JP6840861B2 - How to generate and dispose of dynamic virtual cards - Google Patents

Description

The present invention relates to a method for generating and discarding a dynamic virtual card in which a card provided as hardware is provided as a virtual card and the virtual card is dynamically generated and discarded. In particular, the present invention relates to a method of distributedly installing virtual card flat forms for the dynamic virtual card on a server and a mobile device.

Mobile cards are used for transportation cards, payment of goods and services, identification, and point accumulation and use. In general, for cards used as payment payment instruments, independent security devices (eg, USIM, IC Chip) are used for the purpose of preventing plagiarism through modification or duplication.

FIG. 1 is a diagram illustrating a conventional mobile card service.

An independent security device (for example, USIM, IC chip, H / W Payment-Based Card) 10 is a card flat form (Chip Operation System) that is an operating system of the security device and plays a role of security and application management. It is divided into 12 layers and 11 layers of a payment application (Payment App) that stores payment payment information and performs payment transactions with a payment terminal (= charge / payment device) 20. The payment application 11 performed by the card flat form 12 of the security device 10 is generally guaranteed to be secure.

According to the conventional mobile card service, the security device 10 is installed in a mobile device such as a smartphone. The mobile device and the security device are operated by an operating system that is separated from each other, and a user application that is separated from each other is installed in the mobile device and the security device.

According to the conventional mobile card service, the payment application 11 is installed in the security device 10 attached to the mobile device, and the transaction authentication calculated through the data stored locally in the payment application 11 and the security key. The transaction is carried out through the process of transmitting the code to the terminal application.

That is, the financial card can be issued by the payment application 11 receiving static data (static data) from a payment management server (not shown) existing on the network and storing it. When the payment application 11 receives a transaction request from the payment terminal 20, the payment application 11 performs a transaction using the stored static data, and stores the transaction history information in the storage of the payment application 11 if necessary. The issued financial card can be used in. At this time, the issued payment application 11 is used for payment or charge transaction in an offline form that is not linked to the payment management server.

When the payment application 11 is installed in the physical security device 10 described above and used as a card medium, there are the following problems.

First, in order to install a payment application on a card to which an independent security device is applied, for example, an IC card, and store the installed payment application payment information, the owner of the IC card (for example, communication) is usually used. There should be a business agreement between the company) and the provider of the payment application. Then, the provider of the payment application is generally delegated the technical authority of the physical security device by the owner of the IC card. Such a business agreement procedure has a business problem that the provider of the payment application must be subordinate to the owner (communication company) of the IC card in order to spread the service provided by the provider. There is.

In addition, since the physical security device has a small memory space, the types of applications that can be installed are limited.

In addition, the physical security device has a structure that does not have its own network function. Therefore, as described above, since the payment application once issued is used for payment or charge transaction in an offline form that is not connected to the payment management server, it is difficult to control the lost or stolen IC card. That is, the lost or stolen IC card can be used independently without the control of the management server, and there is a risk of theft.

The present invention provides a method for generating a dynamic virtual card capable of plagiarism prevention, application management, and control of loss / theft so that it is not necessary to use an independent security medium in order to solve the above-mentioned problems. To do.

More specifically, an attempt is made to provide a method of distributing and installing a dynamic virtual card flat form including a plurality of functional modules by using a plurality of devices (for example, a server and a mobile terminal) capable of mutual communication. In other words, a dynamic virtual card flat form that works effectively on a mobile device is dynamically generated and discarded on a separate server, and the server and mobile device organically judge whether it is valid or not, and the mobile device and server When a dynamic virtual card flat flatform between and is generated, it attempts to drive a card application or provide a way to discard the dynamically generated flatform.

According to one aspect of the present invention, a method is provided in which dynamic virtual card flat forms including a plurality of functional modules are distributed and installed by using a plurality of devices capable of mutual communication. The method includes a flat form update step in which the first apparatus updates a first functional module constituting a dynamic virtual card flat form that operates effectively, and a second functional module related to the first functional module. A flat form in which the first device stores the updated first function module in the first device and provides a remote security module with only the second function module of the first function module and the second function module. Includes distributed installation steps and.

At this time, the first functional module includes an ISD module, and the second functional module includes an APSD module.

At this time, before the flat form update step, the first device further includes a step of receiving a request for preparing a financial settlement from the third device, but the flat form update step receives each time the request is received. The third device and the security module communicate with each other.

At this time, the first device is a server, and the security module is a security device that communicates with the third device, or is a module embodied by software in the third device, and the flat foam distributed installation is performed. In the step, the second functional module is provided to the security module using wired or wireless communication between the first device and the third device.

