JP7552385B2 - Electronic information storage medium and payment processing method - Google Patents

Description

The present invention relates to technical fields such as a payment processing method executed by a payment terminal installed outside a vehicle, a control device mounted on the vehicle, and a secure element mounted on the vehicle.

Conventionally, there is known a technology that uses a vehicle as a payment means to complete a payment transaction. For example, Patent Document 1 discloses a system in which, when a vehicle-equipped Vehicle Interface Device (VID) receives a request for payment account information from a merchant access device, the system determines whether or not a user's mobile communication device is in the vehicle, and if it determines that the mobile communication device is in the vehicle, transmits payment account information read from a payment card (e.g., a credit card) inserted in the VID to the merchant access device. With this system, when a VID, a vehicle equipped with the VID, and a mobile communication device are present, the user does not need to re-enter payment account information, etc. for each transaction to achieve three-factor security in addition to simply owning the three combined devices.

JP 2020-053066 A

However, the system disclosed in Patent Document 1 uses a payment card inserted into the VID installed in the vehicle for payment, and does not allow payments to be made to the vehicle, which causes problems in terms of convenience. In addition, the system disclosed in Patent Document 1 does not perform authentication processing using an encryption key, which causes problems in terms of security.

The present invention has been made in consideration of the above points, and aims to provide an electronic information storage medium and a payment processing method that can improve the convenience and security of users of mobile objects such as vehicles in payment transactions.

In order to solve the above problem, the present invention provides an electronic information storage medium that is mounted on a mobile body that a user can board and that includes a memory that stores an encryption key specific to the mobile body and payment data used for payment, the electronic information storage medium including an interface unit that is mounted on the mobile body and is connected to a control device having a short-range wireless communication function, authentication processing means that, when the control device comes within a range in which short-range wireless communication is possible with a payment terminal installed outside the mobile body, executes mutual authentication processing for establishing a secure session with the payment terminal via the control device using an encryption key specific to the mobile body and an encryption key specific to the payment terminal, and a session key generated in the mutual authentication processing and connected to the payment terminal. and a transmission means for, when a payment command encrypted with a session key common between the control device and the payment terminal is received via the control device, reading the payment data from the memory in response to the payment command and transmitting a response including the read payment data to the payment terminal via the control device; and , when the payment command is received via the control device, querying the control device through the control device to query the user as to whether or not to permit payment, wherein the transmission means transmits the response including the payment data to the payment terminal via the control device only if the user gives an instruction to permit the payment in response to the query .

The invention described in claim 2 is a payment processing method executed by a payment terminal installed outside a mobile body that a user can board and having a short-range wireless communication function, a control device mounted on the mobile body and having a short-range wireless communication function, and an electronic information storage medium mounted on the mobile body and having a memory for storing an encryption key unique to the mobile body and payment data used for payment, the method including the steps of: when the control device comes within a range in which short-range wireless communication with the payment terminal is possible, performing mutual authentication processing between the payment terminal and the electronic information storage medium via the control device using an encryption key unique to the mobile body and an encryption key unique to the payment terminal to establish a secure session; and when the control device comes within a range in which short-range wireless communication with the payment terminal is possible, performing mutual authentication processing between the payment terminal and the electronic information storage medium using a session key generated in the mutual authentication processing and a storage key stored in the electronic information storage medium. the step of transmitting a payment command encrypted with a session key common between the control device and the electronic information storage medium via the control device; and a transmission step of, when the electronic information storage medium receives the payment command, reading the payment data from the memory in response to the payment command and transmitting a response including the read payment data to the payment terminal via the control device, wherein in the transmission step, the electronic information storage medium inquires of the control device as to whether or not to permit the payment, and only if information indicating permission for the payment is received from the control device in response to the inquiry, the electronic information storage medium transmits a response including the payment data to the payment terminal via the control device .

The invention described in claim 3 is characterized in that, in the payment processing method described in claim 2 , it further includes a step in which the control device asks the user for an instruction as to whether or not to allow the payment in response to the inquiry from the electronic information storage medium, and a step in which the control device requests the payment data from the electronic information storage medium when the control device receives an instruction from the user to allow the payment.

