JP7652729B2 - PROGRAM, AUTHENTICATION SYSTEM AND INFORMATION PROCESSING METHOD - Google Patents

Description

The present invention relates to a program, an authentication system, and an information processing method.

In cashless payments using payment methods such as bank transfers, credit card payments, and electronic money payments, user authentication techniques are known for using accounts for these payment methods (hereinafter also referred to as "payment accounts").

As a user authentication technology such as the above, for example, 3D Secure is known for credit card payments. Furthermore, the following Patent Document 1 discloses an authentication service method executed by a system including an OTP (One Time Password) token, a user terminal, a dedicated site for an online shop, and an authentication server. In this authentication service method, the dedicated site sends a request for user authentication of a credit card identified by a card number to the authentication server. When the authentication server receives this request, it generates challenge data and sends it to the terminal. When the user inputs the challenge data sent to this terminal into the OTP token, a one-time password is generated. The user inputs this one-time password into the terminal, and the one-time password is sent from the terminal to the authentication server, and the authentication server performs user authentication based on this one-time password.

JP 2011-164821 A

Here, when making a payment for a transaction in a service, even if an account for the service (hereinafter also referred to as a "service account") and a payment account are separately set up, there is a demand for providing a seamless UI for the user in user authentication of the payment account while ensuring information security. However, in the authentication service method of 3D Secure and Patent Document 1, when making a payment for a transaction in a service, in order to authenticate the user of the payment account, an authentication site is provided to the user, which is provided by a server of a payment business operator such as an issuer that provides a payment method or an authentication server, separate from the service site that the user has used up to that point. Then, the user needs to input authentication information such as a password into the provided site. For this reason, when the user makes a payment for a transaction in a service, the UI is not seamless in the series of steps from using the service to settling the transaction, and there is room for improvement.

To solve the above problem, the present invention aims to provide users with a seamless UI while ensuring information security by authenticating users of a payment account separate from the service account when making payments for transactions in services.

A program according to one aspect of the present invention causes a computer to realize an acquisition function for acquiring service authentication success/failure information indicating the success/failure of user authentication for a service account of a user for a service for which a payment means provided by a payment service provider is available; a payment authentication acceptance function for accepting, based on the service authentication success/failure information, a payment authentication request corresponding to the payment request from a service provider device of the service that has accepted a payment request for a transaction by the user using the payment means, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account; a payment authentication function for, when the payment authentication request is accepted, performing processing for user authentication based on the payment authentication request and the payment account information by referencing a payment storage unit that stores payment account information including the payment account identification information; and a transmission function for transmitting payment authentication success/failure information indicating the success/failure of user authentication of the payment account to the service provider device based on the result of the processing.

The authentication system according to one aspect of the present invention includes an acquisition unit that acquires service authentication success/failure information indicating the success/failure of user authentication of a service account of a user for a service for which a payment means provided by a payment service provider is available; a payment authentication reception unit that receives, from a service provider device of the service that has received a payment request for a transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means and payment authentication information for performing user authentication of the payment account, based on the service authentication success/failure information; a payment authentication unit that, when the payment authentication request is received, performs processing for the user authentication based on the payment authentication request and the payment account information, by referring to a payment storage unit that stores payment account information including the payment account identification information; and a transmission unit that transmits payment authentication success/failure information indicating the success/failure of user authentication of the payment account to the service provider device based on the result of the processing.

In an information processing method according to one aspect of the present invention, a computer acquires service authentication success/failure information indicating the success/failure of user authentication for a service account of a user for a service for which a payment means provided by a payment service provider is available, and accepts, from a service provider device of the service that has accepted a payment request for a transaction by the user using the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, based on the service authentication success/failure information; when the payment authentication request is accepted, the computer refers to a payment storage unit that stores payment account information including the payment account identification information, performs processing for the user authentication based on the payment authentication request and the payment account information, and transmits payment authentication success/failure information indicating the success/failure of user authentication of the payment account to the service provider device based on the result of the processing.

According to the present invention, when making payments for transactions in a service, it is possible to provide a seamless UI to the user while ensuring information security by authenticating the user to a payment account separate from the service account.

FIG. 1 is a diagram for explaining an example of a system configuration of an authentication system according to an embodiment of the present invention. FIG. 1 is a diagram for explaining an example of an overview of an authentication system according to an embodiment of the present invention. FIG. 1 is a diagram for explaining an example of an overview of an authentication system according to an embodiment of the present invention. FIG. 1 is a diagram for explaining an example of an overview of an authentication system according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a functional configuration of a server device according to the present embodiment. FIG. 2 is a diagram illustrating an example of the operation of the authentication system according to the present embodiment. FIG. 2 is a diagram illustrating an example of a hardware configuration of a server device according to the present embodiment.

A preferred embodiment of the present invention (hereinafter, also referred to as "the present embodiment") will be described with reference to the attached drawings. Note that in each drawing, parts with the same reference numerals have the same or similar configurations.

In this invention, "part", "means", "device", and "system" do not simply mean physical means, but also include cases where the functions of the "part", "means", "device", and "system" are realized by software. Furthermore, the functions of one "part", "means", "device", or "system" may be realized by two or more physical means or devices, and the functions of two or more "parts", "means", "device", or "system" may be realized by one physical means or device.

The program of this embodiment can be installed or downloaded to a computer through various storage media such as optical disks such as CD-ROMs, magnetic disks, and semiconductor memories, or by downloading via a communications network (network N), etc.

