JP2004240645A - Personal identification system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal identification system and method for surely executing personal identification by supplementing the security of an identification system using only a code such as a password or supplementing the inaccuracy of the identification system based on biological information under the consideration of the improvement of the convenience of a user in a transaction system such as on-line banking. <P>SOLUTION: This invention is provided to execute personal identification based on the combination of the optimal identification methods according to users and transaction classifications or the like. An identification rule data base 21 is registered with the combination of the identification methods or the order of identification for each account and transaction. An identification information data base 22 is registered with identification data corresponding to the respective identification methods. When an identification information accepting part 25 has received the identification data inputted to a customer terminal 40, an identification information deciding part collates the identification information data base 22 or the like, and executes personal identification according to the rule registered in the identification rule data base 22. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a personal authentication system and a personal authentication method capable of securely authenticating a user and improving the convenience of the user in a transaction system using a communication network such as online banking. It is.
[0002]
[Prior art]
Among transaction systems using communication networks, especially in transaction systems that involve fund settlement such as online banking and online securities, the person who transmitted the transaction request data has the authority to ensure the security of the transaction. A personal authentication method for confirming whether or not is an important issue.
[0003]
On the other hand, for example, in an ATM (Automatic Teller Machine) of a bank, a four-digit personal identification number registered in advance for each account is input and collated with account information recorded on a magnetic stripe portion of a cash card. Authenticates the user. Also, in an online banking system using the Internet, a user is required to enter identification information such as an account number and a password, and the personal information is verified by collating the information with pre-registered information. After that, login to the transaction operation screen is approved.
[0004]
However, the authentication using only the password or the password has a risk that the password or the password may be stolen on the network, which leaves a problem in security. On the other hand, for example, a use card printed with a random number table displayed in a matrix is distributed to the contractor in advance, and the number written in a predetermined position of the use card is input and collated, thereby enhancing security. An invention relating to personal authentication is disclosed (for example, see Patent Document 1).
[0005]
Further, as an invention which is more excellent in ease of use and reliability than the invention described in Patent Document 1, an array of symbols having different figures and colors is recorded on a use card instead of a random number table, and a question related to a symbol can be answered. There is disclosed an invention in which a response is input and personal authentication is performed based on the accuracy of the response (for example, see Patent Document 2).
[0006]
In addition to personal authentication that improves security by combining authentication means using codes such as numbers and letters in this way, there is also a method using biometrics that makes it difficult to steal or reproduce authentication data, such as fingerprints and voiceprints I do. Biometric authentication has the problem of lack of reliability due to the inability to accurately detect the user's biometric information depending on physical characteristics, so multiple biometric information is registered to increase the accuracy of authentication. In addition, there has been disclosed an invention in which personal authentication is performed using appropriate biometric information (for example, see Patent Document 3).
[0007]
[Patent Document 1] Japanese Patent Application Laid-Open No. 9-305541
[Patent Document 2] Japanese Patent Application No. 2001-327113
[Patent Document 3] JP-A-2002-236667
[0008]
[Problems to be solved by the invention]
As described above, authentication using only a PIN and a password has a risk that the PIN and password may be stolen on a network. In a transaction system that involves fund settlement through an open network such as online banking, this method is used. Alone cannot ensure sufficient security.
[0009]
The invention described in Patent Document 1 and the invention described in Patent Document 1 improve security by using a use card, but if the user does not have the use card at hand, authentication cannot be received, If the user does not have a use card at a place where he / she is away, he cannot make a transaction. In addition, since each invention is limited to an authentication method using a code such as a numeral, there remains a problem that impersonation by others cannot be completely eliminated due to data theft or loss of a use card itself. .
[0010]
On the other hand, in the invention described in Patent Document 3, it is possible to eliminate impersonation by another person by using the biometric information, and to register biometric information by using a plurality of biometric information. It has also become possible to reduce the uncertainty of detection, which is an issue. However, since the uncertainty of the detection of biological information is still not completely eliminated, there is a possibility that the transaction cannot be performed due to the inability to be authenticated even though the individual has requested the transaction.
