KR101576075B1 - Mobile payment system, mobile terminal, and mobile payment method - Google Patents

Abstract

A mobile payment system, a mobile terminal, and a mobile payment method are disclosed. The mobile payment method may include checking whether the mobile payment system uses the mobile payment for each user of the mobile terminal stored in a predetermined DB to determine whether the payment request corresponding to the mobile terminal is approved or not The mobile payment system according to any one of claims 1 to 3, wherein the mobile payment system includes a mobile payment system, the mobile payment system comprising: When the mobile terminal determines that a predetermined authentication action has been performed, controls the mobile terminal to approve the payment request even when the use information is unavailable information.

Description

[0001] Mobile payment system, mobile terminal, and mobile payment method [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a mobile payment system, a mobile terminal, and a mobile payment method, and more particularly, to a system and method for improving settlement in a relatively easy manner with high security by improving a conventional mobile payment method .

Conventional mobile payment methods (so-called " small-size mobile phone payment ") are widely known.

1 is a diagram for explaining a conventional mobile payment method.

Referring to FIG. 1, the conventional mobile payment method exists in various ways such as 'small-size mobile phone settlement' and 'simple settlement'. In the present invention, 'small-size mobile phone settlement' will be described as an example. However, it is apparent that the technical idea of the present invention is intended to solve the problems of conventional simple settlement as well as various forms of 'small-size mobile phone settlement'.

The mobile payment system 10 transmits a payment request including a mobile telephone number of the user to a predetermined first terminal (e.g., computer 30) (S10) 10 generates authentication information (e.g., a six-digit number) and transmits it to the mobile terminal 20 corresponding to the mobile phone number (S20).

The user confirms the transmitted authentication information through the mobile terminal 20 and inputs the authentication information confirmed to the first terminal 30 in step S30. To the mobile payment system 10 (S40). Then, the mobile payment system 10 can determine whether the payment request is approved by determining whether the transmitted authentication information matches the authentication information transmitted to the mobile terminal 20 (S50 ).

The mobile payment system 10 may include a payment gateway (PG) system 11 and a communication company system 12, and in some embodiments, the communication company system 12 may be connected to the PG system 11 Function may be performed.

Since the mobile payment method uses a relatively simple authentication process (or protocol) for determining whether a person who has made a payment request occupies a specific mobile terminal 20, it is mainly used in a small payment or easy personal authentication .

However, such a conventional mobile payment method is simple, but may have security problems. Recently, vulnerability has caused accidents. An example of this is the so-called smishing (SMS + Phishing) method. SMS can phish SMS sent to a mobile terminal and send it to a device desired by an attacker or illegally. That is, the attacker can prevent the original legitimate user from receiving or recognizing the authentication information, and the attacker himself can obtain the authentication information and perform illegal settlement.

In addition, in an illegal payment method using the simplicity of the recent mobile phone micro settlement, when a false character is sent and a response is requested (e.g., a number or a specific key is input) Online banking fraud occurs when a user clicks or touches the character after the transmission, thereby making an illegal settlement.

As a result, the conventional mobile payment method is a simple security process for authenticating the occupation of the mobile terminal 20. Due to its simplicity, the payment made by the attacker who has not occupied the mobile terminal 20 It would be difficult to perform the role as a payment method because the request is approved or malicious hackers are found to have a blind spot where a legitimate owner unintentionally suffers a fraudulent settlement.

Due to this vulnerability, the user can set the mobile payment system 10 not to use mobile payment at all. If the usage information is not available information, the mobile payment system 10 determines whether or not the authentication process using the authentication information has passed (i.e., , Even if it is authenticated), the payment request for mobile payment will not be approved.

However, preventing the mobile payment from being used by the user, which has the advantage that the payment can be performed only by simple authentication, may significantly restrict the selection of the payment method of the user.

If the user wishes to perform the mobile settlement once after the user has registered the mobile settlement system 10 in the mobile settlement system 10, the use settlement information set in the mobile settlement system 10 is released (i.e., And request to set up the mobile payment again). In addition, when the user intends to perform mobile settlement by one-time, it is difficult to adopt a user because the mobile settlement must be set so that the mobile settlement is not performed in the mobile phone of his / her name.

Therefore, basically, it does not allow mobile settlement, and does not allow an attack in mobile settlement, but allows a mobile settlement temporarily or one-time only by a simple procedure if the user desires, In the middle of the payment process, even if a hacker intercepts the payment authorization number, a technical idea is required to prevent the final payment from being made.

The present invention has been made in view of the above problems, and it is an object of the present invention to provide a mobile payment method which can prevent mobile payment from being fundamentally blocked, And to provide a technical idea that enables a mobile payment to be performed with a simple one-time operation.