The authentication system 1 according to this embodiment is a system for providing a seamless UI to users by performing user authentication all at once when using services and making payments for transactions that use payment methods provided by a payment service provider. In this embodiment, an example is described in which the payment method used for this service is credit card payment, but this is not intended to limit the payment method according to the present invention. The payment method according to the present invention may be any method of online payment, such as electronic money payment, carrier payment, debit card payment, etc.

In this embodiment, services in which the payment means according to the present invention can be used will be described using VR commerce, which is one of the models of EC sites, as an example, as described below, but this is not intended to be limiting. Services in which the payment means according to the present invention can be used may be, for example, services that use other EC site models (such as general shopping mall-type or single-store websites), or services in physical stores that use face-to-face online payments with users (such as biometric authentication of users in stores or electronic payments using NFC tags).

1. System configuration
An example of the system configuration of an authentication system 1 according to this embodiment will be described with reference to FIG.

As shown in FIG. 1, authentication system 1 includes a server device 100, an affiliated store server 200, an issuer server 300, a user device 400, and an international brand server 500. Server device 100 is communicatively connected to affiliated store server 200, issuer server 300, and international brand server 500 via network N to perform all or part of user authentication for services provided by affiliated stores and for payment methods provided by issuers. Affiliated store server 200 is communicatively connected to user device 400 via network N.

The network N is composed of a wireless network and a wired network. Examples of networks include a mobile phone network, a PHS (Personal Handy-phone System) network, a wireless LAN (Local Area Network), 3G (3rd Generation), LTE (Long Term Evolution), 4G (4th Generation), 5G (5th Generation), WiMax (registered trademark), infrared communication, Bluetooth (registered trademark), a wired LAN, a telephone line, a power line network, and a network conforming to IEEE 1394, etc.

[Server device]
The server device 100 is an information processing device capable of communicating with the affiliated store server 200 and the issuer server 300. In this embodiment, the server device 100 is, for example, a device used by a business that provides a wallet service to affiliated stores (hereinafter also referred to as a "wallet business operator"). A wallet service is a service that provides a wallet function that can be used online. Specifically, the wallet service is a service that provides a user with an aggregated form of a plurality of payment methods that can be used by the user by registering the plurality of payment methods. The server device 100 manages a plurality of payment method information related to each of a plurality of payment methods of a transaction by executing a predetermined program, receives authentication requests for various user authentications from the affiliated store server 200, etc., and executes a process for user authentication in cooperation with the issuer server 300, etc.

"Payment method information" is information related to a payment method. Payment method information includes, for example, type information indicating the type of payment method (e.g., credit card payment, debit card payment, electronic money payment, etc.), payment method identification information for identifying the payment method (e.g., card number, account number, etc.), payment business operator identification information providing the payment method, user identification information of the user who uses the payment method, security information for the security of the payment method, etc. In addition, payment method information may be stored in the payment storage unit 132 in association with payment account information for the same user and the same payment method.

"Payment account information" is information related to a payment account. Payment account information may include, for example, payment account identification information (e.g., ID, card number, etc.) for identifying the user's payment account, and payment method information for the corresponding payment method. For example, when authentication is performed on the device itself in the user authentication of the payment account described below (case 2-4a), payment account information may include, for example, the password of the payment account as payment authentication information. Furthermore, payment account information and service account information described below are collectively referred to as "account information."

For example, if the payment method is credit card payment, the payment method information may include the card number as payment method identification information, the cardholder's name as user information of the user using the payment method, and the expiration date and security code as security information.

"User information" is information about a user. User information may include, for example, user identification information for identifying the user, service account identification information, payment account identification information, personal information of the user such as name, telephone number, address, email address, personal identification number, gender, date of birth, etc. User information may also include, for example, biometric information related to the biometric characteristics of the user (for example, facial image data, fingerprint information, iris information, or voiceprint information of the user, etc.).

[Member store server]
The affiliated store server 200 is a server used by an affiliated store (hereinafter, simply referred to as an "affiliated store") of the credit card used by the user, and is an information processing device for providing various services that allow the user to make credit card payments. In this embodiment, a service (so-called VR commerce) in which an affiliated store provides a virtual store of an EC site to users using VR technology will be described as an example. The affiliated store is one aspect of a service provider, and the affiliated store server 200 is one aspect of a service provider device of the service provider. The service provider according to this embodiment is not limited to the affiliated store, and may be a payment agency such as a PSP (Payment Service Provider) or a PF (Payment Facilitator) that provides an agency service related to payments to the affiliated store.

[Issuer Server]
The issuer server 300 is a server used by an issuer of a credit card used by a user, and is an information processing device for providing a credit card payment function. The issuer is one aspect of a payment service provider, and the issuer server 300 is one aspect of a payment service provider device of the payment service provider. The issuer server 300 may include, for example, an authentication issuer server 300a (e.g., a server providing a 3D Secure function, etc.) and an authorization issuer server 300b.

[International Brand Server]
The credit card company's server 500 is a server used by a credit card company, and may be, for example, a directory server that uses information on a credit card used at an affiliated store to identify a target issuer server 300 and link it with the server device 100. The credit card company's server 500 may include, for example, an authentication brand server 500a (e.g., a server that provides a 3D Secure function) and an authorization brand server 500b.

＜2. Overview＞
An example of an overview of the authentication system 1 will be described with reference to FIGS.