[0011]
In response to these problems, the present invention provides a transaction system using a communication network such as online banking, which complements the security of an authentication system using only a code such as a personal identification number, and the inability of an authentication system using biometric information. It is an object of the present invention to provide a personal authentication system and a personal authentication method which ensure the authentication of a user by complementing the certainty and ensure the convenience of a user who conducts a transaction.
[0012]
[Means for Solving the Problems]
In order to solve these problems, the present invention provides an authentication rule storing means for storing an authentication rule for performing user authentication in association with user identification information, and an authentication rule storing means for performing user authentication. Authentication data storage means for storing authentication data in association with user identification information; and referring to the authentication rule stored in the authentication rule storage means from the user identification information received from the user terminal, for use in personal authentication. Authentication method specifying means for specifying an authentication method to be used, and identification of the user by referring to the authentication data of the user received from the user terminal and the authentication data stored in the authentication data storage means. Means. The identity determination means determines the identity of the user by referring to the authentication data of the user identified from the location information of the user terminal and the authentication data stored in the authentication data storage means. You can also. The identity determination means determines the identity of the user by referring to the authentication data of the user identified from the operation time of the user terminal and the authentication data stored in the authentication data storage means. You can also.
[0013]
In the present invention, the rules for the authentication rules are determined in consideration of the form of use of the user, the level of security required for personal authentication, and the like. The authentication method may include biometric authentication such as fingerprint authentication and voice print authentication, in addition to authentication using a code such as a password or a password. Biometric authentication includes not only biometric information related to a part of a human body but also a property that can be specified as a so-called habit such as handwriting and pen pressure. It may include a physical authentication method such as location authentication based on location information of the location where the user is located, time authentication based on the time of making a transaction request, and the like. The authentication rule may define one of these, or may require a combination of a plurality of authentication methods. By setting the most appropriate authentication rules for each account, each user, each transaction type, and the like, the security and convenience of authentication can be optimized.
[0014]
Here, the user terminal includes all terminal devices capable of transmitting and receiving data from a user through a communication network, such as a portable terminal such as a mobile phone and a PDA (Personal Digital Assistant), a personal computer, and a dedicated terminal such as an ATM. included. As the user identification information, ID information such as an account number that can identify the trader is used.
[0015]
In the authentication rule storage unit, two or more authentication methods are associated with one piece of identification information as the authentication rule, and the principal determination unit determines that the authentication data is the same for all of the two or more authentication methods. In the case where the authentication data matches the authentication data stored in the authentication data storage unit, it is determined that the user is the principal. The two or more authentication methods may include an authentication method using at least one code and an authentication method using at least one biometric information. The two or more authentication methods may include an authentication method using at least one code and an authentication method using at least one physical information.
[0016]
In this configuration, it is possible to increase the accuracy and security of the personal authentication by determining that the personal authentication has been performed when the authentication data matches in all of the two or more authentication methods. If two or more authentication methods include authentication using a code such as a password or password and biometric authentication such as fingerprint authentication or voiceprint authentication, authentication using a code with excellent reliability and excellent security will be achieved. By combining authentication methods of different categories called biometric authentication, the accuracy and security of personal authentication can be further improved. The combination of authentication using a code and authentication methods of different categories such as physical authentication such as location authentication and time authentication with excellent security can similarly improve the accuracy and security of personal authentication.
[0017]
In the authentication rule storage unit, two or more authentication methods are associated with one piece of identification information as the authentication rule, and the identity determination unit determines that the authentication data is at least one of the two or more authentication methods. May be determined to be an individual when the authentication data matches the authentication data stored in the authentication data storage means. The authentication rule may be given a priority order for the two or more authentication methods, and the identification means may refer to authentication data according to the priority order.
[0018]
The two or more authentication methods include an authentication method using at least one code and an authentication method using at least one biometric information, and the identity determination unit includes an authentication method using the code and the authentication method using the code. In any of the authentication methods using biometric information, if at least one of the authentication methods matches the authentication data stored in the authentication data storage unit, the user may be determined to be the user. The two or more authentication methods include an authentication method using at least one code and an authentication method using at least one physical information, and the identity determination unit includes an authentication method using the code and In any of the authentication methods using the physical information, when at least one of the authentication methods matches the authentication data stored in the authentication data storage unit, the user may be determined to be the principal.
