KR101548933B1 - System for securiting mobile and method therefor - Google Patents

Abstract

The present invention relates to a system for authenticating a personal identification and a micropayment using a smart card authentication server and a method thereof, and more particularly, to a system and method for authenticating a micropayment using a smart card authentication server and receiving customer information including a mobile communication device identification information, A client that transmits the digits of digits of the resident registration number to the PG company server, receives the digits of the resident registration number received from the payment authentication application server in the form of PUSH, and receives the digits of the digits from the PG company server; If the client is a payment capable client by verifying the mobile communication device identification information and the mobile communication device identification information included in the customer information and the micropayment request information received from the client, the mobile communication device transmits the mobile communication device identification information and the mobile device identification number to the payment authentication application server, Receives the encrypted resident registration number and authentication confirmation completion information from the authentication app server, matches the back of the resident registration number received from the payment authentication application server and the resident registration number received from the client, and transmits the matching resident registration number to the authentication server A PG server for transmitting the micro settlement completion information received from the mobile communication company authentication server to the client; Transmits a request for inputting a back seat of a resident registration number to the client corresponding to the mobile communication device identification number and the mobile communication device identification information included in the customer information received from the PG company server in the form of PUSH to receive the back address of the resident registration number, To the smart card authentication server, receives the authentication confirmation completion information, encrypts the back address of the resident registration number received from the client and authentication confirmation completion information received from the smart card authentication server, and transmits the small payment request A billing authentication app server for transmitting to the PG company server together with the transaction number corresponding to the information; And a smart card that generates authentication completion information and transmits the information to the payment authentication application server when the stored user media information (USIM identification number or smart card identification number) matches the authentication confirmation request information received from the payment authentication application server And an authentication server.
According to the present invention, when a micropayment authentication using a mobile phone is performed, the front and back sides of the resident registration number are distinguished through the Legacy of the PG company via online or mobile, and it is transmitted through the smart card authentication server (HSM server) By performing channel authentication, it is possible to prevent illegal mobile phone settlement by payment authentication and personal authentication, thereby securing security.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a smart card authentication server,

The present invention relates to a system for authenticating a personal identification and a micropayment using a smart card authentication server and a method thereof. More particularly, the present invention relates to a system and method for authenticating a micropayment using a smart card provided in a USIM (including a smart card- By carrying out two-channel authentication through physical occupancy authentication between applet and smart card authentication server and PG server and smart card authentication server, illegal mobile phone settlement such as phishing or smsing accident is prevented in advance and messaging is sent And technology for securing cost reduction and security.

Although the present invention has been described with respect to a smart card authentication server-based mobile phone settlement authentication, its scope is up to the authentication service based on the smart card authentication server, and the process and the background technology are the same.

In the case of mobile financial transactions using smart phones, it is advantageous to carry out financial transaction conveniently and conveniently at any time, anywhere. It is also observed that mobile finance transactions using smartphones (smartphone banking) will outstrip financial transactions on existing PCs.

In recent years, regulations on the use of official certificates have been eased at the time of online banking (Internet banking), but in the future, the official certificates will be used as an important means of authenticating users in domestic online financial transactions.

Like a normal PC, a smartphone can be freely downloaded and installed by a user. As a result, there is a security risk that can be hacked by malicious code-embedded programs like regular PCs.

In order to solve the security problem, various researches and developments have been made. Korean Patent Publication No. 2011-0117744 (mobile payment method and system) stores an electronic certificate in a mobile communication terminal and performs a communication processing procedure with an authentication server And improving the security.

However, the prior patent includes a process of transmitting the certificate number of the specific electronic certificate, the password received from the user, and the transaction information to the mobile security settlement applet when the relay module performs the authentication for mobile payment, It still has a problem of security vulnerability due to phishing or smashing.

An object of the present invention is to provide a mobile communication service provider that acquires a mobile communication company, a mobile phone number, and a resident registration number through a payment window of a PG company via online or mobile when a micro payment authentication using a mobile phone is performed, After verifying the customer's mobile phone number registered in the existing smart card authentication server through the smart card authentication server and checking whether the USIM is stolen, the user operates the payment authentication application and provides the back seven digits of the resident registration number received from the customer to PG, The company is a smart card authentication server-based mobile phone that replaces the small amount of mobile phone payment through the existing SMS authentication number by matching the front of the resident registration number acquired from the payment window to the back of the resident registration number obtained from the payment authentication application, Secure payment authentication service to prevent illegal mobile phone settlement It is an object.

