KR101844906B1 - Fraud payment prevention system - Google Patents

Abstract

A server system for preventing illegal settlement is disclosed. The system includes a payment request receiving unit for receiving a payment request message, and a payment processing unit for performing payment processing using the received payment request message. The payment processing section includes a fraudulent payment determination section and a normal payment authentication section. The illegal settlement judging unit judges whether or not a fraudulent settlement attempt is possible based on at least one of past movement pattern information of the to-be-measured person and past consumption crowd information. If it is determined that there is a possibility of an illegal settlement attempt, the normal settlement authentication unit authenticates the normal settlement in cooperation with the mobile terminal of the settlement person. Then, the settlement processing unit makes a settlement process if the normal settlement authentication unit succeeds in the authentication.

Description

{Fraud payment prevention system}

The present invention relates to a settlement system, particularly a settlement system for an off-line store.

Korean Patent Laid-Open Publication No. 10-2012-0013867 discloses a card payment system using a mobile terminal. According to this system, the credit card payment system storing the credit card list for each user receives the payment request information including the user identification information from the online or offline merchant, stores the payment request information in the payment waiting list, The payment waiting list and the credit card list are transmitted to the mobile terminal, and when the payment item and the credit card are selected from the payment waiting list and the credit card list, the payment approval of the payment item is processed with the selected credit card.

Korean Patent Laid-Open Publication No. 10-2012-0013867 (published Feb. 15, 2012)

A method for preventing illegal settlement in an offline store is disclosed.

A server system for preventing illegal payment according to an aspect may include a settlement request receiving unit for receiving a settlement request message and a settlement processing unit for performing settlement processing using the received settlement request message. The payment processing unit may include a fraudulent payment determination unit and a normal payment authentication unit. The illegal settlement judging unit can judge the possibility of the illegal settlement attempt based on at least one of the past movement pattern information and the past consumption cluster information of the settlement person. The normal settlement authentication unit can authenticate the normal settlement in cooperation with the mobile terminal of the settlement person if it is determined that there is a possibility of the illegal settlement attempt. Then, the settlement processing unit can perform settlement processing when the normal settlement authentication unit successfully authenticates.

The illegal settlement judging unit judges whether a fraudulent settlement attempt is made on the basis of past weekday movement pattern information during weekdays and judges whether or not a fraudulent settlement trial is attempted based on past weekend consumption crowd information on weekends.

Meanwhile, an illegal payment prevention system according to an aspect may include a mobile terminal, an agent terminal, and a payment server. The mobile terminal may execute a payment application, and the payment application may include a barcode generation unit for generating a one-time barcode using payment specific tokens and date and time information. The merchant terminal may include a barcode acquiring unit for acquiring the one-time barcode from the mobile terminal, and a settlement requesting unit for generating the settlement request message including the acquired one-time barcode and payment information and transmitting the message to the VAN server. The payment server may include a payment request receiving unit for receiving a payment request message from the van server, and a payment processing unit for performing payment processing using the received payment request message. The settlement processing unit comprises: an unauthorized payment determination unit for determining whether or not an unauthorized settlement attempt is possible based on at least one of past movement pattern information of the mobile terminal user and past consumption cluster information; And a normal settlement authentication unit for authenticating the normal settlement by interlocking with the normal settlement authentication unit. When the normal settlement authentication unit has completed the normal settlement authentication, the settlement authentication unit may process the settlement using the settlement information of the settlement request message.

The disclosed system can prevent illegal settlement by others by determining whether the settlement is illegal in the offline store based on the user's past travel route and / or the user's past consumption community.

FIG. 1 is a configuration diagram of an illegal settlement prevention system according to an embodiment.
2 is a block diagram of an illegal payment prevention system according to an embodiment.
3 is an illustration of a numbering scheme of a one-time bar code.
4 is a view illustrating a settlement process of the illegal settlement prevention system according to an embodiment.

