KR100718983B1 - System and Method for Providing Integrated Financial Service - Google Patents

Abstract

The present invention provides a system and method for providing integrated financial services for continuously using various financial related services provided by a plurality of financial institutions by using a set-top box used to receive digital cable broadcasting. Authenticate the user connected through the set-top box to use the service, create an authentication token using the user authentication information, send it to the set-top box for storage, and set up a financial institution that the set-top box user wants to use. By selecting and verifying that the authentication token transmitted from the set-top box is legitimate, the set-top box and the financial institution server are connected to each other, so that the service can be used by connecting to a plurality of financial institution servers continuously. Can be.

TV Banking, Integrated Finance

Description

System and Method for Providing Integrated Financial Service

1 is a conceptual diagram illustrating a general financial service method through digital cable broadcasting;

2 is a network diagram for an integrated financial service providing system according to an embodiment of the present invention;

3 is a detailed configuration diagram of the integrated financial service providing system shown in FIG. 2;

4 is a flowchart illustrating a method for providing a unified financial service according to an embodiment of the present invention;

5 is a flowchart illustrating a method of providing a unified financial service according to another embodiment of the present invention;

6 is a network diagram for an integrated financial service providing system according to another embodiment of the present invention;

7 is a detailed configuration diagram of the integrated financial service providing system shown in FIG. 6;

8 is a flow chart for explaining a public certificate relay method applied to the present invention.

<Description of the symbols for the main parts of the drawings>

10: set-top box 20: TV

30: communication network 40: certificate issuing server

50, 52, 54: financial institution server 60: integrated financial service providing system

70: personal computer 610: control unit

620: communication network interface 630: user authentication and management unit

640: authentication token generation unit 650: authentication token verification unit

660: financial institution management 670: database

680: memory 690: public certificate storage

700: STB certification

The present invention relates to a system and method for providing financial services, and more particularly, to continuously use various financial related services provided by a plurality of financial institutions by using a set-top box used to receive digital cable broadcasting. A system and method for providing integrated financial services.

Digital cable broadcasting is a digital transmission of broadcast programs produced by broadcasting channel operators digitally from a cable network to a viewer's TV through the transmission network operator's transmission network. In addition, there is an advantage that more than 400 channels of service are possible. In addition, digital cable broadcasting is expected to activate multimedia services such as Internet access service, data broadcasting, VOD, and electronic commerce because it has advantages of bidirectional, high speed, and large data transmission, which is advantageous than other broadcasting media.

To use digital cable broadcasting, you need a set-top box that is built-in or external to your TV. A set-top box is a type of signal conversion device that converts digital signals transmitted from broadcasting stations into audio and video signals, enables Internet access through a TV, and records and edits broadcast information.

Such digital broadcasting is evolving toward providing various services to users such as internet access, TV commerce, TV banking, etc., because two-way services are available through set-top boxes.

1 is a conceptual diagram illustrating a general financial service method through digital cable broadcasting.

The set top box (STB) 10 is mounted on the TV 20 either internally or externally, and is connected to the financial institution servers 50, 52, and 54 via the communication network 30. In order to use a financial service, an authentication process for confirming whether or not a service user is legitimate must be accompanied. Therefore, a user must previously receive an official certificate issued by the certificate issuing server 40 and store it in the set-top box.

The user who has received the public certificate and stored in the set-top box 10 accesses a financial institution server among a plurality of financial institutions, inputs the private key password specified when issuing the public certificate for user authentication, and the financial institution server and the set-top box. (10) After the user authentication based on the user's certificate is performed between them, the financial services can be used when the user is identified as a legitimate user. In addition, when the user performs a task such as bank transfer, loan, etc., the user re-enters the private key password to perform electronic signature to prevent repudiation.

However, the private key password is not a combination of numbers but a combination of letters, symbols, and numbers. In a digital cable broadcasting environment using a set-top box, a user inputs a password using a remote control having a poor interface environment with the user. This is accompanied by inconvenience in use. Moreover, when a user accesses more than one financial institution continuously and uses the service, the user must enter a password every time he connects to the financial institution server, and frequently enters a password again for electronic signature. Discomfort is aggravated further.

