JP2010049553A - Account information management system, management method, and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce each load of both a customer company and a financial institution, while keeping security, and to enable the customer company side to set and change freely management information of a plurality of accounts. <P>SOLUTION: An account information management system 1 for managing information of a plurality of net-banking accounts X, Y, Z held in a financial institution 2 by a customer company 3 has: a customer information storage part for storing information of the plurality of accounts and an ID of a one-time password generation token 7 distributed beforehand to the customer company 3 in an account unit, in association with a customer ID; a utilization registration application reception means for acquiring account information, the token ID and an ID of an employee A from a customer terminal 5 of the employee A managing a customer account, and receiving application of utilization registration of the token 7; and a utilization registration processing means for registering the acquired token ID into the customer information storage part in association with the ID of the employee A and an account related to application. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an account information management system in which a customer communication terminal (customer terminal) is connected via a communication network and manages information on a plurality of net banking accounts (customer accounts) held by the customer in a financial institution, The present invention relates to an account information management method executed by the system, and a computer program for causing a computer system to execute the account information management method.

  Conventionally, corporations and other corporations and businesses (hereinafter collectively referred to as “corporations”) have multiple financial accounts, such as departments, business partners, sales regions, and deposit / withdrawal types. It is used properly according to the attribute. Financial institutions often manage a plurality of accounts of such customer companies in association with customer IDs.

  In addition, there is a demand on the part of companies that they want to manage their own multiple accounts independently of the collective management for each customer at financial institutions. For example, by flexibly setting the person in charge and transaction authority for each account, or by linking arbitrary multiple accounts among the accounts held, internal factors such as organizational changes and personnel changes, changes in business partners and market trends It is possible to respond to external factors such as timely and appropriately. Such multi-account management is not limited to individual account information (account number, personal identification number, company information, etc.), but specific information (administrator information, contract information) previously determined between the customer and the financial institution. , Information on other accounts, etc., hereinafter referred to as “management information”).

  The following Patent Documents 1 to 3 are helpful for such a method for managing a plurality of customer accounts.

JP 2003-178196 A Japanese Patent Laid-Open No. 2004-280622 Japanese translation of PCT publication No. 2004-523836

  By the way, when a client company wants to change the management information described above, it is necessary to fill out an application on a form designated by the financial institution and obtain approval from the financial institution. Approval of this financial institution takes one to two weeks, and a document of the approval result is sent to the client company. As described above, since all management information changes are made in writing, it takes two to three weeks from application to information update. Therefore, if you want to change the employee's transaction authority for a specific account and start trading immediately, or if you want to notify a business partner by linking a specific account with another account (parent account) This is a factor that reduces business efficiency and convenience.

  As a financial institution, management information shared with customer companies is also important customer information, and therefore it is necessary to strictly manage it according to the account information. In particular, if the management information is allowed to be changed by a simple procedure, there is a risk that the customer company may be greatly damaged by fraud by a third party or an employee of the customer company. Accordingly, a mechanism that allows the client company to freely change the management information while maintaining the security level of the management information is desired by both the client company and the financial institution.

  Such a request is more conspicuous in so-called farm banking (FB) and net banking (hereinafter collectively referred to as “net banking”). In other words, the biggest advantage of net banking is that most transactions can be done online regardless of time or place. Net banking, on the other hand, transmits various types of information through public lines such as the Internet, and therefore, there is a greater possibility of fraudulent acts such as information leakage and impersonation than procedures using paper as a medium. Increase.

  For this reason, in Internet banking, management information is set and changed using paper (application form, notification of approval results) as a medium while ensuring security equivalent to face-to-face applications at physical stores and paper applications. There is a strong demand for a mechanism that eliminates the disadvantages of this.

  For this point, the scheme using the second password information, which has been put into practical use in recent internet banking, is helpful. This scheme distributes OTP generators (tokens) and random number tables that generate disposable passwords (one-time passwords: OTP) with a short expiry time such as 1 minute to customers in advance. In addition to the 4-digit password, authentication is performed based on OTP and random numbers (second password information). As a result, not only account information (account number, personal identification number, nominee, etc.) but also an OTP generation device (token) and random number table cannot be used for important transactions such as transfers, so security is dramatically improved. be able to.

  Regarding the account information management scheme using OTP as the second password information, the following Patent Documents 4 and 5 are helpful.

JP 2007-226763 A (OTP) JP 2007-25907 A (OTP)

  However, in the scheme using the second password information such as OTP described above, since the second password information is managed in association with each account, it is not possible to use this scheme as it is when changing the management information of multiple accounts. Can not.

