Abstract:
A card payment device includes a payment acceptor accepting a card payment amount using a card, card data reader reading card data including a card identifier, biometric-data acquirer acquiring user&#39;s first biometric data and processor. When second biometric data is included in the card data, the processor executes biometric authentication based on the first and second biometric data. The processor generates first payment data including the card identifier, payment amount and first biometric data, and transmits the first payment data to a server, when the first biometric data is acquired and the second biometric data is not acquired. The processor generates second payment data including the card identifier, the payment amount and an authentication success notice, and transmits the second payment data to the server, when the first and second biometric data are acquired and the biometric authentication succeeds.

Description:
TECHNICAL FIELD 
       [0001]    A present invention relates to a card payment device and a card payment system executing biometric authentication. 
       BACKGROUND ART 
       [0002]    Illegal use of credit cards, such as use of a fake signature, analysis of a password, skimming, card counterfeiting, or unapproved use by a relative, is increasing. 
         [0003]    In card payment, there is a method of detecting and preventing illegal use of a card, based on patterning of contents of use, or by scoring based on the number of times of use, intervals of use, used stores, purposes of use, credit balance, etc. 
         [0004]    Current credit cards do not store biological data. When biometric authentication is performed in a current card payment system, it is not executed at a card terminate device, but is executed in a server of an issuer (card issuer). 
         [0005]    Further, as an example of a system for confirming a user based on biometric authentication, there is an automatic teller&#39;s machine (ATM) that performs balance inquiry of bank deposits and postal savings, account activity, transfer processing, etc. In such a bank system, although the ATM acquires biometric data, biometric authentication is performed by a server of a bank. 
       SUMMARY OF INVENTION 
     Technical Problems 
       [0006]    As mentioned above, current credit cards do not store biometric data, and biometric authentication is performed in the server of the issuer in the current card payment system. Thus, when biometric authentication is performed by the server of the issuer, it is necessary to transmit biometric data of a card user, acquired at the time of payment, from a card payment device to the issuer&#39;s server. It is also necessary to execute biometric authentication based on biometric data received by the issuer&#39;s server, and biometric data pre-stored when a card was issued. Because of this, an increase may occur in a load of the issuer&#39;s server, in the amount of communication between the card payment device and the issuer&#39;s server, and in a latency period until authentication of a card user finishes. 
         [0007]    The same can be applied to a bank system. Since biometric data of a user acquired by an ATM is transmitted to the server of a bank, and biometric authentication is executed by the server of the bank, a great load is exerted on the server of the bank. Moreover, since same biometric data is not mutually utilized between different banks, and different types of biometric data unique to the banks are used therein, it is difficult to perform effective use of biometric data and biometric authentication. 
         [0008]    The present invention has been developed in view of the above circumstances, and aims to provide a card payment device and a card payment system capable of efficiently preventing illegal use of card payment by executing biometric authentication by the card payment device. 
       Solution to the Problems 
       [0009]    A card payment device according to an embodiment of a present invention includes a payment acceptance unit, a card data read unit, a biometric-data acquisition unit, and a processing unit. The payment acceptance unit accepts an amount of payment using a card. The card data read unit reads card data stored in the card and including card identification information. The biometric-data acquisition unit acquires first biometric data of a user who performs payment using the card. The processing unit executes biometric authentication based on the first biometric data acquired by the biometric-data acquisition unit, and second biometric data included in the card data, when the second biometric data compared with the first biometric data is included in the card data. The processing unit generates first payment data including the card identification information, the amount of payment and the first biometric data when the first biometric data is acquired and the second biometric data is not acquired, and transmits the first payment data to a server. The processor generates second payment data including the card identification information, the amount of payment and an authentication success notice when the first biometric data and the second biometric data are acquired and the biometric authentication succeeds, and transmits the second payment data to the server. The processor terminates transaction when the first biometric data is not acquired or when the biometric authentication fails. 
       Advantage of Invention 
       [0010]    According to the invention, illegal use of card payment can be prevented, by executing biometric authentication by the card payment device. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0011]      FIG. 1  is a block diagram showing an example of configuration of a card payment device according to a present embodiment. 
           [0012]      FIG. 2  is a flowchart showing an example of processing by the card payment device. 
           [0013]      FIG. 3  is a flowchart showing an example of biometric authentication. 
