KR102348823B1 - System and Method for Identification Based on Finanace Card Possessed by User - Google Patents

Abstract

The present invention is a financial card-based self-authentication system possessed by a user, which reads accessible information of a financial card by a self-authentication application that is driven upon receiving a self-authentication request signal from another application to obtain a secure application module (Secure Application Module: (hereinafter referred to as 'SAM') After transmitting to the server, obtain an authentication key, which is an access right to OTX and card block information recorded on the user's financial card, from the SAM server, and use the obtained authentication key and OTX to The card block information, which is encrypted information read from the financial card through the short-range wireless communication function, is transmitted to the SAM server, and as card information encrypted by the first public key is received from the SAM server, the card company server that issued the financial card Upon receiving the mobile communication terminal requesting identity authentication by sending and receiving the card block information, which is the encrypted information transmitted from the mobile communication terminal, the card block information, which is encrypted information, is decrypted as the OTX verification succeeds, and from the decrypted information A SAM server that encrypts card information including the extracted card number and validity period with the first public key distributed by the card company that issued the financial card and transmits it to the mobile communication terminal, and the card encrypted with the first public key from the mobile communication terminal and a card company server that decrypts information using a first private key paired with a first public key, compares card information with a customer database, and notifies a user authentication result to a mobile communication terminal.

Description

System and Method for Identification Based on Finanace Card Possessed by User

The present invention relates to identity authentication technology, and more particularly, to a financial card-based identity authentication system and method possessed by a user.

A ubiquitous computing environment has been established with the development of current wired and wireless communication technologies and the development of mobile communication terminals that can access wired and wireless communication networks anytime, anywhere.

As such, as the ubiquitous computing environment is established, countless tasks that were performed offline are being performed online. Among them, Internet banking and mobile banking of banks, issuance of resident registration certificates by public institutions, and online identity authentication in shopping malls, etc. may be representative examples.

However, in order to perform any action online, it is necessary to determine whether the subject performing the action is a legitimate subject of the action.

In order to verify the identity of such a subject, that is, the user himself/herself, identity authentication is required, and various types of identity authentication methods have been developed and applied. As such a self-authentication method, there may be a knowledge-based authentication method, a biometric-based authentication method, and a possession-based authentication method.

The knowledge-based authentication method includes an ID and password authentication method, a Personal Identification Number (PIN) authentication method, and an i-PIN authentication method. In addition, biometric-based authentication methods include authentication methods using fingerprint, voice, iris and vein recognition. In addition, the possession-based authentication method includes a One Time Password (OTP) authentication method, an SMS authorization number authentication method using a mobile communication terminal called a cell phone, a mobile phone, and a smart phone, and an ARS authentication method.

Among these, possession-based authentication methods with high security are often applied, but in the case of ARS authentication, there is a possibility that wired or wireless phones considered to be in the possession of the user at the time of authentication may be stolen, and OTP authentication may be stolen if lost. SMS authentication using a mobile communication terminal also has a problem in that the authorization number may be leaked through memory hacking.

Therefore, in order to solve this problem, it is an authentication method that has stronger security and can perform authentication conveniently, using Near Field Communication (NFC) of a mobile communication terminal. Card face-to-face authentication by contact, unique identification information (UID) and Personal Identification Number (PIN) of the financial card are used to enhance the security of self-authentication without exposing card information It provides a self-authentication system and method that can be easily performed.

The present invention is a financial card-based self-authentication system possessed by a user including a card company server, and a security application module by reading accessible information of a financial card by a self-authentication application that is driven as a result of receiving a self-authentication request signal from another application (Secure Application Module: hereafter referred to as 'SAM') After transmitting to the server, obtain the authentication key, which is the right to access OTX and card block information recorded on the user's financial card, from the SAM server, and the obtained authentication key and transmits card block information, which is encrypted information read from the financial card through the short-range wireless communication function, to the SAM server using OTX, and receives the card information encrypted by the first public key from the SAM server A card block, which is encrypted information transmitted from a mobile communication terminal that transmits to the issued card company server to request identification, and returns the identification result received from the card company server to another application, and a mobile communication terminal that has been provided with OTX and authentication key Upon receiving the information, OTX verification is performed, and as the OTX verification is successful, the card block information, which is encrypted information, is decrypted, and the card information including the card number and validity period extracted from the decrypted information is converted to the corresponding financial card. The SAM server encrypts the first public key distributed by the issued card company and transmits it to the mobile communication terminal, and upon receiving the card information encrypted with the first public key from the mobile communication terminal, the card information is paired with the first public key and a card company server that decrypts using the first secret key, compares the card information with the customer database, and notifies the user authentication result to the mobile communication terminal.