In addition, in the case of financial institutions, each server must be constructed and operated, and the set-top box also needs to receive and install a client program provided by the financial institution, resulting in a problem of overlapping investment, and a set-top box manufacturing cost increases. .

The present invention has been made to solve the above-mentioned disadvantages and problems, and integrated finance for accessing a plurality of financial institution servers continuously using only one user authentication when providing financial services through digital cable broadcasting. The purpose is to provide a service providing system and method.

In addition, the present invention by performing a certificate-based authentication for the set-top box before transmitting the previously issued public certificate and private key to the set-top box, by securely transmitting the public certificate and private key to the set-top box, Its purpose is to make it available to financial services through digital cable broadcasting.

The present invention for achieving the above-described technical problem is a system for providing an integrated financial service connected to a plurality of set-top boxes and a plurality of financial institution server, the unique identification number, the device certificate, the device private key and the public certificate is stored, the control unit ; Network interface; A user authentication and management unit configured to perform authentication for the user and store and manage user information in a database as a user who has successfully authenticated based on the set-top box accesses through the set-top box to use financial services; An authentication token generating unit for generating an authentication token using the user authentication information, storing the authentication token under the control of the controller, and transmitting the authentication token to the set top box; An authentication token verification unit for verifying whether an authentication token transmitted from the set-top box is legal as the financial institution to be used by the user is selected from the set-top box and an authentication token is transmitted; And a financial institution management unit for storing and managing updates, modifications, and additional information about a plurality of financial institutions to provide financial services to the set-top box user in a database.

The present invention also provides a method for providing integrated financial services in an integrated financial service providing system connected to a plurality of set-top boxes and a plurality of financial institution servers storing unique identification numbers, device certificates, device private keys, and public certificates. As a user who stores a public certificate in a set-top box accesses the set-top box, the user enters a private key password into the set-top box, performs certificate-based user authentication, and when the certificate-based authentication is successful, A first step of performing user authentication between an integrated financial service providing system and the set top box; A second step of generating and storing an authentication token using user authentication information when it is determined that the user is a legitimate user; A third step of transmitting and storing the authentication token to the set top box; A fourth step of checking whether a financial institution to be used from the set top box is selected and the authentication token is transmitted, the authentication token received from the set top box coincides with the previously stored authentication token; A fifth step of transmitting user authentication information to the selected financial institution server when the authentication tokens match; And a sixth step of providing a financial service by making a connection between the set-top box and the financial institution server.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First Embodiment: When a Public Certificate Is Issued with a Set-Top Box

2 is a diagram illustrating a network configuration for an integrated financial service providing system according to an exemplary embodiment of the present invention, which corresponds to a case where an authorized certificate is issued to a set-top box.

The set top box (STB) 10 is mounted on the TV 20 either internally or externally and is connected to the integrated financial service providing system 60 via the communication network 30. In order to use a financial service, a certification process for checking whether a user of a service is legitimate must be accompanied. Therefore, a user applies for issuance of an authorized certificate through face-to-face verification at an authorized certificate issuing authority, Access to the certificate issuing server 40 is issued to the public certificate and stored in the set-top box (10).

The set top box 10 is released with a unique identification number, a device certificate, and a device private key stored therein, and the content providing server such as the integrated financial service providing system 60 is set by the device unique identification number. ) Can be distinguished.

The integrated financial service providing system 60 has an environment capable of communicating with a plurality of financial institution servers 50, 52, and 54 through a communication network, and the set-top box 10 has a user accessing a financial service. It performs user authentication by inputting the private key password specified when issuing the public certificate, and selects the desired financial institution to use the service if it is found to be a legitimate user.