According to another aspect of the present invention, there is provided a mobile payment method, including: when a payment request corresponding to a mobile terminal is authenticated by a mobile payment system through a predetermined authentication process, The mobile payment system according to claim 1, further comprising: checking whether the mobile payment system uses the mobile payment for each user of the mobile terminal stored in a predetermined DB to determine whether to approve the payment request corresponding to the mobile terminal, The mobile payment system according to claim 1, wherein the mobile payment system further comprises a step of disabling the payment request even if the authentication through the authentication process is successful, when the information on whether the user of the mobile terminal is unavailable information, If a predetermined authentication action has been performed by the mobile terminal In simple cases, even when the use of information indicating whether the information may not be used characterized in that the control to accept the payment request.

The mobile payment method may further include receiving a control signal output from the mobile terminal when the mobile payment system performs the authentication action and determining that the authentication action has been performed when the control signal is received .

The mobile payment method may further include the step of the mobile payment system transmitting an authentication action request including information on a predetermined authentication device to the mobile terminal, And transmits the control signal.

Further, the authentication action may be an action of the mobile terminal performing short-distance wireless communication with a predetermined authentication device, or an action of the mobile terminal photographing predetermined information corresponding to the authentication device.

The authentication device may be a predetermined authentication device corresponding to the user registered in the mobile payment system.

Also, the authentication action may include a password, a secret pattern, a biometric information of the user, an OTP (One Time Password) corresponding to the user, or a security card number corresponding to the user, Whether the information input to the mobile terminal in response to the request matches the password, the secret pattern, or the biometric information, whether it matches an OTP generated by the mobile terminal or the mobile payment system, , Or the security card number stored in the mobile payment system.

According to another aspect of the present invention, there is provided a mobile payment method, including: a mobile payment method in which when a payment request corresponding to a mobile terminal is authenticated by a mobile payment system through a predetermined authentication process, The method of claim 1, further comprising the steps of: determining whether a predetermined authentication action is performed by the mobile terminal performing the payment request to the mobile payment system; and if the mobile terminal determines that the authentication action has been performed, When the mobile terminal transmits the control signal, even if the use information of the user of the mobile terminal stored in the predetermined DB is unavailable information by the mobile payment system, It is especially important that the payment request is controlled to be approved. It can be called gong.

Further, the authentication action may be an action of the mobile terminal performing short-range wireless communication with a predetermined authentication device, or an action of the mobile terminal photographing predetermined information corresponding to the authentication device.

In addition, the authentication action may be performed by the mobile terminal such that the mobile terminal transmits a password, a secret pattern, a biometric information of the user, a One Time Password (OTP) corresponding to the user, or a security card number corresponding to the user Whether the information input to the mobile terminal in response to the request matches the password, the secret pattern, or the biometric information, whether it matches an OTP generated by the mobile terminal or the mobile payment system, Or the security card number stored in the mobile payment system.

The mobile payment method may be stored in a computer-readable recording medium on which the program is recorded.

According to another aspect of the present invention, there is provided a mobile payment system in which a payment request corresponding to a mobile terminal is approved by a mobile payment system through a predetermined authentication process, The mobile payment system according to claim 1, further comprising: a communication unit for performing communication with the mobile terminal; a controller for determining whether to approve the payment request corresponding to the mobile terminal; Wherein the control unit determines that the mobile terminal is unavailable as a result of the determination by the determination unit, the control unit does not approve the payment request even if authentication through the authentication process is successful Characterized in that the mobile terminal If determining that the defined authentication action has been performed, even when the use of information indicating whether the information can not be used can be characterized in that the control to accept the payment request.

The control unit may receive a control signal output from the mobile terminal when the action is performed through the communication unit, and may determine that the action is performed when the control signal is received.

Further, the authentication action may be an action of the mobile terminal performing short-range wireless communication with a predetermined authentication device, or an action of the mobile terminal photographing predetermined information corresponding to the authentication device.

Also, the authentication action may include a password, a secret pattern, a biometric information of the user, an OTP (One Time Password) corresponding to the user, or a security card number corresponding to the user, Whether the information input to the mobile terminal in response to the request matches the password, the secret pattern, or the biometric information, whether it matches an OTP generated by the mobile terminal or the mobile payment system, , Or the security card number stored in the mobile payment system.

According to an aspect of the present invention, there is provided a mobile payment method for a mobile terminal, the mobile payment method comprising: accepting a settlement request corresponding to a mobile terminal by a mobile payment system through a predetermined authentication process; A mobile terminal comprising: a communication module for performing communication with the mobile payment system; an authentication action module for determining whether a predetermined authentication action is performed; and a control unit for controlling the mobile payment system When the control module transmits the control signal, even if the use information of the user of the mobile terminal stored in the predetermined DB is unavailable information by the mobile payment system, The settlement request is approved to be approved can do.

According to the technical idea of the present invention, the user can set the mobile settlement of his / her name to be unacceptable in the normal state (this can be set by the user or set by the system according to the technical idea of the present invention) It is possible to prevent damage due to the mobile settlement and to use the mobile settlement once or only temporarily with a simple authentication action when the user intends to perform the mobile settlement so that the security and convenience can be enhanced at the same time .

