JP2001312471A - One-time password authentication system using portable telephone or the like and settlement system using the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a one-time password system which can easily be operated at low cost safely in terms of security without managing passwords, etc., and to enable the settlement of a purchase of an article on the Internet, etc., without informing the seller side of buyer's personal information. SOLUTION: A user of portable telephone in the case of communicating can report who the user is to the opposite party. By this function, (3) is able to specify who (1) is. Then (3) informs (1) of a temporary ID and a temporary password which are usable only once in a certain time. When (2) authenticates (1), (3) is notified of the temporary ID and temporary password sent from (1). Then (3) compares the temporary ID and temporary password that (3) oneself issued with the temporary ID and temporary password from (2) to confirm that (1) that (3) oneself communicated with is the same person as (1) that (2) is communicating with.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a system for generating a one-time password using a communication device such as a mobile phone. It also includes a payment system using the authentication function.

[0002]

2. Description of the Related Art (A) For the first aspect, a conventional technique will be described as follows. 2. Description of the Related Art Conventionally, when logging in to a certain system, an ID and a password are used to authenticate whether the user is a legitimate user. However, it is generally necessary to frequently change a password in order to improve the security level. The management is difficult, and if you forget your password, you will not be able to use those systems, and if you manage your passwords poorly, you will cause unauthorized use of the system. There are one-time password systems to overcome them, but they are very expensive and only used for authentication, so they can get in the way and can easily be left behind. (B) The related art will be described as follows. Conventionally, when purchasing goods on sites such as the Internet, there is a method of notifying the credit card number when trying to make a payment on the spot, but in general, we do not want to notify the credit card number for security reasons, I do not want to be notified of personal information such as at all if possible. Another method of settlement is electronic money, but it is inconvenient because money must be digitized in advance.

[0003]

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and solves the difficulty of password management at the time of authentication. It also solves the anxiety and hassle associated with inputting a credit card number or the like at the time of business transactions and settlements performed via communication such as the Internet. Eliminate the need to notify personal information to the other party at the time of payment.

[0004]

Means for Solving the Problems (a) The following is a description of claim 1. For the sake of explanation, it is assumed that (1) is an authenticated person and (2) is an authenticated person. In order to achieve the object to be solved by the invention, when (1) is connected to the system (3) according to the present invention, it is associated with a unique number that can identify (1), such as a telephone number notified by a communication carrier. The temporary ID and the temporary password are generated. Further, the generated temporary ID and temporary password are returned to (1). The temporary ID and the temporary password generated and notified to (1) are configured so that (1) can be uniquely specified by the temporary ID. And (1) connects to (2),
In obtaining the authentication, (1) notifies (2) the temporary ID and the temporary password notified from the system (3) of the present invention. (2) notifies the system (3) of the present invention of the temporary ID, the temporary password, and other necessary information notified from (1). This notification can be made by a known method such as circuit switching or communication on the Internet. The system (3) of the present invention is configured so that the temporary ID and the temporary password notified from (2) are compared with the information held by the system (3) of the present invention, and the right or wrong is notified to (2). At this time,
The system (3) of the present invention is configured so that, if necessary, even if the temporary ID and the temporary password notified from (2) are correct, the one that has passed the predetermined time can be rejected. Further, the system (3) of the present invention is configured so that, if necessary, even if the temporary ID and the temporary password notified from (2) are correct, if the temporary ID and the temporary password have been used for authentication once, it can be determined as not. In (2), when a positive notification is received from the system (3) of the present invention, authentication can be successful for (1), and when a negative notification is received, authentication can be unsuccessful. The exchange of the above information can be performed by a known method such as circuit switching and communication on the Internet, and necessary confidential processing in communication can be performed. The present invention is configured so that (2) performs authentication for (1) according to the above flow. (B) A description of claim 2 will be given below. For the sake of explanation, thereafter, (1) is connected to (2) via communication (1)
However, it is assumed that goods or valuable information is obtained from (2) and settlement is performed using the present invention. In order to achieve the problem to be solved by the invention, when (1) is connected to the system (3) according to the invention, (3) is associated with a unique number such as a telephone number notified by the carrier, A temporary ID and a temporary password are configured to be generated, and the generated temporary ID,
The provisional password is returned to (1). In addition, in the system (3) according to the present invention, information such as a name and an address generally used in association with the unique number is required at the time of settlement, so that those items can be searched and extracted from the unique number or the temporary ID. It was configured like this. Generated
The temporary ID and the temporary password notified to (1) are configured so that (1) can be uniquely specified by the temporary ID. Then, (1) is connected to (2), and (1) offers to (2) to purchase goods or valuable information. At that time, (1) notifies (2) the obtained temporary ID and temporary password. (2) notifies the system (3) of the present invention of the temporary ID, the temporary password, the amount of the completed trade, the product name, etc. notified from (1). This notification can be made by a known method such as circuit switching or communication on the Internet. The system of the present invention uses the temporary I
D. Since the provisional password matches the information held by the system (3) of the present invention, it is known that (1) has offered to purchase (2), and the amount and content of the offer. The system (3) of the present invention can determine whether to settle the purchase of (1) notified from (2) based on information owned by itself or information held by another clearing house,
The result is notified to (2). This notification can be made by a known method such as circuit switching or communication on the Internet. If (2) receives a positive notification from the system (3) of the present invention, (1)
To the settlement. If the notification of the failure is received, the settlement can be unsuccessful. These communications can be performed using circuit switching, Internet communications, and the like, and the necessary communication concealment processing can be performed by a known method. If the settlement is successful, the system (3) of the present invention is configured to search the possessed database based on the temporary ID and obtain information such as name and address. According to the present invention, according to the above flow, (1) is replaced with provisional I by (2).
D. Anonymous only for the notification of the provisional password, purchase goods and other valuable information from (2) and enable settlement.

