect of a payment service provider device of the payment service provider. The issuer server 300 may include, for example, an authentication issuer server 300a (e.g., a server providing a 3D Secure function, etc.) and an authorization issuer server 300b.

[0027] [International Brand Server] The credit card company server 500 is a server used by a credit card company, and may be, for example, a directory server that uses information on a credit card used at an affiliated store to identify the target issuer server 300 and link it with the server device 100. The credit card company server 500 may include, for example, an authentication brand server 500a (e.g., a server that provides a 3D Secure function) and an authorization brand server 500b.

[0028] <2. Overview> An example of an overview of the authentication system 1 will be described with reference to FIGS.

[0029] FIG. 2 is a diagram showing an overall view of authentication system 1. As shown in FIG. 2, when using credit card payment for a transaction such as purchasing a product at a virtual store on a VR site, multiple domains such as the affiliated store domain, the issuer domain, or the international brand domain work together to perform processing. In user authentication for such credit card payments, conventional technologies such as 3D Secure required the user to interact with each of the affiliated store domain and the issuer domain. Authentication system 1 reduces the amount of interaction between the user and each of these multiple domains and provides the user with a seamless UI (user interface).

[0030] <0. Service account registration and authentication scene> (0-1) The user registers a new account for the affiliated store's VR commerce service (hereinafter also referred to as "service account") from the user device 400 to the wallet operator's server device 100. This service account may also serve as an account for the wallet service that the wallet operator provides to the user through the affiliated store. (0-2) When the user's service account is registered in the server device 100, the affiliated store server 200 performs user authentication (hereinafter also referred to as "service authentication") of the registered service account on behalf of the server device 100. At this time, communication between the server device 100 and the user device 400 may be performed via the affiliated store server 200. Hereinafter, it is assumed that the user has been successfully authenticated for this service account, that is, has logged in to the VR site. The server device 100 stores service authentication success / failure information indicating that the user authentication for the service account has been successful in the service storage unit 131.

[0031] "Service authentication success / failure information" is information indicating the success or failure of user authentication for a user's service account in a service that allows the use of a payment method (credit card payment) provided by a payment business operator (issuer). For example, service authentication success / failure information indicates "success" (hereinafter also referred to as "OK") for user authentication while the user is logged in to a VR site, and indicates "failure or invalid authentication success (hereinafter also referred to as "NG")" during logout or when authentication fails.

[0032] <1. Payment account registration scene> (1-1) When a user registers a new credit card payment account (hereinafter also referred to as a "payment account"), the user performs an operational input for requesting to register a payment account (hereinafter also referred to as a "payment account registration request") on the screen of the VR site displayed on the user device 400. (1-2) When the user device 400 accepts this operational input, it transmits a payment account registration request to the affiliated store server 200 via the screen (web page) of the VR site. This payment account registration request may include, for example, payment account information. (1-3) The affiliated store server 200 accepts this transmitted payment account registration request and transmits it to the server device 100. (1-4) The server device 100 registers the user's payment account based on the payment account registration request accepted from the affiliated store server. Specifically, the server device 100 stores the user's payment account information in the payment memory unit 132.

[0033] <2. User authentication during payment and 3. Authorization> (2-1) In this example, it is assumed that a user uses a credit card payment provided by an issuer when purchasing a product at a virtual store on a VR site. The user inputs a credit card payment request (hereinafter, simply referred to as a "payment request") using the payment account registered in 1 above on the product purchase screen of the VR site displayed on the user device 400. This payment request may include, for example, payment account identification information and payment authentication information for executing user authentication of the payment account. The payment authentication information is information for matching with the payment authentication information managed by the server device 100 or the issuer server 300. In user authentication, the payment authentication information is considered to be "correct," and if, for example, the payment authentication information input by the user from a screen or the like of the VR site matches the payment authentication information, the authentication is determined to be "OK." Similarly, the service authentication information and service authentication information described later are considered to be "correct," and if the service authentication information matches the service authentication information, the authentication is determined to be "OK."

[0034] (2-2) When the user device 400 accepts the above operation input, it transmits a payment request to the affiliated store server 200 via the screen of the VR site. (2-3) The affiliated store server 200 accepts this transmitted payment request, includes the payment account identification information and payment authentication information contained in this payment request in a payment authentication request, and transmits this payment authentication request to the server device 100. The payment authentication request requests user authentication of the payment account.