In addition, when an authentication action using a predetermined authentication device is required, since the user must occupy not only the occupation of the mobile terminal but also the authentication device which is an offline device, two factor authentication is performed, .

Further, even when the authentication action using the predetermined identification information is required, since the mobile payment is allowed for a limited period of time, the security is increased because it is authenticated that not only the occupation of the mobile terminal but also the predetermined information or device capable of confirming the identity is confirmed .

In addition, mobile settlement is not allowed at all by a conventional mobile process without a predetermined authentication action of a user, and thus an attacker can undesirably attempt to attack or attempt to attack a mobile settlement.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
1 is a diagram for explaining a conventional mobile payment method.
2 is a diagram for explaining a mobile payment method according to an embodiment of the present invention.
3 shows a schematic configuration of a mobile settlement system according to an embodiment of the present invention.
4 shows a schematic configuration of a mobile terminal according to an embodiment of the present invention.
5 is a view for explaining an example of information stored in a DB of a mobile settlement system according to an embodiment of the present invention.

In order to fully understand the present invention, operational advantages of the present invention, and objects achieved by the practice of the present invention, reference should be made to the accompanying drawings and the accompanying drawings which illustrate preferred embodiments of the present invention.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component.

Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the preferred embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

2 is a diagram for explaining a mobile payment method according to an embodiment of the present invention.

Referring to FIG. 2, a mobile payment system 100 and a user's mobile terminal 200 may be provided to perform a mobile payment method according to an embodiment of the present invention. The mobile payment method according to the embodiment of the present invention can be applied not only to the mobile payment using the authentication information as described above but also to all the payment methods in which the authentication for the payment request is performed through the mobile terminal 200. [ That is, the technical idea of the present invention is not only a payment method for performing the authentication process using the authentication information as described with reference to FIG. 1, but also a payment method in which the payment authentication or payment request is performed through the mobile terminal 200 of the user Lt; / RTI > For example, if the terminal performing the payment request is the mobile terminal 200 as described above, or authentication is performed through another authentication process (e.g., simple key input, password, certificate, etc.) without using the authentication information , Various payment methods in which the payment amount is included in the mobile payment amount may be applied. The technical idea of the present invention can be applied to all of these various payment methods. This is because, in any payment method, the technical idea of the present invention does not allow mobile settlement through the mobile terminal in principle, but when the authentication action according to the technical idea of the present invention is performed by the mobile terminal 200, This is because you can accept payments. Herein, for convenience of description, an example in which the technical idea of the present invention is applied to a mobile payment method using authentication information will be described, but the scope of rights of the present invention is not limited thereto.

The mobile terminal 200 may communicate with the mobile payment system 100. The mobile payment system 100 may receive a payment request from a predetermined first terminal 300. According to an embodiment, the mobile terminal 200 may be a terminal performing a payment request. At this time, the first terminal 300 may not be provided.

The mobile terminal 200 may include any type of data processing device that may be carried by a user and that includes data processing capabilities to implement the inventive concepts of the present invention, . ≪ / RTI > The mobile terminal 200 may perform a non-contact wireless communication (e.g., RF tagging) with the authentication device 400 as described later or may transmit predetermined information corresponding to the authentication device 400 (E.g., an image sensor, a camera, or the like) capable of photographing an image (e.g., identification information or a barcode that can identify the image forming apparatus 400).

The first terminal 300 may also be defined to include any type of data processing device capable of performing the functions defined herein. Although the first terminal 300 is illustrated as a desktop computer in FIG. 2, the first terminal 300 may be implemented in various embodiments such as a mobile terminal, a notebook, a tablet, and a set-top box. As described above, the first terminal 300 and the mobile terminal 200 may be the same device.

The mobile payment system 100 may refer to a network system that can determine whether to approve a payment request according to the technical idea of the present invention. The mobile payment system 100 may refer to a predetermined PG system 110 or may be a communication company system 120 that is organically coupled to the PG system 110 through a wired or wireless network. According to an embodiment, the communication company system 120 may directly perform the function of the PG system 110, and in this case, the PG system 110 may not be provided.

The mobile settlement system 100 may store information on whether to use mobile settlement for each user, that is, whether or not to use the mobile settlement. The usage information may be stored in a predetermined DB included in the mobile payment system 100 by a user requesting a setting on the mobile payment system 100 via a telephone or requesting a setting on-line. When the mobile payment system 100 receives a predetermined payment request, the mobile payment system 100 can confirm the user's availability information corresponding to the payment request. If the user has set not to use the mobile payment, unavailable information may be stored in the DB. If the use information is set as unavailable information, the mobile payment system 100 may not allow the mobile payment requested in the user's name.

Meanwhile, the user may apply to the mobile payment system 100 a service corresponding to the mobile payment method according to the technical idea of the present invention. Then, the user availability information may be automatically set as unavailable information.

