KR20010068174A - An electronic commerce settlement system for preventing hacker form client's information - Google Patents

Abstract

PURPOSE: An electronic commerce payment system for preventing customer information from being hacked is provided to increase convenience in personal information input of a customer, and increase security of the personal information stored in a customer database, by reducing the amount of the personal information that the customer has to input in electronic commerce. CONSTITUTION: An input output part(44) receives the customer information inputted by the customer, and outputs the customer information searched in the customer database. A search part(42) searches the customer information in the customer database. A storage part(43) stores the customer information in the customer database. A customer information process part(45) processes only important information of the customer so that another person cannot misuse the customer information. A control part(41) determines whether the customer information has been registered, and controls all system elements.

Description

An electronic commerce settlement system for preventing hacker form client's information}

The present invention relates to an e-commerce payment system performed on the Internet, and more particularly, to incompletely store the personal information of the customer in the customer DB configured in the website of the intermediate merchant performing the e-commerce, the customer by the hacker If information is hacked, hackers can not use the incomplete customer information to enhance the security of customer personal information, and extracts a lot of customer personal information that the customer must input when purchasing goods and services from the customer DB, By outputting on the customer's web browser, it is to shorten the customer's input process to eliminate the inconvenience caused by customer input in the enterprise commerce. To this end, the present invention is to process the important information such as the resident registration number, credit card number of the customer of the input customer information to extract only a predetermined number of the total number of digits incomplete customer important information, the database of the customer information It is composed of server side program (hereinafter referred to as customer DB) and the customer DB to improve convenience by keeping customer information safe and simplifying customer input during e-commerce even in case of hacking from hacker. will be.

In the conventional e-commerce site, when a customer purchases goods or services on the Internet, the customer's personal information is input into a web browser for product delivery, service execution, and payment, and the customer's information is encrypted. The information required for payment using the technique is transmitted to the credit card settlement company or the credit card settlement bank that performs the payment, and at the same time, the personal information such as the purchase history, the address, the telephone number, and the like is stored on the server of the site that performs the e-commerce. In the case of using the Internet network to transmit to the side, and the customer subscribes as a member, the customer's information is stored in the customer DB of the server.

In general, when a customer registers as a member of the above, the personal information of the customer written on the web browser and sent is ID, password, name, address, phone number, and resident registration number, which are required in most sites. Along with the above, you must optionally enter various personal information such as your job name, job title, mobile phone number, and hobbies. In addition, in order to make a payment, the customer often needs to use a credit card payment system or an online payment method.

When using credit card payment, the purchaser can enter his or her personal information and credit card number on a web browser, and use encryption techniques such as SSL (Secure Socket Layer) encryption or public key private key scheme provided by the web browser. In the transmission process, the security of the customer's personal information is guaranteed, but the security is somewhat weak because it uses a 40-bit encryption scheme. Therefore, the current trend is to use a 128-bit encryption scheme. The principle of credit card payment in e-commerce is that the user of the card must be able to determine if the owner of the card is certain (authentication), and the data of the customer to be transmitted must not be exposed to others in transit (confidentiality). It must be possible to verify that the transaction has not been tampered with by others (integrity), to prevent the buyer from denying that he or she has performed the e-commerce transaction (prevention of denial), and the intermediate merchant conducting the transaction must The number must not be known. In other words, the card number entered by the individual should be encrypted and sent directly to the card payment company or the credit card handling bank through the payment gateway for card payment. This ensures that the customer's credit card number is secured by encryption while in transit and that the customer's credit card number is rarely exposed to the outside world because it does not go through an intermediary merchant. The inconvenience of having to input the customer personal information always at the time of purchase occurred. In addition, in order to enhance the convenience of input when a customer purchases goods and services on the web, that is, the buyer is registered as a member (customer) and interlocks with the central server of the website where the customer's personal information is carried out. By storing in the customer database, if the customer wishes to purchase goods or services on the Internet, the customer's information is output in advance on a web browser on the client's client computer for the customer's convenience. Only the customer's personal information can be filled out, but in this case, if the customer DB of the vulnerable commerce site is hacked by a hacker, the customer's personal information, that is, the individual's social security number, Important information, such as credit card numbers, is exposed unprotected to conduct e-commerce transactions with customers Since there is always the possibility of causing serious damage to the middle merchant, both the supplier and the buyer are reluctant to store the client's personal information on the server.