[0019]
In this configuration, when at least one of the authentication data of the two or more authentication methods matches, it is determined that the personal authentication has been performed, so that the convenience of the user using the transaction system can be improved. For example, if authentication is set by using a combination of other highly secure authentication methods in addition to the authentication method using the usage card, another authentication method can be used even if the user does not have the usage card. Makes it possible to conduct transactions.
[0020]
Also, by registering priorities for multiple authentication methods, for example, if priorities are set for each type of transaction, priority is given to highly secure authentication methods and convenience for transactions that prioritize security. By giving priority to a highly convenient authentication method for a transaction to be performed, it is also possible to set an optimal authentication method in consideration of a balance between security and convenience.
[0021]
In addition, if two or more authentication methods include authentication using a code such as a password or password and biometric authentication such as fingerprint authentication or voice print authentication, if one or more authentication data matches If it is determined to be authentication, both authentication accuracy and security are secured by combining authentication methods of different categories: authentication using codes with excellent reliability and biometrics with excellent security. can do. The combination of authentication using codes and physical authentication such as location authentication and time authentication with excellent security can also secure both the accuracy and security of personal authentication. .
[0022]
In the authentication rule, the type of the transaction request received from the user terminal is recorded, and the authentication method specifying unit determines the type of the transaction request received from the user terminal and the type of the transaction request recorded in the authentication rule. The authentication method may be characterized by referring to the type.
[0023]
With this configuration, for example, by setting a highly secure authentication method for transactions that prioritize safety and a highly convenient authentication method for transactions that prioritize convenience, the optimal You can set the authentication method. Transactions that accept requests here include transactions that do not actually involve funds transfer, such as transfers and time deposits, as well as transactions that do not involve funds transfer, such as balance inquiry and contact registration. All requests to the trading system are included.
[0024]
In the authentication rule, a reference value related to a transaction request received from the user terminal is determined, and a different authentication method is defined in accordance with the reference value. The authentication method may be specified by referring to the received information regarding the transaction request as the reference value.
[0025]
Here, for example, if a fixed amount related to transfer is set as the reference value related to the transaction request, the transfer will be accepted only with a password up to the fixed amount, but if it exceeds the fixed amount, more secure than biometric authentication etc. It is possible to set an optimal authentication method in consideration of safety and convenience, such as requesting high authentication.
[0026]
Further, the present invention can be characterized in that it comprises an authentication rule registration unit for registering an authentication rule associated with user identification information received from the user terminal in the authentication rule storage unit. Further, the apparatus may further include an authentication data registration unit that registers authentication data associated with the user identification information received from the user terminal in the authentication data storage unit.
[0027]
With this configuration, it is possible for the user to set his own authentication rules according to his / her needs, and to easily register the authentication data from the terminal device. And security can be improved by changing the authentication rules and authentication data as needed.
[0028]
Incidentally, the present invention can also be configured as a personal authentication method using the personal authentication system of each configuration, corresponding to each configuration of the personal authentication system according to the present invention.
[0029]
BEST MODE FOR CARRYING OUT THE INVENTION
Embodiments of the present invention will be described below in detail with reference to the drawings. In the following, an example of an identity authentication system used for a bank transaction system such as online banking will be described. However, the present invention is not limited to such an embodiment, and targets all authentication systems used for identity authentication. Is what you do.
[0030]
FIG. 1 is a diagram showing an example of an embodiment of a personal authentication system according to the present invention. FIG. 2 is a block diagram showing an example of the configuration of the personal authentication system according to the present invention. FIG. 3 and FIG. 4 are diagrams showing an example of a record provided for each account and a record provided for each account and each transaction type in the authentication rule database of the personal authentication system according to the present invention. FIG. 5 is a diagram showing an example of a record provided for each account in the authentication information database of the personal authentication system according to the present invention. FIGS. 6 and 7 are first and second diagrams showing a flow of a screen for registering an authentication method and authentication data from a user terminal connected to the personal authentication system according to the present invention. FIG. 8 is a diagram showing a flow of a screen for performing a personal authentication and inputting a transaction request from a user terminal connected to the personal authentication system according to the present invention. FIG. 9 is a flowchart for registering an authentication method, authentication data, and an authentication order in the personal authentication system according to the present invention. FIG. 10 and FIG. 11 are first and second flowcharts for performing personal authentication by the personal authentication system according to the present invention.