Each financial institution can authenticate a user in a different manner, and since the user can access a plurality of financial institutions continuously and use the service, for this purpose, the integrated financial service providing system 60 sets user authentication information, that is, set-top. By generating the authentication token using the information including the user name, access time, etc., connected to the integrated financial service providing system 60 through the box 10, and passing the information to the financial institution server that the user wants to use This allows you to verify that you are an authenticated user on the financial institution server without entering a separate password.

In addition, the set-top box 10 encrypts and stores the private key password inputted for user authentication as a device certificate. When a financial transaction event requiring an electronic signature occurs, the set-top box 10 decrypts the encrypted password without receiving a password from the user. To electronically sign financial transactions. At this time, by using the device private key for decryption of the private key password, the theft of the encrypted password can be prevented, so that a secure electronic signature is possible.

FIG. 3 is a detailed configuration diagram of the integrated financial service providing system shown in FIG. 2.

As shown, the integrated financial service providing system 60 according to the present embodiment transmits and receives data with the control unit 610, the set-top box 10 and the financial institution server 50, 52, 54 for controlling the overall operation Using the user authentication and management unit 630 and the user authentication information to perform authentication for the user connected to use the financial services, to store and manage the user information in the database 670 The authentication token generating unit 640 for generating the authentication token and transmitting the authentication token to the set top box 10 under the control of the controller 610 selects a financial institution to be used by the user. Authentication token verification unit 650 for verifying that the authentication token transmitted from the set-top box 10 is legitimate, gangs for a plurality of financial institutions that want to provide financial services through digital cable broadcasting Authentication tokens generated from various information, software, user authentication information, etc. necessary for the operation of the financial institution management unit 660 and the integrated financial service providing system 60 for storing and managing new, modified, and additional information in the database 670. This includes a memory 680 to be stored.

In more detail, the user authentication and management unit 630 authenticates whether the user connected through the set-top box 10 is a legitimate user. If the user is a legitimate user, the authentication token generator 640 generates the authentication token by digitally signing the authentication information, stores the authentication token together with the identification number of the corresponding set-top box in the memory 680, and the authentication token verification unit 650. Decrypts the authentication token transmitted from the set-top box 10, extracts the authentication token stored with the identification number of the set-top box from the memory 680 and confirms whether the two authentication tokens match.

When the authentication token verification is completed, the control unit 610 notifies the financial institution server selected by the user that the user who requested the service is an authenticated user, and the user accesses the financial institution server through the set-top box 10 to display the TV 20 screen. Watch financial services.

4 is a flowchart illustrating a method for providing a unified financial service according to an embodiment of the present invention.

As a user who has been issued a public certificate with the set-top box 10 accesses the integrated financial service providing system 60 using the set-top box 10 (S101), the set-top box 10 prompts the user to enter a private key password. After the request is made and the user enters a password into the set-top box 10 (S103) and authentication is performed, the controller 610 transmits information including the user's name and access time to the integrated financial service providing system 60. User authentication is performed in the user authentication and management unit 630 by the control of the control unit (S105).

If it is determined that the user is a legitimate user, the authentication token generating unit 640 encrypts the user authentication information by digitally generating the authentication token (S107), and the control unit 610 transmits and stores it to the set-top box. (S109, S111).

Thereafter, the financial institution that the user wants to use is selected from the set-top box 10, in which case the name of the financial institution and the authentication token stored in step S111 are transmitted together (S113). Accordingly, the authentication token verification unit 650 verifies the electronic signature of the authentication token received from the set-top box 10 under the control of the control unit 610 to determine whether the authentication token is generated and transmitted by the authentication token generation unit 640. When it is determined that the authentication tokens match (S115), the user authentication information is transmitted to the financial institution server (for example, 50) selected by the user (S117).

The financial institution server 50 determines that the user who wants to use the service is a legitimate user based on the user authentication information received from the integrated financial service providing system 60, and services such as transfer, inquiry, and loan at the user's request. Provides (S119).

