KR101608529B1 - Security System for On-line transaction and security method using the same - Google Patents

Abstract

The present invention relates to an online transaction security system and a security method using the same. The present invention provides an on-line transaction server, which provides an on-line transaction service by transmitting an on-line transaction screen and on which a phone pad server is installed and operated; A user terminal connected to the on-line transaction server through a communication network, for transmitting encrypted information to the phone pad server and installed and operated by a phone pad driver; And a phone pad program that is connected to the user terminal and is capable of encrypting information, and is installed and operated. When receiving a request for information input from the phone pad driver, the communication terminal transmits the information to the user terminal through the phone pad program. Wherein the information entered by the user into the communication terminal is transmitted to the on-line transaction server after passing through the user terminal, and the on-line transaction is performed.

According to the present invention, the security effect can be improved.

Security method, security system, communication terminal

Description

[0001] The present invention relates to an online transaction security system and a security method using the same,

The present invention relates to an online transaction security system and a security method using the same, and more particularly, to an online transaction security system and a security method using the same.

Recently, online transactions such as the Internet and various communication networks have been actively used. The online transaction activity through the communication network is becoming more active because of its convenience, speed and low cost, and thus the total payment amount and the one-time-per-person payment cost are further increased. Accordingly, various accidents due to settlement in online transactions are a problem, and techniques for preventing transaction, transaction, security, and payment means are actively developed and used.

Problems arising from online transactions are mainly fraud issues related to transactions and leakage of various personal information due to insufficient security problems. Among them, fraud issues are somewhat different from online transaction systems, but accidents caused by insufficient security problems are a big problem.

These security incidents are done by people with specialized skills, such as hacking, dummy site administration, spamming, use of virus programs, data sharing, and more and more are becoming more and more serious. For this reason, various financial companies and electronic trading companies have adopted various security systems to cope with professional security. They are actively responding by issuing public certificates along with personal information and promoting their use nationwide.

However, in spite of this response, many security incidents are still occurring, and prevention of such incidents is another problem. Particularly, this problem is mostly caused by computer terminals mainly used in online transactions. This is because the number of users who use the online transaction service using the computer terminal is large, but the reason for the weakness of the computer terminal and the network due to the external contact characteristic of the computer terminal is also great. Representative problems arising from using computer terminals include leakage of personal information by hacking and dummy site operation, and unauthorized use of personal information by acquaintances.

In the case of hacking, when a computer terminal of a user is connected to a communication network such as the Internet, a computer security network is forcibly opened by a specific hacker and stored in the computer terminal, or the information input through the computer terminal is collected by the hacker . Such information is mainly provided by cookies existing in a computer terminal or personal information stored unconsciously by a user, easily collected by a hacker, and the user can not freely use the information by hackers .

Similarly, there are individual damages caused by dummy sites and virus programs. The dummy site is the case where the dummy site operator collects and uses the personal information entered by the user who creates the same site as the user's site and recognizes the dummy site as a real site. Also, the virus program is hidden in the computer terminal of the user similarly, and the user collects the personal information at the moment when the user inputs the personal information, and supplies the personal information through the specific route of the internet so that the third party can collect the user's personal information .

 In addition, accidents caused by acquaintances are caused by the use of personal transactions by the parents of the parents in the family, and parents' attempts to improve them by adding personal identification procedures. However, There is a problem.

These problems are not usually aimed at a security program provided by a financial institution or an electronic trader, but rather occur at a moment when a user enters personal information to use an electronic transaction. Therefore, there is a desperate need to design a method for preventing this with the user's attention.

The present invention provides an online transaction security system including a communication terminal capable of inputting information on behalf of a user terminal during online transaction, and a security method using the same.

Particularly, the present invention provides an online transaction security system and a security method using the same that can prevent personal injury such as personal information inputted during online transactions using a mobile phone or the like as a communication terminal by being hacked or leaked to another person do.

In order to achieve the above object, the present invention provides an online transaction server for providing an online transaction service by transmitting an online transaction screen and operating a phone pad server installed therein; A user terminal connected to the on-line transaction server through a communication network, for transmitting encrypted information to the phone pad server and installed and operated by a phone pad driver; And a phone pad program which is connected to the user terminal through a USB cable and is capable of encrypting information, is installed and operated. When receiving the information input request from the phone pad driver, the phone pad program transmits corresponding information to the user terminal Wherein the information input to the communication terminal by the user is transmitted to the on-line transaction server after passing through the user terminal, and the on-line transaction is performed.

