Card issuing system, card issuing server, card issuing method and program

• US 8,433,908 B2
• Filed: 02/18/2009
• Issued: 04/30/2013
• Est. Priority Date: 03/03/2008
• Status: Active Grant

• Current Assignee: FeliCa Networks, Inc
• Original Assignee: FeliCa Networks, Inc
• Inventors: Hataoka, Jun, Hikita, Tomoharu
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Jamshidi, Ghodrat
• Application Number:
  US12/388,117
• Publication Number:
  US 20090222662A1
• Time in Patent Office: 1,532 Days
• Field of Search: 726/9, 726/10
• US Class Current: 713/169
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3558 Preliminary personalisation for transfer to user
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

The present invention provides a service providing server including an authentication ticket creating unit for encrypting access authentication information and creating an authentication ticket, and an authentication ticket transmitting unit for transmitting the authentication ticket to a card issuing server; where the card issuing server includes an authentication ticket verifying unit for decrypting the authentication ticket and verifying the authentication ticket, a verification result notifying unit for notifying the verification result of the authentication ticket to the service providing server, a connection information transmitting unit for transmitting connection information for connecting to the card issuing server to the service providing server along with the verification result of the authentication ticket, and an authentication information verifying unit for comparing and verifying the access authentication information of the authentication ticket and access authentication information stored in the IC chip of the information processing terminal.

Claims

1. A card issuing system, including:

an information processing terminal which is equipped with an IC chip, and

a service providing server and a card issuing server which are connectable to the information processing terminal via a network, wherein

the service providing server includes

an authentication ticket creating unit configured to encrypt access authentication information, for authenticating access by the information processing terminal, to create an authentication ticket, and

an authentication ticket transmitting unit configured to transmit the authentication ticket created by the authentication ticket creating unit to the card issuing server,

the card issuing server includes

an authentication ticket verifying unit configured to decrypt the authentication ticket transmitted by the authentication ticket transmitting unit, and verify the authentication ticket,

a verification result notifying unit configured to notify the service providing server of a verification result of the authentication ticket verified by the authentication ticket verifying unit,

a connection information transmitting unit configured to transmit to the service providing server connection information for connecting to the card issuing server along with the verification result of the authentication ticket,

an IC card accessing unit configured to receive access authentication information from the IC chip after a transmission of the connection information, and

an authentication information verifying unit configured to compare and verify the access authentication information of the authentication ticket and the access authentication information received from the IC chip of the information processing terminal, and

the information processing terminal includes

a connecting unit configured to connect to the card issuing server based on the connection information, and

an authentication information storage unit configured to store the access authentication information received by the IC card accessing unit, the authentication information storage unit being disposed in the IC chip.

2. A card issuing server connectable to an information processing terminal equipped with an IC chip and to a service providing server via a network, wherein the service providing server encrypts access authentication information, for authenticating access by the information processing terminal, to create an authentication ticket, the card issuing server comprising:

an authentication ticket receiving unit configured to receive the authentication ticket created by the service providing server;

an authentication ticket verifying unit configured to decrypt the authentication ticket received by the authentication ticket receiving unit, and verify the authentication ticket;

a verification result notifying unit configured to notify the service providing server of a verification result of the authentication ticket verified by the authentication ticket verifying unit;

a connection information transmitting unit configured to transmit to the service providing server connection information for connecting to the card issuing server along with the verification result of the authentication ticket;

an IC card accessing unit configured to receive access authentication information from the IC chip after a transmission of the connection information; and

an authentication information verifying unit configured to compare and verify the access authentication information of the authentication ticket and the access authentication information received from the IC chip of the information processing terminal.

3. The card issuing server according to claim 2, wherein the service providing server adds an electronic signature to the access authentication information for authenticating access by the information processing terminal using an authentication private key, and creates the authentication ticket, and the authentication ticket verifying unit verifies the electronic signature added to the authentication ticket using an authentication public key which corresponds to the authentication private key.

4. The card issuing server according to claim 2, wherein the card issuing server is connected to a service acting server configured to act for the service providing server via the network, the service providing server encrypts information of a service licensed to the service acting server and creates an authentication license, the service acting server adds to the authentication license the access authentication information for authenticating access by the information processing terminal, and encrypts to create the authentication ticket,

the card issuing server further comprising:

an authentication license acquiring unit configured to decrypt the authentication ticket, and acquire the authentication license; and

an authentication license verifying unit configured to decrypt the authentication license acquired by the authentication license acquiring unit, and verify the authentication license, and

the authentication ticket verifying unit verifies the authentication ticket based on the authentication license verified by the authentication license verifying unit.