[0035] (2-4) If the service authentication success / failure information indicates “OK”, that is, if the user authentication of the service account has been successful or the success of the user authentication is maintained, the server device 100 accepts the payment authentication request sent above.

[0036] (2-5) When the server device 100 receives the payment authentication request, it performs one of the following processes (2-5a) and (2-5b) to authenticate the user of the payment account. (2-5a) User authentication is performed on the device itself (in its own domain). Hereinafter, this process is also referred to as "payment authentication proxy." In the payment authentication proxy, technologies such as OpenID Connect, DID (Decentralized Identifier) / VC (Verifiable Credentials), and SSO (Single Sign On) may be used as appropriate. (2-5b) The server device 100 links the payment authentication information to the authentication issuer server 300a and executes user authentication in the issuer's domain. Note that, during this linking, the server device 100 may link to the authentication issuer server 300a via the authentication brand server 500a. Hereinafter, this process is also referred to as "payment authentication linking." In the payment authentication linking, the 3D Secure function provided by the authentication issuer server 300a may be called from the server device 100 and used.

[0037] (2-6) The server device 100 generates payment authentication success / failure information as a result of the user authentication executed in the above (2-5), and transmits this payment authentication success / failure information to the affiliated store server 200.

[0038] "Payment authentication success / failure information" is information that indicates the success or failure of user authentication for the user's payment account. The payment authentication success / failure information indicates whether the user authentication was "successful or valid (hereinafter also referred to as "OK")" or "failed or invalid (hereinafter also referred to as "NG")."

[0039] (3) If the payment authentication success / failure information sent in (2-6) above indicates that the user authentication is "OK," the affiliated store server 200 performs authorization for the credit card payment to the authorization issuer server 300b via the authorization brand server 500b. Using the result of this authorization, the affiliated store server 200 and the authorization issuer server 300b execute processes for the credit card payment, such as sales processing and payment processing for the credit card payment.

[0040] FIG. 3 is a diagram showing a flow of advance registration of various information for using the authentication system 1. (0a) The affiliated store server 200 performs business registration for using the wallet service by having the service provider information registered. The service provider information may include, for example, business identification information (e.g., ID, business name, etc.) for identifying the service provider, interface information defining the interface between the server device 100 and the affiliated store server 200, and information regarding the affiliated store's payment of the usage fee for the wallet service. (0b) The server device 100 performs business registration for cooperation with the payment provider by registering the payment provider information. The payment provider information may include, for example, payment identification information (e.g., ID, business name, etc.) for identifying the payment provider, interface information defining the interface between the server device 100 and the issuer server 300, and the like. The interface information indicates, for example, a method selected by the affiliated store or issuer as a cooperation method between the affiliated store server 200 or the issuer server 300 and the server device 100 from, for example, a method using an API, a method using scraping, or a method of providing an SDK (Software Development Kit) to the affiliated store or issuer. In other words, the method of cooperation between the affiliated store server 200 or the issuer server 300 and the server device 100 may be selected from these methods as appropriate.

[0041] (1) The user device 400 sends a service account registration request or a payment account registration request (hereinafter collectively referred to as an "account registration request") for registering a new service account to the affiliated store server 200. This account registration request may include some or all of the account information. (2) The affiliated store server 200 sends the account registration request to the server device 100.

[0042] (3) <A1) Information Registration> When the reception unit 112 of the server device 100 receives an account registration request, it sends a request to the user device 400 to obtain settlement authentication information and service authentication information. The user device 400 presents this request to the user via the screen of the VR site. (4) When the user inputs settlement authentication information and service authentication information on the screen of the VR site, the user device 400 responds with this input authentication information to the server device 100.

[0043] (5) <A2) Service Authentication> <A3) Settlement Authentication> The acquisition unit 111 of the server device 100 registers the authentication information acquired from the user device 400 in the storage unit 130 for settlement authentication and service authentication.

[0044] (6a) <B2 Authentication Agency> When the issuer designates settlement authentication agency, the settlement authentication unit 113a of the server device 100 manages the registered settlement authentication information. (6b) <B3) Authentication Linkage> When the issuer designates settlement authentication linkage, the settlement authentication unit 113a of the server device 100 links the acquired settlement authentication information to the issuer server. In this linkage, it may be via the international brand server 500 (directory server).

