Electronic information storage medium, IC chip, transaction content approval determination method, and program

Abstract

To provide an electronic information storage medium, an IC chip, a transaction content approval determination method, and a program which can transfer authorization function provided in an IC chip from a PIN authorization function to a biometric authorization function while reducing modification costs of a terminal such as a settlement terminal and the like provided previously.SOLUTION: When an IC chip 2 is supplied with power, the IC chip carries out fingerprint authentication by using fingerprint feature information acquired by a fingerprint information acquiring unit 1 and fingerprint feature information initially registered in an NVM 24, and records the fingerprint authentication result. When an instruction to read performance information is received from a terminal T, the IC chip 2 transmits the performance information regarding authentication function of the IC card C to the terminal T, and when an instruction to determine transaction approval including transaction contents having been set by the terminal T is received from the terminal T, the IC chip determines, based on the finger authentication result, whether or not to approve the transaction contents, and transmits, as a response, the determined result to the terminal T.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] It relates to the technical field of IC (Integrated Circuit) cards with biometric authentication functions and the like.

Background Art

[0002] Conventionally, IC cards have been used to ensure that the user of a system is the person assumed by the system. By using the anti-counterfeiting function and cryptographic operation function provided by the IC card, the system and the IC card can uniquely identify each other, so it is guaranteed that the user has a legitimate IC card for a legitimate system. Furthermore, if the cardholder of the IC card is identified by using the personal authentication function provided by the IC card, it is guaranteed that the IC card is held by a legitimate person, so it can be guaranteed that a legitimate system is being used by a legitimate user.

[0003] A typical example of identity verification is PIN (Personal Identification Number) authentication (also known as PIN verification). PIN authentication is used in various types of businesses, but for example, when PIN authentication is performed in a payment processing system that includes a payment terminal and an IC card, an initialization process is performed between the payment terminal and the IC card. After that, the IC card sends performance information back to the payment terminal in response to a read command from the payment terminal. This performance information includes information about the authentication functions that the IC card possesses, including whether or not it has a PIN authentication function. Based on the performance information received from the IC card, the payment terminal determines the status of the IC card's support for the PIN authentication function. If it is determined that the IC card does not support the PIN authentication function, it does not perform PIN authentication and takes measures to reduce the risk of impersonation during payment by performing identity verification by other means (for example, requesting a handwritten signature or receiving a telephone inquiry from the payment service provider). At the same time, it is also verified that the payment terminal supports the PIN authentication function. For example, it is confirmed that the connection between the payment terminal and the PIN pad is good, and that encrypted communication between the PIN pad and the payment terminal is proper, and that the standards required for payment processing are met. If the criteria are not met, measures will be taken to reduce the risk of identity theft during payment by verifying the user's identity through alternative means without implementing PIN authentication.

[0004] On the other hand, if it is determined that the IC card supports PIN authentication and the payment terminal also supports PIN authentication, the payment terminal will, for example, display a message on the PIN pad screen prompting the user to enter a PIN. The user will follow the message and enter the PIN while pressing the PIN pad. Once the PIN has been entered, the payment terminal will send a PIN verification command to the IC card. The PIN verification command will contain the entered PIN, which will be verified within the IC card against a PIN that has been pre-registered in the card. The IC card will record the PIN verification result and send a response back to the payment terminal. The payment terminal will set the transaction details based on the PIN verification result received from the IC card. These transaction details will include not only the amount to be settled but also information necessary for risk assessment when approving the transaction. The payment terminal will then send a transaction approval decision command to the IC card, which will include the set transaction details. In response to the transaction approval decision command from the payment terminal, the IC card will interpret the transaction details, take into account the recorded PIN verification result, and make an approval decision on the transaction, such as whether to approve the transaction, whether to query the online host for approval or rejection, or whether to reject it. The approval result from the IC card is sent back to the payment terminal. Based on the approval result received from the IC card, the payment terminal decides whether to approve the transaction or to inquire with the online host to determine approval status.

