WO2003060789A1

WO2003060789A1 - Method for confirming web electronic transanction and method for acquiring credit card information

Info

Publication number: WO2003060789A1
Application number: PCT/JP2002/000093
Authority: WO
Inventors: Kazuhiro Hayashi; Hisanaga Makino
Original assignee: Wireaction Inc.
Priority date: 2002-01-10
Filing date: 2002-01-10
Publication date: 2003-07-24
Also published as: AU2002219584A1

Abstract

A browser (10a) of a user terminal (10) reads an order processing/confirming instruction program (60a) contained in a commodity order Web page, and according to the program, transmits an order processing request along with a transaction ID information and user identification information to a Web site (60) and transmits a transaction confirmation request along with the transaction ID information and user identification information to a transaction confirmation server (30). The server of the Web site carries out an order acceptance processing according to the received transaction ID information, user identification information, and order processing request and transmits the transaction ID information and user identification information to the transaction confirmation server. The transaction confirmation server judges whether or not the transaction ID information and user identification information received from the server of the Web site agree with those received from the prowser. If it judges that they agree, it acquires information on the credit card of the user from a credit card information storage means (31) and transmits it to a settling means (32).

Description

Details

Transaction confirmation in WEB electronic commerce Credit card acquisition method

Technical field

The present invention relates to a web browser including a transaction confirmation / credit card information acquisition method in a web electronic commerce, a transaction confirmation server, a transaction confirmation server program, an order processing 'confirmation instruction program, a user authentication program, and a user authentication program. Things.

^ Scenic technology

Today, various web site services are deployed on the Internet, and many of the web pages require input of user's personal information. For example, on an EC (Electronic Commerce) site where consumers shop, a form for entering the name and address of the consumer, a telephone number, etc. is used to specify the destination of the purchased product. Fill out the web page. It is very troublesome to input various kinds of personal information into the personal information required web page.

Therefore, it is conceivable to store personal information that has been entered once for each Web site, and then automatically enter it the next time the same user enters personal information. However, at least at the time of initial entry for each Web site, the user must enter the information himself. Also, since it is not often that personal information is repeatedly input to the same Web site page, the convenience for users is not high.

As another method, personal information is registered in a personal information management server provided on the Internet and stores in advance the personal information of a large number of users, and the user inputs the personal information to a website. At the time, the "Web site It is conceivable that the server automatically obtains personal information from the personal information management server via the Internet. However, even in such a method, the user himself / herself needs to input at least once to the personal information management server.

There is another problem with the automatic input of personal information as described above. In general, information flowing through the Internet network is easily leaked, so the Internet world has lower security in terms of personal information protection than the communication range consisting only of dial-up lines or dedicated lines for continuous connection. .

In particular, when purchasing a product or service on an EC site, the user often enters information about the credit card (credit card company, password, expiration date, etc.). It is troublesome to input such credit card information on the web page every time a product is ordered. However, as in the two automatic input methods described above, an EC site on the Internet and a personal information management service It should be avoided as much as possible, since it is highly likely that damages such as unauthorized shopping due to leakage of credit card information will occur.

In addition, payment for products ordered on the EC site is often performed separately by financial institutions, such as credit companies. In such a case, the credit card information entered on the EC site product order web page is transmitted not only through the EC site but also through the Internet, etc., and stored in the payment institution system Therefore, the possibility of leakage is even higher.

Therefore, the present invention does not require a user to input his / her credit strength information in web electronic commerce, and furthermore, the transaction confirmation in web electronic commerce that can reliably prevent the leakage of credit card information. 'The purpose is to provide a credit card information acquisition method.

Also, it is possible to reliably prevent another person who has acquired credit card information illegally by any means from purchasing the product by impersonating the user. eb Transaction confirmation in electronic commerce · The purpose is to provide a method for obtaining credit card information.

Disclosure of the invention

In order to achieve the above object, in a first mode according to the present invention, a step of displaying a product order Web page screen of an electronic commerce Web site on a user terminal in response to a user access request, A step in which the web browser of the user terminal reads the order processing / confirmation instruction program included in the source program of the product order web page, and a step in which the web browser executes the read order processing / confirmation instruction program. Transmitting an order processing request to the web site together with transaction ID information specifying each electronic commerce and user identification information specifying each user; and the web browser reads the Based on the order processing and confirmation instruction program, the transaction confirmation server sends the transaction ID information identifying each electronic commerce transaction and the individual user. Transmitting a transaction confirmation request together with the user identification information for identifying the user; and the Web site server receives the transaction ID information and the user identification information and performs order processing based on the order processing request. The server transmitting the transaction ID information and the user identification information to the transaction confirmation server; andthe transaction confirmation server receiving the transaction from the web browser of the user terminal. Determining whether or not the ID information and the user identification information match the transaction ID information and the user identification information received from the web site server; and If it is determined that the credit card information of the user registered in advance without going through the Internet, A step of acquiring the credit card information of the user from the stored credit card information storage means and transmitting the credit card information to the payment processing means. You. According to the first embodiment of the present invention, there is no need for the user to input credit card information by himself, and there is no need to input credit card information to the Web site. Since the transaction confirmation server retrieves the credit card information from the credit card storage means registered without going through the Internet and passes it to the settlement processing means, the leakage of the credit card information can be reliably prevented. Further, the transaction confirmation server has a transaction confirmation function of confirming that the electronic commerce is indeed by the user himself by using the coincidence of the transaction ID information and the user recognition information. It is also possible to reliably prevent another person who has illegally acquired credit card information from purchasing a product by impersonating the user.

In the first embodiment, the transaction ID information may be Web site ID information for specifying the electronic commerce Web site. Further, when the Web browser of the user terminal transmits the Web site ID information and the user recognition information together with the transaction confirmation request to the transaction confirmation server, the Web browser of the electronic commerce Web site is used. The data may be transmitted via a processing branching unit of the server, which is prohibited from being modified by the web site operator.

In the first embodiment, preferably, the user identification information for specifying each individual user is IP address information assigned to a user terminal, and the credit card information storage means includes It is assumed that user ID information associated with the address information and credit force information of the user corresponding to the user ID information are stored. In this way, when a user establishes a PPP (Point to Point Protocol) connection via dial-up to the Internet via an Internet service provider, a dynamic IP address that is randomly assigned for each connection By using the IP address of the user as the user identification information, the user authentication can be reliably performed, and the user can be protected by impersonation. Unauthorized acquisition of personal information can be reliably prevented.

