Technical field
[0001]The present disclosure relates to a server and authentication method.
BACKGROUND
[0002]Proximity and contactless communication have been widely carried out by giving the value to the IC card to communicate with (see Patent Document 1 and the like). At that time, in order to provide services offline it has been utilized with IC card that holds the value to secure, a secure terminal having a tamper resistance for operating the value. On the other hand, recently, the network is widespread, form of holding a value to the server increases, usage of the IC card authentication is considered to be the owner of the server of the value in making sure that the correct card.
CITATION
Patent Document
[0003]Patent Document 1: JP 2009-110202 JP
Summary of the Invention
Problems that the Invention is to Solve
[0004]The IC card that is intended to be available offline, in the case of diverted to form holding the value to the server there is consideration in the authentication of the IC card.
[0005]Therefore, the server in this disclosure, the IC card that is intended to be available offline, when diverted to form holding the value to the server, which can be authenticated securely IC card, which is new and improved and to propose an authentication method.
Means for Solving the Problems
[0006]According to the present disclosure, a providing unit that provides authentication data for authentication of the IC card to the terminal to perform proximity non-contact communication with the IC card, from said terminal, the number of uses of the authentication data inclusive, and an authentication unit for authenticating the IC card by using an acquisition unit for acquiring the data received, and the authentication data and the received data by the proximity non-contact communication between the IC card , the server is provided.
[0007]According to the disclosure, and to provide authentication data for authentication of the IC card to the terminal to perform proximity non-contact communication with the IC card, from said terminal, the number of uses of the authentication data inclusive, including, and performing the authentication of the IC card by using proximity and obtaining the reception data received by non-contact communication, and said authentication data and the reception data between the IC card, authentication a method is provided.
The invention's effect
[0008]
　Above, according the to the present disclosure describes, the IC card that is intended to be available offline, when diverted to form holding the value to the server, capable of secure authentication IC card, a new and it is possible to provide an improved server and authentication method.
[0009]
　Incidentally, the above effect is not necessarily restrictive, with the above effects, or instead of the above effects, any effects shown herein, or other effects that may be grasped from the description, it may be achieved.
BRIEF DESCRIPTION OF THE DRAWINGS
[0010]
Is an explanatory view showing a configuration example of an authentication system according to the embodiment of FIG. 1 the present disclosure.
Is an explanatory view [2] shows an example of the functional configuration of IDcd authentication server.
Is a flowchart illustrating an operation example of FIG. 3] IDCD authentication server and an IC card.
Is a flowchart illustrating an operation example of FIG. 4] IDCD authentication server and the terminal.
Is a flowchart illustrating an operation example of FIG. 5] IDCD authentication server and the service provider.
[FIG 6] IDCD authentication server is a flowchart showing an operation example of the terminal and service provider.
[7] the service provider is a flow diagram illustrating an operation example of the terminal and the IC card.
8 is an explanatory diagram for explaining a process in the IC card.
Is a flowchart illustrating an operation example of FIG. 9] IDCD authentication server and the service provider.
FIG. 10 is an explanatory diagram for explaining a process of the IC card authentication unit.
[Figure 11] IDCD authentication server is a flowchart illustrating an operation example of the service provider and the terminal.
Is a flowchart illustrating an operation example of FIG. 12 terminals and IC card.
And [13] the service provider is a flow diagram illustrating a terminal, an IC card, an operation example of.
FIG. 14 is an explanatory view showing the structure of a request sentence terminal generates.
It is a flow diagram illustrating [FIG. 15] and IDcd authentication server, and the service provider, an operation example of.
And [FIG. 16] IDCD authentication server, which is a flow diagram illustrating a service provider, and other businesses, an operation example of.
And FIG. 17] IDCD authentication server, which is a flow diagram illustrating a service provider, a terminal, an IC card, an operation example of.
And [18] the service provider is a flow diagram illustrating a terminal, an IC card, an operation example of.
[Figure 19] is a side to settle is an explanatory diagram showing how to change the payment amount by the unauthorized.
Is an explanatory view [20] shows how for the purpose of preventing the incorrect side to settle.
FIG. 21 is an explanatory diagram for explaining the transfer process between individuals using the IC card authentication.
DESCRIPTION OF THE INVENTION
[0011]
　Reference will now be described in detail preferred embodiments of the present disclosure. In the specification and the drawings, components having substantially the same function and structure are a repeated explanation thereof by referring to the figures.
[0012]
　The description will be made in the following order.
　1. The embodiment of the present disclosure
　　1.1. Overview
　　1.2. Configuration example
　　1.3. Operation Example
　2. Summary
[0013]
　<1. Embodiments of the present
　disclosure> [1.1. Summary
　First, before describing embodiments of the present disclosure, illustrating the course of events for achieving the embodiment of the present disclosure.
[0014]
　To provide services offline it has been utilized with IC card that holds the value to secure, a secure terminal having a tamper resistance for operating the value. On the other hand, recently, the network is widespread, form of holding a value to the server increases, usage of the IC card authentication is considered to be the owner of the server of the value in making sure that the correct card.
[0015]
　The IC card that is intended to be utilized in a conventional off-line, it is necessary to clear the points listed below when diverted to form holding the value to the server.
[0016]
　The mutual authentication with the IC card, and a lot of communication occurs, the implementation of the terminal had become complicated.
[0017]
　If not even be detected as the key of the secret has been leaked, or are using the leakage has been key, can not be that one of the distinction is not the case, I did not know whether to stop the service continues
[0018]
　Further, in order to determine that the IC card is correct, it is necessary to secure chip to store it and the key of the concealed terminal, which leads to the complexity of the terminal-side cost increase and management. Further, even if arranged concealed key and the secure chip on the server side, because many communication is required, the server and development costs of the terminal on the communication path was not added. Depending existing environment, there is necessary to separately provide a dedicated communication channel.
[0019]
　Even if you determine that IC card and its IDcd is correct by using a secure chip, another person or system that has received the results transfer is not able to determine whether it is correct, I did not only believe in the transfer source .
[0020]
　Regardless convertibility and security level of the discriminated IC card and the service using the IDCD, key and secure chip concealment had to be protected highly.