According to one aspect of the present invention, a virtual card generation method for dynamically generating a virtual card by using a plurality of devices capable of mutual communication is provided. In the dynamic virtual card generation method, the first apparatus updates a first functional module constituting a dynamic virtual card flat form that operates effectively, and a second functional module related to the first functional module. In the update step, the first device stores the updated first function module in the first device, and only the second function module of the first function module and the second function module is stored in the remote security module. Update the value storage module that constitutes the dynamic virtual payment application in which the first device operates on the dynamic virtual card flat form, and the relay module related to the value storage module. The payment application update step, and the payment application distributed installation step in which the first device stores the updated value storage module only in the first device and provides the security module with the updated relay module. including. At this time, the relay module has a function of relaying the third device communicating with the security module so as to perform a payment transaction by using the financial value stored in the value storage module.

At this time, when the payment transaction is performed, the payment transaction is performed in order to invalidate the virtual card defined by the updated dynamic virtual card flat form and the updated payment application. The updated dynamic virtual card flat form is now disabled.

At this time, prior to the flat form update step and the payment application update step, the first device further includes a step of receiving a request for preparing financial settlement from the third device, and the flat form update step and the payment application update step. The payment application update step is performed each time the request is received.

At this time, the payment application update step includes a step of dividing the updated relay module into a plurality of segments, a step of generating an electronic signature value from the plurality of segments, and one of the plurality of segments. The payment application distributed installation step includes the step of encrypting using the above key (key) and the step of scrambling the encrypted plurality of segments, and the payment application distributed installation step secures the scrambled information. The one or more keys and the electronic signature value are provided to the security module, including the steps provided to the module.

At this time, the security module performs a step of descrambled the scrambled information, a step of decoding the descrambled information using the one or more keys, and the decoded information. The feature is that the step of verifying by using the electronic signature value and the step of installing the relay module in the security module by using the verified and decoded information are performed. To do.

According to one aspect of the present invention, a server is provided which uses a plurality of devices capable of mutual communication and distributes and installs dynamic virtual card flat forms including a plurality of functional modules. The server performs a flat form update step for updating a first functional module that constitutes a dynamically operating dynamic virtual card flat form and a second functional module related to the first functional module. To perform a flat-form distributed installation step in which the updated first functional module is stored in the server and the remote security module is provided with only the second functional module of the first functional module and the second functional module. It has become.

At this time, the first functional module includes an ISD module, and the second functional module includes an APSD module.

At this time, prior to the flat form update step, the server further performs a step of receiving a request for preparing a financial settlement from the third device, and the flat form update step receives the request. The third device and the security module are designed to communicate with each other.

According to the present invention, the dynamic virtual card flat form can be distributed and provided to a server and a user's mobile device capable of communicating with the server. Thereby, it is possible to provide a dynamic virtual card that uses a server (= cloud) -based dynamic virtual card flat form. By controlling the dynamic virtual card in real time, it is possible to prevent card modification, duplication, and theft.

Further, the application installed on the dynamic virtual card flat form can be easily managed through the present invention, and applications for various purposes can be easily installed.

In addition, the application data for the dynamic virtual card can be freely updated via the network. In addition, the dependency between the owner of the physical security device and the provider of the application installed on the dynamic virtual card flat form can be removed.

It is a figure for demonstrating the conventional mobile card service. It is a figure explaining the mobile card service by one Example of this invention. It is a sequence diagram which provides the mobile card service by one Example of this invention. It is a figure which embodies the embodiment of FIG. It is a sequence diagram which shows the step performed after updating the relay module in the cloud server by one Embodiment of this invention. It is a sequence diagram which shows the process performed when the relay module is received by the mobile device by one Example of this invention.

Hereinafter, the drawings will be described with reference to the drawings to which the embodiments of the present invention are attached. However, the present invention is not limited to the examples described herein, and may be embodied in various other forms. The terms used herein are intended to aid in the understanding of the examples and are not intended to limit the scope of the invention. The singular form used below also includes multiple forms unless the phrase has a clear opposite meaning.

FIG. 2 is a diagram illustrating a mobile card service according to an embodiment of the present invention.

Here, the mobile card service is, for example, a service in which a financial card is virtually provided to a mobile device such as a smartphone, and the financial card and the mobile device cooperate with each other to charge / pay using the financial card. Say. At this time, in the mobile device, one of the separate charge / payment devices starts a request for a financial act to the other one, and the other one responds to the request to perform the mobile card service.

A system for providing a mobile card service according to an embodiment of the present invention includes a charge / payment device 20, a cloud server 30, and a mobile device 40.