  For example, when a plurality of persons in charge (customer employees) are to be set in one account, personal information of a plurality of persons in charge is registered as management information. As a result, the client company must manage a plurality of accounts, a plurality of second password information, and a plurality of persons in charge in association with each other, which increases the management burden and causes an input error in account transactions. It becomes easy to do. In particular, when using OTP as the second password information, it is necessary to first perform a procedure for associating the distributed OTP generation device (identification information) with an account, and the procedural load further increases. . In this case, the OTP generation device and the random number table are shared by a plurality of employees, which is not preferable in terms of security.

  In addition, when setting, changing, or canceling linking between a plurality of accounts, it is necessary to verify and authenticate a plurality of second password information associated with each related account. It will be very procedural for both parties.

  Furthermore, when using OTP as the second personal identification information, the validity period of the OTP is set to a short time. Therefore, if there are a large number of target accounts, it is initially possible to input a large number of OTPs on the application screen. The validity period of the input OTP has passed, and the procedure must be restarted from the beginning.

  As described above, there is still a problem to be solved in order to allow the customer company to freely set and change the management information of a plurality of accounts using the second personal identification information.

  The present invention has been made to solve such problems, and while maintaining security, it reduces the burden on both the client company and the financial institution, and the management information of multiple accounts can be freely set by the customer company. It is an object to provide an account information management system, a management method, and a computer program that can be set and changed.

  According to the present invention, a customer communication terminal (customer terminal) is connected via a communication network, and an account information management system for managing information on a plurality of net banking accounts (customer accounts) held by the customer in a financial institution. A customer information storage unit for storing a plurality of customer account information and identification information of a plurality of one-time password (OTP) generation devices distributed in advance to the customer in account units in association with the customer identification information; Identification information of any OTP generation device distributed to this customer for at least one of a plurality of customer accounts from a customer terminal of a customer employee who manages the account (management employee) via a communication network The identification information of the management employee is acquired, and the usage registration application receiving means for receiving the application for the usage registration of the OTP generation device is acquired. An account information management system comprising: identification information of a TP generation device, and registration information processing means for registering in the customer information storage unit in association with the identification information of the management employee and the customer account related to the application; An account information management method executed by the system and a computer program for causing the computer system to execute the account information management method are provided.

  According to the present invention, since the identification information of the OTP generation device distributed to the customer in units of accounts is stored in association with the identification information of the management employee, the management employee of the customer company can associate multiple accounts. Management information such as information (parent-child relationship, etc.) and authority information of the person in charge can be freely set / changed simply through OTP authentication of the OTP generation device. Since the authentication by OTP has higher security than the conventional password (first password information), security equivalent to the setting procedure using paper as a medium can be ensured. In particular, security can be further improved by using in combination with login authentication or a personal identification number (first personal identification information).

  In addition, since the information of a plurality of customer accounts can be managed by the identification information of one OTP generation device and one management employee, it is possible to reduce the burden of managing account information and management information for both customer companies and financial institutions. .

  As a result, while maintaining security, the burden on both the client company and financial institution can be reduced, and management information for multiple accounts can be freely set and changed on the customer company side.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(overall structure)
FIG. 1 is a network configuration diagram conceptually showing an embodiment of the present invention. The account information management system denoted by reference numeral 1 in this figure is an account host computer (not shown) provided in a financial institution 2 that provides a net banking service, and a WEB connected to the account host computer via a dedicated line in the bank. It is configured by cooperating some functions of various computer systems such as a server, a database server, and an application server. A customer terminal 5 such as a PC or a mobile terminal of an employee 4 of a customer company 3 who holds a plurality of accounts for net banking in a financial institution 2 is connected to the account information management system 1 via a computer network such as the Internet. Is done. In the following, for convenience, the plurality of computer systems may be described as one host computer.

  The financial institution 2 is a bank or the like that provides a net banking service to customers regardless of whether there are actual stores. The customer company 3 has a plurality of accounts (three in this embodiment, X, Y, and Z) in the financial institution 2, and various companies such as general companies and associations that are properly used according to the purpose and the attributes of the approval, etc. A legal person, a business person, or a general person. Even a general individual may want to use a plurality of accounts according to purposes such as a settlement account and an investment account, or a parent may want to manage a child's account.