[0005] While the aforementioned PINs are implemented using numerical permutations, they have drawbacks such as the difficulty of applying PINs exceeding six digits due to human memory limitations, and the difficulty of setting different PINs for numerous systems. Therefore, biometric authentication, particularly fingerprint authentication, is attracting attention as an alternative to PIN authentication. Fingerprint sensors are small, consume little power, and are suitable for implementation on IC cards. Furthermore, IC cards allow for the secure storage of biometric information, which poses a risk in the event of leakage. For example, Patent Document 1 discloses an RFID device comprising an antenna for receiving RF (Radio Frequency) signals, an RFID chip powered by contactless communication using the antenna, and a fingerprint authentication engine. The fingerprint authentication engine is configured to compare a fingerprint read by a fingerprint reader with pre-stored fingerprint data. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Special Publication No. 2017-538188 [Overview of the Initiative] [Problems that the invention aims to solve]

[0007] Incidentally, if biometric authentication were to be introduced as a means of user authentication instead of PIN authentication, the aforementioned performance information would indicate whether or not the IC card has a biometric authentication function. An implementation would be envisioned in which the payment terminal that receives this performance information confirms support for the biometric authentication function and then sends a biometric authentication execution command to the IC card. However, in situations where there are already systems in operation using PIN authentication and a large number of payment terminals have been installed at the request of those systems, the cost of modifying all the payment terminals would be enormous, and switching the user authentication method from PIN authentication to biometric authentication is not easy from a cost-effectiveness standpoint.

[0008] Therefore, the present invention has been made in view of these problems, and aims to provide an electronic information storage medium, an IC chip, a transaction content approval determination method, and a program that can transition the authentication function of an IC card from a PIN authentication function to a biometric authentication function while reducing the cost of modifying terminals such as payment terminals that are already installed. [Means for solving the problem]

[0009] To solve the above problems, the invention described in claim 1 is an electronic information storage medium equipped with a biometric authentication function, which is an electronic information storage medium that can communicate with a terminal for setting transaction details, wherein when the electronic information storage medium receives power, the biometric information acquired from the user's body by the biometric information acquisition unit is used to acquire the biometric information of the user of the electronic information storage medium. Remember in advance The system includes: an authentication means that performs biometric authentication using the recorded biometric information and records the biometric authentication result; a determination means that, when a transaction approval determination command including transaction details set by the terminal is received from the terminal after the power supply, determines whether or not to approve the transaction details based on the recorded biometric authentication result; and a second response means that responds to the terminal with the result determined by the determination means. If the transaction details include an online inquiry, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, it makes a determination to approve the transaction details on the condition of the online inquiry. It is characterized by the following: The invention described in claim 2 is an electronic information storage medium equipped with a biometric authentication function, which is an electronic information storage medium that can communicate with a terminal for setting transaction details, and is characterized in that when the electronic information storage medium receives power, it performs biometric authentication using biometric information obtained from the user's body by a biometric information acquisition unit and pre-stored biometric information, and records the biometric authentication result; a first response means that responds to the terminal with performance information relating to the authentication function of the electronic information storage medium when a command to read performance information is received from the terminal after the power supply; a determination means that determines whether or not to approve the transaction details based on the recorded biometric authentication result when a transaction approval determination command including transaction details set by the terminal based on the performance information is received from the terminal; and a second response means that responds to the terminal with the result determined by the determination means.

[0010] Claim 3 The invention described in the claim 2 In the electronic information storage medium described above, if the transaction content includes transaction approval, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, it makes a determination to approve the transaction content.

[0011] Claim 4 The invention described in the claim 2 In the electronic information storage medium described above, if the transaction details include transaction approval, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates a failure to authenticate, it makes a determination not to approve the transaction details.

[0014] Claim 5 The invention described above is an IC chip included in an electronic information storage medium equipped with a biometric authentication function, an IC chip that can communicate with a terminal for setting transaction details, wherein when the IC chip receives power, the biometric information acquired from the user's body by the biometric information acquisition unit of the IC chip and Remember in advance The system includes: an authentication means that performs biometric authentication using the recorded biometric information and records the biometric authentication result; a determination means that, when a transaction approval determination command including transaction details set by the terminal is received from the terminal after the power supply, determines whether or not to approve the transaction details based on the recorded biometric authentication result; and a second response means that responds to the terminal with the result determined by the determination means. If the transaction details include an online inquiry, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, it makes a determination to approve the transaction details on the condition of the online inquiry. It is characterized by the following: The invention described in claim 6 is an IC chip included in an electronic information storage medium equipped with a biometric authentication function, and an IC chip that can communicate with a terminal for setting transaction details, wherein when the IC chip receives power, it performs biometric authentication using biometric information acquired from the user's body by a biometric information acquisition unit and pre-stored biometric information, and records the biometric authentication result; a first response means that responds to the terminal with performance information relating to the authentication function of the electronic information storage medium when a command to read performance information is received from the terminal after the power supply; a determination means that determines whether or not to approve the transaction details based on the recorded biometric authentication result when a transaction approval determination command including transaction details set by the terminal based on the performance information is received from the terminal; and a second response means that responds to the terminal with the result determined by the determination means.

