KR100479323B1 - A payment method based on credit card on a wireless internet - Google Patents

Abstract

The present invention relates to a credit card-based payment method on the wireless Internet that provides end-to-end security in the purchase of goods / services using the wireless internet. That is, the present invention solves the end-to-end security problem in the wireless Internet, and can be used in all wireless Internet protocols by performing an independent protocol that is not limited by a specific wireless internet protocol, and based on a credit card, There is an advantage in that even a large amount of payment is possible. In addition, the present invention uses a secret key establishment through public key-based encryption and a certificate issued by a trusted certificate authority to solve end-to-end security problem, mutual object authentication and information of credit card through the secret key and certificate The payment process is performed in the smart card that provides a stable module in the user's wireless terminal, and the security on the communication line can be handled through a secure session through a secret key. And secure online payments.

Description

Credit card-based payment method over wireless internet {A PAYMENT METHOD BASED ON CREDIT CARD ON A WIRELESS INTERNET}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to electronic commerce using wireless internet, and more particularly, to a credit card based payment method on wireless internet providing end-to-end security in purchasing online goods / services using wireless internet.

In general, a wireless payment protocol based on WAP (Wireless Application Protocol) has been proposed and used in electronic commerce using wireless Internet.

WAP provides security that was important in conventional e-commerce using WTLS (Wireless Transport Layer Security). WTLS is based on Secure Socket Layer (SSL) and Transport Layer Security (TLS), which are well known security mechanisms on the Internet. WTLS establishes a secure channel between two communicating applications to ensure the security of communications. It does not depend on a specific application as a method, and supports all applications using WAP.

However, the WAP-based payment protocol does not provide end-to-end security. In other words, WAP gateway that connects wired and wireless converts WTLS-protected data to SSL or WTLS-converted data to WTLS. There was a problem.

Accordingly, an object of the present invention is to solve end-to-end security problems, and to provide end-to-end security in the purchase of online products / services using the wireless Internet that can be used in any protocols such as WAP, ME, and I-Mode. The present invention provides a credit card-based payment method on wireless internet.

The present invention for achieving the above object is a credit card-based payment method for providing end-to-end security in the wireless Internet, end-to-end security in the user wireless terminal, payment gateway, product / service provider server connected to the wireless Internet network In a credit card-based payment method provided, (a) the user wireless terminal generates a random number and generates a temporary public key for key setting to provide a purchase request message composed of a service provider's identity and selected product or service information. Transmitting to the server; and (b) the service provider server generates a random number and generates a secret session key shared with the user, and hashes it with the service provider's identity, payment data, time stamp, and certificate of the service provider. Transmitting the configured purchase response message to the user wireless terminal, and (c) After generating a secret session key with a service provider server, the wireless terminal calculates a hash value to confirm a certificate of the service provider, authentication information including a hash value of the service provider information and a user certificate, and the selected product / service. Sending credit and payment information messages generated by signing credit and payment information, including payment data and credit card information, to the user's private key and encrypting the secret key between the user and the payment gateway to the service provider server; (d) The service provider server decrypts and encrypts the encrypted credit and payment information message, requests credit card payment processing for the payment requested product / service to a payment gateway, and sends the payment processing result to the user. It is characterized by including.

Hereinafter, with reference to the accompanying drawings will be described in detail the operation of the preferred embodiment according to the present invention.

1 illustrates a configuration of a credit card based payment system that provides end-to-end security in the wireless Internet according to an embodiment of the present invention.

Referring to FIG. 1, the credit card payment system using the wireless Internet of the present invention includes a user wireless terminal 100, a mobile gateway (MG) 102, and a value added service provider 104. , Payment Gateway (PG) 108, and Certificate Authority (CA) 106.

The user wireless terminal 100 displays a product / service transmitted from the service provider server 104 and performs payment for the user's purchase. The wireless terminal 100 executes a public key encryption algorithm and credit card information. It is equipped with a smart card with a built-in electronic wallet for safe storage. The mobile gateway 102 serves to connect the wired section and the wireless section. Unlike the WAP gateway participating in protocol conversion, the mobile gateway 102 performs only a message forwarding function.

