Remittance system, remittance method, and program

Abstract

To provide a remittance system, a remittance method, and a program capable of improving the security of online remittance.SOLUTION: When receiving a remittance request from an external information terminal such as an information terminal 2 or a fishing site 4, a remittance system 1 specifies a global IP address of the information terminal and a global IP address of the information terminal used in the case where a user registered as a genuine user makes a remittance request, and determines whether or not the two specified global IP addresses match. If it is determined that they match, the remittance system 1 determines that the remittance request received from the external information terminal is valid.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a remittance system, a remittance method, and a program for performing online remittance. [Background technology]

[0002] In online remittance, there is a risk that remittance may be made by fraudulent means such as spoofing, so various computer systems have been proposed to prevent this. For example, Patent Documents 1 and 2 disclose systems that use a one-time password that is valid only once to prevent fraudulent remittances by third parties. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-8991 A [Patent Document 2] Patent No. 5965090 specification Summary of the Invention [Problem to be solved by the invention]

[0004] However, if the one-time password is stolen, for example by a phishing site, there is a risk that fraudulent remittances may be made using the above-mentioned conventional technology.

[0005] The present invention has been made in view of the above circumstances, and its main object is to provide a remittance system, a remittance method, and a program that can solve the above problems. [Means for solving the problem]

[0006] In order to solve the above problems, a remittance system of one embodiment of the present invention comprises a first identification unit that, when a remittance request is received from an external information terminal, identifies a global IP address of the information terminal, a second identification unit that identifies a global IP address of the information terminal used when a user who is registered as a genuine user makes a remittance request, and a determination unit that determines that the remittance request received from the external information terminal is legitimate if the global IP address identified by the first identification unit and the global IP address identified by the second identification unit match.

[0007] In the above aspect, the device may further include a transmitting unit that transmits authentication information for user authentication to the registered user when a remittance request is received from the external information terminal, and when information matching the authentication information is received after transmitting the authentication information, the second identification unit may identify the global IP address of the information terminal that transmitted the matching information as the global IP address of the information terminal to be used when the registered user makes a remittance request.

[0008] In addition, in the above aspect, the system may further include a transmitting unit that, when a remittance request is received from the external information terminal, transmits to the registered user acceptance confirmation information indicating that the remittance request has been accepted, and when received information indicating that the registered user has received the acceptance confirmation information via an information terminal executing a program that allows access to the remittance system but does not allow access to communication destinations other than the remittance system, the second identification unit may identify the global IP address of the information terminal executing the program as the global IP address of the information terminal to be used when the registered user makes a remittance request.

[0009] In addition, in the above aspect, the device may further include a transmitting unit that transmits authentication information for user authentication to the registered user when a remittance request is received from the external information terminal, and when, after transmitting the authentication information, information matching the authentication information is received via a program from an information terminal that is executing a program that allows access to the remittance system but does not allow access to communication destinations other than the remittance system, the second identification unit may identify the global IP address of the information terminal that is executing the program as the global IP address of the information terminal to be used when the registered user makes a remittance request.

[0010] In addition, in the above-mentioned aspect, if the global IP address identified by the first identification unit and the global IP address identified by the second identification unit do not match, a retransmission request unit may send a retransmission request to the registered user, and when a retransmission request is accepted in response to the retransmission request, the second identification unit may identify the global IP address of the sender of the retransmission request as the global IP address of the external information terminal.

[0011] In addition, in one aspect of the remittance method of the present invention, when a remittance request is received from an external information terminal, the computer identifies the global IP address of the information terminal, and the computer identifies the global IP address of an information terminal used when a user who is registered as a genuine user makes a remittance request, and if the identified global IP address of the external information terminal matches the global IP address of the information terminal used when the registered user makes a remittance request, the computer determines that the remittance request received from the external information terminal is legitimate.

[0012] In addition, a program of one aspect of the present invention causes a computer to function as an access unit that allows access to the remittance system of the above aspect but does not allow access to communication destinations other than the remittance system, and a transmission unit that transmits received information indicating that the registered user has received the reception confirmation information transmitted from the remittance system to the remittance system via the access unit.

[0013] In addition, a program of another aspect of the present invention causes a computer to function as an access unit that allows access to the remittance system of the above aspect but does not allow access to communication destinations other than the remittance system, and a transmission unit that, when a registered user receives authentication information for user authentication sent from the remittance system, transmits information matching the authentication information to the remittance system via the access unit.

