JP4586439B2 - Identity verification device - Google Patents

Description

  The present invention relates to a personal identification device that verifies an individual's identity entered by an entered personal identification number or the like.

The conventional identity verification device allows the user to select whether to continue the transaction or cancel the transaction by re-entering the PIN when the number of incorrect PINs is less than the warning threshold. And the invalidation information is written on the card to invalidate the card. Further, if the correct password is input before the number of incorrect input of the password reaches the threshold, the transaction is continued (for example, see Patent Document 1).
JP-A-5-290075 (page 4, left column, line 40-page 4, right column, line 40)

However, in the above-described conventional technology, since the transaction is continued if the correct password is input up to the number of times until the threshold value is reached, after an unauthorized third party has mistakenly input the password several times, There is a problem that it is possible to perform an illegal act if a correct password is entered in.
The present invention has been made to solve the above-described problems, and it is an object of the present invention to provide means for preventing fraud even when a correct password is input after the input of the password is inconsistent. And

In order to solve the above-mentioned problem, the present invention provides a personal identification number receiving means for receiving an input of a personal identification number, a verification result acquiring means for acquiring a verification result between the received personal identification number and the registered personal identification number from a host device, and a transaction. And a mismatch number storage means for storing the number of mismatches of the matching results in the memory, and when the obtained matching results match, the number of mismatches stored in the mismatch number storage means is read out, and the number of mismatches read out is 0 In this case , the personal identification by the collation of the personal identification number is terminated and the process proceeds to the next process. When the number of mismatches is one or more, the personal identification number is again input.

  As a result, the present invention allows an unauthorized third party to input the correct password by chance by causing the password to be confirmed when the password entered after the input of the password does not match. Even if it is not possible to input the same personal identification number by confirmation input, it is possible to prevent fraud.

  Embodiments of an identification apparatus according to the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing an automatic teller machine according to the embodiment, and FIG. 2 is a flowchart showing a withdrawal transaction process according to the embodiment.
In FIG. 1, reference numeral 1 denotes an automatic teller machine as a personal identification device, which is installed in a branch of a financial institution such as a bank or a convenience store (referred to as a financial institution or the like) or a store such as a sales office. Cash transactions are done automatically.

Reference numeral 2 denotes a host computer as a host device installed in a center such as a financial institution, which is connected to an automatic teller machine 1 installed in a store via a communication line such as a dedicated line or a telephone line. The customer's account is managed by holding customer information such as the account number and account balance of the customer's account and the registered personal identification number registered in advance by the customer.
Further, the host computer 2 holds customer question information such as a combination of a question, its correct answer, and a plurality of options, which is known only by the customer set in advance when the account is opened, in association with the customer's customer information.

Reference numeral 3 denotes a main control unit of the automatic teller machine 1, which is connected to the host computer 2 via the communication line by the communication unit 4, and controls each part in the automatic teller machine 1 to execute transaction processing and the like. At the same time, it controls data communication and the like.
Reference numeral 5 denotes a storage unit that stores a program executed by the main control unit 3, various data used for the program, processing results by the main control unit 3, and the like. The number of mismatches and the number of questions displayed in the customer question information are stored, and the threshold value for the number of mismatches in the personal identification number and the question display limit value for the number of questions displayed are stored.

Reference numeral 6 denotes an operation display unit, which is composed of a combination of a display unit 6a such as an LCD and a position signal detection unit 6b such as a transparent touch panel. The display unit 6a has a transaction selection screen, various input screens, and customer actions. The position signal detector 6b receives an input from the customer while displaying a guidance screen for prompting the user.
Reference numeral 7 denotes an input operation unit having a character key, a numeric keypad, and the like, which is used by a customer to input a personal identification number.

The position signal detector 6b and the input operation unit 7 constitute the input unit of this embodiment.
8 is a card handling unit having a function of reading and writing card information such as an account number recorded on a magnetic stripe of a card such as a cash card inserted by a customer and a function of printing a transaction statement. ing.
A bankbook handling unit 10 has a function of reading and writing the bankbook information recorded in the magnetic stripe of the customer's bankbook inserted by the customer, and also has a function of recording transaction contents and the like in the bankbook of the customer.

A banknote depositing / dispensing unit 12 has a function of receiving banknotes inserted by a customer, discriminating and counting the banknotes, storing them, discharging banknotes to be paid to the customers, and delivering them to the customers.
Reference numeral 14 denotes a coin deposit / withdrawal unit which has a function of receiving coins inserted by a customer, discriminating and counting them, storing them, discharging coins to be paid to the customer, and delivering them to the customer.
The operation of the above configuration will be described.

The operation of the withdrawal transaction process by the automatic teller machine 1 of this embodiment will be described according to the step indicated by S using the flowchart shown in FIG.
S1, the main control unit 3 displays a transaction selection screen on which a transaction selection button such as a withdrawal transaction is displayed on the display unit 6a of the operation display unit 6 and is on standby.
S2, when the customer presses the transaction selection button of the withdrawal transaction from the transaction selection screen by the position signal detection unit 6b, the main control unit 3 recognizes this and displays a card insertion guidance screen prompting insertion of the card.