Alternatively, in the first embodiment, the user identification information for specifying the individual user is user terminal number information assigned to a user terminal, and the credit card information storage means includes the user terminal The user ID information associated with the number information and the credit card information of the user corresponding to the user ID information may be stored. In this way, when a user is connected to the Internet via a dedicated line for constant connection via an Internet service provider, user terminal number information that differs for each user terminal is used. By using the information as recognition information, user authentication can be reliably performed, and illegal acquisition of personal information of the user due to impersonation or the like can be reliably prevented. Alternatively, in the first embodiment, the user identification information for identifying each user is number information of a user authentication program installed in a user terminal, and is stored in the credit card information storage unit. May store user ID information associated with the number information of the user authentication program, and credit card information of the user corresponding to the user ID information. In this way, regardless of the user's Internet connection form, user authentication can be performed with the existence of the user authentication program installed on the user terminal. Specifically, the user authentication can be easily performed by using the number information such as the manufacturing serial number of the user authentication program as the user identification information.

Further, in the second mode according to the present invention, a step of displaying a product order web page screen of an electronic commerce web site on a user terminal in response to a user access request, the web browser of the user terminal comprises: Reading the order processing / confirmation command program included in the source program of the product order web page; and reading the order processing / confirmation command program by the web browser. Transmitting a transaction confirmation request to the transaction confirmation server together with the user identification information for identifying each user; and the transaction ID generating means of the tori authorization server, based on the transaction confirmation request, Generating transaction ID information specifying an electronic commerce; and the transaction confirmation server stores the generated transaction ID information in a transaction confirmation information temporary storage unit together with the user identification information received from the web browser. And transmitting the received transaction ID information and the user to the web site based on the read order processing / confirmation instruction program. Transmitting an order processing request together with the identification information; and when the server of the website receives the transaction ID information and the user identification information, Performing an order receiving process based on the order processing request; transmitting a transaction ID information and user identification information to the transaction confirmation server by the web site server; Determining whether the transaction ID information and the user identification information stored in the transaction confirmation information temporary storage means match the transaction ID information and the user identification information received from the server of the website. In the determining step, if it is determined that they match, the transaction confirmation server stores the credit card information of the user registered in advance without going through the Internet. And acquiring the credit card information of the user from the user and transmitting the credit card information to the payment processing means. Kicking trade confirmation, credit card information acquisition method is provided.

According to the second embodiment of the present invention, as in the first embodiment, the user does not need to input credit card information by himself / herself, and also inputs the credit card information to the Web site. There is no need, and the transaction confirmation server retrieves the credit card information from the credit card storage means registered in advance without going through the Internet, and passes it to the settlement processing means. It can be reliably prevented. Further, the transaction confirmation server has a transaction confirmation function for confirming that the electronic commerce is indeed the user by utilizing the coincidence of the transaction ID information and the user identification information. It is also possible to reliably prevent another person who has illegally acquired the credit card information from purchasing the product by impersonating the user. In addition, since the transaction ID information in this embodiment is provided by the transaction confirmation server for each electronic commerce transaction, transaction confirmation can be performed for each transaction in more detail.

According to a third aspect of the present invention, there is provided a transaction confirmation server for performing transaction confirmation * credit card information acquisition in web electronic commerce, wherein a source program of a product order web page from an electronic commerce web site is provided. Receives transaction ID information identifying individual e-commerce and user identification information identifying individual users, sent by the web browser of the user terminal along with the transaction confirmation request based on the confirmation order program included in the And the transaction ID information and user recognition received from the web browser by the web site server together with the order processing request transmitted by the web browser based on the order processing / confirmation instruction program. Receiving information from a server of the web site; and the transaction ID received from a browser of the user terminal. Determining whether the transaction ID information and the user identification information match with the transaction ID information and the user identification information received from the web site server; and Acquiring the credit card information of the user from the credit card information storage means in which the credit card information of the user registered beforehand via the Internet is stored, and transmitting the credit card information to the settlement processing means. It is also possible to realize a transaction confirmation server to execute.

Further, in a fourth mode according to the present invention, there is provided a transaction confirmation server that performs transaction confirmation and credit card information acquisition in web electronic commerce, b Ordering products from the site Order processing included in the source program of the web pageReceiving a transaction confirmation request together with user identification information identifying each user transmitted by the web browser of the user terminal based on the confirmation instruction program The transaction ID generation means of the transaction confirmation server generates transaction ID information specifying the electronic commerce transaction based on the transaction confirmation request, and the generated transaction ID information is transmitted to the web browser. Storing the transaction confirmation information in the temporary storage means together with the user recognition information received from the server, and transmitting the transaction confirmation information to the Web browser; and the order processing transmitted by the Web browser based on the order processing / confirmation instruction program. The transaction ID information and the user identification information received from the web browser by the web site server together with the request. Receiving from the server of the website, transaction ID information and user identification information stored in the transaction confirmation information temporary storage means, and the transaction ID information and user received from the website server. In the step of determining whether or not the recognition information matches, and in the step of determining, if it is determined that they match, the credit card information of the user registered in advance without going through the Internet. It is also possible to realize a transaction confirmation server having a step of acquiring the credit card information of the user from the credit card information storage means in which is stored and transmitting the credit card information to the settlement processing means. Further, in the fifth embodiment according to the present invention, the source program of the product order web page from the electronic commerce web site is provided to the transaction confirmation server that performs transaction confirmation and credit card information acquisition in web electronic commerce. Based on the included order processingconfirmation instruction program, the Web browser of the user terminal sends the transaction confirmation request together with the transaction confirmation request, the transaction ID information identifying each electronic commerce, and the user recognition identifying each user. Receiving the information, and the transaction ID information received by the web site server from the web browser and the user, together with the order processing request transmitted by the web browser based on the order processing / confirmation instruction program. recognition Receiving information from the web site server; the transaction ID information and user identification information received from the browser of the user terminal; and the transaction ID information and user identification received from the web site server. A step of judging whether or not the information matches; and a step of judging, if it is judged that they match, a credit card in which credit card information of a user registered in advance without passing through the Internet is stored. A step of acquiring the credit card information of the user from the information storage means and transmitting the credit card information to the settlement processing means.