[0021]
　If a new proof of the IC card and IDcd became necessary, it was going to issue a dedicated IC card and IDcd for certification. In addition, the security chip and a reader-writer storing a key ciphering the IC card has been necessary to prepare each time to each terminal.
[0022]
　Accordingly the present disclosure diligently studied the technology for a clear point described above. As a result, the present disclosure shall, as described below, not only online, the IC card that is intended to be available offline, when diverted to form holding the value to the server, the secure IC card This has led to the devise so that it is possible to perform authentication technology.
[0023]
　[1.2. Configuration Example
　FIG. 1 is an explanatory diagram showing a configuration example of an authentication system according to an embodiment of the present disclosure. In this system, the form for holding the value on the server is increased, assuming the usage of the IC card to authenticate that it is the owner of the server of the value in making sure that the correct card. 1 shows a IDcd authentication server 100, a terminal 200 having a reader writer that communicates by proximity non-contact communication with the IC card 300, the IC card 300 with a built-in IC chip, are the shown. Also in Figure 1, the service provider 400 to provide service to the IC card 300, and other operators 500, it is also shown. A service provider 400, and other operators 500, such as from server form.
[0024]
　Figure 2 is an explanatory diagram showing an example of a functional configuration of IDcd authentication server 100. IDcd authentication server 100 is configured with IC card authentication unit 110, a coupon ticket data management unit 120, a communication data restoring unit 130, it includes an external communication unit 140, a.
[0025]
　IC card authentication unit 110 authenticates the IC card 300. IC card authentication unit 110 is configured to include a response verifier 111, the IC card key table 112. Response verifier 111 verifies whether or not these responses is correct to the challenge generated by the IC card 300. Response verifier 111 has the same mechanism as the mechanism of generation of a response in the IC card 300. IC card key table 112 holds the key information needed to authenticate the IC card 300. Specifically, the IC card key table 112, an IC card key ID, and the IC card key information is held for each IC card key. IC card key ID is an ID for identifying the IC card key. IC card key information is key information necessary for authenticating the key secret stored in the IC card.
[0026]
　Tickets data management unit 120 manages the tickets data and service definition. The coupons data, a unique data information needed is specified for each terminal 200 to authenticate the IC card 300. Tickets data, as described later, a data string having a challenge, the ID token key, a. IDcd authentication server 100 may be provided collectively a plurality of tickets data to the terminal 200, and provided to the terminal 200 and generates at every request sent in response to the authentication of the terminal 200 it may be.
[0027]
　Tickets data management unit 120 is configured to include a coupon ticket data generator 121, a coupon ticket table 122. Tickets data generator 121 generates a coupon ticket data based on a predetermined rule. Tickets table 122 manages the terminal 200 to access the IC card 300, to hold the data necessary to generate the coupon ticket data for each terminal 200. Tickets table 122, specifically, the terminal ID, initial tickets data, tickets data derived key, the current number of uses, currently held payout number, the final tickets data. Terminal ID is an ID for identifying the terminal 200. Initial tickets data is the first key to derive tickets data. Tickets data derived key from tickets data is a key for deriving generate the next tickets data. Currently the number of times of use is the number of times indicating how so far is up to what th of tickets data were used. Current payout number of times, what th of tickets data until this is the number of times that indicates whether paid out. Last tickets data is the number of times ticket data that was last authenticated.
[0028]
　Communication data restoring unit 130 restores the data encrypted by a predetermined rule from the terminal 200. Communication data recovery unit 130 is configured to include a tokenized IDcd decompressor 131, a hash generation 132, a. Tokenized IDCD restorer 131 restores the tokenized IDCD.
[0029]
　IDcd authentication server 100 holds the service definition table 123 for managing the service provider 400 to another. Service definition table 123, to manage the service provider, to hold a list of terminal service provider to use, the key to the kind of IC card to accept. Service definition table 123, for each service provider 400, holds the service ID, the terminal ID list, the key ID list. Service ID is an ID for identifying the service provider. Terminal ID list is a terminal ID list of terminals that service providers are using. The key ID list, each terminal is an IC card key ID list of the IC card key that can be accepted.
[0030]
　External communication unit 140 with an external device IDcd authentication server 100 executes a communication process by any communication protocol.
[0031]
　[1.3. Operation Example]
　Next, an operation example of the authentication system.
[0032]
　(Example 1)
　As an example of a first, On the assumption that the terminal 200 is not secure, also applicable if a terminal 200 each time the IC card 300 is held over to acquire tickets data from IDcd authentication server 100 via the service provider 400.
[0033]
　(1-1) Registration of the IC card key information
　describing an operation example when registering the IC card key information held in the first IC card 300 to IDcd authentication server 100. Figure 3 is a flowchart illustrating an operation example of IDcd authentication server 100 and the IC card 300. From the IC card 300, a predetermined manner, for example, an IC card key information in response to the IC card 300 to the terminal 200 for registering the IDcd authentication server 100 is held over the IC card key information IDcd authentication server 100 sending (step S101). At this time, perform registrant authentication or for holding the IC card 300, the communication path encryption between IDcd authentication server 100 as needed. IDcd authentication server 100 registers the IC card key information transmitted from the IC card 300 into the IC card key table 112 and returns the IC card key ID to the IC card 300 (step S102). The IC card key ID, the user of the IC card 300 may be managed in some way. For example IC card key ID, the user of the IC card 300 may be stored within the information communication apparatus that holds.
[0034]
　(1-2) Registration of the terminal
　then information of the terminal 200 will be described an operation example when registering to IDcd authentication server 100. Figure 4 is a flowchart illustrating an operation example of IDcd authentication server 100 and the terminal 200. Terminal 200 sends a request to register the IDcd authentication server 100 at predetermined timing (step S111). In this case, authentication and subscribers as required, to encrypt a communication path between the IDcd authentication server 100. IDcd authentication server 100, in response to this request, numbered with a unique terminal ID, initial tickets data to the terminal ID, and generates a coupon ticket data derived key. IDcd authentication server 100, the generated initial coupon ticket data is assigned to the initial tickets data and final tickets data tickets table 122. The IDcd authentication server 100 assigns tickets data derived key generated in coupon ticket data derived key of tickets table 122. The IDcd authentication server 100, any number of currently available number and the current payout number of tickets table 122 to 0. IDcd authentication server 100 provides the terminal ID to the terminal 200 (step S112). Terminal 200, in addition to the coupon ticket data list to be described later with the terminal ID, and holds the current number of uses. The initial value of the currently available number of times is set to 0.