When the online transaction is performed without an authorized certificate, information is encrypted or decrypted by the phone pad server and the phone pad program, and when the online transaction is performed through a public certificate, the phone pad server, the phone pad driver, It is preferable that the information is encrypted or decrypted through a program.

In particular, if the phone pad driver determines that the on-line transaction is performed without an authorized certificate, the phone pad driver can encrypt or decrypt the information if it is determined that the on-line transaction is performed through the authorized certificate without encrypting or decrypting the information.

The phone pad driver may include a program driving module for requesting to execute the phone pad program and a device search module for determining whether the communication terminal is connected.

The phone pad server may include an information security processing unit for encrypting or decrypting information transmitted to or from the user terminal.

The phone pad program encrypts or decrypts the information transmitted to the online transaction server or the information received from the online transaction server when the online transaction is performed without the official certificate, and when the online transaction is performed using the public certificate, And an information security processing unit for encrypting or decrypting information received from the user terminal.

Of course, the communication terminal preferably includes an input unit through which a user can input information and a display unit with which the user can display information.

In particular, the communication terminal includes at least one of a cellular phone or a PDA.

The mobile communication terminal may further include a phone pad program download server connected to the communication terminal through a wireless communication network, and transmitting the phone pad program to the communication terminal.

In another aspect of the present invention, an online transaction screen is transmitted from an online transaction server in which a phone pad server is installed to a user terminal installed with a phone pad driver; Requesting, by the user terminal, information necessary for online transaction to the communication terminal while executing the PIN pad program, if it is determined that the communication terminal equipped with the phone pad program is connected to the user terminal; Transmitting information encrypted by the communication terminal to the user terminal; And the user terminal transmits information to the online transaction server to establish an online transaction.

Meanwhile, if it is determined that the online transaction requires a public certificate, the information input from the communication terminal is encrypted and transmitted to the user terminal, and then the user terminal encrypts or decrypts the information transmitted from the communication terminal And the information encrypted or decrypted by the user terminal may be transmitted to the on-line transaction server.

In particular, it may further comprise selecting one of a plurality of public certificates stored in the user terminal or the communication terminal if it is determined that the online transaction requires the public certificate.

According to the present invention, security can be enhanced when an online transaction is performed. In other words, even in a common place such as a PC room, it is possible to input and transmit important personal information by using the communication terminal possessed by the user, so that it is possible to prevent the information leakage which may be caused by the hacked user terminal. This is because the user terminal and the communication terminal are physically separated and use a communication terminal that has not been hacked to date.

As a result, users' potential uneasiness about malicious methods such as hacking and phishing, which are currently social issues, can be solved, and online transaction growth can be promoted by preventing leakage of personal information, which is an obstacle to online transaction growth have.

In addition, according to the present invention, a mobile phone can be used as a communication terminal. Since a mobile phone has about 40 million or more mobile phones in Korea, a rapid infrastructure can be constructed without much cost. In particular, a user of the mobile phone can easily use the present invention without difficulty if the user is familiar with the mobile phone and can easily use the mobile phone.

Furthermore, since the present invention is a physical security method, there is a difference from general software-based security methods such as a cryptographic technique and a firewall setting method, and the difference is that a new type of security service is imprinted on the user as a leading technology, .

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a conceptual diagram illustrating an online transaction security system according to the present invention. The following description will be made with reference to Fig.

An online transaction security system according to the present invention includes an online transaction server 100 in which a phone pad server 110 is installed and operated and a user terminal 200 and a phone pad program 310 in which a phone pad driver 210 is installed, And a communication terminal 300 that is installed and operated.

The online transaction server 100 includes a server for providing online transactions. At this time, the online transaction includes all actions that can be performed on-line, such as not only making a financial settlement but also logging in a specific web site by inputting an ID and a password.

The user terminal 200 is connected to the online transaction server 100 through a communication network. The user terminal 200 includes a general personal computer (PC), and can be any terminal that can use a communication network by a user.

Herein, the communication network means a data communication network in a broad sense including a LAN, a WAN, an intranet and a similar internal network, and includes not only a wired network including a private network and a public switched telephone network (PSTN) but also a wireless network such as a mobile communication network and a satellite communication network can do.