If a user who uses the service by accessing the financial institution server 50 subsequently wants to access another financial institution server (for example, 52), the financial institution name and the integrated financial service providing system 60 from the set-top box 10 are determined. The authentication token is transmitted together, and the integrated financial institution service providing system 60 performs verification of the authentication token to confirm whether the user is a legitimate user, and transmits the authentication information to the financial institution server 52 selected by the user. 52) to make the service available.

As such, the user can access a plurality of financial institution servers and use the service only by authentication through a single password input. In this process, user authentication is continuously performed using the authentication token, thereby providing a reliable service. .

On the other hand, when a user who accesses a server of a financial institution wants to use a service such as transfer or loan, an electronic signature process for preventing repudiation is involved. The digital signature is made using a private key password specified when issuing a public certificate. When accessing the integrated financial service providing system 60, the password entered for user authentication is erased after user authentication. You must enter it.

However, since entering a password using a remote controller in a digital cable broadcasting environment is inconvenient, in the present invention, after encrypting and storing the input password for user authentication, the encrypted password is decrypted when it is necessary to re-enter the password. Make it available. The integrated financial transaction service providing method in this case will be described with reference to FIG. 5.

5 is a flowchart illustrating a method of providing a unified financial service according to another embodiment of the present invention.

As the user who has been issued a public certificate with the set-top box 10 accesses the integrated financial service providing system 60 using the set-top box 10 (S201), the set-top box 10 prompts the user to enter a private key password. After the request is made and the user enters a password into the set-top box 10 (S203) and authentication is performed, the controller 610 transmits information including the user's name and access time to the integrated financial service providing system 60. User authentication is performed in the user authentication and management unit 630 under the control of (S205).

If it is determined that the user is a legitimate user, the authentication token generating unit 640 encrypts the user authentication information by electronic signature to generate an authentication token (S207), and the control unit 610 transmits and stores it to the set-top box. (S209, S211). When the authentication process is completed, the set-top box 10 encrypts and stores the password using the device certificate (S213).

Thereafter, the financial institution to be used by the user is selected from the set-top box 10, in which case the name of the financial institution to be used and the authentication token stored in step S211 are transmitted together (S215). Accordingly, the authentication token verification unit 650 verifies the electronic signature of the authentication token received from the set-top box 10 under the control of the control unit 610 to determine whether the authentication token is generated and transmitted by the authentication token generation unit 640. When it is determined that the authentication tokens match (S217), the user authentication information is transmitted to the financial institution server (for example, 50) selected by the user (S219).

The financial institution server 50 determines that the user who wants to use the service is a legitimate user based on the user authentication information received from the integrated financial service providing system 60, and services such as transfer, inquiry, and loan at the user's request. Provided (S221).

If the user uses a service that requires an electronic signature for non-repudiation such as transfer and loan, the financial institution server 50 sends the set-top box 10 to the set-top box 10 through the integrated financial service providing system 60. Request an electronic signature (S223, S225).

Accordingly, the set-top box 10 decrypts the private key password encrypted in step S213 using the device private key (S227), and performs an electronic signature using the decrypted private key password (S229). The digitally signed financial transaction information is transmitted to the financial institution server 50 through the integrated financial service providing system 60 (S231 and S233), and the set-top box 10 erases the decrypted private key password so as not to be lost. (S235).

If a user who uses the service by accessing the financial institution server 50 subsequently wants to access another financial institution server (for example, 52), the financial institution name and the integrated financial service providing system 60 from the set-top box 10 are determined. The authentication token is transmitted together, and the integrated financial institution service providing system 60 performs verification of the authentication token to confirm whether the user is a legitimate user, and transmits the authentication information to the financial institution server 52 selected by the user. 52) to make the service available.

In this way, the user can use the service by accessing a plurality of financial institution servers only by authentication by entering a single private key password. In this process, the user authentication is continuously performed using the authentication token to provide a reliable service. Can be. In addition, the private key password entered for user authentication is encrypted using a device certificate for electronic signature for non-repudiation, and if a digital signature is required, the device is decrypted using a device personal device. The service is available.