[0031]
FIG. 1 shows an outline of a bank system including an authentication system as an embodiment of the personal authentication system according to the present invention. When the bank system 10 is accessed from a customer terminal 40 such as a personal computer or a mobile phone to make a transaction request such as balance inquiry or transfer, when the authentication system 20 confirms the identity, it connects to the transaction processing system 30. As a result, transaction security is ensured.
[0032]
In FIG. 2, an authentication system 20, which is an identity authentication system according to the present invention, includes an authentication rule database 21, an authentication information database 22, an authentication rule registration unit 23, an authentication information registration unit 24, an authentication information reception unit 25, an authentication information determination unit. 26, an authentication result transmitting unit 27, a position information recognizing unit 28, and a time recognizing unit 29. The authentication system 20 can be accessed from the customer terminal 40 through a communication network such as the Internet, and is also connected to the transaction processing system 30.
[0033]
In the authentication rule database 21, an authentication rule is defined for each transaction account or each transaction type of the transaction account. In a transaction account, an authentication rule may be defined for each user when a plurality of users use the same account, and for each transaction type, an authentication rule is further defined for each transaction pattern such as a reference amount at the time of transaction. . Regarding the former, for example, a plurality of persons in charge of a company account can select and use respective authentication methods. For the latter, for example, a simple authentication method can be used for a small transaction, and a combination of a plurality of highly secure authentication methods can be used for a transaction exceeding a certain amount.
[0034]
The authentication rule is defined by one authentication method used in the transaction account or the like, or a combination of two or more authentication methods, among various authentication methods. In particular, by combining two or more authentication methods, it becomes more difficult to steal data by combining the authentication method itself with the conventional authentication method using a combination of codes such as character strings using a random number table. Can be even higher. In addition, even for authentication methods such as biometric authentication, where the authentication rate of a single unit is lower than a certain probability and lacks certainty, it is possible to increase the substantial authentication rate and increase the certainty of authentication by combining the authentication methods themselves. Become.
[0035]
The authentication rule database 21 is provided with a record for each unit that defines an authentication rule, such as each transaction account, each transaction type of the transaction account, or each transaction pattern of the transaction account. 3 and 4 show examples of records provided for each account and records provided for each account and each transaction type.
[0036]
The record provided for each account shown in the example of FIG. 3 has a plurality of fields for recording an authentication method. In this field, the type of authentication method such as "password" or "voiceprint" is recorded, and the authentication method used for each account is specified. When a plurality of authentication methods are recorded, each authentication method may be defined as "and", and the authentication may be determined by clearing all the authentication methods. By defining the method as "or", it is also possible to determine that the user is the principal by clearing one authentication method. In addition, the order in which authentication is performed and the priority order can be set in order from authentication method 1.
[0037]
In the record provided for each account / transaction type shown in the example of FIG. 4, a field for recording the transaction type is provided in addition to a plurality of fields for recording the same authentication method as in the example of FIG. Have been. In this example, "password", "time", and "voiceprint" are registered as authentication methods for "transfer", and by setting all or some of these to be clear, it can be set to determine that the user is who he claims to be. it can.
[0038]
On the other hand, in the authentication information database 22, data such as a password and an image registered for performing personal authentication are registered. FIG. 5 shows an example of a record provided for each account in the authentication information database 22. As shown in the example of FIG. 3, for the authentication rule determined for each account, in FIG. 5, the authentication data for each authentication method used for the account is registered. If a simple character string such as a password is used, data indicating the password is directly registered. If image data or voice data such as a fingerprint or voiceprint is used, the image data or voice data file is stored in the authentication information database 22. In the record of FIG. 5, a path name and a file name are recorded.
[0039]
In this example, location authentication is registered in the authentication method 4, and an area code is specified as authentication data. When a mobile phone is used as the customer terminal, the location information of the customer terminal can be specified by GPS (Global Positioning System for measuring the position of a mobile object) or base station information, so transactions can be made only at the location specified in advance. The authentication method can be set as follows.
[0040]
Further, time authentication is registered in the authentication method 5, and time is specified as authentication data. If the customer has a limited time to conduct a transaction, by registering the transaction time in advance in this way, it can be set to reject authentication if there is a transaction request during an irregular time zone. .