Specifically, an object of the present invention is to provide: 1) a mobile phone small payment method in which payment has been completed by inputting a mobile phone SMS authentication number into a payment window; By doing so, it is aimed to prevent customer damage through illegal transactions such as smishing, and to reduce messaging sending costs.

2) In the conventional method of performing personal authentication by inputting information on a single channel, a mobile phone user enters a mobile phone number, a mobile phone number, and a prefix of a resident registration number in a payment window, It is intended to protect personal information and property from damages caused by information leakage by completing settlement authentication and authentication of payment for payment, that is, receiving information by multi channel (2 channel).

3) Check the theft of the USIM owned by the customer through the smart card authentication server, match the information value of the smart card owned by the customer with the customer information (mobile phone, mobile number) provided by PG, The purpose of the invention is to prevent unauthorized use of the mobile phone of another person and the use of the USIM theft by performing occupancy authentication of the attempted customer's mobile phone.

4) After separating the resident registration number into two channels and inputting the billing authentication application (application) password (customer setting applicable), it is possible to input the back address of the resident registration number, By providing mobile phone micro settlement service through security authentication in three stages, which performs occupancy certification, it is possible to prevent hacking accidents by phishing or smishing, and to provide safety and security for mobile financial transactions The purpose is to strengthen.

To achieve these and other advantages and in accordance with the purpose of the present invention, as embodied and broadly described herein, there is provided a smart card authentication system comprising a smart card authentication server for receiving a smart card authentication server, A client for transmitting the digits of the resident registration number in response to a resident number input request received in the form of PUSH from the payment authentication application server together with the PG server server and receiving the micro settlement completion information from the PG company server; If the client is a payment capable client by verifying the mobile communication device identification information and the mobile communication device identification information included in the customer information and the micropayment request information received from the client, the mobile communication device transmits the mobile communication device identification information and the mobile device identification number to the payment authentication application server, Receives the encrypted resident registration number and authentication confirmation completion information from the authentication app server, matches the back of the resident registration number received from the payment authentication application server and the resident registration number received from the client, and transmits the matching resident registration number to the authentication server A PG server for transmitting the micro settlement completion information received from the mobile communication company authentication server to the client; The mobile communication terminal transmits the request for inputting the back seat of the resident registration number to the client in the form of PUSH using the mobile communication device identification information and the mobile device identification number included in the customer information received from the PG company server to receive the back address of the resident registration number, To the smart card authentication server, receives the authentication confirmation completion information, encrypts the back address of the resident registration number received from the client and authentication confirmation completion information received from the smart card authentication server, and transmits the small payment request A billing authentication app server for transmitting to the PG company server together with the transaction number corresponding to the information; And a smart card that generates authentication completion information and transmits the information to the payment authentication application server when the stored user media information (USIM identification number or smart card identification number) matches the authentication confirmation request information received from the payment authentication application server And an authentication server.

In the method of authenticating a user using a smart card authentication server of the present invention based on the system described above and a micropayment authentication method, a PG company server receives customer information and micropayment request information from a client and transmits the information to the payment authentication application server (a); (B) transmitting a request for inputting a resident registration number to the client in the form of PUSH for confirming the identity of the customer information and the micropayment request information from the PG company server by the payment authentication server; The smart card authentication server receives the authentication confirmation request information for confirming the client from the payment authentication application server and checks the USIM of the client to match the smart card identification number with the USIM identification number, (C) determining whether or not the numbers match; (d) when the smart card authentication server transmits the authentication confirmation completion information to the payment authentication application server when the acquired USIM identification number matches the smart card identification number as a result of the determination in step (c). (E) the billing authentication application server transmits the digits of the resident registration number and authentication completion information to the PG company server; (F) matching the front digit of the resident registration number received from the payment company authentication server with the PG company's server and the resident registration number included in the received authentication request information; (G) transmitting the matched resident registration number to the mobile communication company authentication server through step (f); And (h) transmitting the payment authentication completion information generated by receiving the payment authentication completion information from the PG server to the client, to the client.