  In the illustrated example, among a plurality of employees 4 of the customer company 3 (including members such as officers, union members, and family members, the same applies hereinafter), the employee A has all customer accounts (X, Y) in the customer company 3. , Z) is an administrative employee who manages, employee B is an employee who is authorized by employee A to conduct transactions for a specific account (Y, Z), and employee C is employee A. It is an employee who is permitted only a specific transaction (simple transaction such as balance inquiry) of a specific account (Z).

  Also, in this embodiment, when the employee 4 requests an important account transaction such as a transfer using net banking, authentication is performed using a one-time password (OTP) with a short expiration date. I have to. This OTP is generated by an OTP generation device (token) 7 that is distributed from the financial institution 2 to the customer 3 by the number of accounts related to the application when the financial institution 2 receives an application for opening an account or net banking from the customer 3. It is generated with a short period such as 1 minute. This token 7 is centrally managed by the system 1 (host computer of the financial institution 2) with identification information (ID) such as a production number, and is associated with the identification information of the customer 3 when distributed to the customer 3. At this point, it is not associated with any account. The management employee A of the customer 3 sends his / her identification information, the identification information of the token 7 and one or more account information, and applies to the financial institution 2 for registration of use of the token 7. Are associated with each other.

  The OTP generation cycle and generation algorithm of this token 7 are the same as the OTP generation program (OTP generation means 29 described later) of the host computer of the financial institution 2. Thereby, the legitimacy of the transaction can be determined by comparing the OTP input from the customer terminal 5 with the OTP generated by the host computer.

  In the example of FIG. 1, employees A and B have the token 7 registered for use in the account information management system 1, but do not have the employee C. As described above, since the same number of tokens 7 as the account is distributed to the customer 3, in the example of FIG. 1, one token 7 (A003) is stored in the customer company 3 without being held by anyone. Will be. This stocked token 7 is used in the future when the client company 3 wants to give the employee C or another employee the authority of an important transaction for a specific account, or other tokens 7 (A001 registered for use). , A002), you can apply for use registration (change) at any time, such as when you want to replace it,

  FIG. 1 schematically shows the relationship among the customer ID (aaa), customer account (X, Y, Z), customer employee (A, B, C), and token ID (A001 to A003). As described later, these pieces of information are registered and managed in the storage device of the account information management system 1.

(Schematic configuration of account information management system)
In order to exhibit the functions described above, the account information management system 1 of the present embodiment has a configuration as shown in FIG.
Specifically, as shown in FIG. 2A, the system 1 includes an external storage such as a RAM 13, a ROM, and an HDD via a system bus 12 to a CPU 11 built in a host computer provided in the financial institution 2. A device 14 and an input / output interface (I / F) 15 are connected to each other. The input / output I / F 15 includes an input device 16 such as a keyboard and a mouse, an output device 17 such as a display, a communication device 18 such as a NIC, and a drive 20 for a removable recording medium 19 such as a CD-ROM or DVD-ROM. It is connected. As shown in FIG. 2B, the external storage device 14 includes a data storage unit 14a and a program storage unit 14b. Both are fixed storage areas secured in the storage device 14.

  In such a hardware configuration, various commands are received from the customer terminal 5 via the communication I / F, the communication device 18 or the like, or the operator of the financial institution 2 operates the input device 16 to perform various commands (commands). ), The software program installed in the storage device (program storage unit 14b) is called and executed by the CPU 11 in the work area of the RAM 13, thereby cooperating with the OS (operation system). It comes to play the function of.

(data structure)
As shown in FIG. 2B, the data storage unit 14a includes a customer basic information storage unit 21, a customer employee information storage unit 22, an account basic information storage unit 23, a transaction authority management table 24, and a token management table 25. I have. As shown in FIG. 3, these storage units and tables can be referred to each other according to key data such as a customer ID and an employee ID, and function as one database (customer information storage unit). Some of these pieces of information can be extracted from an existing database server or synchronized.

  As shown in FIG. 3A, the customer basic information storage unit 21 associates customer basic information such as the name, address, telephone number, and information of the main branch in charge with the customer code set by the financial institution 2 as shown in FIG. Store.

  As shown in FIG. 3B, the customer employee information storage unit 22 stores the name and login information (user ID and login password) of the employee of the customer company 3 acquired from the customer company 3 when the account is opened, The identification information (ID such as employee number and user ID) of the management employee designated by the customer company 3 as the account manager among the employees is stored in association with the customer ID. A flag “1” indicating “managed employee” is registered in the person set as the managed employee. Since it is not necessary to acquire and register information for all employees, account transactions can be made from employees in departments (such as accounting departments and purchasing departments) who are most likely to conduct transactions through net banking, and from administrative employees. It is preferable to register only authorized employee information.