The present invention can improve the convenience and security of users of moving objects such as vehicles during payment transactions.

1 is a diagram illustrating an example of a schematic configuration of a payment processing system S according to an embodiment of the present invention. 1 is a diagram showing an example of a schematic configuration of a payment terminal 1. FIG. FIG. 2 is a diagram illustrating an example of a schematic configuration of an ECU 2. A diagram showing an example of the schematic configuration of eSE3. 1 is a sequence diagram showing an example of a transaction carried out before a secure session is started in a payment processing system S. FIG. 1 is a conceptual diagram showing the positional relationship between a wireless communication unit 11 embedded in the ground of a pay-by-the-hour parking lot and a vehicle C. 1 is a sequence diagram showing an example of a transaction carried out after a secure session is started in a payment processing system S. FIG.

Below, an embodiment of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment in which the present invention is applied to a payment processing system capable of performing payments to a vehicle using an eSE (embedded secure element). The eSE is mounted in a vehicle so as not to be removable. Mounted in a vehicle so as not to be removable means that the eSE is fixed in the vehicle so that it cannot be easily removed from the vehicle. There is no particular limitation on the method of fixing the eSE in the vehicle, but one example is soldering it to a circuit board or the like in the vehicle. A vehicle is an example of a moving body that a user can ride in, such as a two-wheeled vehicle, a four-wheeled vehicle, or a bicycle.

[1. Overview of the payment processing system S]
First, a schematic configuration of a payment processing system S according to the present embodiment will be described with reference to FIG. 1 and the like. FIG. 1 is a diagram showing a schematic configuration example of the payment processing system S according to the present embodiment. As shown in FIG. 1, the payment processing system S includes a payment terminal 1, an ECU (Electronic Control Unit) 2, and an eSE 3. The payment terminal 1 and the ECU (Electronic Control Unit) 2 are capable of short-distance wireless communication using, for example, NFC (Near field communication), Bluetooth (registered trademark), or UWB (Ultra Wide Band) technology. The payment processing system S may be provided with a management server that manages information on users and the like registered as members who use the system. Here, the user is a user of a vehicle C (for example, an owner of the vehicle C).

The payment terminal 1 is installed at locations such as stores with drive-through facilities, parking lots, gas stations, and toll booths on expressways, and is a terminal that performs payment processing for the payment of fees when a user purchases a product or receives a service. Such locations are outside the vehicle C, and are vehicle visit locations that the vehicle C can visit while traveling. Payment methods used in the payment processing include, but are not limited to, electronic money payment and credit card payment. When the payment method is credit card payment, the payment terminal 1 may access a management server that manages credit card information via a network (not shown) to make a credit inquiry.

2 is a diagram showing an example of the schematic configuration of the payment terminal 1. As shown in FIG. 2, the payment terminal 1 is configured to include a wireless communication unit 11, a storage unit 12, and a control unit 13. The wireless communication unit 11 is a wireless communication device (e.g., a reader/writer) that has an antenna and performs contactless communication using NFC, Bluetooth, or UWB technology, and performs wireless communication with a communication partner (e.g., ECU 2) within a range where short-distance wireless communication is possible. In particular, when UWB technology is used, the wireless communication unit 11 periodically checks (confirms the position) whether a communication partner exists within a preset distance range, and performs wireless communication with a communication partner that is confirmed to exist within the distance range. Note that the wireless communication device may be embedded in the ground through which the vehicle C passes, for example, outside the housing in which the storage unit 12 and the control unit 13 of the payment terminal 1 are mounted.

The storage unit 12 stores an operating system (OS) and applications. The applications include a mutual authentication processing program and a payment processing program. Furthermore, the storage unit 12 stores a key pair (encryption key) of a public key and a private key that is unique to the payment terminal 1. Here, the public key included in the key pair and a key ID for identifying the public key are shared in advance with the eSE 3. The public key and key ID may be linked to the terminal information of the payment terminal 1 and managed by the management server. As a result, the public key and key ID unique to the payment terminal 1 are provided to the eSE 3 via the ECU 2 installed in the vehicle C of each of multiple users registered as members.