[0005]

DESCRIPTION OF THE PREFERRED EMBODIMENTS With the above configuration, an authentication system using mobile communication such as a mobile phone according to the present invention and a settlement system using the authentication will be described in detail with reference to FIG. (1) is a person who is going to be authenticated or who is going to purchase goods. (2) is (1)
Or a person who sells goods or the like to (1). (3) is a system having the function of the present invention. (1) has a communication device connected to (3) for communication and exchanging necessary information. At present, a mobile phone corresponds to this communication device. This communication device must be a device that (3) can obtain a unique number that can uniquely identify the communication device owned by (1). At present, mechanisms having such a function include NTT's caller ID notification service, NTT DoCoMo's i-mode or cellular phone EzWeb content billing system, and the like. (1) Connects to the system (3) of the present invention via a mobile phone browser or a communication carrier by voice communication. At this time, a unique number is notified from the communication carrier to (3). The system (3) of the present invention immediately generates a temporary ID and a temporary password, associates them with a unique number, and stores them in the database. Then, the temporary ID and the temporary password are notified to (1). After connecting to (2), (1) notifies (2) the temporary ID and temporary password and other necessary information obtained from (3). (2) notifies the obtained information to (3),
In (3), authentication is performed by determining whether the temporary ID and the temporary password notified from (2) match those at the time of generation.
In addition, (3) is based on the information held in the same flow (1)
It is possible to determine whether or not to accept the settlement when purchasing an article or the like from (2).

[0006]