The service provider server 104 is a merchandise sales server connected to the Internet, which provides merchandise information for sale to a corresponding user wireless terminal 100 connected through the wireless Internet, and provides credit card information provided for payment of merchandise value from a user. Receives and transmits to the payment gateway 108 to enable electronic payment.

The payment gateway 108 performs a function of approving / processing payments generated between a user and a service provider in association with a credit card company or a mobile communication company. The certification authority 106 is a key object of the public key-based authentication system, and is a system that manages the validity of the certificate when inquiring certificate registration issuance, and transmits / receives electronic documents through the Internet requiring security such as credit card payment. When receiving, by participating in the authentication process of the user and the service provider issuing a digital certificate for authenticating the user registered in the authentication system to provide a more stable electronic document transmission service through a trusted third party certificate.

Referring to the protocol performing procedure in the certification authority 106, first, the user accesses the service provider server 104 using the wireless terminal 100, selects a desired product / service, and requests authentication. If the user does not have a certificate or belongs to a different authentication domain from the service provider, the service provider makes an authentication request to the certification authority 106 and the certification authority 106 transmits an authentication response thereto.

Then, the service provider server 104 forms a secret key for transmitting payment information and establishes a secure communication session by performing authentication with a smart card installed in the user's wireless terminal 100. You can trust each other by performing mutual object authentication. At this time, the service provider requests credit card information from the user for payment of goods / services requested by the user.

Accordingly, the user encrypts the credit card information contained in the electronic wallet with the secret key between the user and the payment gateway 108 and transmits the credit card information to the service provider server 104. The service provider server 104 then requests payment processing from the payment gateway 108, whereby the payment gateway 108 performs payment processing with the credit card company, and then sends the service provider server 104 the result of the payment processing. And finally provide the product / service to the user.

On the other hand, the present invention uses a public key cryptographic algorithm and a key setting algorithm for user authentication in the certification authority 106. The public key cryptography system uses an elliptic curve cryptography system with a small number of bits and a fast calculation speed required for a wireless mobile communication environment, and the keying algorithm for setting a session key with each participant uses a Diffie-Hellman key setting method. do. Table 1 below summarizes the data elements included in the algorithm used in the present invention.

h () One-way hash function Sig _X () Sign the message using X's private key {} _K Encryption using session key (K) shared by X and Y ID _X Identity of X x X's private key g ^x X's public key K _XY Session key shared by X and Y CertChain (X, Y) Certificate chain generated to validate X and Y certificates TX Timestamp generated by X ch _data Payment (Transaction) Information card _data Credit card information cid _U User's unique identity for signing certificate cid _V Service Provider Unique Identity of the Certificate for Key Generation

At this time, each participant in the present invention needs an initialization process. That is, the user has a session key shared with the certification authority 106, the session key shared with the payment gateway 108, and the credit card information stored in the smart card of the user's wireless terminal 100 The information should be agreed in advance with the credit card company for use in a wireless environment. Also in the present invention, if a user does not have a certificate issued by the certification authority 106 or if the user and the service provider do not exist in the same domain, the certificate is issued through the online certification authority 106. However, if the user has a certificate, the certification authority 106 does not participate.

That is, the payment process of the present invention may be divided into two cases in which the online certification authority does not participate in the authentication process and the online certification authority participates in the authentication process. The operation control flow in the system in each case will now be described with reference to FIGS. 2 and 3.

First, FIG. 2 illustrates an operation control flow in a payment system when a user and a service provider exist in the same authentication domain or have a certificate according to an embodiment of the present invention. Hereinafter, an embodiment of the present invention will be described in detail with reference to FIGS. 1 and 2.

Operation of the control flow of FIG. 2 is initiated by a user connecting to a service provider server using a wireless terminal.