5. The card issuing server according to claim 4, wherein the service providing server adds a first electronic signature to user authentication information using a first authentication private key to create the authentication license, the service acting server adds the access authentication information for authenticating access by the information processing terminal to the authentication license, and further adds a second electronic signature using a second authentication private key to create the authentication ticket, the authentication license verifying unit verifies the first electronic signature added to the authentication license using a first authentication public key which corresponds to the first authentication private key, and the authentication ticket verifying unit verifies the second electronic signature added to the authentication ticket using a second authentication public key which corresponds to the second authentication private key included in the authentication license verified by the authentication license verifying unit.

6. The card issuing server according to claim 2, wherein the access authentication information for authenticating access by the information processing terminal includes at least process information used by the information processing terminal, identification information of the IC chip, and issuing source information of the IC chip.

7. The card issuing server according to claim 2, wherein the access authentication information for authenticating access by the information processing terminal includes write judgment information for determining whether it is possible to write to the IC chip, and the authentication information verifying unit determines a writing to the IC chip based on the write judgment information.

8. The card issuing server according to claim 2, wherein the access authentication information for authenticating access by the information processing terminal includes control information of a device allowed to write data to the IC chip or to use data written to the IC chip.

9. The card issuing server according to claim 2, further comprising:

a challenge response authentication unit configured to authenticate the service providing server by a challenge response authentication.

10. The card issuing server according to claim 9, wherein the challenge response authentication unit authenticates the service providing server by the challenge response authentication.

11. The card issuing server according to claim 2, further comprising:

an access status notifying unit configured to notify an access status to the IC chip of the information processing terminal in response to a request of the service providing server.

12. The card issuing server according to claim 11, wherein the access status notifying unit includes an access authentication information transmitting unit configured to transmit the access authentication information received from the IC chip to the service providing server in response to a request of the service providing server.

13. A card issuing system, comprising:

an information processing terminal which is equipped with an IC chip; and

a service providing server and a card issuing server which are connectable to the information processing terminal via a network, wherein

the service providing server includes

an authentication ticket creating unit configured to encrypt access authentication information, for authenticating access by the information processing terminal, to create an authentication ticket, and

an authentication ticket transmitting unit configured to transmit the authentication ticket created by the authentication ticket creating unit to the information processing terminal,

the information processing terminal includes

an authentication ticket transmitting unit configured to transmit to the card issuing server the authentication ticket transmitted by the authentication ticket transmitting unit included in the service providing server, and

the card issuing server includes

an authentication ticket verifying unit configured to decrypt the authentication ticket transmitted by the authentication ticket transmitting unit included in the information processing terminal, and verify the authentication ticket,

a verification result notifying unit configured to notify the information processing terminal of a verification result of the authentication ticket verified by the authentication ticket verifying unit,

a connection information transmitting unit configured to transmit to the information processing terminal connection information for connecting to the card issuing server along with the verification result of the authentication ticket,

an IC card accessing unit configured to receive access authentication information from the IC chip after a transmission of the connection information, and

an authentication information verifying unit configured to compare and verify the access authentication information of the authentication ticket and the access authentication information received from the IC chip of the information processing terminal.

14. A card issuing server connectable to an information processing terminal equipped with an IC chip and to a service providing server via a network, wherein the service providing server encrypts access authentication information, for authenticating access by the information processing terminal, to create an authentication ticket, the card issuing server comprising:

an authentication ticket receiving unit configured to receive the authentication ticket created by the service providing server through the information processing terminal;

an authentication ticket verifying unit configured to decrypt the authentication ticket received by the authentication ticket receiving unit, and verify the authentication ticket;

a verification result notifying unit for notifying the information processing terminal of a verification result of the authentication ticket verified by the authentication ticket verifying unit;

a connection information transmitting unit configured to transmit to the information processing terminal connection information for connecting to the card issuing server based on the verification result of the authentication ticket;

a communication control unit configured to connect to the information processing terminal after a transmission of the connection information; and

an authentication information verifying unit configured to compare and verify the access authentication information of the authentication ticket and access authentication information stored in the IC chip of the information processing terminal.

15. A card issuing system, comprising:

an information processing terminal which is equipped with an IC chip; and

a service providing server, a service acting server and a card issuing server which are connectable to the information processing terminal via a network, wherein

the service providing server includes

an authentication license creating unit configured to encrypt information of a service licensed to the service acting server, and create an authentication license, and

an authentication license transmitting unit configured to transmit the authentication license created by the authentication license creating unit to the service acting server,

the service acting server includes

an authentication ticket creating unit configured to add access authentication information for authenticating an access by the information processing terminal to the authentication license transmitted by the authentication license transmitting unit, and encrypt to create an authentication ticket, and

an authentication ticket transmitting unit configured to transmit the authentication ticket created by the authentication ticket creating unit to the card issuing server, and

the card issuing server includes

an authentication license acquiring unit configured to decrypt the authentication ticket transmitted by the authentication ticket transmitting unit, and acquire the authentication license,

an authentication license verifying unit configured to decrypt the authentication license acquired by the authentication license acquiring unit, and verify the authentication license, an authentication ticket verifying unit configured to verify the authentication ticket based on the authentication license verified by the authentication license verifying unit, and

a communication control unit configured to connect to the information processing terminal based on a verification of the authentication ticket.