According to the present invention as described above, when performing a micropayment authentication using a mobile phone, it is possible to distinguish the front and back of the resident registration number through the Legacy of the PG company through online or mobile, By performing the normal USIM check and the mobile phone occupancy authentication, it is possible to prevent illegal mobile phone settlement through payment authentication and personal authentication, thereby securing security.

In addition, according to the present invention, after the mobile phone SMS authentication number is input to the payment window and the payment has been completed, the app transmits the PUSH through the settlement authentication application to the back of the resident registration number, Smishing), etc., and it is effective to reduce messaging sending cost.

According to the present invention, there is provided a method for receiving payment information in a single channel by inputting a mobile phone number, a mobile phone number, and a prefix of a resident registration number into a payment window, (2 channels), that is, to complete the payment authentication and the authentication of the personal authentication of the mobile phone by inputting the information, and to protect personal information and property from damage caused by information leakage.

Further, according to the present invention, there is an effect of preventing forgery and falsification of an application (App) and illegal use of a USIM by performing medium authentication for smart card and smart card.

According to the present invention, it is possible to separate the resident registration number into two channels, receive the app password, enter the resident registration number, and use the smart card authentication server to prevent the use of the USIM, By providing the mobile phone micro settlement service through the three-step security authentication that matches the registered customer information and carry out the occupancy certification, it prevents the hacking accident by phishing or smishing, It has the effect of strengthening the safety and security of transactions.

Brief Description of the Drawings Fig. 1 is a block diagram showing a personal authentication process of a personal identification and a micropayment authentication system using a smart card authentication server according to the present invention; Fig.
FIG. 2 is a configuration diagram showing a personal authentication and a micropayment authentication process of a micropayment authentication system using a smart card authentication server according to the present invention; FIG.
3 is a diagram showing an example of a micropayment process of a personal identification and micropayment authentication system using a smart card authentication server according to the present invention.
4 is a flowchart showing a method of authenticating a user and a method of authenticating a micropayment using a smart card authentication server according to the present invention.
FIG. 5 is a flowchart showing a process after step S70 of the identity verification and the micropayment authentication method using the smart card authentication server according to the present invention. FIG.

Specific features and advantages of the present invention will become more apparent from the following detailed description based on the accompanying drawings. Prior to this, terms and words used in the present specification and claims are to be interpreted in accordance with the technical idea of the present invention based on the principle that the inventor can properly define the concept of the term in order to explain his invention in the best way. It should be interpreted in terms of meaning and concept. It is to be noted that the detailed description of known functions and constructions related to the present invention is omitted when it is determined that the gist of the present invention may be unnecessarily blurred.

1 and 2, the principal authentication and micro payment authentication system S using the smart card authentication server according to the present invention includes a client 100, a PG (payment gateway) server 200, a payment authentication An application server 300, a hardware security module (HSM) 400, and a mobile communication server authentication server 500.

Hereinafter, the client 100 according to the present invention is preferably understood to include a mobile device capable of connecting with a wireless communication network or a PC connected through an information communication network.

First, the client 100 receives the customer information including the mobile communication device identification information, the mobile device identification number, and the first digit of the resident registration number from the user, transmits the customer information together with the micro payment request information to the PG company server 200, After the USIM stolen check by the server 400, the postal address of the resident number is transmitted in response to the request for inputting the resident registration number received in the form of PUSH from the payment authentication application server 300, .

At this time, the client 100 is connected to the smart card authentication server 400 by a previously installed payment authentication application (App), and the payment authentication application (App) is reinstalled or updated from the payment authentication application server 300.