[0014] In addition, a program of another aspect of the present invention is configured to cause a computer to function as a transmitting unit that, when a registered user receives a request to resend a remittance request sent from the remittance system of the above aspect, transmits a remittance request in response to the remittance request to the remittance system. Effect of the Invention

[0015] According to the present invention, it is possible to prevent remittances from being made through fraudulent means such as spoofing. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a block diagram showing the configuration of a remittance system and its communication destination. [Diagram 2] 11 is a flowchart showing the procedure for a remittance request acceptance process. [Diagram 3] 11 is a flowchart showing the procedure of a remittance request authentication process. [Figure 4] FIG. 13 is a diagram showing an example of an authentication information input screen. [Diagram 5] 11 is a flowchart showing the procedure of a validity determination process. [Figure 6] 13 is a flowchart showing a procedure for a retransmission request process. [Figure 7] FIG. 13 is a diagram showing an example of a received information input screen. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Preferred embodiments of the present invention will be described below with reference to the drawings. Note that the following embodiments are merely examples of methods and devices for embodying the technical idea of ​​the present invention, and the technical idea of ​​the present invention is not limited to the following. The technical idea of ​​the present invention can be modified in various ways within the technical scope described in the claims.

[0018] The remittance system of this embodiment is a computer system for executing remittance processing in response to remittance requests received online. The program of this embodiment is for an information terminal to access this remittance system. The configurations and operations of this remittance system and information terminal are described below.

[0019] [System configuration] FIG. 1 is a block diagram showing the configuration of a remittance system and its communication destination according to this embodiment. The remittance system 1 is a computer system operated by a business operator such as a financial institution that provides online remittance services. The information terminal 2 and smartphone 3 are devices operated by a user who uses the remittance service to remit money. The remittance system 1, the information terminal 2, and the smartphone 3 can communicate with each other via the Internet 101.

[0020] It should be noted that there exist phishing sites 4 on the Internet 101 that pose as businesses offering remittance services and carry out fraudulent activities. The remittance system 1 prevents such phishing sites 4 from carrying out fraudulent remittances.

[0021] The remittance system 1 is a system composed of a computer equipped with a control unit including a CPU, RAM, and ROM, and each process described below is executed by this control unit. The remittance system 1 also has a member database (DB) 11 for storing information about each user who is preregistered as a member (genuine user) who can use the remittance service. Specifically, information about each user's financial institution account, the user ID and password required for each user to log in to the remittance system 1, and each user's contact information (such as telephone number and email address) are stored in the member DB11.

[0022] The information terminal 2 is composed of a personal computer. A remittance program 21 having a function of allowing access to the remittance system 1 and disallowing access to other communication destinations is stored in the storage device of the information terminal 2. The remittance program 21 is a program pre-installed in the information terminal 2 by each user.

[0023] The information terminal 2 may be an information terminal other than a personal computer, such as a tablet terminal or a smartphone. The smartphone 3 may function as the information terminal 2.

[0024] [System Operation] Next, the operation of the remittance system 1 and the information terminal 2 configured as described above will be described with reference to a flowchart. In this embodiment, the remittance system 1 and the information terminal 2 execute the following processes: (1) a remittance request acceptance process for the remittance system 1 to accept an online remittance request, and (2) a remittance request authentication process for authenticating the remittance request. The details of these processes will be described below.

[0025] (1) Remittance request acceptance process 2 is a flowchart showing the procedure of the remittance request acceptance process executed by the remittance system 1 and the information terminal 2. Each process executed by the information terminal 2 in this remittance request acceptance process is performed via a known Internet browser.

[0026] A user requesting remittance first accesses the remittance system 1 using the information terminal 2. As a result, a login screen for logging in to the remittance system 1 is displayed on the display unit of the information terminal 2.

[0027] The user inputs a preset user ID and password into the login screen. The information terminal 2 that receives this input transmits a login request including the input user ID and password to the remittance system 1 (S101).

[0028] When the remittance system 1 receives a login request from the information terminal 2 (S201), it checks whether the user ID and password included in the login request match the user ID and password stored in the member DB 11, and then transmits selection screen information for selecting each service, including the remittance service, to the information terminal 2 (S202). If the user ID and password do not match, information indicating that login is not possible is transmitted to the information terminal 2.

[0029] When the information terminal 2 receives the selection screen information from the remittance system 1 (S102), it displays the selection screen on the display unit according to the selection screen information and prompts the user for input. The user who wishes to remit selects a remittance service on the selection screen. The information terminal 2, which has accepted this selection, transmits a remittance request to the remittance system 1 (S103).

[0030] In this embodiment, the login request and the remittance request are made separately, but they may be made simultaneously. That is, a single request that combines the login request and the remittance request may be sent from the information terminal 2 to the remittance system 1.