[0015] The invention described in claim 7 is an electronic information storage medium equipped with a biometric authentication function, and a transaction content approval determination method executed by a computer contained in the electronic information storage medium that can communicate with a terminal for setting transaction content, wherein when the electronic information storage medium receives power supply, the biometric information obtained from the user's body by the biometric information acquisition unit and Remember in advance The steps include: performing biometric authentication using the obtained biometric information and recording the biometric authentication result; and, after the power supply is supplied, if a transaction approval decision command including the transaction details set by the terminal is received from the terminal, determining whether or not to approve the transaction details based on the recorded biometric authentication result. The system includes a determination step and a step of responding to the terminal with the determined result, wherein if the transaction includes an online inquiry, the determination step checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, it makes a determination to approve the transaction on the condition of the online inquiry. The invention described in claim 8 is an electronic information storage medium equipped with a biometric authentication function, and a transaction content approval determination method performed by a computer contained in the electronic information storage medium that can communicate with a terminal for setting transaction content, the method being characterized by including the steps of: when the electronic information storage medium receives power supply, performing biometric authentication using biometric information obtained from the user's body by a biometric information acquisition unit and pre-stored biometric information, and recording the biometric authentication result; when a command to read performance information is received from the terminal after the power supply, responding to the terminal with performance information relating to the authentication function of the electronic information storage medium; when a transaction approval determination command including transaction content set by the terminal based on the performance information is received from the terminal, determining whether or not to approve the transaction content based on the recorded biometric authentication result; and responding to the terminal with the result determined in the determination step.

[0016] Claim 9 The invention described above is an electronic information storage medium equipped with a biometric authentication function, wherein a computer contained within the electronic information storage medium, which can communicate with a terminal for setting transaction details, receives power and, when the electronic information storage medium receives power, acquires biometric information from the user's body by a biometric information acquisition unit. Remember in advanceAuthentication means for performing biometric authentication using the acquired biometric information and recording the biometric authentication result, and determination means for determining whether to approve the transaction content based on the recorded biometric authentication result when a transaction approval determination command including the transaction content set by the terminal is received from the terminal after the power supply, and second response means for responding to the terminal with the result determined by the determination means The program functions as such, and if the transaction details include an online inquiry, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, it makes a determination to approve the transaction details on the condition of the online inquiry. It is characterized by this. The invention described in claim 10 is an electronic information storage medium equipped with a biometric authentication function, wherein the computer contained in the electronic information storage medium, which can communicate with a terminal for setting transaction details, functions as an authentication means that, when the electronic information storage medium receives power, performs biometric authentication using biometric information acquired from the user's body by a biometric information acquisition unit and pre-stored biometric information, and records the biometric authentication result; a first response means that, when a command to read performance information is received from the terminal after the power supply, responds to the terminal with performance information relating to the authentication function of the electronic information storage medium; a determination means that, when a transaction approval determination command including transaction details set by the terminal based on the performance information is received from the terminal, determines whether or not to approve the transaction details based on the recorded biometric authentication result; and a second response means that responds to the terminal with the result determined by the determination means.

Effect of the Invention

[0017] According to the present invention, it is possible to shift the authentication function provided in the IC card from the PIN authentication function to the biometric authentication function while reducing the modification cost of terminals such as existing settlement terminals.

Brief Description of the Drawings

[0018] [Figure 1] It is a diagram showing an example of the schematic configuration of the transaction system S. [Figure 2] It is a sequence diagram showing an example of the transaction process implemented in the transaction system S. [Figure 3] It is a sequence diagram showing an example of the fingerprint authentication process implemented by the fingerprint information acquisition unit 1 and the IC chip 2.

Embodiment for Implementing the Invention

[0019] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiments described below are embodiments when the present invention is applied to an IC card used in a transaction system.

[0020] [1. Configuration and Function of Transaction System S] First, the configuration and functions of the transaction system S according to this embodiment will be described with reference to Figure 1. Figure 1 is a diagram showing an example of the overview configuration of the transaction system S. As shown in Figure 1, the transaction system S is configured to include an IC card C equipped with a fingerprint authentication function (an example of a biometric authentication function), a terminal T, and an online host H. The IC card C is capable of communicating with the RW (reader / writer) of the terminal T, such as a payment terminal, either by contact or contactless means. The terminal T is connected to the online host H via a communication line. Note that the terminal T is equipped with a PIN authentication function but does not have a fingerprint authentication function.