[0035]
　(1-3) Registration of service providers
　will now be described an example of the operation of when registering the information of the service provider 400 to IDcd authentication server 100. Figure 5 is a flowchart illustrating an operation example of IDcd authentication server 100 and the service provider 400. Service provider 400 sends a request to register the service definition to IDcd authentication server 100 (step S121). At this time, if necessary, performed registrant of authentication and, a communication path encryption between IDcd authentication server 100. Service provider 400, against IDcd authentication server 100, transmits the terminal ID list and the IC card key ID list. IDcd authentication server 100, numbered with a unique service ID in accordance with this request, registers the information in the service definition table 123. IDcd authentication server 100, to the service provider 400, to provide a service ID that was numbered (step S122). Service provider 400 to the terminal 200 to use the service (terminal 200 corresponding to the terminal ID included in the terminal ID list), and notifies the service ID and the IC card key ID list (step S123).
[0036]
　(1-4) Output of tickets data list (payout)
　Next, IDCD authentication server 100 outputs a coupon ticket data list (paying) an example of operation will be described. Figure 6 is a flowchart illustrating an operation example of IDcd authentication server 100, the terminal 200 and service provider 400.
[0037]
　Service provider 400, for each terminal 200 to be paid out the coupon ticket data list, to request a payout of tickets data list to IDcd authentication server 100 (step S131). Service provider 400, compared IDcd authentication server 100, to send its own service ID, terminal ID of the terminal to pay out the number of times ticket data list, the number of times ticket data payout number of information.
[0038]
　IDcd authentication server 100, to this issuance request, using the coupon ticket data generator 121, the following procedure, tickets data payout number of input, and generates a coupon ticket data. First IDcd authentication server 100, from the terminal ID that has been input from the service provider 400, for identifying the terminal ID of the tickets table. Then IDcd authentication server 100, the tickets data generator 121 receives the final tickets data and coupon tickets data derived key, to generate new tickets data. Then IDcd authentication server 100 outputs the tickets data list currently generated and payout number the service provider 400, only the number of times paid out, adds the current payout number of tickets table 122 (step S132).
[0039]
　Service provider 400 transfers the current payout number acquired from IDcd authentication server 100, a coupon ticket data list, the terminal 200 corresponding to the terminal ID (step S133). Terminal 200 corresponding to the terminal ID, the tickets data list held by itself, adds the acquired tickets data list.
[0040]
　(1-5) Acquisition of card response
　terminal 200, each time the IC card 300 is held over becomes authenticated necessary, performs the card response acquisition less. Figure 7 is a flow chart showing an operation example of the service provider 400, the terminal 200 and IC card 300. Terminal 200, IC card 300 is held over, every time the authentication of the IC card 300 is required, performs the card response acquisition less. First terminal 200, the youngest data in the tickets data list held is taken out, as well as delete the tickets data from tickets data list and increments the current number of uses. Then the terminal 200, from the tickets the data retrieved, retrieving the challenge, the ID token key, a. For example, the first 8 bytes, or 16 bytes of tickets data challenge, the ID token key for the next 8 bytes. Of course the challenge, the definition of the ID token key is not be construed as limited to this example.
[0041]
　Terminal 200, when the IC card 300 is held over, by using the information determined for each IC card key ID, to identify the IC card key ID to use. At this time, the terminal 200 issues a unilateral authentication command of the IC card 300. At that time, the terminal 200 by the proximity non-contact communication enters the challenge to the IC card 300 (step S141), obtains the IDcd from the IC card 300, a response IC card 300 has been generated for the challenge (step S142 ).
[0042]
　Figure 8 is an explanatory diagram for explaining the processing in the IC card 300. IC card 300 acquires the challenge from the terminal 200 by performing a predetermined calculation using the IC card key information and IDcd is held inside, and generates a response to the challenge. The IC card 300 outputs the IDCD, the response generated against challenge.
[0043]
　Then the terminal 200, to the IDCD authentication server 100, using the ID token key, to generate the tokenized IDCD. For example terminal 200, by taking the exclusive OR IDCD and ID tokenization key to generate the tokenized IDCD. Of course not intended method of generating the tokenized IDcd is limited to such an example. The terminal 200, to the response and the like, to generate the encrypted response using a predetermined encryption method such as SSL (Secure Sockets Layer). The terminal 200 transmits the generated information to the service provider 400 (step S143). Here, the terminal 200, to the service provider 400, terminal ID, tokenized IDcd, to send a response, the current number of times of use, the IC card key ID.
[0044]
　(1-6) IC card authentication
　Figure 9 is a flow chart showing an operation example of IDcd authentication server 100 and the service provider 400. Service provider 400 transmits the acquired response information from the terminal 200 to IDcd authentication server 100, and requests the authentication of the response is correct (step S151). Here, the service provider 400, to IDcd authentication server 100, service ID, terminal ID, tokenized IDcd, to send a response, the current number of times of use, and the IC card key ID.
[0045]
　IDcd authentication server 100 is a coupon ticket data management unit 120, to generate a coupon ticket data by the following procedure. First IDcd authentication server 100, the terminal ID received from the service provider 400 to identify the data in the coupon ticket table 122, obtains the final tickets data. Then IDcd authentication server 100, to generate a number of times ticket data from the currently available number of times that has been input from the service provider 400. Tickets table 122 rather than from the initial tickets data to repeat the generation by the number of the currently available number of input from the service provider 400 in, the number of difference between the current usage count in the coupon ticket table 122, final repeated generation of tickets data using tickets data generator 121 from the tickets the data.