The present invention is a user-owned financial card-based self-authentication method implemented in a self-authentication application executed in a mobile communication terminal equipped with a short-range wireless communication function. In the financial card-based self-authentication method possessed by a user implemented in ) Transmitting to the server, acquiring an authentication key, which is an access right to OTX and card block information recorded on the user's financial card, from the SAM server, and using the obtained OTX and authentication key to send the Reading the card block information, which is recorded encrypted information, through a short-range wireless communication function, transmitting the read encrypted information, card block information, to the SAM server, and the card company that issued the financial card from the SAM server Upon receiving card information including the card number and validity period encrypted with the first public key distributed by and replying to another application.

The present invention is a financial card-based identity authentication method possessed by a user in a secure application module (hereinafter referred to as 'SAM') server, and is recorded on a financial card together with information accessible from a mobile communication terminal In response to a request for issuance of an authentication key, which is an access right to access the card block information, authenticating a user through information transmitted from a mobile communication terminal and providing OTX and an authentication key to the mobile communication terminal; When card block information, which is information, is transmitted, performing OTX verification, and when OTX verification is successful, decrypting card block information, which is encrypted information, a card including a card number and expiration date from the decrypted information The method includes extracting information, encrypting the extracted card information with a first public key distributed by a card company that issued the corresponding financial card, and transmitting the encrypted card information to a mobile communication terminal.

The present invention has the effect of enhancing security by performing face-to-face authentication of a financial card holding a financial card based on financial card information obtained by contact with a financial card possessed by a user using NFC of a mobile communication terminal.

The present invention can improve security by using a Secure Application Module (SAM) server to check the validity of a financial card and perform encrypted communication of card information when acquiring card information of a financial card for face-to-face authentication of a financial card. have a possible effect.

1 is a diagram showing the configuration of a financial card-based identity authentication system possessed by a user according to an embodiment of the present invention.
2 is a block diagram of a card company server according to an embodiment of the present invention.
FIG. 3 is a signal flow diagram for explaining a user authentication method based on a financial card possessed by a user according to an embodiment of the present invention.
4 is a signal flow diagram illustrating a user authentication method based on a financial card possessed by a user according to another embodiment of the present invention.
5 is a signal flow diagram illustrating a process of providing an authentication key from a SAM server to a mobile communication terminal according to an embodiment of the present invention.
6 is a flowchart illustrating an authentication method of a card company server according to another embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings, a financial card-based identity authentication system and method possessed by a user according to a preferred embodiment will be described in detail as follows. Here, the same reference numerals are used for the same components, and repeated descriptions and detailed descriptions of well-known functions and configurations that may unnecessarily obscure the gist of the invention will be omitted. The embodiments of the present invention are provided in order to more completely explain the present invention to those of ordinary skill in the art. Accordingly, the shapes and sizes of elements in the drawings may be exaggerated for clearer description.

Each block in the accompanying block diagram and combinations of steps in the flowchart may be executed by computer program instructions (execution engine), which may be executed by a processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment. It may be mounted so that the instructions, which are executed by the processor of a computer or other programmable data processing equipment, create means for performing the functions described in each block of the block diagram or in each step of the flowchart.

These computer program instructions may also be stored in a computer usable or computer readable memory which may direct a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer usable or computer readable memory. It is also possible to produce an article of manufacture containing instruction means for performing the functions described in each block of the block diagram or each step of the flowchart, the instructions stored in the block diagram.

And since the computer program instructions may be mounted on a computer or other programmable data processing equipment, a series of operational steps is performed on the computer or other programmable data processing equipment to create a computer-executable process to create a computer or other programmable data processing equipment. It is also possible that the instructions for performing the data processing equipment provide steps for carrying out the functions described in each block of the block diagram and each step of the flowchart.

In addition, each block or step may represent a module, segment, or portion of code comprising one or more executable instructions for executing specified logical functions, and in some alternative embodiments the blocks or steps referred to in some alternative embodiments. It should be noted that it is also possible for functions to occur out of sequence. For example, it is possible that two blocks or steps shown one after another may be performed substantially simultaneously, and also the blocks or steps may be performed in the reverse order of the corresponding functions, if necessary.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the embodiments of the present invention illustrated below may be modified in various other forms, and the scope of the present invention is not limited to the embodiments described below. Examples of the present invention are provided to more completely explain the present invention to those of ordinary skill in the art.

1 is a diagram showing the configuration of a financial card-based identity authentication system possessed by a user according to an embodiment of the present invention.

Referring to FIG. 1 , the financial card-based identity authentication system possessed by the user includes the user's financial cards 1a and 1b, the mobile communication terminal 10, and the Secure Application Module (hereinafter referred to as 'SAM'). ) includes a server 20 and a card company server 30 .

