Application program, information processing system, and information processing method

Abstract

To improve security. [Solution] When a card used for payment is brought close to a terminal device equipped with the computer, the application program uses the communication unit of the terminal device to wirelessly communicate with the communication unit of a circuit unit including a communication unit included in the card and a memory unit in which information is stored, obtains related information related to the card and authentication information used to authenticate the card, sends the related information and the authentication information to a server device to perform the authentication, and determines whether or not to associate the card with an application program based on the authentication results obtained from the server device.

Description

[Technical Field]

[0001] The present invention relates to an application program, an information processing system, a server device, and an information processing method. [Background technology]

[0002] A server has been disclosed that performs authentication by comparing the card identifier of a card with a card identifier in a database (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2024-505584 Summary of the Invention [Problem to be solved by the invention]

[0004] The above techniques have not always provided sufficient security.

[0005] The present invention has been made in consideration of the above circumstances, and one of its objects is to provide an application program, an information processing system, a server device, and an information processing method that can further improve security. [Means for solving the problem]

[0006] One aspect of the present invention is an application program that, when a card used for payment is brought close to a terminal device equipped with the computer, uses a communication unit of the terminal device to wirelessly communicate with a communication unit of a circuit unit including a communication unit included in the card and a memory unit in which information is stored, obtains related information related to the card and authentication information used to authenticate the card, transmits the related information and the authentication information to a server device to perform the authentication, and determines whether or not to associate the card with an application program based on the authentication result obtained from the server device. [Effects of the Invention]

[0007] According to one aspect of the present invention, it is possible to provide an application program, an information processing system, a server device, and an information processing method that can further improve security. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration for realizing an electronic payment service. [Figure 2] This is a sequence diagram (part 1) illustrating the general flow of electronic payment. [Figure 3] This is a sequence diagram (part 2) illustrating the general flow of electronic payment. [Figure 4] 1 is a configuration diagram of a payment server 100 according to an embodiment. [Figure 5] FIG. 10 is a diagram showing an example of the contents of user information 172. [Figure 6] FIG. 10 is a diagram showing an example of the contents of affiliated store / store information 176. [Figure 7] FIG. 2 is a diagram illustrating the configuration of a card server 200. [Figure 8] FIG. 2 is a diagram showing an example of the contents of authentication information 260. [Figure 9] FIG. 10 is a diagram illustrating an example of a scene in which authentication processing is performed. [Figure 10] FIG. 10 is a diagram illustrating an authentication process. [Figure 11] FIG. 10 is a sequence diagram mainly showing the second authentication process. [Figure 12] FIG. 10 is a sequence diagram mainly showing the first authentication process. [Figure 13] FIG. 2 is a diagram showing an example of authentication result information 270. [Figure 14] FIG. 10 is a sequence diagram showing an example of a processing flow relating to a new one-time code and a new write password. [Figure 15] FIG. 10 is a sequence diagram mainly showing the first authentication process. [Figure 16] FIG. 10 is a sequence diagram mainly showing the second authentication process. [Figure 17] FIG. 10 is a diagram for explaining a process of a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, with reference to the drawings, embodiments of an application program, an information processing system, a server device, an information processing method, and an information processing device according to the present invention will be described. Various devices, such as the "server" mentioned below, that provide services to users or perform internal analysis may be realized by a group of distributed devices, and each device may be operated by a different business. Furthermore, the hardware owner (the cloud server provider) and the business that actually operates the device may also be different. The application program and the payment server work together to provide an electronic payment service. In the following description, the application program is referred to as a payment app. An electronic payment service is a service that supports payments for the purchase of goods and services at a store. A store is, for example, a physical store (real-world store) existing in real space, but may also include a virtual store for e-commerce transactions. Virtual stores may also include those operated by an entity other than the operator of the electronic payment service. In such cases, a transition to an interface screen for the electronic payment service may be performed when making a payment for a purchase at the virtual store. In an electronic payment service, a store is treated as belonging to, for example, an affiliated store (brand), and processing such as payment when a purchase is made at the store is primarily conducted between the user and the affiliated store. Alternatively, processing such as payment may be carried out between the user and the store.

[0010] [Electronic payment service] FIG. 1 shows an example of the configuration of an electronic payment system in which an electronic payment service is realized. The electronic payment service is realized mainly by a payment server 100. The electronic payment system that realizes the electronic payment service includes, for example, one or more credit cards C, one or more user terminal devices 10, one or more first store terminal devices 50, one or more second store terminal devices 70, the payment server 100, and a card server 200 (server device). These devices communicate, for example, via a network NW. The network NW includes, for example, the Internet, a LAN (Local Area Network), a wireless base station, a provider device, etc. Some or all of the functional components included in the electronic payment system may be distributed in any form across multiple devices or integrated into any device.

[0011] In this embodiment, a credit card C is used for the explanation, but in addition to (or instead of) the credit card C, other electronic payment cards such as a debit card may also be used.

[0012] [User terminal device] The user terminal device 10 is, for example, a portable terminal device such as a smartphone or tablet terminal. The user terminal device 10 is a computer device having at least an optical reading function, a communication function, a display function, an input acceptance function, and a program execution function. In the following description, components for realizing these functions are referred to as a camera, a communication device, a touch panel, a CPU (Central Processing Unit), etc. In the user terminal device 10, a processor such as a CPU executes a payment app 20, which operates in cooperation with the payment server 100 to provide electronic payment services to users. The payment app 20 is installed on the user terminal device 10 from, for example, an application store, and controls the camera, communication device, touch panel, etc.

[0013] [First store terminal device] The first store terminal device 50 is installed, for example, in a store. The first store terminal device 50 is a computer device having at least a product price acquisition function, an optical reading function, a program execution function, and a communication function. The first store terminal device 50 includes a so-called POS (Point of Sale) device, and the product price acquisition function and the optical reading function may be realized by the POS device. The store code image 60 is placed in the store and is a code image such as a QR code (registered trademark) printed on a paper or plastic medium. The store code image 60 may be displayed on a display placed in the store (which may be the display of a terminal device such as a smartphone).