The present invention has the inconvenience of having to fill out the information of the customer, which occurs when the customer purchases goods or services in the electronic commerce in the above-described prior art, and the personal information of the website that performs the e-commerce. When stored in the customer DB, it is intended to prevent the damage of the customer due to exposure of personal information by hacking. In other words, by reducing the amount of personal information that a customer must enter in e-commerce, the convenience of following the personal information input of the customer is enhanced, and when the customer's personal information is stored in the customer DB of a website that conducts e-commerce, The purpose is to increase the security of the personal information. Customer's important information (credit card number, social security number) to be entered when purchasing goods or services from e-commerce site is stored in customer DB of website that conducts e-commerce transaction or website where other member information should be stored. When you do not store all the numbers on the credit card (for example, store only the first eight numbers in the customer database). Only part of the resident registration number (eg, the date of birth) is stored in the customer DB, and the customer's information is stored when the customer re-connects to the e-commerce site and requests the purchase of resources and services. By transmitting all personal information stored in the client to the client computer in advance and outputting it on the web browser of the client computer, the inconvenience of writing personal information is reduced by reducing the personal information that a customer needs to fill out when purchasing services and goods. In addition, even if a customer DB of a website is intruded by a hacker, complete personal information cannot be obtained from information that the hacker can exploit from the customer DB. Ensure the safety of the information.

The invention is not limited to credit card numbers, social security numbers, etc., but can be used to store all the information that is not important in terms of management by storing, using, and leaking.

1 shows a schematic configuration of a network according to the invention,

2 is a diagram showing the configuration of a web server and a customer DB of the present invention;

3 is a block diagram showing a process in which the payment process of the present invention is initiated from a client computer to payment of a credit card.

4 is a flowchart showing a process of the present invention;

5 is a block diagram schematically showing that a server side program and a web server are configured in a central server.

* Explanation of symbols for the main parts of the drawings

1: Central Server 2: Customer DB

3: firewall 4: internet network

5: client computer 10: web server

20: shopping mall web page 30: server side program

P1: control unit P2: search unit

P3: storage unit P4: input / output unit

In order to achieve the above object of the present invention, the present invention provides a central server (1) having a web server having a web page embedded therein and a server side program for managing a customer DB.

A firewall (3) for preventing and securing illegal infiltration into the central server from the outside of the website conducting e-commerce,

The customer DB (2) for storing the personal information of the customer, the web browser is driven to access the web server 10 configured in the central server (1) to perform a search, or to purchase the goods or services on the website Consists of at least one client computer 5 for displaying the transmitted information,

By storing only a part of the customer's information in the customer DB, when the customer re-connects to the site and purchases the product, the previously stored incomplete customer data and all the customer's data are transferred to the client's client computer in advance, and the client's web browser By printing on the screen, the customer can enter only the unlisted parts, making the process of writing personal information more convenient.

Even if the customer DB is hacked by the hacker, since the customer's information is only partially exposed, the hacker cannot use the information in the customer DB alone to cause disadvantages to the customer, thereby enhancing the security of the customer's personal information. In the above-mentioned information that requires security, the most characteristic is a credit card number and an individual's social security number.

Hereinafter, with reference to the accompanying drawings, it will be described in more detail through an embodiment of the present invention.

1 is a view showing the overall configuration of the e-commerce payment system for preventing customer information hacking.

The overall configuration of the system includes a central server (1) including a web server having a server side program for controlling a shopping mall web page and a customer DB,

Customer DB (2) that stores customer information,

A firewall (3) for preventing illegal access from outside to the central server,

The user accesses the central web server, performs a search, receives data on personal information transmitted from the central server of the website when selecting a purchase of goods and services, and displays the personal information on a web browser running on a client computer. To display. At least one client computer 5 applying for the purchase of said goods and services,

Credit card payment server (6), which performs credit card authorization and payment when the customer performs credit card payment,

And an internet network 4 for mediating these data communications.

FIG. 2 is a block diagram schematically showing the configuration of a web server and a customer DB built in a central server of the website of the present invention. The web server 10 includes a shopping mall web page 20 and a server side program 30. FIG. ) And the customer DB 2 are shown.

