KR102002945B1 - Apparatus and method for security based on extensions for financial service and financial device - Google Patents

Abstract

The present invention relates to an application for operating a drive for at least one device unit included in a financial instrument; A service provider for receiving the operation control command of the at least one device unit from the application and driving the corresponding at least one device unit; And an authentication information DB for managing authentication information for the application, wherein the service provider receives a WFSOPEN for access from the application to the at least one device unit, And an application authentication device for extracting CEN / XFS nonstandard WFS_SECURITY information stored in advance and verifying the application.

Description

[0001] The present invention relates to a CEN / XFS nonstandard based application authentication apparatus, a control method thereof, and a financial apparatus,

The present invention relates to a CEN / XFS nonstandard based application authentication apparatus, a control method thereof, and a financial instrument.

The financial device is composed of a plurality of device units such as a keypad device, a customer's guest device, a card reader device, a medium recognition device, and the like, and an appropriate device is adopted according to the job and the type of the financial device to perform the requested operation.

XFS-based financial instruments are provided with the CEN / XFS (eXtension for Financial Service) standard, which is mandated by the European standards committee and defines the commands for driving the devices. The CEN / XFS standard defines a user interface to provide consistent control over the driving of devices.

Such an XFS-based financial device can control a plurality of devices according to the firmware of the device using the XFS command even if the device is changed to another manufacturer's device.

In this way, companies that want to use banks or CD / ATM can develop device-driven APs using the same CEN / XFS library. Therefore, the CD / ATM provider or the bank that wants to use it can develop and operate the financial business through knowing the CEN / XFS specification even if they do not know their AP or SP. In other words, existing XFS-based financial instruments have security weakness that makes it easier to access the device through the international convention of CEN / XFS. In addition, since the CEN / XFS specification allows anyone to access the device after the program is built, the risk of financial accidents increases.

The object of the present invention is to prevent financial accidents by remote control of financial instruments and illegal programs by using CEN / XFS nonstandard WFS_SECURITY and to enhance work efficiency.

According to an aspect of the present invention, there is provided an apparatus for authenticating an application, the apparatus comprising: an application for operating at least one device unit included in a financial device; A service provider for receiving the operation control command of the at least one device unit from the application and driving the corresponding at least one device unit; And an authentication information DB for managing authentication information for the application.

Here, the service provider receives the WFSOPEN for accessing the at least one device unit from the application, extracts the CEN / XFS non-standard WFS_SECURITY information stored in advance for the application from the authentication information DB, Can be verified.

According to another aspect of the present invention, there is provided a method for authenticating an application based on CEN / XFS, comprising: receiving an XFS command for accessing at least one device unit included in a financial device from an application; ; Receiving CEN / XFS nonstandard WFS_SECURITY from the application and extracting the extracted CEN / XFS non-standard WFS_SECURITY information from the authentication information DB in advance for the application; And verifying the application using the received CEN / XFS nonstandard WFS_SECURITY and the extracted CEN / XFS nonstandard WFS_SECURITY information.

Wherein permitting access to the at least one device unit for the application in accordance with a result of the verifying step.

According to another aspect of the present invention, there is provided a financial device including: a storage unit for storing authentication information for each application authenticated by a server; A control unit for controlling driving of at least one device unit included in the financial device through each application; An authentication device for authenticating each application accessing the at least one device unit; And a media processing apparatus for processing a financial transaction under the control of the control unit.

Here, the authentication apparatus verifies the application by comparing the CEN / XFS non-standard WFS_SECURITY output from the application with the CEN / XFS non-standard WFS_SECURITY information for the corresponding application stored in the storage unit through the service provider, Thereby allowing or blocking access to the at least one device unit for the application.

According to the present invention, when an application accesses a device of a financial device, it compares the information of the application with the information registered in the authentication information DB for managing the authentication information of the application, verifies the corresponding AP, The security of the application's access to the financial device can be further enhanced.