           [0014]      FIG. 4  is a block diagram showing an example of configuration of a card payment system, and data transmission/reception states assumed when biometric authentication is succeeded in the card payment device. 
           [0015]      FIG. 5  is a block diagram showing an example of the configuration of the card payment system, and data transmission/reception states assumed when biometric authentication is succeeded in a computer system of an acquirer (card payment enterprise). 
           [0016]      FIG. 6  is a block diagram showing an example of the configuration of the card payment system, and data transmission/reception states assumed when biometric authentication is succeeded in a computer system of a card brand. 
           [0017]      FIG. 7  is a block diagram showing an example of the configuration of the card payment system, and data transmission/reception states assumed when biometric authentication is succeeded in a computer system of an issuer. 
           [0018]      FIG. 8  is a flowchart showing an example of the biometric authentication executed by the computer system of the acquirer and the computer system of the card brand. 
           [0019]      FIG. 9  is a flowchart showing an example of the biometric authentication executed by the computer system of the issuer. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0020]    An embodiment of a present invention will be described with reference to the accompanying drawings. In the descriptions below, similar reference numbers denote elements similar in function and structure, and duplicate descriptions will be given only when necessary. 
         [0021]    In the present embodiment, a description will be given of a card payment system including a card payment device that executes biometric authentication. 
         [0022]    In the present embodiment, a case where a credit card is used as a card storing biometric data used for biometric authentication is described as an example. However, as the card storing biometric authentication data, various types of cards used for payment, such as a debit card and an electronic money card, may be used. 
         [0023]      FIG. 1  is a block diagram showing an example of configuration of a card payment device according to the present embodiment. 
         [0024]    In the present embodiment, a card C of a user U stores, for example, card data  6  that includes a card number  2  as an example of card identification information, an expire date  3 , a name  4 , and biometric data  5 , etc. The card data  6  is already stored in the card C when, for example, the card is issued. As biometric data  5 , a fingerprint pattern, an iris pattern or a vein pattern is used, for example. Biometric data  5  is compared in biometric authentication with biometric data  13  of the user U acquired at the time of payment. 
         [0025]    For instance, the card data  6  is stored at least one of magnetic information of the card C, and information of integrated circuit (IC) chip of the card C. In the present embodiment, biometric data  5  is assumed to be stored in the IC chip of the card C. 
         [0026]    A card payment device  1  includes a biometric-data acquisition unit  7  and a card device  8 . The card payment device  1  includes a card data read unit  9 , a payment acceptance unit  10 , a processing unit  11  and a communication device  12 . 
         [0027]    Although a case where the card payment device  1  is installed in a member store of a card payment service is described as an example in the present embodiment, the card payment device  1  may be another type of device that can acquire biometric data  5  of the user U and the card data  6  of the card C. For instance, the card payment device  1  may be an information processing device including a biometric-data acquisition function, a card data read function, a payment acceptance function, a biometric authentication function and a communication function. Each function of the information processing device may be realized by software, hardware, or cooperation of software and hardware. Hardware needed to realize each function of the information processing device may be built therein, or may be externally attached to the information processing device. Purchase of a product or a service according to the present embodiment, may be performed at a store or at an electronic commerce site or service providing site on a network. As the information processing device, a cellular phone, a personal computer, a tablet computer, etc., may be used. 
         [0028]    The payment acceptance unit  10  accepts an amount of payment, a payment method (for example, single payment or divided payment), etc., in accordance with an operation by, for example, a salesclerk B of the member store, etc., and sends the amount of payment and the payment method to the processing unit  11 . 
         [0029]    The card data read unit  9  reads the card data  6  stored in the card C of the user U, and sends the card data  6  to the processing unit  11 . 
         [0030]    The biometric-data acquisition unit  7  acquires biometric data  13  of the user U at the time of card payment, and sends the biometric data  13  to the processing unit  11  in the card device  8 . 
         [0031]    The processing unit  11  determines whether biometric data  13  of the user U at the time of payment is read by the biometric-data acquisition unit  7 . 
         [0032]    Further, the processing unit  11  determines whether biometric data  5  is included in the card data  6  read by the card data read unit  9 . 
         [0033]    Furthermore, the processing unit  11  performs biometric authentication (collation) based on biometric data  5  in the card C, and biometric data  13  of the user U at the time of payment. 