At this time, the mobile device 40 includes an operating system for the mobile device 40 and a UX / UI application 41 executed on the operating system.

A security module 42 is installed in the mobile device 40.

At this time, the mobile device 40 and the security module 42 are computing devices that are independent of each other. In this case, the security module may be provided by using a conventional SE (Secure Element).

Alternatively, the security module 42 may be a module executed as software in the mobile device 40.

The UX / UI application 41 is, for example, an application used by a user of the mobile device 40 to actually make a payment via the mobile device.

In FIG. 1, the above-mentioned payment application 11 and card flat form 12 are distributed and located in a cloud server 30 and a security module 42 as shown in FIG. That is, conventionally, the payment application 11 is installed only in the security module 42, whereas in the present invention, the payment application 11 is divided into a cloud server 30 and a security module 42 into a value storage module 32 and a relay module 52, respectively. Will be installed.

According to the present invention, since the conventional card flat form is divided and installed in a plurality of devices (server and mobile device) via a network, the card flat form according to the present invention is referred to as a "dynamic virtual card flat form". Is called. In one embodiment of the present invention, since the dynamic virtual card flat form is updated every time a financial transaction request is made, it is referred to as a "dynamic virtual card flat form".

Further, conventionally, the card flat form 12 is installed only in the security module 42, whereas in the present invention, the dynamic virtual card flat form 12 is disassembled into the first function module 31 and the second function module 51. Provided, the first function module 31 and the second function module 51 are distributed and installed in the cloud server 30 and the security module 42, respectively.

The dynamic virtual card 1 is formed by combining the payment application 11 and the dynamic virtual card flat form 12. Since the payment application 11 is also divided and installed in a plurality of devices (server and mobile device) via a network, the payment application according to the present invention is referred to as a "dynamic virtual payment application". In one embodiment of the present invention, the dynamic virtual payment application is referred to as a "dynamic virtual payment application" because it is updated every time there is a financial transaction request.

In the embodiment of FIG. 2, the cloud server 30 and the mobile device 40 are connected to each other via a network and exchange information.

When making a payment via the charge / payment device 20, the payment is made using the value storage module 31 stored in the cloud server 30, and at this time, the relay module 51 stores in the value storage module 31. It functions to relay payment transactions with the charge / payment device 20 using the financial value.

At this time, the mobile device 40 plays a role of assisting the data exchange between the security module 42 and the cloud server 30, and assisting the data exchange between the charge / payment device 20 and the security module 42. For example, the UX / UI APP 41 may be provided by a person who provides the dynamic virtual payment application 11.

The actual financial transaction is performed between the dynamic virtual card 1 and the charge / payment device 20, and the mobile device 40 provides a communication function or the like for the financial transaction.

At this time, the first functional module 32 includes, for example, an ISD (Issuer Security Domine), and the second functional module 52 includes, for example, APSD (Application Provider Security Domine), CASD (Certificate Authority Technology), and CASD (Certificate Authority Technology). (User Authentication Framework) is included.

FIG. 3 is a sequence diagram for providing a mobile card service according to an embodiment of the present invention.

In step S10, the UI application 41 of the mobile device 40 requests the cloud server 30 to prepare for financial settlement. Various functions of the UI application 41 are activated by the user of the mobile device 40 via the user interface of the mobile device 40.

The request for financial settlement preparation is triggered by, for example, the act of the user of the mobile device 40 approaching the charge / payment device 20 activating the UI application 41 for financial settlement.

In step S20, the cloud server 40 updates the first functional module constituting the dynamic virtual card flat form 12 that operates effectively, and the second functional module related to the first functional module. When the first function module and the second function module are updated, the dynamic virtual card flat form 12 defined by the first function module and the second function module is updated.

In this way, the dynamic virtual card flat form 12 is updated every time the UI application 41 requests the preparation of financial settlement.

In step S30, the cloud server 40 stores the updated first functional module in the cloud server 30.

In step S31, the cloud server 40 transmits the updated second function module to the security module 42 of the mobile device 40 via the wireless network. In this process, the mobile device 40 provides a wireless network communication function for the security module 42.

In step S40, the cloud server 40 updates the value storage module 31 constituting the dynamic virtual payment application 11 operating on the dynamic virtual card flat form 12, and the relay module 51 related to the value storage module. For example, the value storage module may be a cloud T-money TM, and the relay module may be a T-money agent TM.

When the value storage module 31 and the relay module 51 are updated, the dynamic virtual payment application 11 defined by the value storage module 31 and the relay module 51 is updated.

In this way, the dynamic virtual payment application 11 is updated every time the UI application 51 requests the preparation of financial payment.