  As shown in FIG. 3C, the account basic information storage unit 23 stores information of a plurality of customer accounts in association with customer IDs. When the customer company 3 wishes to group multiple accounts, the representative account number (a 10-digit number combining the branch code and the account number) designated by this customer (management employee) It is registered as a group identification number (contract identification information) for linking with an account. Thus, by grouping a plurality of customer accounts, both customers and financial institutions can be managed in a unified manner. Whether or not to group a plurality of customer accounts and which group of a plurality of customer accounts are grouped can all be determined by the customer company 3 side. You may apply for grouping at the same time as opening an account. In addition, as the representative account, an account having the youngest account number may be set by default. Further, the group identification number may be newly generated on the financial institution side based on the customer ID, the representative account number, or the like.

  As shown in FIG. 3D, the transaction authority management table 24 stores the account transaction authority information set for each employee in association with the employee ID for each account. In this embodiment, the transaction authority includes (1) general transaction such as balance inquiry and financial product data request, (2) specific transaction accompanied by asset changes such as account transfer and account transfer, and (3) transaction authority. It can be set in three stages: procedures related to management information such as settings / changes. For the employee of ID: aaa11111, who is a management employee, all transaction authorities are set for all accounts.

  As shown in FIG. 3 (E), the token management table 25 stores the ID of the token 7 registered for use by the management employee and the ID of the employee who uses the token 7 in association with the customer ID. It is. Among these, the customer ID is registered in the token management table 25 when the token 7 is distributed to the customer. In the illustrated example, the employee ID is registered for the tokens 7 with IDs: A001 and A002, but the token 7 with ID: A003 is not registered. This indicates that the ID of the token 7 sent to the customer company 3 at the time of opening the account is registered in the financial institution 2, but is not associated with any account or any customer employee. For this reason, even if such an unregistered token 7 is lost, a third party cannot conduct account transactions illegally or register for use without permission.

(Program structure)
The software program stored in the program storage unit 14b shown in FIG. 2B mainly includes account information registration application acceptance means (use registration application acceptance means, grouping acceptance means, OTP generation device change application acceptance means, transaction authority setting. Application acceptance means) 26, account information registration means (use registration processing means, group registration means, update means) 27, financial transaction application acceptance means 28, OTP generation means 29, authentication means (transaction availability determination means) 30, and transaction execution Instruction means 31 is provided. Each of these means is actually an independent computer program, its routine, subroutine, module, and the like. Each function is called by the CPU 11 onto the RAM 13 and sequentially executed so that each function cooperates with the OS and hardware. It plays.

  The account information registration application receiving means 26 generates an HTML-format transaction screen and transmits it to the customer terminal 5, acquires necessary information input on the application screen displayed on the browser of the customer terminal 5, and performs various applications. Is to accept. Specifically, the application reception function for the use registration of the distributed token 7, the application reception function for grouping multiple accounts, the change application reception function for the token 7, and the setting (change) of the transaction authority of the customer employee 4 It has an application reception function. Hereinafter, each function will be described in order.

  First, the use registration application accepting function of the token 7 includes information on any one of a plurality of customer accounts via the communication network from the customer terminal 5 of the management employee 4 (employee A in FIG. 1), This is a function for acquiring any one of a plurality of tokens 7 distributed in advance to the customer company 3 and the ID of the management employee 4 and receiving an application for use registration of the token 7.

  The grouping reception function acquires information on a plurality of accounts desired for group management from a plurality of customer accounts held by the customer company 3 from the customer terminal 5 of the management employee 4 via a communication network. This is a function for accepting applications for grouping customer accounts. This function also has a function of accepting an application for exclusion, replacement, addition of another customer account, or group dissolution of a plurality of customer accounts registered in the group. Such group management of a plurality of accounts is the same as in the past, but in this embodiment, as will be described later, it is possible to apply online for group registration and setting change, and it is quick only by authentication of management employees and OTP. It has a feature in that it can be performed.

  The transaction authority setting application acceptance function is configured to send information on any customer account and customer employees other than the management employee (other employees: FIG. 1) from the customer terminal 5 of the management employee via the communication network. ID of the token 7 that has not been registered for use (such as A002 in FIG. 1) and the type of transaction authority shown in FIG. This is a function for accepting an application for setting transaction authority of employees. Note that, as the transaction authority to be permitted, the types of individual transactions and the types of information that can be updated may be acquired, or the validity period of the transaction authority may be set.