The control unit 13 is configured with a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), etc. The control unit 13 executes a mutual authentication process for establishing a secure session with the eSE3 via the ECU2 according to a mutual authentication process program. In this mutual authentication process, a private key unique to the payment terminal 1 and a public key unique to the eSE3 (in other words, a public key unique to the vehicle C) are used, and mutual authentication is performed by key exchange using ECDH (Elliptic curve Diffie-Hellman key exchange) and signature generation and signature verification using ECDSA (Elliptic Curve Digital Signature Algorithm). After establishing a secure session with the eSE3, the control unit 13 transmits a payment command encrypted with a session key common to the payment terminal 1 and generated in the mutual authentication process to the eSE3 via the ECU2 according to the payment process program. Then, when a response to the payment command is received from the eSE 3 via the ECU 2, the control unit 13 executes the payment process for fee payment.

The ECU 2 is a control device mounted on the vehicle C and controls the vehicle C. The ECU 2 is mounted, for example, inside a center console. FIG. 3 is a diagram showing an example of a schematic configuration of the ECU 2. As shown in FIG. 3, the ECU 2 is configured to include a wireless communication unit 21, an interface (I/F) unit 22, a storage unit 23, and a control unit 24. The wireless communication unit 21 is a wireless communication device that has an antenna and performs contactless communication using NFC, Bluetooth, or UWB technology, and performs wireless communication with a communication partner (for example, a payment terminal 1) within a range where short-distance wireless communication is possible. The interface unit 22 serves as an interface with the eSE 3 and is electrically connected to the eSE 3. Examples of the interface include an SPI (Serial Peripheral Interface), an I ² C (Inter-Integrated Circuit), and an ISO 7816 interface.

The memory unit 23 stores an operating system and applications. The applications include a vehicle control program and a data relay program. The control unit 24 is configured with a CPU, RAM, ROM, etc. If a multimedia terminal such as a display is provided on the console of the vehicle C, the multimedia terminal is electrically connected to the control unit 24 via an interface unit (not shown). The control unit 24 controls the electrical system related to unlocking the doors of the vehicle C and starting the engine, etc., according to the vehicle control program. The control unit 24 also relays data exchanged between the payment terminal 1 and the eSE 3 according to the data relay program. Protocol conversion of the data may be performed during such relaying.

The eSE3 is a secure element such as an eUICC (embedded Universal Integrated Circuit Card) having high tamper resistance, which is mounted unremovably, for example, inside the center console or inside the door of the vehicle C by soldering or the like. The eSE is an example of an electronic information storage medium of the present invention. FIG. 4 is a diagram showing an example of a schematic configuration of the eSE3. As shown in FIG. 4, the eSE3 is configured with an interface (I/F) unit 31, a RAM 32, a NVM (Nonvolatile Memory) 33, a CPU 34, and the like. The interface unit 31 serves as an interface with the ECU 2, and is electrically connected to the ECU 2. The NVM 33 stores an operating system and applications. The applications include a mutual authentication processing program and a payment processing program.

NVM33 also stores payment data. The payment data is, for example, a payment ID (identification information) unique to vehicle C. The payment ID may be linked to the user's payment information and managed by a management server. The payment information includes information necessary for payment according to the payment method. For example, if the payment method is credit card payment, the payment information includes data such as the credit card number, the cardholder's name, and expiration date required for credit card payment. If the payment method is electronic money payment, the payment information includes data such as the electronic money number and electronic value required for electronic money payment. Note that NVM33 may include the payment information as payment data instead of (or in addition to) the payment ID.

Furthermore, a key pair (encryption key) of a public key and a private key unique to vehicle C is stored in NVM33 in association with the payment data. Here, the public key included in the key pair and a key ID for identifying the public key are shared in advance with payment terminal 1. The public key and key ID may be linked to the payment ID and payment information of each of multiple users registered as members and managed by the management server. As a result, the public key and key ID unique to eSE3 are provided to payment terminal 1. Furthermore, the payment information is provided to payment terminal 1 using the payment ID as a key.