         [0034]    If biometric data  13  of the user U at the time of payment is read, and if biometric data  5  is not included in the card data  6 , the processing unit  11  generates payment data  16 A including the card number  2 , the expire date  3 , the name  4 , biometric data  13  of the user U at the time of payment, a payment amount  14  and a payment method  15 , based on the card data  6 , the payment amount, the payment method, and biometric data  13  of the user U at the time of payment. 
         [0035]    In contrast, if biometric data  13  of the user U at the time of payment is read by the biometric-data acquisition unit  7 , biometric data  5  included in the card data  6  is acquired, and biometric authentication based on biometric data  5  in the card C and biometric data  13  of the user U at the time of payment is succeeded, the processing unit  11  generates payment data  16 B including the card number  2 , the expire date  3 , the name  4 , an authentication success notice  17 , the payment amount  14  and the payment method  15 , based on the card data  6 , the payment amount and the payment method. 
         [0036]    The authentication success notice  17  includes authentication executor ID (identification information) which identifies an executor having executed the biometric authentication. If in the processing unit  11 , biometric authentication is succeed, the authentication executor ID may be, for example, identification information of the member store that uses the card payment device  1 , identification information of the card payment device  1 , or identification information of an account of the member store. 
         [0037]    If biometric data  13  of the user U at the time of payment is not read by the biometric-data acquisition unit  7 , or if biometric authentication based on biometric data  5  in the card C and biometric data  13  of the user U at the time of payment is failed, the processing unit  11  determines termination of transaction, based on biometric authentication failure. 
         [0038]    Upon generating payment data  16 A or  16 B, the processing unit  11  sends payment data  16 A or  16 B to the communication device  12 . 
         [0039]    Examples of the above-mentioned processing by the processing unit  11  will be described later with reference to  FIGS. 2 and 3 . 
         [0040]    The communication device  12  transmits payment data  16 A or  16 B to a server of an issuer as a destination via a network. The communication device  12  may transmit payment data  16 A or  16 B to the server of the issuer via at least one of a server of an acquirer and a server of a card brand. 
         [0041]      FIG. 2  is a flowchart showing an example of processing by the card payment device  1 . 
         [0042]    In step S 101 , the card payment device  1  of the member store is turned on, and the biometric-data acquisition unit  7  and the card device  8  become a standby state. 
         [0043]    In step S 102 , the card payment device  1  executes payment acceptance processing using the payment acceptance unit  10 . For instance, in the payment acceptance processing, an amount of payment and a method of payment associated with an article of commerce or a service is accepted. 
         [0044]    In step S 103 , the card payment device  1  executes card-data read processing using the card data read unit  9 . For example, in the card-data read processing, a data storage area for the card data  6  is initialized, and reading of the card data  6  is executed. If the card data  6  is read, the card data  6  is stored in the data storage area allocated to the card data  6 . For instance, if reading of the card data  6  failed a predetermined number of times, for example, three times, an error is displayed. 
         [0045]    In step S 104 , the card payment device  1  executes biometric-data acquisition processing using the biometric-data acquisition unit  7 . For example, in the biometric-data acquisition processing, a data storage area for biometric data  13  of the user U at the time of payment is initialized, and acquisition of biometric data  13  is executed. If biometric data  13  is acquired, biometric data  13  is stored in the data storage area allocated to biometric data  13 . For example, if acquisition of biometric data  13  failed a predetermined number of times, for example, three times, an error is displayed. 
         [0046]    In step S 105 , the card payment device  1  executes biometric authentication, based on the payment acceptance, the card data  6 , and the biometric data  13  at the time of payment. Based on a result of biometric authentication, generation of payment data  16 A, generation of payment data  16 B, or termination of transaction is executed. 
         [0047]    In step S 106 , if the card payment device  1  is continuously used, the processing returns to step S 102 . 
         [0048]    In contrast, if the card payment device  1  is not continuously used, the card payment device  1  is turned off in step S 107 . 
         [0049]      FIG. 3  is a flowchart showing an example of biometric authentication. 
         [0050]    In step S 201 , the processing unit  11  determines whether biometric data  13  of the user U at the time of payment is acquired. 
         [0051]    If biometric data  13  of the user U at the time of payment is not acquired, the processing proceeds to step S 205 . 
         [0052]    If biometric data  13  of the user U at the time of payment is acquired, the processing unit  11  determines, in step S 202 , whether biometric data  5  in the card data  6  is acquired. 