  The OTP generation device change application acceptance function is a function for accepting a change to another token 7 for the token 7 registered for use. Specifically, the ID of the token 7 distributed to the customer company 3 and not yet registered for use from the customer terminal 5 of the management employee or the second employee who has registered the token 7 and the employee's ID The ID is acquired, and an application for changing the token 7 registered in the token management table 25 is accepted.

  The account information registration unit 27 updates the account basic information storage unit 23 based on the acquired information for the application for setting / updating the account information accepted by the account information registration application receiving unit 26. Specifically, a token 7 usage registration function, a multiple account group registration function, and a transaction authority change registration function for the token 7 and the customer employee 4 are provided. Hereinafter, each function will be described in order.

  First, the use registration function of the token 7 is a function for registering the ID of the token 7 related to the application for use registration in the token management table 25 in association with the ID of the management employee and the ID of the second employee. As shown in FIGS. 3D and 3E, the transaction authority management table 24 and the token management table 25 can be referred to each other using the employee ID as a key. It will be associated with such an account.

  Next, the group registration function of a plurality of accounts is configured such that when the account information registration application receiving means 26 (grouping reception function) receives an application for grouping of customer accounts, the acquired information on the plurality of customer accounts is stored in the account. This is a function of retrieving from the basic information storage unit 23, assigning a representative account number (group identification number) designated by the management employee to these customer accounts, and registering it in the account basic information storage unit 23. At this time, when the token ID of the management employee is registered in the customer account designated as the representative account, it is preferable to register the same token ID in the other grouped accounts. In addition, this group registration function is such that the account information registration application receiving means 26 (grouping reception function) excludes or replaces some of the plurality of customer accounts registered in the group, adds other customer accounts, or It also has a function of updating the group information in the account basic information storage unit 23 according to the accepted contents when an application for dissolution of the group is accepted.

  The transaction authority change registration function for the token 7 and the customer employee 4 is such that the account information registration application acceptance means 26 (transaction authority setting application acceptance function) obtains information on a specific account, employee ID, and transaction authority information. When acquired, it is a function of registering the acquired transaction authority information in the transaction authority management table 24 in association with the employee ID and the customer account related to the application. In addition, when the account information registration application acceptance means 26 (OTP generation device change application acceptance function) acquires the ID of the management employee or another employee (second employee) and the unregistered token ID, The employee also has a function of updating the token ID registered in the token management table 25 to the acquired token ID.

  The financial transaction application accepting means 28 sends the account information, transaction type, transaction amount / transfer destination, etc. from the customer terminal 5 of the management employee 4 or the second employee via the communication network. The contents, the ID of the employee, and the OTP generated by the token 7 are acquired to accept an application for a financial transaction. Of the acquired information, the account information, transaction type, and employee ID are transferred to the authentication means 30, the employee ID is transferred to the OTP generation means 29, and the account information and transaction contents are transferred to the transaction execution instruction means 31, respectively.

  The OTP generation unit 29 searches the token management table 25 for the token 7 associated with the employee ID acquired by the financial transaction application reception unit 28, and generates an OTP generation algorithm and generation using predetermined parameters such as hour and minute. OTP is generated in synchronization with the searched token 7 in a cycle (effective period of OTP). Since various conventionally known methods can be adopted as the OTP generation algorithm, detailed description thereof is omitted.

  The authentication unit 30 determines whether or not a financial transaction related to the application is possible by comparing login authentication using an employee ID and password, primary authentication using an account number and a personal identification number, and comparing the generated OTP with the acquired OTP. (Transaction) Authentication is executed. Note that login authentication and primary authentication may be made common. Since the employee C illustrated in FIG. 1 (the employee of ID: aaa33333 in FIG. 3D) has only “(1) general transaction” registered as transaction authority, login authentication and primary authentication pass. Since the token 7 is not registered for use, secondary authentication cannot be passed, and important transactions (specific transactions) such as transfer and transfer cannot be performed.

  The transaction execution instructing means 31 sends a transaction execution instruction including transaction details (transaction type, transfer destination, transaction amount, etc.) acquired at the time of acceptance to the accounting system etc. Output. Since the function of executing a transaction when the authentication is affirmative is the same as the conventional transaction processing, the transaction execution instructing means 31 can be incorporated in a billing system or the like.

(flowchart)
Hereinafter, detailed functions of the system 1 will be described together with actual operations with reference to the flowchart of FIG. In the following, as in FIG. 1, after the management employee 4 of the customer company 3 who holds three accounts in the financial institution 2 has registered for the use of his token 7, A transaction authority is set for the other employee 4, and processing steps until the other employee 4 actually requests a transaction will be described. Note that. For convenience of explanation, as in FIG. 1, the management employee is represented as “employee A” and the other employees 4 as “employee B”.