BRIEF DESCRIPTION OF THE DRAWINGS The foregoing and further aspects of the present invention will become more apparent from the following detailed description of preferred embodiments with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a configuration diagram of an illegal settlement prevention system according to an embodiment. 1, the illegal payment prevention system includes a mobile terminal 100, an affiliate terminal 200, a van server 300, and a payment server 400. However, the billing system does not necessarily include all of them, but may include only a part of them. The mobile terminal 100 is a terminal possessed by a user who visits a merchant (a person to be charged), and is a terminal having communication and computing functions. Examples of the mobile terminal 100 include a smart phone, a smart pad, a personal digital assistant (PDA), and a Palm personal computer.

The mobile terminal 100 can download and install and execute a payment application (payment application) 500 in an online market such as an app store where various applications can be downloaded for a fee or free of charge. The payment application 500 is used to make a payment at a merchant in a more convenient manner. The payment application 500 can support simple payment, mileage payment, credit card payment, and the like. For reference, the simple settlement may mean settlement in a manner in which the settlement amount is charged to the communication fee of the mobile terminal 100 and charged to the user. The payment application 500 executed in the mobile terminal 100 is linked with the payment server 400 and the user requests the membership server 400 to register the membership through the payment application 500. After completing membership, The payment service provided by the payment application 500 can be used. The payment application 500 according to one aspect generates a one-time barcode (OTB) for payment and uses the payment service using the generated one-time barcode (OTB).

The merchant terminal 200 is a terminal installed in an affiliated store and used for payment. The merchant terminal 200 may be a POS terminal that inputs and manages sales information of goods at each point of sale. The merchant terminal 200 can be connected to a peripheral device. For example, the merchant terminal 200 may include a keyboard for inputting a key of an affiliate store employee, a scanner for barcode scanning, and a keypad for inputting a user's personal identification number (PIN) Or wirelessly. The merchant terminal 200 may be interpreted as including such a peripheral device. The merchant terminal 200 may scan the OTB displayed on the screen of the mobile terminal 100 and use it for payment.

The van server 300 is a server operated by a VAN provider that provides financial services through computerized relays as is well known. In FIG. 1, the van server 300 relays payment between the merchant terminal 200 and the payment server 400. The settlement server 400 may be a server system for preventing illegal settlement including a web server, a web application server (WAS), a database server, a network switch, and the like. The payment server 400 may be operated under a variety of operating systems including or not including a Windows-based operating system, MacOS, Java, UNIX, or LINUX. The billing server 400 can interoperate with the payment application 500 executed in the mobile terminal 100 and can perform payment processing according to the payment request received through the van server 300. [ The payment server 400 according to an aspect determines whether or not it is a fraudulent payment attempt before a payment process in response to a payment request, and performs a payment process only when it is determined that a normal payment is attempted.

Meanwhile, a communication network may include a plurality of heterogeneous networks, and may support a plurality of communication protocols. For example, the communication network supports at least some of the communication protocols such as TCP / IP, IPX, SPX, NetBIOS, Ethernet, ARCNET, Fiber Distributed Date Interface (FDDI), IEEE 802.11, IEEE 802.11a, . In addition, the communication network may include a VAN dedicated network.

2 is a block diagram of an illegal payment prevention system according to an embodiment. As shown in FIG. 2, the payment app 500 of the mobile terminal 100 may include a barcode generator 510. The merchant terminal 200 may include a barcode obtaining unit 210 and a settlement request unit 220. The payment server 400 may include a payment request receiving unit 410 and a payment processing unit 420. The above configurations can be implemented in hardware and / or software. Of course, all the components included in the payment application 500 are implemented in software.

First, the payment server 400 will be described. The payment request receiving unit 410 of the payment server 400 receives the payment request message generated in the merchant terminal 200. In one embodiment, the settlement request receiver 410 receives a settlement request message through the van server 300. The settlement processing unit 420 performs settlement processing using the received settlement request message. The way in which the payment is processed according to the payment request from the merchant's side is well known. The payment processing unit 420 according to an aspect includes a fraudulent payment determination unit 421 and a normal payment authentication unit 422. [ When the settlement request message is received, the illegal settlement determining unit 421 determines whether or not a fraudulent settlement attempt is possible based on at least one of the past movement pattern information of the user who uses the mobile terminal 100, do.