S 3, when the customer inserts the card into the card handling unit 8, the main control unit 3 reads the card information recorded on the card by the card handling unit 8 and displays the question of the customer question information stored in the storage unit 5. Reset the number of times to the initial value of 0.
S4, the main control unit 3 resets the number of mismatches stored in the storage unit 5 to an initial value of zero.

S5, the main control unit 3 displays a password entry guidance screen on the operation display unit 6 that displays the password for entering the password shown in FIG.
S 6, when the customer inputs a password that is a combination of numbers by the input operation unit 7, the main control unit 3 accepts the password and recognizes the input password, and exchanges the password with the host computer 2. Execute.

That is, the main control unit 3 transmits a password verification request attached with the card information and the input password to the host computer 2 via the communication line by the communication unit 4.
The host computer 2 retrieves the customer information held based on the received card information of the password verification request, reads the registered password from the customer information of the customer, compares it with the password of the password verification request, and requests the password verification. Create a verification result notification indicating that the security code does not match the registered security code and that the security code does not match the security code, and that the security code request request matches the registered security code. This is transmitted to the automatic teller machine 1 through a communication line.

S7, The main control unit 3 that has received the verification result notification by the communication unit 4 determines whether the security code matches or does not match based on the acquired verification result. If the security code does not match, the process branches to step S8. If they match, the process proceeds to step S10.
In S8, the main control unit 3 that has determined that the passwords do not match counts the number of mismatches by adding 1 to the number of mismatches stored in the storage unit 5.

S9, the main control unit 3 reads out the number of mismatches stored in the storage unit 5 and a threshold value (eg, 3 times) of the number of mismatches of the personal identification number stored in the storage unit 5, and the number of mismatches exceeds the threshold value. If YES in step S14, the flow advances to step S14. If the number of mismatches is equal to or less than the threshold value, the flow returns to step S5 to display the password input guidance screen again to prompt the customer to input the password.
S10, the main control unit 3 having determined that the passwords match, reads out the number of mismatches stored in the storage unit 5, and if the number of mismatches is 0, that is, if the input of the password has never been mistaken, step The process branches to S20, and if the number of mismatches is one or more, that is, if the input of the password is wrong even once, the process proceeds to Step S11.

  S11, the main control unit 3 having determined that the correct password has been input after making a mistake in entering the password, is the third password appropriately entered by the third party posing as the card owner? In order to check whether or not the operation display unit 6 prompts the confirmation input of the password again in order to prevent the third party shown in FIG. The password confirmation input guidance screen displaying and is displayed.

S12, when the customer inputs the confirmation number of the personal identification number by the input operation unit 7, the main control unit 3 accepts this, recognizes the personal identification number of the confirmation input, and checks with the host computer 2 to collate the personal identification number. In the same manner as in step S6, the password verification communication process is executed.
S13, the main control unit 3 that has received the verification result notification determines whether or not the passwords confirmed and input based on the acquired verification result match, and if the passwords do not match, the process branches to step S14. If they match, the process proceeds to step S20.

  The main control unit 3 that has determined that the number of mismatches exceeds the threshold value or the confirmation input passwords do not match is stored in the storage unit 5 and the number of question displays stored in the storage unit 5. A question display limit value (for example, once) is read, and if the question display number is less than the question display limit value, the process branches to step S15, and if the question display number is equal to or greater than the question display limit value, the process proceeds to step S19. .

In S15, the main control unit 3 that has determined that the number of question display times is less than the question display limit value adds 1 to the question display number of the customer questions stored in the storage unit 5.
S <b> 16, the main control unit 3 executes customer inquiry information acquisition communication processing with the host computer 2. That is, the main control unit 3 transmits a customer question transmission request attached with card information to the host computer 2.

The host computer 2 retrieves the customer information held based on the received card information of the customer question transmission request, reads the customer question information from the customer information of the customer, and cashes the customer question information via the communication line. Send to the teller machine 1.
S17, the main control unit 3 that has received the customer question information shows, on the operation display unit 6, an option button displaying a plurality of options including a question and a correct answer and a word prompting an answer to the displayed question, as shown in FIG. Display the customer question screen.

  S18, when the customer presses the answer option button on the operation display unit 6, the main control unit 3 accepts this and recognizes the customer's answer. Based on the correct answer of the received customer question information, is the customer's answer correct? If the customer's answer is correct, the process returns to step S4, resets the number of mismatches added so far, displays the PIN number input guidance screen again, accepts the PIN number, and receives the customer's answer. If the answer is incorrect, the process proceeds to step S19.