[0045] Figure 4 is a diagram showing the process of performing settlement authentication in a transaction using the authentication system 1. (1) As shown in Figure 4, the user device 400 sends a settlement request for a transaction in VR commerce to the franchise server 200. (2) When the franchise server 200 receives the settlement request, it sends a settlement authentication request corresponding to this settlement request to the server device 100.

[0046] (3) <A3) Settlement Authentication> The settlement authentication reception unit 112a of the server device 100 obtains service authentication success / failure information indicating the success or failure of service authentication by the service authentication unit 113b and determines whether the service authentication is "OK". When the settlement authentication reception unit 112a determines that the service authentication is "OK", it receives the above-mentioned transmitted settlement authentication request.

[0047] (4a) <Proxy Authentication> In the case of proxy authentication for payment, the payment authentication unit 113a performs user authentication for the payment account. (4b) <Authentication Linkage> In the case of authentication linkage for payment, the payment authentication unit 113a instructs the issuance server 300 to execute user authentication for the payment account and receives a response to the result of the execution.

[0048] Under the above configuration, in the authentication system 1, in the payment of transactions in the VR commerce service and wallet service provided to the user, when performing user authentication for a payment account separate from the service account, the interaction with the user can be performed via the VR site provided by the affiliated store in the same way as service authentication. For this reason, for user authentication of the payment account, it is not necessary to provide the user with an authentication site provided by the issuance server 300 or the like, which is different from the VR site that the user has been using. Therefore, the user does not need to move to this separate authentication site and perform input operations such as passwords. In addition, since the payment authentication request for the payment account is accepted based on the success or failure of service authentication, it is also possible to avoid accepting an illegal payment authentication request. Therefore, the authentication system 1 can provide a seamless UI to the user while ensuring information security through user authentication of the payment account.

[0049] <3. Functional Configuration of Server Device> Referring to FIG. 5, the functional configuration of the server device 100 according to the present embodiment will be described. As shown in FIG. 5, the server device 100 includes a control unit 110, a communication unit 120, and a storage unit 130.

[0050] The control unit 110 includes an acquisition unit 111, a reception unit 112, and an authentication unit 113.

[0051] [Acquisition Unit] The acquisition unit 111 acquires various information from the affiliated store server 200, the issuer server 300, or other external devices. Any mode may be used for the acquisition unit 216 to acquire various information. When authentication information is input by a user to a screen of a VR site provided by the affiliated store server 200, the acquisition unit 111 may receive a message indicating the input authentication information at any time. As another example, the acquisition unit 111 may receive a file indicating service authentication success / failure information from the affiliated store server 200 in an event-driven or cyclical manner. As another example, the acquisition unit 111 may instruct an API implemented by the affiliated store server 200 or the issuer server 300 to refer to information, and acquire information as a result of the reference.

[0052] The acquiring unit 111 acquires service authentication success / failure information. For example, when the acquiring unit 111 executes service authentication in its own device (its own domain), the acquiring unit 111 may acquire the service authentication success / failure information from the service authentication unit 113b described later. As another example, when the acquiring unit 111 executes service authentication in the affiliated store server 200, the acquiring unit 111 may acquire the service authentication success / failure information from the affiliated store server 200.

[0053] The acquisition unit 111 may acquire payment authentication success / failure information indicating the success or failure of user authentication for the payment account from a payment business device such as the issuer server 300, for example, as a response to an authentication instruction from the payment authentication unit 113a.

[0054] [Reception] The reception unit 112 receives various requests and instructions from the affiliated store server 200, the issuer server 300, or the user device 400. The reception unit 112 includes a payment authentication reception unit 112a. The reception unit 112 may also include, for example, a service authentication reception unit 112b.

[0055] The payment authentication reception unit 112a receives, from a service provider device of a service that has received a payment request for a transaction by a user using a payment means, a payment authentication request corresponding to the payment request, the payment authentication request including the user's payment account identification information in the payment means and payment authentication information, based on service authentication success / failure information. With this configuration, the server device 100 can receive a payment authentication request corresponding to the payment request from the affiliated store server 200 that has received the payment request from the user device 400. Furthermore, since the payment authentication reception unit 112a receives a payment authentication request based on the success / failure of service authentication, it is possible to avoid receiving an unauthorized payment authentication request, and to ensure information security.