In step S50, the cloud server 40 transmits the updated relay module 51 to the security module 42 of the mobile device 40 via the wireless network. In this process, the mobile device 40 provides a wireless network communication function for the security module 42.

In step S60, the updated and provided relay module 51 is installed in the security module 42 of the mobile 40.

Here, after the user of the mobile device 40 approaching the charge / payment device 20 requests the financial settlement preparation, for example, a clerk who operates the charge / payment device 20 controls the charge / payment device 20. This induces a financial transaction between the dynamic virtual card and the charge / payment device 20. Alternatively, the financial transaction may be triggered by the dynamic virtual card, the UI application, or the mobile device 40.

In step S70, if the financial transaction is triggered, the consistency between the first functional module and the second functional module constituting the dynamic virtual card flat form 12 is verified, and the dynamic virtual payment application is performed. Verify the consistency between the value storage module and the relay module that make up the. The use of verifying integrity is that each time the card flat form and payment application are updated, the corresponding modules with different mapping values are dynamically generated in pairs.

The integrity verification is performed by the cloud server, the dynamic virtual card, or the UI application, so that communication between the mobile device 40 and the cloud server 30 is maintained.

The cloud server is physically embodied by one server or by a plurality of devices separated from each other.

In step S80, the dynamic virtual card makes a payment between the value storage module and the charge / payment device via the relay module.

If it is confirmed by the cloud server 30 that the payment has been completed successfully or the payment has failed in step S90, the cloud server 30 will be the updated first function module and value storage module of the cloud server 30. To remove.

If it is confirmed by the security module 42 that the payment has been completed successfully or the payment has failed in step S91, the security module 42 uses the updated second function module and relay module of the security module 42. Remove.

In one embodiment of the invention, all updated modules that make up the dynamic virtual card are discarded after a single payment transaction process that succeeds or fails. That is, every time the preparation for financial settlement is requested as in step S10, all the modules constituting the virtual card, that is, the dynamic virtual card is updated.

Then, the updated dynamic virtual card is removed after the payment transaction process is performed once as in steps S90 and S91. The above content dynamically generates a dynamic virtual card each time a financial settlement is requested (every time a card is requested), and the dynamic virtual card program ends when the transaction is completed. Means to do.

FIG. 4 is a diagram embodying the embodiment of FIG.

The cloud server 30 includes a service application server 35, a payment management unit (Payment Management) 36, and a dynamic virtual card flat form management unit (V-Card Platform Management) 37.

The mobile device 40 includes a UI application 41 and a security module 42. The UI application 41 is adapted to select types for transportation such as one-time tickets, commuter passes, cloud tee money, tee money pay, and mobile tee money. When the user of the mobile device subscribes to the service and / or selects the desired means of transportation, the UI application 41 sends a subscription to the service and / or a card activation request to the service application server of the cloud server 30.

When the service application server 35 receives, for example, a card activation request for cloud tea money, it requests the payment management unit 36 and the dynamic virtual card flat form management unit 37 to activate cloud tea money. Then, the payment management unit 36 and the dynamic virtual card flat form management unit 37 generate a dynamic virtual card. At this time, the cloud tea money 31 corresponding to the value storage module and the card flat form ISD module are stored in the server, and the tea money agent 51 corresponding to the relay module and the APSD, CASD, and UAF modules of the card flat form are the mobile device 40. It is stored in the security module 42. Upon receiving the activation request from the payment management unit 36 and the dynamic virtual flat form management unit 37, the payment management unit 36 creates an account (Account) and personalizes the T-money agent. Then, the dynamic virtual card flat form management unit 37 personalizes each security domain SD module and UAF module. The source code of the tea money agent, each security domain (APSD, CASD) module, and the UAF module is different for each mobile device, and is encrypted and scrambled and transmitted to the security device of the mobile device. At the time of execution of the application, the security device descrambles and decrypts the module encrypted and scrambled in the memory before using it for the transaction.

The cloud T-money 31, the T-money agent 51, which corresponds to the payment application, and the ISD, APSD, CASD, and UAF, which correspond to the card flat form, function as one virtual card 1.

At this time, the account and security information for generating the dynamic virtual card are stored in the cloud server, and the ID and non-security information for approaching the account are stored in the mobile device.

At this time, the T-money agent 51 is used to make a payment via the cloud T-money 31.

FIG. 5 is a sequence diagram showing steps performed after updating the relay module on the cloud server according to an embodiment of the present invention. That is, FIG. 5 is a sequence diagram showing a process performed between step S40 and step S51 of FIG.