In the sixth embodiment according to the present invention, a transaction confirmation server that performs transaction confirmation and credit card information acquisition in web electronic commerce is provided with a source program of a product order web page from an electronic commerce web site. Receiving a transaction confirmation request together with user identification information identifying each user transmitted by the Web browser of the user terminal based on the order processing and confirmation instruction program included in the transaction confirmation server; and a transaction ID generating means of the transaction confirmation server Generating transaction ID information that identifies the electronic commerce based on the transaction confirmation request; and temporarily storing the transaction ID information together with the user identification information received from the web browser. And sending to the web browser, and the web browser executes the order processing / confirmation instruction. A step of receiving from the web site server the transaction ID information and the user identification information received by the web site server from the web browser, together with the order processing request transmitted based on the program; A step of determining whether the transaction ID information and the user identification information stored in the transaction confirmation information temporary storage means match the transaction ID information and the user identification information received from the web site server. In the determining step, if it is determined that they match, the credit card information in which the credit card information of the user registered in advance without going through the Internet is stored A step of acquiring the credit card information of the user from the storage means and transmitting the credit card information to the settlement processing means. Further, in the seventh mode according to the present invention, in response to a user access request, an order processing / confirmation included in a source program of a product order web page of an electronic commerce web site displayed on a user terminal. An instruction program, the order processing-confirmation instruction program is read into a Web browser of a user terminal, and to the Web site, transaction ID information for specifying individual electronic commerce and individual users. Transmitting an order processing request together with user identification information specifying the transaction ID; and causing the web browser to transmit a transaction confirmation request to the transaction confirmation server together with the transaction ID information and the user identification information. Order processing to be executed · A confirmation instruction program can also be realized.

Further, in the eighth mode according to the present invention, the order processing and confirmation included in the source program of the product order web page of the electronic commerce web site displayed on the user terminal in response to a user access request. An instruction program, wherein the order processing / confirmation instruction program is transmitted to a web browser of a user terminal, and a transaction confirmation request is transmitted to a transaction confirmation server together with user identification information for identifying each user; Receiving from the transaction confirmation server transaction ID information for identifying the electronic commerce generated based on the transaction confirmation request, the transaction ID generation means of the transaction confirmation server; transmitting an order processing request to the eb site together with the received transaction ID information and the user identification information. Order processing to be executed · A confirmation instruction program can also be realized.

Further, in a ninth aspect according to the present invention, the program installed in the user terminal, wherein the number information of the program is used as user identification information for identifying an individual user. In one preferred form of the form A user authentication program used in the operation can also be realized.

In the tenth aspect according to the present invention, a Web browser including the user authentication program in the ninth aspect as a plug-in program can also be realized.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a diagram showing the overall configuration of a first embodiment of a transaction confirmation / credit card information acquisition method in web electronic commerce according to the present invention, and FIG. 2 is a diagram showing a transaction confirmation server and the like in the first embodiment. FIG. 3 is a diagram showing an internal configuration, FIG. 3 is an image diagram of a data configuration stored in credit card information storage means in the first embodiment, FIG. 4 is a flowchart showing a processing procedure in the first embodiment, FIG. Is a diagram showing an internal configuration of a transaction confirmation server and the like in the second embodiment, FIG. 6 is a diagram showing an internal configuration of a transaction confirmation server and the like in the third embodiment, and FIG. FIG. 8 is a diagram showing an overall configuration in another modified example.

Legends of main symbols used in the drawings are shown below.

1 0 User terminal

1 0 a Web Browser

1 0 b User authentication program

2 0 Internet service provider

3 0 Transaction confirmation server

3 0 a Web server

3 0 b Transaction confirmation module

3 0 c Order confirmation module

3 0d Personal information acquisition module

3 0 e Various DB adapter

3 0 f Transaction confirmation information temporary storage means 3 0 g Personal information acquisition setting file

3 0 h DB setting file

3 1 Credit card information storage means

3 1 a User ID

3 1 b Personal information part

3 1 c Credit number information

3 2 Settlement processing module

3 3 Langpu ID setting script program

40 dial-up line

41 Always-on dedicated line

50 Internet

6 0 E C Site

6 0a Order processingConfirmation instruction program

6 1 Web server

62 Sales Order Processing Module

6 3 Processing branch module

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, examples of embodiments of the present invention will be described with reference to the accompanying drawings. === First Embodiment ===

FIG. 1 is a diagram showing an overall configuration according to a first embodiment of a transaction confirmation / credit card information acquisition method in web electronic commerce according to the present invention. In the first embodiment, a user terminal 10 such as a personal computer is connected to an Internet service provider (hereinafter referred to as ISP) 20 via a dial-up line 40 such as a telephone line or an ISDN line. Point Protocol) connection to Internet 50. Each time a connection is made, the user terminal 10 has an ISP Global IP addresses (hereinafter simply IP addresses) are randomly assigned from 20.

It is assumed that the user accesses the EC (Electronic Commerce) site 60, which is a Web site, using the browser 10a of the user terminal 10, and intends to purchase a certain product. Here, this EC site 60 is affiliated with ISP 20 which is a central institution that provides users with transaction confirmation and credit card information acquisition and payment processing services of this embodiment. · It is assumed that a number of agreements have been made in advance for the credit settlement service.

The ISP 20 system mainly consists of a transaction confirmation server 30, credit card information storage means 31 as a database for relational databases, and a payment processing module 3 2 as a payment processing means (Fig. 2). , And an Internet connection processing unit (not shown). The credit card information storage means 31 stores various personal information of the user (name, address, telephone number, e-mail address, etc.) registered when the user first applied to the ISP 20 for the Internet connection service. ) Is stored with credit card information (credit card company, card number, expiration date, etc.).

When a user who is a member of the ISP 20 places a product order on the product order web page of the partner EC site 60, the transaction confirmation server 30 receives the credit power stored in the credit card information storage means 31. The information is obtained and passed to the payment processing module 32 for payment processing. At that time, it confirms whether or not the product order (electronic commerce) was originally ordered by the user who is a member of the ISP 20 (transaction confirmation). Therefore, the transaction confirmation server 30 performs various functions such as transaction confirmation, acquisition of credit card information, and settlement processing.