[0056] The payment authentication reception unit 112a may, for example, receive from the affiliated store server 200 a payment request for a user to purchase a product on a VR site by credit card payment, a payment authentication request corresponding to the payment request, the payment authentication request including the user's payment account identification information for the credit card payment and payment authentication information, based on service authentication success / failure information.

[0057] The service authentication receiving unit 112b receives a service authentication request from a service provider device such as the member store server 200 or the user device 400, which includes service authentication information for executing user authentication of a service account.

[0058] [Authentication section] The authentication unit 113 performs a process for user authentication of the account based on the authentication request accepted by the acceptance unit 112. The authentication unit 113 may use, for example, an authentication method using knowledge information such as an ID, password, or PIN, an authentication method using possessions (possession information) such as a card medium or token, or an authentication method using biometric information of the user. The authentication unit 113 may be, for example, single-factor authentication using one of the above authentication methods (a) to (c), or multi-factor authentication using two or more of the above authentication methods (a) to (c). The authentication unit 113 includes a payment authentication unit 113a. The authentication unit 113 may also include, for example, a service authentication unit 113b.

[0059] When a payment authentication request is accepted by the payment authentication accepting unit 112a, the payment authentication unit 113a refers to the payment memory unit 132, which stores payment account information including payment account identification information, and performs processing for user authentication of the payment account based on the payment authentication request and the payment account information.

[0060] [Payment authentication integration] The payment authentication unit 113a may, for example, as a process for user authentication of the above-mentioned payment account (payment authentication integration), issue an authentication instruction to a payment service provider device such as the issuer server 300 to perform user authentication of the payment account, the authentication instruction including payment account identification information and payment authentication information.

[0061] [Payment authentication agency] The payment account information stored in the payment storage unit 132 may include, for example, payment authentication information for executing user authentication of the payment account. In this case, the payment authentication unit 113a may, for example, execute user authentication of the payment account based on the payment authentication information as a process for the user authentication of the payment account, and generate payment authentication success / failure information based on the result of this execution. With this configuration, it is possible to reduce the amount of interaction with a payment service provider device such as the issuer server 300 during payment authentication, and in particular to reduce security risks related to communication for this interaction via the network N. Thus, information security can be ensured.

[0062] [Automatic payment authentication] For example, as a process for user authentication of the payment account, the payment authentication unit 113a may determine that the user authentication of the payment account is successful if the service authentication success / failure information indicates that the user authentication is successful, and may determine that the user authentication of the payment account is unsuccessful if the service authentication success / failure information indicates that the user authentication is unsuccessful. The payment authentication unit 113a may generate payment authentication success / failure information based on the result of this determination. In other words, the payment authentication unit 113a may omit the process of user authentication of the payment account by the user authentication of the service account. Hereinafter, this process is also referred to as "automatic payment authentication." In addition, the payment authentication unit 113a may evaluate a risk related to the user's payment based on, for example, negative information. The payment authentication unit 113a may determine that the user authentication of the payment account is successful if the user authentication of the service account is successful, and may determine that the user authentication of the payment account is unsuccessful, as described above, only when the evaluated risk meets a predetermined standard.

[0063] Negative information may be, for example, historical information indicating a history of failure to verify identity (a history of NG results in identity verification), or a history of a scheduled account deduction not being made due to insufficient funds, or a history of delayed payment, etc.

[0064] According to the above configuration, instead of executing a process of matching the payment authentication information with the payment authentication information for payment authentication, payment authentication can be performed based on the success or failure of service authentication. Therefore, since there is no need to obtain the payment authentication information or manage the payment authentication information, the confidentiality of this information can be ensured.

[0065] The service authentication unit 113b refers to the service storage unit 131 that stores service account information including the service authentication information, and executes user authentication of the service account based on the service authentication request and the service account information. The service authentication unit 113b generates service authentication success / failure information of the service account based on the result of the execution of this user authentication. The service authentication unit 113b shares the generated service authentication success / failure information with the acquisition unit 111.