[0014] [Second store terminal device] The second store terminal device 70 is used by the operator of the affiliated store. The second store terminal device 70 is a smartphone, tablet terminal, personal computer, etc. An interface for affiliated stores 72 runs on the second store terminal device 70. The interface for affiliated stores 72 may be an app for affiliated stores or a browser. The interface for affiliated stores 72 accepts coupon settings and the like from the operator of the affiliated store and transmits them to the payment server 100. The second store terminal device 70, which is a smartphone, has the function of displaying a code image corresponding to a store code image and reading the code image displayed by the user terminal device 10 by executing the app for affiliated stores.

[0015] [Payment server] The payment server 100 realizes electronic payment based on payment information received from the user terminal device 10 or the first store terminal device 50. The first store terminal device 50 may include a POS device and an affiliated store server, in which case payment information is sent from the POS device via the affiliated store server to the payment server 100. In the following explanation, this distinction will not be made and it is assumed that payment information is sent from the first store terminal device 50.

[0016] 2 and 3 are sequence diagrams illustrating the general flow of electronic payment. There may be two patterns for electronic payment: Pattern 1 and Pattern 2.

[0017] In the case of pattern 1 (hereinafter referred to as user scan) shown in FIG. 2, the user terminal device 10, with the payment application 20 running, decodes the store code image 60 using its optical reading function (S1). The store code image 60 includes store URL (Uniform Resource Locator) information. This store URL is the domain of the electronic payment service to which store identification information has been added, and is associated with an affiliated store ID, store ID, etc. in the payment server 100 (described below). The payment application 20 sends first payment information including the store URL and account ID to the payment server 100 (S2). The payment server 100 searches for store information (described below) using the affiliated store ID and store ID corresponding to the store URL, acquires the affiliated store name and store name information (S3), and sends this to the payment application 20 (S4). The user enters the payment amount into the user terminal device 10 on the screen displaying the affiliated store name and store name (S5). Then, the user terminal device 10 generates second payment information including at least the payment amount and sends it to the payment server 100 (S6). The payment server 100 makes the electronic payment based on the received second payment information (S7). The payment server 100 then sends a payment completion notice (information for displaying a payment completion screen) to the payment app 20 (S8), and the payment app 20 displays the payment completion screen (S9). Note that when the store code image 60 is displayed on a display installed in the store, the store code image 60 may include information on the payment amount in addition to the store URL. In this case, the step of the user inputting the payment amount is omitted, and the payment amount information is included in the first payment information and sent to the payment server 100. Information on the affiliated store name and store name may be included and displayed on the payment completion screen.

[0018] In the case of pattern 2 (hereinafter referred to as store scan) shown in FIG. 3, the payment app 20 sends a request to issue a one-time code to the payment server 100 when the payment app 20 is launched, when a payment operation is performed in the payment app 20, at the automatic update timing (e.g., every minute), and at other timings (S11). The payment server 100 generates a one-time code (S12) and sends it to the payment app 20 (S13). The payment app 20 displays a code image, such as a QR code or barcode, generated based on the one-time code (S14). The user holds (presents) the display surface of the user terminal device 10 over the first in-store terminal device 50, and the first in-store terminal device 50 decodes the code image using its optical reading function and obtains the one-time code, etc. (S15). The first in-store terminal device 50 then generates payment information including the one-time code, payment amount, affiliated store ID, store ID, etc., and sends it to the payment server 100 (S16). The payment amount information is acquired in advance by reading a barcode, manually entering it, etc. Based on the received information, the payment server 100 identifies the user corresponding to the one-time code and performs electronic payment (S17). Then, the payment server 100 sends a payment completion notice to the payment application 20 (S18), and the payment application 20 displays a payment completion screen (S19).

[0019] Note that electronic payment may be performed using only one of the above patterns. Furthermore, the "account ID" described in FIG. 2 may be other information (e.g., a phone number) that can be used as user identification information. Furthermore, issuing a one-time code may be omitted in store scanning, and the payment application 20 may display a code image generated based on the user's account ID. In this case, the payment server 100 identifies the user corresponding to the account ID instead of identifying the user corresponding to the one-time code.

[0020] [Payment server functional configuration] 4 is a configuration diagram of the payment server 100. The payment server 100 includes, for example, a communication unit 110, a content providing unit 120, a payment processing unit 130, an information management unit 140, and a storage unit 170. The components other than the communication unit 110 and the storage unit 170 are realized by, for example, a hardware processor such as a CPU executing a program (software). Some or all of these components may be realized by hardware (including circuitry) such as an LSI (Large Scale Integration), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), a GPU (Graphics Processing Unit), or an SOC (System On Chip), or may be realized by a combination of software and hardware. The program may be stored in advance in a storage device such as an HDD (Hard Disk Drive) or flash memory (a storage device with a non-transitory storage medium), or may be stored in a removable storage medium (a non-transitory storage medium) such as a DVD or CD-ROM, and installed in the storage device by inserting the storage medium into a drive device.

[0021] The storage unit 170 is a HDD, flash memory, RAM (Random Access Memory), etc. The storage unit 170 may be a NAS (Network Attached Storage) device that the payment server 100 can access via a network. The storage unit 170 stores information such as user information 172, content information 174, affiliated store / shop information 176, and authentication result information 270 (described later). Some of this information may be stored in the storage unit of the user terminal device 10. Details of each piece of information will be described later.

[0022] The communication unit 110 is a communication interface for connecting to the network NW, and is, for example, a network interface card.

[0023] The content providing unit 120 has, for example, a web server function, and provides information (content) for displaying various screens of the electronic payment service to the user terminal device 10. The content providing unit 120 reads out necessary content from the content information 174 as appropriate and provides it to the user terminal device 10. The user terminal device 10 accepts various inputs from the user while content is being played by the payment application 20, and transmits the above-mentioned payment information and the like to the payment server 100. The above content may be generated by the payment application 20. In this case, the content providing unit 120 provides the payment application 20 with information necessary for generating the content.

[0024] The payment processing unit 130 performs payment processing based on the payment information transmitted by the user terminal device 10 or the first store terminal device 50. The payment processing unit 130 performs payment processing while referring to the user information 172.