The processing unit (not shown) for generating the product order page of the EC site 60 receives the request (“HTTPGET” command) from the user and generates the product order page. Order processing indicated by a star in the figure · Confirmation instruction program 60a is embedded in the page. The order processing / confirmation instruction program 60a is a program (code) written in a language such as script language, and is a source program in HTML language or the like for each product order page of each partner EC site 60. It is embedded anywhere in the. Order processing · Confirmation instruction program 60a is a format that does not require rewriting of existing source programs and functions only by adding a few new lines. This is preferable because it is simple for the website.

The order processing / confirmation instruction program 60a is read into the web browser 10a of the user terminal 10. The web browser 10a sends a transaction confirmation request to the transaction confirmation server 30 of the ISP 20 and an order processing request to the EC site 60 based on the order processing / confirmation instruction program 60a. You.

In addition, along with those requests, the URL of the EC site 60 (Web site ID information) as transaction ID information that specifies individual transactions, and the IP of the user terminal 10 as user identification information that specifies individual users The address is sent.

Regarding the transmission of the IP address, specifically, at the time of the transaction confirmation request to the transaction confirmation server 30 and the order processing request to the EC site 60, the web browser 10a transmits a dummy web page having no information at all. (Or a dummy image such as a transparent GIF) to send a command (“HTTP GET” command). When the web page or image is acquired, the IP address is passed in exchange, so the IP address is transmitted in this manner.

This IP address is used by ISP 20 to authenticate that the user is a registered user of ISP 20, and in the transaction confirmation process described later, the order of the product to EC site 60 is definitely by the user himself. It is also used to confirm that The IP address of the present embodiment is used for connection to ISP 20. Since it is a dynamic IP address that is randomly assigned every time, the security effect is also high. It is also possible to use a fixed IP address instead of a dynamic IP address.

FIG. 2 is a diagram showing details of the internal configurations of the system of the ISP 20 such as the transaction confirmation server 30 and the system of the EC site 60. The web server 30a at the transaction confirmation server 30 of the ISP 20 and the web server 61 at the EC site 60 serve as a point of contact with the user terminal 10 to transfer various programs and data to the HTTP protocol. Send and receive according to the For example, a transaction confirmation request and an order processing request transmitted by the web browser 10a of the user terminal 10 are respectively transmitted to the IP address, which is the user identification information, and the UR of the EC site 60, which is the web site ID information. Receive with L. The transaction confirmation server 30 receives the transaction confirmation request received by the web server 30a, and sends the IP address and web site ID of the user received with the request to the order confirmation module by using 30c. The information (hereinafter, IP-ID pair) is stored in the transaction information temporary storage means 30f.

On the other hand, the EC site 60 receives the order processing request received by the web server 61, executes the order processing by the order processing module 62, and checks the inventory of the ordered products and arranges the delivery. And so on. In the order processing module 62, when the order processing is completed, in this service, the settlement of the price for the user is performed by the ISP 20 and a settlement request is transmitted to the transaction confirmation module 30b of the ISP 20. Although not shown in the figure, when communication is made between the order processing module 62 of the EC site 60 and the transaction confirmation module 30b of the transaction confirmation server 30 using the HTTP protocol, each side has a web site. A server may be provided.

The order processing module 62 sends the IP-ID pair received from the user terminal 10 by the web server 61 together with the settlement request to the transaction confirmation module 30b. In the transaction confirmation module 30b, the same IP-ID pair as the transaction confirmation information Request the order confirmation module 30c to perform a collation process for checking whether or not the information is stored in the temporary report storage means 30f.

The order confirmation module 30c searches for the IP-ID pair that has already been received from the user terminal 10 via the web server 30a and is supposed to be stored in the transaction confirmation information temporary storage means 30f. However, if a matching pair is found, it is determined that the order for this product is indeed the member user himself, and the process is recommended to the next step. In other words, even if another person illegally impersonates this user and tries to purchase a product on the EC site 60, the other person does not have the dynamic IP address assigned to the user, and the user terminal 10 The IP-ID pair transmitted directly to the transaction confirmation server and stored in the transaction confirmation information temporary storage means 30 f is not found, and the settlement request is rejected.

It should be noted that the IP_ID is transmitted from the user terminal 10 directly to the transaction confirmation server 30 and is stored in the transaction confirmation information temporary storage means 30f. The allowable time (time range) until the ID pair reaches the transaction confirmation module 30b can be freely set. A pair that arrives beyond the allowable time may be notified to the administrator of the transaction confirmation server 30 even if they match.

If the IP-ID pairs match without any problem, the transaction confirmation server 30 executes a credit card information acquisition step for the user. First, the transaction confirmation module 30b passes the IP address, which is the user identification information, to the personal information acquisition module 30g, and uses the IP address as key information to store the credit card information of the user in credit card information storage means. 3 Request to get from 1. The personal information acquisition module 30d executes a query request statement (for example, SQL: Structured Query) that describes what type of information should be acquired from the credit card information storage means 31 from the personal information setting file 30g. Language) Get. The credit card information storage means 31 stores the inquiry method and the like in the personal information setting file 30 g because the manner of defining data in the database differs for each ISP 20.

The various DB adapters 30e receive the personal information acquisition command from the personal information acquisition module 30d, and acquire the credit card of each user from the credit card information storage means 31. At that time, the IP address of the user is used as key information for user identification. In addition, at the time of acquisition, information on a connection method with the credit card information storage means 31 is acquired from the DB setting file 3 Oh. The connection method with the credit card information storage means 31 means the address (host name, etc.) of the credit card information storage means 31 which is a database, and a transaction confirmation server for the credit card information storage means database 31. Settings such as the access ID and password of the client.

FIG. 3 is an image diagram of the data configuration stored in the credit card information storage means 31. The ID 31 a and various personal information 31 b (name, zip code, address, credit card number, etc.) of each user registered in the internetwork connection service of ISP 20 are stored. Since the IP address given each time a user connects to the Internet is uniquely determined for each user, credit card information is stored in various DB adapters 30 e of the transaction confirmation server 30. When acquiring the credit card information of a specific user from the storage means 31, the user ID 31a is specified using this IP address information as key information, and the credit card number of the user corresponding to the ID is identified. Get information 3 1 c and so on. As the user ID 31 a in the personal information storage means 31, the same ID as each user for the Internet connection service of the ISP 20 may be used, or the user ID 31 a dedicated to the credit card information acquisition processing may be used. It may be something.