The communication terminal 300 includes an input unit through which a user can input information and a display unit that can display information to the user. At this time, the input unit and the display unit are not limited in size, and the user can recognize the type of information requested by the communication terminal 300 and can perform a function of inputting necessary information Is sufficient. In particular, the communication terminal 300 may include at least one of a cellular phone and a PDA. The communication terminal may include a wire telephone equipped with a display unit on which characters such as numbers can be shown.

At this time, the communication terminal 300 is connected to the user terminal 200 through a USB cable, and information can be exchanged between the communication terminal 300 and the user terminal 200.

The phone pad program download server 400 is connected to the communication terminal 300 through the mobile communication network 20 and transmits the phone pad program download request to the communication terminal 300, The phone pad program can be supplied. Since the mobile communication service provider allows the mobile communication service provider to use only the mobile communication network when transmitting the program to the mobile communication service provider, it is limited to the mobile communication network 20, and if the program can be received from the mobile communication service through the wired communication network It is also possible to apply a wired communication network.

A process of installing the phone pad program from the phone pad program download server 400 to the communication terminal 300 will be briefly described.

First, after accessing the phone pad program download server 400 by the communication terminal 300, the identification information is registered. At this time, various methods such as confirming the personal name by checking the SMS authentication number can be applied.

The phone pad program download server 400 may transmit the phone pad program download announcement text message to the personal communication terminal 300 so that the user can access the download site using the communication terminal 300 and download the program . This method is merely an example, and it is possible to install a phone pad program in the communication terminal 300 by various methods.

The certification authority server 500 refers to a server that can issue or update a public certificate that can be installed in the user terminal 200 or the communication terminal 300. The certification authority server 500 may be connected to the user terminal 200 through the communication network 10.

An official certificate is electronic information issued by a certificate authority (CA) for the purpose of confirming the identity when conducting electronic commerce, forgery and alteration of documents, and for preventing the denial of transaction facts. It is a kind of seal certificate for cyber transactions. In other words, the information used to make the digital signature is unique to the subscriber who signed it, and so on. An accredited certification body is an institution equipped with personnel, technology, and financial resources capable of safely establishing and managing a public authority and an authentication system capable of fairly managing and securing a transaction in accordance with the Digital Signature Act, and is designated by the Minister of Public Administration and Security.

Certified certificates include certificate version, certificate serial number, certificate validity period, issuer name, subscriber's digital signature verification information, subscriber name and identification information, and electronic signature scheme. Certified certificates are used in the electronic commerce sector such as Internet banking, internet securities, insurance and loan services, financial services such as corporate financial services, Internet shopping, information distribution, reservation, cargo transportation, electronic tax bill, There are many kinds of applications such as administrative civil affairs affairs, licensing application, tax administration, electronic notarization and contents proof, import and export customs clearance, electronic application, electronic bidding, public sector, other university affairs work, wireless internet, internet subscription, e-mail sending and receiving.

In other words, the official certificate used in the present invention means a public certificate currently used in the country.

Fig. 2 is a configuration diagram of essential parts of the respective components shown in Fig. Particularly, FIG. 2 (a) is a configuration diagram showing the configuration of a phone pad server, FIG. 2 (b) is a configuration diagram showing a phone pad driver, to be.

Referring to FIG. 2 (a), the phone pad server 110 includes an interface unit 120 and an information security processing unit 130.

The interface unit 120 may include a session-specific public key management module and a program interface. Meanwhile, the information security processing unit 130 may include a public key generation module, an encryption key generation module, and a cryptographic module by a server.

The phone pad server 110 can generate a public key of a server and manage a server public key for each communication terminal, and can generate and manage a public key in units of a session.

2, the phone pad driver 210 includes an interface unit 220, an information security processing unit 230, a communication terminal management unit 240, and an information transmission and reception unit 250.

The interface unit 220 includes a program interface and an event processing module. The information security processing unit 230 includes a public key generation module, an encryption key generation module, and a cryptographic module.

The communication terminal management unit 240 includes a program driving module and a device searching module, and the information transmitting and receiving unit 250 includes an information processing module, an information transmitting module, and an information receiving module.

The phone pad driver 210 is executed on a PC, which is a user terminal 200, that is, a user computer. Communication between the on-line transaction server 100 and the communication terminal 300 allows information to be transmitted. The phone pad driver 210 performs various functions such as executing the phone pad program 310 or requesting information from the phone pad program 310.