         [0053]    If biometric data  5  in the card data  6  is not acquired, the processing proceeds to step S 206 . 
         [0054]    If biometric data  5  in the card data  6  is acquired, the processing unit  11  determines, in step S 203 , whether biometric authentication is succeeded, based on biometric data  5  in the card data  6 , and biometric data  13  of the user U at the time of payment. 
         [0055]    If the biometric authentication is succeeded, the processing unit  11  generates, in step S 204 , payment data  16 B that includes the authentication success notice  17  including the authentication executor ID. 
         [0056]    If biometric data  13  of the user U at the time of payment is not acquired in step S 201 , or if the biometric authentication is not succeeded in step S 203 , the processing unit  11  outputs, in step S 205 , data designating failure of the biometric authentication and terminates the transaction. 
         [0057]    If biometric data  5  in the card data  6  is not acquired in step S 202 , the processing unit  11  generates, in step S 206 , payment data  16 A including biometric data  13  of the user U at the time of payment. 
         [0058]    Referring now to  FIGS. 4 to 7 , a description will be given of a card payment system including the card payment device according to the present embodiment. 
         [0059]    As shown, a card payment system  18  includes the card payment device  1 , a computer system  19  of an acquirer, a computer system  20  of a card brand, and a computer system  21  of an issuer. 
         [0060]    The card payment device  1  and the computer system  19  of the acquirer can transmit and receive data through a network  22 . The computer system  19  of the acquirer and the computer system  20  of the card brand can transmit and receive data through a network  23 . Further, the computer system  20  of the card brand and the computer system  21  of the issuer can transmit and receive data through a network  24 . 
         [0061]    The computer system  19  of the acquirer includes a server  19   a  and a database  19   b.    
         [0062]    The computer system  20  of the card brand includes a server  20   a  and a database  20   b.    
         [0063]    The computer system  21  of the issuer includes a server  21   a  and a database  21   b.    
         [0064]      FIG. 4  is a block diagram showing a configuration example of the card payment system  18 , and data transmission/reception states assumed when biometric authentication is succeeded in the card payment device  1 . 
         [0065]    If the biometric authentication is succeeded in the card payment device  1 , the card payment device  1  transmits payment data  16 B including the authentication success notice  17  including the authentication executor ID to the computer system  19  of the acquirer via the network  22 . In the example of  FIG. 4 , the authentication executor ID designates, for example, the member store. 
         [0066]    Since payment data  16 B received from the card device  1  via the network  22  includes the authentication success notice  17 , the computer system  19  of the acquirer executes various types of necessary processing without executing biometric authentication, and transmits payment data  16 B to the computer system  20  of the card brand via the network  23 . 
         [0067]    Since payment data  16 B received from the computer system  19  of the acquirer via the network  23  includes the authentication success notice  17 , the computer system  20  of the card brand executes various types of necessary processing without executing biometric authentication, and transmits payment data  16 B to the computer system  21  of the issuer via the network  24 . 
         [0068]    Since payment data  16 B received from the computer system  20  of the card brand via the network  24  includes the authentication success notice  17 , the computer system  21  of the issuer executes various types of necessary processing, such as credit processing and payment processing, without executing biometric authentication, and transmits credit result data  25  to the card payment device  1  via the network  24 , the computer system  20  of the card brand, the network  23 , the computer system  19  of the acquirer, and the network  22 . 
         [0069]    The computer system  20  of the card brand and the computer system  19  of the acquirer may execute various types of necessary processing based on the credit result data  25 . 
         [0070]    The card payment device  1  outputs data designating completion of payment or failure of payment, based on the credit result data  25 . 
         [0071]    In the present embodiment, when received payment data  16 B includes the authentication success notice  17 , server  20   a  of the computer system  20  of the card brand executes privilege processing  26  on at least one of a person (the member store in the example of  FIG. 4 ) designated by the authentication executor ID in the authentication success notice  17 , and the user U. 
         [0072]    Privilege that the authentication executor can receive includes, for example, addition of a bonus point, or an increase in the amount of money (commission) received by the authentication executor. 
         [0073]    Privilege that the user U can receive includes, for example, addition of point, or discount service. 
         [0074]      FIG. 5  is a block diagram showing an example of the configuration of the card payment system  18 , and data transmission/reception states assumed when biometric authentication is succeeded in computer system  19  of the acquirer. 