[0041]
The location authentication and the time authentication perform authentication by specifying physical items. Other physical authentication methods include, for example, a barcode reader mounted on a mobile phone or the like, which is owned by the customer. Barcode authentication to authenticate by reading the barcode affixed to the object, access point authentication by specifying the access point of the provider usually used by customers when connecting to the Internet with a personal computer, caller such as a mobile phone There are various authentication methods such as caller ID authentication by specifying a number. Various authentication methods can be obtained by freely selecting and combining these authentication methods according to the circumstances of the customer and the contents of the transaction.
[0042]
The registration of the data relating to the authentication rule in the authentication rule database 21 can be performed by accessing the authentication rule registration unit 23 from the customer terminal 40 through a communication network such as the Internet. The registration of data such as a password and an image in the authentication information database 22 can be performed by accessing the authentication information registration unit 24 from the customer terminal 40 through a communication network such as the Internet.
[0043]
6 and 7 show an example of a screen flow for registering an authentication method and authentication data in a mobile banking system from a mobile terminal used as the customer terminal 40. In FIG. 6, when a transaction selection page of the mobile banking service is opened, a transaction menu is displayed, and "3. Registration of authentication method" is selected. Here, in order to perform personal authentication, it is required to input a currently set four-digit password for logging in to the mobile banking service.
[0044]
When the password is matched and login is performed, a screen for selecting an authentication method is first displayed as shown in FIG. If "1. Voiceprint authentication" is selected here, the authentication method is recorded in the authentication rule database 21, and on the screen for requesting voiceprint registration, an instruction to speak the name on the mobile phone is displayed. When the data is transmitted, the voiceprint data is registered and the procedure is completed. Voiceprint data is registered in the authentication information database 22. After that, a new authentication method can be added or the registered authentication method can be deleted. When a rule such as a combination of authentication methods and a priority is registered, the rule is recorded in the authentication rule database 21. The authentication rule can be set for each transaction type and each transaction pattern. In this case, a record is provided in the authentication rule database 21 for each rule.
[0045]
When the customer performs personal authentication at the time of requesting a transaction, the customer terminal 40 accesses the authentication information receiving unit 25 through a communication network such as the Internet. The authentication information receiving unit 25 receives identification information such as an account number for specifying a customer, and specifies an authentication method corresponding to the identification information with reference to the authentication rule database 21. When the authentication method is set for each transaction type, information on the transaction type is received together with the identification information, and the authentication rule database 21 searches the records corresponding to both to identify the authentication method.
[0046]
The authentication information determination unit 26 acquires, from the authentication information database 22, authentication data registered in advance corresponding to the specified authentication method. The authentication data is compared with the authentication data received from the customer terminal 40 in the authentication information receiving unit 25, and if they match, it is determined that the user is the person. The authentication rule when a plurality of authentication methods are specified is determined according to the priority order and the like defined in the authentication rule database 21.
[0047]
When the authentication based on the position information is specified as the authentication method, the position information recognizing unit 28 specifies the position information of the customer terminal by the GPS or the base station information, and the position data and the authentication data registered in the authentication information database 22 in advance. Collate.
[0048]
When the authentication based on the time information is specified as the authentication method, the time at which the transaction request is received is specified by the time recognition unit 29, and the time data is compared with the authentication data registered in the authentication information database 22 in advance. The time data may be specified by using the data of the time recognition unit 29 such as a timer provided in the authentication system as described above, or by the authentication information receiving unit 25 such as the creation time of the data transmitted from the customer terminal 40. The received data may be used.
[0049]
As a result of the authentication, when it is determined whether or not the user is the principal, the authentication result transmitting unit 27 transmits the authentication result to the customer terminal 40 through a communication network such as the Internet. In response to this result, the customer terminal 40 can transmit the transaction request data to the transaction processing system 30. Alternatively, when the transaction request data is received together with the authentication data, the result of the authentication is transmitted from the authentication result transmitting unit 27 to the transaction processing system 30, and the process can be directly shifted to the transaction processing.