[0066] "Service account information" is information related to a service account. The service account information may include, for example, service account identification information (e.g., ID, etc.) for identifying a user's service account and payment account identification information of a corresponding payment account.

[0067] According to the above configuration, the service authentication unit 113b can perform user authentication of the service account of the affiliated store server 200. Therefore, service authentication can be performed together with payment authentication by the wallet service.

[0068] [Communications Department] The communication unit 120 transmits and receives various information to and from a service provider device, a payment provider device, or other devices in external domains via the network N. The communication unit 120 includes a transmission unit 121 and a reception unit 122. The reception unit 122 receives, for example, various requests from the affiliated store server 200 and payment authentication success / failure information from the issuer server 300.

[0069] The transmitter 121 transmits payment authentication success / failure information indicating whether the user authentication of the payment account has been successful to a service provider device such as the affiliated store server 200 based on the result of the user authentication process by the payment authentication unit 113a.

[0070] According to the above configuration, in the settlement of a transaction in a service provided to a user by a service provider, user authentication of a payment account separate from a service account can be performed by an exchange between the user device 400 and the affiliated store server 200. Therefore, for settlement authentication, there is no need for the user device 400 to exchange with the issuer server 300 or the like in a domain separate from the affiliated store server 200. Therefore, the user does not need to move to a site provided by the issuer server 300 or the like to input a password or the like. Therefore, the authentication system 1 can provide a seamless UI to the user.

[0071] The transmission unit 121 may transmit, for example, service authentication success / failure information generated by the service authentication unit 113b to a service provider device such as the affiliated store server 200.

[0072] The transmitting unit 121 may transmit, for example, the payment authentication success / failure information acquired by the acquiring unit 111 to a service provider device such as the affiliated store server 200.

[0073] According to the above configuration, the payment authentication function of the issuer server 300 can be used through the payment authentication linkage. Therefore, the wallet operator does not need to implement a function for performing user authentication of the payment account in its own domain such as the server device 100. Therefore, it is possible to provide a highly versatile authentication system 1.

[0074] The transmission unit 121 may transmit, for example, payment authentication success / failure information generated by the payment authentication unit 113a to a service provider device such as the affiliated store server 200 and a payment provider device such as the issuer server 300.

[0075] [Storage] The storage unit 130 stores various information related to the authentication system 1. The storage unit 130 may store, for example, user information and the like. The storage unit 130 may store each piece of information using a database management system (DBMS), or may store each piece of information using a file system. When using a DBMS, a table may be provided for each piece of information, and each piece of information may be managed by associating the tables with each other. The storage unit 130 includes a service storage unit 131 and a payment storage unit 132.

[0076] The service storage unit 131 stores service account information including service account identification information and service authentication information for executing user authentication of the service account. The payment storage unit 132 stores payment account information including payment account identification information.

[0077] <4. Example of operation> An example of the operation of authentication system 1 will be described with reference to Fig. 6. Fig. 6 is a sequence diagram showing the process flow and interactions when service authentication and payment authentication are performed in authentication system 1. In the example of Fig. 6, payment authentication collaboration is used for user authentication of a payment account in authentication system 1. Note that the order of processes shown below is an example and may be changed as appropriate.

[0078] 6, the user device 400 receives an operation input of a service authentication request for requesting user authentication of a service account from the user via the screen of the VR site (S10). Upon receiving the operation input of the service authentication request, the user device 400 transmits the service authentication request to the server device 100 via the affiliated store server 200 (S11).

[0079] The service authentication reception unit 112b of the server device 100 receives the transmitted service authentication request (S12). The service authentication unit 113b of the server device 100 refers to the service storage unit 131 that stores the service account information, executes user authentication of the service account based on the received service authentication request and the service account information, and generates service authentication success / failure information for the service account based on the result of this execution (S13). The transmission unit 121 of the server device 100 transmits the generated service authentication success / failure information to the affiliated store server 200 as a response to the service authentication request (S14).

[0080] The affiliated store server 200 acquires the service authentication success / failure information transmitted from the server device 100 (S15). The affiliated store server 200 transmits a response indicating the result of the service authentication request based on the acquired service authentication success / failure information to the user device 400 (S16). The user device 400 outputs the result of the service authentication to the user (S17).