The user's past movement pattern information can be obtained from an external separate server. At this time, the external server may be an LBS server that provides a location based service. The LBS server retains past movement path data for each user, and can analyze past movement patterns to generate past movement patterns. Alternatively, the payment server 400 may receive the past travel route data from the LBS server for each user, and directly analyze the past travel route data to generate past travel pattern information. In one embodiment, the past movement pattern information is generated by dividing into weekday and weekend. That is, it can be generated by dividing the past weekday movement pattern information and the past weekday movement pattern information.

The past consumption cluster information of the user can be generated in a server separate from the payment server 400 or the payment server 400. [ The past consuming cluster information generating server maps and manages settlement place data for each user upon completion of settlement, analyzes and accumulates accumulated settlement place data, and generates past consumption cluster information. In one embodiment, the past consuming cluster information generating server may generate past weekly consumption cluster information and past weekend consumption cluster information by separating the weekday settlement and the weekend settlement.

The illegal settlement determining unit 421 may determine whether the user is currently in the illegal settlement by comparing the current location with the past movement pattern information and / or past consumption cluster information. Where the current location information of the user may be obtained from the internal database or obtained from the mobile terminal 100 or the LBS server. For example, the location information of the franchisees is stored in the internal database of the payment server 400, and the fraudulent payment determination unit 421 can search the location information of the franchisee in the database. The merchant location information may be identical to the current location information of the user, and this method is possible. Otherwise, it may receive the current location information of the mobile terminal 100 from the mobile terminal 100 or the LBS server.

The negative payment determining unit 421 compares the current location information of the user with the past travel pattern information and / or past consumption cluster information, and if the current location of the user does not belong to the user's past travel pattern and / It is judged that there is a possibility of an illegal settlement attempt. In one embodiment, the negative payment determination unit 421 compares the current location information of the user with the past weekday movement pattern information during weekdays, and compares the current location information of the user with the past weekend consumption consumption information on weekends, It is judged whether or not it is attempted. In addition, since the movement route of the users during weekdays is mostly determined, it is judged whether or not the user is likely to make an illegal settlement by using the weekday moving pattern during the weekdays. And on weekends, it is judged whether there is a possibility of illegal settlement considering different patterns of consumption patterns depending on the individuality of users.

The normal settlement authenticating unit 422 authenticates the normal settlement in cooperation with the mobile terminal 100 when it is determined that the illegal settlement attempt is possible by the illegal settlement determining unit 421. [ In one embodiment, the normal payment authentication unit 422 provides the authentication number to the mobile terminal 100, and allows the user to input the authentication number provided. If the authentication number matches the input authentication number, It is authenticated as a trial. The authentication number may be provided as a short message service (SMS), and the user's authentication number may be input through an automated response service (ARS) call. That is, the normal settlement authentication unit 422 transmits the SMS authentication number to the mobile terminal 100, and can request the input of the authentication number after connecting the ARS call to the mobile terminal 100. If there is a possibility of an illegal settlement, the settlement processing unit 420 performs the settlement processing only when the normal settlement authentication unit 422 authenticates that the settlement is attempted.

The payment application 500 of the mobile terminal 100 will be described. The barcode generating unit 510 of the payment app 500 generates an OTB to be used for payment. The barcode generating unit 510 may generate a new OTB every predetermined time, for example, OTB in units of one minute. The barcode generating unit 510 may generate the OTB using the payment specific tokens issued from the payment server 400 and the current time information. Here, the payment unique token is used to generate the OTB in the payment application 500, and may be referred to as XPT (eXtension Payment Token, XPT). In one embodiment, the billing unique token (XPT) is transmitted from the payment server 400 to the user's payment application 500 when the user accesses the payment server 400 through the payment application 500 and completes the membership It will be issued. The barcode generating unit 510 may use the time information of the mobile terminal 100 as the current time information, but may receive and use the server time information from the payment server 400 at the time of the payment app 500.