The CPU 34 is an example of the authentication processing means, transmission means, and inquiry means of the present invention. The CPU 34 executes mutual authentication processing for establishing a secure session (encrypted communication path) with the payment terminal 1 via the interface unit 31 and the ECU 2 in accordance with a mutual authentication processing program. In this mutual authentication processing, a private key unique to the eSE 3 (in other words, a private key unique to the vehicle C) and a public key unique to the payment terminal 1 are used, and mutual authentication is performed by key exchange using ECDH, and signature generation and signature verification using ECDSA.

Furthermore, after a secure session is established with the payment terminal 1, when the CPU 34 receives a payment command from the payment terminal 1 via the ECU 2, the CPU 34 reads payment data from the NVM 33 in response to the payment command in accordance with the payment processing program, and transmits a response including the read payment data to the payment terminal 1 via the interface unit 31 and the ECU 2. When a payment command is received from the payment terminal 1 via the ECU 2, the CPU 34 may inquire of the user via the ECU 2 as to whether or not to permit the payment. In this case, the CPU 34 may transmit a response including the payment data to the payment terminal 1 via the interface unit 31 and the ECU 2 only if the user gives an instruction to permit the payment in response to the inquiry.

2. Operation of payment processing system S
Next, the operation of the payment processing system S will be described with reference to Figures 5 to 7. Figure 5 is a sequence diagram showing an example of a transaction carried out in the payment processing system S before the start of a secure session. Figure 6 is a conceptual diagram showing the positional relationship between the wireless communication unit 11 embedded in the ground of a pay-by-the-hour parking lot and the vehicle C. Figure 7 is a sequence diagram showing an example of a transaction carried out in the payment processing system S after the start of a secure session.

5, the wireless communication unit 11 of the payment terminal 1 actively transmits radio waves D as shown in FIG. 6(A) and periodically checks whether a communication partner is present within a preset distance range H. In the example of FIG. 6(A), the vehicle C carrying the ECU 2 is not within the distance range H, so the presence of the ECU 2 in the distance range H is not confirmed (detected) (standby state). On the other hand, in the example of FIG. 6(B), the vehicle C carrying the ECU 2 enters the distance range H, so that the presence of the ECU 2 in the distance range H is confirmed (communication starts). In other words, the fact that the vehicle C has entered the distance range H indicates that the user has expressed an intention to make a payment. In the example of FIG. 6(B), the vehicle C is parked, but even when the vehicle C passes a predetermined position as in ETC, the presence of the ECU 2 in the distance range H is confirmed, and as a result, communication may be started. Alternatively, the wireless communication unit 21 of the ECU 2 mounted on the vehicle C may actively transmit radio waves and periodically check whether a communication partner (i.e., the payment terminal 1) is present within a preset distance range.

As shown in FIG. 6(B), when the control unit 13 of the payment terminal 1 confirms that the ECU 2 is within the distance range H (step S1), it starts wireless communication with the ECU 2 (step S2) and transmits a SELECT command to select an application (payment processing program) for performing the payment process to the ECU 2 via the wireless communication unit 11 (step S3). Next, when the control unit 24 of the ECU 2 receives the SELECT command from the payment terminal 1 via the wireless communication unit 21, it performs protocol conversion and transmits the protocol-converted SELECT command (command APDU (Application Protocol Data Unit)) to the eSE 3 via the interface unit 22 (step S4).

Next, when the CPU 34 of the eSE 3 receives the SELECT command from the ECU 2 via the interface unit 31, it selects an application (payment processing program) in response to the SELECT command (step S5), and transmits a response to the SELECT command (response APDU) to the ECU 2 via the interface unit 31 (step S6). The response includes, for example, SW (Status Word) "9000" and FCI (File Control Information) in TLV format. Next, when the control unit 24 of the ECU 2 receives the response from the eSE 3 via the interface unit 22, it performs protocol conversion and transmits the protocol-converted response to the payment terminal 1 via the wireless communication unit 21 (step S7).