The user wireless terminal 100 generates a random number u (S200), calculates a temporary public key g ^u for key setting (S202), and identifies the identity ID _V of the service provider server 104 and the selected product. Or a purchase request message composed of the service information is transmitted to the service provider server 104 (S204).

Then, the service provider server 104 generates a random number (r) (S206), and share with the user using a temporary public key for setting the key of the user included in the service request message sent from the user wireless terminal 100 A session key K _UV = h ((g ^u ) ^v || r) is generated (S208). A hash value of the random number r generated in the above process, a hash value of the shared session key K _UV between the user and the service provider together with the identity ID _V of the service provider server 104, payment data (ch _data ), The purchase response message composed of the time stamp TV and the certificate Cert _V of the service provider server 104 received from the certification authority 106 transmitted by the user is transmitted to the user wireless terminal 100 (S210).

Accordingly, the user may generate a session key with the service provider and calculate a hash value (S212) to confirm the implicit key authentication with the service provider server 104 and the server object authentication of the service provider. Check (S214). The user then uses the user's public key (g ^u ), the service provider's public key (g ^v ) obtained from the service provider's certificate, the random number of the service provider (r), the identity of the service provider (ID _V ), and the time stamp received. (TV), signing the hash value of the received payment data (ch _data ) together using the user's private key (S216), and the secret key (K) between the user and the service provider together with the user's certificate (Cert _U ). _UV ) to encrypt. In addition, the user's identity (ID _U ), service provider's identity (ID _V ), time stamp (TU), payment data (ch _data ) and credit card information (card _data ) to be sent to payment gateway 108 together. The hashed value is signed by the user's private key (S216), and the secret value between the user and the payment gateway 108 together with the signature value, time stamp (TU), payment data (ch _data ), and credit card information (card _data ). An encrypted credit / payment information message for the selected product / service is generated by encrypting using the key K _UP (S218). In operation S220, the user transmits the credit / payment information message to the service provider server 104.

The service provider server 104 then decrypts the encrypted credit / payment information message sent from the user (S222) and verifies the signature using the user's public key (S224). You can also verify mutual entity authentication by checking for your own random number. The service provider server 104 then combines the user's identity (ID _U ), the service provider's identity (ID _V ), and payment data (ch _data ) together to request payment processing from payment gateway 108. A payment request message consisting of a message generated by encrypting the secret key between the 104 and the payment gateway 108 and a credit / payment information message received by the user is generated and transmitted to the payment gateway 108 (S226).

The payment gateway 108 then sends a payment processing request to the credit card company or mobile carrier and receives a response accordingly. At this time, if the payment processing request is correctly processed, the payment gateway 108 transmits a payment request approval message to the service provider server 104 and the user (S228). In this case, the payment request approval message may be transmitted through the service provider server 104 or through the mobile gateway 102 (S230). The message is a value signed by using a private key of the payment gateway 108, which hashes together the identity of the user who participated in the transaction (ID _U ), the time of payment processing (TP), and the transaction information (ch _data ). Becomes The message also provides the service provider and the user with the ability to avoid non-payment. When the above payment process is completed, the service provider provides the user with the product / service selected by the user.

3 illustrates an operation in an online payment system when a user does not have a certificate or when a user and a service provider belong to different authentication domains, that is, when an online certification authority participates in the authentication process. Control flow is shown. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1 and 3.

The control flow of FIG. 3 also begins by the user connecting to a service provider server using a wireless terminal.

The user wireless terminal 100 generates a random number u (S300) to generate a temporary public key (g ^u ) for key setting (S302), the temporary public key (g ^u ) and the secret key (K) of the certification authority. _UC ) consists of data ({ID _U } K _UC ) encrypted by the user's own identity (ID _U ), unique identity (ID _CA ) of the user's certificate authority (106), and data of goods or services. The purchase request message is transmitted to the service provider server 104 (S304).

