WO2009091158A2

WO2009091158A2 - Final confirmation system and method for trading in electronic commerce

Info

Publication number: WO2009091158A2
Application number: PCT/KR2009/000064
Authority: WO
Inventors: Byung-Ryul Lim
Original assignee: Sorinamoo Solution Co. Ltd.
Priority date: 2008-01-17
Filing date: 2009-01-07
Publication date: 2009-07-23
Also published as: KR20080012389A; WO2009091158A3

Abstract

This invention relates to a final confirmation system and a method for trading in electronic commerce which confirm trade details and securely transfer authorization of trade to an electronic commercial system when performing a financial trade, a stock exchange, an item trade, shopping etc. on the internet. The disclosed final confirmation system for trading in electronic commerce is characterized in that: in the final confirmation step of electronic commerce, an electronic commercial server (10) encodes summarized trade contents by using a security key shared with an auxiliary device (30) and transfers the encoded contents to the auxiliary device; the auxiliary device (30) decodes the encoded summarized trade contents and transfers the contents necessary for the final confirmation of trade to a user by outputting the decoded contents to an output unit; and a user transfers authorization of trade to the electronic commercial server (10) if the contents outputted to the output unit are identical to those of his/her actual trade.

Description

Transaction final confirmation system and method in e-commerce

The present invention relates to a transaction final confirmation system and method in electronic commerce to confirm transaction details and securely transmit transaction approvals to an electronic commerce system when performing financial transactions, stock transactions, shopping, item transactions, etc. over the Internet. .

There are many stages of hacking in e-commerce today, and there are many ways to prevent each stage of hacking. However, neither of these methods can provide security for modern hacking programs.

Representative final confirmation methods are as follows.

1. Encryption transmission method

A method of encrypting and transmitting data between an e-commerce server and a user's PC. This method is for security of a network communication network, and has a weak point for hacking at an input terminal (for example, a personal computer).

2. Secure keyboard input method

The secure keyboard input method is a method for preventing hacking by encrypting transaction data input by the user through an enhanced keyboard without using an existing keyboard of the user PC and transmitting it to the e-commerce server. However, this method has a disadvantage in that the hardware is large, the inconvenience of carrying, and the security keyboard manufacturing cost are high, which burdens the user and does not provide a method of safely checking the transaction contents.

3. Two-way input method

This is how a user performs final verification using a channel other than the Internet such as a landline phone or a mobile phone. This method is safe because it is difficult to hack two channels simultaneously. However, this method incurs new system and channel usage costs in order to use channels other than Internet channels.

4. Keyboard Security Methods (Anti-KeyLogger)

This method implements S / W function to encrypt keyboard input value and transmit it to PC or server to prevent keyboard hacking. It is a method that implements the existing security keyboard method in S / W and there is no H / W cost and provides convenience of installation. However, this method has a security problem that cannot prevent the latest hacking that attacks the keyboard security software itself.

Memory hacking, which has become a problem recently, is a method in which a hacker modifies user input information and causes damage. Many attempts have been made to solve this problem, but there is no solution that satisfies security, cost, portability, and user convenience.

An object of the present invention is to output the content of the final confirmation process in the e-commerce to the output of the auxiliary device, the final confirmation system from the e-commerce transaction that can disable the hacking by transmitting the final confirmation from the user to the e-commerce server and To provide a way.

In order to achieve the above object, the transaction final confirmation system in the electronic commerce according to the present invention encrypts the summary of the transaction with the security key shared by the electronic commerce server with the auxiliary device in the final confirmation step during the electronic commerce and delivers it to the auxiliary device. The auxiliary device decrypts the encrypted transaction summary and outputs it to the output unit to deliver the contents necessary for final confirmation of the transaction to the user. The user transmits a transaction confirmation to the e-commerce server when the output printed on the output matches the actual transaction. The transaction confirmation method may include selecting a confirmation button of an auxiliary device and inputting an authentication code value displayed on an output of the auxiliary device to a user PC.

In the method of selecting the confirmation button of the auxiliary device, the final confirmation input unit is present in the auxiliary device, and the authentication code input method shown in the output unit is the final confirmation input unit of the auxiliary device is present in the user PC.

In the present invention, the auxiliary device is a device for interworking with the user PC refers to a device for communicating with the user PC using a wired method such as USB, Serial, Parallel, 1394, and a wireless method such as Bluetooth, WLAN.

The auxiliary device includes a security key, an output unit, and a button. The security key of each auxiliary device is the same value as the security key of the auxiliary device having the same serial number among the security keys stored in the e-commerce server. The security key is used to encrypt and decrypt the data exchanged between the e-commerce server and the auxiliary device.

The output unit of the auxiliary device performs a function of outputting information transmitted from the e-commerce server. The output unit of the auxiliary device is a device that performs a function of visually transmitting the information to the user as LCD, LED, and the like.

The button of the auxiliary device is a device used to determine whether or not to confirm or proceed with the final confirmation content delivered to the auxiliary device by the e-commerce server. The button of the auxiliary device may be implemented as a push button or a touch screen button. Although the button has a confirmation cancel button, the button may not be required depending on the confirmation method among contents transmitted from the e-commerce server. If you do not use the buttons on the auxiliary device, the same function is performed through other input devices such as the keyboard of the user's PC.