[0021] Online host H is a server managed by the card issuer, and it manages the personal information of the user of IC card C issued by the card issuer (e.g., name, address, telephone number, etc.) and the card information of IC card C for each user, and is used for online inquiries from terminal T. Here, the card information of IC card C includes, for example, the card number, expiration date, payment method such as credit card payment, and means of identity verification (identity verification method). In this embodiment, a fingerprint authentication function is shown as the means of identity verification for IC card C.

[0022] As shown in Figure 1, IC card C (an example of an electronic information storage medium of the present invention) is configured to include a fingerprint information acquisition unit 1 (an example of a biometric information acquisition unit) and an IC chip 2. IC card C can be used for various transactions. Examples of IC card C include credit cards, cash cards, and electronic money cards. Examples of transactions include transactions related to the buying and selling of goods or the exchange of services at stores and vending machines, and transactions related to deposits and withdrawals at banks and ATMs (Automatic Teller Machines). Note that IC card C does not have a PIN authentication function.

[0023] The fingerprint information acquisition unit 1 comprises a fingerprint sensor 11 and a sensor control unit 12. The fingerprint sensor 11 is mounted on the surface of the IC card C and, in response to a fingerprint reading command from the sensor control unit 12, attempts to read a fingerprint from the fingertip of the user (cardholder) using the IC card C. If the reading is successful, it outputs the fingerprint information to the sensor control unit 12. For example, the fingerprint sensor 11 has tens of thousands of electrodes and a contact surface that the user's fingertip makes contact with. When the user's fingertip makes contact with this contact surface, an amount of charge corresponding to the proximity to the contact surface due to the irregularities of the user's fingertip (i.e., the irregularities that constitute the fingerprint) accumulates on the electrodes. The fingerprint sensor 11 acquires fingerprint information by detecting the amount of charge accumulated on each electrode and converting it into a numerical value (i.e., a numerical value corresponding to the amount of charge). The fingerprint sensor 11 may acquire fingerprint information by methods other than those described above.

[0024] The sensor control unit 12 is a controller IC that controls the fingerprint sensor 11. In response to a fingerprint reading command from the IC chip 2, it activates the fingerprint sensor 11 and issues a fingerprint reading command to the fingerprint sensor 11. The sensor control unit 12 then extracts fingerprint characteristic information (an example of biometric information obtained from the user's body) from the fingerprint information acquired by the fingerprint sensor 11 and outputs it to the IC chip 2 (CPU 25). If the acquisition of fingerprint information or the extraction of fingerprint characteristic information fails, the sensor control unit 12 outputs information indicating an error to the IC chip 2.

[0025] The IC chip 2 comprises an I / O unit 21, RAM (Random Access Memory) 22, ROM (Read Only Memory) 23, NVM (Nonvolatile Memory) 24, and a CPU (Central Processing Unit) 25. The I / O unit 21 is for exchanging data with the RW of terminal T via contact or contactless means. If IC card C is a contact-type IC card, the I / O unit 21 is configured to include contact terminals (eight contact terminals C1 to C8) compliant with ISO / IEC 7816-3. In this case, power is supplied to the IC chip 2 from the RW of terminal T via terminal C1. On the other hand, if IC card C is a contactless IC card, the I / O unit 21 is configured to include a wireless antenna for receiving radio waves (RF signals) and a modulation / demodulation circuit for demodulating or modulating the RF signals. In this case, power is supplied to the IC chip 2 by the induced voltage from the wireless antenna receiving radio waves from terminal T.

[0026] ROM23 or NVM24 stores the operating system and applications such as a fingerprint authentication program (including the program of the present invention). Examples of NVM24 include flash memory and Electrically Erasable Programmable Read-Only Memory. Furthermore, fingerprint characteristic information related to the fingerprint read by the fingerprint sensor 11 is pre-stored (initially registered) in NVM24 and associated with the identifier of IC card C. Performance information related to the authentication function of IC card C is also pre-stored in NVM24. This performance information related to the authentication function of IC card C is managed, for example, by a transaction application and includes an identifier indicating that IC card C supports fingerprint authentication. NVM24 also stores information indicating transaction rules predetermined by the card issuer for the use of IC card C, and these transaction rules are also shared at terminal T. In addition, transaction data necessary for transactions is stored in NVM24. For example, in the case of a transaction related to the buying and selling of goods or the exchange of services at a store, the transaction data includes, for example, information necessary for payment according to the payment method, such as credit card payment.

