KR20050049569A - Credit card payment sign-on system using card type recorded media included certificate and application method of the system - Google Patents

Abstract

The present invention provides a card-type storage medium (24) containing a credit card (22) having a serial number and card-specific data for validity, an official certificate including a public key and an electronic signature, and a private key corresponding to the public key. A credit card transaction approval system using a card reader, the card reader unit 33 of which the credit card 22 and the card-type storage medium 24 are inquired, the purchase amount and the installment month credit An input unit 34 for inputting a card transaction history and a password for activating the private key, an authorization request based on the card-specific data and the credit card transaction history, and an authentication with an electronic signature based on the private and public keys Card including a calculation unit 35 for generating a request, a data communication unit 36 connected to an external wired and wireless communication network to enable data communication, and a display unit 37 for displaying the result of the data communication to the outside. Once the terminal 32 and; A bansa 40 connected to the wired / wireless communication network to relay the approval request and the authentication request; The credit card company 50 is connected to the bansa 40 and returns an authorization request result for the authorization request, and is connected to the bansa 40 or the credit card company 50 and returns an authentication request result for the authentication request. It provides a credit card transaction approval system, characterized in that it comprises a public certification authority (60) and a credit card transaction approval method using the same.

Description

Credit card transaction sign-on system using card type recorded media included certificate and application method of the system}

The present invention relates to a credit card transaction approval system and a credit card transaction approval method using the same, and more particularly, a credit card containing a serial number and card-specific data of an expiration date, and a public key and an electronic signature. The present invention relates to a credit card transaction approval system using a card-type storage medium in which a certificate and a private key corresponding to the public key are embedded, and a credit card transaction approval method using the same.

Thanks to the rapid development of the economy, the increase of consumption due to the increase of personal income, and the expansion of transportation facilities and sales network, the sales credit donation system developed.Since the first bank credit card was issued in 1982, The spread and use of credit cards, called 'money', is on the rise.

In the modern society, the credit card serves as a measure of the transparent credit society. FIG. 1 is a system diagram for explaining a conventional credit transaction method using an existing credit card.

At this time, the credit transaction using a credit card can be largely divided into the approval of the purchase and the settlement thereof. The attached drawings and the following descriptions refer to the dual authorization, and are particularly applicable to face-to-face transactions between credit card members and merchants.

First, the subject for credit card authorization is provided in the member (2) who has a credit card (4) in which card-specific data such as unique serial number and expiration date are embedded, and in the merchant (6) that provides services or services. A card inquiry terminal 8 capable of inquiring a credit card 4 of a member 2, a bansa (Value Added Network: VAN 10) as a relay agency, and a bansa 10 through each of the affiliated stores. It includes a card inquiry terminal 8 of (6) and a credit card company 12 connected through a wired or wireless communication network.

In this case, the bansa 10 provides a wired / wireless communication network connecting the card inquiry terminal 8 of the affiliated store 6 and the credit card company 12, and relays the approval and payment process of the credit card transaction, and the sales of the affiliated store 6 It provides various agency services such as billing sales based on details and checking for abnormal transactions.

When the member (2) presents the credit card (4) for the purchase of goods or services at the merchant (6), the merchant (6) side using the card inquiry terminal (8) the serial number and validity of the credit card (2) After the card-specific data of the period is inquired, the transaction amount such as purchase amount and installment month for the goods or services that the member (2) wants to purchase is input to the card inquiry terminal (8) to generate an approval request, and then the bansa (10) To send).

Then, the bansa 10 aggregates the authorization request for each credit card company 12 and transmits it to the corresponding credit card company 12.

Subsequently, the credit card company 12 determines whether to approve or reject the transaction based on the approval request sent from the bansa 10 and the previously stored member credit information and merchant sales information. Notify the bansa 10.

Next, when the bansa 10 relays the approval number to the card inquiry terminal 8 of the affiliated store 6, a slip is issued from the card inquiry terminal 8, and finally, the member 2 confirms the slip and signs the handwritten signature. By being certified as a member, approval is completed.