1 is a diagram illustrating a configuration of a financial instrument according to an embodiment of the present invention.
2 is a diagram illustrating a configuration of a financial instrument according to another embodiment of the present invention.
FIG. 3 is a diagram illustrating an exemplary embodiment of a CEN / XFS nonstandard WFS_SECURITY-based application authentication method according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 4 is a diagram illustrating a procedure of a CEN / XFS nonstandard WFS_SECURITY-based application authentication procedure according to an embodiment of the present invention.
FIG. 5 is a diagram illustrating an exemplary embodiment of a CEN / XFS nonstandard WFS_SECURITY-based application authentication portion according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 6 is a diagram illustrating three cases according to the conventional method and whether the CEN / XFS non-standard WFS_SECURITY-based application is authenticated according to the present invention.
FIG. 7 is a view schematically showing a general device accessing method according to an existing method.
FIG. 8 is a diagram schematically illustrating a case where a CEN / XFS nonstandard WFS_SECURITY-based application authentication fails according to an embodiment of the present invention.
FIG. 9 is a diagram schematically illustrating an example of successful authentication of a CEN / XFS nonstandard WFS_SECURITY based application according to an embodiment of the present invention.
FIG. 10 is a view showing a detailed configuration of a financial instrument according to the present invention.
Fig. 11 is a view showing a detailed configuration of the medium processing apparatus of Fig. 10; Fig.

Hereinafter, some embodiments of the present invention will be described in detail with reference to exemplary drawings. It should be noted that, in adding reference numerals to the constituent elements of the drawings, the same constituent elements are denoted by the same reference numerals whenever possible, even if they are shown in different drawings. In the following description of the embodiments of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the difference that the embodiments of the present invention are not conclusive.

In describing the components of the embodiment of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are intended to distinguish the constituent elements from other constituent elements, and the terms do not limit the nature, order or order of the constituent elements. When a component is described as being "connected", "coupled", or "connected" to another component, the component may be directly connected or connected to the other component, Quot; may be "connected," "coupled," or "connected. &Quot;

The financial device according to an embodiment of the present invention may be a financial device that obtains various media such as banknotes, securities, bills, coins, vouchers, etc. to process and process transactions such as deposit processing, And the like, and performs a financial task to perform the media processing such as the processing such as the release. Examples of such financial instruments include an automated teller machine (ATM) such as a cash dispenser (CD), a cash recycling machine, and the like. However, the financial instrument is not limited to the above-described example, and may be a device for automating financial business such as FIS (Financial Information System).

Hereinafter, an embodiment of the present invention will be described on the assumption that the financial instrument is a financial automatic instrument. However, this assumption is for convenience of explanation, and the technical idea of the present invention is not limited to the financial automation equipment.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a diagram illustrating a configuration of a CEN / XFS nonstandard WFS_SECURITY based application authentication apparatus according to an embodiment of the present invention.

1, a financial device 10 according to the present invention may include a CEN / XFS-based application authentication device 100 (hereinafter, referred to as an 'authentication device') and a media processing device 200 have.

The authentication apparatus 100 includes an application 110, an extensions for financial service (XFS) manager 120, a service provider (hereinafter, referred to as 'SP' ) 130 and an authentication information DB 140. [0031]

The media processing apparatus 200 may include a media input / output unit (not shown), a media recognition unit (not shown), a media return unit (not shown), a media storage unit (not shown) And may be a device that controls and processes the media being traded. First, the AP 110 refers to a financial transaction application that drives a device unit in the financial instrument 10 to process a specific financial transaction. That is, when there is a financial transaction request, the AP 110 requests the server 20 for authentication before processing the financial transaction, and may process the financial transaction when the authentication is completed from the server 20. At this time, the authentication information of the AP 110 may be stored in the authentication information DB 140 as CEN / XFS non-standard WFS_SECURITY information.

Here, the AP 110 can access the device of the financial device 10 using the 'WFSOPEN' command, which is a standard command of XFS (Extended Financial Service). The WFSOPEN command in XFS can be accompanied by information such as APPID (Application ID) and hybrid wavelet-kernel novelty detection (HWND) as parameters.

The XFS manager 120 delivers the WFS command from the AP 110 to the SP 130 operating the actual financial device 10 according to the corresponding command. In other words, when the CEN / XFS manager 120 receives the WFSOPEN command from the AP 110, the CEN / XFS manager 120 can transmit the received WFSOPEN command to the SP 130. In addition, the XFS manager 120 can forward the response data from the SP 130 to the corresponding AP 110. [

The SP 130 receives the command output from the AP 110 through the XFS manager 120 and drives the device unit corresponding to the financial transaction. Here, the SP 130 can control the device unit that processes the financial transaction requested from the AP 110 by calling the API of the XFS manager 120 using the commands defined in the XFS protocol.

At this time, the XFS manager 120 processes the device units included in the financial device 10 so as to perform consistent control according to the CEN / XFS standard specification. Here, the device unit included in the financial instrument 10 may be a keypad module, a printer module, a customer hospitality module, a card reader module, and a medium recognition module.