In addition, the PG company server 200 verifies the mobile communication device identification information and the mobile device identification number included in the customer information and the micropayment request information received from the client 100, And the mobile device identification number to the payment authentication application server 300 and receives the encoded back address of the resident registration number and the authentication confirmation completion information from the payment authentication application server 300 and includes it in the customer information received from the client 100 And transmits the matched resident number to the mobile communication company authentication server 500 and transmits the received small payment completion information to the client 100. [

In addition, the payment authentication application server 300 transmits to the client 100 corresponding to the mobile communication device identification information and the mobile device identification number included in the customer information received from the PG company server 200, And sends the authentication confirmation request information for confirming the client to the smart card authentication server 400 to receive the authentication confirmation completion information, And transmits it to the PG company server 200 together with the transaction number corresponding to the micro settlement request information received from the PG company server 200. [

The settlement authentication application server 300 transmits a request for inputting the resident registration number to the client 100 in the form of PUSH, but the client 100 sets the password (PIN number) of the previously installed authentication payment app (App) (PIN number) is requested from the client 100 and the password (PIN number) of the received authentication payment application (App) matches the pre-registered password (PIN number), the back side of the resident registration number is received from the client do.

On the other hand, when the password of the authentication payment app (App) does not match with the pre-stored password, the payment authentication application server 300 transmits the password to the pre-set e-mail according to the request of the client 100. [

When the smart card authentication server 400 matches the previously stored user medium information (USIM identification number or smart card identification number) with the authentication confirmation request information received from the payment authentication application server 300, And transmits it to the payment authentication application server 300.

FIG. 3 is a diagram illustrating an example of a personal identification using a smart card authentication server and a micropayment process of a micropayment authentication system (S) according to the present invention.

The client 100 accesses the payment window of the PG company server 200 to select the payment for the micropayment and the PG company server 200 transmits the settlement information to the payment server 100 based on the mobile communication device identification information and the mobile device identification number received from the client 100 The authentication application server 300 primarily performs authentication.

In addition, the smart card authentication server 300 performs authentication secondarily through USIM forgery and verification of whether or not the smart card is normal.

In addition, the payment authentication application server 300 transmits the password (PIN number) request information of the authentication payment application (App) installed in the client 100, and transmits the PIN number request information from the client 100 in the form of PUSH, When the password of the payment application (App) is received and the password of the authentication payment application (App) received matches with the password stored previously, the screen changes to a screen for inputting the back address of the resident registration number. If the passwords of the apps (App) do not match, the password can be transmitted by a predetermined email according to the request of the client (100).

Hereinafter, referring to FIG. 4, a description will be given of a method of authenticating a user using a smart card authentication server and a method of authenticating a small amount of payment according to the present invention.

First, the PG company server 200 receives the customer information and the micropayment request information from the client 100 and transmits it to the payment authentication application server 300 (S10).

Subsequently, the payment authentication application server 300 transmits a request for inputting the resident registration number to the client 100 in the PUSH form to confirm the identity of the customer information and the micropayment payment request information from the PG company server 200, (S20).

Then, the smart card authentication server 400 receives the authentication confirmation request information for confirming the client from the payment authentication application server 300, checks the USIM of the client 100, and matches the smart card identification number with the USIM identification number , It is determined whether the acquired USIM identification number matches the smart card identification number (S30).

If it is determined in operation S30 that the acquired USIM identification number matches the smart card identification number, the smart card authentication server 400 transmits the authentication confirmation completion information to the payment authentication application server 300 (S40) .

Subsequently, the settlement authentication app server 300 transmits the digits of the resident registration number and authentication confirmation completion information to the PG company server 200 (S50).

Subsequently, the PG company server 200 matches the resident registration number received from the payment authentication application server 300 with the resident registration number included in the received authentication request information (S60).

Subsequently, the PG company server 200 transmits the matching resident registration number to the mobile communication company authentication server 500 (S70).

The PG company server 200 receives payment authentication completion information from the mobile communication company authentication server 500 and transmits the payment authentication completion information to the client 100 (S80).

Hereinafter, the process after step S70 of the identity verification and the micropayment authentication method using the smart card authentication server according to the present invention will be described below with reference to FIG.

After step S70, if the mobile communication company authentication server 500 receives the matched resident registration number from the PG company server 200 and matches the stored resident registration number, the payment authentication completion information is generated and transmitted to the PG company server 200 , And the procedure goes to step S80 (S90).

While the present invention has been particularly shown and described with reference to preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. It will be appreciated by those skilled in the art that numerous changes and modifications may be made without departing from the invention. And all such modifications and changes as fall within the scope of the present invention are therefore to be regarded as being within the scope of the present invention.