The billing unique token (XPT) may be an encrypted billing unique identification code. The payment server 400 may generate a payment unique identification code (payment ID) and first encrypt the payment ID using the secret key to generate XPT. Further, the payment server 400 can encrypt the XPT secondarily before issue. Here, the secondary encryption may be SEED encryption. The payment server 400 transmits the public key together with the second encrypted XPT to the payment application 500 of the mobile terminal 100. Thus, the payment application 500 receives the XPT. Then, the barcode generating unit 510 SEED decodes the XPT to extract the first encrypted payment ID, generates the current time information, encrypts the primary ID and the current time information with the public key to generate the OTB can do. Here, the current time information may be a value indicating year, month, day, hour, or minute, or a value indicating month, day, hour, and minute.

The OTB numbering scheme generated by the barcode generator 510 is illustrated in FIG. As shown in FIG. 3, the OTB can be composed of a total of 20 digits, and is composed of a business entity identification code, an OTB generation time code, a payment unique identification code (payment ID), an app code, and a checksum code. The provider identification code is a code for identifying the payment provider and consists of three digits. The OTB generation time code is a value obtained by converting the OTB generation time including the month, day, hour, and minute of the present time into minutes, and is composed of 6 digits. The payment ID is composed of a total of 9 digits, which is composed of an 8-digit value randomly generated by the payment server 400 and a 1-digit value indicating an app type. The application code (App code) is a code for designating a settlement method such as a simple settlement, a membership settlement, a credit card settlement, and the like, and is composed of one digit. The checksum is a code having 0 to 9 values calculated to check the validity of codes of 1 to 19 digits, and is composed of one digit. At least some of these OTB configurations are encrypted, as described above, the payment ID and time information may be encrypted.

The merchant terminal 200 will be described. The barcode obtaining unit 210 of the merchant terminal 200 obtains the OTB from the payment app 500 of the mobile terminal 100. [ In one embodiment, the barcode obtaining unit 210 obtains the OTB by scanning the OTB displayed on the screen of the mobile terminal 100.

The payment request unit 220 generates a payment request message. The payment request message may include OTB and payment information. The payment information may include the merchant identification number, order details and payment amount. The merchant identification number may be stored in the non-volatile memory in the merchant terminal 200, and may be automatically input and included in the payment information. The order details and payment amount can be entered by the merchant staff. In addition, the payment request message may further include a PIN. The user of the mobile terminal 100 can input the PIN through the keypad and the payment request unit 220 can generate the payment request message including the PIN. The payment request unit 220 generates a payment request message including the OTB, the PIN, and payment information, and transmits the generated payment request message to the van server 300 to request payment.

The vanserver 300 receives the payment request message from the merchant terminal 200, confirms the received payment request message, and transmits the received payment request message to the payment server 400. In one embodiment, the van server 300 checks the value of the APP code of the OTB included in the payment request message, and when the confirmed code value specifies the payment of the communication charge or the payment of the membership, And transmits a settlement request message to the credit card company 400 when the credit card settlement is designated. The communication protocol between the merchant terminal 200 and the van server 300 may be different from the communication protocol between the van server 300 and the payment server 400. The van server 300 converts the communication protocol, And then transmit the settlement request message to the settlement server 400. [

On the other hand, when the payment request message includes the OTB and the PIN, the payment processing unit 420 may authenticate the user and then settle the payment. In one embodiment, the payment processing unit 420 authenticates the PIN by confirming whether the PIN included in the payment request message matches the PIN registered in advance, compares the value obtained by decrypting the OTB included in the payment request message with its own The user can authenticate the user by authenticating the OTB by checking the OTB validity by comparing the generated OTB value with the generated OTB value. If the user authentication is successful, the settlement processing unit 420 performs settlement processing using the settlement information included in the settlement request message. At this time, the payment processing unit 420 can confirm the APP code of the OTB and process the payment according to the confirmation.

According to the above, illegal settlement is prevented. For example, even when OTB is exposed to another person and abused, illegal settlement is prevented by performing a normal payment authentication.