The external structure of the auxiliary device is as follows. The first is when the auxiliary device consists of a PC connection terminal, an output and a button. The PC connection terminal is a part for interworking with a user PC, an output part is a part for outputting information, and a button is a part for receiving an input from a user.

An example of a transaction final confirmation method in the e-commerce according to the present invention is

Generating and encrypting the final confirmation information by the e-commerce server to the user PC;

Transmitting, by the user PC, the encrypted final confirmation information to the auxiliary device;

Decrypting the transmitted encrypted final confirmation information by the auxiliary device;

Outputting, by the auxiliary device, the final confirmation information encrypted;

The auxiliary device receives a final confirmation result from the user using a button;

The assistant encrypts the final verification result and forwards it to the user's PC;

Transmitting, by the user PC, the final encrypted result to the e-commerce server;

Decrypting the encrypted final confirmation result by the e-commerce server;

Characterized in that the e-commerce server is configured to complete the e-commerce according to the final confirmation result.

Another example of a transaction final confirmation method in an electronic commerce according to the present invention

Receiving, by the user PC, the authentication code value outputted from the user to the auxiliary device;

The user PC passes the verification code to the e-commerce server as the final verification result value;

Transaction final confirmation system and method in the electronic commerce according to the present invention increased the portability by using an auxiliary device that is easy to carry compared to similar security products (secure keyboard, etc.) composed of hardware, and encrypts the final confirmation information By transmitting to the auxiliary device and outputting it, the user has a high security by providing a method for checking whether the transaction has been tampered with by a hack or an error through a safe device for hacking. By doing so, it is possible to disable the latest hacking such as memory hacking, thereby increasing the safety of e-commerce and contributing to the vitalization of the market.

1 and 2 is an external structural diagram of two forms of the auxiliary device in the present invention

3 is a block diagram illustrating an example of a system for implementing a transaction final confirmation system and method in an electronic commerce in accordance with the present invention.

4 and 5 are block diagrams showing an auxiliary device in the present invention.

6 is a flowchart illustrating a system and method for confirming a transaction finalization in an electronic commerce according to the present invention.

7 is a flowchart illustrating another example of a system and method for confirming a transaction finalization in an electronic commerce according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings.

In the transaction final confirmation system in the electronic commerce according to the present invention, the external structure of the auxiliary device is of two types.

Referring to FIG. 1, the auxiliary device 30 includes a PC connection terminal 31a, an output unit 32a, and

buttons

33a and 33b. The PC connection terminal 31a is a part that performs a function of interworking with the user PC 20, the output unit 32a is a part where final confirmation information is output, and the

buttons

33a and 33b receive a final confirmation input from the user. This part performs the receiving function.

Referring to FIG. 2, the auxiliary device 30 includes a PC connection terminal 31a and an output unit 32a. The PC connection terminal 31a is a part that performs a function of interworking with the user PC 20, and the output unit 32a is a part where final confirmation information is output.

Referring to FIG. 3, the final confirmation system using the auxiliary device in the electronic commerce includes an electronic commerce server 10, a user PC 20, and an auxiliary device 30.

The e-commerce server 10 is a server that conducts transactions over the Internet. The e-commerce server 10 is composed of an auxiliary device security key DB 13, the final confirmation information transmission unit 11 and the final confirmation result receiving unit 12. The auxiliary device security key DB 13 manages a security key stored in the user's auxiliary device. The final confirmation information transmitting unit 11 performs a function of encrypting and delivering the final confirmation information to the user's auxiliary device. The final confirmation result receiving unit 12 receives a result of the final confirmation information from the user and performs a function of finishing the progress of the e-commerce.

The user PC 20 is composed of an information delivery unit 21 and a final confirmation result input unit 22.

The information transfer unit 21 performs a function of transferring data between the e-commerce server 10 and the auxiliary device 30. As a result of the final confirmation, the input unit 22 exists when the authentication code output to the output unit 32 of the auxiliary device 30 is used, and inputs the authentication code output to the output unit 32 of the auxiliary device 30. It performs the function of transmitting to the e-commerce server (10).

The auxiliary device 30 includes a security key storage unit 34, a final confirmation information receiving unit 31, an output unit 32, and a final confirmation result input unit 32. The security key storage unit 34 is a place where the security key shared with the e-commerce server 10 is stored. Data encryption and decryption are performed using this security key. The final confirmation information receiver 31 performs a function of receiving and decrypting the encrypted final confirmation information from the e-commerce server 10. The output unit 32 performs a function of outputting the final confirmation information decoded by the final confirmation information receiver 31. The final confirmation result input unit 33 is present when the confirmation result is input by the button of the auxiliary device 30, and the user who confirms the final confirmation information output to the output unit 32 selects the confirmation or cancellation button and then e-commerce. It performs the function of delivering the final confirmation information to the server (10).

The internal structure of the auxiliary device is of two types.