At this time, the document containing the autographed signature of the member (2) serves as the authentication basis for judging whether the credit card member matches the user and is used as a calling document when an abnormality is found in the later transaction. A total of three slips are issued from the card inquiry terminal (8), one of which is kept by the member (2) as a receipt, one is kept by the merchant (6), and the other is a general purchase method. 6) The credit card company (12) billed to the credit card company 12 is received and stored, or in the case of automatic purchase method bansa 10 is collected and stored.

Each credit card transaction keeps a slip for a certain period of time.

However, the above-mentioned conventional credit card transaction approval process has some problems as the authentication of the member (2) depends only on the slip and the handwritten signature described therein, one of which is the forgery and alteration of the illegal signature. That's a big possibility.

That is, in general, the autograph signature of the member (2) is written on the back of the credit card (4), and the merchant (6) side compares it with the autograph signature written on the slip and authenticates the membership. Since the written signature is easily exposed to the outside, it can be easily forged and altered by others in case of loss or theft, and the member (2) or credit card company (12) is inadvertently damaged by the signature forgery of a third party. Cases are frequent.

In addition, the existing card inquiry terminal (8) requires a printer function that can print out the document is not only complicated device configuration, but also increases in manufacturing and sales price, and the document is issued as three documents with the same content issued The manufacturing cost and the storage cost is excessively spent, which imposes an excessive cost burden on the affiliated store (6) side.

In addition, in the case of the general purchase method for the storage and payment request of the slip, the merchant 6 must visit each credit card company 12 directly to receive the slip and charge the sales fee, and in the case of the automatic purchase method, Bansa 10 collects the slips of each affiliated store to verify, claim, and keep the complexity of the process, such as time consuming and costly has a disadvantage.

In addition, when a large amount of credit transactions occur in a short time, such as a large discount store or a department store, a time delay occurs such that the member (2) signs a handwritten signature on the slip and the merchant (6) checks it for each transaction. Due to the possibility of loss or damage during the storage period, the documents must be treated with special care.

Recently, due to the rapid development of information and communication technology and the proliferation of information and communication network, electronic shopping such as internet shopping, banking service or electronic commerce or electronic payment between companies is actively progressing. Difficulties in identifying and confirming the authenticity of transactions and the authenticity of transactions are likely to present various problems.

In this regard, a method of authenticating a member using a certificate is widely used. A certificate is a digital certificate issued by an authorized certificate authority and possessed by a member. A unique number, a copy of the owner's public key, and the digital signature of the certificate issuer are included.

This public certificate has a public key infrastructure (PKI) that uses asymmetric cryptography that can be encrypted and decrypted using a pair of corresponding public and private keys. It is stored in a hard disk drive, floppy disk, or smart card of a computer so that it can be read using a computer or a dedicated reader with a private key known only to the member.

In the process of electronic payment, the certification request is authenticated by an authentication request with a cryptographic and decryptable digital signature by a hashing algorithm of a predetermined rule using a public key and a private key corresponding to each other. The possibility of a third party's involvement is extremely low, allowing secure non-face-to-face transactions.

However, such a certificate is currently used only in the electronic transaction field of the Internet environment by mobilizing a computer and a dedicated reader interoperating with it regardless of the type of storage medium.

Accordingly, the present invention provides a member using a card-type storage medium in which a credit card containing a serial number and card-specific data of an expiration date, an official certificate including a public key and an electronic signature, and a private key corresponding to the public key are embedded. It provides an approval system for acquiring credit card transactions in face-to-face and between merchants and credit card transactions using this authorization system. Its purpose is to solve various problems and enable safer and more convenient credit card transactions.

In order to achieve the above object, the present invention provides a credit card having a serial number and card-specific data of an expiration date, an official certificate including a public key and an electronic signature, and a private key corresponding to the public key. A credit card transaction approval system using a type storage medium, comprising: a card reader unit provided at a merchant and inquiring the credit card and a card type storage medium, credit card transaction details of a purchase amount and an installment month, and activation of the private key; An input unit for inputting a password, an operation unit for generating an authentication request based on the card-specific data and credit card transaction history, and an authentication request with an electronic signature based on the private and public keys; A data communication unit connected to a wired / wireless communication network, and a display unit to externally display a result of the data communication. Views card terminal; A bansa connected to the wired / wireless communication network to relay the approval request and the authentication request; A credit card company connected to the bansa and returning an authorization request result for the authorization request; and a credit card authority connected to the bansa or credit card company and returning an authentication request result for the authentication request. Provide a transaction approval system.