The mobile communication terminal 10 , the SAM server 20 , and the card company server 30 will be connected through a wired/wireless data communication network (not shown). Here, the wired and wireless data communication network includes an Internet network including a Wi-Fi network, a 3G (Third Generation) WCDMA method, a 4th generation (4Generation: 4G=Long Term Evolution (LTE)) network, and a 5th generation mobile communication (5Generation Networks) It is a communication network to which a mobile communication network including

According to the present invention, user authentication based on a financial card possessed by a user is performed as a user authentication event occurs in institutions, businesses, and stores in order to provide arbitrary services to the user. Here, the institution may be an online or offline bank, a financial institution such as a securities company or an insurance company, a government office, such as a city office, a ward office, a city hall, a financial identity verification agency, etc. etc. could be

The financial cards 1a and 1b include all types of cards capable of performing financial services and transportation services by being connected to the mobile communication terminal 10 in a contact or contactless manner, such as general credit cards and transportation cards. As an example, a physical credit card 1a and a mobile card 1b may be included, and one or more chips are embedded in the financial cards 1a and 1b, and the mobile communication terminal 10 and the short-range wireless It may be an RF-type card that can be connected in a contactless manner by communication to send and receive data. Here, the short-distance wireless communication is not limited, such as RF, infrared communication, PAN communication, Bluetooth communication, etc., it is preferable that the communication method conforms to the NFC (Near Field Communication) protocol. In addition, an OS (Operation System) (not shown) and a storage space (not shown) are provided inside the chip of the financial cards 1a and 1b, and the storage space is divided into two or more sectors, and each sector has Hierarchical card-related information may be stored. As the authentication key is transmitted from the mobile communication terminal 10 in the RF method, the OS (Operation System) performs an authentication algorithm using the authentication key inside the chip of the financial cards 1a and 1b, and the card stored in each sector Related information may be transmitted to the mobile communication terminal 10 in an RF manner. A detailed description thereof will be described later with reference to FIG. 5 .

The mobile communication terminal 10 is a communication terminal that connects the financial cards 1a and 1b and the SAM server 20 or the card company server 30 to provide a personal authentication channel based on holding a financial card, such as a general mobile phone, smart phone, etc. It may be a personal wireless communication terminal of, but is not limited thereto. That is, the mobile communication terminal 10 is not limited to such a personal wireless communication terminal, and is a terminal that accesses a card and mediates a corresponding service using information stored in the card, and a general credit card connected to the existing VAN communication network. It may be any other type of wireless card terminal or dongle terminal, such as a terminal.

In the mobile communication terminal 10, a self-authentication application for self-authentication of a user holding the financial cards 1a and 1b according to the present invention may be installed as an application program 13a. According to the present invention, the mobile communication terminal 10 records in the financial cards 1a and 1b through the wireless communication unit 11 performing wireless Internet communication with the SAM server 20 and the card company server 30, and short-range wireless communication. The card reader unit 12 for reading the information obtained, the memory unit 13 for storing the application program including the identity authentication application, and the user interface information including the process progress status of the identity authentication application are displayed, and information from the user The user authentication process using the financial cards 1a and 1b through wireless Internet communication with the SAM server 20 or the card company server 30 by executing the display unit 14 in the form of a touch screen that can receive input and the installed identity authentication application It is provided with a control unit 15 that proceeds sequentially.

Specifically, the user of the mobile communication terminal 10 downloads the identity authentication application 13a, installs and registers it in the control unit 15, and communicates with the SAM server 20 and the card company server 30 through the identity authentication application 13a. It works in conjunction with the authentication process. That is, when the authentication key is received by the mobile communication terminal 10, the authentication key can be used to access the financial cards 1a and 1b to perform personal authentication, and during such authentication, the short-range wireless communication reader unit 12 RF card information in an encrypted form, that is, card block information, is first read through The card block information is transmitted to the SAM server 20 as code information for recognizing or identifying the corresponding credit card. After that, when card information corresponding to the card block information is received from the SAM server 20 in an encrypted state with the first public key key, the control unit 15 transmits the encrypted card information and the user's personal identification information to the card company server 30 to send and request approval of identity authentication.

In addition, according to another embodiment of the present invention, the mobile communication terminal 10 may additionally encrypt the card information encrypted with the first public key using an asymmetric key method, but may be encrypted with the second private key to be digitally signed. The second secret key is distributed from the encryption key distribution server (not shown) to be owned only by the user, the second secret key is owned only by the mobile communication terminal 10, and the public key paired with the second secret key is an unspecified number. can be distributed to

Here, the SAM server 20 may include a secure application module (SAM) in the form of at least one chip and may be configured in a hardware state. In addition, the SAM server 20 may be configured such that the SAM is programmed into the server in a software state. At this time, the SAM server 20 uses a self-equipped PC or wireless communication means to authenticate card block information, corresponding card information, and identity. The process of sending and receiving information is automatically processed.