In the above, the server side program 2 of the web server 10 converts the customer's personal information transmitted from the client computer 5 to the central server of the website, and only a part of important information such as a processed credit card number and an individual's social security number. Extract and store in the customer DB (for example, only six digits of the social security number, and only eight digits in the case of a credit card number) is deleted personal information of the first customer obtained.

In the customer DB 2, the credit card number and the individual's social security number, which are processed and stored only in part by the server-side program, do not have personal information that can be abused by itself, so that the customer may be exposed to the hacker by hacking. The security of the information is guaranteed.

In addition, when the customer reconnects to the website and purchases goods and services, all the customer's information is transmitted to the client computer along with the incomplete customer information stored in the customer DB (2) and printed on a web page on the client computer. By reducing the inconvenience of having to write down all the personal information every time in the purchase activity performed by the customer, the inconvenience caused by the input of the customer's personal information can be reduced.

3 shows the data transfer and processing process occurring between the client computer 5, the central server 2, the customer DB 2 and the card settlement server of the card settlement company.

First, when the customer selects the goods and services to purchase from the client computer (ST1), the member (customer) login screen appears and if the member (customer) is not a member (ST2).

The central server extracts incomplete customer information by querying customer information from the customer DB (ST3).

The extracted incomplete customer information and the details of the goods and services to be purchased by the customer are transmitted to the client computer (ST5).

The customer information and the purchase history sent to the client computer are output on the web browser of the client computer (ST6), the customer fills out the unlisted customer information among the incomplete customer information output (ST7), and after confirming the purchase history, the central server To the computer (ST8).

Among the personal information described above, information such as credit card number, card expiration date, and payment amount required for payment is transmitted to the central credit server and the central server only when the customer makes the first purchase. The information sent to the server is processed, the card is authorized and settled in the credit card server (ST9),

After providing or delivering the desired product to the customer, the customer's purchase of goods and services is stored in the customer database for use as data to provide services such as mileage to the customer.

FIG. 4 is a flowchart illustrating a process of FIG. 3.

To describe the preprocessing process of the present invention, first, a customer accesses a web server in a central server configured in a website for performing electronic commerce through a web browser on a client computer (S1),

After searching the contents of the website (S2),

If there are goods and services to be purchased, the purchase of goods is selected (S3),

If there is no purchase intention, the search of the website is terminated, and if there are goods and services to be purchased, the process of FIG. 3 is performed.

FIG. 4 adds a registration process that is not present in FIG. 3. If the customer selects the purchase of goods and services, it is determined whether the purchaser is a member (customer) (S4),

In the case of a non-member induces membership (S5), in the case of a member performs a member login (S7).

5 is a diagram showing the configuration of a server-side program built in a web server, the server-side program accepts to process the customer information entered by the customer input and output unit 44 for exporting the customer information retrieved from the customer DB ), A retrieval unit 42 for retrieving customer information from the customer DB, a storage unit 43 for storing the customer information in the customer DB, and a customer's information so that the customer information cannot be misused even if another person acquires the customer information. A customer information processing unit 45 for processing only important information, and a control unit 41 for determining whether or not the customer information is registered, and controls the component.

In the above, the customer information processing unit 45 determines whether or not the customer information retrieved from the search unit is information registered by the control unit 41, and is not registered information. And selectively extract a predetermined number of digits from the total number of digits of the address and phone number, and delete the original customer information before the extraction. By doing so, information of social security numbers, telephone numbers, credit card numbers, and addresses is incompletely stored in the customer DB, so that even if exposed to hackers, the customer's information cannot be abused.

The customer DB stores member ID, password, name, hobby, job, job name, purchase history, customer mileage information and processed customer information together.

In some cases, the member information is not completely registered in the customer database. If a client who does not register as a member does not want to register as a member, the card number, social security number, and other important information are not entered. This is because membership (customer) can be registered. However, you must enter information such as your name, address, age, member ID, and password to manage your membership.

