KR20100006004A - Autentification processing method and system using card, card terminal for authentification processing using card - Google Patents

Abstract

PURPOSE: An authentication process method, a system and a card terminal for authentication process using a card are provided to secure the face that a member possesses the card by generating an encryption card number. CONSTITUTION: A card number toward a card(500) of the members is read through a card terminal(100). The card terminal generates the encryption card number. The encryption card number is transmitted to an authentication processing server(200). The encryption card number is stored as the authentication information.

Description

Authentication processing method and system using a card, card terminal for authentication processing using a card {AUTENTIFICATION PROCESSING METHOD AND SYSTEM USING CARD, CARD TERMINAL FOR AUTHENTIFICATION PROCESSING USING CARD}

The present invention relates to an authentication processing method and system using a card terminal and an authentication processing server that can be connected to a card company through a network.

In recent years, due to the rapid development of information and communication technology and the proliferation of information and communication networks, electronic transactions such as Internet shopping, banking services, or electronic commerce and electronic payments between companies are actively progressing. It is difficult to determine and confirm the authenticity of the transaction and the authenticity of the transaction details.

In this regard, a method of authenticating a member by using a certificate is widely used. A certificate is a digital certificate issued by an authorized certificate authority and held by a member. , A unique number, a copy of the owner's public key, and the digital signature of the certificate issuer.

These certificates have a public key infrastructure (PKI) that uses asymmetric cryptography that can be encrypted and decrypted using a pair of corresponding public and private or secret keys. It is stored in a hard disk drive, floppy disk, or smart card of a computer so that it can be read using a computer or a dedicated reader with a private key known only to the member.

When the electronic payment is made, the authentication authority and the pair of public and private keys corresponding to each other are authenticated by an authentication request attached with a cryptographic and decryptable digital signature by a hashing algorithm of a predetermined rule. The possibility of third-party intervention is extremely low, allowing safe non-face-to-face transactions.

The process of electronic credit card transactions using a conventional accredited certificate authentication system is as follows.

In order to perform an electronic transaction using a credit card, a user first calls a corresponding public certificate, and inputs a public certificate password (private key).

If the public certificate password is verified as a normal password, personal information in the public certificate is passed to the public certification authority for certificate validation. At this time, if it is checked as a valid public certificate from the public certification body, it confirms that the holder of the public certificate. After it is confirmed that the holder is a certified certificate holder, the user enters the credit card number and transaction amount and completes the electronic transaction.

However, although the PKI-based security is guaranteed internally, the public certificate itself is stored in the secondary storage device in the form of a file, which has a vulnerability that can be easily copied by others. In addition, the number of the credit card also may be easily exposed.

Therefore, when the electronic transaction with a credit card using a public certificate, if only the password of the official certificate and the card number of the credit card is known, there is a problem that a transaction party who does not actually have a card can perform the electronic transaction.

In addition, even if the transaction party possesses a card of another person other than the person's name, there was a problem that the electronic transaction of the credit card is possible if he knows only the cardholder's official certificate password.

The present invention has been made to solve the above problems, an object of the present invention to provide an authentication processing method and system that can ensure that the payment party actually possessed a credit card in the course of electronic transactions using a credit card. Let it be technical problem.

Another object of the present invention is to provide an authentication processing method and system capable of assuring that a person holding a credit card is himself / herself in the electronic transaction process using a credit card.

According to an aspect of the present invention for achieving the above object is disclosed an authentication processing method using the card terminal 100 and the authentication processing server 200 that can be connected to the card company 300 through the network (400).

The authentication processing method according to the present invention is characterized in that the authentication is allowed to the authentication processing server 200 only when the member actually owns the card 500.

To this end, the authentication processing method according to the present invention comprises the steps of: (a) reading a card number for a card 500 of a member registered in the authentication processing server 200 through the card terminal 100; (b) generating an encryption card number by encrypting the card number in the card terminal 100 and transferring the encryption card number to the authentication processing server 200; (c) transferring the encryption card number from the authentication processing server 200 to the card company 300; (d) transferring a random number generated by the card company 300 corresponding to the encryption card number from the card company 300 to the authentication processing server 200; (e) matching the encryption card number and the random number and storing the authentication information in the authentication processing server 200 as an authentication information.