For example, when the user performs the service application according to the mobile payment method according to the technical idea of the present invention to the mobile payment system 100 through the first terminal 300 and / or the mobile terminal 200, The mobile settlement system 100 may set the user availability information as unavailable information. In this case, a conventional mobile settlement requested in the name of the user may not be allowed.

According to one embodiment, when the payment request is received from the first terminal 300 or the mobile terminal 200, the mobile payment system 100 confirms the use information, If it is impossible information, the authentication process using the authentication information may not be performed. According to an embodiment, the mobile payment system 100 may once perform an authentication process using the authentication information when a payment request is received from the first terminal 300 or the mobile terminal 200. And, if the authentication process is successful, the user's availability information corresponding to the payment request can be confirmed. If the availability information is unavailable information, the mobile payment system 100 may not approve the payment request even if the authentication process is successful. As described above, when the authentication process is performed first, there is a case where the system for receiving the payment request is the PG system 110 and the PG system 110 can not confirm the user's availability information. Accordingly, the PG system 110 may perform the authentication process using the authentication information as in the conventional method, and the final approval of the payment request through the use information may be determined through the communication company system 120. It is needless to say that the service application information of the user according to the mobile payment method according to the technical idea of the present invention may be shared with the PG system 110 according to the embodiment.

In any case, the mobile payment system 100 may not approve the settlement request if the use case information is set as unusable information even though the predetermined authentication process (for example, the authentication process using the authentication information) succeeds . Even if the authentication process succeeds, the fact that the payment request is not accepted means that not only the case where the authentication process succeeds but the payment request is not accepted even after the authentication process is performed, the case where the authentication process fails or the authentication process itself is not performed And a case in which it is controlled so as not to be controlled.

As a result, the mobile settlement system 100 may not approve the mobile settlement request of the user name if the user sets the mobile settlement requested in his / her name to be disallowed in any case. However, according to the technical idea of the present invention, when the mobile payment system 100 determines that the mobile terminal 200 has performed a predetermined authentication action, the mobile payment system 100 may exceptionally allow the mobile payment. Therefore, when the user performs the authentication action, the user can use the mobile settlement once or only temporarily (for a mobile settlement request made within a predetermined time) even if the mobile settlement is set to not allow the mobile settlement.

The user may perform a payment request after performing an authentication action, or may perform an authentication action using the mobile terminal 200 at a predetermined time after performing a payment request.

In the case where the authentication action is performed before the payment request, the payment request is performed within a predetermined time after the authentication action is performed, and the authentication process for authenticating the payment request is completed. In the mobile terminal 200, predetermined software for implementing the technical idea of the present invention may be installed. The software determines whether an authentication action is performed through the mobile terminal 200, The mobile payment system 100 may transmit a predetermined control signal.

According to another embodiment, the authentication action may be performed after the settlement request is performed, and one such example is as shown in Fig.

As shown in FIG. 2, the first terminal 300 can perform a payment request to the mobile settlement system 100 (S100). The payment request may include the telephone number of the mobile terminal 200. [ Then, the mobile settlement system 100 can confirm the user's availability information corresponding to the payment request. If the availability information indicates that the mobile payment is available (including the case where the unavailable information is not recorded), the mobile payment system 100 transmits the settlement information through the conventional authentication process If the authentication is successful after authenticating the request, the payment request can be approved. If it is determined that the usage information is unavailable information, the mobile payment system 100 may request the mobile terminal 200 to perform an authentication action (S110).

Then, the mobile terminal 200 can perform a predetermined authentication action (S120). The mobile terminal 200 may transmit a predetermined control signal to the mobile payment system 100 after the authentication action is performed (S130). Then, the mobile payment system 100 can perform the authentication process when the control signal is received. If the authentication process is the authentication using the authentication information as described above, the mobile payment system 100 transmits the authentication information to the mobile terminal 200 (S140). In response to the transmission, The mobile terminal 200 may check the data and input the data to the first terminal 300 (S150). Then, the first terminal 300 can transmit the authentication information to the mobile settlement system 100 (S160), and the mobile settlement system 100 transmits the received authentication information to the mobile terminal 200 It may be determined whether to approve the settlement request based on whether or not one authentication information matches (S170).

When the payment request is received, the mobile payment system 100 may request the authentication action before performing the authentication process, but may request the authentication action after the authentication process is performed.

For example, the PG system 110 included in the mobile payment system 100 performs an authentication process, and may transmit a signal to the communication company system 120 that the authentication process is successful if the authentication process is successful. Then, the communication company system 120 can check the user use information corresponding to the payment request, and request the authentication operation to the mobile terminal 200 when the confirmed use information is unavailable information. When a control signal indicating that the authentication action has been performed is received from the mobile terminal 200, the communication company system 120 may finally approve the payment request.

Therefore, according to the technical idea of the present invention, when the user occupies the mobile terminal 200 and performs a predetermined authentication action through the mobile terminal 200, the user can temporarily use the mobile payment.