Next, when the control unit 13 of the payment terminal 1 receives the response from the ECU 2 via the wireless communication unit 11, it generates a key pair of a temporary public key and a private key (step S8). Here, the temporary public key is called a temporary public key and is distinguished from a public key that is shared and managed in advance. Similarly, the temporary private key is called a temporary private key and is distinguished from a private key that is shared and managed in advance. The temporary public key is generated by ECDH calculation based on a previously generated temporary private key (e.g., a random numerical value) and a point on an elliptic curve according to the ECDH protocol. In the ECDH calculation, for example, a temporary public key is generated from a temporary private key by performing a scalar multiplication to calculate a k-fold point kp of a point p on an elliptic curve. The parameters of the elliptic curve are known between the payment terminal 1 and the eSE 3.

Next, the control unit 13 of the payment terminal 1 transmits an AUTH0 command including the temporary public key generated in step S8 to the ECU 2 via the wireless communication unit 11 (step S9). The AUTH0 command is a command for exchanging temporary public keys for ECDH and generating a session key for encrypted communication. Next, when the control unit 24 of the ECU 2 receives the AUTH0 command from the payment terminal 1 via the wireless communication unit 21, it performs protocol conversion and transmits the protocol-converted AUTH0 command to the eSE 3 via the interface unit 22 (step S10).

Next, when the CPU 34 of the eSE3 receives the AUTH0 command from the ECU2 via the interface unit 31, it generates a key pair of a temporary public key and a temporary private key unique to the eSE3 (step S11). Next, the CPU 34 of the eSE3 generates a shared key by ECDH calculation based on the temporary public key (the temporary public key unique to the payment terminal 1) included in the received AUTH0 command and the temporary private key (the temporary private key unique to the eSE3) generated in step S11 (step S12). Next, the CPU 34 of the eSE3 generates a session key to be used for a secure session between the payment terminal 1 and the eSE3 based on the data obtained during the ECDH calculation in step S12 (step S13). Note that the session key may be generated using the shared key generated in step S12.

Next, the CPU 34 of the eSE3 transmits a response to the AUTH0 command to the ECU 2 via the interface unit 31 (step S14). This response includes the temporary public key unique to the eSE 3, which was generated in step S11. Next, when the control unit 24 of the ECU 2 receives the response from the eSE 3 via the interface unit 22, it performs protocol conversion and transmits the protocol-converted response to the payment terminal 1 via the wireless communication unit 21 (step S15).

Next, when the control unit 13 of the payment terminal 1 receives the response from the ECU 2 via the wireless communication unit 11, it generates a shared key by ECDH calculation based on the temporary public key (temporary public key unique to the eSE 3) included in the response and the temporary private key (temporary private key unique to the payment terminal 1) generated in step S8 (step S16). Next, the control unit 13 of the payment terminal 1 generates a terminal certificate by generating a signature using the private key unique to the payment terminal 1 according to ECDSA (step S17).

Then, the control unit 13 of the payment terminal 1 transmits an AUTH1 command including the terminal certificate generated in step S17 and a key ID for identifying a public key unique to the payment terminal 1 to the ECU 2 via the wireless communication unit 11 (step S18). The AUTH1 command is a command for exchanging digital signatures for ECDSA and performing mutual authentication. Next, when the control unit 24 of the ECU 2 receives the AUTH1 command from the payment terminal 1 via the wireless communication unit 21, it performs protocol conversion and transmits the protocol-converted AUTH1 command to the eSE 3 via the interface unit 22 (step S19).

Next, when the CPU 34 of the eSE3 receives the AUTH1 command from the ECU 2 via the interface unit 31, it identifies a public key unique to the payment terminal 1 based on the key ID included in the AUTH1 command, and performs signature verification of the terminal certificate included in the AUTH1 command using the identified public key according to ECDSA (step S20). If the signature verification is successful, the CPU 34 of the eSE3 generates an SE certificate by generating a signature using a private key unique to the eSE3 according to ECDSA (step S21).