[0081] The user device 400 accepts from the user, via the screen of the VR site, a payment request for the user's transaction using the credit card payment provided by the issuer server 300 (S18). In this example, the payment request includes payment account identification information and payment authentication information. When the user device 400 accepts the payment request, it transmits the payment request to the affiliated store server 200 (S19).

[0082] When the user authentication of the service account is successful, each device of the authentication system 1 executes processing of the area indicated by the combined fragment opt1 (Option1). Specifically, the affiliated store server 200 accepts a payment request sent from the user device 400 (S20). The affiliated store server 200 sends a payment authentication request corresponding to the payment request, which includes payment account identification information and payment authentication information, to the server device 100 (S21). The server device 100 accepts the payment authentication request based on the generated service authentication success / failure information (S22). The server device 100 sends an authentication instruction to the issuer server 300 to instruct the execution of user authentication of the payment account, which includes payment account identification information and payment authentication information (S23). The issuer server 300 executes user authentication of the payment account based on the transmitted authentication instruction (S24). In response to this authentication instruction, the issuer server 300 transmits payment authentication success / failure information indicating the success or failure of the user authentication as a result of this execution to the server device 100 (S25). The server device 100 acquires the payment authentication success / failure information from the issuer server 300 (S26). The server device 100 transmits the acquired payment authentication success / failure information to the affiliated store server 200 (S27).

[0083] If the user authentication of the payment account is successful, each device in the authentication system 1 executes the process for the area indicated by the combined fragment opt2 (Option2). Specifically, the affiliated store server 200 executes the process for the payment of the transaction requested by the user (S28).

[0084] <5. Hardware configuration> 7, an example of a hardware configuration in which the above-mentioned server device 100 is realized by a computer 800 will be described. Note that the functions of each device can also be realized by dividing them into a plurality of devices.

[0085] As shown in FIG. 7, a computer 800 includes a processor 801, a memory 803, a storage device 805, an input I / F unit 807, a data I / F unit 809, a communication I / F unit 811, and a display device 813.

[0086] The processor 801 controls various processes in the computer 800 by executing programs stored in the memory 803. For example, each functional unit and the like included in the control unit 110 of the server device 100 can be realized as a program that is temporarily stored in the memory 803 and operates mainly on the processor 801.

[0087] The memory 803 is a storage medium such as a RAM (Random Access Memory), etc. The memory 803 temporarily stores the program code of the program executed by the processor 801 and data required when the program is executed.

[0088] The storage device 805 is a non-volatile storage medium such as a hard disk drive (HDD) or a flash memory. The storage device 805 stores an operating system and various programs for implementing the above-mentioned configurations. In addition, the storage device 805 can also store tables for registering user information and various account information, and a DB for managing the tables. Such programs and data are loaded into the memory 803 as necessary, and are referred to by the processor 801.

[0089] The input I / F unit 807 is a device for receiving input from a user. Specific examples of the input I / F unit 807 include a keyboard, a mouse, a touch panel, various sensors, a wearable device, etc. The input I / F unit 807 may be connected to the computer 800 via an interface such as a USB (Universal Serial Bus).

[0090] The data I / F unit 809 is a device for inputting data from outside the computer 800. A specific example of the data I / F unit 809 is a drive device for reading data stored in various storage media. The data I / F unit 809 may be provided outside the computer 800. In that case, the data I / F unit 809 is connected to the computer 800 via an interface such as a USB.

[0091] The communication I / F unit 811 is a device for performing data communication via the Internet N, either wired or wirelessly, with an external device of the computer 800. The communication I / F unit 811 may be provided outside the computer 800. In that case, the communication I / F unit 811 is connected to the computer 800 via an interface such as a USB.

[0092] The display device 813 is a device for displaying various types of information. Specific examples of the display device 813 include a liquid crystal display, an organic EL (Electro-Luminescence) display, a display of a wearable device, and the like. The display device 813 may be provided outside the computer 800. In that case, the display device 813 is connected to the computer 800 via, for example, a display cable. In addition, when a touch panel is adopted as the input I / F unit 807, the display device 813 can be configured integrally with the input I / F unit 807.