Figure 2 is a diagram showing an overall view of authentication system 1. As shown in Figure 2, when credit card payment is used for a transaction such as purchasing a product at a virtual store on a VR site, multiple domains such as the affiliated store domain, issuer domain, or international brand domain work together to perform processing. In conventional technologies such as 3D Secure, user authentication for such credit card payments requires the user to interact with each of the affiliated store domain and issuer domain. Authentication system 1 reduces the amount of interaction between the user and each of these multiple domains, providing the user with a seamless UI (user interface).

<0. Service account registration and authentication scene>
(0-1) The user registers a new account for the affiliated store's VR commerce service (hereinafter also referred to as "service account") from the user device 400 to the wallet operator's server device 100. This service account may also serve as an account for the wallet service that the wallet operator provides to the user through the affiliated store. (0-2) When the user's service account is registered in the server device 100, the affiliated store server 200 performs user authentication (hereinafter also referred to as "service authentication") of the registered service account on behalf of the server device 100. At this time, communication between the server device 100 and the user device 400 may be performed via the affiliated store server 200. Hereinafter, it is assumed that the user has been successfully authenticated for this service account, that is, has logged in to the VR site. The server device 100 stores service authentication success/failure information indicating that the user authentication for the service account has been successful in the service storage unit 131.

"Service authentication success/failure information" is information indicating the success or failure of user authentication for a user's service account in a service that allows the use of a payment method (credit card payment) provided by a payment service provider (issuer). For example, service authentication success/failure information indicates "success" (hereinafter also referred to as "OK") for user authentication while the user is logged in to a VR site, and indicates "failure or authentication success has expired (hereinafter also referred to as "NG")" during logout or when authentication has failed.

<1. Payment account registration scene>
(1-1) When a user registers a new credit card payment account (hereinafter also referred to as a "payment account"), the user performs operational input of a payment account registration request (hereinafter also referred to as a "payment account registration request") on the screen of the VR site displayed on the user device 400. (1-2) When the user device 400 accepts this operational input, it transmits a payment account registration request to the affiliated store server 200 via the screen (web page) of the VR site. This payment account registration request may include, for example, payment account information. (1-3) The affiliated store server 200 accepts this transmitted payment account registration request and transmits it to the server device 100. (1-4) The server device 100 registers the user's payment account based on the payment account registration request accepted from the affiliated store server. Specifically, the server device 100 stores the user's payment account information in the payment storage unit 132.

<2. User authentication during payment and 3. Authorization>
(2-1) In this example, it is assumed that a user uses a credit card payment provided by an issuer when purchasing a product at a virtual store on a VR site. The user inputs a credit card payment request (hereinafter, simply referred to as a "payment request") using the payment account registered in 1 above on the product purchase screen of the VR site displayed on the user device 400. This payment request may include, for example, payment account identification information and payment authentication information for performing user authentication of the payment account. The payment authentication information is information for matching with the payment authentication information managed by the server device 100 or the issuer server 300. In user authentication, the payment authentication information is considered to be "correct," and if, for example, the payment authentication information input by the user from a screen or the like of the VR site matches the payment authentication information, authentication is determined to be "OK." Similarly, the service authentication information and service authentication information described later are considered to be "correct," and if the service authentication information matches the service authentication information, authentication is determined to be "OK."

(2-2) When the user device 400 accepts the above operation input, it sends a payment request to the affiliated store server 200 via the VR site screen. (2-3) The affiliated store server 200 accepts this sent payment request, includes the payment account identification information and payment authentication information contained in this payment request in a payment authentication request, and sends this payment authentication request to the server device 100. The payment authentication request requests user authentication of the payment account.

(2-4) If the service authentication success/failure information indicates "OK", that is, if the user authentication of the service account has been successful or the success of the user authentication is maintained, the server device 100 accepts the payment authentication request sent above.

(2-5) When the server device 100 receives a payment authentication request, it performs one of the following processes (2-5a) and (2-5b) to authenticate the user of the payment account: (2-5a) Executes user authentication on its own device (its own domain). Hereinafter, this process is also referred to as "payment authentication proxy." In the payment authentication proxy, OpenID Connect, DID (Decentralized Identifier)/VC (Verifiable Credentials), SSO (Single Sign On), and other technologies may be used as appropriate.
(2-5b) The server device 100 links the payment authentication information to the authentication issuer server 300a and executes user authentication in the issuer's domain. Note that during this linking, the server device 100 may link to the authentication issuer server 300a via the authentication brand server 500a. Hereinafter, this process is also referred to as "payment authentication linking." In the payment authentication linking, the 3D Secure function provided by the authentication issuer server 300a may be called from the server device 100 and used.

(2-6) The server device 100 generates payment authentication success/failure information as a result of the user authentication performed in (2-5) above, and transmits this payment authentication success/failure information to the affiliated store server 200.

"Payment authentication success/failure information" is information indicating the success or failure of user authentication for the user's payment account. Payment authentication success/failure information indicates whether user authentication was "successful or valid (hereinafter also referred to as "OK")" or "failed or invalid (hereinafter also referred to as "NG")."

(3) If the payment authentication success/failure information sent in (2-6) above indicates that user authentication is "OK," the affiliated store server 200 performs authorization for the credit card payment to the authorization issuer server 300b via the authorization brand server 500b. With the result of this authorization, the affiliated store server 200 and the authorization issuer server 300b execute processing for the credit card payment, such as sales processing and payment processing via the credit card payment.