2, the phone pad program 310 includes a user input processing unit 320, an information security processing unit 330, an information management unit 340, and an information transmission and reception unit 350.

The user input processing unit 320 includes a screen display module, a key input processing module, and a consistency checking module. The information security processing unit 330 may include a public key generation module, an encryption key generation module, and a cryptographic module.

The information management unit 340 includes an information deletion module, an information storage module, and an information search module. The information transmission and reception unit 350 may include an information processing module, an information transmission module, and an information reception module.

The phone pad program 310 is executed on the communication terminal 300 and receives an execution request by the phone pad driver 210. In addition, the phone pad program 310 provides an input screen for information required when an on-line transaction is performed, so that the user can grasp the type of information required.

3 is a flowchart illustrating an online transaction security method that does not require a public certificate. This will be described below with reference to Fig.

First, the online transaction server 100 and the user terminal 200 are connected to each other through the communication network 10 (S10). At this time, the user terminal 200 may access a specific online transaction server 100 to perform a desired online transaction.

Next, it is determined whether the communication terminal 300 is connected to the user terminal 200 (S20). At this time, the communication terminal 300 and the user terminal 200 are preferably connected using a USB cable.

If the communication terminal 300 is not connected to the user terminal 200, since information can not be input through the communication terminal 300, the user terminal 200 is used to input transaction information necessary for online transaction (S60 ). This method is the same as that of the existing security method. In the case where a hacking program is already laid on the user terminal 200 or there is a security problem, personal information may be leaked.

If the communication terminal 300 is connected to the user terminal 200, the user terminal 200 requests the communication terminal 300 for information (S30). At this time, the information requested by the user terminal 200 includes information required for establishing a transaction in the online transaction server 100. Such information may include, for example, an ID and password for logging in, and basic personal information required at the time of settlement.

In the communication terminal 300, an item of information required is shown on the display unit, and the user inputs this information through the input unit. This information is transmitted to the user terminal 200 by the communication terminal 300, in particular, by the phone pad program 310 (S40).

The encrypted information transmitted from the communication terminal 300 is transmitted to the online transaction server 100 through the user terminal 200 (S50). At this time, the user terminal 200 transmits the information encrypted by the communication terminal 300 to the on-line transaction server 100 without any processing such as encryption, decryption, or the like.

If the information transmitted to the online transaction server 100 is correct information corresponding to the information requested by the online transaction server 100, online transaction is performed. Of course, if the information is not correct, the online transaction server 100 may request the user terminal 200 to transmit information for online transaction again.

FIG. 4 is a view showing a data flow in FIG. 3, and FIG. 5 is a detailed view illustrating a method of encryption or decryption in FIG. Hereinafter, the data flow will be described in detail with reference to FIGS. 4 and 5. FIG.

In the online transaction server 100, the public key generation module of the phone pad server 110 generates a public key (hereinafter, referred to as 'server public key') and a pair of session key of a private key. Then, the online transaction server 100 transmits the online transaction screen and the server public key to the user terminal 200 together. The session-specific public key management module stores the session key in a memory or DISK.

The user terminal 200 drives the phone pad driver 210 while displaying the online transaction screen and sets the server public key received from the online transaction server 100 to the program interface of the phone pad driver 210. [

The device search module of the phone pad driver 210 searches for the communication terminal 300 connected to the user terminal 200 and the information transmission module transmits a request for execution of the phone pad program 310.

The Phone Platform of the communication terminal 300 executes the phone pad program 310 according to the received execution command. If the phone pad program 310 is not installed in the communication terminal 300, the Phone Platform transmits the communication terminal 300 to the phone pad program download server 400 so that the phone pad program 310 can be downloaded. Connect to the Internet. The communication terminal 300 accesses the phone pad program download server 400, downloads and installs the phone pad program 310, and executes the phone pad program 310 when the installation is completed.

When the phone pad program 310 is executed, the information transmitting module of the phone pad program 310 transmits execution completion information to the user terminal 200 and notifies the phone pad driver 210 of the completion of the execution.

The phone pad driver 210 receives the execution information of the phone pad program 310, and the event processing module notifies completion of the preparation. The phone pad driver 210 sets important information input fields to be input for online transaction to the program interface of the phone pad driver 210, and the data processing module includes an input information request including an input field information and a server public key And the information transmission module transmits the generated message to the phone pad program 310. [

The information receiving module of the phone pad program 310 receives the information input request telegram, the information processing module separates the input field information from the received telegram, and the screen display module dynamically generates the screen with the analyzed input field information And displays it on the display unit of the communication terminal 300 so that the user can input it.