[0031] When the remittance system 1 receives a remittance request from the information terminal 2 (S203), it acquires the global IP address included in the remittance request as the global IP address of the information terminal 2 (S204). This global IP address is stored in a predetermined storage area of ​​the remittance system 1.

[0032] Next, the remittance system 1 acquires the contact information of the member (registered user) who made the remittance request from the member DB 11 based on the login ID accepted in step S201, and transmits authentication information for user authentication to the contact information (S205). This ends the remittance request acceptance process.

[0033] The authentication information is transmitted by SMS (Short Message Service) or email and is received by the smartphone 3 owned by the user. However, in addition to this, the authentication information may be transmitted to a specific application executed on the smartphone 3 and received by the application. Note that as the authentication information, for example, a character string consisting of numbers and the like is used.

[0034] The above-mentioned remittance request acceptance process executed by the information terminal 2 can also be executed on behalf of the information terminal 2 by a phishing site 4 that has defrauded the user of the user's user ID and password required for logging in to the remittance system 1. Therefore, at this point in time, the remittance system 1 cannot determine whether the remittance request accepted in step S203 is legitimate or not. Its legitimacy is confirmed in the remittance request authentication process that is performed next.

[0035] (2) Remittance request authentication process As a result of the remittance request process described above, the authentication information transmitted from the remittance system 1 to the smartphone 3 is received by the smartphone 3 and displayed on its display. Since the authentication information is transmitted to a user who has been registered as a member who can use the remittance service, only the registered user, i.e., the genuine user, can view the authentication information on the display of the smartphone 3. Having viewed the authentication information, the user instructs the information terminal 2 to execute the remittance program 21. This starts the remittance request authentication process described below.

[0036] 3 is a flowchart showing the procedure of the remittance request authentication process executed by the remittance system 1 and the information terminal 2. The information terminal 2 starts up the remittance program 21 in response to an instruction from the user (S301). Subsequent processes in the information terminal 2 are executed by the remittance program 21. As described above, the remittance program 21 has a function of permitting access to the remittance system 1 but prohibiting access to other communication destinations. Therefore, the information terminal 2 performs subsequent communication processes only with the remittance system 1, and does not perform them with other communication destinations, such as the phishing site 4.

[0037] The user inputs authentication information displayed on the display unit of the smartphone 3 to the screen displayed on the display unit of the information terminal 2. This screen is an authentication information input screen displayed by the remittance program 21 being executed on the information terminal 2. Figure 4 is a diagram showing an example of the authentication information input screen.

[0038] 4, the authentication information input screen 22 has display fields for displaying the branch number of the financial institution from which the remittance originates and the account number of the financial institution account of the user from which the remittance originates, an input field for inputting authentication information, and a send button 22a for instructing the transmission of the input information. Note that the display of these display fields is based on information related to the financial institution account of the user registered in the member DB 11.

[0039] The user inputs the authentication information displayed on the display unit of the smartphone 3 into the input field of the authentication information input screen 22, and then clicks the send button 22a. When the information terminal 2 accepts the input of the authentication information (S302), in response to the click of the send button 22a, it transmits an authentication request including the input authentication information to the remittance system 1 (S303).

[0040] When the remittance system 1 receives an authentication request from the information terminal 2 (S401), it executes a validity determination process to determine the validity of the remittance request accepted in the previous remittance request acceptance process (S402).

[0041] Fig. 5 is a flow chart showing the procedure of the above-mentioned validity determination process. As shown in Fig. 5, the remittance system 1 first determines whether the authentication information included in the authentication request received from the information terminal 2 matches the authentication information sent in step S205 of the remittance request acceptance process (S501).

[0042] If it is determined in step S501 that the authentication information does not match (NO in S501), the remittance system 1 determines whether the number of times the authentication information has been input has reached an upper limit (e.g., three times) (S502). If it is determined that the upper limit has not been reached (NO in S502), the remittance system 1 transmits a re-input request to the information terminal 2 to request re-input of the authentication information (S503). If the information terminal 2 transmits authentication information including the authentication information again in response to this re-input request, the remittance system 1 returns to step S401 to receive the authentication information, and then executes the validity determination process again.

[0043] Also, if it is determined in step S502 that the upper limit has been reached (YES in S502), that is, if incorrect authentication information has been repeatedly sent from the information terminal 2 until the upper limit is reached, the remittance system 1 determines that the previous remittance request is fraudulent (S504) and ends the process. Since the mismatch in authentication information is assumed to indicate that an authentication request has been made by someone other than the genuine user, the process ends without responding to the previous remittance request.