The acquired credit card information is settled from the transaction confirmation module 30b. It is transmitted to the settlement processing module 32 as a means, and then the settlement processing step is executed. It is preferable that the purchase of the merchandise at the EC site 60 be billed to the user together with the Internet connection service fee of the ISP 20 because the payment is simple and easy.

As described above, according to the transaction confirmation, credit card information acquisition, and settlement method in the web electronic commerce of the present embodiment, the user does not need to input the credit card information by himself, and moreover, the EC site 60 is not required. There is no need to enter credit card information, and the transaction confirmation server 30 retrieves the credit card information from the credit card storage means 31 registered in advance without going through the Internet and sends it to the payment processing module 32. Because it passes, the leakage of credit card information can be reliably prevented. In addition, the transaction confirmation server 30 has a transaction confirmation function for confirming that the electronic commerce is indeed the user himself by using a match between pairs of transaction ID information and user identification information. Therefore, it is possible to surely prevent a person who has acquired credit card information illegally by any means from purchasing the product by impersonating the user.

Next, an example of a processing procedure according to the present embodiment will be described.

FIG. 4 is a flowchart showing a basic processing procedure of the present embodiment. In FIG. 4, the processes in the ISP 20, the user terminal 10, and the EC site 60 are separately shown. The detailed processing of the modules 30a to 30h, such as each module, in the transaction confirmation server 30 has already been described in the description of FIG.

First, the user makes an Internet connection request by dial-up connection from the user terminal 10 to the ISP 20 (step s200). At this time, the user ID and password for the Internet connection service are entered and transmitted to ISP 20. After user authentication by ID and password, ISP 20 key The Internet connection processing unit makes a PPP connection to the Internet (step s100). At this time, the ISP 20 gives an IP address as user authentication information for specifying the user terminal 10.

Next, the user starts the browser 10a of the user terminal 10, specifies the URL of the EC site 60, and requests access. If login is required, enter the ID and password for EC site 60, log in, and access the EC site (step s202).

Next, in order to purchase a desired product in web electronic commerce, the order page for the product is requested (step s204). The web server 61 of the EC site 60 transmits the product order page in response to the request (step S300).

This product order page includes an order processing / confirmation instruction program 60a, which is read by the web browser 10a of the user terminal 10 (step s206). The browser 10a transmits a transaction confirmation request to the transaction confirmation server 30 of the ISP 20, and transmits an order processing request to the EC site 60 (step s208).

In addition, along with those requests, the URL of the EC site 60 (Web site ID information) as transaction ID information for specifying each transaction, and the IP of the user terminal 10 as user identification information for specifying each user The address (collectively, the IP_ID pair) is sent.

The transaction confirmation server 30 of the ISP 20 receives the information via the web server 30a and the order confirmation module 30c, and stores the received IP_ID pair in the transaction confirmation information temporary storage means 30f. (Step s102).

On the other hand, the EC site 60 receives the information via the web server 61, and performs order processing in the order processing module 62 based on the order processing request (step S302). At the EC site 60, upon completion of the order processing, the order processing module 62 sends a settlement processing request to the transaction confirmation module 30b of the ISP 20 transaction confirmation server 30 and the user terminal 10 The IP-ID pair received from is transmitted (step 304).

Next, in the transaction confirmation server 30, the order confirmation module 30c receives the IP-ID pair received from the user terminal 10 and stored in the transaction confirmation information temporary storage means 30f, and the EC site 60 The IP-ID pair received from is compared with the IP-ID pair (step s104), and if they match, the process proceeds to a credit card acquisition process (step s106). If the order does not match, or if the information received from the EC site 60 does not include the IP address, the order is rejected if a fraudulent order is suspected.

The transaction confirmation server 30 stores the credit card information of the user corresponding to the IP address from the credit card information storage means 31 via the personal information acquisition module 30d and various DB adapters 30e. Acquisition (step s106) and passes this information to the settlement module 32.

The payment module 32 performs payment processing using the received credit card information (step s108).

This is the end of the basic processing procedure of the mobile phone of the present embodiment.

In the present embodiment, the ISP 20 performs transaction confirmation, obtains credit card information, and performs settlement processing for the user. However, the system such as a credit card company has a transaction confirmation server 30 ゃ credit card storage means 3 1, and a payment processing module 32 may be provided, and a credit card company or the like may perform these processing. In this case, the user identification information for identifying each user may be other than the IP address. Details of how to use such user identification information other than the IP address will be described later. Further, the transaction confirmation server 30 and the credit card storage means 31 may be provided in the ISP 20, only the payment processing module 32 may be provided in the credit card company, and only the payment processing may be performed by the credit card company or the like. In this case, the information is connected between ISP 20 and the credit card company by a secure line other than the Internet, such as a dedicated line, or by a communication method that uses security measures such as encryption and SSL. Is preferably exchanged.

=== Second embodiment ===

The overall configuration of the second embodiment is the same as that of the first embodiment (see FIG. 1), in which a user terminal 10 such as a personal computer is connected to an Internet service provider (hereinafter referred to as an ISP) 20. It is connected to the Internet 50 by a PPP (Point-to-Point Protocol) connection via a telephone line or a dial-up line 40 such as an SDN line. Each time a connection is made, a global IP address (hereinafter simply referred to as an IP address) is randomly assigned from the ISP 20 to the user terminal 10, and this IP address is used as user identification information.

When a user places an order for a product on the partner's EC site 60 of ISP 20, the order processing is embedded in the product order web page and read into the web browser 10 a of the user terminal 10 · Based on the confirmation instruction program 60a, the transaction confirmation server 30 executes transaction confirmation, acquisition of credit card information, settlement processing, and the like. The difference from the first embodiment is that the web browser 10a of the user terminal 10 transmits both the order processing request and the transaction confirmation request transmitted based on the order processing / confirmation instruction program 60a. The point is that it is sent to the server 61.

FIG. 5 is a diagram showing an internal configuration of the transaction confirmation server 30 and the like according to the second embodiment of the present invention. The order processing request sent together with the IP-ID pair is processed in the order processing module 62 via the web server 61 of the EC site 60 as in the first embodiment, and the order processing request is processed. Transaction confirmation server as a settlement request with the pair Sent to 30 transaction confirmation module 30b.