In addition, the step (a) further comprises the step of receiving the ID and password of the member, and in the step (b) is the authentication processing server 200 is the ID and password match the registered ID and password? By confirming further; it is possible to ensure that the party holding the card is the card holder.

In addition, in the step (b), the authentication processing server 200 decrypts the encryption card number to find out the original card number, and then confirms whether the card number is actually issued a card number. .

In addition, in step (d), the card company 300 transmits the time stamp generated as information of the time when the random number is generated from the card company 300 to the authentication processing server 200 together with the random number. In step (e), the time stamp may be stored in the authentication processing server 200 as authentication information together with the encryption card number and the random number.

In addition, in the step (d), the card company 300 may further include checking the validity of the original card number after determining the original card number by decoding the encryption card number.

On the other hand, according to another aspect of the present invention is disclosed an authentication processing system for allowing the authentication of the authentication processing server 200 only when the member actually has his card 500.

An authentication processing system according to the present invention comprises: a card terminal (100) for reading a card number of a member's card (500) and encrypting the card number to generate an encryption card number; The card company 300 transmits the encryption card number received from the card terminal 100 to the card company 300 through the network 400, and the card company 300 generates a random number generated in correspondence with the encryption card number by the card company 300. After receiving from, the authentication processing server 200 for matching and storing the encryption card number and the random number as authentication information; includes.

The authentication processing server 200, the card number processing unit 220 to find out the original card number by decrypting the encryption card number received from the card terminal 220 and confirm that the card number is actually issued card; The encryption card number received from the card terminal 100 is transmitted to the card company 400, and the card company 400 receives a random number generated corresponding to the encryption card number and then matches the encryption card number and the random number to one It may include; authentication information processing unit 230 for generating authentication information.

In addition, the authentication processing server 200 may further include an authentication DB 250 for storing the authentication information.

In addition, the card terminal 100 may receive the ID and password of the member registered in the authentication processing server 200, in this case, the authentication processing server 200 is a member received from the card terminal 100 If the ID and password of the match with the pre-registered member information and does not match, the personal information processing unit 210 for transmitting an error message to the card terminal 100 may be further included.

In addition, the authentication processing server 200 may further include a member DB (240) in which IDs, passwords, and card numbers of the members are stored in correspondence.

In addition, the card terminal 100, the card reader unit 110 for reading the card number for the card 500 of the member; An encryption processing unit 130 for generating an encryption card number by encrypting the card number read by the card reader unit 110 and transmitting it to the authentication processing server 200; And a data communication unit 140 for transmitting and receiving data between the authentication processing server 200 or the card company 300 connected to the network 400.

The card terminal 100 may further include a display unit 150 for displaying various information transmitted and received through the data communication unit 140 to a member.

The present invention has the following effects.

1. Since the encryption card number is generated by the encryption processing unit 130 provided in the card terminal 100, it is impossible to generate the encryption card number if only the card number is known and the card is not actually possessed. Therefore, the fact that the member actually holds the card in the process of logging in to the authentication processing server 200 is guaranteed.

2. During the login process, the ID and password input as well as the card reading is also requested, so that the user who logs in is actually a card holder or a member of the authentication processing server 200.

3. The encryption card number generated by the card terminal 100, the random number generated by the card company 300 and the time stamp together constitute authentication information, the authentication information is the authentication processing server 200 and the card company ( Since it is stored in the authentication DB (250, 340) provided in 300, respectively, once the authentication information is generated, the authentication information is prevented from being forged by the authentication processing server 200 or the card company 300.

That is, since the random number is generated separately by the card company 300 after the encryption card number is generated, the authentication processing server 200 is prevented from forgery of the encryption card number once the encryption card number is generated.

In addition, when the random number is generated, the time stamp at the time of generating the random number is also generated, so that once the random number is generated, the card company 300 cannot arbitrarily forge the random number.

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

1 is a block diagram of an authentication processing system according to the present invention.