S: Identity verification and micro payment authentication system using smart card authentication server
100: client 200: PG company server
300: Payment authentication application server 400: Smart card authentication server
500: Mobile communication authentication server

Claims (5)

In a personal authentication and a micropayment authentication system using a smart card authentication server,
The customer information including the carrier identification information, the mobile device identification number, and the first digit of the resident registration number is input from the user and transmitted to the PG company server together with the micro payment request information, and the resident number input request A client which transmits the back address of the resident registration number and receives the micropayment completion information from the PG company server;
And transmits the mobile communication device identification information and the mobile device identification number to the payment authentication application server if the mobile communication device is a client capable of verifying the mobile communication device identification information and the mobile device identification number included in the customer information and the micropayment request information received from the client, Receiving the encrypted resident registration number and authentication confirmation completion information from the payment authentication application server and matching the resident registration number received from the payment authentication application app server with the resident registration number received from the client and matching the resident registration number to the authentication server A PG server for transmitting the micro settlement completion information received from the mobile communication company authentication server to the client;
Transmits a request for inputting the back seat of the resident registration number to the client corresponding to the mobile communication device identification number and the mobile communication device identification number included in the customer information received from the PG company server in the form of PUSH to receive the back address of the resident registration number, And transmits the information to the smart card authentication server to receive the authentication confirmation completion information, encodes the authentication number confirmation information received from the smart card authentication server and the back of the resident registration number received from the client, A billing authentication application server for transmitting to the PG company server together with the transaction number corresponding to the micropayment request information; And
When the stored user medium information (USIM identification number or smart card identification number) matches with the authentication confirmation request information received from the payment authentication application server, a smart card authentication for generating and transmitting the authentication confirmation completion information to the payment authentication application server server; , ≪ / RTI &
The settlement authentication application server transmits a request for entering a resident registration number to the client in the form of PUSH, and when the client sets a password (PIN number) of an installed authentication payment application (App) installed in the client, (PIN number) of the received authentication payment application (App) matches the previously registered password (PIN number), receives the resident registration number from the client,
Wherein the smart card authentication server transmits the password to the smart card authentication server according to a request from the client when the password stored in the authentication payment application (App) system.
The method according to claim 1,
The client is connected to the PG company server by a previously installed authentication payment application (App)
Wherein the authentication payment application (App) is reinstalled or updated from the payment authentication application server (300). delete In a personal authentication and a micropayment authentication method using a smart card authentication server,
(a) receiving a customer information and micropayment request information from a client and transmitting the received information to a payment authentication application server;
(b) receiving from the PG company server a request for inputting a resident registration number in a PUSH form to the client to confirm the identity of the customer information and the micropayment request information from the PG server, and receiving the resident registration number;
(c) The smart card authentication server receives the authentication confirmation request information for confirming the client from the payment authentication application server, checks the USIM of the client, and matches the smart card identification number with the USIM identification number. Determining whether the smart card identification numbers match;
(d) transmitting, as a result of the checking in step (c), the authentication confirmation completion information to the payment authentication application server when the acquired USIM identification number matches the smart card identification number;
(e) a payment authentication application server transmitting the resident registration number and authentication confirmation completion information to the PG company server;
(f) matching the resident registration number received by the PG server from the payment authentication application server with the resident registration number included in the received authentication request information;
(g) transmitting, by the PG company server, the resident registration number matched by the server to the mobile communication company authentication server; And
(h) transmitting, by the PG server, payment authentication completion information generated by receiving payment authentication completion information from the mobile communication company authentication server to the client; , ≪ / RTI &
In the step (b)
When the payment authentication application server transmits a request for entering a resident registration number to the client in the form of PUSH and the client sets a password (PIN number) of a previously installed authentication payment application (App) (PIN number) of the received authentication payment application (App) matches the pre-registered password (PIN number), receives the postmark of the resident registration number from the client,
Wherein the smart card authentication server transmits the password to the smart card authentication server according to a request from the client when the password stored in the authentication payment application (App) Way.
5. The method of claim 4,
After the step (g)
(i) When the mobile communication authentication server receives the matching resident registration number from the PG company server and matches the stored resident registration number, the payment authentication completion information is generated and transmitted to the PG company server, and the procedure is executed in step (h) The method further comprising the steps of: (a) authenticating the user using the smart card authentication server;

Images