In the prior art, when paying for goods and services to be purchased necessary for electronic commerce on the Internet, the personal credit card information is not recognized by the intermediary merchant performing the e-commerce. It will be sent directly through the payment gateway to card companies and multiple card settlement banks. Therefore, when a customer (member) wants to purchase goods or services, it was inconvenient to fill out all the information necessary for the e-commerce payment, such as an individual's social security number and credit card number. In addition, in order to solve the inconvenience, if the customer's important information, that is, the social security number or credit card number stored in the customer database in the database server of the intermediary merchant who performs the e-commerce risks that the important information of the customer to the hacker unprotected This will follow.

The present invention reduces the amount of personal information that a customer must fill in when he or she desires to purchase goods and services in e-commerce, thereby eliminating the inconvenience of purchasing in the customer's e-commerce, and also storing incomplete customer information in the customer DB. It has the effect of keeping your information safe from hackers.

As described above, the present invention can be variously modified by those skilled in the art according to a preferred embodiment without departing from the gist of the present invention as claimed in the claims. It is not limited to the preferred embodiment of the.

Claims (5)

At least one client computer 5 for performing data communication with the website when accessing the website through a web browser to purchase goods and services; A central server 1 including a web server for providing a web page and driving an application program, the central server 1 for communicating with the outside; A server side program (30) configured in a web server for processing customer information received at the central server; A customer DB (2) storing customer information processed by the server side program and customer information for membership management; E-commerce payment system for preventing hacking customer information, characterized in that consisting of a credit card payment server (6) for performing a credit card payment by a customer's purchase request. The method of claim 1, wherein the web server, A customer who stores customer information in the customer DB and inquires customer information stored in the customer DB (2) when a customer who is a member purchases goods and services from the website. E-commerce payment system for preventing customer information hacking, characterized in that for transmitting to the client computer so that the customer information is displayed on the web browser. According to claim 1, wherein the server side program, (1) the input and output unit 44 for transmitting the customer information of the customer DB to the client computer and receiving the customer information and credit card information entered for the purchase by the customer when the customer registers and purchases on the client computer; and (2) a search unit 42 for determining whether the customer's resident registration number, credit card number, telephone number, address of the customer information is registered in the customer DB; and (3) If the customer's resident registration number, credit card number, phone number, and address are not registered in the customer DB, other persons will not be able to know the whole information, and the resident registration number, credit card number, phone number and address before processing will be deleted. Customer information processing section 44; and (4) a storage unit (43) for storing the processed resident registration number, credit card number, telephone number, address and customer information for customer management in the customer DB; and (5) an electronic commerce payment system for preventing hacking of customer information, characterized in that it comprises a control unit (41) for controlling all the components of the server side program. The method of claim 3, wherein the processing unit of the server side program, If the processed information of the resident registration number, credit card number, address, and phone number is not in the customer database among the customer information retrieved from the search unit, the predetermined number of digits among the digits of the resident registration number, credit card number, address, and phone number are extracted and processed. Resident registration number, credit card number, address, phone number of the e-commerce payment system for preventing hacking customer information, characterized in that the deletion. (1) a step in which a user accesses a website using an internet network through a client computer (S1) and searches for a site (S2); (2) the user selecting to purchase goods and services provided in the website (S3); (3) If the customer login screen is displayed on the client computer and the user is a member, the user logs in. If the user is not a member, the user registers. If the customer information is transmitted to the web server of the website, the social security number of the customer information is displayed. After processing the credit card number, phone number, and address so that others cannot recognize it, and storing the processed information with name, member ID, password, job name, job, hobby, customer mileage in customer DB, user Performing login (S4, S5, S6, S7); (4) a purchase request screen is displayed on the client computer of the customer, and the web server transmits the customer information stored in the customer DB among the customer information input by the customer to the client computer (S8, S9); (5) The customer inputs the unwritten contents of the customer's social security number, credit card number, telephone number, and address among the customer information displayed on the client computer, identifies the goods and services that the client computer wants to purchase, and centralizes the purchase information. Transmitting to the server (S10); (6) Credit card information among the customer information is transmitted to the central server only when the customer first enters a transaction, and if the credit card information is already processed and stored in the customer DB, the credit card payment server (6) Immediately sent to the step of making the credit card authorization and payment (S11); (7) after the approval and payment confirmation in the credit card payment server 6, providing the goods and services purchased by the customer to the customer, and storing the customer's goods and services purchase history in the customer DB (S12) E-commerce payment method to prevent hacking of customer information.