Authentication processing The authentication processing server 200 of the present invention is capable of connecting to the card terminal 100 and the card company 300 through various wired and wireless networks (such as the Internet 400). In the following description, the card 500 is not limited to a credit card but a concept including all kinds of IC cards. That is, both a memory card that stores only data and a processor card that includes not only data storage but also a driving application. In addition, in the following description, the card company 300 is representative of the credit card company, but is not limited thereto, and includes any issuer that issued the card 500, such as a bank or a securities company.

1 schematically illustrates a process of authenticating a person using a credit card according to the present invention.

As shown, when the member reads the card 500 to the card terminal 100 and inputs an ID and password, the card terminal 100 encrypts the read card number and then authenticates the ID, password and encrypted card number. Send to server 200. The authentication processing server 200 checks the ID, password, and card number and transmits the encryption card number to the card company 300 when it is determined to be normal. After checking the validity of the card, the card company 300 generates a random number, stores the encryption card number and the random number, and transmits the generated random number to the authentication processing server 200. The authentication processing server 200 also stores the received random number along with the encryption card number and transmits a login permission message to the card terminal 100.

By the step of encrypting the card number in the card terminal 100 in the above process it is possible to ensure that the member actually possessed the card.

In addition, since the authentication processing server 200 and the card company 300 match the encryption card number and the random number with each other and share them as authentication information, either of the authentication processing server 200 or the card company 300 operates. Can monitor each other.

In addition, in the preferred embodiment, when the card company 300 generates a random number, a time stamp, which is time information at the time of generating the random number, may be generated and transmitted to the authentication processing server 200 together with the random number. The stability is even higher.

Hereinafter, each configuration will be described in detail with reference to FIGS. 2 to 4.

Card terminal (100)

2 is a detailed configuration diagram of the card terminal 100.

As shown, the card terminal 100 may be any terminal capable of transmitting and receiving data by connecting to the network 400, the card reader unit 110, input unit 120, encryption processing unit 130, data communication unit And a display unit 150.

Card reader unit 110 serves to read a variety of information, typically the card number stored in the card 500, and a magnetic stripe reader (MSR) that can read the card 500 of the magnetic card or smart card type and / Or an IC card slot or a smart card reader.

 The input unit 120 is a device for inputting a member's ID and password or a personal identification number (PIN), and may include a plurality of buttons to which unique numbers and letters are assigned. However, the input unit 120 is not limited to the button method and may be employed as various means for recognizing the personal identification information of the member. For example, the input unit 120 may be configured as a fingerprint recognition device capable of recognizing the fingerprint of the member.

The encryption processing unit 130 is a configuration for encrypting the card number of the card 500 read from the card reader unit 110. To this end, the encryption processing unit 130 has a built-in encryption algorithm, a public key infrastructure (PKI) encryption algorithm may be used as a representative, but the encryption method is not limited to this, and various methods may be employed.

As described above, since the encryption processing unit 130 encrypts the card number read by the card reader unit 110, the encryption card number is generated only when the member actually reads the card to the card reader unit 110. Therefore, it is guaranteed that the member possesses a physical card at the time of login.

The data communication unit 140 is a component for transmitting and receiving data between an external server connected to the network 400, for example, the authentication processing server 200 or the card company 300, such as a modem or a LAN card. It may be a communication interface device.

The display unit 150 is a component for displaying various information received from the card terminal 100 to a member, and may be a liquid crystal display device.

Authentication processing Authentication Processing Server (200)

3 is a detailed configuration diagram of an authentication processing authentication processing server 200 according to the present invention. As shown in the figure, the authentication processing server 200 includes a personal information processing unit 210, a card number processing unit 220, an authentication information processing unit 230, a member DB 240, and an authentication DB 250.

The personal information processing unit 210 determines whether the ID and password of the member received from the card terminal 100 match the registered member information, and if it does not match, transmits an error message to the card terminal 100. To this end, the member DB 240 to be described later is inquired and compared with the member ID and password transmitted from the card terminal 100.

The card number processing unit 220 decrypts the encryption card numbers N1 'and N2' received from the card terminal 220 to find out the original card numbers N1 and N2, and searches the member DB 240 for the card number. Is a card actually issued. If the card number (N1, N2) is a card number that is not registered in the member DB 240 after confirmation, an error message is transmitted to the card terminal (100). In order to decrypt the encryption card numbers N1 'and N2', the card number processing unit 220 may include an encryption algorithm such as a public key infrastructure (PKI).