Figure 3 is a diagram showing the flow of pre-registration of various information for using the authentication system 1. (0a) The affiliated store server 200 performs business registration for using the wallet service by having the service provider information registered. The service provider information may include, for example, business identification information (e.g., ID, business name, etc.) for identifying the service provider, interface information defining the interface between the server device 100 and the affiliated store server 200, information regarding the payment of the usage fee for the wallet service by the affiliated store, etc. (0b) The server device 100 performs business registration for cooperation with the payment provider by registering the payment provider information. The payment provider information may include, for example, payment identification information (e.g., ID, business name, etc.) for identifying the payment provider, interface information defining the interface between the server device 100 and the issuer server 300, etc. The interface information indicates, for example, a method selected by the affiliated store or issuer as a method of cooperation between the affiliated store server 200 or issuer server 300 and the server device 100 from among a method using an API, a method using scraping, or a method of providing an SDK (Software Development Kit) to the affiliated store or issuer. In other words, it is considered that the method of cooperation between the affiliated store server 200 or issuer server 300 and the server device 100 is appropriately selected from among these methods.

(1) The user device 400 sends a service account registration request or a payment account registration request (hereinafter collectively referred to as an "account registration request") to the affiliated store server 200 in order to register a new service account. This account registration request may include some or all of the account information. (2) The affiliated store server 200 sends the account registration request to the server device 100.

(3) <A1) Information Registration> When the reception unit 112 of the server device 100 receives an account registration request, it sends a request to obtain payment authentication information and service authentication information to the user device 400. The user device 400 presents this request to the user via the screen of the VR site. (4) When the user inputs payment authentication information and service authentication information on the screen of the VR site, the user device 400 responds to the server device 100 with the input authentication information.

(5) <A2) Service authentication> <A3) Payment authentication> The acquisition unit 111 of the server device 100 registers the authentication information acquired from the user device 400 in the memory unit 130 for payment authentication and service authentication.

(6a) <B2 authentication agency> When the issuer specifies payment authentication agency, the payment authentication unit 113a of the server device 100 manages the registered payment authentication information. (6b) <B3) Authentication federation> When the issuer specifies payment authentication federation, the payment authentication unit 113a of the server device 100 feeds the acquired payment authentication information to the issuer server. This feed-in may go via the international brand server 500 (directory server).

Figure 4 shows the flow of performing payment authentication for a transaction payment using authentication system 1. (1) As shown in Figure 4, the user device 400 sends a payment request for the payment of a VR commerce transaction to the affiliated store server 200. (2) When the affiliated store server 200 accepts the payment request, it sends a payment authentication request corresponding to this payment request to the server device 100.

(3) <A3) Payment authentication> The payment authentication reception unit 112a of the server device 100 acquires service authentication success/failure information indicating whether the service authentication by the service authentication unit 113b has been successful, and determines whether the service authentication is "OK" or not. If the payment authentication reception unit 112a determines that the service authentication is "OK", it accepts the payment authentication request sent above.

(4a) <B2) Authentication agency> In the case of payment authentication agency, the payment authentication unit 113a performs user authentication of the payment account. (4b) <B3) Authentication federation> In the case of payment authentication federation, the payment authentication unit 113a instructs the issuer server 300 to perform user authentication of the payment account and accepts a response of the result of the execution.

With the above configuration, when authenticating a user of a payment account separate from a service account in the payment of transactions in the VR commerce service or wallet service provided to the user, the authentication system 1 can communicate with the user through a VR site provided by the affiliated store, in the same manner as service authentication. For this reason, there is no need to provide the user with an authentication site provided by the issuer server 300 or the like, separate from the VR site that the user has previously used, for payment account user authentication. This eliminates the need for the user to move to this separate authentication site and enter a password, etc. In addition, since a payment authentication request for the payment account is accepted based on the success or failure of service authentication, it is also possible to avoid the acceptance of fraudulent payment authentication requests. Therefore, the authentication system 1 can provide the user with a seamless UI while ensuring information security through user authentication of the payment account.

3. Functional configuration of server device
The functional configuration of the server device 100 according to the present embodiment will be described with reference to Fig. 5. As shown in Fig. 5, the server device 100 includes a control unit 110, a communication unit 120, and a storage unit 130.

The control unit 110 includes an acquisition unit 111, a reception unit 112, and an authentication unit 113.

[Acquisition section]
The acquisition unit 111 acquires various information from the affiliated store server 200, the issuer server 300, or other external devices. Any mode may be used for the acquisition unit 216 to acquire various information. When authentication information is input by a user to a screen of a VR site provided by the affiliated store server 200, the acquisition unit 111 may receive a message indicating the input authentication information at any time. As another example, the acquisition unit 111 may receive, for example, a file indicating service authentication success/failure information from the affiliated store server 200 in an event-driven or cyclical manner. As another example, the acquisition unit 111 may instruct an API implemented by the affiliated store server 200 or the issuer server 300 to refer to information, and acquire information as a result of the reference.

The acquisition unit 111 acquires service authentication success/failure information. For example, when service authentication is performed on the acquisition unit 111's own device (own domain), the acquisition unit 111 may acquire the service authentication success/failure information from the service authentication unit 113b described below. As another example, when service authentication is performed on the affiliated store server 200, the acquisition unit 111 may acquire the service authentication success/failure information from the affiliated store server 200.

The acquisition unit 111 may acquire payment authentication success/failure information indicating the success/failure of user authentication for a payment account from a payment service provider device such as the issuer server 300, for example, in response to an authentication instruction from the payment authentication unit 113a.

[Reception department]
The reception unit 112 receives various requests and instructions from the affiliated store server 200, the issuer server 300, or the user device 400. The reception unit 112 includes a payment authentication reception unit 112a. The reception unit 112 may also include, for example, a service authentication reception unit 112b.