In addition, in detail, the SAM server 20 performs authentication of affiliated store or user information through the identity authentication application installed in the mobile communication terminal 10, and OTX for verification of authentication key and subsequent decryption validation of card block information with card access authority. When card block information, which is encrypted information, is received from the authentication server 20A and the mobile communication terminal 10 for generating and transmitting ) provided by the encoding server 20B.

The authentication server 20A authenticates user information through a self-authentication application so that the personal authentication processing of the financial cards 1a and 1b can be performed in the mobile communication terminal 10, and transmits the authentication key, which is the card access right, to the mobile communication terminal 10 ) is supplied. In addition, when a request for an authentication key is received from the mobile communication terminal 10, the SAM server 20 generates a 16-byte OTX of a unique value using the request time from the authentication server 20A, and the authentication server DB (not shown). ) is stored in Then, the authentication server 20A transmits the authentication key and the generated OTX to the mobile communication terminal 10 .

When the card block information is received from the mobile communication terminal 10, the encryption server 20B decrypts the card block information according to the standard of a general financial card to extract card information including the card number and expiration date, and the extracted card block information. The card information is encrypted and returned to the mobile communication terminal 10 . At this time, when the encryption server 20B receives the card number decryption request, it sends the OTX received from the mobile communication terminal 10 to the authentication server 20A, and the authentication server 20A verifies that the card number decryption request is valid by OTX. After that, the result is returned to the encryption server 20B.

The encryption server 20B encrypts card information using the first public key distributed by the card company server 30 . That is, in the present invention, an asymmetric key encryption method in which the encryption key and the decryption key are different from each other is used. is a form of In the present invention, the private key is stored by the card company server 30, and the public key is distributed by the card company server 30 and used by the encoding server 20B.

The card company server 30 may be a server system composed of a plurality of servers such as banks, securities companies, and insurance companies. The card company server 30 receives the identity authentication request information from the mobile communication terminal 10, compares the card information included in the identity authentication request signal with card information registered in advance for user identification information, and performs identity authentication. Then, the user authentication result is provided to the mobile communication terminal 10 .

The card company server 30 includes a memory in which an identity authentication application performing a financial card-based identity authentication method possessed by a user, which will be described later with reference to FIGS. 3 to 6, is programmed and stored in a software state, or a user in a hardware state It is composed of a chip in which process information for performing the financial card-based identity authentication method possessed by the company is stored, and may be stored in a memory or configured as a chip through the CPU of a self-equipped processing PC.

2 is a block diagram of a card company server according to an embodiment of the present invention.

Referring to FIG. 2 , the card company server 30 includes a decryption unit 31 , a customer DB 32 , an identity authentication verification unit 33 , and a message sending processing unit 34 . Additionally, it may further include an authentication allowed time checker 35 and an authentication allowed time information DB 36 .

The decryption unit 31 decrypts the received card information encrypted with the first public key with the first private key and also decrypts the personal identification information with the symmetric key. At this time, according to another embodiment of the present invention, the card information may be encrypted over the second time. That is, the card information may be encrypted with a first public key that is a primary encryption key and then encrypted with a second private key that is a secondary encryption key. Then, the decryption unit 31 first decrypts the card information with the second public key paired with the second private key, and then performs second decryption with the first private key to obtain card information. That is, the second secret key is held only by the mobile communication terminal 10, and when the card information is encrypted and transmitted with the second secret key, and the card company server 30 decrypts it with the second public key, personal authentication The function can be further strengthened. This is because only the mobile communication terminal 10 has the second secret key.

The identity verification confirmation unit 33 compares card information and personal identification information with information in the customer DB 32 to perform identity authentication. The customer DB 32 stores card issuance information, and stores card information and personal identification information for each customer. That is, when the received card information and personal identification information match the information stored in the customer DB 32 , it is determined that the user is authenticated.

The message sending processing unit 34 notifies the user authentication result of the user authentication confirmation unit 33 to the mobile communication terminal 10 .

Additionally, the authentication allowable time check unit 35 searches the authentication allowable time information DB 36 and extracts the authentication allowable time information set by the customer corresponding to the decrypted card information and personal identification information. That is, it is possible to set the self-authentication time in advance for each customer. Therefore, if identity authentication is requested at a time other than the set time, it is regarded as an illegal identity authentication request, and the identity authentication request is not performed. Instead, it is impossible to request identity authentication through the message sending unit 34 and card information Make sure that a fraud warning message is sent. Thereby, the security of user authentication can be further strengthened.

FIG. 3 is a signal flow diagram illustrating a method for user authentication based on a financial card possessed by a user according to an embodiment of the present invention, and FIG. 4 is a method for personal authentication based on a financial card possessed by a user according to another embodiment of the present invention. FIG. 5 is a signal flow diagram for explaining a process of providing an authentication key and OTX from a SAM server to a mobile communication terminal according to an embodiment of the present invention.