On the other hand, unlike the first embodiment, the transaction confirmation request sent together with the IP-ID pair is branched by the processing branch module 63 via the Web server 61 of the EC site 60, and the transaction confirmation is performed. It is transmitted to the order confirmation module 30c via the web server 30a of the server 30.

Here, since it is important for the accurate transaction confirmation that the IP-ID pair that is forked twice is not altered in the EC site 60 or the like, the processing branch module 63 is, for example, a transaction confirmation / credit card. It is a central provider of acquisition services

No one other than the person in charge of 1 SP 20 can modify the internal structure.

In the present embodiment, the internal configuration of the ISP 20 system is the same as that of the transaction confirmation server 30 except that a web server is not provided, that is, the transaction confirmation server 30 ゃ credit card information storage means 31 and the like. The internal configuration of is exactly the same as in the first embodiment. In addition, when a user orders a product on the EC site 60, the processing procedure of transaction confirmation—credit card information acquisition—payment processing in the ISP 20 is completely the same as in the first embodiment. Omitted. The effects of this embodiment are exactly the same as those of the first embodiment.

= == Third Embodiment = ==

The overall configuration of the third embodiment is similar to the first and second embodiments (see FIG. 1). A user terminal 10 such as a personal computer is connected to a telephone line or an ISDN line by an ISP 20. It is connected to the Internet 50 by a PPP connection via a dial-up line 40. Each time a connection is made, I S P

A global IP address (hereinafter simply referred to as an IP address) is randomly allocated from 20 and this IP address is used as user identification information.

When a user places an order for an item on the ISP 20 partner EC site 60, it is embedded in the item order web page and loaded into the web browser 10a on the user terminal 10. I

The transaction confirmation server 30 executes transaction confirmation, acquisition of credit card information, and settlement processing based on the confirmation order program 60a. The difference from the first embodiment is that the transaction ID information for identifying each electronic commerce is not the URL of the EC site 60 (Web site ID information), but is used for each transaction (product order) by the transaction confirmation server 30. This is the transaction ID assigned to.

FIG. 6 is a diagram showing an internal configuration of a transaction confirmation server 30 and the like according to the third embodiment of the present invention. The order confirmation module 30c of the transaction confirmation server 30 in the first and second embodiments is changed to a transaction ID generation module 30i in the present embodiment.

Order processing · Web browser 10a of the user terminal 10 that reads the confirmation instruction program 60a first sends the transaction ID generation module 3 via the web server 30a of the transaction confirmation server 30. Send a transaction confirmation request to 0 i. Unlike the first and second embodiments, the transaction confirmation request is not a dummy Web page or the like but an “HTTPGET” command requesting transmission of the transaction ID setting script program 33. In exchange for receiving the ID setting script program 33, the IP address of the user terminal 10 is transmitted to the transaction ID generation module 30i.

The transaction ID setting script program 33 is loaded into the web browser 10a, and the transaction ID information generated by the transaction ID generation module 30i based on the transaction confirmation request is automatically sent to the product order web page. It is a script language program for executing the processing set in the. The transaction ID information to be set may or may not be displayed so as to be visible on the product order web page. The transaction ID information generated by the transaction ID generation module 30 i is transmitted to the user terminal 10 together with the transaction ID setting script program 33, while the transaction confirmation information as an IP-ID pair together with the IP address of the user terminal. It is stored in the temporary storage means 30f. The transaction ID information transmitted to the user terminal 10 forms an IP address and IP_ID pair together with an order processing request sent from the web browser 10a of the user terminal 10 to the EC site 60. Then, the data is transmitted to the Web server 61 of the EC site 60 in the same manner as in the first and second embodiments.

Subsequent processing procedures are exactly the same as the processing procedure of transaction confirmation → acquisition of credit card information—settlement processing in the first ISP 20, and a detailed description thereof will be omitted.

Also, except that the order confirmation module 30 c of the transaction confirmation server 30 has been changed to the transaction ID generation module 30 c, the internal configuration of the transaction confirmation server 30 ゃ credit card information storage means 31, etc. Since it is completely the same as the first embodiment, the details of the same parts as those of the first embodiment are omitted.

The effects of the present embodiment have the same effects as the first embodiment. Further, since the transaction ID information in this embodiment is provided by the transaction confirmation server for each electronic commerce transaction, it is possible to perform transaction confirmation in more detail for each transaction. === Variations ===

In each of the above embodiments, the IP address information assigned to the user terminal at the time of dial-up connection is used as the user identification information for identifying each user. However, the present invention is not limited to this. May be user terminal number information assigned to the user terminal. FIG. 7 is a diagram showing the overall configuration in such a modification.

In this modification, a user terminal 10 such as a personal computer is always connected to the Internet 50 via a dedicated line 41 by an Internet service provider (hereinafter, ISP) 21. Other configurations are the same as those of the first embodiment. As in the first embodiment, the user accesses the EC (Electronic Commerce) site 60, which is a Web site, using the browser 10a of the user terminal 10. And buy a certain product.

In the case of this modification, a dynamic IP address is not assigned from the ISP 20 to the user terminal 10 because the connection is always on. Therefore, the user terminal number information assigned in advance to the user terminal is used as unique user identification information for each user to ensure user authentication.

As the user terminal number information, for example, in the case of ISP 20 using a cable TV line, a management number or the like assigned to a set-top box installed in a user's house may be used. The Web browser 10a of the user terminal 10 issues a transaction confirmation request to the transaction confirmation server 30 of ISP20, and E. When sending an order processing request to the site 60, the user terminal number information is transmitted together with those requests in place of the IP address in the first embodiment, and in the subsequent processing steps, the IP address Used instead.

Also, in this modification, since the dynamic IP address given at the time of connection by ISP 20 is not used, the organization that performs transaction confirmation, credit card information acquisition, and payment processing is not ISP 20 but a credit card company. Good. In such a case, the credit card information may be provided by a credit card company's transaction confirmation server 30 or credit card information storage means 31 in a highly secure communication network such as a dedicated line. All the effects of the above-described embodiments can be realized in the same manner by preventing leakage to a low-security communication network.