The authentication action may be, for example, an action for performing short-range wireless communication with a predetermined authentication device 400. [ According to another embodiment, it may be an act of photographing information indicating the authentication device 400. [ In the case where the authentication action is an action using the authentication device 400, the user must occupy not only the mobile terminal 200 but also the authentication device 400 to perform mobile settlement, .

Meanwhile, the authentication device 400 may not be fixed. That is, according to the technical idea of the present invention, the mobile settlement system 100 can provide the uncertainty of the authentication apparatus 400. This uncertainty can be achieved by allowing the mobile payment system 100 to request the authentication action to the mobile terminal 200, allowing the mobile terminal 200 to specify an authentication device 400 to take action. That is, since the authentication apparatus 400 to which the mobile terminal 200 performs the authentication action is not fixed and the mobile settlement system 100 can change at every authentication or at a predetermined period, Uncertainty can be given. Therefore, even if a predetermined attacker seizes or unauthorizedly occupies the mobile terminal 200 and the specific authentication device 400, there is no guarantee that the authentication is successful.

This effect is further multiplied by the fact that the mobile payment system 100 registers a plurality of authentication devices in advance and decides to selectively use a predetermined authentication device among the plurality of authentication devices for current authentication.

Therefore, the attacker can not guarantee that the payment request will be granted unless the attacker occupies all of the plurality of authentication devices registered in the mobile payment system 100. [

In a case where a plurality of authentication apparatuses are registered in the mobile payment system 100 and the mobile payment system 100 requests authentication action by designating any one of the plurality of authentication apparatuses, The mobile payment system 100 may determine whether the authentication unit 400 has performed the authentication action with the authentication apparatus and may include information about the authentication apparatus 400 in the control signal and transmitted to the mobile settlement system 100, May have been performed with the specified authentication device. That is, the control signal may be a signal output by the mobile terminal 200 when the mobile terminal 200 performs an authentication action using the authentication device specified by the mobile payment system 100. [ Alternatively, if a predetermined authentication action is performed, a control signal is output by the mobile terminal 200, and whether the authentication action with the specified authentication device has been performed may be determined by the mobile payment system 100. [ The authentication action request transmitted from the mobile payment system 100 to the mobile terminal 200 may include information on an authentication device (identification information), and the mobile terminal 200 may display information on the authentication device And provide the user with information indicating that the authentication device and the authentication action are to be performed.

On the other hand, in general, an increase in security has a trade-off relationship that leads to a decrease in the convenience of the user. Therefore, although an increase in security usually causes a deterioration of the convenience of the user, it may be necessary to not reduce the convenience of the user as much as possible. This request can be achieved by appropriately selecting an action to be performed by the mobile terminal 200. [

For example, the authentication action may be an action in which the mobile terminal 200 performs contactless short-range wireless communication with the authentication device 400 (e.g., RF tagging, etc.). Therefore, even when the authentication apparatus 400 is stored in a certain place (for example, a wallet of a payment requester), there is an effect that the user does not have to take out the authentication apparatus 400 for mobile settlement. The user only performs an operation of accessing the mobile terminal 200 within a predetermined distance to the authentication device 400 to such a degree that the contactless short-range wireless communication can be performed, thereby bringing about a remarkable synergy of security as described above.

According to another embodiment, the action may be an act of the mobile terminal 200 photographing the information indicating the authentication device 400. The information to be photographed may include identification information capable of identifying the authentication apparatus 400. [ The identification information may be a simple set of text, numbers, or symbols, or it may be separately encrypted or encoded information to implement the technical idea of the present invention. For example, when the authentication device 400 is a predetermined data processing device, a predetermined one-dimensional or two-dimensional barcode (e.g., QR code, etc.) including its identification information may be displayed on the data processing device , The bar code (for example, QR code, etc.) displayed on the mobile terminal 200, and the control signal may be transmitted from the mobile terminal 200 to the mobile payment system 100.

In addition, the authentication action may vary according to the embodiment. For example, a method of making contact communication with the mobile terminal 200 and the authentication device 400 may be applied. It will be readily apparent to those of ordinary skill in the art that any action that can be identified as having other predetermined authentication devices 400 may be applied to implement the spirit of the invention.

The authentication device 400 may be any device as long as it can perform the authentication action defined in accordance with the technical idea of the present invention with the mobile terminal 200. [ It is preferable that the authentication apparatus 400 is a general apparatus occupied by the user such as a user's credit card. In some implementations, the authentication device 400 may be a data processing device, such as a mobile phone or a notebook, or may be implemented as a data processing device specifically designed for authentication and the like. Or an RF tag device may be implemented in the authentication device 400 so as to perform a function as the authentication device 400. [

Meanwhile, the technical idea of the present invention can be applied not only to an authentication action through the authentication device 400 but also to an authentication action for authenticating a user through a predetermined second authentication process. In this case, the second authentication process is preferably an authentication process different from the authentication process.