(Embodiment 1) For the sake of explanation, (1) uses a laptop computer and a mobile phone for authentication from a remote place via the Internet, and (2) the company to which ((1) belongs). This example describes how to connect to the system and receive authentication. A system having the function of the present invention is called (3),
It is connected to (2) by a communication line such as the Internet. First, (1) connect your laptop computer to the Internet. Then, an attempt is made to connect to the system (2), and an authentication screen is displayed. A screen for inputting a temporary ID and a temporary password is displayed on the screen. Here, separately from the notebook computer, the connection to (3) is made by a mobile phone browser (EzWeb service in the case of a cellular phone).
In this case, since the connection is made via the gateway of the communication company, (3) is notified of the telephone number which is the unique information of the mobile phone in (1) or the subscriber ID in the case of the EzWeb service. You. These unique information are previously associated with the authority to use the system (1) and (2) and stored in the database of the system (3). (3) generates and notifies a temporary ID and a temporary password as a pair to (1). This temporary ID is (1)
Is generated so that can be uniquely specified. This function is automatically performed by the software built in (3). (1) received them, the temporary ID is displayed on the screen of the notebook computer,
Enter your temporary password. Upon completion of the input, the system of (2) notifies the received temporary ID and temporary password to (3) by communication. In (3), the database is searched based on the received temporary ID, and a temporary password generated simultaneously with the temporary ID and information unique to the mobile phone (1) acquired at the time of communication with (1) are obtained. (1) Connects to the system of (2) by referring to the fact that the combination of the temporary ID and the temporary password match, and referring to the information of (1) associated with the unique information of the mobile phone of (1). Verify that you are qualified to do so. (3) has a mechanism in which the temporary ID and the temporary password after a certain period of time are not used for authentication by comparing the generation time of the temporary ID and the temporary password with the time received from (2). Further, the temporary ID and the temporary password used once may not be used for authentication. (3) performs verification, and returns the result to (2). (2)
Authenticates (1) based on the result. With the above flow, you do not have to worry about managing ID and password,
Authentication work can be performed safely. (Example 2) For the purpose of explanation, (1) describes an example in which a personal computer is connected to the site (2) on the Internet to purchase music data. The server having the function of the present invention is called (3), which is connected to (2) via the Internet. First, (1) connect your laptop computer to the Internet. Then, the screen of the company's site is displayed on the browser. (1) decides to find and purchase favorite music data on the site. When the payment screen is displayed on the browser, a screen for inputting a temporary ID and a temporary password, and an amount to be settled are displayed. Here, separately from the notebook personal computer, a connection is made to (3) using a mobile phone browser, for example, EzWeb of a cellular phone. Since the connection in this case is connected via the gateway of the communication company, (3) is notified of (1) a subscriber ID which is unique information. (3) generates and notifies a temporary ID and a temporary password to (1).
This temporary ID is generated so as to uniquely identify (1), and is stored in the database together with the subscriber ID.
This function is automatically processed by the software built in (3). Upon receiving them, (1) inputs the temporary ID and the temporary password on the screen of the personal computer. When the input is completed, (2) notifies (3) of the received temporary ID, temporary password and payment amount by communication. (3) Searches the database based on the received temporary ID, and obtains the temporary password generated at the same time as the temporary ID and the subscriber ID which is the unique information of (1). (3) notifies the charging system of the cellular telephone of the subscriber ID and the payment amount. If the subscriber ID is known, the cellular phone can identify the holder of the mobile phone, and notifies (3) whether or not to accept the payment in consideration of the past call charge payment status, the average call charge, and the like. In (3), if the provisional password generated at the same time as the provisional ID matches the one notified from (2), and a notification of acceptance of payment is received from the cellular phone, OK information is notified to (2). . Otherwise, the information of NO is notified to (2). (2) transmits the information to (1). If the notification is OK, (1) can download and obtain the music data to be purchased from the site (2). Thereafter, the cellular telephone debits the purchase price together with the call charge from the settlement account of (1). By the above flow, (1) becomes (2)
More music data can be purchased and settled without any personal information being notified to (2). As in the first embodiment, the temporary ID and the temporary password after a certain period of time can be invalidated.
The temporary ID and the temporary password used once can also be invalidated, so that even if the input screen is viewed by another person, there is no problem in security. (Example 3) For the sake of explanation, it is assumed that a certain person (1) purchases an article at a certain shop (2). In this case,
(1) and (2) are in the same place, but (1) uses this system in order to prevent personal information from being disclosed to (2) when making a payment. A store that sells articles is designated as (2). The system having the function of the present invention is (3)
And (1) shall decide the goods to be purchased and pay the price. (1) Make a call to (3) using a mobile phone. In (3), the caller can be immediately known from the caller ID display service of NTT. Then, the temporary ID and the temporary password generated by the automatic voice response function, which is a known technique, are notified by voice to (1). (1) is (2)
To the temporary ID and the temporary password. (2) is (3)
Make a call to. The temporary ID, the temporary password, and the amount are notified to (3) by using an automatic voice function and a push signal notification, which are known technologies. In (3), a settlement process is performed in the same manner as in Embodiment 2 and the result is notified to (2). The rest is processed in the same manner as in the second embodiment. As described above, in the system of the present invention, the communication between (1), (2), and (3) can be performed by the Internet, voice communication, and other information exchange as long as there is communication means capable of identifying (1) in (3). Any method that can be used can be used.