[0025] [User information] FIG. 5 is a diagram showing an example of the contents of user information 172. User information 172 is an example of user registration information. User information 172 includes, for example, a user URL, account ID, telephone number, and password, as well as associated information such as email address, user ID, name, address, date of birth, registration date, charge balance, credit card payment settings, credit card limit, credit card payment amount, available credit card payment amount, payment method settings, bank account, credit card number, charge history information, and payment history information. The user URL is used for remittance processing between users. Registration of a telephone number and password is required when registering for an electronic payment service. The account ID is issued to the user by the payment server 100, and the user ID can be set by the user (or does not have to be set). Similarly, the email address, name, address, and date of birth can be set by the user (or do not have to be set). The registration date is the date on which the user registered for the electronic payment service (the date on which the account was created). Hereinafter, the user's instance (electronic payment account) to which this information is associated will be referred to as an account.

[0026] The charge balance is information indicating the balance of electronic money set by the user by transferring funds to the account in advance. Transfer methods include transfer from a designated service provider (bank) ATM (Automatic Teller Machine) or transfer from a registered bank account. The credit payment setting is information indicating whether the settings for enabling electronic credit payments using the payment app 20 have been completed and is set to either "completed" or "not completed." The credit payment limit is the monthly credit payment limit, the credit payment usage amount is the amount of credit payments already used in the current month, and the available credit payment amount is the amount of credit payments available in the current month, calculated by subtracting the credit payment usage amount from the credit payment limit. While the figure shows only one credit payment limit, in reality, there may also be daily limits, and the lower of these may be set as the credit payment limit. Further details of credit payments will be described later. The payment method setting is setting information indicating whether the user will make electronic payments using the charge balance or by credit payment at that time. The bank account and credit card number are information on the bank account or credit card number (account number, card number) that can be used to deposit funds into the electronic payment service. The charge history information is a history of the user's previous transfers to the electronic payment service to increase the charge balance. The payment history information is information that shows the breakdown of payments made by the user for each payment (date and time, store ID of the store where the purchase was made, payment amount, payment method, etc.).

[0027] [Affiliated store / store information] 6 is a diagram showing an example of the contents of affiliated store / store information 176. The affiliated store / store information 176 includes, for example, a first table 176A in which an affiliated store ID and a store ID are associated with a store URL, a second table 176B in which an affiliated store ID is associated with an affiliated store name and sales amount (described above), and a third table 176C in which a store ID is associated with a store name. In addition to this information, the affiliated store / store information 176 may also include information such as the category of the affiliated store or store, the store's location, and payment patterns.

[0028] The information management unit 140 acquires information provided by other server devices, terminal devices, and card server 400. The information management unit 140 manages user information 172 and affiliated store / store information 176 based on information acquired from the user terminal device 10 and second store terminal device 70. The information management unit 140 adds new records to, edits, deletes, etc., the user information 172 and affiliated store / store information 176.

[0029] [Electronic Payment] When payment information is acquired from the user terminal device 10 or the first store terminal device 50, the payment processing unit 130 references the user information 172 to acquire the "payment method setting" of the user. For users whose "payment method setting" is set to "charge balance," the payment processing unit 130 performs electronic payment as follows: For example, the payment processing unit 130 performs electronic payment by decreasing the charge balance managed in association with the user ID and increasing the item value of the affiliated store's sales proceeds. The item value of the affiliated store's sales proceeds is not itself used as electronic money, for example, but rather the amount corresponding to the item value of the sales proceeds is transferred to a bank account in a cycle according to an agreement between the affiliated store and the electronic payment service.

[0030] The payment processing unit 130 performs electronic payments for users whose "setting information" is set to "Credit card payment (Credit card payment using code information)" as follows. Credit card payment is a payment method in cooperation with a credit card company, which is a separate entity from the operator of the electronic payment service. The operator of the electronic payment service acts as the creditor, and allows electronic payments within the credit card payment limit, independent of the remaining balance. To receive the credit card payment service, a user may be required to obtain a credit card provided by the operator of the electronic payment service. The amount used for credit card payment is settled in full for one month on the payment date of the following month, for example, by debit from a bank account. In this case, the payment processing unit 130 makes a provisional payment by adding the payment amount to the credit card payment amount and subtracting the same amount from the available credit card balance. On the closing date, the payment processing unit 130 performs the process described above to debit the current month's payment on the payment date of the following month, or requests the operator of the credit card company to perform this process. If the payment amount exceeds the available credit card balance at the time of provisional payment, an error notification is returned to the payment application 20.

[0031] [Card Server] FIG. 7 is a configuration diagram of card server 200. Card server 200 is, for example, a server device managed by the issuer of credit card C. Card server 200 includes, for example, communication unit 210, authentication processing unit 220, and storage unit 250. Authentication processing unit 220 is realized, for example, by a hardware processor such as a CPU executing a program (software). Some or all of these components may be realized by hardware (including circuitry) such as an LSI, ASIC, FPGA, GPU, or SOC, or may be realized by a combination of software and hardware. The program may be stored in advance in a storage device such as an HDD or flash memory (a storage device having a non-transitory storage medium), or may be stored in a removable storage medium (a non-transitory storage medium) such as a DVD or CD-ROM, and installed in the storage device by inserting the storage medium into a drive device.

[0032] The storage unit 250 is a HDD, flash memory, RAM, or the like. The storage unit 250 may be a NAS device that the card server 200 can access via a network. The storage unit 250 stores information such as authentication information 260 and authentication result information 270. Some of this information may be stored in the storage unit of the user terminal device 10. Details of the authentication information 260 will be described later.

[0033] The communication unit 210 is a communication interface for connecting to the network NW. The communication unit 110 is, for example, a network interface card.

[0034] The authentication processing unit 220 executes a first authentication process and a second authentication process (details will be described later). The authentication processing unit 220 may execute either the first authentication process or the second authentication process.

[0035] [Authentication Information] 8 is a diagram showing an example of the contents of the authentication information 260. The authentication information 260 stores, for example, a write password, code information (one-time code), and information related to a credit card in association with each other.

[0036] The information about the credit card includes, for example, one or both of the credit card number and the security code. In addition to the above, the information about the credit card may also include the user's name, expiration date, etc. The information about the credit card is not limited to the above as long as it can identify the credit card. The code information is information used for authentication stored in the memory unit C4 of the credit card C. The write password is a password used by the payment application 20 to write the code information to the memory unit C4. In addition to this information, the authentication information 260 may also include a URL (for example, a one-time URL: one-time uniform resource locator).