In this case, a hashing algorithm for encryption and decryption of the public key infrastructure is embedded in the operation unit, and the authentication request is hashed according to a predetermined rule. In addition, the card-type storage medium is characterized in that the smart card, in this case, the card-type storage medium is characterized in that it is integrated with the credit card. The password may be a combination of numbers and letters or a fingerprint of the credit card member, and the input unit may include a plurality of buttons and a fingerprint recognition device to which letters or numbers are assigned, respectively.

In another aspect, the present invention is a method for approving a credit card transaction using the credit card transaction approval system, a) querying the credit card with the card inquiry terminal and inputting the purchase amount and transaction details of the installment month to generate an authorization request. Making a step; b) querying the card-type storage medium with the card inquiry terminal and inputting a password for activating the private key to generate a decrypted authentication request; c) transmitting the approval request and the authentication request to the bansa; b) returning the approval request result and the authentication request result after the approval request and the authentication request are relayed from the bansa to the credit card company and the authorized certification authority; e) providing the approval method of the credit card transaction comprising the step of completing the approval by transmitting the approval request result and the authentication request result to the card inquiry terminal.

In another aspect, the present invention is a method for approving a credit card transaction using the credit card transaction approval system, a) querying the storage medium with the card inquiry terminal and inputting a password for activating the private key to request a hashed authentication request. Generating a; b) transmitting the authentication request to the authorized certification authority through the bansa, and receiving an authentication request result from the certified certification authority through the bansa; c) generating an authorization request by inquiring the credit card using the card inquiry terminal and inputting a purchase amount and a transaction history of an installment month; d) transmitting the authorization request to the credit card company through the bansa, and receiving an authorization request result from the credit card company through the bansa; e) providing a method for approving a credit card transaction comprising the step of completing the approval based on the result of the authentication request and the result of the authorization request.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

Figure 2 is a view showing a credit card transaction approval system according to the present invention, largely to the member 20, merchant 30, bansa 40, credit card company 50 and the accredited certification authority (60) Can be classified.

At this time, the member 20 possesses a credit card 22 and a card-type storage medium 24 in which an official certificate is embedded, and each affiliated store 30 has a bansa 40 and a card inquiry terminal 32 connected to a wired / wireless communication network. ), The credit card 22 and the card-type storage medium 24 are inquired and a predetermined message is generated to communicate. And the credit card company 50 and the accredited certification authority 60 is connected to the card inquiry terminal 32 of each affiliate store 30 through the bansa 40, wherein the accredited certification authority 60 is the bansa 40 It may be connected to or with a credit card company 50.

To describe in more detail, first, the credit card 22 held by the member 20 has a unique serial number and card-specific data of an expiration date, similar to the general case, and includes a magnetic stripe. ) May be a magnetic card or a smart card.

The card-type storage medium 24 has a private key corresponding to the public key as well as a public certificate corresponding to the owner's name, a unique number, a copy of the owner's public key, and the electronic signature of the certification authority. For example, it may be a smart card, and in this case, in particular, may be made integral with the credit card (22).

3 is a block diagram of a smart card in which a card-type storage medium 24 and a credit card 22 are integrated in accordance with the present invention, and includes a central processing unit 25 with a microprocessor, an operating system, and a security algorithm. ROM (ROM: 26), RAM for storing temporary data (RAM: 27), and various applets such as application programs are stored. In particular, card-specific data such as serial number and expiration date of the credit card 22 are stored. It also includes an EEPROM (EEPROM 28), which stores public certificates and private keys.

In this case, reference numeral 29 indicates a functional application module that performs a predetermined role, and may be an RF antenna or the like in the case of a contactless or combination type according to the method of the smart card.