[0093] The above-mentioned embodiment is an example for explaining the present invention, and is not intended to limit the present invention to the embodiment. In addition, the present invention can be modified in various ways without departing from the gist of the present invention. Furthermore, a person skilled in the art can adopt an embodiment in which each element described below is replaced with an equivalent, and such an embodiment is also included in the scope of the present invention.

[0094] [Variations] Although the present invention has been described based on the above embodiment, the following cases are also included in the present invention.

[0095] [Variation 1] Some of the functional units included in the control unit 110 of the server device 100 according to the above embodiment may be provided in the service provider device or the payment provider device.

[0096] [Variation 2] In the above embodiment, an example was described in which the payment authentication information for executing user authentication of the payment account was included in the payment authentication request from the affiliated store server 200 of the service provider device, but the source of acquisition of the payment authentication information is not limited to this. The payment authentication information may be registered in advance in the payment account information stored in the payment storage unit 132.

[0097] For example, when a payment authentication request is accepted, the payment authentication unit 113a may refer to the payment storage unit 132 that stores payment account information including payment account identification information and payment authentication information, and issue an authentication instruction to the payment service provider device to execute user authentication of the payment account based on the payment authentication request and the payment account information. This authentication instruction includes the payment account identification information and the payment authentication information. With this configuration, there is no need to exchange highly confidential payment authentication information between the user device 400 and the affiliated store server 200, and between the affiliated store server 200 and the server device 100. This makes it possible to reduce security risks, particularly regarding communication for this exchange via the network N. This makes it possible to ensure information security.

[0098] [Variation 3] In the above embodiment, an example has been described in which an account for the VR commerce service of an affiliated store also serves as an account for the wallet service that the wallet operator provides to the user through the affiliated store, but the service account according to the present invention is not limited to this. For example, an account for the VR commerce service and an account for the wallet service may be provided separately. In this case, the service authentication success / failure information may indicate the success / failure of user authentication for at least one of the account for the VR commerce service and the account for the wallet service.

[0099] [Variation 4] Although not shown in the above embodiment, which of (A) payment authentication cooperation, (B) payment authentication proxy, and (C) automatic payment authentication is to be selected as the authentication method of the payment account may be selected manually by a user such as an issuer, or may be selected automatically based on a predetermined condition. In the latter example of automatic selection, for example, the payment authentication unit 113a may select one of (A) to (C) as the user authentication method of the payment account based on the evaluated risk of the user's payment. For example, the risk may be evaluated in three stages ("high", "medium", and "low"), and the payment authentication unit 113a may select (A) if the evaluated risk is "high", select (B) if the evaluated risk is "medium", and select "C" if the evaluated risk is "low". With this configuration, it is possible to select an appropriate authentication method of the payment account according to the risk of the user's payment. Furthermore, the payment authentication unit 113a may call up a user authentication function of the payment account of the issuer server 300 in addition to (A) to (C) based on the risk of the user's payment, and have the user authenticate using this issuer function. [Explanation of symbols]

[0100] 1...authentication system, 100...server device, 110...control unit, 111...acquisition unit, 112...reception unit, 113...authentication unit, 120...communication unit, 130...memory unit, 300...issuer server, 500...international brand server, 800...computer, 801...processor, 803...memory, 805...storage device, 807...input I / F unit, 809...data I / F unit, 811...communication I / F unit, 813...display unit.

Claims

1. On the computer, an acquisition function for acquiring service authentication success / failure information indicating the success / failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available; a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success / failure information indicates success of the user authentication; a payment authentication function that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information; a transmission function of transmitting, to the service provider device, payment authentication success / failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, the payment authentication success / failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success; The payment authentication function, as a process for the user authentication, issues an authentication instruction to the payment service provider device to execute user authentication of the payment account, the authentication instruction including the payment account identification information and the payment authentication information, The acquisition function acquires, in response to the authentication instruction, information indicating whether user authentication for the payment account has been successful or not from the payment service provider device; The transmission function generates the payment authentication success / failure information based on the information indicating the success / failure of the user acquired by the acquisition function, and transmits the payment authentication success / failure information to the service provider device. program.