[0037] [overview] This embodiment relates to the authentication of a credit card. By authenticating a credit card, it is verified whether the credit card belongs to a user who has the authority to use the credit card.

[0038] [Credit card] As shown in FIG. 1, the credit card C includes a circuit unit C1. The circuit unit C1 is, for example, an integrated circuit (IC chip). The circuit unit C1 includes, for example, a communication unit C2, a control unit C3, and a memory unit C4. The communication unit C2 communicates with the communication unit of the user terminal device 10. This allows the circuit unit C1 to communicate with the payment application 20 to send and receive information. The control unit C3, for example, works in cooperation with the communication unit C2 and the memory unit C4 to perform processes related to communication, information reading, and information writing. The memory unit C4 reads stored information and writes and stores information.

[0039] The memory unit C4 stores information about credit cards, code information, and the like. For example, a predetermined format (e.g., NDEF: NFC Data Exchange Format) is used for information processing between the circuit unit C1 and the payment application 20. The code information is, for example, but not limited to, a one-time code that changes for each authentication process described below. This one-time code is written using a write password described below. The one-time code is information written in an area different from the EMV area in which the credit card number (credit card identification information) and expiration date are written, for example.

[0040] Information about a credit card is an example of "related information." One or both of a credit card number (identification information of a credit card) and a security code is another example of "related information." Information different from related information (e.g., information different from a card number and a security code) is authentication information. For example, code information is an example of "authentication information."

[0041] The related information is information stored in a first storage area of ​​the storage unit C4. The authentication information is information stored in a second storage area different from the first storage area of ​​the storage unit C4. The first storage area is a basic area, such as an EMV area, specified to store credit card numbers and the like in credit card payments. The second storage area is an area different from the first storage area, and is, for example, an extended area in which desired information can be stored. The information (code information) stored in the second storage area is information stored in the second storage area that has not been provided to the user.

[0042] [Authentication process overview] Payment application 20 has an electronic payment wallet function that manages multiple electronic payment methods and enables electronic payments using a payment method selected by the user. Payment application 20 may be an application program that has the wallet function and does not include the electronic payment function described above.

[0043] When a credit card C to be used for payment is brought close to the user terminal device 10, the payment application 20 uses the communication unit of the user terminal device 10 to wirelessly communicate with the communication unit C2 included in the credit card C and the communication unit C2 of the circuit unit C1 including the memory unit C4 in which information is stored. The payment application 20 acquires information (related information) about the credit card C and code information (authentication information such as a one-time code) used to authenticate the credit card C. The payment application 20 transmits the information about the credit card C and the code information (authentication information) to the card server 200 to perform authentication, and determines whether or not to associate the credit card C with the payment application 20 based on the authentication result acquired from the card server 200.

[0044] The authentication performed by the card server 200 may be an authentication process using a one-time code, which will be described later, or may be another authentication process. In the authentication process, the information stored in the second storage area may be used for authentication, and the content of the authentication is not limited.

[0045] When payment application 20 obtains a positive authentication result from card server 200, it manages information about credit card C (e.g., credit card number, security code, etc.) in association with payment application 20. As a result, credit card C is managed as an electronic payment selectable in the wallet function of payment application 20. When the user selects a payment method using credit card C and performs electronic payment, payment application 20 executes electronic payment using credit card C. As a result, the user can perform electronic payment using credit card C in the wallet function.

[0046] 9 is a diagram showing an example of a scene where authentication processing is performed. When a user brings credit card C close to user terminal device 10, payment application 20 executes authentication processing of credit card C in cooperation with card server 200, as will be described later. If authentication is successful, payment application 20 registers credit card C as a credit card C that can be used with the wallet function. Then, payment application 20 displays screen IM1 on the display unit of user terminal device 10, which includes information indicating that credit card C has been registered as a payment method.

[0047] After registration, the user operates payment application 20 to activate the wallet function and display screen IM2. Screen IM2 displays a list of electronic payment methods registered in the wallet function. When the user selects a registered credit card C from the list, payment application 20 executes the electronic payment using information about credit card C that it manages. For example, payment application 20 wirelessly communicates with a terminal device installed in a store, provides information about credit card C, and executes the electronic payment.

[0048] When registering credit card C, as described above, authentication may be started without starting payment app 20. For example, when registering credit card C, authentication may be started after starting payment app 20 and performing a predetermined operation, or logging in to payment app 20 may be a condition for starting the authentication process.

[0049] The authentication process may also be executed, for example, when user terminal device 10 is replaced. For example, when user terminal device 10 is replaced and the wallet function of payment app 20 is available on this user terminal device 10, payment app 20 may request the user to re-authenticate. For example, payment app 20 may display on the display unit information indicating that re-authentication is required or information indicating that credit card C should be brought closer to user terminal device 10. When the user brings credit card C closer to user terminal device 10, payment app 20 may execute the authentication process in cooperation with card server 200, and if authentication is successful, make credit card C available for use with the wallet function.

[0050] The authentication process may be executed after credit card C is registered in the wallet function. In addition to the above, the authentication process may also be executed when the content of the service of credit card C is changed. For example, payment application 20 may execute the above authentication process when it receives a notification from card server 200, either via payment server 100 or without, that a service has been changed. A change in service may be a change in the payment amount available for credit card C (an increase in the upper limit), or the like. In this case, the display unit of user terminal device 10 displays a message indicating that re-authentication is required, and the user is requested to bring credit card C closer to user terminal device 10. For example, the authentication process may be executed at predetermined intervals, or when payment application 20 receives an instruction to execute authentication process from card server 200.

[0051] The authentication process may be executed when a preset condition is met when credit card C is used. The preset condition may be, for example, that credit card C is being used for a predetermined payment (for example, a payment of a predetermined amount or a payment at a predetermined store). The preset condition may also be that credit card C is being used for a predetermined use in an electronic payment service, such as charging the electronic payment service.

[0052] In the following processing, the processing executed by card server 200 may be executed by payment server 100, and vice versa. Payment application 20 may transmit and receive various information to and from card server 200 via payment server 100.