4 is a view illustrating a payment process of the settlement system according to an embodiment of the present invention. The payment application 500 of the mobile terminal 100 accesses the payment server 400 and performs a membership registration procedure and issues an XPT from the payment server 400 and stores the XPT in the internal memory. Then, in the offline store, the payment application 500 of the mobile terminal 100 generates the OTB using the XPT and the current time information, and displays the generated OTB on the screen. When the user presents the OTB displayed on the screen of the mobile terminal 100 to the merchant, the merchant terminal 200 scans the OTB. The merchant terminal 200 receives the payment information, and receives the PIN through the keypad 201. The merchant terminal 200 generates a payment request message including the OTB, the PIN, and payment information, and transmits the generated payment request message to the van server 300. [ The van server 300 receives the settlement request message from the merchant terminal 200 and transmits the received settlement request message to the settlement server 400 configured in the integrated payment gateway platform.

The payment server 400 that has received the payment request message acquires the current location information of the user. The payment server 400 can search the internal database with the merchant identification number contained in the payment information of the payment request message and obtain the merchant location information that can be viewed as the current location information of the user. Alternatively, the payment server 400 may request and receive the current location information of the mobile terminal 100 from the mobile terminal 100 or the LBS server. The billing server 400 compares the present location of the user with the past movement pattern information and / or the past consumption cluster information to determine whether or not a fraudulent payment attempt is possible. If it is determined that there is a possibility of an illegal settlement, the payment server 400 interlocks with the mobile terminal 100 and authenticates that the settlement is successful. When the normal payment is authenticated, the payment server 400 parses the payment request message to obtain PIN and OTB, performs user authentication using the PIN and OTB, and performs payment processing according to the payment information of the payment request message. And, of course, when the normal settlement authentication fails, the settlement server 400 does not perform settlement processing.

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

100: mobile terminal 200: merchant terminal
210: Barcode acquisition unit 220:
300: Van server 400: Payment server
410: payment request receiving section 420: payment processing section
421: Negative payment determination unit 422:
500: Payment App 510: Barcode Generation Unit

Claims (5)

delete A payment request receiving unit for receiving a payment request message; And
And a settlement processor for performing settlement processing using the received settlement request message,
The payment processing unit:
If the current position of the person to be determined does not belong to the past weekday moving pattern of the person to be charged as a result of the comparison, it is determined that there is a possibility of an unauthorized settlement attempt. On the weekend, A non-payment determining unit that compares the current location information of the to-be-paid person with the past weekend consumption consume information and determines that there is a possibility of an illegal settlement attempt if the current position of the to-be-paid person does not belong to the past weekend consumption community of the to- And
And a normal settlement authentication unit for authenticating whether the settlement attempt is a normal settlement attempt in cooperation with the mobile terminal of the settlement object if it is determined that there is a possibility of an illegal settlement attempt.
The payment application executing a payment application, wherein the payment application generates a one-time barcode using the payment unique token and the date and time information;
A merchant terminal including a barcode acquisition unit for acquiring a one-time barcode from a mobile terminal, a payment request unit for generating a payment request message including the obtained one-time barcode and payment information, and transmitting the payment request message to a VAN server; And
A billing server for receiving a payment request message from a van server and a payment processor for performing payment processing using the received payment request message,
The payment processing unit of the payment server is:
If the current position of the person to be determined does not belong to the past weekday moving pattern of the person to be charged as a result of the comparison, it is determined that there is a possibility of an unauthorized settlement attempt. On the weekend, A non-payment determining unit that compares the current location information of the to-be-paid person with the past weekend consumption consume information, and determines that there is a possibility of an unauthorized payment attempt if the current position of the to-be-paid person does not belong to the past weekend consumption community of the to- And
And a normal settlement authentication unit for authenticating whether the settlement attempt is a normal settlement attempt in cooperation with a mobile terminal of the settlement object, if it is determined that there is a possibility of an unauthorized settlement attempt.
The method of claim 3,
The barcode generation unit of the mobile terminal generates a barcode of the mobile terminal by using a business ID code for identifying the payment provider, a one-time barcode generation time code, a payment unique ID code obtained by decoding the payment unique token, And a checksum code for checking the validity of the vendor identification code, the one-time barcode generation time code, the payment unique identification code, and the application code,
Wherein the payment processing unit of the payment server includes a payment processing unit that performs payment processing using the payment information of the payment request message after authenticating the person to be charged using the one-time bar code of the payment request message. delete

Images