Next, the CPU 34 of the eSE3 transmits a response to the AUTH1 command to the ECU 2 via the interface unit 31 (step S22). This response includes the SE certificate generated in step S21 and a key ID for identifying a public key unique to the eSE3. Next, when the control unit 24 of the ECU 2 receives the response from the eSE3 via the interface unit 22, it performs protocol conversion and transmits the protocol-converted response to the payment terminal 1 via the wireless communication unit 21 (step S23).

Next, when the control unit 13 of the payment terminal 1 receives the response from the ECU 2 via the wireless communication unit 11, it identifies a public key unique to the eSE 3 based on the key ID included in the response, and performs signature verification of the SE certificate included in the response using the identified public key according to ECDSA (step S24). If the signature verification is successful, the control unit 13 of the payment terminal 1 generates a session key to be used for the secure session between the payment terminal 1 and the eSE 3 based on the data obtained during the ECDH calculation in step S16 (step S25). The session key may be generated using the shared key generated in step S16. The session key generated here is generated using the same generation method as the session key generated in step S13, so the two will match.

In FIG. 7, the control unit 13 of the payment terminal 1 starts a secure session with the eSE 3 using the session key generated in step S25 (step S26). In this secure session, data (command or response) encrypted with the session key generated above is transmitted and received. That is, the control unit 13 of the payment terminal 1 transmits a payment command (EXCHANGE command) indicating a request to obtain payment data, which is encrypted with the session key, to the ECU 2 via the wireless communication unit 11 (step S27). Next, when the control unit 24 of the ECU 2 receives the payment command from the payment terminal 1 via the wireless communication unit 21, it converts the protocol and transmits the protocol-converted payment command to the eSE 3 via the interface unit 22 (step S28).

Next, when the CPU 34 of the eSE 3 receives a payment command from the ECU 2 via the interface unit 31, it transmits a response including data indicating an inquiry as to whether or not the payment is permitted to the ECU 2 via the interface unit 31 (step S29). Next, when the control unit 24 of the ECU 2 receives a response from the eSE 3 via the interface unit 22, it causes the multimedia terminal to display, for example, a button indicating that the payment is permitted (or a button indicating that the payment is not permitted) (step S30). This prompts the user to indicate whether or not to permit the payment in response to the inquiry from the eSE 3.

If there is no multimedia terminal on the console of vehicle C, the control unit 24 of ECU 2 may be configured to display a button indicating that payment is permitted (or a button indicating that payment is not permitted) on a user terminal (e.g., a smartphone) that has been previously paired with ECU 2 via Bluetooth (registered trademark) or the like, thereby requesting the user to indicate whether or not to permit payment. Alternatively, the control unit 24 of ECU 2 may be configured to transmit information requesting an instruction as to whether or not to permit payment to a management server, so that the management server may display a button indicating that payment is permitted (or a button indicating that payment is not permitted) on the user terminal.

When the control unit 24 of the ECU 2 receives an instruction to permit payment from the user by pressing a button indicating that payment is permitted (step S31), the control unit 24 transmits a request command (e.g., a GET command) indicating a request for payment data to the eSE 3 via the interface unit 22 (step S32). Next, when the CPU 34 of the eSE 3 receives the request command from the ECU 2 via the interface unit 31, the CPU 34 reads the payment data from the NVM 33 using the application (payment processing program) selected in step S5 (step S33), and transmits a response including the read payment data to the ECU 2 via the interface unit 31 (step S34).

Next, when the control unit 24 of the ECU 2 receives the response from the eSE 3 via the interface unit 22, it converts the protocol and transmits the protocol-converted response to the payment terminal 1 via the wireless communication unit 21 (step S35). As a result, according to the example shown in FIG. 5, a response including payment data is transmitted to the payment terminal 1 only if the user instructs to permit payment in response to the inquiry.

Next, when the control unit 13 of the payment terminal 1 receives a response from the ECU 2 via the wireless communication unit 11, it executes a payment process for paying the fee based on the payment data included in the response (step S36). For example, the control unit 13 of the payment terminal 1 acquires payment information based on the payment data, and executes a process of charging (e.g., debiting) the parking fee to the user using the payment method indicated in the payment information. Note that if the payment data is a payment ID, the control unit 13 of the payment terminal 1 may acquire the user's payment information from the management server using the payment ID as a key.