[0053] [Authentication process explanation] Payment application 20 executes one or both of a first authentication process using a write password and a second authentication process using a one-time code. Fig. 10 is a diagram for explaining the authentication process.

[0054] (First authentication process) (0) In credit card C (storage unit C4), a first one-time code is written using a first write password, and information about credit card C is also stored. (1) When the credit card C is brought close to the user terminal device 10, the payment application 20 uses the communication unit of the user terminal device 10 to wirelessly communicate with the communication unit C2 included in the credit card C and the circuit unit C1 including the memory unit C4 that can write information using the write password (set password) set when writing information.

[0055] The payment application 20 communicates with the credit card C to acquire information about the credit card C, and transmits the acquired information about the credit card C to the card server 200. At this time, the acquired first one-time code (code information) may also be transmitted to the card server 200 together with the information about the credit card C. The payment application 20 acquires the first write password associated with the information about the credit card C from the card server 200. The payment application 20 acquires the first write password from the card server 200.

[0056] (Second authentication process) (2) The payment application 20 acquires the first one-time code (one-time code) stored in the memory unit C4. The payment application 20 sends the acquired first one-time code to the payment server 100 and requests a second authentication process to determine whether the first one-time code matches the one-time code associated with information related to the credit card C. The payment server 100 determines whether the one-time code in the user's authentication information 173 matches the first one-time code and performs authentication. In this process, it is assumed that the authentication is successful.

[0057] (3) After the first authentication process and the second authentication process, the payment server 100 issues a second write password and a second one-time code. The payment server 100 manages the second write password and the second one-time code in the authentication information 173 in association with the user's identification information or information related to the credit card C. (4) The payment application 20 writes the second one-time code into the memory unit C4 of the credit card C using the issued second write password. (5) As a result, the second one-time code is written in place of the first one-time code in the memory unit C4 of the credit card C. The write password required for writing is the second write password.

[0058] As described above, security is improved by executing the first authentication process and the second authentication process, for example, because the one-time code and the write password are changed for each authentication process.

[0059] If the authentication is successful, payment application 20 or card server 200 registers that credit card C is a credit card that can be used with the wallet function. In this case, for example, payment application 20 or card server 200 associates information about credit card C, such as the number and security code of credit card C, with identification information for user terminal device 10, payment application 20, or user identification information, and further associates and manages information indicating that the wallet function is available. The information about credit card C may be information obtained by payment application 20 from storage unit C4, or may be information obtained by manual input by the user, or may be information obtained by capturing an image of credit card C.

[0060] The first authentication process and the second authentication process will be specifically described below. Fig. 11 is a sequence diagram mainly showing the second authentication process. Fig. 12 is a sequence diagram mainly showing the first authentication process.

[0061] 11 is a sequence diagram showing an example of the flow of processing (second authentication processing) executed by the electronic payment system. A one-time code written using a write password is stored in memory unit C4 of credit card C. It is assumed that the user brings credit card C close to user terminal device 10 in order to register credit card C in the wallet function.

[0062] The payment application 20 acquires the information and one-time code related to the credit card C stored in the memory unit C4 of the credit card C (S100), and transmits the acquired information and one-time code related to the credit card C to the card server 200 (S102). Next, the card server 200 acquires the information and one-time code related to the credit card C transmitted by the payment application 20 (S104).

[0063] Next, card server 200 determines whether authentication of the one-time code has been established (S106). For example, card server 200 determines whether the one-time code associated with information about credit card C stored in authentication information 260 matches the acquired one-time code, and if they match, determines that authentication has been established. This process is an example of a process in which "the server device refers to information in a storage unit that associates the related information with the authentication information, and authenticates the correspondence between the related information and the authentication information transmitted from the application program." Card server 200 may notify payment application 20 of the processing result.

[0064] If the authentication fails, card server 200 executes a second process (S108). The second process may, for example, notify payment application 20 of information indicating that the authentication failed, or suspend the use of credit card C. The above authentication may be executed by payment application 20. In this case, a one-time code associated with information related to credit card C is obtained from card server 200.

[0065] Next, card server 200 stores the above authentication result in the storage unit (S109). For example, card server 200 stores information about credit card C in association with the authentication result. This allows the authentication result for each user to be checked after the fact.

[0066] 12 is a sequence diagram showing an example of the flow of processing (first authentication processing) executed by the electronic payment system. In FIG. 12, the user is holding credit card C close to (tapping) user terminal device 10, and credit card C and payment application 20 are able to communicate with each other.

[0067] Payment application 20 transmits a request for transmission of a write password together with information about credit card C to card server 200 (S150). Next, card server 200 acquires the information about credit card C and the request for the write password (S152). Next, card server 200 references authentication information 260 to acquire the write password associated with the information about credit card C, and transmits the acquired write password to payment application 20 (S154). The write password may be stored in user terminal device 10.

[0068] The payment application 20 acquires the transmitted write password (S156). The user taps / brings the credit card C close to the user terminal device 10 (S158).

[0069] Next, the payment application 20 confirms the validity of the write password (S160). For example, the payment application 20 confirms whether information can be written to the storage unit C4 using the write password (performs authentication processing to determine whether the write password is the set password). Next, the payment application 20 determines whether the validity has been confirmed (S162). If the validity cannot be confirmed, the payment application 20 executes a first process (S164). If the payment application 20 has executed the process to confirm the validity a predetermined number of times but is unable to confirm the validity, the first process may display on the display unit of the user terminal device 10 that the authentication of the credit card C cannot be confirmed, or notify the card server 200 that the validity cannot be confirmed. Furthermore, the card server 200 may suspend the use of the credit card C in response to the notification from the payment application 20.

[0070] If the authenticity is confirmed, payment application 20 notifies card server 200 of information indicating that the authenticity has been confirmed (S166). Next, card server 200 stores the above authentication result in a storage unit (S167). For example, card server 200 stores information about credit card C and the authentication result in association with each other. This makes it possible to check the authentication result for each user after the fact.

[0071] As described above, card server 200 generates authentication result information 270 that associates information about credit card C with the authentication result. Fig. 13 is a diagram showing an example of authentication result information 270. Authentication result information 270 is information that indicates the results of the first authentication process and the results of the second authentication process for each credit card (information about the credit card).