As described above, when the user terminal number information assigned to the user terminal 10 is used as the user identification information, when the user is connected to the Internet via the ISP 20 via a dedicated line for permanent connection, etc. Therefore, user authentication can be reliably performed, and unauthorized acquisition of personal information of the user due to impersonation or the like can be reliably prevented. In each of the above embodiments, the number information of the user authentication program installed in the user terminal may be used instead of the IP address as the user identification information for specifying each user. FIG. 8 is a diagram showing an overall configuration in such a modification.

In this modification, a user authentication program 10b is installed in a user terminal 10 such as a personal computer. Based on the order processing embedded in the product order page of the EC site 60 and the confirmation instruction program 60a, the web browser 10a of the user terminal 10 first executes the user authentication program 10b It acquires number information such as the manufacturing serial number as user identification information.

In this modification, since the user identification information for identifying each user is the number information of the user authentication program 10b provided in the user terminal 10 itself, the connection to the Internet 1 network 50 Form and communication line 40 may be in any form.

When the web browser 10a of the user terminal 10 sends a transaction confirmation request to the transaction confirmation server 30 of the ISP 20 and an order processing request to the EC site 60, the first Instead of the IP address in the embodiment, the number information of the user authentication program is transmitted together with those requests, and is used instead of the IP address in the subsequent processing steps.

Also, in this modification, since the dynamic IP address given at the time of connection by ISP 20 is not used, the organization that performs transaction confirmation, credit card information acquisition, and payment processing is not ISP 20 but a credit card company. Good. In such a case, the credit card information may be provided by a credit card company's transaction confirmation server 30 or credit card information storage means 31 in a highly secure communication network such as a dedicated line. All the effects of the above embodiments can be realized in the same way if they are prevented from leaking to a low-security communication network. Is done.

As described above, when the number information of the user authentication program 10b is used as the user identification information for specifying each user, the user installed on the user terminal is used regardless of the user's Internet connection form. User authentication can be performed with the existence of the authentication program 10b itself, and user authentication can be performed easily.

Further, the user authentication program 10b may be integrally included in the Web browser 10a of the user terminal 10 as a plug-in program.

Industrial applicability

As described above, according to the transaction confirmation / credit card information acquisition method in web electronic commerce of the present invention, the user does not need to input his / her own credit card information, and the credit card information is leaked. Can be reliably prevented. Also, it is possible to reliably prevent another person who has illegally acquired credit card information by any means from purchasing the product by impersonating the user.

Claims

The scope of the claims

1. An e-commerce Web site product order Web page screen is displayed on a user terminal in response to a user access request;

A web browser of the user terminal reading an order processingconfirmation instruction program included in the source program of the product order web page;

Based on the order processing / confirmation instruction program read by the web browser, the web browser sends, to the web site, transaction ID information specifying individual electronic commerce and user identification information specifying individual users. Sending an order fulfillment request;

Based on the read order processing / confirmation instruction program, the web browser sends a transaction confirmation to the transaction confirmation server together with transaction ID information for identifying each electronic commerce and user identification information for identifying each user. Sending the request; and

A step in which the server of the Web site receives the transaction ID information and the user identification information, and performs order processing based on the order processing request;

The server of the website transmitting the transaction ID information and the user identification information to the transaction confirmation server;

The transaction confirmation server matches the transaction ID information and user identification information received from the web browser of the user terminal with the transaction ID information and user identification information received from the web site server. If it is determined in the step of determining whether or not the transaction is identical, the transaction confirmation server stores the credit card information of the user registered in advance without passing through the Internet. Obtaining credit card information of the user from the credit card information storage means and transmitting the credit card information to the payment processing means;

Transaction confirmation in web e-commerce with credit card information acquisition method.

2. The transaction confirmation and credit card information acquisition in web electronic commerce according to claim 1, wherein the transaction ID information is web ID information for identifying the electronic commerce website. Method.

3. When the web browser of the user terminal transmits the website ID information and the user identification information together with the transaction confirmation request to the transaction confirmation server, the server of the electronic commerce website has 3. The transaction confirmation in web electronic commerce according to claim 2, wherein the transmission is performed via a processing branching unit that is prohibited from being modified by the web site operator.

4. a step of displaying a product order web page screen of the electronic commerce web site on the user terminal in response to a user access request;

A web browser of the user terminal reading an order processing / confirmation instruction program included in the source program of the product order web page;

The web browser sending a transaction confirmation request to the transaction confirmation server together with user identification information for identifying each user based on the read order processing / confirmation instruction program;

A step in which the transaction ID generation means of the transaction confirmation server generates transaction ID information specifying the electronic commerce based on the transaction confirmation request;

The transaction confirmation server storing the generated transaction ID information in the transaction confirmation information temporary storage means together with the user identification information received from the web browser, and transmitting the transaction ID information to the web browser;

Transmitting the order processing request to the web site together with the received transaction ID information and user recognition information to the web site based on the read order processing / confirmation instruction program;

The website server receives the transaction ID information and the user identification information. In addition, the order processing is performed based on the order processing request.

A server of the Web site transmitting the transaction ID information and the user identification information to the acquisition I confirmation server;

The transaction confirmation server stores the transaction ID information and the user identification information stored in the transaction confirmation information temporary storage means, and the transaction I received from the server of the Web site.

Determining whether or not the D information and the user recognition information match;

In the determining step, when it is determined that they match, the transaction confirmation server reads the credit card information of the user from the credit card information storage unit in which the credit card information of the user registered without passing through the Internet is stored. Obtaining credit card information and transmitting it to the payment processing means;

Transaction confirmation in WEB electronic commerce · Credit card information acquisition method.

5. The user identification information for identifying the individual user is IP address information assigned to the user terminal,

The credit card information storage means stores user ID information associated with the IP address information and credit card information of a user corresponding to the user ID information.

The method of claim 1 for confirming a transaction in Web electronic commerce according to claim 1.

6. The user identification information for identifying each user is user terminal number information assigned to the user terminal,

The credit card information storage means stores user ID information associated with the user terminal number information and credit card information of a user corresponding to the user ID information.

The method for acquiring transaction information and credit force information in web electronic commerce according to claim 1.