The payment authentication reception unit 112a receives, from a service provider device of a service that has received a payment request for a user's transaction using a payment means, a payment authentication request corresponding to the payment request, the payment authentication request including the user's payment account identification information for the payment means and payment authentication information, based on service authentication success/failure information. With this configuration, the server device 100 can receive a payment authentication request corresponding to the payment request from the affiliated store server 200 that has received the payment request from the user device 400. Furthermore, since the payment authentication reception unit 112a receives a payment authentication request based on the success/failure of service authentication, it is possible to avoid receiving fraudulent payment authentication requests and ensure information security.

The payment authentication reception unit 112a may, for example, receive from the affiliated store server 200 a payment request for a user to purchase a product on a VR site by credit card payment, a payment authentication request corresponding to the payment request, the payment authentication request including the user's payment account identification information for the credit card payment and payment authentication information, based on the service authentication success/failure information.

The service authentication reception unit 112b receives a service authentication request including service authentication information for performing user authentication of a service account from a service provider device such as the affiliated store server 200 or a user device 400.

[Authentication section]
The authentication unit 113 performs a process for user authentication of the account based on the authentication request received by the reception unit 112. For example, the authentication unit 113 may use an authentication method such as (A) an authentication method using knowledge information such as an ID, password, or PIN, (B) an authentication method using possessions (possession information) such as a card medium or token, or (C) an authentication method using biometric information of the user. The authentication unit 113 may be a single-factor authentication using one of the above authentication methods (A) to (C), or a multi-factor authentication using two or more of the above authentication methods (A) to (C). The authentication unit 113 includes a payment authentication unit 113a. The authentication unit 113 may also include, for example, a service authentication unit 113b.

When a payment authentication request is accepted by the payment authentication acceptance unit 112a, the payment authentication unit 113a refers to the payment memory unit 132, which stores payment account information including payment account identification information, and performs processing to authenticate the user of the payment account based on the payment authentication request and the payment account information.

[Payment authentication collaboration]
The payment authentication unit 113a may, for example, as a process for user authentication of the above-mentioned payment account (payment authentication integration), issue an authentication instruction to a payment service provider device such as the issuer server 300 to perform user authentication of the payment account, the authentication instruction including payment account identification information and payment authentication information.

[Payment authentication agency]
The payment account information stored in the payment storage unit 132 may include, for example, payment authentication information for executing user authentication of the payment account. In this case, the payment authentication unit 113a may, for example, execute user authentication of the payment account based on the payment authentication information as a process for the user authentication of the payment account, and generate payment authentication success/failure information based on the result of this execution. With this configuration, it is possible to reduce the amount of interaction with a payment service provider device such as the issuer server 300 during payment authentication, and in particular to reduce security risks related to communication for this interaction via the network N. Thus, information security can be ensured.

[Automatic payment authentication]
For example, as a process for user authentication of the payment account, the payment authentication unit 113a may determine that the user authentication of the payment account is successful if the service authentication success/failure information indicates that the user authentication is successful, and may determine that the user authentication of the payment account is unsuccessful if the service authentication success/failure information indicates that the user authentication is unsuccessful. Then, the payment authentication unit 113a may generate payment authentication success/failure information based on the result of this determination. In other words, the payment authentication unit 113a may omit the process of user authentication of the payment account by the user authentication of the service account. Hereinafter, this process is also referred to as "automatic payment authentication." In addition, the payment authentication unit 113a may evaluate a risk related to the user's payment based on, for example, negative information. The payment authentication unit 113a may determine that the user authentication of the payment account is successful if the user authentication of the service account is successful, and may determine that the user authentication of the payment account is unsuccessful, as described above, only when the evaluated risk meets a predetermined standard.

Negative information may be, for example, historical information showing a history of failure to verify identity (a history of failure to verify identity), or a history of a scheduled account withdrawal not being made due to insufficient funds, or a history of delayed payment, etc.

According to the above configuration, instead of executing a process of matching payment authentication information with payment authentication information for payment authentication, payment authentication can be performed based on the success or failure of service authentication. Therefore, there is no need to obtain payment authentication information or manage payment authentication information, and the confidentiality of this information can be ensured.

The service authentication unit 113b refers to the service storage unit 131, which stores service account information including service authentication information, and performs user authentication of the service account based on the service authentication request and the service account information. The service authentication unit 113b generates service authentication success/failure information for the service account based on the result of this user authentication. The service authentication unit 113b shares this generated service authentication success/failure information with the acquisition unit 111.

"Service account information" is information about a service account. Service account information may include, for example, service account identification information (e.g., ID, etc.) for identifying a user's service account and payment account identification information for the corresponding payment account.

According to the above configuration, the service authentication unit 113b can act as a proxy for user authentication of the service account of the affiliated store server 200. Therefore, service authentication can be performed together with payment authentication in a single transaction via the wallet service.

[Communications Department]
The communication unit 120 transmits and receives various information to and from a service provider device, a payment provider device, or other devices in external domains via the network N. The communication unit 120 includes a transmission unit 121 and a reception unit 122. The reception unit 122 receives, for example, various requests from the affiliated store server 200 and payment authentication success/failure information from the issuer server 300.

The transmission unit 121 transmits payment authentication success/failure information indicating whether the user authentication of the payment account was successful or not to a service provider device such as the affiliated store server 200 based on the result of the user authentication process by the payment authentication unit 113a.