That is, if the mobile payment system 100 determines that the second authentication process has been performed by the mobile terminal 200, the mobile payment system 100 may temporarily allow mobile payment of the user name.

The second authentication process may be an authentication process using certain identity information. The identity verification information may be, for example, a password or a secret pattern set by the user. Or biometric information of the user (e.g., fingerprint, iris, etc.) may be implemented as the identification information. In this case, the mobile terminal 200 may be provided with predetermined biometric information recognition means (for example, a fingerprint recognition device or an iris recognition device) for receiving the biometric information as input information.

Depending on the implementation, an OTP (one time password) may be used as identification information for authenticating a legitimate user. In this case, the legitimate user may have an OTP token (OTP generating device). An OTP generation module corresponding to the OTP token may be installed in the mobile terminal 200. In this case, whether or not the OTP generated by the OTP generation module of the mobile terminal 200 and the OTP input by the user (i.e., the OTP generated by the OTP token) can be determined by the mobile terminal 200 .

According to another embodiment, the OTP generation module may be included in the mobile payment system 100. In this case, the mobile terminal 200 confirms whether or not the OTP input by the user matches the OTP generated by the OTP generation module included in the mobile payment system 100, so that the user inputting the OTP is a legitimate user You can also check. To this end, the mobile terminal 200 may transmit an OTP input from a user to the mobile payment system 100, and may receive an OTP match from the mobile payment system 100 in response to the transmission. According to an embodiment, the OTP generated from the mobile payment system 100 may be received, and the mobile terminal 200 may compare OTP received from the user with OTP received from the user.

According to another embodiment, a so-called m-OTP (mobile-OTP) module in which the mobile terminal 200 functions as an OTP token may be installed in the mobile terminal 200. In this case, a legitimate user may not have a separate OTP token. The OTP generation module corresponding to the m-OTP module may be included in the mobile payment system 100. Then, whether or not the OTP generated by the m-OTP module matches the OTP generated by the OTP generation module included in the mobile payment system 100 may be confirmed by the mobile terminal 200. [

On the other hand, a security card number may be used as identification information. In this case, a legitimate user may have a secure card. In addition, security information corresponding to the security card may be stored in one of the mobile terminal 200 and the mobile settlement system 100. Since the authentication method using the security card is widely known, a detailed description thereof will be omitted.

According to the technical idea of the present invention, when the user holding the mobile terminal 200 is authenticated as a legitimate user (i.e., the principal) of the mobile terminal 200 through the authentication action for performing the second authentication process , Mobile payments may be allowed temporarily.

3 shows a schematic configuration of a mobile settlement system according to an embodiment of the present invention.

3, a mobile payment system 100 according to an embodiment of the present invention includes a control unit 101, a communication unit 102, and a determination unit 103. [ The mobile payment system 100 may further include a predetermined DB 104.

In the present specification, the term "module" or "module" may mean a functional or structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, the 'to' or 'module' may refer to a logical unit of a predetermined code and a hardware resource for executing the predetermined code, May be easily deduced to the average expert in the field of the present invention. Thus, the above " module " or " module " refers to a combination of hardware and software that performs the functions defined herein and does not imply any particular physical configuration.

The mobile payment system 100 may be implemented as a PG system 110 and a communication company system 120 as shown in FIG. 2, but may be implemented as any one physical device or two or more physical devices may be organically combined The mobile payment system 100 may be implemented. Each of the control unit 101, the communication unit 102, the determination unit 103, and / or the DB 104 may be implemented as a plurality of physical devices.

The communication unit 102 may communicate with the first terminal 300 or the mobile terminal 200. According to an embodiment, the communication unit 102 may be connected to the first terminal 300 through a wired Internet, and the communication unit 102 may be connected to the mobile terminal 200 through wireless communication.

The controller 101 may determine whether the payment request corresponding to the mobile terminal 200 is approved. The payment request corresponding to the mobile terminal 200 may be a payment request including the telephone number of the mobile terminal 200 when the authentication process using the authentication information is performed, A payment request requested by the user name of the mobile terminal 200 or a payment request requested from the mobile terminal 200 may be possible. In any case, the payment request corresponding to the mobile terminal 200 may include all payment requests in which a payment amount is charged to the communication fee of the mobile terminal 200 when the payment is approved.

The determination unit 103 may check the usage information for each user stored in the DB 104. [

Then, the control unit 101 may determine whether the payment request is approved based on the confirmation result of the determination unit 103. If the usage information is available information, the control unit 101 can approve the payment request if the authentication process is successful, such as a conventional mobile payment. If the usage information is unavailable information, the control unit 101 can approve the payment request only when the mobile terminal 200 determines that the mobile terminal 200 has performed a predetermined authentication action. Of course, the authentication process can be more successful to approve the settlement request.

The control unit 101 may determine that the mobile terminal 200 has performed the authentication action when a predetermined control signal is received through the communication unit 102. [ The mobile terminal 200 may be implemented to output the control signal in order to perform an authentication action.