7. The user identification information for identifying the individual user is the number information of the user authentication program installed on the user terminal,

The credit card information storage means stores user ID information associated with the number information of the user authentication program, and credit card information of the user corresponding to the user ID information. Do

8. A transaction confirmation server that performs transaction confirmation and credit card information acquisition in WEB electronic commerce.

Product order from e-commerce web site Order processing included in source program of web pageTransaction ID that identifies each e-commerce sent by web browser of user terminal together with transaction confirmation request based on confirmation instruction program Receiving information and user identification information identifying individual users;

The transaction ID information and the user identification information received from the web browser by the web site server together with the order processing request transmitted by the web browser based on the order processing / confirmation instruction program are transmitted to the web site. Whether the transaction ID information and the user identification information received from the browser of the user terminal match the transaction ID information and the user identification information received from the server of the website. The step of determining;

In the determining step, when it is determined that they match, the credit card information of the user is stored in the credit card information storage means in which the credit card information of the user registered without passing through the Internet is stored in advance. Acquiring and transmitting to the payment processing means

A transaction confirmation server that performs

9. The transaction confirmation server according to claim 8, wherein the transaction ID information is website ID information for specifying the electronic commerce website.

10. When the web browser of the user terminal transmits the website ID information and the user identification information together with the transaction confirmation request to the transaction confirmation server, the server of the electronic commerce website 10. The transaction confirmation server according to claim 9, wherein the transaction confirmation server is transmitted via a processing branching unit that is prohibited from being modified by the website operator of the transaction.

1 1. Transaction confirmation in web e-commerce · A transaction confirmation server that acquires credit card information.

Electronic commerce Ordering goods from the website Order processing included in the source program of the web pageTransaction confirmation request along with user identification information identifying each user transmitted by the web browser of the user terminal based on the confirmation instruction program Receiving the

Storing the generated transaction ID information in the transaction confirmation information temporary storage means together with the user identification information received from the web browser, and transmitting the transaction ID information to the web browser;

Along with the order processing request transmitted by the web browser based on the order processing / confirmation instruction program, the transaction ID information and the user recognition information received from the web browser by the web site server are transmitted to the web server. b receiving from the site server;

A step of determining whether the transaction ID information and the user identification information stored in the transaction confirmation information temporary storage means match the transaction ID information and the user identification information received from the website server. When, In the determining step, when it is determined that they match, the credit card information of the user is stored in the credit card information storage means in which the credit card information of the user registered without going through the Internet is stored in advance. Acquiring and transmitting to the payment processing means

A transaction confirmation server that performs

1 2. Transaction confirmation in WEB electronic commerce · Acquisition of credit card information

Along with the order processing request transmitted by the web browser based on the order processing / confirmation instruction program, the transaction ID information and the user identification information received from the web browser by the web site server are transmitted to the web site. It is determined whether the transaction ID information and the user identification information received from the browser of the user terminal match the transaction ID information and the user identification information received from the server of the website. Steps to the '

In the determining step, if it is determined that they match, the credit card information storage means in which the credit card information of the user registered without passing through the Internet is stored in advance, and the credit card of the user is stored. Acquiring information and sending it to the payment processing means;

A program for executing

13. The program according to claim 12, wherein the transaction ID information is Web site ID information for specifying the electronic commerce Web site.

14. When the web browser of the user terminal transmits the transaction confirmation request, the website ID information and the user identification information to the transaction confirmation server, the server of the electronic commerce website has 14. The program according to claim 13, wherein the program is transmitted via a processing branching unit that is prohibited from being modified by the web site operator.

1 5. Transaction confirmation in WEB electronic commerce · Acquisition of credit card information

Product order from e-commerce Web site Order processing included in the source program of the Web pageAlong with the user identification information that identifies each user transmitted by the Web browser of the user terminal based on the confirmation instruction program Receiving a transaction confirmation request;

Storing the generated transaction ID information together with the user identification information received from the web browser in the transaction confirmation information temporary storage means, and transmitting the transaction ID information to the web browser;

Along with the order processing request transmitted by the web browser based on the order processing / confirmation instruction program, the transaction ID information and the user identification information received from the web browser by the web site server are transmitted to the web site Receiving from the server at

A step of determining whether the transaction ID information and the user identification information stored in the transaction confirmation information temporary storage means match the transaction ID information and the user identification information received from the website server. When,

In the determining step, if it is determined that they match, the credit card information of the user registered in advance without going through the Internet is stored. Obtaining the credit card information of the user from the credit card information storage means obtained and transmitting the credit card information to the payment processing means;

A program for executing

16. Electronic commerce displayed on the user terminal in response to the user's access request. Product order on the website. Order processing and confirmation instruction program included in the source program on the web page.

The order processing request is sent to the web browser of the user terminal that has read the order processing 'confirmation instruction program', and to the web site, an order processing process together with transaction ID information specifying individual electronic transactions and user identification information specifying individual users. Sending a

Causing the web browser to transmit a transaction confirmation request to the transaction confirmation server together with the transaction ID information and the user identification information;

Execute order processing · Confirmation instruction program.

17. The order processing / confirmation instruction program according to claim 16, wherein the transaction ID information is website ID information for specifying the electronic commerce website.

18. When the Web browser of the user terminal transmits the transaction confirmation request, the website ID information, and the user identification information to the transaction confirmation server, the e-commerce website server has 18. The order processing / confirmation instruction program in web electronic commerce according to claim 17, wherein the program is transmitted via a processing branching unit that is prohibited from being modified by a web site operator.

19. Electronic commerce displayed on the user terminal in response to the user's access request. Product order on the website. Order processing and confirmation included in the source program on the web page. A step of transmitting a transaction confirmation request to a transaction confirmation server, together with user identification information for identifying each user, to a Web browser of the user terminal that has read the order processing / confirmation instruction program;

The transaction ID generation means of the transaction confirmation server receiving from the transaction confirmation server transaction ID information that is generated based on the transaction confirmation request and specifies the electronic commerce;

Causing the web browser to transmit an order processing request to the web site together with the received transaction ID information and the user identification information;

Execute order processing · Confirmation instruction program.

2 0. Install on the user terminal! Is a program that is

Number information of the program is used as user identification information for specifying an individual user.

8. A user authentication program according to claim 7, wherein the user authentication program is used in web electronic commerce.

21. A Web browser including the user authentication program according to claim 20 as a plug-in program.