[0007]

According to the present invention, (a) password management,
Memory and the like become unnecessary. The issued temporary ID and temporary password are discarded after a lapse of a predetermined time, and the once used temporary ID and temporary password cannot be used. Therefore, there is no problem even if the input temporary ID and temporary password are known to others. (B) There is no need to enter any personal information for authentication and settlement. At the time of payment at the time of purchase of goods at the site on the Internet, there is no need to input a credit card number or the like, and it is possible to purchase goods at the site on the Internet easily and safely. (C) There is no need for a procedure such as computerization of cash in advance such as electronic money. (D) As in the second embodiment, if the mobile phone carrier has a settlement function and cooperates with the system of the present invention, the site that sells goods on the Internet will be a small part of the settlement system of its own site. With the change, it is possible to provide a secure and simple means of Internet payment for anyone with a mobile phone.

[Brief description of the drawings]

FIG. 1 is a diagram showing an entire configuration.

[Explanation of symbols]

(1): A person who is authenticated or purchases an article, and has a communication device such as a mobile phone capable of notifying (3) of a unique number. (2): Person who authenticates to person (1) who is authenticated,
Alternatively, the seller is a seller who sells articles and the like for (1). (3): The system of the present invention. (4): Person to be authenticated (1) and the system of the present invention (3)
It is necessary to have a function to communicate the unique information that can identify (1) from (1) to (3). is there. From (3) to (1), provisional I
D and the temporary password are transmitted. (5): A communication means between a person to be authenticated (1) and a person to authenticate (2) or a person to purchase goods (1) and a person to sell (2), from (1) to (2) Is notified of the temporary ID and the temporary password obtained from (1) and (3). (2)
The result of the authentication performed in (3) is returned to (1). The Internet and face-to-face exchanges are assumed, but any communication means can be used as long as the above functions are satisfied. (6): Communication means between the authenticator (2) and the system (3) of the present invention. (2) notifies the temporary ID and the temporary password notified from (1) to (3). Then, the pass / fail of the authentication is notified to (2) from (3). Although the Internet, voice communication, or dedicated line is assumed, any communication means may be used as long as the above functions are satisfied.

Continued on front page F term (reference) 5B049 AA05 BB11 CC36 DD01 FF04 GG06 GG10 5B085 AA08 AE03 BC01 BC02 5J104 AA07 KA01 NA05 PA02 PA07 PA11 5K067 AA32 BB04 BB21 DD17 EE02 HH22 HH23

Claims (2)

[Claims] (1). The present invention provides an authentication function for another system by using an authentication function of a mobile phone or the like. When it is assumed that a certain person (1) logs in to the system (2) by using communication, the present invention is applied. The present invention provides a so-called one-time password function by utilizing an authentication function of a mobile phone or the like, that is, a function of who the other party is. , Systems using NTT's caller ID display service, NTT DoCoMo's i-mode, EzWeb provided by the cellular group, etc.
The one-time password generated by the system of the present invention has a function of specifying a connected user, and is configured so that an ID and a password are created as a basic pair (hereinafter, referred to as a temporary ID and a temporary password, respectively) for the sake of explanation. The system (3) of the present invention is placed in an environment where information can be exchanged using (1) and (2) and a communication carrier, and a communication function for communicating with (1) is provided. A database function that can uniquely specify a number (for example, a telephone number) and an actual name, address, and the like. (1) When a one-time password issuance request is issued from (1), these are generated and notified to (1). When (2) authenticates (1), (1) verifies whether the contents of the one-time password notified to (2) are valid, returns the verification result to (2), and has a communication function. Use It is configured to have a function to be exchanged with the other necessary information (1) or (2). (B). The present invention is supposed to operate using communication such as voice, data communication, and the Internet in circuit switching. If necessary, a conventional ID and the like can be used in addition to a temporary ID and a temporary password. The one-time password generated by the present invention is composed of a temporary ID and a temporary password,
It is configured so that (1) can be uniquely specified by the provisional ID, and a device that has been used for an arbitrary time and that has been used once has a function that cannot be used for authentication. The present invention is a system having the features described in the above (a) and (b). 2. The present invention uses the authentication system of claim 1, wherein when (1) connects to the system (2) and purchases an article or the like, a notification of the price is received from (2), It is configured to have a function to search for basic information (name, address, other necessary contents) for performing payment using the database function, and to notify (2) the result of whether to accept the payment, The present invention is a system that is configured so that payment can be made without sending personal information from (1) to (2), and the present invention has the above features.