As described above, according to the above embodiment, when the ECU 2 enters the range for short-distance wireless communication with the payment terminal 1, a mutual authentication process for establishing a secure session is executed between the payment terminal 1 and eSE 3 via the ECU 2 using an encryption key specific to the vehicle C and an encryption key specific to the payment terminal 1, and the payment terminal 1 transmits a payment command encrypted with the session key generated in the mutual authentication process to the eSE 3 via the ECU 2. When the eSE 3 receives the payment command, it reads payment data from the NVM 33 in accordance with the payment command and transmits a response including the read payment data to the payment terminal 1 via the ECU 2, thereby improving the convenience and security for the user of vehicle C in payment transactions. For example, in the past, a user would prepare an ETC card created in his or her own name and insert it into a dedicated terminal in the vehicle to make payments. In this embodiment, however, it is possible to make payments to vehicle C by using eSE3 that is permanently installed in vehicle C, and it is also possible to improve security by using an encryption key unique to eSE3 (in other words, an encryption key unique to vehicle C).

1 Payment terminal 2 ECU
3 eSE
11 Wireless communication unit 12 Storage unit 13 Control unit 21 Wireless communication unit 22 Interface unit 23 Storage unit 24 Control unit 31 Interface unit 32 RAM
33 NVM
34 CPU
S Payment processing system

Claims (3)

An electronic information storage medium that is mounted on a moving body that a user can board and has a memory that stores an encryption key unique to the moving body and payment data used for payment,
an interface unit that is mounted on the moving object and is connected to a control device having a short-range wireless communication function;
an authentication processing means for performing a mutual authentication process for establishing a secure session between the control device and a payment terminal installed outside the mobile object, using an encryption key unique to the mobile object and an encryption key unique to the payment terminal, when the control device comes within a range where short-distance wireless communication with the payment terminal is possible, via the control device;
a transmission means for, when a payment command encrypted with a session key generated in the mutual authentication process and common to the payment terminal is received via the control device, reading out the payment data from the memory in response to the payment command, and transmitting a response including the read payment data to the payment terminal via the control device;
an inquiry means for inquiring of the user through the control device whether or not to permit the payment when the payment command is received via the control device;
Equipped with
The electronic information storage medium is characterized in that the transmission means transmits a response including the payment data to the payment terminal via the control device only if the user gives an instruction to allow the payment in response to the inquiry . A payment terminal installed outside a mobile body that a user can board and having a short-range wireless communication function;
A payment processing method executed by a control device mounted on the mobile body and having a short-range wireless communication function, and an electronic information storage medium mounted on the mobile body and having a memory for storing an encryption key unique to the mobile body and payment data used for payment, comprising:
When the control device comes within a range where short-distance wireless communication with the payment terminal is possible, a mutual authentication process for establishing a secure session is executed between the payment terminal and the electronic information storage medium via the control device using an encryption key unique to the mobile object and an encryption key unique to the payment terminal;
a step of transmitting, via the control device, to the electronic information storage medium, a payment command encrypted by the payment terminal using a session key generated in the mutual authentication process and common between the payment terminal and the electronic information storage medium;
a transmission step of, when the electronic information storage medium receives the payment command, reading the payment data from the memory in response to the payment command, and transmitting a response including the read payment data to the payment terminal via the control device;
Including,
A payment processing method characterized in that, in the transmission step, the electronic information storage medium inquires of the control device as to whether or not the payment is permitted, and only if information indicating that the payment is permitted is received from the control device in response to the inquiry, the electronic information storage medium transmits a response including the payment data to the payment terminal via the control device . the control device prompting the user to indicate whether or not to permit the payment in response to the inquiry from the electronic information storage medium;
a step of requesting the payment data from the electronic information storage medium when the control device receives an instruction to permit the payment from the user;
The payment processing method according to claim 2 , further comprising:

Images