  First, the employee A (administrative employee) operates the customer terminal 5 to log in to the system 1 and selects “token usage registration” from the transaction screen (not shown) displayed on the terminal 5 screen. Then, when the own ID, the ID of the token 7 and the account information of one of the three are input and transmitted (S1), the account information registration application accepting means 26 of the present system 1 acquires the information and obtains the token. 7 application for use registration is accepted (S2).

  Here, the authentication means 30 is activated, and the employee ID of the customer employee information storage unit 22 is compared with the acquired ID to perform personal authentication of the employee A (S3). If the authentication is affirmed, the account information registration means 27 (group registration function) searches the account basic information storage unit 23 for all accounts based on the ID of the customer company 3 (S4). When information on a plurality of accounts to be grouped is acquired from the management employee A, the accounts are specified from the account basic information storage unit 23.

  Next, the account information registration means 27 (group registration function) records the account number of this representative account in another account with the account for application as the representative account (S5). Further, the account information registration unit 27 (token 7 usage registration function) registers the token ID of the employee A involved in the application in association with all accounts including the representative account (S6).

  When the use registration of the token 7 is completed, the account information registration unit 27 generates a registration completion screen by combining registration items on a predetermined screen form and transmits it to the customer terminal 5 of the employee A, thereby registering the use of the token. Completion is notified (S7). When this registration completion notification is received (S8), employee A can use the OTP generated by this token 7 for account transactions. As described above, everything can be done online from the application for use registration of the token 7 (S1) until the account transaction becomes possible (S8), so there is a procedural load on both the client company 3 and the financial institution 2. It is reduced. In addition, since authentication is performed based on an employee ID or token ID shared offline when an account is opened, fraudulent acts such as impersonation can be effectively prevented, and security can be maintained.

  If employee A wants to allow account transactions for another employee B, select “Register Authority” from the transaction screen, and the ID of the token 7 to be used by this employee B, and the account for which transactions are permitted. Information and the type of transaction authority (see FIG. 3D) are transmitted (S9). The transmitted information is acquired by the account information registration application receiving means 26 (transaction authority setting application reception function) of the system 1 and receives the transaction authority setting application (S10). It may be processed as “token usage registration”.

  Here, if the customer terminal 5 of the employee A disconnects the communication with the system 1 after completion of the token use registration described above, the authentication unit 30 performs the authority authentication of the employee A again at this point. (S11). On the other hand, when the employee A continues to apply for authority setting within the same communication session as the token use registration, the authentication process is skipped because the authentication result of S3 is held. If all employees or customer accounts of the customer company 3 are registered in advance in the customer employee information storage unit 22 (see FIG. 3B), the ID of the employee B involved in the application is the customer employee information. You may make it authenticate whether it is registered into the storage part 22. FIG.

  Next, the account information registration means 27 (transaction authority change registration function) registers the ID of the employee B and the ID of the new token 7 for the account related to the application (S12). When this authority registration is completed, the account information registration means 27 synthesizes the registration items on a predetermined screen form, generates a registration completion screen, and transmits it to the customer terminal 5 of the employee A to notify the authority registration completion. (S13). Upon receipt of this registration completion notification, employee A informs employee B of that fact (S14). This also enables employee B to conduct a registered transaction for the authorized account. In this way, it is very easy to manage accounts on the customer side, because it is possible for the customer company to freely set which employees are allowed to perform account transactions and the content of authorized transaction authority at any time. . If you want to allow other employees only general transactions that do not use OTP, you can register with the same application procedure as above.

  Employee B, who has received notification from employee A that his / her authority registration has been completed, activates his / her customer terminal 5 browser and displays the login screen of the system 1 when he / she wants to perform an account transaction. The login information (employee ID, login password) is input and transmitted (S15). The authentication means 30 that has acquired the login information collates with the login information registered in the customer employee information storage unit 22 and performs login authentication of the employee B (S16). When login is permitted, employee B selects “account transaction” from the menu screen to display the transaction information input screen, and the account (account allowed to transact) and transaction type (account transfer, etc.) The transaction contents (amount, transfer account, etc.) and the OTP generated by the use-registered own token 7 are input and transmitted (S17).