3 and 4, first, as a user authentication request signal is received according to the occurrence of a user authentication event for any service requested by the user (S101), the mobile communication terminal 10 is downloaded in advance by the user and Run the installed identity authentication application. The user authentication request may be made as a user authentication event occurs in institutions, businesses, and stores to provide arbitrary services to users. In addition, such a user authentication request signal may be a signal generated from another application executed through the mobile communication terminal 10 in an institution, a company, a store, and the like. For example, when a transcript issuance service is provided from a university, an identity authentication request signal may be generated from a certificate issuance application, and when a shopping payment service is provided, an identity authentication request signal may be generated from a payment application of a corresponding company .

The mobile communication terminal 10 requests authentication of a user authentication application through wireless communication with the SAM server 20 so that user information is authenticated. At this time, the SAM server 20 authenticates user information through the identity authentication application 13a installed in the mobile communication terminal 10 and supplies an authentication key capable of reading card block information (S102). The authentication key may be a secure access key enabling access from the financial cards 1a and 1b to a storage space in which user authentication information is stored. At this time, the SAM server 20 generates an OTX and transmits it to the mobile communication terminal 10 together with the authentication key. Here, the OTX is generated by the authentication server 20A, and is used to verify the validity of the card number decryption request. That is, OTX is used for the purpose of preventing the validity of the decryption request and the reuse and storage of card block information. An embodiment of providing an authentication key and OTX according to the present invention will be described with reference to FIG. 5 .

Referring to FIG. 5 , the mobile communication terminal 10 drives the short-range wireless communication reader unit 12 to provide unique identification information (Unique ID: UID) or a chip serial number of the financial cards 1a and 1b. : CSN) and prepare to read card information (S210). In detail, after activating the short-range wireless communication reader unit 12 by being driven by the execution of the identity authentication application, a message requesting to contact the financial cards 1a and 1b through the display unit 14 is displayed, In response, when the financial cards 1a and 1b come into contact with the short-range wireless communication reader unit 12, unique identification information (Unique ID: UID) or a chip serial number (Chip Serial Number: CSN) can be obtained. Here, Unique ID (UID) or Chip Serial Number (CSN) is information that can be read by the mobile communication terminal 10 in the RF method without a separate authentication key, and is 4 bytes of information. can

The mobile communication terminal 10 transmits the UID or CSN to the SAM server 20 to request the primary authentication key (S220). Then, the SAM server 20 provides the primary authentication key to the mobile communication terminal 10 by verifying whether it is forged or not through the financial cards 1a and 1b having the UID or CSN (S230). Here, the primary authentication key may be 6 bytes of information. Then, the mobile communication terminal 10 drives the short-range wireless communication reader unit 12 and uses the primary authentication key provided from the SAM server 20 to obtain the first sector 1st of the card information from the financial cards 1a and 1b. sector) information is read (S240). That is, the financial cards 1a and 1b receive the first authentication key from the mobile communication terminal 10 in the RF method, and when the corresponding primary authentication key is valid, the first sector information stored in the storage space is transferred to the mobile communication terminal. (10) is forwarded.

Then, the mobile communication terminal 10 transmits the first sector information of the financial cards 1a and 1b to the SAM server 20 to request a secondary authentication key (S250). Then, the SAM server 20 authenticates the first sector information, and transmits a secondary authentication key having access to the card block information, which is encrypted information, to the mobile communication terminal 10 (S260). At this time, the authentication server 20A of the SAM server 20 generates a 16-byte OTX that is a unique value using the authentication key request time, and stores it in the authentication server DB (not shown). Then, the authentication server 20A transmits the generated OTX secondary authentication key to the mobile communication terminal 10 (S260).

Referring back to FIGS. 3 and 4 , after the user's authentication process of the mobile communication terminal 10 is performed, the user directly uses the authentication key, which is the card access right, from the SAM server 20 to access the financial cards 1a and 1b. When the mobile communication terminal 10 is tagged, the mobile communication terminal 10 reads the card block information by the short-range wireless communication reader unit 12 (S110). Here, the authentication key may be the secondary authentication key obtained in FIG. 5 . Here, the card block information is encrypted information. The mobile communication terminal 10 transmits card block information to the SAM server 20 through the wireless communication unit 11 (S120). At this time, the mobile communication terminal 10 transmits the OTX received in step S102 together.