The authentication information processing unit 230 is a configuration for generating authentication information for authenticating that the member has just logged in to the authentication processing server 200 using the card 500. The authentication information includes encryption card numbers N1 'and N2' generated by the card terminal 100, random numbers N1 " and N2 " generated by the card company, and time stamps (time information for generating random numbers). It is composed.

In order to generate the authentication information, the authentication information processing unit 230 transmits the encryption card numbers (N1 ', N2') received from the card terminal 100 to the card company 400, the card company 400 is encrypted card number (N1) After receiving the random numbers (N1 ", N2 ") and time stamps generated corresponding to ', N2'), one piece of authentication information is generated by matching the encryption card number, the random number, and the time stamp. The generated authentication information is stored in the authentication DB (250).

The member DB 240 stores IDs, passwords, and credit card numbers of members subscribed to the authentication processing server 200 in correspondence.

The authentication DB 250 stores the authentication information generated by the authentication information processor 230 described above. That is, the encryption card numbers N1 'and N2' generated by the card terminal 100, the random numbers N1 " and N2 " It is stored as one piece of authentication information. Preferably, after decrypting the encryption card number, the authentication information may be stored in association with the original card numbers N1 and N2.

Card company (300)

The card company 300 is a card company that has released an affiliate card in cooperation with the authentication processing server 200 of the present invention. When the affiliate card is issued to a member of the authentication processing server 200, the card issuer information is issued every predetermined time ( Daily or weekly). As a result, the authentication processing authentication processing server 200 enables real-time inquiry on the card issuance confirmation for the member.

4 shows a detailed configuration of the card company 300. The server of the card company 300 includes a card validity checker 310, a random number generator 320, a card DB 330, and an authentication DB 240. It is.

The card validity checker 310 decrypts the encryption card numbers N1 'and N2' received from the authentication processing server 200 to find the original card numbers N1 and N2, and then looks up the card DB 330. It is determined whether the expiration date of this card number has passed. If the validity period of the card number has passed after the determination, an error message is transmitted to the card terminal 100. In order to decrypt the encryption card numbers N1 'and N2', the card validity checker 310 may include an encryption algorithm such as a public key infrastructure (PKI).

The random number generator 320 generates random numbers N1 ″ and N2 ″ corresponding to the encryption card numbers N1 ′ and N2 ′ received from the authentication processing server 200. In addition, in the preferred embodiment, a time stamp indicating the time at which the random number is generated may be generated together with the random number generation. The time stamp preferably includes both the year, month, and time of the time when the random number is generated. However, the time stamp may include only the time (20:10:30, 23:15:10) as shown in FIG. 4 for simplicity.

In the card DB 330, when the affiliate credit card is issued to a member of the authentication processing server 200, the affiliate credit card issuing information, typically, a card number and an expiration date are stored.

In the authentication DB 340, the encryption card number received from the authentication processing server 200, the random number generated by the random number generation unit 320 and the time stamp which is time information at the time of generating the random number are corresponding to the authentication information. Is stored as.

The random number and time stamp are transmitted to the authentication processing server 200 and stored in the authentication DB 250, whereby the card company 300 can share the same authentication information as the authentication processing server 200. Here, since the card company 300 generates a random number corresponding to the encryption card number, once the authentication authentication processing server 200 generates the encryption card number for the card number logged in at a specific point in time, the forgery is prevented. In addition, since the card company 300 simultaneously generates a time stamp that is time information when the random number is generated when generating a random number, the card company 300 alone or the card company 300 and the authentication processing authentication processing server after generating the random number once. It is possible to prevent the 200 from arbitrarily forging random numbers by fixing them.

According to the above configuration, a method of authenticating using a credit card according to the present invention will be described with reference to the flowchart of FIG.

When the member reads the card 500 to the card reader unit 110 of the card terminal 100 and inputs the ID and password to the input unit 120 (S 100), the encryption processing unit 130 at the card reader unit 110 The encrypted card number N1 is encrypted to generate an encryption card number N1 '(S 110).