The control unit 101 may control the communication unit 102 to request an authentication action to the mobile terminal 200 at a predetermined time. At this time, the control unit 101 may designate the authentication apparatus. To this end, information on the authentication device 400 may be included in the authentication action request.

Then, the mobile terminal 200 may perform the authentication action with the authentication device 400 designated by the control unit 101 to output the control signal to the communication unit 102. According to another embodiment, when a predetermined authentication action is performed, the mobile terminal 200 outputs the control signal to the communication unit 102, and the control signal includes information on the authentication device that performed the authentication action . Then, the control unit 101 determines whether the information on the authentication device included in the control signal corresponds to the designated authentication device 400, and may approve the payment request only if the information corresponds to the designated authentication device 400. [

The authentication action may be an action for performing short-range wireless communication with the authentication device 400 as described above, or may be an action for shooting information corresponding to the authentication device 400. [ Or an action to perform a predetermined second authentication process may be the authentication action. The second authentication process may be an authentication process performed through a password, a secret pattern, biometric information, an OTP, a security card number, or the like.

Whether or not the authentication action has been performed can be determined by the mobile terminal 200.

The DB 104 may include usage information for each user. Also, the DB 104 may store information on a corresponding authentication device for each user. An example of this is shown in Fig.

5 is a view for explaining an example of information stored in a DB of a mobile settlement system according to an embodiment of the present invention.

FIG. 5 shows an example of information stored in a predetermined DB 104 included in the mobile payment system 100. As shown in FIG. 5, the DB 104 stores availability information for each user in advance . The availability information may be stored on a user-by-user basis, which means that usage information is stored for each mobile phone number corresponding to the user. Of course, further information about the corresponding user's identification information (e.g., name, ID, etc.) or mobile phone number may be stored for each mobile phone number or for each user.

The usage information may be set by the user terminal through the wired / wireless Internet and stored in the DB 104, or may be set via the wire / wireless telephone and stored in the DB 104. [

Meanwhile, the DB 104 may further store information on the corresponding authentication device 400 for each user. Also, a plurality of corresponding authentication apparatuses may be stored in advance in the DB 104 according to the user.

The corresponding authentication device 400 for each user may be registered in the DB 104 by the user. Alternatively, when there is an authentication apparatus distributed by a user by the mobile settlement system 100, the distributed authentication apparatus (e.g., IC card, point card, etc.) automatically transmits the DB (104).

According to the example shown in FIG. 5, the use information is set as the available information, and the user B can set the use availability information as unavailable information. The authentication device corresponding to the user B may be the authentication device 1 and the authentication device 2. If the authentication action is an authentication action using the authentication device, the control unit 101 determines whether any one of the authentication devices corresponding to the user (for example, the authentication device 1 and the authentication device 2) As long as the action is performed, the payment request date can be temporarily approved. Alternatively, the control unit 101 may designate any one of the authentication devices (for example, the authentication device 1 and the authentication device 2) corresponding to the user (for example, the authentication device 1) as described above. Then, the mobile terminal 200 performs a predetermined authentication action with the specified authentication device (e.g., authentication device 1), and the payment request may be temporarily approved.

5 shows an example in which the authentication device corresponding to the user A is not registered. However, it is needless to say that a user whose use information is available information can also register a corresponding authentication device in advance.

4 shows a schematic configuration of a mobile terminal according to an embodiment of the present invention.

4, a mobile terminal 200 according to an exemplary embodiment of the present invention includes a control module 210, a communication module 220, and an authentication action module 230.

The control module 210 may control the functions and / or resources of other components of the mobile terminal 200 (e.g., the communication module 220 and / or the authentication action module 230).

The communication module 220 may communicate with the mobile payment system 100.

The authentication action module 230 may determine whether the mobile terminal 200 performs a predetermined authentication action. The authentication action module 230 may include corresponding devices according to an implementation of the authentication action. For example, when the authentication action is performed with a predetermined authentication device 400, the authentication action module 230 may include a short-range wireless communication module (e.g., an NFC (Near Field Communication) chip) . Also, when the action to perform the predetermined second authentication process is the authentication action, the OTP module or the like may be included as described above.

Then, the control module 210 may output a control signal to the mobile settlement system 100 when it is determined that the predetermined authentication action has been performed by the authentication action module 230. The control module 210 may output the control signal through the communication module 220 only when it is determined that the authentication action has been performed.

In addition, the control module 210 may include information on the authentication device that has performed the authentication action in the control signal according to the embodiment, as described above.

Certain software for performing the functions defined herein may be installed in the mobile terminal 200. The software may be software distributed by the subject of the mobile payment system 100. In this case, the software may previously store information (for example, an address on the network) for the mobile payment system 100. If it is determined that the authentication action is performed by the authentication action module 230, To the mobile payment system 100 using the control signal.