         [0075]    In  FIG. 5 , the card C does not store biometric data  5  which was registered at the time of issuing the card, and is compared with biometric data  13  of the user U acquired at the time of payment. Biometric data  5  compared with biometric data  13  of the user U at the time of payment is stored in database  19   b  of the computer system  19  of the acquirer. 
         [0076]    In this case, the card payment device  1  transmits payment data  16 A, which includes biometric data  13  of the user U acquired at the time of payment, to the computer system  19  of the acquirer via the network  22 . 
         [0077]    The computer system  19  of the acquirer performs biometric authentication, based on biometric data  5  in database  19   b  and biometric data  13  in payment data  16 A, if payment data  16 A received from the card payment device  1  via the network  22  includes biometric data  13 . 
         [0078]    If the biometric authentication is succeeded in the computer system  19  of the acquirer, the computer system  19  of the acquirer transmits payment data  16 B, which includes the authentication success notice  17  including the authentication executor ID, to the computer system  20  of the card brand via the network  23 . In the example of  FIG. 5 , the authentication executor ID designates the acquirer. 
         [0079]    Since subsequent processing in  FIG. 5  is similar to that of  FIG. 4 , its description is omitted. 
         [0080]    In the example of  FIG. 5 , server  20   a  of the computer system  20  of the card brand executes processing of providing privilege to an executor (acquirer) designated by the authentication executor ID included in the authentication success notice  17  in received payment data  16 B. 
         [0081]      FIG. 6  is a block diagram showing an example of the configuration of the card payment system  18 , and data transmission/reception states assumed when biometric authentication is succeeded in the computer system  20  of the card brand. 
         [0082]    In  FIG. 6 , biometric data  5 , which was registered when the card was issued, and is compared with biometric data  13  of the user U acquired at the time of payment, is not stored in the card C and is not stored in database  19   b  of the computer system  19  of the acquirer. Biometric data  5  compared with biometric data  13  of the user U at the time of payment is stored in database  20   b  of the computer system  20  of the card brand. 
         [0083]    In  FIG. 6 , the card payment device  1  transmits, to the computer system  19  of the acquirer via the network  22 , payment data  16 A including biometric data  13  of the user U at the time of payment. 
         [0084]    The computer system  19  of the acquirer transmits payment data  16 A to the computer system  20  of the card brand via the network  23 , without executing biometric authentication. 
         [0085]    If payment data  16 A received from the computer system  19  of the acquirer via the network  23  includes biometric data  13 , the computer system  20  of the card brand executes biometric authentication, based on biometric data  5  in database  20   b  and biometric data  13  in payment data  16 A. 
         [0086]    If the biometric authentication is succeeded in the computer system  20  of the card brand, the computer system  20  of the card brand transmits, to the computer system  21  of the issuer via the network  24 , payment data  16 B including the authentication success notice  17  that includes the authentication executor ID. In the example of  FIG. 6 , the authentication executor ID designates the card brand. Since server  20   a  can recognize that an executor of the biometric authentication is the card brand, the authentication executor ID may not be included in the authentication success notice  17 . 
         [0087]    Since the subsequent processing in  FIG. 6  is similar to that of  FIG. 4 , its description is omitted. 
         [0088]    In the example of  FIG. 6 , since an executor of the biometric authentication is the card brand, server  20   a  of the computer system  20  of the card brand executes processing of providing privilege to the card brand. 
         [0089]      FIG. 7  is a block diagram showing an example of the configuration of the card payment system  18 , and data transmission/reception states assumed when biometric authentication is succeeded in the computer system  21  of the issuer. 
         [0090]    In  FIG. 7 , biometric data  5 , which is compared with biometric data  13  of the user U at the time of payment, is not stored in the card C, database  19   b  of the computer system  19  of the acquirer, and database  20   b  of the computer system  20  of the card brand. Biometric data  5 , which was registered when the card was issued, and is compared with biometric data  13  of the user U acquired at the time of payment, is stored in database  21   b  of the computer system  21  of the issuer. 
         [0091]    In this case, the card payment device  1  transmits, to the computer system  19  of the acquirer via the network  22 , payment data  16 A including biometric data  13  of the user U at the time of payment. 
         [0092]    The computer system  19  of the acquirer transmit payment data  16 A to the computer system  20  of the card brand via the network  23 , without executing biometric authentication. 