[0072] For example, if the second authentication process is successful but the first authentication process fails, it is possible that the IC chip on credit card C is counterfeit. For example, it is possible that the one-time code on credit card C has been fraudulently obtained and a counterfeit IC chip with this one-time code written on it has been used. As described above, by storing the results of the first authentication process and the second authentication process, the legitimacy of credit card C can be managed.

[0073] Card server 200 determines whether the card used by the user (credit card C) is counterfeit based on authentication result information 270. Card server 200 generates authentication result information 270 in which the results of the first authentication process and the second authentication process are associated with information about credit card C (or the user's identification information), and determines whether the card is counterfeit by referring to the generated authentication result information 270. If card server 200 determines that the card is counterfeit, it may notify an alert to the terminal device of the credit card administrator. For example, card server 200 may generate a blacklist by referring to authentication result information 270. For example, a credit card for which the second authentication process in authentication result information 270 was successful but the first authentication process failed may be blacklisted as a counterfeit credit card C. In this way, card server 200 can perform blacklist management by using the authentication processes and the results of the authentication processes.

[0074] Fig. 14 is a sequence diagram showing an example of the processing flow related to a new one-time code and a new write password. In the sequence diagram of Fig. 12, after authentication is successful, card server 200 issues a new one-time code and a new write password, and transmits the issued new one-time code and new write password to payment application 20 (S180).

[0075] The payment application 20 acquires the new one-time code and new write password transmitted in S180, and uses the new write password to write and store the new one-time code in the storage unit C4 (S182). At this time, the payment application 20 may, if necessary, control the storage unit C4 to a state where writing is possible using the write password acquired in S156 of FIG. 12, and write the new one-time code using the new write password. If there is no need to use the write password acquired in S156 of FIG. 12, the payment application 20 writes the new one-time code into the storage unit C using the new write password. Through this process, the storage unit C4 of the credit card C stores the new one-time code (S184). The payment application 20 may issue the new one-time code or write password. The payment application 20 may acquire the new one-time code or write password from the card server 200, or may generate them by itself. The one-time code and write password are also shared with the card server 200.

[0076] Next, payment application 20 determines whether the process of writing the new one-time code was successful (S186). If the process was not successful, payment application 20 executes a third process (S188). The third process is, for example, a process in which payment application 20 displays on the display unit of user terminal device 10 that the authentication of credit card C cannot be confirmed, or notifies card server 200 that the process was not successful. Furthermore, card server 200 may suspend the use of credit card C in response to the notification from payment application 20.

[0077] If the processing is successful, payment application 20 transmits information indicating the success of the processing to card server 200 (S190). Next, card server 200 acquires the information indicating the success of the processing, executes a fourth process, and notifies payment application 20 that the authentication processing is complete (S192). In the fourth process, card server 200 registers a new one-time code and a new write password in authentication information 260. Card server 200 may rewrite the one-time code and write password registered in authentication information 260 with a new one-time code and a new write password, or may register the new one-time code and the new write password as the one-time code and the new write password to be used in the future. The new one-time code and the new write password may be registered in authentication information 260 after the processing of S180 described above. The new one-time code and the new write password are information to be used in the next authentication processing after the current authentication processing.

[0078] Furthermore, the fourth process may include a process in which the card server 200 confirms or determines that both (or one) of the first authentication process and the second authentication process have been successful and that the current authentication process for credit card C has been successful.

[0079] When payment application 20 receives a notification from card server 200 that the authentication process has been successful, it displays information indicating that the authentication process has been completed on the display unit of user terminal device 10 (S194). For example, information indicating that credit card C has been registered in the wallet function is displayed. This ends one routine of the authentication process, and in the next authentication process, the registered new one-time code and new write password are used to execute the first authentication process and the second authentication process.

[0080] As described above, the electronic payment system can improve security by performing one or both of the first authentication process and the second authentication process.

[0081] [Variations of processing order] The second authentication process may be executed after the first authentication process. Fig. 15 is a sequence diagram mainly showing the first authentication process, and Fig. 16 is a sequence diagram mainly showing the second authentication process.

[0082] [Sequence diagram (1)] 15 is a sequence diagram showing an example of the flow of processing (first authentication processing) executed by the electronic payment system. A one-time code written using a write password is stored in memory unit C4 of credit card C. Assume that the user brings credit card C close to user terminal device 10 to register credit card C in the wallet function. At this time, information about credit card C (and the one-time code) is acquired by payment application 20.

[0083] The payment application 20 transmits a request for transmission of the write password to the card server 200 together with information about the credit card C (S150). At this time, a one-time code may also be transmitted. Next, the card server 200 acquires the information about the credit card C and the request for the write password (S152). Next, the card server 200 references the authentication information 260 to acquire the write password associated with the information about the credit card C, and transmits the acquired write password to the payment application 20 (S154). The write password may be stored in the user terminal device 10.

[0084] The payment application 20 acquires the transmitted write password (S156). The user taps / brings the credit card C close to the user terminal device 10 (S158).

[0085] Next, the payment application 20 confirms the validity of the write password (S160). For example, the payment application 20 confirms whether information can be written to the storage unit C4 using the write password. Next, the payment application 20 determines whether the validity has been confirmed (S162). If the validity cannot be confirmed, the payment application 20 executes a first process (S164). If the payment application 20 has executed the process to confirm the validity a predetermined number of times but is unable to confirm the validity, the first process may be to display on the display unit of the user terminal device 10 that the authentication of the credit card C cannot be confirmed, or to notify the card server 200 that the validity cannot be confirmed. Furthermore, the card server 200 may suspend the use of the credit card C in response to the notification from the payment application 20.

[0086] If the validity has been confirmed, payment application 20 notifies card server 200 of information indicating that the validity has been confirmed (S166). This process may be omitted. In this case, card server 200 may recognize that the validity has been confirmed when a one-time code described in FIG. 16 is transmitted. As described above, the process of S167 may be performed.

[0087] 16 is a sequence diagram showing another example of the flow of processing (second authentication processing) executed by the electronic payment system. In FIG. 16, the user taps credit card C on user terminal device 10, and credit card C and payment application 20 are able to communicate with each other.