4 is a block diagram of a card inquiry terminal 32 provided in each affiliated store 30 in a state of being connected to a bansa 40 and a wired / wireless communication network, and a card reader unit 33 capable of inquiring various cards. And an input unit 34 for inputting external data, an operation unit 35 for generating various messages by performing calculation according to a predetermined rule, and a data communication unit connected to a wired / wireless communication network so as to perform data communication with the outside ( 36) and a display unit 37 for displaying various messages to the outside.

At this time, the card reader 33 may be a magnetic stripe reader (MSR) capable of reading a magnetic card or a smart card type credit card 22 and / or a smart card type storage medium 24 having a built-in certificate. And / or an IC card slot or a smart card reader, and the input unit 34 includes a plurality of buttons each assigned a unique number and letter, and a credit card including a fingerprint reader capable of recognizing a user's fingerprint. It is possible to enter a password for activating the purchase amount of 22), the transaction history of the installment month, and the private key of the card-type storage medium 24 in which the authentication certificate is embedded.

In addition, the calculation unit 35 generates an authorization request based on the unique data of the credit card 22 inquired by the card reader unit 33 and the credit card transaction history input to the input unit 34, and in particular, the card reader unit 33. Encryption and decryption of the public key infrastructure to generate an authentication request including a digital signature hashed in a predetermined form based on the private key and public key of the card-type storage medium 24 queried with a password input to the input unit 34. Hashing algorithm is built in.

The data communication unit 36 may be a communication interface device such as a modem or a LAN card, and the display unit 37 may be a liquid crystal display device.

For reference, the bansa 40 connected to the card inquiry terminal 32 and the wired / wireless communication network is provided with a relay system including a server 42 and a database 44 interworked with the server 42 similarly to a general case, and includes a credit card company ( 50) is equipped with an approval system that stores member credit information and merchant sales information, and can return the result of the approval request for the approval request. Although the certification authority (60) is not separately indicated, an external registration authority (registration authority) : In connection with RA), there is an authentication system that returns the result of the authentication request for the authentication request.

FIG. 5 is a flowchart illustrating a method of obtaining approval for a credit card transaction in a face-to-face manner using a credit card transaction approval system according to the present invention as described above, and will be described with reference to FIGS. 2 to 4. .

First, the member 20 having the credit card 22 and the card-type storage medium 24 visits the affiliated store 30 and uses the credit card 22 and the card-type storage medium 24 to purchase goods or services. Present each one (st1)

Next, the merchant 30 checks the credit card 22 with the card inquiry terminal 32, reads the serial number and the unique data of the credit card of the expiration date (st2), and then adds the goods or services to the member 20 to purchase. Enter the transaction details such as the purchase amount and the installment month. (St3) Then, the card-type storage medium 24 is queried by the card inquiry terminal 32 (st5), and a password unique to the member 20 is input. (st6)

In this case, the password of the member 20 is for activating the private key of the public certificate, and may be formed by a combination of numbers and letters, but preferably the fingerprint of the member 20 may be utilized. The member 20 fingerprint is inquired by the fingerprint recognition device included in the input unit 34 of the card inquiry terminal 32.

Accordingly, the calculation unit 35 of the card inquiry terminal 32 generates an authorization request based on the card-specific data and the transaction history (st4), and activates the private key in the card-type storage medium 24 through the password to open the public key base. An authentication request is generated by a hash algorithm of encryption and decryption of the structure, hashed in a predetermined form, and attached to the digital signature based on the private key. (St7)

And the approval request and authentication request is sent to the bansa (40).

In this case, when the member 20 presents the card-type storage medium 24 first, the steps st5, st6, and st7 may be preceded, and the credit card 22 and the card-type storage medium 24 are integrated. In this case, the process may be performed at the same time, and similarly to the general case, the step of inputting the password of the credit card 22 may be additionally performed before generating the approval request.

Next, the bansa 40 aggregates the authorization request by each credit card company 50 and transmits the request to the credit card company 50, and transmits the authentication request to the authorized certification authority 60. (st8)

At this time, the official certification authority 60 may be connected to the bansa 40, but may also be connected to the credit card company 50, in the latter case, the authentication request through the credit card company 50, the authorized certification authority 60 Is sent to. In contrast, the bansa 40 or the credit card company 50 may act as an accredited certification body 60, the authentication request is transmitted to the authority capable of authentication.