[0050]
FIG. 8 shows an example of a flow of a screen for inputting a transaction request by performing personal authentication on a mobile banking system from a portable terminal used as the customer terminal 40. When the transaction selection page of the mobile banking service is opened, a transaction menu is displayed, and "2. Transfer" is selected. Next, a plurality of authentication methods registered for performing personal authentication at the transfer are displayed, and the customer selects “voiceprint authentication” as an appropriate authentication method from among them. On the other hand, it is required to speak the name to the mobile phone as the input of voiceprint data, so if you speak the name as instructed, it will be compared with the authentication data registered in advance, and if you clear the authentication, you will be prompted to input the transfer amount. Is displayed.
[0051]
The flow of registering the authentication method, authentication data, and authentication order in the personal authentication system according to the present invention will be described with reference to FIG. When the personal authentication system according to the present invention receives a registration request for an authentication method from a customer terminal (S01), it transmits a request for selecting a transaction type such as transfer or withdrawal to the customer terminal (S02). From the information received from the customer terminal, it is determined whether or not the transaction type is specified in the authentication method setting (S03). When the transaction type is specified, the information on the selected transaction type is received (S04). ), And register the received transaction type in the authentication rule database (S05).
[0052]
After the transaction type is registered, or when the transaction type is not specified, a request for selecting an authentication method is transmitted to the customer terminal (S06). When the information about the selected authentication method is received (S07), the received authentication method is registered in the authentication rule database in association with the account number or the like (S08). Subsequently, a request for inputting authentication data such as a password and a voiceprint is transmitted to the customer terminal (S09). When the input authentication data is received (S10), the received authentication data is registered in the authentication information database in association with the account number or the like (S11).
[0053]
Subsequently, a request for selecting an authentication method is transmitted in the form of a screen for selecting an authentication method (S12). Here, it is determined from the information received from the customer terminal whether or not to end the registration of the authentication method (S13). If a new authentication method is to be registered without ending the processing, the newly selected authentication method is to be registered. The method is received (S07). On the other hand, when it is determined that the registration is to be ended, it is determined whether or not to set the authentication order such as the priority order based on the information received from the customer terminal (S14), and when it is determined that the authentication order is not set. Ends the processing as it is.
[0054]
When it is determined that the authentication order is set, a request for selecting an authentication order is transmitted to the customer terminal (S15). When the information on the selected authentication order is received (S16), the received authentication order is registered in the authentication rule database in association with the account number or the like (S17), and the process is terminated.
[0055]
Next, a flow in the case where personal authentication is performed by one authentication method in the personal authentication system according to the present invention will be described with reference to FIG. In this example, it is assumed that an authentication method is set for each transaction type.
[0056]
First, when the personal authentication system according to the present invention receives information on the transaction type and the transaction request from the customer terminal (S21), the authentication method corresponding to the transaction type is registered by referring to the authentication rule database (S22). It is confirmed whether or not there is (S23). If not registered, data for displaying an error is transmitted to the customer terminal (S28), and the process ends.
[0057]
If the authentication method corresponding to the transaction type has been registered, a request for inputting authentication data for the registered authentication method is transmitted to the customer terminal (S24). Upon receiving the authentication data input from the customer terminal (S25), it checks with the authentication data registered in the authentication information database whether the authentication data matches (S26). If they match, it is determined that the user is the principal, and data for displaying a request for inputting detailed information on the transaction is transmitted (S27), and the processing for personal authentication is terminated. If they do not match, data for displaying an error is transmitted to the customer terminal (S28), and the process ends.
[0058]
Next, a flow in the case where personal authentication is performed by the second authentication method in the personal authentication system according to the present invention will be described with reference to FIG. Also in this example, it is assumed that an authentication method is set for each transaction type, and that if at least one of the two authentication methods matches, the user is determined to be a principal. The same flow is repeated also when performing personal authentication by three or more authentication methods.
[0059]
First, when the personal authentication system according to the present invention receives information on the transaction type and the transaction request from the customer terminal (S31), the authentication method corresponding to the transaction type is registered with reference to the authentication rule database (S32). It is confirmed whether or not there is (S33). If not registered, data for displaying an error is transmitted to the customer terminal (S41), and the process ends.