[0044] Furthermore, if it is determined in step S501 that the authentication information matches (YES in S501), the remittance system 1 acquires the global IP address included in the authentication request received in step S401 as the global IP address of the information terminal 2 (S505), and determines whether the acquired global IP address matches the global IP address acquired in step S204 in the remittance request acceptance processing (S506).

[0045] If it is determined in step S506 that the global IP addresses do not match (NO in S506), the remittance system 1 determines that the previous remittance request is fraudulent (S504) and ends the process. If the two global IP addresses do not match, it is assumed that the previous remittance request was sent from a device other than the information terminal 2 (e.g., the phishing site 4, etc.), and therefore the previous remittance request is determined to be fraudulent as described above.

[0046] On the other hand, if it is determined in step S506 that the global IP addresses match (YES in S506), the remittance system 1 determines that the previous remittance request is valid (S507). In this case, returning to Fig. 3, the remittance system 1 executes remittance processing to transfer money according to the remittance request (S403). Specifically, based on the remittance destination and remittance amount acquired from the user side, the remittance system 1 executes the processing required to transfer money from the user's financial institution account.

[0047] In this embodiment, since only a genuine user can send an authentication request including correct authentication information, the sender of the authentication request is an information terminal operated by the genuine user (an information terminal used when a genuine user makes a remittance request). Therefore, if the global IP address of the sender of the authentication request matches the global IP address of the sender of the previous remittance request, it can be said that the sender of the remittance request is an information terminal operated by a genuine user, and therefore, as described above, the previous remittance request can be determined to be legitimate.

[0048] Unlike device-specific identification information such as a MAC address, the global IP address of the information terminal 2 may change depending on time, location, etc. Therefore, even if the remittance system 1 obtains and registers the global IP address of the information terminal 2 in advance, it may not be possible to use it to determine the validity of a remittance request received thereafter. In the case of this embodiment, the global IP address of the information terminal 2 is obtained each time, so the validity of a remittance request can be correctly determined even if the global IP address changes.

[0049] If the previous remittance request is determined to be fraudulent, there is a possibility that the remittance request was sent from the phishing site 4. Therefore, if the remittance system 1 determines that the previous remittance request is fraudulent, it may be configured to send a password change request to the registered user. Furthermore, if the remittance system 1 receives a login request using the old password after the password has been changed in response to this change request, it may determine that the login request has been received from the phishing site 4, and register the global IP address, etc., related to the login request in the fraud list.

[0050] However, when a user operates the information terminal 2 while moving, the communication environment of the information terminal 2 may change. Therefore, when a remittance request and an authentication request are sent from the information terminal 2 in response to the user's operation while the user is moving, the global IP address of the information terminal 2 may change between the time the remittance request is sent and the time the authentication request is sent. To enable the remittance process to be executed even in such a case, the remittance request may be prompted to be resent. The resend request process for this purpose will be described below.

[0051] 6 is a flowchart showing the procedure of the retransmission request process executed by the remittance system 1 and the information terminal 2. When the remittance system 1 determines in step S506 of the above-mentioned validity determination process that the global IP addresses do not match, it sends a retransmission request to the information terminal 2 (S601).

[0052] When the information terminal 2 receives a retransmission request from the remittance system 1 (S701), it transmits a remittance request in response to the retransmission request (S702). This remittance request is transmitted upon receiving a transmission instruction from the user. Therefore, if the user does not wish to remit money, this remittance request will not be transmitted.

[0053] When the remittance system 1 receives a remittance request from the information terminal 2 (S602), it acquires the global IP address included in the remittance request (S603) and judges whether the global IP address matches the global IP address of the sender of the authentication request acquired in the previous step S505 (S604). If it is judged that they match (YES in S604), the remittance system 1 judges that the previous remittance request is valid (S605). On the other hand, if it is judged that they do not match (NO in S604), the remittance system 1 judges that the previous remittance request is invalid (S606).

[0054] According to the above resend request process, even if the communication environment of the information terminal 2 changes, it is possible to determine the validity of the remittance request using the global IP address.

[0055] (Other embodiments) In the above embodiment, the sender of the authentication request is the information terminal used when a genuine user makes a remittance request, and the remittance system 1 checks the global IP address of the sender against the global IP address of the previous remittance request, but this is not limited to the above. For example, if the global IP address of the information terminal used when a genuine user makes a remittance request is known in advance, the remittance system 1 may store the global IP address, and when a remittance request is subsequently received, the remittance system 1 may check the validity of the remittance request by checking the global IP address of the sender of the remittance request against the stored global IP address.