Subsequently, the credit card company 50 determines whether to approve or reject the transaction based on the previously stored member credit information and merchant sales information, and notifies the company of the approval number as a result of the approval request. (St9, st10) and The accredited certification authority 60 verifies the authentication request with the public key corresponding to the private key, confirms that it is electronically signed with the secret key of the member 20, and transmits the result of the authentication request to the bansa 40. (st11, st12) )

Subsequently, the bansa 40 relays the approval request result and the authentication request result to the card inquiry terminal 32 of the affiliate store 30, respectively, in which case the bansa 40 is not processed normally. ) Can be re-transmitted to the relevant authority to check and verify a number of times, and the final approval request result and the authentication request result are relayed to the terminal 32 of the corresponding affiliate store 30 (st13).

Then, the member 20 checks the approval request result and the authentication request result displayed on the card inquiry terminal 32 of each affiliate store 30, and completes the transaction. (St14, st15).

In this case, the slip in the credit card transaction approval method according to the present invention is not essential, and can be omitted depending on the purpose because it can be authenticated through a certificate and a password.

In addition, the authorization method for the face-to-face credit card transaction according to the present invention can be modified somewhat, Figure 6 is a flow chart showing this in order as described with reference to Figs.

As described above, the member 20 having the first credit card 22 and the card-type storage medium 24 visits the affiliated store 30 to purchase the goods or services. Begin by presenting the storage media 24, respectively (st1 ').

Subsequently, the affiliate store 30 queries the card type storage medium 24 with the card inquiry terminal 32 and inputs a password unique to the member 20. Accordingly, the operation unit 35 of the card inquiry terminal 3 is predetermined. After generating the hashed authentication request, attach the digital signature based on the private key (st2 ', st3', st4 ').

And the authentication request is transmitted to the authorized certification authority 60 through the bansa (40). (St5)

Accordingly, the accredited certification authority 60 returns the result of the authentication request for the authentication request to the bansa 40 through the same process as mentioned above, and the bansa 40 goes to the card inquiry terminal 32 of the affiliate store 30. Through this, the affiliated store 30 can confirm that the credit card holder is a member. (St6 ', st7', st8 ', st9', st10 ')

Next, the affiliate store 30 searches the credit card 22 with the card inquiry terminal 32, reads the serial number and the unique data of the credit card of the expiration date, and then purchases the purchase price for the goods or services that the member 20 intends to purchase. Enter the transaction details, such as installment month and installment month. (St11 ', st12')

And the calculation unit 25 of the card inquiry terminal 32 generates an authorization request based on the card-specific data and transaction history and transmits it to the credit card company 50 through the bansa 40, the credit card company 50 is the authorization request Return the result to bansa 40. (st13 ', st14', st15 ', st16')

Next, the bansa 40 relays it and transmits it to the card inquiry terminal 32 of the affiliate store 30, and the member checks the result of the approval request indicated by the card inquiry terminal 32 and then completes the transaction. (st17 ', st18', st19 ')

In this case, as compared with FIG. 5, the authentication of the credit card member is preceded. In the case where the credit card 22 and the card-type storage medium 24 are integrated, each of these inquiry points is the same but st2 'to st10' After the step is preceded, the steps st11 'to st19' are performed. As the credit card holder authenticates the member and proceeds with the approval of the credit card, a safer transaction can be performed.

In this case, the slip can be omitted.

The system and method for approving a credit card transaction according to the present invention as described above is characterized in that it receives a personal certificate using an official certificate embedded in a card-type storage medium possessed by a member in a daily face-to-face transaction. It is possible to authenticate by using a series of numbers, letters or fingerprints that only the member can know or possess. Therefore, unlike existing handwritten signatures, there is a very low possibility of forgery and alteration. Therefore, a more secure face-to-face credit transaction is possible. In particular, there is an advantage that the time required for credit card transactions can be shortened because no additional identity verification procedure such as a handwritten signature is required in addition to the input of a password.