  The transmitted information is acquired by the financial transaction application acceptance means 28. Of the acquired information, account information, transaction type and employee ID are transferred to the authentication means 30, and the transaction authority of this employee B is authenticated based on the information registered in the transaction authority management table 24 ( S18). If the authorization of transaction authority is positive, the financial transaction application acceptance means 28 transfers the employee ID to the OTP generation means 29 and instructs the OTP generation. Based on the employee ID, the OTP generation means 29 identifies seven tokens of the employee B from the token management table 25 (S19), and generates an OTP according to the same generation algorithm as the token 7 (S20). The generated OTP is transmitted to the authentication means 30.

  The authenticating means 30 compares the OTP generated by the OTP generating means 29 with the OTP transferred from the financial transaction application receiving means 28 to determine the legitimacy of the transaction (S21). When the OTP matches and it is determined that the transaction is valid, the transaction execution instructing means 31 that has received the authentication result includes an account, transaction type, and transaction details (amount, bank account, etc.) in the account system. The transaction information is transferred to the accounting system (S22). Note that if the transaction type is a general transaction such as a balance inquiry, the OTP authentication is not required, and the steps S19 to S21 are skipped.

  As described above, in this embodiment, grouping of multiple accounts and authority setting of other employees can be performed with simple procedures, so that the client company 3 can flexibly manage multiple accounts and employee authority. Can be done. Also, since all processing can be performed online in real time, the convenience of net banking is not impaired. In addition, OTP is used together for important transactions involving asset changes, and security can be maintained by allowing only management employees to apply for account group settings / changes and employee authority settings.

  In addition, this invention is not limited to said embodiment, A various deformation | transformation is possible in the range which does not change the summary of invention.

  For example, use registration of a plurality of tokens and authority settings of a plurality of employees may be accepted simultaneously. In this case, since a plurality of setting registrations can be performed by one authentication of the management employee, the load and time of the registration procedure can be reduced. In addition, the management company, the representative account, and the number of tokens associated with the employee may be made plural so that the client company can use them properly.

FIG. 1 is a network configuration diagram conceptually showing an embodiment of the present invention. FIG. 2 is a block diagram showing a schematic configuration of the account information management system of the present embodiment. FIG. 3 is a diagram conceptually showing the data structure of the data storage unit. FIG. 4 is a flowchart showing the processing steps of the present invention.

Explanation of symbols

1 ... Account information management system 2 ... Financial institutions 3 ... Customer companies 4 ... Customer employees (administrative employees, other employees)
5 ... Customer terminal 7 ... OTP generator (token)
11 ... CPU
12 ... System bus 13 ... RAM
DESCRIPTION OF SYMBOLS 14 ... External storage device 14a ... Data storage part 14b ... Program storage part 15 ... Input / output interface 16 ... Input device 17 ... Output device 18 ... Communication device 19 ... Removable recording medium 20 ... Drive 21 ... Customer basic information storage part 22 ... Customer Employee information storage unit 23 ... Account basic information storage unit 24 ... Transaction authority management table 25 ... Token management table 26 ... Account information registration application acceptance means 27 ... Account information registration means 28 ... Financial transaction application acceptance means 29 ... OTP generation means 30 ... Authentication means 31 ... Transaction execution instruction means

Claims (12)