[0027] The CPU 25 (an example of a computer) functions as the authentication means, first response means, determination means, and second response means in the present invention by executing the program of the present invention. More specifically, when the IC chip 2 receives power (power ON), the CPU 25 uses this as a trigger to perform fingerprint authentication (an example of biometric authentication) using the fingerprint characteristic information acquired by the fingerprint information acquisition unit 1 and the fingerprint characteristic information initially registered in the NVM 24, and records the fingerprint authentication result. When a command to read performance information is received from terminal T after power is supplied, the CPU 25 responds to terminal T with performance information relating to the authentication function of the IC card C. Then, when a transaction approval determination command including transaction details set by terminal T based on the performance information is received from terminal T, the CPU 25 determines whether to approve the transaction details based on the recorded fingerprint authentication result, and responds to terminal T with the determined result (determination result). Here, the transaction details include, for example, one of the following: transaction approval, transaction rejection, and online inquiry. Furthermore, the transaction details may include information necessary for risk assessment at the time of transaction approval, as well as the amount of the transaction.

[0028] [2. Operation of Trading System S] Next, with reference to Figure 2, the operation of the transaction system S when a transaction is conducted using IC card C will be explained. Figure 2 is a sequence diagram showing an example of a transaction process performed in the transaction system S. Figure 3 is a sequence diagram showing an example of a fingerprint authentication process performed by the fingerprint information acquisition unit 1 and the IC chip 2. The terminal T is assumed to acquire the identifier of IC card C from IC card C when communication with IC card C begins.

[0029] When IC card C is inserted into terminal T, or when IC card C is held over terminal T, the IC chip 2 receives power (step S1). As shown in Figure 2, the IC chip 2 performs an initialization process with terminal T (step S2). During the initialization process, the RAM 22 and CPU 25 are reset by the power-on reset circuit (not shown) of the IC chip 2, or when a reset signal transmitted from terminal T is received by the IC chip 2, the RAM 22 and CPU 25 are reset, and an initial response is sent from the IC chip 2 to terminal T. The initial response is sent from the IC chip 2 to terminal T in response to a reset signal transmitted from terminal T, or an initial response command transmitted from terminal T, but it may also be sent automatically after the reset of RAM 22 and CPU 25. Upon receiving such an initial response, terminal T sends a communication method selection command, etc., to the IC chip 2 as needed, and the IC chip 2 sends a response to that command back to terminal T.

[0030] Furthermore, when the IC chip 2 receives power, the IC chip 2 performs fingerprint authentication processing with the fingerprint information acquisition unit 1 in parallel with the initialization process (step S3). In the fingerprint authentication process, as shown in Figure 3, the CPU 25 gives a fingerprint reading command to the sensor control unit 12 (step S31). In response to the fingerprint reading command from the CPU 25, the sensor control unit 12 activates the fingerprint sensor 11 and gives a fingerprint reading command to the fingerprint sensor 11 (step S32). In response to the fingerprint reading command from the sensor control unit 12, the fingerprint sensor 11 attempts to read a fingerprint from the pad of the user's finger (step S33), and if successful, outputs the fingerprint information to the sensor control unit 12 (step S34). When the sensor control unit 12 receives the fingerprint information output from the fingerprint sensor 11, it extracts fingerprint feature information from the fingerprint information (step S35) and outputs the extracted fingerprint feature information to the CPU 25 (step S36).

[0031] Next, when the CPU 25 receives the fingerprint feature information output from the sensor control unit 12, it performs fingerprint authentication using the received fingerprint feature information and the fingerprint feature information pre-stored in the NVM 24 (step S37), and records the fingerprint authentication result (for example, stored in the RAM 22) (step S38). In this fingerprint authentication, the fingerprint feature information stored in the RAM 22 is compared with the fingerprint feature information pre-stored in the NVM 24, and if the two reach a predetermined similarity (in other words, if the degree of match is above a threshold), a fingerprint authentication result indicating successful authentication is recorded. It is desirable that the operations up to the recording of the fingerprint authentication result be completed by the time the application is successfully selected by the application selection command described later.

[0032] Meanwhile, once the initialization process is complete, terminal T sends an application selection command to IC chip 2 (step S4). When IC chip 2 (CPU 25) receives the application selection command from terminal T, it selects an application identified by the identifier (AID) included in the application selection command (for example, a transaction application) (step S5), and sends a response indicating successful selection back to terminal T (step S6). When terminal T receives the response indicating successful selection from IC chip 2, it sends a performance information read command to IC chip 2 (step S7). When IC chip 2 receives the read command from terminal T, it obtains performance information related to the authentication function of IC card C using the application selected in step S5 (step S8). Next, IC chip 2 sends a response containing the performance information obtained in step S8 back to terminal T (step S9).