Hereinafter, description will be made with reference to FIG.

In step S100, the updated relay module is divided into a plurality of segments.

In step S110, the electronic signature value is generated by using the plurality of segments.

In step S120, the plurality of segments are encrypted by using one or more keys.

In step S130, the encrypted plurality of segments are scrambled.

In step S140, the scrambled information, the information about one or more keys used, and the generated digital signature value are transmitted to the security module 42 of the mobile device 40.

FIG. 6 is a sequence diagram showing a process performed when a relay module is received by a mobile device according to an embodiment of the present invention. That is, FIG. 6 is a sequence diagram showing the process performed in step S60 of FIG.

Hereinafter, description will be made with reference to FIG.

In step S200, the security device receives the information scrambled to the cloud server, the information about one or more keys, and the digital signature value.

In step S210, the scrambled information is restored to the original arrangement.

In step S220, the restored descramble information is decrypted using the information related to the one or more keys.

In step S230, the information decoded by step S220 is verified by using the electronic signature value.

In step S240, the relay module is installed using the verified and decrypted information.

The dynamic virtual card flat form described in the present invention is an OS for the dynamic virtual card. The dynamic virtual payment application is an application program that operates on the dynamic virtual card flat form.

Utilizing the examples of the present invention described above, a person belonging to the technical field of the present invention should be able to easily make various changes and modifications without departing from the essential characteristics of the present invention. The content of each claim in the claims may be combined with other claims which are not cited within the scope of what can be understood through the present specification.

Claims (9)

This is a method of distributing and installing dynamic virtual card flat forms containing multiple functional modules using multiple devices capable of mutual communication.
A flat form update step in which the first device updates a first functional module constituting a dynamic virtual card flat form that operates effectively, and a second functional module related to the first functional module.
A flat in which the first device stores the updated first function module in the first device and provides a remote security module with only the second function module of the first function module and the second function module. Form distributed installation steps and
Distributed installation method of dynamic virtual card flat form including. The first functional module includes an ISD module.
The second function module is an APSD module.
The distributed installation method of the dynamic virtual card flat form according to claim 1. Prior to the flat form update step, the first apparatus further includes a step of receiving a request from the third apparatus to prepare a financial settlement.
The flat form update step is performed each time the request is received.
The distributed installation method of a dynamic virtual card flat form according to claim 1, wherein the third device and the security module communicate with each other. The first device is a server.
The security module is a security device that communicates with the third device, or is a module embodied by software in the third device.
The operation according to claim 3, wherein in the flat foam distributed installation step, the second functional module is provided to the security module by utilizing wired communication or wireless communication between the first device and the third device. Virtual card Flat form distributed installation method. It is a virtual card generation method that dynamically generates a virtual card using multiple devices capable of mutual communication.
A flat form update step in which the first device updates a first functional module constituting a dynamic virtual card flat form that operates effectively, and a second functional module related to the first functional module.
A flat in which the first device stores the updated first function module in the first device and provides a remote security module with only the second function module of the first function module and the second function module. Form distributed installation steps and
A payment application update step in which the first device updates a value storage module constituting a dynamic virtual payment application operating on the dynamic virtual card flat form, and a relay module related to the value storage module.
A payment application decentralized installation step in which the first device stores the updated value storage module only in the first device and provides the security module with the updated relay module.
Including
The relay module is a dynamic virtual card generation in which a third device communicating with the security module relays a payment transaction using the financial value stored in the value storage module. Method. When the payment transaction is made, the update is made to invalidate the virtual card defined by the updated dynamic virtual card flat form and the updated payment application. The dynamic virtual card generation method according to claim 5, wherein the dynamic virtual card flat form is invalidated. Prior to the flat form update step and the payment application update step, the first device further includes a step of receiving a request from the third device to prepare a financial payment.
The dynamic virtual card generation method according to claim 5, wherein the flat form update step and the payment application update step are performed each time the request is received. The payment application update step
The step of dividing the updated relay module into a plurality of segments, and
A step of generating a digital signature value from the plurality of segments,
A step of encrypting the plurality of segments using one or more keys, and
The step of scrambling the plurality of encrypted segments,
Including
The payment application decentralized installation step includes providing the scrambled information to the security module.
The dynamic virtual card generation method according to claim 5, wherein the one or more keys and the electronic signature value are provided to the security module. The security module
The steps to descramble the scrambled information,
The step of decrypting the descrambled information using the one or more keys, and
A step of verifying the decrypted information using the electronic signature value, and
The step of installing the relay module in the security module using the verified and decrypted information, and
The dynamic virtual card generation method according to claim 8, wherein the method is to be performed.