[0088] Payment application 20 acquires the one-time code stored in memory unit C4 of credit card C (S100) and transmits the acquired one-time code to card server 200 (S102). Next, card server 200 acquires the one-time code transmitted by payment application 20 (S104). At this time, information about credit card C or other identification information is attached and transmitted in association with the one-time code. The other identification information is information for identifying that the one-time code corresponds to the information in the request of S150 in FIG. 15. Furthermore, if a one-time code has been transmitted in S150 in FIG. 15, the processes of S100-S104 may be omitted.

[0089] Next, card server 200 determines whether authentication of the one-time code is successful (S106). For example, card server 200 determines whether the one-time code associated with information related to credit card C stored in authentication information 260 matches the acquired one-time code, and if they match, determines that authentication is successful. If authentication fails, card server 200 executes a second process (S108). The second process may, for example, notify payment application 20 of information indicating that authentication has failed, or suspend the use of credit card C. The above authentication may be executed by payment application 20. In this case, the one-time code associated with information related to credit card C is acquired from payment application 20.

[0090] If the authentication is successful, card server 200 issues a new one-time code and a new write password, and transmits the issued new one-time code and new write password to payment application 20 (S180).

[0091] The payment application 20 acquires the new one-time code and new write password transmitted in S180, and uses the new write password to write and store the new one-time code in the storage unit C4 (S182). At this time, the payment application 20 may, if necessary, control the storage unit C4 to a state where writing is possible using the write password acquired in S156 of FIG. 15, and write the new one-time code using the new write password. If there is no need to use the write password acquired in S156 of FIG. 15, the payment application 20 writes the new one-time code into the storage unit C using the new write password. Through this process, the storage unit C4 of the credit card C stores the new one-time code (S184). The payment application 20 may issue the new one-time code or write password. The payment application 20 may acquire the new one-time code or write password from the card server 200, or may acquire it by itself.

[0092] Next, payment application 20 determines whether the process of writing the new one-time code was successful (S186). If the process was not successful, payment application 20 executes a third process (S188). The third process is, for example, a process in which payment application 20 displays on the display unit of user terminal device 10 that the authentication of credit card C cannot be confirmed, or notifies card server 200 that the process was not successful. Furthermore, card server 200 may suspend the use of credit card C in response to the notification from payment application 20.

[0093] If the processing is successful, payment application 20 transmits information indicating the success of the processing to card server 200 (S190). Next, card server 200 acquires the information indicating the success of the processing, executes a fourth process, and notifies payment application 20 that the authentication processing is complete (S192). In the fourth process, card server 200 registers a new one-time code and a new write password in authentication information 260. Card server 200 may rewrite the one-time code and write password registered in authentication information 260 with a new one-time code and a new write password, or may register the new one-time code and the new write password as the one-time code and the new write password to be used in the future. The new one-time code and the new write password may be registered in authentication information 260 after the processing of S160 described above. The new one-time code and the new write password are information to be used in the next authentication processing after the authentication processing.

[0094] Furthermore, the fourth process may include a process in which the card server 200 confirms or determines that both (or one) of the first authentication process and the second authentication process have been successful and that the current authentication process for credit card C has been successful.

[0095] When payment application 20 receives a notification from card server 200 that the authentication process has been successful, it displays information indicating that the authentication process has been completed on the display unit of user terminal device 10 (S194). For example, information indicating that credit card C has been registered in the wallet function is displayed. This ends one routine of the authentication process, and in the next authentication process, the registered new one-time code and new write password are used to execute the first authentication process and the second authentication process.

[0096] In the first authentication process and the second authentication process, the process executed by payment application 20 may be executed by card server 200, and vice versa. For example, as described above, confirmation of the validity of the write password may be executed by card server 200. For example, determination of match of one-time codes and issuance of a new one-time code and a new write password may be executed by payment application 20. Also, part or all of authentication information 260 may be stored in user terminal device 10.

[0097] For example, when a card to be used for payment is brought close to user terminal device 10, payment application 20 uses a communication unit of user terminal device 10 to wirelessly communicate with a communication unit included in the card and a communication unit of a circuit unit including a memory unit in which information is stored, to acquire related information and authentication information related to the card. Payment application 20 may refer to information stored in the memory unit of user terminal device 10 that associates the related information with authentication information, authenticate the association between the acquired related information and the authentication information, and determine whether to associate the card with an application program based on the authentication result.

[0098] Either the first authentication process or the second authentication process may be omitted. For example, the second authentication process may be omitted and the first authentication process may be executed. In this case, the processes of determining whether the one-time codes match and issuing a new one-time code are omitted.

[0099] As described above, the electronic payment system can improve security by performing one or both of the first authentication process and the second authentication process.

[0100] [Variations] In addition to the one-time code, the memory unit C4 of the credit card C may also store a URL (for example, a one-time URL: one-time uniform resource locator).

[0101] FIG. 17 is a diagram for explaining the process of the modified example. (0#) Credit card C (storage unit C4) stores information about credit card C, and furthermore, a first one-time URL and a first one-time code are written using a first writing password. When credit card C is tapped on user terminal device 10, user terminal device 10 reads the first one-time URL and accesses the access destination of the first one-time URL. For example, user terminal device 10 may access card server 200, or may access payment application 20 as in this process.

[0102] (0##) For example, the user terminal device 10 reads the first one-time URL, launches the payment app 20 installed on the user terminal device 10, and displays the specified interface screen. If the user is not logged in to the payment app 20, the payment app 20 displays a login screen on the display unit to allow the user to log in, and if the user is logged in, executes the first authentication process and the second authentication process.

[0103] The first authentication process (1) and the second authentication process (2) are the same as the processes shown in FIG. 10 above.

[0104] (3#) After the first authentication process and the second authentication process, the card server 200 issues a second write password, a second one-time URL, and a second one-time code. The card server 200 manages the second one-time URL, the second write password, and the second one-time code in the authentication information 260 in association with information about the credit card C. (4#) The payment application 20 writes the second one-time URL and the second one-time code into the memory unit C4 of the credit card C using the issued second write password. (5) As a result, the second one-time code and second one-time URL are written into memory unit C4 of credit card C in place of the first one-time code and first one-time URL.