The service provider server 104 then generates and authenticates an authentication request message including the user's public key (g ^u ), encrypted data ({ID _U } K _UC ), and his certificate (Cert _V ) received from the user. The transmission to the engine 106 (S306).

The certificate authority 106 then generates a timestamp (TCA) and certificate chain (CertChain (U, V)) {CertChain (V, U)} K _UC || CertChain (V, CA) for the service provider server 104. Message) consisting of the user's public key (g ^u ) for the user, the user's unique identity for the signing certificate (cid _U ), the service provider's unique identity for the key generation certificate (cid _V ), and a timestamp (TCA). The hash value is signed using the private key of the certificate authority 106 and the authentication approval message including the message encrypted using the private key K _UC with the user is transmitted to the service provider server 104 (S308). ).

Here, the certification authority 106 uses the service provider's certificate (Cert _V ) received from the service provider server 104 to allow the user to verify the public key of the service provider (CertChain (U, V)). It generates a certificate chain (CertChain (V, U)) and a certificate chain (CertChain (V, CA)) so that the service provider can verify the public key of the user and the certification authority is sent to the service provider. At this time, in order to prevent a malicious service provider retransmission attack, the certificate chain (CertChain (V, U)) is encrypted and transmitted using the session key with the user.

Then, the service provider server 104 generates a random number r (S310), and generates a session key K _UV using the temporary public key g ^u for setting a key included in the service request message. (S312). The hash of the session key (K _UV ), the random number (r), and the identity (ID _V ) together with the payment data (ch _data ), time stamp (TCA), and the authentication chain (CertChain (U, V)). ) And {Sig _CA {h (g ^u || cid _U || cid _V || TCA)}} K _UC partial message for the user of the certificate request response message sent from the certificate authority 106. The purchase response message configured to be transmitted is transmitted to the user (S314). In the above, the session key is generated by a method (K _UV = h ((g ^u ) ^v || r)) modified from the Diffie-Hellman key setting method.

Then, the user obtains the service provider's public key (g ^v ) through the authentication chain (CertChain (U, V)) (S316), calculates the session key (K _UV ) with the service provider using the hash value, and then uses the hash value. This is compared with the hash value received from the service provider (S318), through which the implicit key authentication with the service provider server 104 and the server entity authentication of the service provider can be confirmed. The user then has the user's public key (g ^u ), the service provider's public key (g ^v ), the service provider's random number (r), the service provider's identity (ID _V ), the received timestamp (TCA), and the payment received. The value hashed together with the data (ch _data ) is signed using the user's private key (S320), and the secret key (K _UC ) between the user and the certification authority 106, together with the secret key (K _UC ) between the user and the service provider. _UV ) to encrypt using (S322).

In addition, the user's identity (ID _U), a service provider identification (ID _V), timestamp (TU), payment data (ch _data) and payment sent to the gateway, credit card information (card _data) together in a hash value users signed with the private key, and select the encryption using the signature value and the time stamp (TU), payment data secret key (K _UP) between the user and the payment gateway with the (ch _data), credit card information (card _data) After generating an encrypted credit / payment information message for the product / service, and transmits it to the service provider server (S324).

The service provider server 104 then decrypts the encrypted credit / payment information message sent from the user (S326) and verifies the signature using the user's public key (S328). You can also verify mutual entity authentication by checking for your own random number. The service provider server 104 then combines the user's identity (ID _U ), the service provider's identity (ID _V ), and payment data (ch _data ) with the service provider to request payment processing from payment gateway 108. A payment request message consisting of a message generated by encrypting a secret key between payment gateways 108 and a credit / payment information message received by a user is generated and transmitted to the payment gateway 108 (S330).