[0046]
　IDcd authentication server 100 uses the response information entered, the tickets data generated by tickets the data generator 121, the communication data restoring unit 130 performs decoding of the received data. First IDcd authentication server 100, the tickets data generated by tickets the data generator 121 acquires the challenge and token key. Then IDCD authentication server 100 inputs an IDCD and tokens key to tokenize IDCD decompressor 131 acquires the IDCD.
[0047]
　Then, IDcd authentication server 100, and the response information that has been input from the service provider 400, and the number of times ticket data created by itself, using the information it had decrypted itself, a response that has been input from the service provider 400 correct things to authenticate with the IC card authentication unit 110. Specifically, IDCD authentication server 100 authenticates the following procedure. First IDcd authentication server 100 from the IC card key ID that has been input, to get the IC card key information. Then IDCD authentication server 100, the response verifier 111, restored IDCD, enter challenge created by itself, and the IC card key information to generate a response, compared with input from the service provider 400 Response Te, both to determine whether or not the same. If they are the same, IDCD authentication server 100, which was held over the terminal 200 is considered as a correct IC card and IDCD. Then IDcd authentication server 100, the tickets data created by itself to a final coupon ticket data, the currently available number, and input the current number of uses. On the other hand, if they do not match, IDCD authentication server 100, the subsequent processing is not performed, and returns a predetermined error message indicating that was disagreement service provider 400.
[0048]
　Figure 10 is an explanatory diagram for explaining the processing of the IC card authentication unit 110. IC card authentication unit 110, the IC card key ID, the reference to the IC card key table 112, extracts the IC card key information of the target. The IC card authentication unit 110, restored IDCD, challenge created by itself, and to generate a response to input IC card key information in the response verifier 111.
[0049]
　Terminal 200, in order to consume the number of times ticket data each time of authentication, to acquire an additional number of times ticket data from IDcd authentication server 100 when it is no longer enough. Terminal 200, the service provider 400, a request for additional tickets data. Service provider 400, to IDcd authentication server 100, service ID, terminal ID, enter the number of tickets data payout, to request an additional generation of tickets data to IDcd authentication server 100. IDcd authentication server 100 performs the same processing as the payout processing of tickets data list as described above, to provide the generated tickets data to the service provider 400. Service provider 400, the number of times ticket data obtained from the IDcd authentication server 100, to transfer to the terminal 200 which has requested the additional tickets data.
[0050]
　(Example 2)
　as the next example, when the list of IDCD of an IC card is held over the terminal 200 is known in advance, an example for paying in advance Challenge and response corresponding to the IDCD.
[0051]
　(2-1) Acquisition of challenge-response list
　will be described first acquisition processing of the challenge response list. 11, IDCD authentication server 100 is a flowchart showing an operation example of the service provider 400 and the terminal 200. Service provider 400 transmits IDcd list of IC card 300 will be held over the terminal 200 to IDcd authentication server 100 (step S201). Service provider 400, to IDcd authentication server 100, to send a list of service ID and IDcd information (including the IDcd and IC card key ID).
[0052]
　IC card authentication unit 110 of IDcd authentication server 100 acquires the IC card key information from the IC card key ID. The IC card authentication unit 110, the challenge also produced. The generation of this challenge is performed by a random number generator or the like. Response verifier 111 of Next IDcd authentication server 100, and input IDcd, IC card key information, the challenge, to get a response. This is repeated only a few minutes of the list of IDcd information.
[0053]
　And IDcd authentication server 100 returns a list that generated the service provider 400 (step S202). Specifically, IDCD authentication server 100 transmits a list of service ID and IDCD information (including IDCD, IC card key ID, the challenge and response).
[0054]
　Service provider 400 transmits the list received from IDcd authentication server 100 to the terminal 200 (step S203). Terminal 200, holds the list sent from the service provider 400.
[0055]
　(2-2) Confirmation of card response
　Figure 12 is a flow chart illustrating an operation example of the terminal 200 and IC card 300. Terminal 200, when the IC card 300 is held over, be obtained by the proximity non-contact communication IDcd the IC card 300 (step S211). Then the terminal 200, after confirming the IDCD of the IC card 300, the challenge corresponding to the IDCD, with the information specified by the IC card key ID, the issue unilateral authentication command of the IC card 300 (step S212 ), and it acquires a response from the IC card 300 (step S213).
[0056]
　Terminal 200, and the response corresponding to the IDcd, the response received from the IC card 300 to confirm whether or not the same. If they are the same, the terminal 200 is regarded as an IC card 300 held over is the correct IC card and IDCD, executes the subsequent processing. If different, the terminal 200 executes a predetermined error process.
[0057]
　(Example 3)
　As an example of a third, that the challenge to be input to the IC card 300 generates the terminal 200, IDCD authentication server 100, the response is the result of the input to the challenge and the IC card an example to prove will be described.
[0058]
　(3-1) card response acquiring
　Figure 13, the service provider 400, a terminal 200, is a flow diagram showing the IC card 300, an operation example of. Terminal 200 first generates a challenge to be input to the IC card 300. Terminal 200 generates a service ID, a terminal ID, and the IC card key ID, and the current number of times of use, a request sentence coupled with any of the text, the. Figure 14 is an explanatory view showing the structure of a request sentence terminal 200 generates.
[0059]
　Then the terminal 200 generates a hash for generated request statements. The terminal 200 increments the current number of uses.
[0060]
　When IC card 300 is held over the terminal 200, the terminal 200, with the information specified by the IC card key ID, and issues a unilateral authentication command of the IC card 300. At that time, the terminal 200 receives the proximity noncontact communication IC card 300 generated hash as the challenge (step S301), and acquires the proximity contactless communication IDcd and response from the IC card 300 (step S302).
[0061]
　Then the terminal 200, the generated request statement, and transmits the IDcd and responses obtained from the IC card 300, to the service provider 400 (step S303).
[0062]
　(3-2) card authentication response
　Figure 15 is a flow diagram illustrating a IDcd authentication server 100, the service provider 400, an operation example of. Service provider 400, to IDcd authentication server 100, a request for authentication of whether the response is correct (step S311). In this case, the service provider 400, and transmits it to the IDcd authentication server 100, request statement, the IDcd and response.