In an account information management system in which a customer's communication terminal (customer terminal) is connected via a communication network and this customer manages information of a plurality of net banking accounts (customer accounts) held in financial institutions,
A customer information storage unit that stores information of a plurality of customer accounts and identification information of a plurality of one-time password (OTP) generating devices distributed in advance to the customer in account units in association with the customer identification information;
Identification information of any OTP generating device distributed to this customer for at least one of a plurality of customer accounts from a customer terminal of a customer employee (management employee) who manages the customer account via a communication network And a use registration application accepting means for obtaining the identification information of the management employee and accepting an application for use registration of the OTP generating device,
And a usage registration processing means for registering the acquired identification information of the OTP generation device in the customer information storage unit in association with the identification information of the management employee and the customer account related to the application. The system of claim 1, comprising:
further,
Grouping reception means for acquiring information on a plurality of customer accounts held by the customer from the customer terminal of the management employee via a communication network and receiving an application for grouping of customer accounts;
A group registration means for retrieving information of a plurality of customer accounts from the customer information storage unit, assigning a common group identification number to the plurality of customer accounts, and registering in the customer information storage unit System. The system of claim 2, wherein
When the registration information of the OTP generation device of the management employee is registered for one of the plurality of customer accounts registered in the group by the group registration unit, the usage registration processing unit registers the management employee for the other customer accounts of the group. A system for registering employee identification information and OTP generation device identification information. The system of claim 3, comprising:
The customer information storage unit registers one of a plurality of customer accounts registered as a group as a representative account, and registers the identification information of the representative account as the group identification number for another group account. A system characterized by The system of claim 3, comprising:
The grouping acceptance means is for accepting an application for exclusion, replacement, addition of another customer account, or dissolution of a group of a part of a plurality of grouped customer accounts,
The group registration means updates the group information in the customer information storage unit according to the contents of the application. The system of claim 1, comprising:
further,
From the management employee's customer terminal, the management employee's identification information and the OTP generated by the OTP generation device distributed to the customer are obtained via a communication network, and an application for a financial transaction is made for the customer account. Accepting financial transaction application acceptance means,
The OTP generation device associated with the acquired management employee identification information is searched from the customer information storage unit, and the OTP generation device searched with the generation algorithm and generation cycle (OTP validity period) using predetermined parameters OTP generation means for generating OTP in synchronization with
A transaction feasibility determining means for comparing the generated OTP with the acquired OTP to determine the feasibility of a financial transaction related to the application;
And a transaction execution instructing means for outputting, to the financial transaction system, an instruction to execute a financial transaction related to the application when it is determined that the transaction is possible. The system of claim 6, comprising:
The customer information storage unit includes, for a specific customer account, an identification information of a customer employee who is permitted to perform a financial transaction other than the management employee, and an OTP generation device registered in association with the identification information of the management employee. It stores the identification information of different OTP generation devices in association with each other,
The OTP generation unit searches the customer information storage unit for an OTP generation device associated with the identification information of the acquired management employee or authorized customer employee, and generates an OTP in synchronization therewith. System. The system of claim 1, comprising:
Further, from the customer terminal of the management employee, information on any customer account, identification information of a customer employee (second employee) other than the management employee, and usage registration are transmitted via a communication network. A transaction authority setting application receiving means for acquiring the identification information of the OTP generating device that has not been received and receiving the transaction authority setting application of the second employee,
The usage registration processing means registers the acquired identification information of the OTP generation device in the customer information storage unit in association with the identification information of the second employee and the customer account related to the application. 9. The system of claim 8, comprising:
The transaction authority setting application accepting means, from the customer terminal of the management employee, of the type of transaction permitted to the second employee and / or information registered in the customer information storage unit regarding the customer account related to the application The type of information that can be updated (hereinafter collectively referred to as “transaction authority information”) is also acquired.
The usage registration processing means registers the acquired transaction authority information in the customer information storage unit in association with the identification information of the second employee and the customer account related to the application. 9. The system of claim 8, comprising:
further,
From the customer terminal of the management employee or the second employee, the identification information of the OTP generating device distributed to this customer and not registered for use and the identification information of this employee are acquired and stored in the customer information storage unit An OTP generating device change application accepting means for accepting an application for changing a registered OTP generating device;
Update means for identifying the identification information of the OTP generation device registered in the customer information storage unit for the employee based on the acquired employee identification information, and updating the acquired identification information of the OTP generation device. A system characterized by that. In a method executed by an account information management system in which a customer's communication terminal (customer terminal) is connected via a communication network and this customer manages information on a plurality of net banking accounts (customer accounts) held in financial institutions. There,
The account information management system stores a plurality of customer account information and identification information of a plurality of one-time password (OTP) generating devices distributed in advance for each account in association with customer identification information. A storage unit,
This method
Identification information of any OTP generating device distributed to this customer for at least one of a plurality of customer accounts from a customer terminal of a customer employee (management employee) who manages the customer account via a communication network And a use registration application receiving step of acquiring the management employee identification information and receiving an application for use registration of the OTP generating device,
A usage registration processing step of registering the acquired identification information of the OTP generation device in the customer information storage unit in association with the identification information of the management employee and the customer account related to the application. Executes an account information management method for managing information on multiple Internet banking accounts (customer accounts) held by a customer in a financial institution on a computer system to which customer communication terminals (customer terminals) are connected via a communication network In a computer program for causing
The computer system stores information on a plurality of customer accounts and identification information on a plurality of one-time password (OTP) generating devices distributed to the customer in units of accounts in association with customer identification information, respectively. With
This program
Identification information of any OTP generating device distributed to this customer for at least one of a plurality of customer accounts from a customer terminal of a customer employee (management employee) who manages the customer account via a communication network And a use registration application receiving step of acquiring the management employee identification information and receiving an application for use registration of the OTP generating device,
A use registration processing step of registering the acquired identification information of the OTP generation device in the customer information storage unit in association with the identification information of the management employee and the customer account related to the application.

Images