According to the above configuration, when making a payment for a transaction in a service provided to a user by a service provider, the user device 400 can authenticate the user of a payment account separate from the service account through communication with the affiliated store server 200. Therefore, for the purpose of authentication, there is no need for communication between the user device 400 and an issuer server 300 or the like in a domain separate from the affiliated store server 200. This eliminates the need for the user to move to a site provided by the issuer server 300 or the like to input a password, etc. Therefore, the authentication system 1 can provide the user with a seamless UI.

The transmission unit 121 may, for example, transmit the service authentication success/failure information generated by the service authentication unit 113b to a service provider device such as the affiliated store server 200.

The transmission unit 121 may, for example, transmit the payment authentication success/failure information acquired by the acquisition unit 111 to a service provider device such as the affiliated store server 200.

According to the above configuration, the payment authentication function of the issuer server 300 can be used through the payment authentication linkage. Therefore, the wallet operator does not need to implement a function for performing user authentication of the payment account in its own domain, such as the server device 100. Therefore, it is possible to provide a highly versatile authentication system 1.

The transmission unit 121 may transmit, for example, the payment authentication success/failure information generated by the payment authentication unit 113a to a service provider device such as the affiliated store server 200 and a payment provider device such as the issuer server 300.

[Memory unit]
The storage unit 130 stores various information related to the authentication system 1. The storage unit 130 may store, for example, user information. The storage unit 130 may store each piece of information using a database management system (DBMS), or may store each piece of information using a file system. When using a DBMS, a table may be provided for each piece of information, and each piece of information may be managed by associating the tables with each other. The storage unit 130 includes a service storage unit 131 and a payment storage unit 132.

The service memory unit 131 stores service account information including service account identification information and service authentication information for performing user authentication of the service account. The payment memory unit 132 stores payment account information including payment account identification information.

<4. Operation example>
An example of the operation of the authentication system 1 will be described with reference to Fig. 6. Fig. 6 is a sequence diagram showing the process flow and interaction when service authentication and payment authentication are performed in the authentication system 1. In the example of Fig. 6, it is assumed that payment authentication collaboration is used for user authentication of a payment account in the authentication system 1. Note that the order of the processes shown below is an example and may be changed as appropriate.

As shown in FIG. 6, the user device 400 accepts a service authentication request operation input from the user, requesting user authentication of a service account, via the screen of the VR site (S10). When the user device 400 accepts the service authentication request operation input, it transmits the service authentication request to the server device 100 via the affiliated store server 200 (S11).

The service authentication reception unit 112b of the server device 100 receives the transmitted service authentication request (S12). The service authentication unit 113b of the server device 100 refers to the service memory unit 131 that stores the service account information, and performs user authentication of the service account based on the received service authentication request and the service account information, and generates service authentication success/failure information for the service account based on the result of this execution (S13). The transmission unit 121 of the server device 100 transmits this generated service authentication success/failure information to the affiliated store server 200 as a response to the service authentication request (S14).

The affiliated store server 200 acquires the service authentication success/failure information sent from the server device 100 (S15). The affiliated store server 200 transmits a response to the user device 400 indicating the result of the service authentication request based on the acquired service authentication success/failure information (S16). The user device 400 outputs the result of the service authentication to the user (S17).

The user device 400 accepts from the user, via the VR site screen, a payment request for the user's transaction using the credit card payment provided by the issuer server 300 (S18). In this example, the payment request includes payment account identification information and payment authentication information. When the user device 400 accepts the payment request, it sends the payment request to the affiliated store server 200 (S19).

When the user authentication of the service account is successful, each device of the authentication system 1 executes processing of the area indicated by the composite fragment opt1 (Option1). Specifically, the affiliated store server 200 accepts a payment request sent from the user device 400 (S20). The affiliated store server 200 sends a payment authentication request corresponding to this payment request, which includes payment account identification information and payment authentication information, to the server device 100 (S21). The server device 100 accepts the payment authentication request based on the generated service authentication success/failure information (S22). The server device 100 sends an authentication instruction to the issuer server 300 to instruct the execution of user authentication of the payment account, which includes payment account identification information and payment authentication information (S23). The issuer server 300 executes user authentication of the payment account based on the transmitted authentication instruction (S24). In response to this authentication instruction, the issuer server 300 transmits payment authentication success/failure information indicating the success or failure of the user authentication as a result of this execution to the server device 100 (S25). The server device 100 acquires the payment authentication success/failure information from the issuer server 300 (S26). The server device 100 transmits this acquired payment authentication success/failure information to the affiliated store server 200 (S27).

If user authentication of the payment account is successful, each device in the authentication system 1 executes processing for the area indicated by the composite fragment opt2 (Option2). Specifically, the affiliated store server 200 executes processing for the payment of the transaction requested by the user (S28).

5. Hardware Configuration
7, an example of a hardware configuration in which the above-mentioned server device 100 is realized by a computer 800 will be described. Note that the functions of each device can also be realized by dividing them into a plurality of devices.

As shown in FIG. 7, the computer 800 includes a processor 801, a memory 803, a storage device 805, an input I/F unit 807, a data I/F unit 809, a communication I/F unit 811, and a display device 813.

The processor 801 controls various processes in the computer 800 by executing programs stored in the memory 803. For example, each functional unit of the control unit 110 of the server device 100 can be realized as a program that is temporarily stored in the memory 803 and operates mainly on the processor 801.