The payment gateway 108 then sends a payment processing request to the credit card company or mobile carrier and receives a response accordingly. At this time, if the payment processing request is correctly processed, the payment gateway 108 transmits a payment request approval message to the service provider server 104 and the user (S332). In this case, the payment request approval message may be transmitted through the service provider server 104 or through the mobile gateway 102 (S334). The message is a value signed by using a private key of the payment gateway 108, which hashes together the identity of the user who participated in the transaction (ID _U ), the time of payment processing (TP), and the transaction information (ch _data ). Becomes The message also provides the service provider and the user with the ability to avoid non-payment. When the above payment process is completed, the service provider provides the user with the product / service selected by the user.

Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the invention should be determined by the claims rather than by the described embodiments.

As described above, the present invention solves the end-to-end security problem in the wireless Internet, and can be used in all wireless Internet protocols by performing an independent protocol that is not limited by a specific wireless internet protocol, and based on a credit card There is an advantage in that not only small payments but also large payments are possible.

In addition, the present invention uses a secret key establishment through public key-based encryption and a certificate issued by a trusted certificate authority to solve end-to-end security problem, mutual object authentication and information of credit card through the secret key and certificate The payment process is performed in the smart card that provides a stable module in the user's wireless terminal, and the security on the communication line can be handled through a secure session through a secret key. And secure online payments.

1 is a block diagram of a credit card-based payment system according to an embodiment of the present invention;

2 is a flowchart illustrating a credit card based payment processing on a wireless Internet according to an embodiment of the present invention;

3 is a flowchart of a credit card based payment processing on the wireless Internet according to another embodiment of the present invention.

Claims (30)