[0063]
　IDcd authentication server 100, a request sentence received, using the hash generator 132, it generates a hash, a challenge. In addition, IDcd authentication server 100, removed from the request text received, and the service ID, the terminal ID, the IC card key ID, and the current number of times of use, the. Subsequently, tickets data management unit 120 of IDcd authentication server 100 refers to the service definition table 123, the IC card key ID list corresponding to the service ID, checks whether there is an IC card key ID retrieved . Subsequently, in the IC card authentication unit 110, the IC card key table 112, identifies the IC card key information corresponding to the IC card key ID. IDcd authentication server 100, using the response verification unit 111, and input IDcd, challenge, the IC card key information, to generate a response. Then IDcd authentication server 100 transmits an authentication result using the generated response to the service provider 400 (step S312). If the response generated with received and had responses are equal, IDCD authentication server 100, response received is, the IC card 300 that is specified by the IDCD, regarded as having been generated by inputting a request sentence.
[0064]
　(3-3) Transfer of the authentication result
　service provider 400, or holds the authentication result, it may or transferred to other operators 500. Figure 16 is a IDcd authentication server 100, the service provider 400, and other businesses 500, is a flow chart showing an operation example of.
[0065]
　Other operators 500 receives from the service provider 400, the request sentence, the IDcd and response (step S321). Other operators 500, and transmits it to the IDcd authentication server 100, request statement, the IDcd and response (step S322). IDcd authentication server, in the same manner as described above card response authentication, to authenticate the response received from other operators 500, and returns the results to the other operators 500.
[0066]
　(Example 4)
　As an example of a fourth
[0067]
　If you of the service provider server is in the closed network affects Internet communication between the server and the IDcd authentication server 100 of the service provider, it is likely to be affected, such as network disconnection and congestion.
[0068]
　Therefore, in the fourth embodiment, a pair of challenge and response, holds in advance as a cache in the server of the service provider 400. Thus, with the next authentication service provider 400 and can be completed with the terminal 200, even if the network between the server and the IDcd authentication server 100 of the service provider has been cut, the service provider it can be carried out between 400 and terminal 200.
[0069]
　Figure 17 is a IDcd authentication server 100, the service provider 400, a terminal 200, is a flow diagram showing the IC card 300, an operation example of.
[0070]
　Terminal 200 is periodically sending polling (step S401). The polling includes Request Service command for acquiring the IDm (IC card 300 specific information) and key version from the IC card 300. IC card 300 receives the polling sent from the terminal 200, returns a IDm and key version to the terminal 200 in response to the Request Service command (step S402).
[0071]
　Terminal 200, terminal ID of its own device and transmits the IDm and key version obtained from the IC card 300 in step S402 to the server of the service provider 400 (step S403). Server of the service provider 400, the terminal ID of the terminal 200 received from the terminal 200, based on the IDm and key version of the IC card 300 selects the authentication key (step S404), the IDcd authentication server 100, received from the terminal 200 the information transferred (step S405).
[0072]
　IDcd authentication server 100, and generates the challenge and response on the basis of the information received from the server of the service provider 400 (step S406). And IDcd authentication server 100 pays out the generated challenge and response to the server of the service provider 400 (step S407). Server of the service provider 400 provides a challenge and response are paid out from IDcd authentication server 100 to the terminal 200 (step S408). Terminal 200 transmits to the IC card 300 Challenge to authenticate the IC card 300 held over (step S409), the IC card 300 returns to the terminal 200 generates a response to the challenge (step S410). Terminal 200 compares the response obtained from the server of the service provider 400, and a response IC card 300 is generated (step S411), performs authentication of the IC card 300 (step S412).
[0073]
　Further the service provider 400 server, to advance acquires the challenge-response for next authentication in the IC card 300, to the IDcd authentication server 100, and transfers the information received from the terminal 200 (step S413). IDcd authentication server 100, and generates the challenge and response on the basis of the information received from the server of the service provider 400 (step S414). And IDcd authentication server 100 pays out the generated challenge and response to the server of the service provider 400 (step S415). Server of the service provider 400, Precache Challenge and Response paid out from the IDcd authentication server 100 (step S416). As a result, it is possible to complete in between the next service provider 400 at the time of certification of the terminal 200 of the IC card 300. This state will be described below.
[0074]
　Terminal 200 is periodically sending polling (step S417). The polling includes Request Service command for acquiring the IDm and key version from the IC card 300. IC card 300 receives the polling sent from the terminal 200, returns a IDm and key version to the terminal 200 in response to the Request Service command (step S418).
[0075]
　Terminal 200, terminal ID of its own device and transmits the IDm and key version obtained from the IC card 300 in step S402 to the server of the service provider 400 (step S419). Server of the service provider 400 selects the authentication key based on the IDm and key version of the terminal ID, IC card 300 of the terminal 200 received from the terminal 200 (step S420). Challenge and server of the service provider 400, to IDcd authentication server 100 during initial authentication, had transferred the information received from the terminal 200, here, it paid out from the IDcd authentication server 100 in advance at step S416 and since the pre-cache the response, and selects a challenge and response from the challenge and the response was the precache (step S421).
[0076]
　Server of the service provider 400 provides a challenge and response selected from the challenge and the response was pre cache to the terminal 200 (step S422). Terminal 200 sends a challenge to the IC card 300 to authenticate the IC card 300 held over (step S423), the IC card 300 returns to the terminal 200 generates a response to the challenge (step S424). Terminal 200 compares the response obtained from the server of the service provider 400, and a response IC card 300 is generated (step S425), performs authentication of the IC card 300 (step S426).
[0077]
　Further the service provider 400 server, to advance acquires the challenge-response for next authentication in the IC card 300, to the IDcd authentication server 100, and transfers the information received from the terminal 200 (step S427). IDcd authentication server 100, and generates the challenge and response on the basis of the information received from the server of the service provider 400 (step S428). And IDcd authentication server 100 pays out the generated challenge and response to the server of the service provider 400 (step S429). Server of the service provider 400, Precache Challenge and Response paid out from the IDcd authentication server 100 (step S430).