In addition, when using the credit card transaction approval system and method according to the present invention, it is possible to omit the slip required for identity verification, and thus there is an advantage that can solve various problems caused by the output of the slip.

1 is a system configuration for approval of a general credit card transaction.

2 is a system configuration for the approval of credit card transactions according to the present invention.

Figure 3 is a block diagram of a card-type storage medium with a built-in certificate in accordance with the present invention.

4 is a block diagram of an inquiry terminal capable of reading a card-type storage medium having a built-in public certificate according to the present invention.

Figure 5 is a flow chart for a method of authorizing a credit card transaction according to the present invention.

Figure 6 is a flow chart for another authorization method of credit card transactions in accordance with the present invention.

<Description of the symbols for the main parts of the drawings>

20: Member 22: Credit Card

24: card-type storage medium 25: central processing unit

26: Romans 27: Ram

28: Y pyrom 29: application module

30: Merchant 32: Card inquiry terminal

33: card reader 34: input

35: calculation unit 36: data communication unit

37: display unit 40: bansa

42: web server 44: database

50: credit card company 60: certificate authority

Claims (7)

Using a credit card 22 having a serial number and card-specific data with an expiration date, an authorized certificate including a public key and an electronic signature, and a card-type storage medium 24 having a private key corresponding to the public key. As a credit card transaction authorization system, A card reader unit 33 provided in the affiliated store 30 for inquiring the credit card 22 and the card-type storage medium 24, the credit card transaction history of the purchase amount and the installment month, and the activation of the private key. An input unit 34 for inputting a password, an operation unit 35 for generating an authentication request based on the card-specific data and credit card transaction history, and an authentication request with an electronic signature based on the private and public keys; A card inquiry terminal 32 including a data communication unit 36 connected to an external wired and wireless communication network to enable communication, and a display unit 37 for displaying the result of the data communication to the outside; A bansa 40 connected to the wired / wireless communication network to relay the approval request and the authentication request; The credit card company 50 is connected to the bansa 40 and returns an authorization request result for the authorization request, and is connected to the bansa 40 or the credit card company 50 and returns an authentication request result for the authentication request. Authorization system for credit card transactions, comprising a public certification body (60). The method of claim 1, The computing unit (35) includes a hashing algorithm for encryption and decryption of a public key infrastructure, wherein the authentication request is hashed according to a predetermined rule. The method of claim 1, The card-type storage medium 24 is a credit card transaction approval system, characterized in that the smart card. The method of claim 3, wherein The credit card transaction approval system, characterized in that the card-type storage medium (24) is integral with the credit card (22). The method of claim 1, The password is a combination of a number and a letter or a fingerprint of the credit card member, and the input unit 34 includes a plurality of buttons and a fingerprint recognition device each of which has been assigned a letter or number. . As a method of authorizing a credit card transaction using the credit card transaction authorization system of claim 1, a) generating an authorization request by inquiring the credit card with the card inquiry terminal and inputting a purchase amount and an installment transaction history; b) querying the card-type storage medium with the card inquiry terminal and inputting a password for activating the private key to generate a decrypted authentication request; c) transmitting the approval request and the authentication request to the bansa; b) returning the approval request result and the authentication request result after the approval request and the authentication request are relayed from the bansa to the credit card company and the authorized certification authority; e) a method of approving a credit card transaction comprising the step of transmitting the approval request result and the authentication request result to the card inquiry terminal to complete the approval. As a method of authorizing a credit card transaction using the credit card transaction authorization system of claim 1, a) querying the storage medium with the card inquiry terminal and inputting a password for activating the private key to generate a hashed authentication request; b) transmitting the authentication request to the authorized certification authority through the bansa, and receiving an authentication request result from the certified certification authority through the bansa; c) generating an authorization request by inquiring the credit card using the card inquiry terminal and inputting a purchase amount and a transaction history of an installment month; d) transmitting the authorization request to the credit card company through the bansa, and receiving an authorization request result from the credit card company through the bansa; e) a method of authorizing a credit card transaction, comprising the step of completing the authorization based on the result of the authentication request and the result of the authorization request.