The key input processing module of the phone pad program 310 collects the key information input by the user to create information of each input field, and the consistency checking module checks the consistency of the information input by the user. At this time, And displays the guidance on the input on the display unit of the communication terminal 300 to notify the user.

When the user input is completed in the communication terminal 300, the public key generation module generates a pair of a client public key (hereinafter referred to as a 'large public key') and a private key (hereinafter referred to as a 'client private key'), The encryption key generation module generates an encryption key using a server public key, a client public key, and a client private key, and the encryption module encrypts user input information.

Then, the information processing module of the phone pad program 310 generates an information input response message, and the information transmitting module transmits the corresponding data to the user terminal 200.

The information receiving module of the phone pad driver 210 receives the information input response telegram, and the information processing module analyzes the received data and separates the encrypted input information. After that, the event processing module notifies the completion of the input by the user. The user terminal 200 obtains encrypted user input information and client public key information from the program interface of the phone pad driver 210 and transmits the encrypted user input information and the client public key information to the online transaction server 100.

The online transaction server 100 sets the encrypted user input information and the client public key in the communication interface of the phone pad server 110 and the session public key management module of the phone pad server 110 Detect the server private key stored in Session. At this time, the encryption key generation module generates an encryption key using the server public key, the server private key, and the client public key, and the encryption module decrypts and returns the encrypted user input information.

The online transaction server 100 encrypts or decrypts the information according to the processing method and performs online transactions based on the user input information.

6 is a flowchart illustrating an online transaction security method requiring an authorized certificate. The security method of FIG. 6 is similar to the security method of FIG. 3 without the public certificate shown in FIG. 3, but there is a difference in that the existence or non-existence of the public certificate is checked and encryption or decryption is performed in the user terminal. Hereinafter, for simplicity's sake, similarities to those of FIG. 3 will be briefly described, and the differences will be described with reference to FIG.

An online transaction screen is transmitted from the online transaction server 100 to the user terminal 200 (S100). It is checked whether the communication terminal 300 is connected to the user terminal 200 (S120).

If the communication terminal 300 is not connected to the user terminal 200, the user terminal that is a general security method inputs transaction information (S60).

If the communication terminal 300 is connected to the user terminal 200, it is determined whether online transaction requires a public certificate (S130).

If the online transaction does not require a public certificate, the security method shown in FIG. 3 is followed, and the online transaction is performed in the same process as that after step S30 of FIG.

If the online transaction requires a public certificate, the user can select any one of the stored public certificate (S140). At this time, the location where the authorized certificate is stored can be any of the communication terminal 300 and the user terminal 200. In order to select a certificate, the user can use a certificate management program provided by the user terminal 200. Such a certificate management program is widely used in the case of using a public certificate at home, and may be a management program for confirming the location of a public certificate in an internet banking or a personal identification process using a public certificate.

The user inputs information to the communication terminal 300 using the input unit, and the communication terminal 300 encrypts the information input to the input unit and transmits the encrypted information to the user terminal 200 (S160).

Then, the user terminal 200 performs information processing such as decrypting the encrypted information, analyzing the information, and extracting necessary information. Subsequently, the phone pad driver 210 encrypts the information requested by the online transaction server 100 (S170).

The information encrypted by the user terminal 200 is transmitted to the online transaction server 100 through the communication network 10 (S180). If the information transmitted to the online transaction server 100 is correct information, an online transaction is established. If the online transaction service provided by the online transaction server 100 is an online settlement, an online settlement will be made, and if it is a login service, a login can be made.

FIG. 7 is a view showing a data flow in FIG. 6, and FIG. 8 is a detailed view illustrating a method of encrypting or decrypting between a user terminal and a communication terminal in FIG. However, the data flow between the user terminal and the online transaction server is omitted in FIG. 8, but the contents of the data flow can be interpreted through FIGS. 4 and 5, so that the description will be omitted for the sake of convenience. This will be described below with reference to Figs. 7 and 8. Fig.

When the certificate management program of the user terminal 200 is executed, the phone pad driver 210 is driven.