[0078]
　Thus, at the time of authentication of the IC card 300, using the challenge and response in advance precache the server of the service provider 400, exchanges related to the authentication of the IC card 300 with the service provider 400 and the terminal 200 it can be completed.
[0079]
　Further, at the time of authentication of the IC card 300, using the challenge and response in advance precache the server of the service provider 400, if there is a problem with the communication between the server and the IDcd authentication server 100 of the service provider 400 , even if you can not transfer the data correctly, it is possible to authenticate the IC card 300.
[0080]
　Figure 18 is a IDcd authentication server 100, the service provider 400, a terminal 200, is a flow diagram showing the IC card 300, an operation example of.
[0081]
　Terminal 200 is periodically sending polling (step S431). The polling includes Request Service command for acquiring the IDm and key version from the IC card 300. IC card 300 receives the polling sent from the terminal 200, returns a IDm and key version to the terminal 200 in response to the Request Service command (step S432).
[0082]
　Terminal 200, terminal ID of its own device and transmits the IDm and key version obtained from the IC card 300 in step S402 to the server of the service provider 400 (step S433). Server of the service provider 400 selects the authentication key based on the IDm and key version of the terminal ID, IC card 300 of the terminal 200 received from the terminal 200 (step S434). Subsequently, the server of the service provider 400 to IDcd authentication server 100, but to transfer the information received from the terminal 200, there is a problem where the communication between the server and the IDcd authentication server 100 of the service provider 400, the state can not exchange data normally has occurred. Then the server of the service provider 400 performs the selection of the challenge and the response from the challenge and response, which was pre-pre-cache (step S435).
[0083]
　Server of the service provider 400 provides a challenge and response selected from the challenge and the response was pre cache to the terminal 200 (step S436). Terminal 200 sends a challenge to the IC card 300 to authenticate the IC card 300 held over (step S437), the IC card 300 returns to the terminal 200 generates a response to the challenge (step S438). Terminal 200 compares the response obtained from the server of the service provider 400, and a response IC card 300 is generated (step S439), performs authentication of the IC card 300 (step S440).
[0084]
　Thus, at the time of authentication of the IC card 300, using the challenge and response in advance precache the server of the service provider 400, if a communication problem between the server and the IDcd authentication server 100 of the service provider 400 There are, even if you can not transfer the data correctly, it is possible to authenticate the IC card 300.
[0085]
　Thereafter, when the communication between the server and the IDcd authentication server 100 of the service provider 400 is restored, the server of the service provider 400, removes the challenge and the response was pre-cache, also, a new challenge from the IDcd authentication server 100 and the response may be acquired.
[0086]
　The server of the service provider 400, the challenge and response which precache may be deleted when a predetermined time has elapsed. As a result, it is possible not to use to authenticate too old challenge and response. For example, the server of the service provider 400 may delete the challenge and the response was regularly pre-cache. The server of the service provider 400 may delete the challenge and response which precache Once at the prescribed timing.
[0087]
　For example, a train or a bus, if you want to use the authentication by the IC card 300 at the time of boarding of transportation such as airplanes, server of the service provider 400, be allowed to pre-cache the only challenge and response reserved in advance the number of people good. Then, the server of the service provider 400, the challenge and the response was pre-cache, it may be deleted at the time of past the departure time. Therefore, IDCD authentication server 100, when generating a challenge and response, may be added to information of the expiration date. In addition, the server of the service provider 400, the challenge and response at the time of pre-cache, may be added to the information of the expiration date.
[0088]
　Thus, the server of the service provider 400 can implement authentication with the IC card 300 without performing the communication between the IDcd authentication server 100. Furthermore the server of the service provider 400, there is no need, by deleting the challenges and responses were precache prevent outflow of challenges and responses, it is possible to improve the security.
[0089]
　(Example 5)
　As an example of a fifth,
[0090]
　The explosive growth of communication devices that can be connected to the Internet, E-commerce payments and via the Internet, the settlement of a terminal with a portable capable mPOS settlement has become widespread. Card authentication and user authentication is being strictly determined by the EMV specification, for transaction authorization is in the stage of organizing developing, and the Internet browser to be used in the settlement, the place to be dependent on the reliability of the terminal to run the mPOS settlement It is large.
[0091]
　Therefore, when the side on which the settlement had gone unauthorized, such as to change the settlement amount maliciously, there is a risk that given the damage to the side to be settled. For example, going to the shopping for 1,000 yen by using the mPOS terminal, an example that becomes a settlement of 10,000 yen is considered in practice. Figure 19 is a side that settlement is an explanatory diagram showing how to change the payment amount by the unauthorized. In fact, has been shopping for 1,000 yen, on the user or by pressing the acknowledge button to confirm the settlement amount, and to input the predetermined security code, of 1000 yen if Kazase the card to the reader-writer the settlement is carried out. However, if you've set the settlement amount at 10,000 yen on the side of the settlement is in fact, as the transaction information to be sent from the store to the settlement server becomes a transaction of 10,000 yen, the settlement server (service provider 400 settlement of the server), the 10,000 yen will be carried out.
[0092]
　Therefore, the following description will be given about how that can prevent such fraud. Figure 20 is an explanatory view showing a mechanism for the purpose of preventing the incorrect side to settle.
[0093]
　For example, when the 1000 yen, MPOS terminal date and purchase amount to the bar-coded, after hashing the bar code information, and transmits to the IC card 300 Authentication1 command from the reader-writer (terminal 200). Buyer product after entering the predetermined security code to mPOS terminal, holds the IC card 300 to the reader writer (terminal 200). Thus, IC card 300 generates a response corresponding to Authentication1 command.
[0094]
　After that, the purchaser of the goods in order to pay actually the price, to settle the EMV card such as a credit card with, for example, the non-contact communication function is held up to the reader writer. Here, when the side on which the settlement is carried out illegally, such as to change the settlement amount maliciously to 10,000 yen, the settlement amount of the transaction information is sent to the settlement server is 1 million. However, at the time of authentication in advance using the IC card 300, because the response has been generated for that shopping for 1,000 yen, the settlement server, by matching the response and transaction information, can be detected in the settlement amount disagreement to become. It should be noted that, rather than a settlement server to match the response to the transaction information, IDcd authentication server 100 may be executed. If IDcd authentication server 100 collates the transaction information and the response, the payment server, the IDcd receives the verification result of the authentication server 100 executes the settlement process if the determination that payment amount matches has been made It will be.