In the above, the financial service by the integrated financial service providing system has been described when an authorized certificate is issued to the set-top box. However, in the case of a user who has already issued a public certificate to a personal computer or other storage device, the public certificate can be used only through digital cable broadcasting to deliver the public certificate to the set-top box.

In the following, the certificate-based authentication is performed on the set-top box before the previously issued public certificate and private key are transmitted to the set-top box, and the public certificate and private key are securely transferred to the set-top box. A financial service providing system and method are described.

Second embodiment: In the case of using a previously issued public certificate transmitted to the set-top box

6 is a diagram illustrating a network configuration for a system for providing integrated financial services according to another embodiment of the present invention.

Set-top box (STB) 10 is mounted on the TV 20 built-in or external, connected to the integrated financial service providing system 60 via the communication network 30, the set-top box 10 is each unique identification number In addition, since the device certificate and the device private key are released, the content providing server such as the integrated financial service providing system 60 may distinguish the set top box 10 by the device unique identification number.

In order to use a financial service, an authentication process for checking whether a user of a service is legally accompanied is essential. In this embodiment, a user applies for an authorized certificate through face-to-face verification at an accredited certificate issuing authority, and the certificate is stored in a storage device Or is already in the state of being issued a public certificate by accessing the certificate issuing server 40 through a personal computer, digital banking-based financial only need to transmit the previously issued public certificate and private key to the set-top box (10) The service is available. The Applicant has filed a patent application on March 11, 2005 regarding the certificate relay system and method for this (Application No. 10-2005-0020631).

When the user wants to transfer the previously issued public certificate and private key to the set-top box 10, the user accesses the integrated financial service providing system 60 using the personal computer 70, and then registers and authenticates the user (ID and Using a password) and transmits a unique identification number that is pre-assigned to the set-top box 10. Here, the unique identification number of the set-top box 10 is preferably transmitted by encrypting. Thereafter, the personal computer 70 encrypts the public certificate or the private key, which is stored in advance or read from the external storage device, and transmits it to the integrated financial service providing system 60.

As such, after storing the device unique identification number, the public certificate and the private key in the integrated financial service providing system 60, the user accesses the integrated financial service providing system 60 through the set-top box 10, Perform user authentication using a password and request to download a public certificate and private key. Accordingly, the integrated financial service providing system 60 receives the device certificate from the set-top box 10 and checks whether the device unique identification number included in the device certificate matches the device unique identification number transmitted from the personal computer 70. The set top box 10 is authenticated. When the authentication of the set-top box using the device unique identification number is successful, the integrated financial service providing system 60 transmits the encrypted public certificate and the private key to the set-top box 10, and the set-top box 10 is encrypted public Install after decrypting the certificate and private key.

The integrated financial service providing system 60 has an environment capable of communicating with a plurality of financial institution servers 50, 52, and 54 through a communication network, and a user connected through the set-top box 10 wants to use financial services. Then, the user authentication is performed by the private key password received from the integrated financial service providing system 60 together with the accredited certificate, and if it is determined to be a legitimate user, the user can select a desired financial institution to use the service.

Each financial institution may authenticate a user in a different manner, and since the user may access the plurality of financial institutions continuously and use the service, the integrated financial service providing system 60 uses the user authentication information for this purpose. By generating an authentication token and passing this information to the financial institution server that the user wants to use, it is possible to confirm that the user is authenticated at the financial institution server without a separate password input process.

In addition, the set-top box 10 encrypts and stores the private key password inputted for user authentication with a device certificate. When a financial transaction event requiring an electronic signature occurs, the set-top box 10 decrypts the encrypted password without receiving a password from the user. To electronically sign financial transactions. At this time, by using the device private key for decryption of the private key password, the theft of the encrypted password can be prevented, thereby enabling secure electronic signature.

FIG. 7 is a detailed configuration diagram of the integrated financial service providing system shown in FIG. 6.

The integrated financial service providing system 60 according to the present embodiment further includes an authorized certificate storage unit 690 and an STB authentication unit 700 in addition to the integrated financial service providing system 60 shown in FIG. 3.