S19, the main control unit 3 performs an invalidation process of writing invalidation information to the card inserted in the card handling unit 8, returns the card to the customer, and ends the withdrawal transaction process.
S20, the main control unit 3 having determined that the number of mismatches stored in the storage unit 5 is 0 or the confirmation input of the PIN number is the same, input the withdrawal amount as usual in the operation display unit 6 Display the screen and prompt the user to enter the withdrawal amount.

S 21, the main control unit 3 recognizing that the customer has input the withdrawal amount through the input unit 6 executes a transaction process of withdrawal transaction with the host computer 2. In addition, since the operation | movement of the communication process of withdrawal transaction is the same as that of a normal case, the description is abbreviate | omitted.
S22. The main control unit 3 that has been permitted to withdraw cash to the customer by the communication process executes the withdrawal process.

That is, the main control unit 3 counts and pays out cash corresponding to the input withdrawal amount from the banknote depositing / withdrawing unit 12 and the coin depositing / withdrawing unit 14, and describes the card and transaction details from the card handling unit 8. The statement slip is discharged and the operation display unit 6 is displayed to prompt the user to receive them, confirming that the customer has received them, and the withdrawal transaction process is terminated.
As described above, in the input of the personal identification number according to the present embodiment, when the correct personal identification number is input after the input of the initial personal identification number is inconsistent, the third personal identification number is the owner of the card. In order to confirm whether or not the password has been entered properly, the password is confirmed and entered.

  In addition, when the number of PIN mismatches becomes a threshold value or when the confirmation input does not match, a question that is known only to the customer is displayed and prompted to answer, and when the answer is correct, the stored number of mismatches is reset. And then enter the PIN again to continue the transaction, and if the answer is incorrect or the number of questions displayed exceeds the question display limit, the card is invalidated and the transaction is terminated. Like to do.

As described above, in the present embodiment, after the input of the personal identification number does not match, when the input personal identification number matches, the confirmation input of the personal identification number is performed, so that an unauthorized third party accidentally Even if the correct password is input to the password, the same password cannot be input by confirmation input, so that fraud can be prevented in advance.
In addition, customer question information is set by displaying customer question information and prompting the answer when the number of PIN mismatches exceeds the threshold or when the PIN confirmation input does not match Since the customer other than the customer himself / herself does not know the correct answer, if the correct answer cannot be made, the card is invalidated and the withdrawal transaction is terminated.

In this embodiment, the automatic teller machine has been described as an example of the identity verification device. However, the identity verification device is not limited to the above, and a certificate for inputting a personal identification number to issue a certificate in which personal information is described. It may be an issuing / leaving device or an entrance / exit management device for inputting a password to lock and unlock the door.
In this case, when a card reader that passes the card as the card handling unit of the entry / exit management device is used, the card cannot be directly invalidated, so the card information of the corresponding card is not accepted from the main control unit. The card is invalidated by transmitting a message to be sent to the host device.

In the present embodiment, the personal identification number has been described as a combination of numbers, but the personal identification number is not limited to a number, and may be a character string combining kana characters and English characters.
In addition, it was explained that invalidation processing is performed on the card when the answer to the question displayed on the customer question screen is incorrect or the number of questions displayed is greater than or equal to the question display limit value. However, the card is placed inside the cash dispenser. Even if the withdrawal transaction process is terminated without taking in and returning to the customer, the same effect as described above can be obtained.

  In the present embodiment, the communication process for acquiring customer question information has been described as being executed. However, when the first password verification process is executed, customer question information is attached to the verification result notification transmitted from the host computer. When the main control unit that has received the verification result notification stores the customer question information in the storage unit and the number of PIN mismatches exceeds the threshold, or when the PIN confirmation input does not match If the control unit reads the customer question information stored in the storage unit and displays the customer question screen on the operation display unit, in addition to the above effect, the communication process for acquiring the customer question information can be omitted. There is an effect that it is possible to shorten the time spent for the communication process between the automatic teller machine and the host computer during the withdrawal transaction process.

The block diagram which shows the automatic teller machine of an Example, The flowchart which shows the payment transaction processing of an Example. Example of password entry guidance screen Sample password confirmation input guidance screen Customer question screen example

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Cash dispenser 2 Host computer 3 Main control part 4 Communication part 5 Memory | storage part 6 Operation display part 6a Display part 6b Position signal detection part 7 Input operation part 8 Card handling part 10 Passbook handling part 12 Banknote depositing / withdrawing part 14 Coin depositing / withdrawing Kanbe

Claims (1)

A password receiving means for receiving the password,
Collation result obtaining means for obtaining a collation result between the received personal identification number and the registered personal identification number from the host device;
A mismatch number storage means for storing the number of mismatches of matching results in one transaction,
When the obtained collation result is a match, the number of mismatches stored in the mismatch number storage means is read. When the number of mismatches read is 0 , the identity verification by the collation of the personal identification number is terminated and the process proceeds to the next process. The identity verification device is controlled so as to obtain the input of the personal identification number again when the number of mismatches is one or more.