Then, before decrypting the card block information, the encryption server 20B of the SAM server 20 performs validation of the card block information decryption request using the OTX transmitted from the mobile communication terminal 10 (S121 to S125) That is, the encryption server 20B makes an OTX verification request to the authentication server 20A (S121). Then, the authentication server 20A verifies whether the card number decryption request by OTX is valid (S122), and then returns the OTX verification result (S123). That is, the authentication server 20A verifies whether the OTX requested for verification by the mobile communication terminal 10 is the OTX issued by the authentication server 20A. At this time, once OTX verification is completed, the OTX stored in the authentication server DB is deleted, so the OTX used once cannot be reused. In addition, the verification failure result may be returned to reject the decryption request after a predetermined time (eg, 3 minutes) has passed by checking the generation time in the OTX.

If the OTX verification result transmitted in S123 is a failure, the encryption server 20B transmits a self-authentication impossible message to the mobile communication terminal 10 (S125). Then, the mobile communication terminal 10 transmits a self-authentication impossible message to another application requesting self-authentication (S126), and the self-authentication process is terminated.

On the other hand, if the OTX verification result transmitted in S123 is successful, the encryption server 20B decrypts the card block information (S130). Then, the SAM server 20 extracts card information for identity authentication from among the decrypted information (S135), and uses the first public key distributed by the card company server 30 that issued the financial cards 1a and 1b. The extracted card information is encrypted using (S140). Here, the card information may include a card number and an expiration date. Then, the SAM server 20 transmits the card information to the mobile communication terminal 10 in an encrypted state with the first public key (S150).

According to an embodiment of the present invention shown in FIG. 3 , as the mobile communication terminal 10 receives card information received in an encrypted state, a Personal Identification Number (PIN) along with the encrypted card information transmits to the card company server 30 to request identity authentication (S160, S170).

That is, the mobile communication terminal 10 displays a message requesting input of a personal identification number, and obtains and encrypts the PIN input through the input means (S160). Here, the user identification information may be one or more of a user name, date of birth, resident registration number, mobile communication terminal phone number, and the like, but preferably the date of birth or the mobile communication terminal phone number. Here, the mobile communication terminal 10 and the portable terminal possessed by the user may be the same, and when the mobile communication terminal 10 is a terminal installed in an affiliated store, the portable terminal possessed by the user may be different from the mobile communication terminal 10 . may be

Meanwhile, according to another embodiment of the present invention shown in FIG. 4 , the mobile communication terminal 10 may additionally encrypt card information encrypted with the first public key with the second private key ( S155 ). To this end, the mobile communication terminal 10 may receive in advance a second secret key, which is an encryption key to be possessed only by the mobile communication terminal, from an encryption key distribution server (not shown) in advance. The second private key is distributed from the encryption key distribution server (not shown) to be owned only by the user, the second private key is owned only by the mobile communication terminal 10, and the second public key paired with the second private key is It can be distributed to an unspecified number of people. That is, in the case of the current credit card or the like, when the real card itself is illegally acquired, the acquirer can make an illegal payment using the credit card, so there is no method to prevent the illegal use of the card when the card is lost. Accordingly, it is possible to strengthen the identity authentication of the card holder through this.

In addition, according to an embodiment of the present invention shown in FIG. 3 , the card company server 30 receiving the identity authentication request signal decrypts card information included in the identity authentication request signal with the first secret key ( S180 ). In detail, the card information decrypted with the first public key is decrypted with the second private key paired with the first public key. Meanwhile, according to another embodiment of the present invention shown in FIG. 4 , card information may be encrypted over a second time. That is, the card information may be encrypted with a first public key that is a primary encryption key and then encrypted with a second private key that is a secondary encryption key. Then, the decryption unit 31 first decrypts the card information with the second public key paired with the second private key (S175), and then performs second decryption with the first private key to obtain card information (S185). That is, the second secret key is held only by the mobile communication terminal 10, and when the card information is encrypted and transmitted with the second secret key, and the card company server 30 decrypts it with the second public key, personal identification The function can be further strengthened. This is because only the mobile communication terminal 10 has the second secret key. This second public key may be requested in real time from an encryption key distribution server (not shown) or stored in the customer DB 32 matched with the card user's personal identification information.

The card company server 30 searches the customer DB 32 with the decrypted card information and personal identification information to perform identity authentication (S185). At this time, the card company server 30 may perform identity authentication based on a preset allowable time slot in performing identity authentication, which is a kind of siren service to prevent card information theft. It will be described later with reference to FIG. 5 .

Then, the card company server 30 notifies the user authentication result to the mobile communication terminal 10 (S190). In this case, the authentication result may be transmitted as a mobile communication message. At this time, the authentication result is mobile communication messages such as Short Message Service (SMS), Long Message Service (LMS), Multimedia Message Service (MMS), push messages, and specific application execution. It could be a request signal.

Then, the mobile communication terminal 10 returns the identity authentication result received from the card company server 30 to the other application (S195), thereby completing the identity authentication process.