Specifically, the user authentication and management unit 630 of the integrated financial service providing system 60 according to the present embodiment performs authentication for a user who wants to use financial services and stores user information in the database 670. In addition to the management function, the user receives the ID, password, and device identification number of the set-top box from the user who wants to deliver the public certificate and private key to the set-top box, stores and manages in the database 670, and entrusts the public certificate and private key Alternatively, the method further performs a function of authenticating a user connected for download.

The functions of the authentication token generator 640, the authentication token verification unit 650, and the financial institution manager 660 are the same as those described with reference to FIG. 3.

In addition, the public certificate storage unit 690 receives the public certificate and private key from the user's personal computer 70 stores the user-specific public certificate and private key in the memory 680 and stores the public certificate and private key storage information Information is stored and managed in the database 670 is stored. In addition, the STB authentication unit 700 checks whether the set-top box 10 requesting the public certificate and the private key is legitimate as the user connected through the set-top box 10 requests the transmission of the public certificate and the private key.

Herein, the public certificate and the private key are preferably transmitted encrypted from the user's personal computer. In addition, the STB authentication unit 700 receives the device certificate stored in the set-top box 10 for authentication of the set-top box 10, the device unique identification number included in the device certificate and the device unique identification number previously stored in the database Check that is the same. In addition, the personal computer 70 and the integrated financial services providing system 60 may be secure sockets layer / transport layer security (SSL / TLS) protocols or other channels, which are world standard protocols used for server-client authentication and encrypted communications. Data can be transmitted and received using an encryption protocol.

8 is a flow chart for explaining a public certificate relay method applied to the present invention.

In order to relay the public certificate, the user must confirm the device identification number of the set top box to which the public certificate and private key are to be delivered. When the public certificate and the private key are to be delivered, the user accesses the integrated financial service providing system 60 through a personal computer and performs a user registration procedure (S301). That is, as personal information (name, social security number, etc.), ID, password, etc. are transmitted through the personal computer 70, the user authentication and management unit 630 stores the user information in the database 670 (S303).

When the user registration is completed, the user ID is input through the personal computer 70 to perform the user authentication (S305), and transmits the device unique identification number of the set-top box 10 to send a public certificate and private key (S307). When the device unique identification number is transmitted, the user authentication and management unit 630 stores the device unique identification number together with the user information in the database 670 (S309), whereby the integrated financial service providing system 60 sets the box. (10) The device unique identification number should be used during the authentication process. In addition, the device unique identification number is preferably encrypted and transmitted to prevent exposure during the communication process.

Thereafter, the personal computer 70 encrypts the public certificate and the private key stored in the personal computer or stored in the external storage device (S311), and transmits it to the integrated financial service providing system 60 (S313).

The public certificate service storing unit 690 of the integrated financial service providing system 60 stores the encrypted public certificate and private key transmitted from the personal computer 70 in the memory 680, while referring to the user information, the public certificate and Memory storage information of the private key is stored in the database 670 (S315). That is, it stores the user-specific certificate and private key storage location.

After storing the public certificate and private key in the integrated financial service providing system 60 as described above, the user accesses the integrated financial service providing system 60 using the set-top box 10 (S317). As a user who accesses the integrated financial service providing system through the set-top box 10 requests to download a certificate and a private key, the user authentication and management unit 630 performs user authentication using the user ID and password registered in step S301. In operation S319, when it is confirmed that the user is a legitimate user, the device performs authentication of the set-top box in operation S321.

For authentication of the set top box 10, the STB authentication unit 700 receives a device certificate stored in the set top box 10 and extracts a device unique identification number included in the device certificate. Then, the device unique identification number received and stored in step S307 is extracted from the database 670. Thereafter, the device unique identification number extracted from the device certificate of the set-top box 10 and the device unique identification number input by the user is matched, and if not matched to the set-top box that the device unique identification number is an error do. On the other hand, if the device unique identification numbers match, that is, if the set-top box 10 is confirmed to be legitimate, the user is referred to the user information to extract the encrypted certificate and private key previously stored in the memory 680 set-top box Transmit to 10 (S323).