The device search module of the phone pad driver 210 searches for the communication terminal 300 connected to the user terminal 200 and the information transmission module of the phone pad driver 210 transmits an execution command of the phone pad program 310 And the Phone Platform of the communication terminal 300 executes the phone pad program 310 in accordance with the received command,

If the program is not installed in the communication terminal 300, the Phone Platform connects to the wireless communication network so that the phone pad program 310 can be downloaded, connects to the phone pad program download server 400, And executes the phone pad program 310 when the installation is completed.

When the phone pad program 310 is executed, the information transmitting module of the phone pad program 310 transmits execution completion information to the user terminal 200 and notifies the phone pad driver 210 of the completion of the execution.

The phone pad driver 210 receives the execution information of the phone pad program 310, and the information processing module generates a client public key request message in the phone pad program 310, and the information transmitting module transmits the generated message .

The information receiving module of the phone pad program 310 receives the client public key request telegram, the information processing module analyzes the received information, and the public key generating module generates a pair of a public key and a private key of the client, And the information processing module generates a response message including the client public key, and the information transmitting module transmits the generated response message to the user terminal 200. [

The information receiving module of the phone pad driver 210 receives the information, the information processing module stores the received client public key in the memory, and the event processing module notifies the phone pad driver 210 of the completion of the preparation.

The certificate management program installed in the user terminal 200 displays the certificate stored in the user terminal 200. When the user selects a specific certificate, the user sets the selected certificate basic information in the program interface of the phone pad driver 210 and inputs a certificate password Make a request.

 The public key generation module of the phone pad driver 210 generates a pair of a public key of a user terminal 200 (hereinafter referred to as a PC public key) and a private key (hereinafter referred to as a PC private key) The key generation module generates an encryption key with the client public key, the PC public key, and the PC private key, and the encryption module encrypts the certificate basic information.

The information processing module generates a certificate password input request message including the encrypted certificate basic information and the PC public key information, and the specialized transmission module transmits the generated message.

The information receiving module of the phone pad program 310 receives the message and the information processing module analyzes the received message to separate the encrypted certificate basic information and the PC public key information. The encryption module decrypts the encrypted certificate basic information with the encryption key, and the display module displays the certificate basic information on the display unit of the communication terminal 300, .

When the user inputs the certificate password, the public key generation module of the phone pad program 310 generates a pair of the client public key and the private key, and the encryption key generation module generates a pair of the PC public key stored in the memory And the data processing module generates a certificate password input response message including the encrypted certificate password and the client public key, and the information transmitting module generates the password for the password To the computer terminal (200).

The information receiving module of the phone pad driver 210 receives the response telegram, and the information processing module analyzes the received telegram to separate the encrypted certificate password and the client public key. The cryptographic key generation module transmits the client public key and the PC public key Key and a PC private key, and the cryptographic module decrypts the certificate password encrypted with the encryption key, and the event processing module notifies the certificate management program of the completion of the user's certificate password as an event.

The certificate management program obtains the decrypted certificate password from the program interface of the phone pad driver 210 and performs the certificate password verification.

9 is a diagram illustrating various screens displayed on the display unit of the communication terminal. As shown in FIG. 9, the display unit of the communication terminal 300 may display various types of information such as a screen for inputting specific information to a user, a screen for outputting an error when the user inputs incorrect information, The screen can be implemented.

A description will be given of a process in which a public certificate is stored in a communication terminal rather than a user terminal.

When the user selects the communication terminal 300 as the storage location at the time of issuing the certificate, the certificate management program sets the certificate basic information and the certificate file issued to the program interface of the phone pad driver 210, 310).

The public key generation module of the phone pad driver 210 generates a PC public key and a PC private key, and the encryption key generation module generates an encryption key using a stored client public key, a PC private key, and a PC public key, Encrypt the certificate file and certificate basic information with the key.

The information processing module generates a certificate storage request message including the encrypted certificate file, the encrypted certificate basic information, and the PC public key, and the information transmitting module transmits the generated message to the phone pad program 310.

The specialist receiving module of the phone pad program 310 receives the specialization and the information processing module separates the encrypted certificate file and the PC public key from the received telegraphic message and the encryption key generation module generates the public key, The encryption module decrypts the certificate file and the certificate basic information encrypted with the encryption key, and the data processing module stores the certificate basic information and the certificate file in the memory.