In some implementations, the mobile payment system 100 may include information about the mobile payment system 100 in an authentication action request received from the mobile payment system 100. Then, the information about the mobile settlement system 100 can be grasped by the software, and the control signal may be transmitted to the identified mobile settlement system 100.

The authentication action request transmitted from the mobile payment system 100 to the mobile terminal 200 may be implemented as a short message such as SMS or MMS or as a push message recognizable by the software.

The mobile payment method according to the embodiment of the present invention can be implemented as a computer-readable code on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, an optical data storage device, and the like in the form of a carrier wave (for example, . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

Claims (15)

delete A mobile payment method in which a payment request corresponding to a mobile terminal is approved by a mobile payment system through a predetermined authentication process,
Checking whether the mobile payment system uses the mobile payment for each user of the mobile terminal stored in a predetermined DB to determine whether the payment request corresponding to the mobile terminal is approved; And
The mobile payment system disallowing the payment request even if the authentication through the authentication process is successful when the information on the use of the user of the mobile terminal is unavailable information,
The mobile payment system includes:
When the mobile terminal determines that a predetermined authentication action has been performed, controls the mobile terminal to approve the payment request even when the use information is unavailable information,
The authentication action may include:
Wherein the mobile terminal performs short-range wireless communication with a predetermined authentication apparatus, or the mobile terminal photographs predetermined information corresponding to the authentication apparatus.
The mobile payment method according to claim 2,
The mobile payment system receiving a control signal output from the mobile terminal when the authentication action is performed; And
And determining that the authentication action has been performed when the control signal is received.
The mobile payment method according to claim 3,
Further comprising the step of the mobile payment system transmitting an authentication action request including information on a predetermined authentication device to the mobile terminal,
Wherein the mobile terminal transmits the control signal in order to perform an authentication action using the authentication device.
The method as claimed in claim 4, wherein the mobile payment system transmits an authentication action request including information on a predetermined authentication device to the mobile terminal,
Wherein the mobile payment system designates the authentication apparatus to be used for performing an authentication action by transmitting the authentication action request including information on the authentication apparatus among information on a plurality of authentication apparatuses registered in the mobile payment system Mobile payment method.
delete A mobile payment method in which a payment request corresponding to a mobile terminal is approved by a mobile payment system through a predetermined authentication process,
Determining whether a predetermined authentication action is performed by the mobile terminal performing the payment request to the mobile payment system; And
And transmitting a control signal to the mobile payment system when the mobile terminal determines that the authentication action has been performed,
When the mobile terminal transmits the control signal, the mobile payment system is controlled such that the payment request is approved even when the information on whether the user of the mobile terminal stored in the predetermined DB is unavailable information In addition,
The authentication action may include:
Wherein the mobile terminal performs near field wireless communication with a predetermined authentication device corresponding to the user registered in the mobile payment system or a mobile payment method in which the mobile terminal photographs predetermined information corresponding to the authentication device .
delete delete A computer-readable recording medium recording a program for performing the method according to any one of claims 2 to 5 or 7.
delete A mobile payment system for a mobile payment method in which a payment request corresponding to a mobile terminal is approved by a mobile payment system through a predetermined authentication process,
A communication unit for performing communication with the mobile terminal;
A controller for determining whether to approve the payment request corresponding to the mobile terminal; And
And a determination unit for determining whether or not to use mobile settlement for each user of the mobile terminal,
Wherein,
Wherein if the information on the use of the user of the mobile terminal is unavailable information as a result of the determination by the determination unit, the settlement request is disallowed even if authentication through the authentication process is successful.
When the mobile terminal determines that a predetermined authentication action has been performed, controls the mobile terminal to approve the payment request even when the use information is unavailable information,
The authentication action may include:
Wherein the mobile terminal performs near field wireless communication with a predetermined authentication apparatus corresponding to the user registered in the mobile settlement system or a mobile payment system in which the mobile terminal captures predetermined information corresponding to the authentication apparatus, .
13. The apparatus according to claim 12,
Designating the authentication apparatus to be used for performing an authentication authentication action including transmitting information on the plurality of authentication apparatuses registered in the mobile payment system to the mobile terminal,
Wherein the control unit controls to approve the settlement request even when the use information is unavailable information when it is determined that the authentication action has been performed using the specified authentication apparatus.
delete A mobile terminal for a mobile payment method in which a payment request corresponding to a mobile terminal is approved by a mobile payment system through a predetermined authentication process,
A communication module for performing communication with the mobile payment system;
An authentication action module for determining whether a predetermined authentication action is performed; And
And a control module for transmitting a control signal to the mobile payment system when it is determined that the authentication action has been performed,
When the control module transmits the control signal, the mobile payment system is controlled so that the payment request is approved even when the use information of the user of the mobile terminal stored in the predetermined DB is unavailable information In addition,
The authentication action may include:
Wherein the mobile terminal performs near field wireless communication with a predetermined authentication device corresponding to the user registered in the mobile payment system or the mobile terminal photographs predetermined information corresponding to the authentication device.

Images