[0033] Next, when terminal T receives a response from IC chip 2 that includes performance information, it determines whether IC card C supports PIN authentication based on the performance information included in the response (step S10). If it is determined that IC card C does not support PIN authentication (step S10: NO), the process proceeds to step S12. In this embodiment, the performance information received from IC chip 2 includes an identifier indicating that IC card C supports fingerprint authentication. However, since terminal T is a device installed before fingerprint authentication was introduced into the transaction system S, it cannot interpret what personal authentication means this identifier represents. Therefore, it determines that IC card C does not support PIN authentication and supports a proprietary personal authentication method. As another example, the performance information regarding the authentication function of IC card C may be configured to indicate whether or not it has a PIN authentication function. In this case, terminal T determines that IC card C does not support PIN authentication based on the "no" PIN authentication function indicated in the performance information received from IC chip 2.

[0034] If it is determined that IC card C supports the PIN authentication function (step S10: YES), terminal T determines whether it itself supports the PIN authentication function (step S11). In this determination, for example, it is confirmed that the connection between terminal T and the PIN pad is good and that encrypted communication between the PIN pad and terminal T is proper. If the criteria are met, it is determined that terminal T supports the PIN authentication function and a PIN verification command is sent to IC chip 2. However, in this embodiment, this process is not performed.

[0035] In step S12, terminal T sets the transaction details for when PIN authentication is not supported, based on predetermined transaction rules. Here, the transaction details are set, including transaction approval or online inquiry, and the amount of the transaction (for example, the amount to be settled). If terminal T can interpret the content of response S6 that IC card C sends to the application selection command (step S4) and implicitly obtain the performance information of IC card C, the system can be configured so that a command to read performance information is not sent to IC chip 2. In this case, terminal T sets the transaction details for when IC card C does not support PIN authentication, based on predetermined transaction rules, without obtaining performance information from IC chip 2.

[0036] Next, terminal T sends a transaction approval decision command to IC chip 2, which includes the transaction details set in step S12 (step S13). When IC chip 2 receives the transaction approval decision command from terminal T, it obtains the fingerprint authentication result recorded in step S38 (step S14). Next, IC chip 2 interprets the transaction details included in the transaction approval decision command received in step S13 and determines whether or not to approve the transaction details based on the fingerprint authentication result obtained in step S14 (transaction details approval decision) (step S15). This transaction details approval decision is performed in accordance with predetermined transaction rules.

[0037] For example, if the transaction includes transaction approval, IC chip 2 checks whether the fingerprint authentication result indicates successful authentication. If fingerprint authentication has not been performed at this point, the fingerprint authentication result will indicate that authentication was not performed. If the fingerprint authentication result indicates successful authentication, IC chip 2 makes a decision to approve the transaction (transaction approval). If the fingerprint authentication result indicates that authentication was not performed, IC chip 2 checks whether the amount of the transaction included in the transaction is less than or equal to a predetermined amount (for example, 10,000 yen). If the amount of the transaction is less than or equal to the predetermined amount, IC chip 2 makes a decision to approve the transaction. On the other hand, if the amount of the transaction is not less than or equal to the predetermined amount, IC chip 2 makes a decision to approve the transaction on the condition of online inquiry (online inquiry transaction approval). Alternatively, if the fingerprint authentication result indicates authentication failure, IC chip 2 makes a decision not to approve the transaction (transaction rejection). If the transaction includes online inquiry, IC chip 2 also checks whether the fingerprint authentication result indicates successful authentication. If the fingerprint authentication result indicates successful authentication, IC chip 2 makes a decision to approve the transaction on the condition of online inquiry (online inquiry transaction approval). On the other hand, if the fingerprint authentication result indicates authentication failure (or authentication not performed), IC chip 2 makes a decision not to approve the transaction (transaction rejection).

[0038] Next, IC chip 2 sends a response to terminal T containing the determination result determined in step S15 (step S16). This determination result indicates transaction rejection, transaction approval, or online inquiry transaction approval. In addition, the determination result indicating online inquiry transaction approval includes an identifier indicating successful fingerprint authentication. When terminal T receives the response containing the determination result from IC chip 2, it performs processing according to the determination result (step S17). For example, if the determination result indicates transaction rejection, terminal T displays an error message indicating that the transaction is impossible on the display. On the other hand, if the determination result indicates transaction approval, terminal T performs processing to complete the transaction and displays a message to that effect on the display.