         [0093]    The computer system  20  of the card brand transmits payment data  16 A to the computer system  21  of the issuer via the network  24 , without executing biometric authentication. 
         [0094]    If payment data  16 A received from the computer system  20  of the card brand via the network  24  includes biometric data  13 , the computer system  21  of the issuer performs biometric authentication, based on biometric data  5  in database  21   b  and biometric data  13  in payment data  16 A. 
         [0095]    If the biometric authentication is succeeded in the computer system  21  of the issuer, the computer system  21  of the issuer executes various types of necessary processing including credit processing, payment processing, etc. 
         [0096]    The computer system  21  of the issuer transmits the credit result data  25  to the card payment device  1  via the network  24 , the computer system  20  of the card brand, the network  23 , the computer system  19  of the acquirer, and the network  22 . 
         [0097]    The card payment device  1  outputs data designating completion of payment or failure of payment, based on the credit result data  25 . 
         [0098]    Moreover, if the biometric authentication is succeeded in the computer system  21  of the issuer, the computer system  21  of the issuer supplies the computer system  20  of the card brand with the authentication executor ID via the network  24 . In the example of  FIG. 7 , the authentication executor ID designates the issuer. 
         [0099]    Upon receiving the authentication executor ID from the computer system  21  of the issuer, server  20   a  of the computer system  20  of the card brand executes privilege processing  26  of providing privilege to an executor (issuer) designated by the authentication executor ID. 
         [0100]      FIG. 8  is a flowchart showing an example of the biometric authentication executed by the computer system  19  of the issuer and the computer system  20  of the card brand. 
         [0101]    In step S 301 , server  19   a  ( 20   a ) determines whether received payment data is payment data  16 A including biometric data  13 , or payment data  16 B including the authentication success notice  17 . 
         [0102]    If the received payment data is payment data  16 B including the authentication success notice  17 , the processing proceeds to step S 304 . 
         [0103]    If the received payment data is payment data  16 A including biometric data  13 , server  19   a  ( 20   a ) determines, in step  302 , whether biometric data  5  compared with biometric data  13  of the user U at the time of payment is stored in database  19   b  ( 20   b ). 
         [0104]    If biometric data  5  is not stored in database  19   b  ( 20   b ), the processing proceeds to step S 306 . 
         [0105]    If biometric data  5  is stored in database  19   b  ( 20   b ), server  19   a  ( 20   a ) executes, in step S 303 , biometric authentication based on biometric data  13  in payment data  16 A and biometric data  5  in database  19   b  ( 20   b ). 
         [0106]    If it is determined in step S 301  that the received payment data is payment data  16 B including the authentication success notice  17 , or if biometric authentication is succeed in step  303 , server  19   a  ( 20   a ) transmits, in step S 304 , payment data  16 B including the authentication success notice  17  to next computer system  20  ( 21 ). The authentication success notice  17  includes the authentication executor ID designating the acquirer, if the executor of the biometric authentication is the acquirer. If the executor of biometric authentication is the card brand, the authentication success notice  17  may include the authentication executor ID designating the card brand. 
         [0107]    If the biometric authentication is failed in step S 303 , server  19   a  ( 20   a ) supplies, in step S 305 , the card payment device  1  with data designating the biometric authentication failure. 
         [0108]    If the biometric data  5  is not stored in database  19   b  ( 20   b ) in step S 302 , server  19   a  ( 20   a ) transmits, in step S 306 , payment data  16 A including biometric data  13  of the user U at the time of payment to the next computer system  20  ( 21 ). 
         [0109]      FIG. 9  is a flowchart showing an example of the biometric authentication executed by the the computer system  21  of the issuer. 
         [0110]    In step S 401 , server  21   a  determines whether received payment data is payment data  16 A including biometric data  13 , or payment data  16 B including the authentication success notice  17 . 
         [0111]    If the received payment data is payment data  16 B including the authentication success notice  17 , the processing proceeds to step S 403 . 
         [0112]    If the received payment data is payment data  16 A including biometric data  13 , server  21   a  executes, in step S 402 , biometric authentication based on biometric data  13  in payment data  16 A and biometric data  5  in database  21   b.    