The screen display module of the phone pad program 310 displays the certificate basic information and the storage completion guide on the display unit of the communication terminal 300. The data processing module generates a response message for the certificate storage request, And transmits a message to the user terminal 200.

The information receiving module of the phone pad driver 210 receives the response telegram, the information processing module analyzes the received information, and the event processing module notifies the certificate management program of the certificate completion event.

The authorized certificate can be stored in the communication terminal 300 physically separated from the user terminal 200 without being stored in the user terminal 200 connected to the online transaction server 100 and the communication network 10 have.

It is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

1 is a conceptual diagram illustrating an online transaction security system according to the present invention;

Fig. 2 is a configuration diagram of essential components of each configuration shown in Fig. 1; Fig.

3 is a flow chart illustrating an online transaction security method that does not require a public certificate.

Figure 4 shows a data flow in Figure 3;

FIG. 5 is a detailed view showing a method of encrypting or decrypting in FIG. 3; FIG.

6 is a flow chart illustrating an online transaction security method that requires an authorized certificate;

FIG. 7 shows a data flow in FIG. 6; FIG.

FIG. 8 is a detailed view illustrating a method of encrypting or decrypting between a user terminal and a communication terminal in FIG. 6;

9 is a diagram illustrating various screens displayed on the display unit of the communication terminal;

Description of the Related Art [0002]

10: communication network 20: wireless communication network

100: online transaction server 110: phone pad server

200: user terminal 210: phone pad driver

300: communication terminal 310: phone pad program

Claims (10)

An online transaction server for providing an online transaction service by transmitting an online transaction screen to a user terminal and running a phone pad server installed and operated; A user terminal connected to the on-line transaction server through a communication network, for transmitting encrypted information to the phone pad server and installed and operated by a phone pad driver; And A communication terminal connected to the user terminal and installed and operated by a phone pad program capable of encrypting information and transmitting the information to the user terminal through the phone pad program when receiving the information input request from the phone pad driver; Lt; / RTI > The information input to the communication terminal by the user is transmitted to the online transaction server after passing through the user terminal, Wherein the phone pad program comprises an information security processing unit for decrypting information received from the online transaction server or the user terminal and for encrypting information transmitted to the online transaction server or the user terminal. The method according to claim 1, When the on-line transaction is performed without an authorized certificate, the information is encrypted or decrypted by the phone pad server and the phone pad program, while the phone pad driver does not encrypt or decrypt the information, Wherein the information is encrypted or decrypted through the phone pad server, the phone pad driver, and the phone pad program when the online transaction is performed through a public certificate. The method according to claim 1, The phone pad driver A program driving module for requesting to execute the phone pad program, and a device search module for determining whether the communication terminal is connected. The method according to claim 1, And the phone pad server includes an information security processing unit for encrypting or decrypting information transmitted to or from the user terminal. delete The method according to claim 1, The communication terminal An input unit through which a user can input information, and a display unit that can display information to a user. The method according to claim 6, Wherein the communication terminal comprises at least one of a mobile phone, a PDA, and a wired telephone. Transmitting an online transaction screen from an online transaction server in which a phone pad server is installed to a user terminal installed with a phone pad driver; Requesting, by the user terminal, information necessary for on-line transaction to the communication terminal while executing the phone pad program, if it is determined that the communication terminal equipped with the phone pad program is connected to the user terminal; Transmitting information encrypted by the communication terminal to the user terminal; And Wherein the user terminal transmits information to the on-line transaction server to establish an on-line transaction, Wherein the phone pad program is capable of decrypting information received from the online transaction server or the user terminal and encrypting information transmitted to the online transaction server or the user terminal. 9. The method of claim 8, When the on-line transaction is performed without an authorized certificate, the information is encrypted or decrypted by the phone pad server and the phone pad program, while the phone pad driver does not encrypt or decrypt the information, Information is encrypted or decrypted through the phone pad server, the phone pad driver, and the phone pad program when the on-line transaction is performed through a public certificate,  If the online transaction is determined to require a certificate, Wherein the user terminal further comprises encrypting or decrypting the information transmitted from the communication terminal after the information input from the communication terminal is encrypted and transmitted to the user terminal, And the information encrypted or decrypted by the user terminal is transmitted to the online transaction server. 9. The method of claim 8, And selecting one of a plurality of authorized certificates stored in the user terminal or the communication terminal if the online transaction determines that the authorized certificate is required.

Images