[0060]
When the authentication method corresponding to the transaction type is registered, a request for inputting authentication data relating to the first authentication method is transmitted to the customer terminal for the registered authentication method (S34). When the authentication data input from the customer terminal is received (S35), it is checked with the authentication data registered in the authentication information database whether the authentication data matches (S36). If they match, it is determined that the user is the principal, and data for displaying a request for inputting detailed information on the transaction is transmitted (S40), and the processing for personal authentication is terminated.
[0061]
If they do not match, for the registered authentication method, an input request for authentication data according to the second authentication method is transmitted to the customer terminal (S37). When the authentication data input from the customer terminal is received (S38), it is checked with the authentication data registered in the authentication information database whether the authentication data matches (S39). If they match, it is determined that the user is the principal, and data for displaying a request for inputting detailed information on the transaction is transmitted (S40), and the processing for personal authentication is terminated. If they do not match, data for displaying an error is transmitted to the customer terminal (S41), and the process ends.
[0062]
【The invention's effect】
According to the present invention, in a transaction system using a communication network such as online banking, it is possible to provide an authentication system that is more difficult to steal authentication data and has higher security than an authentication system using only a code such as a password. Can be. Further, from the viewpoint of the user, the convenience is improved as compared with the conventional authentication system in that the storage of the password and possession of the use card are not required.
[0063]
Compared to the authentication system based on biometric information, even in the case of an authentication technique that has a limit in improving the authentication rate in a single authentication method, the reliability of authentication can be improved by combining the authentication methods.
[0064]
In addition, in the present invention, a physical authentication method such as location authentication or time authentication is adopted, and by combining various authentication methods, a flexible authentication method according to customer convenience, transaction security and certainty. Can be set, so that an authentication method corresponding to various needs of the customer can be provided.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of an embodiment of a personal authentication system according to the present invention.
FIG. 2 is a block diagram showing an example of the configuration of the personal authentication system according to the present invention.
FIG. 3 is a diagram showing an example of a record provided for each account in an authentication rule database of the personal authentication system according to the present invention.
FIG. 4 is a diagram showing an example of records provided for each account and each transaction type in the authentication rule database of the personal authentication system according to the present invention.
FIG. 5 is a diagram showing an example of a record provided for each account in the authentication information database of the personal authentication system according to the present invention.
FIG. 6 is a first diagram showing a flow of a screen for registering an authentication method and authentication data from a user terminal connected to the personal authentication system according to the present invention.
FIG. 7 is a second diagram showing a flow of a screen for registering an authentication method and authentication data from a user terminal connected to the personal authentication system according to the present invention.
FIG. 8 is a diagram showing a flow of a screen for inputting a transaction request after performing user authentication from a user terminal connected to the user authentication system according to the present invention.
FIG. 9 is a flowchart for registering an authentication method, authentication data, and an authentication order in the personal authentication system according to the present invention.
FIG. 10 is a first flowchart for performing personal authentication by the personal authentication system according to the present invention.
FIG. 11 is a second flowchart for performing personal authentication by the personal authentication system according to the present invention.
[Explanation of symbols]
10 Banking system
20 Authentication system
21 Authentication Rule Database
22 Authentication information database
23 Authentication Rule Registration Section
24 Authentication information registration section
25 Authentication information reception unit
26 Authentication information judgment unit
27 Authentication Result Transmitter
28 Location Information Recognition Unit
29 Time Recognition Unit
30 Transaction Processing System
40 customer terminals

Claims (19)

Authentication rule storage means for storing an authentication rule for performing user authentication in association with the user identification information;
Authentication data storage means for storing authentication data for performing user authentication in association with user identification information;
Authentication method specifying means for specifying an authentication method used for personal authentication by referring to an authentication rule stored in the authentication rule storage means from user identification information received from the user terminal;
Identity determination means for determining the identity of the user by referring to the authentication data of the user received from the user terminal and the authentication data stored in the authentication data storage means,
An identity authentication system comprising: The identity determination means determines the identity of the user by referring to the authentication data of the user identified from the location information of the user terminal and the authentication data stored in the authentication data storage means. The personal authentication system according to claim 1, wherein The identity determination means determines the identity of the user by referring to the authentication data of the user identified from the operation time of the user terminal and the authentication data stored in the authentication data storage means. The personal authentication system according to claim 1, wherein In the authentication rule storage means, two or more authentication methods are associated with one piece of identification information as the authentication rule,