Referring to FIG. 4, the internal configuration of the auxiliary device 30 includes a PC interface 31, a CPU 35, a memory 36, a controller 37, an output unit 32, and a button 33. .

Referring to FIG. 5, the internal configuration of the auxiliary device 30 includes a PC interface 31, a CPU 35, a memory 36, a controller 37, and an output unit 32.

4 and 5, the PC Interface 31 performs a function of interworking with a PC and a wired method such as USB, Serial, Parallel, 1394 and a wireless method such as Bluetooth, wireless LAN. The CPU 35 performs an operation such as encryption / decryption. The memory 36 stores a security key. The controller 37 performs a function of controlling the output unit 32 and the button 33. The output unit 32 performs a function of outputting final confirmation information. The button 33 has a button for confirming and canceling when the user inputs the final confirmation information using the auxiliary device 30, and performs the function of generating the final confirmation information.

Referring to FIG. 6, the transaction final confirmation system and method in the electronic commerce according to the first embodiment of the present invention encrypts the final confirmation information after the electronic commerce server 10 proceeds to the final step of the electronic commerce. Do

The electronic commerce server 10 transmits the encrypted final confirmation information to the user PC 20.

The user PC 20 transmits the received encrypted final confirmation information to the auxiliary device 30.

The auxiliary device 30 decrypts the received encrypted final confirmation information.

The auxiliary device 30 outputs the final confirmation information to the output unit.

After that, the user sees the final confirmation information displayed on the output of the auxiliary device and presses the confirm button or the cancel button if it matches the content he wants to trade. The auxiliary device converts the input button value into the final confirmation result and encrypts the final confirmation result value.

The auxiliary device 30 transmits the encrypted final confirmation result value to the user PC 20.

The user PC 20 transmits the encrypted final confirmation result value to the e-commerce server 10.

The e-commerce server 10 decrypts after receiving the encrypted final confirmation result.

Thereafter, the e-commerce server 10 proceeds with the completion of the e-commerce according to the value.

Referring to FIG. 7, the transaction final confirmation system and method in the electronic commerce according to the second embodiment of the present invention encrypts the final confirmation information after the electronic commerce server proceeds to the final step of the electronic commerce.

When the user sees the final confirmation information output to the output unit of the auxiliary device 30 and matches the contents of his / her transaction, the user inputs the authentication code outputted to the output unit to the user PC 20.

The user PC 20 transmits the input final confirmation result value to the e-commerce server 10.

The e-commerce server 10 performs the completion process of the e-commerce according to the value of the received final confirmation result.

Claims

The e-commerce server 10 including the auxiliary device security key DB 13 generates and encrypts the e-commerce final confirmation information, and the auxiliary device 30 includes a CPU 35 and a memory 36 and an output unit. (32) and decrypts the received final confirmation information and outputs the final confirmation information to the output unit, and when the final confirmation result is input from the user, the corresponding value is transmitted to the e-commerce server to complete the e-commerce processing. Final confirmation system in the e-commerce, characterized in that the.
The method of claim 1,

The auxiliary device 30 and the user PC (20) is the final confirmation system in the electronic commerce, characterized in that using a wireless method such as USB, Serial, Parallel, 1394 wired and Bluetooth, wireless LAN.
The method of claim 1,

The external configuration of the auxiliary device 30 is the final confirmation system in the e-commerce, characterized in that it has an output unit (32) capable of visual output such as LCD or LED.
The method of claim 2 or 3,

The external configuration of the auxiliary device 30 is a final confirmation system in the e-commerce, characterized in that the user has a button for inputting the final confirmation result.
The method of claim 1,

Final assistance system in electronic commerce, characterized in that the auxiliary device 30 and the e-commerce server 10 has the same security key.
Generating and encrypting the final confirmation information by the electronic commerce server 10 to the user PC 20, and transmitting the final confirmation information by the user PC 20 to the auxiliary device 30. (30) decrypting the transmitted encrypted final confirmation information, and the auxiliary device 30 outputting the encrypted final confirmation information to the output unit 32, and the auxiliary device 30 uses a button from the user. Receiving a final confirmation result, the auxiliary device 30 encrypts the final confirmation result and transmits to the user PC 20, the user PC 20 transmits the encrypted final confirmation result to the e-commerce server 10 Final confirmation in the e-commerce, characterized in that the e-commerce server 10 decrypts the encrypted final confirmation result, the e-commerce server 10 completes the e-commerce according to the final confirmation result. Way.
The electronic commerce server 10 generates and encrypts the final confirmation information and transmits the final confirmation information to the user PC 20, and the user PC 20 delivers the encrypted final confirmation information to the auxiliary device 30. 30) decrypting the transmitted encrypted final confirmation information, the auxiliary device outputs the encrypted final confirmation information to the output unit 32, the user PC 20, the authentication code value output from the user to the auxiliary device Receiving the input step, the user PC 20 to pass the authentication code as the final confirmation result value to the e-commerce server 10, the e-commerce server 10 is configured to complete the e-commerce according to the final confirmation result Final confirmation method in the e-commerce, characterized in that.