6 is a flowchart illustrating a customer authentication method in a card company server according to an embodiment of the present invention.

Referring to FIG. 6 , the authentication allowable time check unit 35 of the card company server 30 searches the authentication allowable time information DB 36 , and allows authentication set by the customer corresponding to the decrypted card information and personal identification information. Time information is searched (S310). To this end, the card company server 30 may transmit the user authentication allowed time input from the user to the card company server to be registered in advance. That is, it is possible to set an allowable time for self-authentication in advance for each customer. Accordingly, if the authentication permission time check unit 35 of the card company server 30 is requested at a time other than the set time, it is regarded as an illegal identity authentication request, and does not perform the identity authentication request, instead The message sending unit 34 transmits a message indicating that it is impossible to request identity authentication and a warning message about personal information theft (S340). Thereby, the security of user authentication can be further strengthened.

On the other hand, when the user authentication is requested at the time set by the customer, the identity authentication performing unit 35 of the card company server 30 compares the information in the customer DB 32 to perform the identity authentication (S350). As a result of the determination of S350, if the received card information and personal identification information match the information stored in the customer DB 32, it is determined that the identity authentication has been confirmed, and the message sending processing unit 34 of the card company server 30 performs the identity authentication A confirmation message is sent (S380). On the other hand, as a result of the determination of S350, if the received card information and personal identification information do not match the information stored in the customer DB 32, it is determined that the identity authentication has failed, and the message sending processing unit 34 of the card company server 30 is A user authentication error message is sent (S380).

Claims (22)