4. The personal identification unit according to claim 1, wherein the authentication unit determines that the user is an individual when the authentication data matches the authentication data stored in the authentication data storage unit for all of the two or more authentication methods. 3. The personal identification system according to any one of 3. The personal authentication system according to claim 4, wherein the two or more authentication methods include an authentication method using at least one code and an authentication method using at least one biometric information. The personal authentication system according to claim 4, wherein the two or more authentication methods include an authentication method using at least one code and an authentication method using at least one physical information. In the authentication rule storage means, two or more authentication methods are associated with one piece of identification information as the authentication rule,
The personal identification unit determines that the user is an individual when the authentication data matches the authentication data stored in the authentication data storage unit for at least one of the two or more authentication methods. The personal identification system according to any one of 1 to 3. The authentication rule is given a priority for the two or more authentication methods,
8. The personal authentication system according to claim 7, wherein said personal identification means refers to authentication data in accordance with said priority order. The two or more authentication methods include an authentication method using at least one code and an authentication method using at least one biometric information,
The identity determination means is an identity when at least one of the authentication method using the code and the authentication method using the biometric information matches at least one of the authentication data stored in the authentication data storage means. The personal authentication system according to claim 7 or 8, wherein: The two or more authentication methods include an authentication method using at least one code and an authentication method using at least one physical information,
The identity determination means determines that the identity of at least one of the authentication method using the code and the authentication method using the physical information matches the authentication data stored in the authentication data storage means. 9. The personal authentication system according to claim 7, wherein it is determined that there is a user. The type of transaction request received from the user terminal is recorded in the authentication rule,
11. The authentication method identifying unit according to claim 1, wherein the authentication method identifying unit identifies the authentication method by referring to a type of the transaction request received from the user terminal and a type of the transaction request recorded in the authentication rule. Personal authentication system described in Crab. In the authentication rule, a reference value related to a transaction request received from the user terminal is determined, and a different authentication method is defined corresponding to the reference value.
The personal authentication system according to claim 1, wherein the authentication method specifying unit specifies an authentication method by referring to information on a transaction request received from the user terminal as the reference value. 13. The personal authentication according to claim 1, further comprising an authentication rule registration unit that registers an authentication rule associated with user identification information received from the user terminal in the authentication rule storage unit. system. 13. The personal authentication according to claim 1, further comprising an authentication data registration unit that registers authentication data associated with user identification information received from the user terminal in the authentication data storage unit. system. The computer receiving the user identification information from the user terminal;
A step in which the computer refers to an authentication rule for performing personal authentication of the user associated with the user identification information stored in the storage device, and specifies an authentication method used for personal authentication from the identification information. When,
The computer receives the authentication data of the user from the user terminal,
A step in which the computer determines the user identity from the user authentication data by referring to authentication data for performing user identity authentication associated with the user identification information stored in the storage device; ,
A personal authentication method characterized by having: The computer receiving the user identification information from the user terminal;
A step in which the computer refers to an authentication rule for performing personal authentication of the user associated with the user identification information stored in the storage device, and specifies an authentication method used for personal authentication from the identification information. When,
The computer specifies the location information of the user terminal,
The computer, referring to the authentication data for performing the user authentication of the user associated with the user identification information stored in the storage device, to determine the user identity from the position information,
A personal authentication method characterized by having: The computer receiving the user identification information from the user terminal;
A step in which the computer refers to an authentication rule for performing personal authentication of the user associated with the user identification information stored in the storage device, and specifies an authentication method used for personal authentication from the identification information. When,
The computer specifies an operation time of the user terminal;
The computer, referring to the authentication data for performing the user authentication associated with the user identification information stored in the storage device, to determine the user identity from the operation time,
A personal authentication method characterized by having: The type of transaction request received from the user terminal is recorded in the authentication rule,
The personal authentication according to any one of claims 15 to 17, wherein the computer has a step of referring to a type of the transaction request received from the user terminal and a type of the transaction request recorded in the authentication rule. the method of. In the authentication rule, a reference value related to a transaction request received from the user terminal is recorded, and a different authentication method is defined according to the reference value,
18. The personal authentication method according to claim 15, further comprising the step of: said computer referencing information relating to the transaction request received from said user terminal as said reference value.

Images