16. A card issuing method realized by using an information processing terminal which is equipped with an IC chip, and a service providing server and a card issuing server which are connectable to the information processing terminal via a network, the method comprising:

by the service providing server,

encrypting access authentication information for authenticating an access by the information processing terminal, to create an authentication ticket; and

transmitting the authentication ticket to the card issuing server, by the card issuing server,

decrypting the authentication ticket transmitted by the service providing server, and verifying the authentication ticket;

notifying the service providing server of a verification result of the verified authentication ticket;

transmitting to the service providing server connection information for connecting to the card issuing server along with the verification result of the authentication ticket;

receiving access authentication information from the IC chip after the transmitting; and

comparing and verifying the access authentication information of the authentication ticket and the access authentication information received from the IC chip of the information processing terminal; and

by the information processing terminal, connecting to the card issuing server based on the connection information.

17. A card issuing method realized by using an information processing terminal which is equipped with an IC chip, and a service providing server and a card issuing server which are connectable to the information processing terminal via a network, the method comprising:

by the service providing server,

encrypting access authentication information, for authenticating an access by the information processing terminal, to create an authentication ticket; and

transmitting the authentication ticket to the information processing terminal;

by the information processing terminal, transmitting the authentication ticket transmitted by the service providing server to the card issuing server; and

by the card issuing server,

decrypting the transmitted authentication ticket, and verifying the authentication ticket;

notifying the information processing terminal of a verification result of the verified authentication ticket;

transmitting to the information processing terminal connection information for connecting to the card issuing server along with the verification result of the authentication ticket;

receiving access authentication information from the IC chip after the transmitting; and

comparing and verifying the access authentication information of the authentication ticket and the access authentication information received from the IC chip of the information processing terminal.

18. A card issuing method realized by using an information processing terminal which is equipped with an IC chip, and a service providing server, a service acting server and a card issuing server which are connectable to the information processing terminal via a network, the method comprising:

by the service providing server,

encrypting information of a service licensed to the service acting server, and creating an authentication license; and

transmitting the authentication license to the service acting server,

by the service acting server,

adding to the transmitted authentication license access authentication information for authenticating an access by the information processing terminal, and encrypting to create an authentication ticket; and

transmitting the authentication ticket to the card issuing server; and

by the card issuing server,

decrypting the authentication ticket, and acquiring the authentication license;

decrypting the acquired authentication license, and verifying the authentication license;

verifying the authentication ticket based on the verified authentication license; and

connecting to the information processing terminal based on the verifying the authentication ticket.

19. A non-transitory computer-readable storage medium encoded with a program for causing a computer to perform a method as a card issuing server connectable to an information processing terminal mounted with an IC chip and to a service providing server via a network, wherein the service providing server encrypts access authentication information, for authenticating an access by the information processing terminal, to create an authentication ticket, and the method comprises:

receiving the authentication ticket created by the service providing server,

decrypting the authentication ticket received by the receiving, and verifying the authentication ticket,

notifying the service providing server of a verification result of the authentication ticket verified by the verifying,

transmitting to the service providing server connection information for connecting to the card issuing server along with the verification result of the authentication ticket,

receiving access authentication information from the IC chip after the transmitting, and

comparing and verifying the access authentication information of the authentication ticket and the access authentication information received from the IC chip of the information processing terminal.

20. The storage medium according to claim 19, wherein the card issuing server is connected to a service acting server configured to act for the service providing server via the network, the service providing server encrypts information of a service licensed to the service acting server and creates an authentication license, the service acting server adds to the authentication license access authentication information for authenticating an access by the information processing terminal, and encrypts to create the authentication ticket,

the method further comprises

decrypting the authentication ticket, and acquiring the authentication license, and

decrypting the authentication license acquired by the acquiring, and verifying the authentication license, and

the verifying includes verifying the authentication ticket based on the authentication license.

21. A non-transitory computer-readable storage medium encoded with a program for causing a computer to perform a method as a card issuing server connectable to an information processing terminal equipped with an IC chip and a service providing server via a network, wherein the service providing server encrypts access authentication information, for authenticating an access by the information processing terminal, to create an authentication ticket, and the method comprises:

receiving the authentication ticket created by the service providing server through the information processing terminal,

decrypting the authentication ticket received by the receiving, and verifying the authentication ticket,

notifying the information processing terminal of a verification result of the authentication ticket verified by the verifying,

transmitting to the information processing terminal connection information for connecting to the card issuing server based on the verification result of the authentication ticket;

connecting to the information processing terminal after the transmitting; and

comparing and verifying the access authentication information of the authentication ticket and access authentication information stored in the IC chip of the information processing terminal.