[0039] On the other hand, if the judgment result indicates online transaction approval, terminal T sends a transaction approval inquiry request to online host H. This inquiry request includes the identifier of IC card C and an identifier indicating successful fingerprint authentication. When online host H confirms that fingerprint authentication was successful on IC card C based on the identifier indicating successful fingerprint authentication included in the inquiry request received from terminal T, it sends a transaction approval inquiry result back to terminal T. Upon receiving the transaction approval inquiry result from online host H, terminal T processes the transaction and displays a message to that effect on its display.

[0040] As described above, according to the above embodiment, when power is supplied, the IC chip 2 performs fingerprint authentication using the fingerprint characteristic information acquired by the fingerprint information acquisition unit 1 and the fingerprint characteristic information initially registered in the NVM 24, and records the fingerprint authentication result. Furthermore, when a command to read performance information is received from terminal T, the IC chip 2 responds to terminal T with performance information regarding the authentication function of the IC card C. When a transaction approval judgment command including transaction details set by terminal T is received from terminal T, the IC chip 2 determines whether or not to approve the transaction details based on the recorded fingerprint authentication result and responds to terminal T with the determined judgment result. This configuration reduces the cost of modifying the already installed terminal T, while enabling the transition of the personal authentication function of the IC card C from PIN authentication to biometric authentication. Moreover, according to the above embodiment, since the IC card C can automatically perform fingerprint authentication without the terminal T sending an execution command for fingerprint authentication, the time required for sending and receiving execution commands and responses can be shortened, and the risk of communication errors that may occur during transmission and reception can be reduced.

[0041] In the above embodiment, a fingerprint authentication function was used as an example of a biometric authentication function. However, the biometric authentication may be performed using biometric information obtained from the user's face, the user's palm print, the user's veins in the user's palm or fingers, or the user's iris, and the present invention can also be applied in such cases. Furthermore, in the above embodiment, the case in which a fingerprint information acquisition unit 1, which is an example of a biometric information acquisition unit, is mounted on an IC card C was described as an example. However, the present invention can also be applied even if the fingerprint information acquisition unit 1 is not mounted on an IC card C. In this case, the fingerprint information acquisition unit 1 is installed in a predetermined location such as a store and is capable of communicating with the IC chip 2. [Explanation of symbols]

[0042] 1 Fingerprint information acquisition section 2 IC chips 11. Fingerprint sensor 12 Sensor Control Unit 21 I / O Department 22 RAM 23 ROM 24 NVM 25 CPU CIC card T terminal H Online Host

Claims

1. An electronic information storage medium equipped with biometric authentication functionality, which is capable of communicating with a terminal for setting transaction details, When the electronic information storage medium receives power, the authentication means performs biometric authentication using biometric information acquired from the user's body by the biometric information acquisition unit and pre-stored biometric information, and records the result of the biometric authentication. After the power supply, when a transaction approval determination command including the transaction details set by the terminal is received from the terminal, a determination means for determining whether or not to approve the transaction details based on the recorded biometric authentication result, A second response means that responds to the terminal with the result determined by the determination means, Equipped with, If the transaction details include an online inquiry, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, it makes a determination to approve the transaction details on the condition of the online inquiry, characterized in that the electronic information storage medium.

2. An electronic information storage medium equipped with a biometric authentication function, which is capable of communicating with a terminal for setting transaction details, When the electronic information storage medium receives power, the authentication means performs biometric authentication using biometric information acquired from the user's body by the biometric information acquisition unit and pre-stored biometric information, and records the result of the biometric authentication. When a command to read performance information is received from the terminal after the power supply, a first response means responds to the terminal with performance information relating to the authentication function of the electronic information storage medium, When a transaction approval decision command including transaction details set by the terminal based on the performance information is received from the terminal, a determination means determines whether or not to approve the transaction details based on the recorded biometric authentication result, A second response means that responds to the terminal with the result determined by the determination means, An electronic information storage medium characterized by comprising the following features.

3. The electronic information storage medium according to claim 2, wherein if the transaction details include transaction approval, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, it makes a determination to approve the transaction details.

4. The electronic information storage medium according to claim 2, wherein if the transaction details include transaction approval, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates a failure to authenticate, it determines not to approve the transaction details.