The card terminal 100 then transmits the ID, password, and encryption card number N1 ′ to the authentication processing server 200 (S 120).

The authentication processing server 200 checks the member DB 240 and checks whether the received ID and password match the actual member information (S 130).

As a result of the check, when the ID and password do not match the information of the member DB 240, an error message is transmitted to the card terminal 100. In this case, an error message may be displayed on the display unit provided in the card terminal 100 ( S 150).

On the contrary, if the ID and password match the information of the member DB 240, the authentication processing server 200 decrypts the received encryption card number, reads the original card number, and then searches the member DB 240 for the original. Check whether the card number is actually a card number issued to the member (S 140).

If the check result card number is not actually a card number issued to the member sends an error message to the card terminal (S 190), if the card number matches the card number of the member, the authentication processing server 200 is encrypted card The number is transmitted to the card company 300.

The card company 300 decrypts the received encryption card number, finds the original card number, and then checks whether the received card number is valid by querying the card DB 330 (S 160).

If it is determined that it is not valid, an error message is transmitted to the card terminal 100 (S 150).

On the other hand, if the card number is valid, a random number and a time stamp, which is the time information at which the random number was generated, are generated in response to the encryption card number, and the random number and time stamp are stored in the authentication DB 340 together with the encryption number ( S 170).

In addition, the generated random number and time stamp is transmitted to the authentication processing server 200 (S 180).

The authentication processing server 200 receiving the random number and the timestamp is matched with the encryption card number already held and stored in the authentication DB 250 as one authentication information (S 190) and the card terminal (100). Notify that the login is completed.

According to the above process, the encryption card number is generated only by the member actually reading the card to the card terminal 100 and as a result of the encryption processing performed by the encryption processing unit 230, so if only the card number is known, the encryption card number cannot be generated. Do. Therefore, the fact that the card is actually held in the process of logging in to the authentication processing server 200 is guaranteed.

In addition, since the login process requires ID and password input as well as card reading, it is guaranteed that the user who logs in is a member of the real card name or the authentication processing server 200.

In addition, the random number and time stamp generated by the card company 300 together with the encryption card number constitutes the authentication information, and the authentication information is provided in the authentication processing server 200 and the card company 300 by the authentication DBs 250 and 340. Are stored in each.

As such, since the random number is generated separately by the card company 300 after the encryption card number is generated, the authentication processing server 200 is prevented from forging the encryption card number once the encryption card number is generated. In addition, since the time stamp at the time of generation is generated together when the random number is generated, the card company 300 cannot arbitrarily arbitrarily randomize the random number once the random number is generated.

Although specific embodiments of the present invention have been described above, the spirit and scope of the present invention are not limited to the specific embodiments, and various modifications and changes can be made without departing from the spirit of the present invention. Those skilled in the art will understand.

Therefore, since the embodiments described above are provided to completely inform the scope of the invention to those skilled in the art, it should be understood that they are exemplary in all respects and not limited. The invention is only defined by the scope of the claims.

1 is a network configuration diagram of an authentication processing system according to the present invention.

2 is a detailed configuration diagram of a card terminal 100 according to the present invention.

3 is a detailed configuration diagram of an authentication processing authentication processing server 200 according to the present invention.

4 is a detailed configuration diagram of a card company 300 according to the present invention.

5 is a flowchart showing an authentication processing method according to the present invention.

<Description of main reference numerals in the drawings>

100: card terminal 110: card reader unit

120: input unit 130: encryption processing unit

140: data communication unit 150: display unit

200: authentication processing system 210: personal information processing unit

220: card number processing unit 230: authentication information processing unit

240: member DB 250: authentication DB

300: card company 310: card validity check unit

320: random number generator 330: card DB

340: authentication DB 400: network

500: card

Claims (13)