[0095]
　(Example 6)
　As an example of a sixth,
[0096]
　Usually, when performing remittance transactions between individuals, intervention equipment such common settlement server and transaction server in financial institutions each individual use was required. However, due to the increase of the communication device connectable to the Internet, to improve convenience of the settlement via the Internet, safe and simple transfer techniques are required with it.
[0097]
　Therefore, the authentication by the IC card, which has been described above, not only the personal authentication, by so also used to authenticate the transaction content, also have different settlement server and transaction server in the financial institutions that each of the individuals to use , cooperation is possible as a common authentication function in each of the financial institutions.
[0098]
　Figure 21 is an explanatory diagram for explaining a transfer process between individuals using the IC card authentication. Here, a description will be given remittance processing when remitting 1000 yen from the first user to the second user. Terminal 200 of the first user, the IC card 300 of the first user, transmits a challenge including a hash of the transaction information. IC card 300 of the first user generates the response to the challenge received from the terminal 200 of the first user. This is the response includes the signature of the transaction information that the first user to transfer the 1000 yen to the second user. Then, the terminal 200 of the first user, to the terminal 200 of the second user, and transmits a response IC card 300 of the first user generated.
[0099]
　Terminal 200 of the second user receives the response IC card 300 of the first user generated to the IC card 300 of the second user is included in the response, the first user IC card 300 signatures to send a hash of marked with transaction information as a challenge. IC card 300 of the second user generates a response to the challenge received from the terminal 200 of the second user. This is the response includes the signature of the transaction information that the first user to transfer the 1000 yen to the second user. Then, the terminal 200 of the second user to the settlement server, sends a response IC card 300 of the second user-generated.
[0100]
　Settlement server (server of the service provider 400) receives a response IC card 300 of the first user of the IC card 300 is generated response and the second user-generated. Settlement server transmits both the response to IDcd authentication server 100. IDcd authentication server 100, to match the two of response received from the settlement server, perform the confirmation of the authenticity of the two IC card 300, confirmation and the validity of the signature of the transaction information, the. It should be noted, IDcd authentication server 100, and the confirmation of the authenticity of the IC card 300 only, perform, and the confirmation of the validity of the signature of the transaction information, is not concerned with the contents of the transaction information. Then IDcd authentication server 100, if it is confirmed that the two response received from the payment server is valid, relative to the settlement server, a message to allow transfer from a first user to a second user send. Settlement server, the remittance and a message to the effect that to allow the remittance from the first user to a second user received from the IDcd authentication server 100, from the first user of the account 1000 yen to the second user's account process to run.
[0101]
　Through a series of these processes, safe and convenient money transfer between individuals using the IC card authentication can be performed.
[0102]
　<2. Summary>
　According to this embodiment of the present disclosure has been described and illustrated, but also online, the IC card that is intended to be available offline, when diverted to form holding the value to the server, secure IC it is possible to provide a IDcd authentication server 100 capable of performing the authentication of the card.
[0103]
　Each step in the process of the device herein is performed, not necessarily performed in time series along the order described in the sequence diagrams or flowchart. For example, each step in the processing of each device is executed may be processed in an order different from that described in the flowchart, it may be processed in parallel.
[0104]
　Further, CPU incorporated in the device, the hardware such as ROM and RAM, a computer program for exhibiting the structure and function equivalent of the apparatus described above can also be created. The storage medium storing the computer program can also be be provided. Furthermore, each functional block shown in the functional block diagram are configured in hardware, thereby realizing a series of processes by hardware.
[0105]
　Incidentally, in the embodiments described above showed an IC card, IC card may be a portable terminal such as a smartphone with an IC chip having a contactless communication function.
[0106]
　Having described in detail preferred embodiments of the present disclosure with reference to the accompanying drawings, the technical scope of the present disclosure is not limited to such an example. It would be appreciated by those skilled in the art of the present disclosure, within the scope of the technical idea described in the claims, it is intended to cover various modifications, combinations, these for it is also understood to belong to the technical scope of the present disclosure.
[0107]
　The effects described herein are not limiting be those that only illustrative or exemplary. In other words, the technology according to the present disclosure, together with the above effects, or instead of the above effects, can exhibit the apparent other effects to those skilled in the art from the description herein.
[0108]
　Also within the scope of the present disclosure the following configurations.
(1)
　and a providing unit that provides authentication data for authentication of the wireless communication device to a terminal that performs proximity non-contact communication with the radio communication apparatus equipped with an IC chip,
　from the terminal, the authentication data of including the number of times of use, an acquisition unit, wherein acquiring the data received by the proximity non-contact communication between the wireless communication device,
　performs authentication of the wireless communication device using said authentication data and said received data an authentication unit,
comprising a server.
(2)
　the providing unit is configured prior to the authentication of the wireless communication device, providing a plurality of the authentication data in advance to the terminal, the server according to (1).
(3)
　the authentication data which the provider provides is the last one authentication is generated based on the authentication data when performed, according to (1) or (2) the server.
(4)
　The providing unit, and the challenge of providing from the at the time of authentication of the authentication subject to wireless communication device of the terminal to the wireless communication device, and a response to be sent back from the wireless communication device in response to the challenge to the terminal set, and provides to the terminal prior to authentication of the wireless communication device, the server according to any one of (1) to (3) of the.
(5)
　The authentication unit includes a first reception data from the first wireless communication device, the second received data with the first wireless communication device and the second wireless using from the second wireless communication device authenticating the communication device, the server according to any one of (1) to (4).
(6)
　said authentication unit, based on the authentication result of the first wireless communication device and the second wireless communication device, with the user of the first user and the second wireless communication device of a wireless communication device determining whether remittance processing between, according to (5) server.
(7)
　The authentication unit is configured by using the received data from the radio communication device, and the transaction data, and to check the authenticity of the transaction data, according to any one of (1) to (4) of the server.