In a credit card-based payment method providing end-to-end security in a user wireless terminal, a payment gateway, and a product / service provider server connected to a wireless internet network, (a) the user wireless terminal generating a random number and generating a temporary public key for key setting to transmit a purchase request message composed of a service provider's identity and selected product or service information to a service provider server; (b) The service provider server generates a random number and generates a secret session key that is shared with the user. The purchase response message is composed of a hashed value and payment data, a timestamp, and a service provider's certificate. Transmitting to the terminal; (c) After generating a secret session key with the service provider server, the user wireless terminal calculates a hash value to confirm the certificate of the service provider, authentication information including a hash value of the service provider information and a user certificate, and the selected information. Transmitting to the service provider server a credit and payment information message generated by signing credit and payment information, including payment data for the goods / service, credit card information, with a user private key and encrypting it with a secret key between the user and the payment gateway; (d) the service provider server decrypts and encrypts the encrypted credit and payment information message, requests a credit card payment process for the payment requested product / service to a payment gateway, and sends the payment processing result to the user. Letting step Credit card-based payment method on the wireless Internet comprising a. The method of claim 1, In the step (c), the credit and payment information message is composed of authentication information and credit and payment information, wherein the authentication information includes a public key of a user, a public key of a service provider, a random number of a service provider, and a service provider. Sign the hash of the identity, timestamp, and payment data with the user's private key, encrypt the user's certificate with the secret key between the user and the service provider, and generate the user's identity and service provider. Sign the hash of the identity, timestamp, payment data and credit card information to be sent to the payment gateway with the user's private key, and the secret between the user and the payment gateway with the signature value, timestamp, payment data and credit card information. Credit card based payment method on the wireless Internet, characterized in that generated by encrypting with a key. The method of claim 1, In step (d), (d1) decrypting the credit payment request message with a secret key, verifying a signature with a user's public key, checking whether there is a random number, and confirming mutual entity authentication; (d2) The service provider server encrypts the user's identity, the service provider's identity, and the payment data together with the private key between the service provider and the payment gateway to request payment processing from the payment gateway, and the credit and payment received from the user. Generating and sending a payment request message consisting of the message to the payment gateway, (d3) When the payment processing request is successfully processed, the payment gateway sends a message signed with the payment gateway's private key as a payment request approval message, hashing the user's identity, the time when the payment processing was performed, and transaction information together. Credit card-based payment method on the wireless Internet comprising the step of. In a credit card based payment method providing end-to-end security in a credit card based payment system on a wireless Internet including a wireless terminal, a mobile gateway, a service provider server, a certificate authority, and a payment gateway, (a ') transmitting a purchase request message consisting of corresponding product / service information when there is a request for purchasing a product or service through the wireless Internet from a user; (b ') transmitting an authentication request message for requesting authentication of the wireless terminal user who has made a purchase request through a certification authority and transmitting an authentication response message including an authentication chain for performing authentication between the user and the service provider server; Steps, (c ') from the purchase request message, the service provider server transmitting a purchase response message including a secret session key with the generated user and the authentication chain and a partial message for the user of the authentication response message; (d ') encrypting and encrypting the service provider information, the authentication information including the user certificate, the payment data for the selected product / service, and the credit and payment information including the credit card information with a user private key Transmitting a credit and payment request message including the encrypted authentication information, credit and payment information, to a service provider server; (e ') requesting a payment gateway for credit card payment processing for the credit and payment requested goods / service, and transmitting the payment processing result to the corresponding user; Credit card based payment method on the wireless Internet comprising a. The method of claim 4, wherein In the purchase request message in the step (a '), the user wireless terminal generates a random number to generate a temporary public key for key setting, encrypts the user's identity using a secret key with a certification authority, and the user certification authority. Credit card-based payment method on the wireless Internet, characterized in that it comprises the unique identity of the goods and services. The method of claim 4, wherein In the step (b '), the service provider server (b'1) generates and transmits an authentication request message including a public key of the user, encrypted data received from the user, and certificate information of the service provider to the certification authority. Wow, (b'2) Certification chain 1 (CertChain (U, V)) that allows the user to verify the public key of the service provider from the certification authority and authentication that allows the service provider to verify the public key of the user and the certification authority. And receiving an authentication response message comprising chain 2 (CertChain (V, U)) and authentication chain 3 (CertChain (V, CA)). The method of claim 6, The authentication response message includes a hash of a timestamp for a service provider server, an authentication chain, a user's public key, a user's unique identity of a signing certificate, and a service provider's unique identity information of a key generation certificate as a private key of a certification authority. Credit card based payment method on the wireless Internet, characterized in that it comprises an encrypted message. The method of claim 6, The authentication chain 2 is a credit card-based payment method on the wireless Internet, characterized in that encrypted through a session key with the user to prevent a malicious service provider retransmission attack. The method of claim 4, wherein In the step (c '), the purchase response message includes a hash value of a session key, a random number, and an identity of a service provider generated using a temporary public key for user's key setting, payment data, time stamp, and authentication. And a message composed of chain 1 and partial message information for a user of the authentication response message. The method of claim 4, wherein In the step (d '), the credit and payment information message is composed of authentication information and credit and payment information, wherein the authentication information is a public key of a user, a public key of a service provider, a random number of a service provider, and a service. The identity, timestamp, and payment data of the provider are signed together with the user's private key and encrypted with the user's certificate with the private key between the user and the service provider. The credit and payment information is generated by the user's identity, service. Signed with the user's private key a hash of the provider's identity, timestamp, payment data and credit card information to be sent to the payment gateway, and between the user and the payment gateway along with the signature value, timestamp, payment data and credit card information. Credit card based payment method on the wireless Internet, characterized in that generated by encrypting with a secret key. The method of claim 4, wherein The step (e ') may include: (e'1) decrypting the credit payment request message with a secret key, verifying a signature with a user's public key, and confirming whether there is a random number thereof to verify mutual object authentication; , (e'2) The service provider server encrypts a user's identity, a service provider's identity, and payment data together with a secret key between the service provider and the payment gateway to request payment processing from the payment gateway, and credit received from the user. Generating a payment request message consisting of a payment message and transmitting the payment request message to a payment gateway; (e'3) When the payment processing request is successfully processed, the payment gateway may sign a message signed with the payment gateway's private key together with the user's identity, the time when the payment processing was performed, and transaction information. Credit card based payment method on the wireless Internet comprising the step of transmitting to. delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete delete