As an authentication processing method using a card terminal 100 and an authentication processing server 200 which can be connected to a card company 300 through a network 400, (a) reading the card number of the member's card 500 registered in the authentication processing server 200 through the card terminal 100; (b) generating an encryption card number by encrypting the card number in the card terminal 100 and transferring the encryption card number to the authentication processing server 200; (c) transferring the encryption card number from the authentication processing server 200 to the card company 300; (d) transferring a random number generated by the card company 300 corresponding to the encryption card number from the card company 300 to the authentication processing server 200; (e) matching the encryption card number and the random number and storing them in the authentication processing server 200 as authentication information; Including authentication, the authentication processing method using a card (500), characterized in that to allow authentication for the authentication processing server 200 only when the member actually owns the card (500). The method of claim 1, The step (a) further includes the step of receiving the ID and password of the member, Confirming, by the authentication processing server 200, whether the ID and password match a registered ID and password in step (b); Authentication processing method using a card (500), characterized in that it further comprises. The method of claim 1, In step (b), the authentication processing server 200 decrypts the encryption card number to find out the original card number, and then confirms whether the card number is a card number issued by killing; Authentication processing method using a card (500), characterized in that it further comprises. The method of claim 1, In step (d), the card company 300 transmits the time stamp generated as information at the time when the random number is generated from the card company 300 to the authentication processing server 200 together with the random number. In the step (e), the time stamp is also stored in the authentication processing server (200) as the authentication information together with the encryption card number and the random number. The method of claim 1, In step (d), the card company 300 decrypts the encryption card number to find the original card number, and then checks whether the original card number is valid. Authentication processing method using a card (500), characterized in that it further comprises. As an authentication processing system using the member's card 500, A card terminal 100 that reads a card number for the member's card 500 and encrypts the card number to generate an encryption card number; The card company 300 transmits the encryption card number received from the card terminal 100 to the card company 300 through the network 400, and the card company 300 generates a random number generated in correspondence with the encryption card number by the card company 300. After receiving from, the authentication processing server 200 for matching the encryption card number and the random number and stores as authentication information; Including an authentication processing system using a card (500), characterized in that for allowing the authentication of the authentication processing server 200 only when the member actually owns the card (500). The method of claim 6, wherein the authentication processing server 200, A card number processing unit 220 for deciphering the encryption card number received from the card terminal 220 to find out the original card number and confirming whether the card number is actually issued card; Delivering the encryption card number received from the card terminal 100 to the card company 400, receiving the random number generated by the card company 400 corresponding to the encryption card number and then matching the encryption card number and random number one Authentication information processing unit 230 for generating authentication information of; Authentication processing method using a card (500), characterized in that it comprises a. The method of claim 7, wherein the authentication processing server 200, Authentication DB (250) for storing the authentication information; Authentication processing system using a card (500), characterized in that it further comprises. The method of claim 6, The card terminal 100 receives the ID and password of the member registered in the authentication processing server 200, The authentication processing server 200 determines whether the ID and password of the member received from the card terminal 100 matches the registered member information and if it does not match, the individual who transmits an error message to the card terminal 100. Information processing unit 210; Authentication processing system using a card (500), characterized in that it further comprises. The method of claim 9, And a member DB (240) corresponding to the IDs, passwords, and possessed card numbers of the members. The authentication processing system using a card (500) further comprising: a member DB (240). According to claim 6, The card terminal 100, A card reader unit 110 for reading a card number of the card 500 of the member; An encryption processing unit 130 for generating an encryption card number by encrypting the card number read by the card reader unit 110 and transmitting it to the authentication processing server 200; A data communication unit 140 for transmitting and receiving data between the authentication processing server 200 or the card company 300 connected to the network 400; Authentication processing system using a card (500), characterized in that it comprises a. According to claim 6, The card terminal 100, And a display unit (150) for displaying the various information transmitted and received through the data communication unit (140) to the member. As a card terminal 100 that can be connected to the card company 300 and the authentication processing server 200 through the network 400 and the authentication processing using the card 500 of the member registered in the authentication processing server 200, A card reader unit 110 for reading a card number of the card 500 of the member; An encryption processing unit 130 for generating an encryption card number by encrypting the card number read by the card reader unit 110 and transmitting it to the authentication processing server 200; A data communication unit 140 for transmitting and receiving data between the authentication processing server 200 or the card company 300; Card terminal 100 for authentication processing using the card 500, characterized in that it comprises a.

Images