[0105] In the above example, a write password is used in the first authentication process, but a read password for reading information stored in memory unit C4 may be used instead of (or in addition to) the write password, or a password set for circuit unit C may be used. When a read password is used, the first authentication process may be determined to be successful if one or both of the information about the credit card and the one-time code can be read. If the above information cannot be read, the second authentication process cannot be performed, and therefore the second authentication process is executed if the first authentication process is successful (if the information can be read).

[0106] In the above process, it may be a condition that the user is logged in to use payment application 20, or if this is not the condition but the user is logged in, the user information registered in payment server 100 may be provided to card server 200, and the user information may be used for authentication in card server 200. For example, it may be determined whether the user's name registered in payment server 100 matches the name registered in card server 200.

[0107] Furthermore, in the above example, the payment application 20 of the electronic payment service is described as being used for the authentication process, but the application program is not limited to the payment application 20, and other application programs may also execute the processing of this embodiment.

[0108] According to the embodiment described above, when a card used for payment is brought close to a terminal device on which the computer is installed, the computer uses the communication unit of the terminal device to wirelessly communicate with the communication unit of a circuit unit including a communication unit included in the card and a memory unit in which information is stored, to obtain related information related to the card and authentication information used to authenticate the card, transmit the related information and the authentication information to a server device to perform the authentication, and determine whether or not to associate the card with an application program based on the authentication result obtained from the server device, thereby improving security.

[0109] The above describes the form for carrying out the present invention using an embodiment, but the present invention is not limited to such an embodiment, and various modifications and substitutions can be made within the scope that does not deviate from the gist of the present invention. [Explanation of symbols]

[0110] 10 User terminal device 20. Payment App 100 Payment Server 120 Contents Provider 130 Payment processing unit 140 Information Management Department 200 Card Server 220 Authentication processing unit 260 Authentication Information 270 Authentication result information

Claims

1. On the computer, When a card used for payment is brought close to a terminal device equipped with the computer, a communication unit of the terminal device is used to wirelessly communicate with a communication unit included in the card and a communication unit of a circuit unit including a memory unit in which information is stored, Acquires relevant information related to the card and authentication information used to authenticate the card; transmitting the related information and the authentication information to a server device to perform the authentication, and determining whether or not to associate the card with an application program based on an authentication result obtained from the server device; The memory unit of the circuit unit can write information using a set password that is set when writing information, obtaining a write password associated with the related information from the server device; executes an authentication process for determining whether the write password is a set password; determining whether or not to associate the card with the application program based on the authentication result obtained from the server device and the result of the authentication process for the write password; Application program.

2. the related information is one or both of the card number and the card security code; The authentication information is authentication information different from the card number and security code. The application program according to claim 1 .

3. the related information is information stored in a first storage area of ​​the storage unit, the authentication information is information stored in a second storage area different from the first storage area of ​​the storage unit; The application program according to claim 1 .

4. the first storage area is an area that is preset to store information about a credit card defined by a standard, the second storage area is an extended area different from the area; 4. The application program according to claim 3.

5. The authentication information is updated every time the server device executes the authentication process.

4. The application program according to claim 3.

6. the application program is an application program that manages a plurality of electronic payment methods and enables electronic payment using a payment method selected by a user; The computer, When a positive authentication result is obtained from the server device, the related information of the card is managed in association with an application program; When the user selects the payment method using the card and makes an electronic payment, the related information is used to execute the electronic payment. The application program according to claim 1 .

7. The card is a credit card or a debit card. The application program according to claim 1 .

8. the server device is a server device that manages the card, the related information and the authentication information are transmitted to the server device via a service server that provides a service in cooperation with the application program, or without the service server.

8. The application program according to claim 7.

9. An application program according to any one of claims 1 to 8; The server device, the server device refers to information stored in a storage unit in which the related information and the authentication information are associated with each other, authenticates the association between the related information and the authentication information transmitted from the application program, and transmits a result of the authentication to the application program. Information processing system.

10. The computer When a card used for payment is brought close to a terminal device equipped with the computer, a communication unit of the terminal device is used to wirelessly communicate with a communication unit included in the card and a communication unit of a circuit unit including a memory unit in which information is stored, Acquire relevant information related to the card and authentication information used to authenticate the card; transmitting the related information and the authentication information to a server device to perform the authentication, and determining whether or not to associate the card with an application program based on an authentication result obtained from the server device; The memory unit of the circuit unit can write information using a set password that is set when writing information, obtaining a write password associated with the related information from the server device; performing an authentication process to determine whether the write password is a set password; determining whether to associate the card with the application program based on the authentication result obtained from the server device and the result of the authentication process for the write password; Information processing methods.

11. On the computer, When a card used for payment is brought close to a terminal device equipped with the computer, a communication unit of the terminal device is used to wirelessly communicate with a communication unit included in the card and a communication unit of a circuit unit including a memory unit in which information is stored, Acquires relevant information related to the card and authentication information used to authenticate the card; referencing information stored in a storage unit in which the related information and the authentication information are associated with each other, and authenticating the association between the acquired related information and the authentication information; determining whether to associate the card with an application program based on the authentication result; The memory unit of the circuit unit can write information using a set password that is set when writing information, obtaining a write password associated with the related information from a server device; executes an authentication process for determining whether the write password is a set password; determining whether or not to associate the card with the application program based on the authentication result obtained from the server device and the result of the authentication process for the write password; Application program.

12. The computer When a card used for payment is brought close to a terminal device equipped with the computer, a communication unit of the terminal device is used to wirelessly communicate with a communication unit included in the card and a communication unit of a circuit unit including a memory unit in which information is stored, Acquire relevant information related to the card and authentication information used to authenticate the card; referencing information stored in a storage unit in which the related information and the authentication information are associated with each other, and authenticating the association between the acquired related information and the authentication information; determining whether to associate the card with an application program based on the authentication result; The memory unit of the circuit unit can write information using a set password that is set when writing information, obtaining a write password associated with the related information from the server device; performing an authentication process to determine whether the write password is a set password; determining whether to associate the card with the application program based on the authentication result obtained from the server device and the result of the authentication process for the write password; Information processing methods.

Images