[0056] In the above embodiment, the validity of the remittance request is determined using the global IP address and authentication information, but the validity may be determined only by the global IP address without using the authentication information. For example, the remittance system 1 may transmit reception confirmation information indicating that the remittance request has been received to the registered user in step S205 of the remittance request reception process, instead of transmitting authentication information to the registered user. In this case, the user's information terminal 2 transmits received information indicating that the reception confirmation information has been received to the remittance system 1. The remittance system 1, which has received this received information, can determine the validity of the remittance request by comparing the global IP address included in the received information with the global IP address of the sender of the previous remittance request.

[0057] 7 is a diagram showing an example of a received information input screen for inputting the above-mentioned received information in the information terminal 2. The user checks the received check box provided on the received information input screen 23 and clicks the send button 23a. The information terminal 2 receiving this sends the received information to the remittance system 1, and the remittance system 1 that receives the received information checks the global IP address as described above to determine the validity of the remittance request.

[0058] The above-mentioned transmission of the received information is executed by the remittance program 21. The remittance program 21 has a function of permitting access to the remittance system 1 and prohibiting access to other communication destinations, so that information is not sent from the remittance program 21 to the remittance system 1 via an illegal website such as a phishing site 4. Therefore, when the remittance system 1 receives the received information from the remittance program 21, it can consider the received information to have been sent by a genuine user.

[0059] In the above embodiment, the remittance system 1 receives an authentication request after receiving a remittance request from the information terminal 2 and performs the legitimacy determination process, but this is not limited to the above. For example, the remittance system 1 may transmit authentication information to a registered user before receiving a remittance request, and after receiving an authentication request including the authentication information from the information terminal 2, receive the remittance request from the information terminal 2 and perform the legitimacy determination process. Even in this case, the legitimacy determination process involves checking the global IP addresses of the information terminal 2 that is the sender of the authentication request and the information terminal 2 that is the sender of the remittance request. [Explanation of symbols]

[0060] 1. Remittance System 11 Membership Database 2. Information terminal 21 Remittance Program 3. Smartphone 4. Phishing Sites 101 Internet

Claims

1. a first identification unit that identifies a global IP address of an external information terminal when a remittance request is received from the external information terminal; a transmission unit which, when receiving a remittance request from the external information terminal, transmits authentication information for user authentication to a user who has been registered as a genuine user; a second identification unit which, when receiving information matching the authentication information after transmitting the authentication information, identifies a global IP address of an information terminal which has transmitted the matching information as a global IP address of an information terminal which is to be used when the registered user makes a remittance request; a determination unit that determines that the remittance request received from the external information terminal is valid when the global IP address specified by the first determination unit and the global IP address specified by the second determination unit match; a retransmission request unit that transmits a retransmission request to the registered user when the global IP address specified by the first specification unit does not match the global IP address specified by the second specification unit; a third identification unit that identifies a global IP address of an information terminal that has transmitted the remittance request when the remittance request is received in response to the retransmission request; Equipped with the determination unit determines that the remittance request accepted from the external information terminal is valid when the global IP address identified by the second identification unit and the global IP address identified by the third identification unit match. Money transfer system.

2. the second identification unit, when receiving information matching the authentication information from an information terminal executing a program that allows access to the remittance system and does not allow access to communication destinations other than the remittance system, identifies the global IP address of the information terminal that sent the matching information as the global IP address of the information terminal used when the registered user makes a remittance request; 2. The remittance system according to claim 1.

3. (a) when a remittance request is received from an external information terminal, a computer of the remittance system identifies a global IP address of the information terminal; (b) when a remittance request is received from the external information terminal, the computer transmits authentication information for user authentication to a user who has been registered as a genuine user; (c) when receiving information matching the authentication information after transmitting the authentication information, the computer specifies the global IP address of the information terminal that transmitted the matching information as the global IP address of the information terminal used when the registered user makes a remittance request; (d) a step in which, when the global IP address of the external information terminal identified in the step (a) matches the global IP address of the information terminal used when the registered user makes a remittance request identified in the step (c), the computer determines that the remittance request received from the external information terminal is valid; a step (e) of the computer sending a retransmission request to the registered user when the global IP address specified in the step (a) does not match the global IP address of the information terminal used when the registered user makes a remittance request specified in the step (c); (f) when a remittance request is received in response to the retransmission request, the computer specifies a global IP address of an information terminal that has sent the retransmission request; a step (g) of determining that the remittance request received from the external information terminal is valid when the global IP address specified in the step (c) matches the global IP address specified in the step (f); A method of sending money.

4. In the step (c), when information matching the authentication information is received from an information terminal executing a program that allows access to the remittance system and prohibits access to communication destinations other than the remittance system, the computer identifies the global IP address of the information terminal that sent the matching information as the global IP address of the information terminal used when the registered user makes a remittance request. The method of claim 3.

Images