The set-top box 10 that receives the encrypted public certificate and private key decrypts the public certificate and the private key (S325) and stores the decrypted public certificate in the memory (S327).

In the above-described authorized certificate relay method, a personal computer, an integrated financial service providing system, a set-top box and an integrated financial service providing system may further improve security of data transmitted and received using SSL / TLS or other channel encryption method.

In addition, the above has been described using a personal computer as an example of reading a previously issued certificate, but is not limited thereto.

After delivering the certificate issued in advance to the set-top box 10 by the above-described process, the user can access the integrated financial service providing system 60 through the set-top box 10 to use the financial service. A specific financial service providing method is the same as described with reference to FIGS. 4 and 5.

When using the financial service, all data (user authentication related messages, account information, transaction information, etc.) transmitted between the set-top box and the financial institution server is preferably encrypted for the protection of personal information. Meanwhile, when the user logs out and terminates the service, the set top box, the integrated financial service providing system, and the financial institution server erase all user information and transaction details. In addition, when the user does not log out but there is no user input signal for a specified time, the integrated financial service providing system detects whether the user uses the other function of the set-top box, and if the user does not use the other function, the user information, Clear the transaction history and terminate the service.

As such, those skilled in the art will appreciate that the present invention can be implemented in other specific forms without changing the technical spirit or essential features thereof. Therefore, the above-described embodiments are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

According to the present invention described above, a digital cable broadcasting-based financial services integrated management of a plurality of financial institution server, a user can use the service by continuously connecting to a plurality of financial institution server only by entering a single private key password The advantage is that financial services can be used conveniently and simply.

In addition, each financial institution generates an authentication token based on user authentication information in order to authenticate in a different way, performs user authentication by using it, and encrypts the private key password entered during user authentication. If an electronic signature is required, the password re-entry process can be omitted by decrypting and using the encrypted private key password.

In addition, even users who have already issued a public certificate can safely use the public certificate in a set-top box, thereby increasing the utilization rate of financial services using digital cable broadcasting.

Claims (14)