2. A computer comprising: an acquisition function for acquiring service authentication success / failure information indicating the success / failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available; a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success / failure information indicates success of the user authentication; a payment authentication function that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information; a transmission function of transmitting, to the service provider device, payment authentication success / failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, the payment authentication success / failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success; The payment account information includes payment authentication information for performing user authentication of the payment account; The payment authentication function executes the user authentication based on the payment authentication information as a process for the user authentication, and generates the payment authentication success / failure information based on a result of the execution, The transmission function transmits the generated payment authentication success / failure information to the service provider device and the payment provider device. program.

3. A computer comprising: an acquisition function for acquiring service authentication success / failure information indicating the success / failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available; a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success / failure information indicates success of the user authentication; a payment authentication function that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information; a transmission function of transmitting, to the service provider device, payment authentication success / failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, the payment authentication success / failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success; The payment authentication function is As a process for the user authentication, if the service authentication success / failure information indicates a success of the user authentication, it is determined that the user authentication of the payment account is successful, and on the other hand, if the service authentication success / failure information indicates a failure of the user authentication, it is determined that the user authentication of the payment account is a failure; generating the payment authentication success / failure information based on the result of the determination; The transmission function transmits the generated payment authentication success / failure information to the service provider device and the payment provider device. program.

4. The computer includes: a service authentication reception function for receiving a service authentication request including service authentication information for performing user authentication of the service account from the service provider device or a user device of the user; a service authentication function of performing the user authentication based on the service authentication request and the service account information by referring to a service storage unit that stores service account information including service authentication information for performing user authentication of the service account; the service authentication function generates the service authentication success / failure information of the service account based on a result of the execution; The acquisition function acquires the generated service authentication success / failure information from the service authentication function, The transmission function transmits the generated service authentication success / failure information to the service provider device. The program according to any one of claims 1 to 3.

5. On the computer, an acquisition function for acquiring service authentication success / failure information indicating the success / failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available; a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means, when the service authentication success / failure information indicates success of the user authentication; a payment authentication function for, when the payment authentication request is accepted, referring to a payment storage unit that stores payment account information including the payment account identification information and payment authentication information for executing user authentication of the payment account, issuing an authentication instruction to a payment service provider device of the payment service provider based on the payment authentication request and the payment account information, the authentication instruction including the payment account identification information and the payment authentication information, and acquiring, in response to the authentication instruction, payment authentication success / failure information from the payment service provider device, which indicates success or failure of user authentication in the payment account and which prompts the service provider device to authorize the payment means for the payment service provider device if the user authentication indicates success; A transmission function of transmitting the acquired payment authentication success / failure information to the service provider device. program.

6. an acquisition unit that acquires service authentication success / failure information indicating success / failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available; a payment authentication receiving unit that receives, from a service provider device of the service that has received a payment request for the transaction of the user via the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success / failure information indicates success of the user authentication; a payment authentication unit that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information; a transmitter that transmits, to the service provider device, payment authentication success / failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, and that prompts the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success; the payment authentication unit issues, as a process for the user authentication, an authentication instruction to the payment business device to execute user authentication of the payment account, the authentication instruction including the payment account identification information and the payment authentication information; The acquisition unit acquires, in response to the authentication instruction, information indicating success or failure of user authentication for the payment account from the payment service provider device; the transmission unit generates the payment authentication success / failure information based on the information indicating the success / failure of the user authentication acquired by the acquisition unit, and transmits the payment authentication success / failure information to the service provider device. Authentication system.

7. The computer Acquire service authentication success / failure information indicating the success / failure of user authentication for the user's service account in a service in which a payment means provided by the payment service provider is available; receiving, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success / failure information indicates success of the user authentication; When the payment authentication request is accepted, a payment storage unit that stores payment account information including the payment account identification information is referenced, and processing for the user authentication is performed based on the payment authentication request and the payment account information; based on a result of the processing, transmitting payment authentication success / failure information indicating whether user authentication of the payment account has been successful, the payment authentication success / failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success; As a process for the user authentication, an authentication instruction is issued to the payment service provider device to instruct the payment service provider device to execute user authentication of the payment account, the authentication instruction including the payment account identification information and the payment authentication information; acquiring, from the payment service provider device, information indicating whether user authentication for the payment account has been successful or not in response to the authentication instruction; generating payment authentication success / failure information based on the acquired information indicating success / failure of the user authentication, and transmitting the payment authentication success / failure information to the service provider device; Information processing methods.

Images