5. An IC chip included in an electronic information storage medium equipped with biometric authentication functionality, which is an IC chip capable of communicating with a terminal for setting transaction details, When the IC chip receives power, it performs biometric authentication using the biometric information acquired from the user's body by the biometric information acquisition unit and the biometric information stored in advance. An authentication method for recording the biometric authentication result, After the power supply, when a transaction approval determination command including the transaction details set by the terminal is received from the terminal, a determination means for determining whether or not to approve the transaction details based on the recorded biometric authentication result, A second response means that responds to the terminal with the result determined by the determination means, Equipped with, If the transaction details include an online inquiry, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, the IC chip makes a determination to approve the transaction details on the condition of the online inquiry.

6. An IC chip included in an electronic information storage medium equipped with a biometric authentication function, the IC chip being able to communicate with a terminal for setting transaction details, When the IC chip receives power, the authentication means performs biometric authentication using biometric information acquired from the user's body by the biometric information acquisition unit and pre-stored biometric information, and records the result of the biometric authentication. When a command to read performance information is received from the terminal after the power supply, a first response means responds to the terminal with performance information relating to the authentication function of the electronic information storage medium, When a transaction approval decision command including transaction details set by the terminal based on the performance information is received from the terminal, a determination means determines whether or not to approve the transaction details based on the recorded biometric authentication result, A second response means that responds to the terminal with the result determined by the determination means, An IC chip characterized by having the following features.

7. An electronic information storage medium equipped with biometric authentication functionality, wherein a transaction content approval determination method is performed by a computer contained within the electronic information storage medium that can communicate with a terminal for setting transaction content, When the electronic information storage medium receives power, it performs biometric authentication using biometric information acquired from the user's body by the biometric information acquisition unit and pre-stored biometric information, and records the biometric authentication result. After the power supply, if a transaction approval decision command including the transaction details set by the terminal is received from the terminal, a decision step is made to determine whether or not to approve the transaction details based on the recorded biometric authentication result. The steps include: responding to the terminal with the determined result; Includes, A transaction content approval determination method characterized in that, if the transaction content includes an online inquiry, the determination step checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, a determination is made to approve the transaction content on the condition of the online inquiry.

8. A transaction content approval determination method performed by a computer contained in an electronic information storage medium equipped with a biometric authentication function, which is capable of communicating with a terminal for setting transaction content, When the electronic information storage medium receives power, it performs biometric authentication using biometric information acquired from the user's body by the biometric information acquisition unit and pre-stored biometric information, and records the biometric authentication result. If a command to read performance information is received from the terminal after the power supply, the step of responding to the terminal with performance information relating to the authentication function of the electronic information storage medium, When a transaction approval decision command including transaction details set by the terminal based on the performance information is received from the terminal, a determination step is made to determine whether or not to approve the transaction details based on the recorded biometric authentication result, A step of responding to the terminal with the result determined in the determination step, A method for determining the approval of transaction details, characterized by including the following:

9. An electronic information storage medium equipped with biometric authentication functionality, comprising a computer contained within the electronic information storage medium that can communicate with a terminal for setting transaction details, When the electronic information storage medium receives power, the authentication means performs biometric authentication using biometric information acquired from the user's body by the biometric information acquisition unit and pre-stored biometric information, and records the result of the biometric authentication. After the power supply, when a transaction approval determination command including the transaction details set by the terminal is received from the terminal, a determination means for determining whether or not to approve the transaction details based on the recorded biometric authentication result, A program that causes the result determined by the determination means to function as a second response means for responding to the terminal, If the transaction details include an online inquiry, the determination means checks whether the recorded biometric authentication result indicates successful authentication, and if the biometric authentication result indicates successful authentication, the program makes a determination to approve the transaction details on the condition of the online inquiry.

10. An electronic information storage medium equipped with a biometric authentication function, comprising a computer included in the electronic information storage medium that can communicate with a terminal for setting transaction details, When the electronic information storage medium receives power, the authentication means performs biometric authentication using biometric information acquired from the user's body by the biometric information acquisition unit and pre-stored biometric information, and records the result of the biometric authentication. When a command to read performance information is received from the terminal after the power supply, a first response means responds to the terminal with performance information relating to the authentication function of the electronic information storage medium, When a transaction approval decision command including transaction details set by the terminal based on the performance information is received from the terminal, a determination means determines whether or not to approve the transaction details based on the recorded biometric authentication result, A program characterized in that the result determined by the determination means functions as a second response means that responds to the terminal.

Images