The memory 803 is a storage medium such as a RAM (Random Access Memory). The memory 803 temporarily stores the program code of the program executed by the processor 801 and data required when the program is executed.

The storage device 805 is a non-volatile storage medium such as a hard disk drive (HDD) or flash memory. The storage device 805 stores an operating system and various programs for implementing the above-mentioned configurations. In addition, the storage device 805 can also store tables for registering user information and various account information, and a DB for managing the tables. Such programs and data are loaded into the memory 803 as necessary and are referenced by the processor 801.

The input I/F unit 807 is a device for receiving input from a user. Specific examples of the input I/F unit 807 include a keyboard, a mouse, a touch panel, various sensors, and a wearable device. The input I/F unit 807 may be connected to the computer 800 via an interface such as a USB (Universal Serial Bus).

The data I/F unit 809 is a device for inputting data from outside the computer 800. A specific example of the data I/F unit 809 is a drive device for reading data stored in various storage media. The data I/F unit 809 may be provided outside the computer 800. In that case, the data I/F unit 809 is connected to the computer 800 via an interface such as a USB.

The communication I/F unit 811 is a device for performing data communication via the Internet N, either wired or wirelessly, with devices external to the computer 800. The communication I/F unit 811 may be provided external to the computer 800. In that case, the communication I/F unit 811 is connected to the computer 800 via an interface such as a USB.

The display device 813 is a device for displaying various types of information. Specific examples of the display device 813 include a liquid crystal display, an organic EL (Electro-Luminescence) display, a display of a wearable device, and the like. The display device 813 may be provided outside the computer 800. In that case, the display device 813 is connected to the computer 800 via, for example, a display cable. Furthermore, when a touch panel is used as the input I/F unit 807, the display device 813 can be configured as an integral part of the input I/F unit 807.

The above-described embodiment is an example for explaining the present invention, and is not intended to limit the present invention to only this embodiment. Furthermore, the present invention can be modified in various ways without departing from the gist of the invention. Furthermore, a person skilled in the art can adopt an embodiment in which each element described below is replaced with an equivalent element, and such an embodiment is also included in the scope of the present invention.

[Modification]
Although the present invention has been described based on the above embodiment, the following cases are also included in the present invention.

[Modification 1]
Some of the functional units included in the control unit 110 of the server device 100 according to the above embodiment may be provided in a service provider device or a payment provider device.

[Modification 2]
In the above embodiment, an example has been described in which the payment authentication information for executing user authentication of the payment account is included in the payment authentication request from the affiliated store server 200 of the service provider device, but the source of acquisition of the payment authentication information is not limited to this. The payment authentication information may be registered in advance in the payment account information stored in the payment storage unit 132.

For example, when a payment authentication request is accepted, the payment authentication unit 113a may refer to the payment storage unit 132, which stores payment account information including payment account identification information and payment authentication information, and issue an authentication instruction to the payment business device to perform user authentication of the payment account based on the payment authentication request and the payment account information. This authentication instruction includes payment account identification information and payment authentication information. With this configuration, there is no need to exchange highly confidential payment authentication information between the user device 400 and the affiliated store server 200, and between the affiliated store server 200 and the server device 100. This makes it possible to reduce security risks, particularly regarding communications for this exchange via the network N. This makes it possible to ensure information security.

[Modification 3]
In the above embodiment, an example has been described in which an account for the VR commerce service of an affiliated store also serves as an account for the wallet service that the wallet operator provides to the user through the affiliated store, but the service account according to the present invention is not limited to this. For example, an account for the VR commerce service and an account for the wallet service may be provided separately. In this case, the service authentication success/failure information may indicate the success/failure of user authentication for at least one of the account for the VR commerce service and the account for the wallet service.

[Modification 4]
Although not shown in the above embodiment, which of (A) payment authentication cooperation, (B) payment authentication agency, and (C) automatic payment authentication is to be selected as the authentication method of the payment account may be selected manually by a user such as an issuer, or may be selected automatically based on a predetermined condition. In the latter example of automatic selection, for example, the payment authentication unit 113a may select one of (A) to (C) as the user authentication method of the payment account based on the evaluated risk of the user's payment. For example, the risk may be evaluated in three stages ("high", "medium", and "low"), and the payment authentication unit 113a may select (A) if the evaluated risk is "high", select (B) if the evaluated risk is "medium", and select "C" if the evaluated risk is "low". With this configuration, it is possible to select an appropriate authentication method of the payment account according to the risk of the user's payment. Furthermore, the payment authentication unit 113a may call up a user authentication function of the payment account of the issuer server 300 in addition to (A) to (C) based on the risk of the user's payment, and have the user authenticate using this issuer function.

1...authentication system, 100...server device, 110...control unit, 111...acquisition unit, 112...reception unit, 113...authentication unit, 120...communication unit, 130...memory unit, 300...issuer server, 500...international brand server, 800...computer, 801...processor, 803...memory, 805...storage device, 807...input I/F unit, 809...data I/F unit, 811...communication I/F unit, 813...display device.