An integrated financial service providing system connected to a plurality of set-top boxes and a plurality of financial institution servers, each having a unique identification number, a device certificate, a device private key, and a public certificate. Control unit; Network interface; A user authentication and management unit configured to perform authentication for the user and store and manage user information in a database as a user who has successfully authenticated based on the set-top box accesses through the set-top box to use financial services; An authentication token generator for generating an authentication token using the user authentication information, storing the authentication token under the control of the controller, and transmitting the authentication token to the set top box; An authentication token verification unit for verifying whether an authentication token transmitted from the set-top box is legal as the financial institution to be used by the user is selected from the set-top box and an authentication token is transmitted; And A financial institution manager for storing and managing updates, modifications, and additional information about a plurality of financial institutions that want to provide financial services to the set-top box user in a database; Integrated financial services providing system comprising a. delete The method of claim 1, The authentication token generation unit generates the authentication token by performing an electronic signature on the authentication information of the user authentication and management unit, and stores the authentication token with a unique identification number of the set-top box, characterized in that the integrated financial service providing system . The method of claim 3, wherein The authentication token verification unit verifies the authentication token by decrypting the authentication token transmitted from the set top box, extracting the authentication token stored together with the identification number of the corresponding set top box that transmitted the authentication token, and confirming that the two authentication tokens match. Integrated financial service providing system characterized in that. The method of claim 1, The public certificate is stored in the set-top box when the set-top box user requests a public certificate from a certificate issuing authority, accesses the certificate issuing server through a communication network through the set-top box, and requests the download of the public certificate. Integrated financial services system. The method of claim 1, The user authentication and management unit receives an ID, a password, and a device unique identification number of the set-top box from a personal computer of a user who wants to deliver a public certificate and a private key to the set-top box, and stores and manages it in a database. Further comprising a function for authenticating the user connected through the set-top box using the ID and password, The integrated financial service providing system includes a public certificate storage unit for receiving a public certificate and a private key from the personal computer and storing them in a memory for each user; And As a user connected through the set-top box requests delivery of a certificate and a private key, the device certificate is received from the set-top box, and a device unique identification number included in the device certificate is extracted. A set-top box authentication unit for confirming whether the set-top box that has requested the public certificate is legal by checking whether it is the same as; And further comprising, if the set-top box is found to be legitimate, the control unit is integrated financial service providing system, characterized in that for transmitting and storing the public certificate and the private key to the set-top box. A method of providing an integrated financial service in an integrated financial service providing system connected to a plurality of set-top boxes and a plurality of financial institution servers, each having a unique identification number, a device certificate, a device private key, and a public certificate, As a user who stores a public certificate in a set-top box accesses the set-top box, the user enters a private key password into the set-top box, performs certificate-based user authentication, and when the certificate-based authentication is successful, A first step of performing user authentication between an integrated financial service providing system and the set top box; A second step of generating and storing an authentication token using user authentication information when it is determined that the user is a legitimate user; A third step of transmitting and storing the authentication token to the set top box; A fourth step of checking whether a financial institution to be used from the set top box is selected and the authentication token is transmitted, the authentication token received from the set top box coincides with the previously stored authentication token; A fifth step of transmitting user authentication information to the selected financial institution server when the authentication tokens match; And A sixth step of providing a financial service by making a connection between the set-top box and the financial institution server; Integrated financial services providing method comprising a. The method of claim 7, wherein The authentication token is generated by performing an electronic signature on the user authentication information. The method of claim 7, wherein If the user connected to the financial institution server to switch the connection to another financial institution server, the method further comprising the step of returning to the fourth step. The method of claim 7, wherein The public certificate is stored in the set-top box when the set-top box user requests a public certificate from a certificate issuing authority, accesses the certificate issuing server through a communication network through the set-top box, and requests the download of the public certificate. To provide integrated financial services. The method of claim 7, wherein The accredited certificate may include: storing the user information as the user accesses the integrated financial service providing system through a personal computer and transmits user information including a user name, social security number, ID, and password; Performing user authentication as a user who wants to transfer a public certificate and a private key accesses through a personal computer; Storing the device unique identification number as the user transmits a device identification number of the set top box to which the public certificate and private key are to be transmitted; Receiving and storing a public certificate and a private key from the personal computer; Performing user authentication using the user information as a user accesses an integrated financial service providing system using the set top box; Authenticating the set-top box using the device unique identification number as a user accessing the set-top box requests a public certificate and a private key; And If it is determined that the set-top box is legitimate, extracting a pre-stored public certificate and private key and transmitting it to the set-top box; Integrated financial service providing method, characterized in that stored in the set-top box through. The method of claim 11, Authenticating the set top box comprises: receiving a device certificate stored in the set top box; Extracting a device unique identification number from the device certificate; Extracting a device unique identification number received and stored from the personal computer of the user who requested the authorized certificate; And Confirming whether a device unique identification number extracted from the device certificate and the previously stored device unique identification number match; Integrated financial services providing method comprising a. The method of claim 7, wherein After the third step, before performing the fourth step, the set-top box further includes encrypting the private key password of the certificate, After the sixth step, requesting, by the financial institution server, the electronic signature for the financial transaction information to the set-top box through the integrated financial service providing system; The set-top box decrypts the encrypted private key password using the device private key, performs an electronic signature on financial transaction information using the decrypted password, and then converts the electronically signed financial transaction information into the integrated finance. Transmitting to the financial institution server through a service providing system; The set-top box erasing the decrypted private key password; Integrated financial services providing method comprising a further. The method of claim 13, After erasing the decrypted private key password, if the set-top box user wants to switch access to another financial institution server, the method further includes the step of returning to the fourth step. .

Images