         [0113]    If it is determined in step S 401  that the received payment data is payment data  16 B including the authentication success notice  17 , or if the biometric authentication is succeeded in step S 402 , the server  21   a  executes credit processing and payment processing, generates the credit result data  25 , and supplies the card payment device  1  with the credit result data  25  in step S 403 . Further, when server  21   a  is executed the biometric authentication, server  21   a  supplies the computer system  20  of the card brand with the authentication executor ID designating the issuer. 
         [0114]    If the biometric authentication is failed in step S 402 , server  21   a  supplies, in step S 404 , the card payment device  1  with data designating the biometric authentication failure. 
         [0115]    In the above-described embodiment, biometric data  5  is stored in the card C, the biometric-data acquisition unit  7  is installed in the card payment device  1 , and biometric authentication is executed based on biometric data  5  in the card C, and biometric data  13  acquired by the biometric-data acquisition unit  7 . With this structure, illegal use of card payment of the card C at the time of card payment can be prevented without greatly changing the computer systems  19  to  21  provided behind the card payment device  1 . 
         [0116]    In the present embodiment, it is not necessary to transmit biometric data  13  to the computer systems  19  to  21  provided behind the card payment device  1 , if the biometric authentication is succeeded in card payment device  1 . By virtue of this, communication traffic of the card payment system  18  can be suppressed, the amount of call/response between the card payment device  1  and the computer system  21  of the issuer can be reduced, the communication traffic can be suppressed, a speed of response can be enhanced, and a latency time until a completion of authentication of the user U can be suppressed. 
         [0117]    In the present embodiment, the biometric authentication of a card user can be performed by any one of the devices ranging from the card payment device  1  to the computer system  21  of the issuer. As a result, illegal use of a card can be prevented, and processing for biometric authentication can be prevented from concentrating on each server  19   a  to  19   c  in the card payment system  18 , i.e., load of servers  19   a  to  19   c  can be dispersed. 
         [0118]    In the present embodiment, since biometric data  13  is transmitted and received among a plurality of different enterprises, biometric data  13  can be used effectively. 
         [0119]    In the present embodiment, since biometric data  5  is not transmitted after biometric authentication succeeds, the number of times of transmission of biometric data  5  can be reduced, and biometric data  5  can be prevented from being illegally acquired by other people. 
         [0120]    In the present embodiment, privilege is provided to at least one of an executor of biometric authentication and the user of the card C. Accordingly, the use of the biometric authentication in card payment can be promoted. In particular, introduction of the card payment device  1  can be promoted. 
         [0121]    In the present embodiment, biometric data  5  may be encrypted. If the card payment device  1  is read encrypted biometric data  5 , the card payment device  1  decrypts the encrypted biometric data  5 , and performs biometric authentication based on the resultant decrypted biometric data  5  and biometric data  13 . The same can be applied to biometric authentication performed by the computer systems  19  to  21 . If biometric data  5  stored therein is encrypted, the computer systems  19  to  21  decrypt the encrypted biometric data  5  before biometric authentication. 
         [0122]    Although in the embodiment, the privilege processing  26  is executed by the computer system  20  of the card brand, it may be executed by another computer system, such as the computer system  19  of the acquirer, or the computer system  21  of the issuer. Moreover, the privilege processing  26  may be executed by of a plurality of computer systems in cooperation. 
         [0123]    The card payment system  18  according to the present embodiment may use, for example, electronic signature authentication based on a public key system, may encrypt data on a transmission side, and may decrypt data on a reception side. The electronic signature authentication can ensure the security of the card data  6  and biometric data  13  during a period from the time of input to the time of execution of biometric authentication and completion of payment. Communication of various types of data (for example, payment data  16 A, payment data  16 B, the authentication executor ID, etc.) in the card payment system  18  may be executed utilizing, for example, Secure Sockets Layer (SSL). This enhances securities of communications by the card payment system  18 . In the card payment system  18 , a unit for performing decryption does not perform decryption if it detects unjustness or incursion of a third party, if any. This protects data in security. 
         [0124]    In the present embodiment, the computer systems  19  to  21  can be combined arbitrarily, and a part thereof may be omitted. 
         [0125]    In the flowcharts of  FIGS. 2, 3, 8 and 9 , order of the steps may be changed arbitrarily within a range in which processing, such as biometric authentication, can be realization, and payment data  16 A and  16 B can be generated. 
         [0126]    In the embodiment, payment data  16 A and  16 B may be each divided into a plurality of portions. 
         [0127]    While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.