Claims (7)

On the computer,
an acquisition function for acquiring service authentication success/failure information indicating the success/failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available;
a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success/failure information indicates success of the user authentication;
a payment authentication function that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information;
a transmission function of transmitting, to the service provider device, payment authentication success/failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, the payment authentication success/failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success;
The payment authentication function, as a process for the user authentication, issues an authentication instruction to the payment service provider device to execute user authentication of the payment account, the authentication instruction including the payment account identification information and the payment authentication information,
The acquisition function acquires, in response to the authentication instruction, information indicating whether user authentication for the payment account has been successful or not from the payment service provider device;
The transmission function generates the payment authentication success/failure information based on the information indicating the success/failure of the user acquired by the acquisition function, and transmits the payment authentication success/failure information to the service provider device.
program. On the computer,
an acquisition function for acquiring service authentication success/failure information indicating the success/failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available;
a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success/failure information indicates success of the user authentication;
a payment authentication function that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information;
a transmission function of transmitting, to the service provider device, payment authentication success/failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, the payment authentication success/failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success;
The payment account information includes payment authentication information for performing user authentication of the payment account;
The payment authentication function executes the user authentication based on the payment authentication information as a process for the user authentication, and generates the payment authentication success/failure information based on a result of the execution,
The transmission function transmits the generated payment authentication success/failure information to the service provider device and the payment provider device .
program . On the computer,
an acquisition function for acquiring service authentication success/failure information indicating the success/failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available;
a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success/failure information indicates success of the user authentication;
a payment authentication function that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information;
a transmission function of transmitting, to the service provider device, payment authentication success/failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, the payment authentication success/failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success;
The payment authentication function is
As a process for the user authentication, if the service authentication success/failure information indicates a success of the user authentication, it is determined that the user authentication of the payment account is successful, and on the other hand, if the service authentication success/failure information indicates a failure of the user authentication, it is determined that the user authentication of the payment account is a failure;
generating the payment authentication success/failure information based on the result of the determination;
The transmission function transmits the generated payment authentication success/failure information to the service provider device and the payment provider device .
program . The computer includes:
a service authentication reception function for receiving a service authentication request including service authentication information for performing user authentication of the service account from the service provider device or a user device of the user;
a service authentication function of executing the user authentication based on the service authentication request and the service account information by referring to a service storage unit that stores service account information including service authentication information for executing user authentication of the service account;
the service authentication function generates the service authentication success/failure information of the service account based on a result of the execution;
The acquisition function acquires the generated service authentication success/failure information from the service authentication function,
The transmission function transmits the generated service authentication success/failure information to the service provider device.
The program according to any one of claims 1 to 3. On the computer,
an acquisition function for acquiring service authentication success/failure information indicating the success/failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available;
a payment authentication reception function that receives, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means, when the service authentication success/failure information indicates success of the user authentication ;
a payment authentication function for, when the payment authentication request is accepted, referring to a payment storage unit that stores payment account information including the payment account identification information and payment authentication information for executing user authentication of the payment account, issuing an authentication instruction to a payment service provider device of the payment service provider based on the payment authentication request and the payment account information, the authentication instruction including the payment account identification information and the payment authentication information, and acquiring, in response to the authentication instruction, payment authentication success/failure information from the payment service provider device , which indicates success or failure of user authentication for the payment account and which prompts the service provider device to authorize the payment means for the payment service provider device if the user authentication indicates success ;
A transmission function of transmitting the acquired payment authentication success/failure information to the service provider device.
program. an acquisition unit that acquires service authentication success/failure information indicating success/failure of user authentication for a service account of a user in a service in which a payment method provided by a payment service provider is available;
a payment authentication receiving unit that receives, from a service provider device of the service that has received a payment request for the transaction of the user via the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the user's payment account in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success/failure information indicates success of the user authentication;
a payment authentication unit that, when the payment authentication request is accepted, refers to a payment storage unit that stores payment account information including the payment account identification information, and performs processing for the user authentication based on the payment authentication request and the payment account information;
a transmitter that transmits, to the service provider device, payment authentication success/failure information indicating whether user authentication of the payment account has been successful based on a result of the processing, the payment authentication success/failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success ;
the payment authentication unit issues, as a process for the user authentication, an authentication instruction to the payment service provider device to execute user authentication of the payment account, the authentication instruction including the payment account identification information and the payment authentication information;
The acquisition unit acquires, in response to the authentication instruction, information indicating success or failure of user authentication for the payment account from the payment service provider device,
the transmission unit generates the payment authentication success/failure information based on the information indicating the success/failure of the user authentication acquired by the acquisition unit, and transmits the payment authentication success/failure information to the service provider device.
Authentication system. The computer
Acquire service authentication success/failure information indicating the success/failure of user authentication for the user's service account in a service in which a payment method provided by the payment service provider is available;
receiving, from a service provider device of the service that has received a payment request for the transaction of the user by the payment means, a payment authentication request corresponding to the payment request, the payment authentication request including payment account identification information for identifying the payment account of the user in the payment means and payment authentication information for performing user authentication of the payment account, when the service authentication success/failure information indicates success of the user authentication;
When the payment authentication request is accepted, a payment storage unit that stores payment account information including the payment account identification information is referenced, and processing for the user authentication is performed based on the payment authentication request and the payment account information;
based on a result of the processing, transmitting payment authentication success/failure information indicating whether user authentication of the payment account has been successful, the payment authentication success/failure information prompting the service provider device to authorize the payment means to the payment provider device of the payment provider when the user authentication indicates success ;
As a process for the user authentication, an authentication instruction is issued to the payment service provider device to instruct the payment service provider device to execute user authentication of the payment account, the authentication instruction including the payment account identification information and the payment authentication information;
acquiring information indicating whether user authentication for the payment account has been successful or not from the payment service provider device in response to the authentication instruction;
generating payment authentication success/failure information based on the acquired information indicating success/failure of the user authentication, and transmitting the payment authentication success/failure information to the service provider device;
Information processing methods.

Images