(8)
　The wireless communication device is an IC card with a built-in IC chip, according to any one of (1) to (7) server.
(9)
　The wireless communication device is a portable terminal with a built-in IC chip, according to any one of (1) to (7) server.
(10)
　provides to the terminal to perform proximity non-contact communication with the radio communication apparatus having an IC chip, the authentication data for authentication of the wireless communication device, obtained from device to generate the authentication data and, cache prior said authentication data acquired to provide to the terminal, the server.
(11)
　when said terminal to authenticate the wireless communication device, providing the authentication data cache to the terminal, the server according to (10).
(12)
　when the authentication of the wireless communication device, in a case can not communicate with the device, providing the authentication data cache to the terminal, according to (11) server.
(13)
　deletes the authentication data cached at a predetermined timing, according to (10) server.
(14)
　said deletes the authentication data cache when the expiration date of the authentication data has elapsed as the predetermined timing, according to (13) server.
(15)
　When communication with the device as the predetermined timing is restored to delete the authentication data cache, according to (13) server.
(16)
　said wireless communication device is an IC card with a built-in IC chip, according to any one of (10) to (15) server.
(17)
　said wireless communication device is a portable terminal with a built-in IC chip, according to any one of (10) to (15) server.
(18)
　and to provide authentication data for authentication of the wireless communication device to a terminal that performs proximity non-contact communication with the radio communication apparatus equipped with an IC chip,
　from the terminal, the authentication data including use count, and obtaining a received data received by the proximity non-contact communication between the wireless communication device,
　And performing the authentication of the wireless communication device using said authentication data and the reception data
including the authentication method.
(19)
　and a wireless communication apparatus having an IC chip,
　and a terminal performing proximity non-contact communication with the wireless communication device,
　a server that provides authentication data for authentication of the wireless communication device to the terminal When,
　with a
　said server,
　a providing unit for providing said authentication data,
　from the terminal, including the number of uses of the authentication data, the received data received by the proximity non-contact communication between the wireless communication device an acquisition unit for acquiring, with
　an authentication unit that performs authentication of the wireless communication device using said authentication data and said received data
comprises an authentication system.
DESCRIPTION OF SYMBOLS
[0109]
　100 IDcd authentication server
　200 terminal
　300 IC card

The scope of the claims
[Requested item 1]
　A providing unit that provides authentication data for authentication of the wireless communication device to a terminal that performs proximity non-contact communication with the radio communication apparatus equipped with an IC chip,
　from the terminal, the number of times of use of the authentication data including an acquisition unit that acquires data received by the proximity non-contact communication between the wireless communication device,
　said authenticating unit and authentication data using said received data to authenticate the wireless communication device ,
equipped with a server.
[Requested item 2]
　The providing unit, prior to the authentication of the wireless communication device, provides to the terminal a plurality of the authentication data in advance, the server according to claim 1.
[Requested item 3]
　The authentication data is the last one authentication is generated based on the authentication data when performed, according to claim 1 server the provider provides.
[Requested item 4]
　The providing unit, and the challenge of providing from the at the time of authentication of the wireless communication device that is authenticated is terminal to the wireless communication device, a set of the response to be replied from the wireless communication device to said terminal in response to the challenge , provided to the terminal prior to authentication of the wireless communication device, server of claim 1.
[Requested item 5]
　The authentication unit includes a first reception data from the first wireless communication device, the second received data with the first wireless communication device and the second wireless using from the second wireless communication device authenticate communication device, server of claim 1.
[Requested item 6]
　Wherein the authentication unit, transfer between the first based on the authentication result of the wireless communication device and the second wireless communication device, the first user of the user and the second wireless communication device of a wireless communication device determining whether processing server according to claim 5.
[Requested item 7]
　The authentication unit includes a reception data from the wireless communication device, using the transaction data, and said to check the authenticity of the transaction data server of claim 1.
[Requested item 8]
　The wireless communication device is an IC card with a built-in IC chip of claim 1 server.
[Requested item 9]
　The wireless communication device is a portable terminal with a built-in IC chip of claim 1 server.
[Requested item 10]
　Providing to the terminal to perform proximity non-contact communication with the radio communication apparatus having an IC chip, the authentication data for authentication of the wireless communication device obtains from the device for generating the authentication data, acquired cache prior said authentication data to provide to the terminal, the server.
[Requested item 11]
　When the terminal authenticating the wireless communication device, providing the authentication data cache to the terminal server of claim 10.
[Requested item 12]
　Wherein when the authentication of the wireless communication device, in a case can not communicate with the device, providing the authentication data cache to the terminal server of claim 11.
[Requested item 13]
　Remove the authentication data cached at a predetermined timing, according to claim 10 server.
[Requested item 14]
　Remove the authentication data cache when the expiration date of the authentication data has elapsed as the predetermined timing, according to claim 13 server.
[Requested item 15]
　Remove the authentication data cache when the communication with the device is restored as a predetermined timing, according to claim 13 server.
[Requested item 16]
　The wireless communication device is an IC card with a built-in IC chip of claim 10 server.
[Requested item 17]
　The wireless communication device is a portable terminal with a built-in IC chip of claim 10 server.
[Requested item 18]
　And providing authentication data for authentication of the wireless communication device to a terminal that performs proximity non-contact communication with the radio communication apparatus equipped with an IC chip,
　from the terminal, the number of uses of the authentication data inclusive, and obtaining a received data received by the proximity non-contact communication, between the wireless communication device
　, and to perform authentication of the wireless communication device using the authentication data and the received data
including , authentication method.
[Requested item 19]
　A wireless communication device including an IC chip,
　and a terminal performing proximity non-contact communication with the wireless communication device,
　a server that provides authentication data for authentication of the wireless communication device to the terminal,
　the provided,
　wherein the server,
　the providing unit for providing said authentication data,
　from the terminal, including the number of uses of the authentication data, and acquires the data received by the proximity non-contact communication between the wireless communication device an acquisition unit,
　an authentication unit for authenticating the wireless communication device using said authentication data and said received data
comprises an authentication system.