A secure application module (hereinafter referred to as 'SAM') reads accessible information of financial cards, including general credit cards and transportation cards, by a self-authentication application that is driven as it receives a self-authentication request signal from another application. After transmitting to the server, obtain the authentication key, which is the right to access OTX and card block information recorded on the user's financial card, from the SAM server to verify the decryption validity of the card block information, and use the obtained authentication key The card block information and OTX, which are encrypted information read from the financial card through the short-range wireless communication function, are transmitted to the SAM server, and the financial card is issued by receiving the card information encrypted by the first public key from the SAM server. A mobile communication terminal that transmits to the card company server to request identity authentication, and returns the identity authentication result received from the card company server to another application;
Upon receipt of card block information and OTX, which are encrypted information itself, transmitted from the mobile communication terminal provided with the authentication key, OTX verification is performed and the card block information, which is the encrypted information, is converted to general information as the OTX verification succeeds. Decrypted according to the standard method of the financial card, and the card information including the card number and expiration date directly extracted from the decrypted information is encrypted with the first public key distributed by the card company that issued the financial card and transmitted to the mobile communication terminal. a SAM server that
Upon receiving the card information encrypted with the first public key from the mobile communication terminal, the card information is decrypted using the first private key paired with the first public key, and the card information is compared with the customer database to authenticate the user. A financial card-based identity authentication system possessed by a user, including a card company server that notifies the mobile communication terminal.
The method of claim 1, wherein the SAM server is
An authentication server that generates and issues an authentication key and OTX;
An encryption server that decrypts card block information according to the standard of a general financial card,
encryption server
As card block information and OTX are received, it requests OTX verification from the authentication server,
authentication server
A financial card-based self-authentication system owned by the user that verifies whether the OTX requested for verification is the OTX issued by the user and returns the verification result to the encryption server.
The method of claim 1, wherein the SAM server is
As the OTX verification fails, a self-authentication impossible message is transmitted to the mobile communication terminal,
mobile communication terminal
A financial card-based self-authentication system owned by a user who transmits a message that cannot be authenticated to another application.
3. The method of claim 2, wherein the authentication server is
When the OTX verification is complete, a financial card-based identity authentication system held by the user who deletes the OTX.
3. The method of claim 2, wherein the authentication server is
A financial card-based self-authentication system possessed by the user that checks the creation time recorded in the OTX and returns an OTX verification failure result when a certain amount of time has elapsed from the OTX creation time.
According to claim 1, wherein the mobile communication terminal
Obtain additional personal identification number (PIN) of the user, transmit personal identification information together with card information to the card company server to request additional authentication;
card company server
As a personal identification number is additionally received along with card information, a financial card-based identity authentication system possessed by a user, including a card company server that additionally authenticates it.
7. The method of claim 6, wherein the personal identification number is
A financial card-based identity authentication system held by the user, which is the user's social security number or the number of the user's mobile terminal.
According to claim 1, wherein the mobile communication terminal
The card information encrypted by the first public key is additionally encrypted with the second secret key held only by the mobile communication terminal and transmitted to the card company server to request identity authentication,
card company terminal
After decrypting the additional encrypted card information with the second public key paired with the second secret key, the user's financial card-based identity authentication system decrypts with the first private key.
According to claim 1, wherein the mobile communication terminal
Transmit the user authentication time input from the user to the card company server and register it in advance,
card company server
Registers a preset time allowed for self-authentication for each user, detects the permissible time for self-authentication of the user when receiving a self-authentication request, determines whether the self-authentication request is valid based on the permissible time for self-authentication, and determines whether the self-authentication request is valid If not, a financial card-based self-authentication system possessed by the user that transmits a self-authentication impossible message to the mobile communication terminal.
In the user-owned financial card-based self-authentication method implemented in a self-authentication application executed in a mobile communication terminal equipped with a short-range wireless communication function,
Reading the accessible information of the financial card as a user authentication request signal is received from another application and transmitting it to a secure application module (hereinafter referred to as 'SAM') server;
Obtaining an authentication key, which is an access right to OTX and card block information recorded on a user's financial card, from the SAM server for verification of decryption validity of card block information;
Using the obtained authentication key to read card block information, which is encrypted information recorded on a financial card, through a short-range wireless communication function;
Transmitting the read encrypted information, card block information and OTX to the SAM server;
Upon receiving card information including the card number and validity period encrypted with the first public key distributed by the card company that issued the financial card from the SAM server, transmitting the information to the card company server that issued the financial card to request identity authentication;
A financial card-based identity authentication method possessed by a user, comprising the step of replying to another application the identity authentication result returned from the card company server.
The method of claim 10, wherein the step of requesting identity authentication
A financial card-based self-authentication method possessed by a user, comprising the steps of additionally acquiring a personal identification number (PIN) of the user and transmitting the personal identification information together with the card information to a card company server to request additional authentication.
12. The method of claim 11, wherein the personal identification number is
A financial card-based identity authentication method held by the user, which is the user's social security number or the number of the mobile terminal the user has.
The method of claim 10, wherein the step of requesting identity authentication
receiving in advance a second secret key, which is an encryption key to be possessed only by the mobile communication terminal, from an encryption key distribution server;
A financial card-based identity authentication method possessed by a user, further comprising the step of further encrypting the card information encrypted by the first public key with a second private key held only by the mobile communication terminal.
11. The method of claim 10,
A financial card-based self-authentication method possessed by a user, further comprising the step of registering in advance by transmitting the allowed time for authentication received from the user to the card company server.
11. The method of claim 10,
In response to receiving a self-authentication impossible message due to OTX verification failing from the SAM server, the method of self-authentication based on a financial card possessed by a user further comprising the step of transmitting the self-authentication impossible message to another application.
In the secure application module (hereinafter referred to as 'SAM') server, a financial card-based identity authentication method possessed by a user,
As the mobile communication terminal requests issuance of an authentication key, which is the right to access card block information recorded on the financial card, along with the accessible information of the financial card, the user is authenticated through the information transmitted from the mobile communication terminal, and then the providing an OTX and an authentication key for verifying the decryption validity of card block information;
Performing OTX verification as OTX and card block information, which is information encrypted by itself, are transmitted from the mobile communication terminal;
If the OTX verification is successful, decrypting the encrypted card block information according to the standard of a general financial card;
extracting card information including card number and expiration date directly from the decrypted information;
encrypting the extracted card information with a first public key distributed by the card company that issued the financial card;
A financial card-based identity authentication method possessed by a user, comprising transmitting encrypted card information to a mobile communication terminal.
17. The method of claim 16,
When the OTX verification fails, the user's financial card-based self-authentication method further comprising the step of transmitting a message that cannot be decrypted to the mobile communication terminal.
The method of claim 16, wherein performing OTX verification comprises:
A financial card-based self-authentication method possessed by the user that verifies whether the OTX requested for verification is an OTX issued by the user. The method of claim 16, wherein performing OTX verification comprises:
When the OTX verification is complete, the financial card-based identity authentication method possessed by the user who deletes the OTX.
The method of claim 16, wherein performing OTX verification comprises:
A financial card-based self-authentication method possessed by the user that checks the creation time recorded in the OTX and returns an OTX verification failure result when a certain amount of time has elapsed from the OTX creation time.
The personal authentication application performing the financial card-based identity authentication method possessed by the user according to any one of claims 10 to 15 includes a memory that is programmed and stored in a software state, or finance owned by the user in a hardware state A mobile communication terminal that is composed of a chip in which process information for performing a card-based identity authentication method is stored, and is stored in a memory through the CPU of a self-equipped processing PC or performs a financial card-based identity authentication method possessed by a user composed of a chip.
The secure application module (SAM) is programmed in software state and stored in memory, or is composed of a chip in which the secure application module (SAM) information is stored in the hardware state, and the CPU of the self-equipped processing PC By performing wireless communication through a mobile communication terminal through a separate wireless communication means through a security application module ( Secure Application Module (SAM) server.

Images