SP 130 accesses the authentication information DB 140 storing the CEN / XFS non-standard WFS_SECURITY information of the AP 110 from the server 20 when the AP 110 attempts to access the financial device 10 of the AP And calls the CEN / XFS nonstandard WFS_SECURITY information of the corresponding AP 110. [ At this time, the SP 130 verifies the AP 110 by comparing the called CEN / XFS non-standard WFS_SECURITY information with the CEN / XFS nonstandard WFS_SECURITY information received from the AP 110. Here, the CEN / XFS nonstandard WFS_SECURITY may include an authentication key other than the CEN / XFS standard command, or may include predetermined information such as a specific number or signal.

Specifically, for example, the SP 130 can confirm whether a predetermined signal is received for the specific AP 110, and the AP 110 can be authenticated. In addition, the SP 130 may perform the authentication procedure of the AP 110 using the CEN / XFS non-standard WFS_SECURITY information a plurality of times.

In addition, the SP 130 may transmit the verification result of the AP 110 to the AP 110 through the XFS manager 120. For example, if the verification of the AP 110 is successful, the SP 130 transmits 'WFS_SUCCESS' to the AP 110 and accesses the AP 110 to each device unit of the financial device 10 . Accordingly, the AP 110 can output a command for financial transaction processing of each device unit of the access permitted financial instrument 10.

At this time, the SP 130 receives the command output from the AP 110 through the XFS manager 120 and drives the corresponding device. Here, the APIs of the XFS manager 120 can be called using the commands defined in the XFS protocol to control the device that processes the financial transaction requested from the AP 110. [

Meanwhile, when the verification of the AP 110 fails, the SP 130 transmits a failure message 'WFS_ERR_INVALID_HWND' to the AP 110, and accesses the AP 110 to each device unit of the financial device 10 Can be blocked. Of course, the SP 130 may block access to some device units of the financial device 10 to the AP 110 that failed the verification.

In this case, it is possible to prevent a plurality of APs from simultaneously using each device unit of the financial instrument 10 without authentication, and to allow a security enhanced service by allowing access to the financial instrument 10 only to the authenticated AP 110 It has an effect that can be provided.

The authentication information DB 140 stores and manages CEN / XFS nonstandard WFS_SECURITY information for a specific application. In addition, the media processing apparatus 200 builds a database of registered customer information, and analyzes and manages the characteristics of the customer on the basis of the constructed database.

The authentication apparatus 100 shown in FIG. 1 is configured such that the authentication information DB 140 is implemented in the authentication apparatus 100 independently of the medium processing apparatus 20. However, as shown in FIG. 2, the authentication information DB 140 of the authentication apparatus 100 may be implemented in the internal memory of the media processing apparatus 200. In this case, the media processing apparatus 200 can serve as a DB of the authentication apparatus 100. [

The authentication device 100 according to the present embodiment may be implemented in the form of an independent hardware device, and may be implemented as at least one processor included in another hardware device such as a microprocessor or a general-purpose computer system .

FIG. 3 is a diagram illustrating an exemplary embodiment of a CEN / XFS nonstandard WFS_SECURITY-based application authentication method according to an exemplary embodiment of the present invention. Referring to FIG.

The AP 110 transmits a start command to the XFS manager 120 to access the unit of the financial instrument (S100). In response, the XFS manager 120 sends an ack signal, and the AP 110 transmits a 'WFSOPEN' command, which is a standard command of the XFS (Extended Financial Service), to the XFS manager 120 (S120). The XFS manager 120 receiving the 'WFSOPEN' command transfers the command to the SP 130. In the conventional method, when the 'WFSOPEN' command is transmitted to the SP 130, the device unit corresponding to the financial transaction is operated by receiving the command output from the corresponding AP 110 without performing an additional authentication procedure. However, The SP 130 that has received the 'WFSOPEN' command simply checks the relevant file (S140) and determines whether the device unit can be driven according to the instruction after the authentication of the application Only the result of the determination is transmitted to the XFS manager 120 (S150). The received XFS manager 120 transmits the file check result to the AP 110 (S160).

If there is no abnormality in the basic file check result of the SP 130, the AP 110 transmits the primary CEN / XFS nonstandard WFS_SECURITY to the XFS manager 120 (S170). The XFS manager 120 transmits the primary CEN / XFS nonstandard WFS_SECURITY received from the AP 110 to the SP 130 (S180). Upon receiving the primary CEN / XFS non-standard WFS_SECURITY from the XFS manager 120, the SP 130 extracts parameter values included in the primary CEN / XFS non-standard WFS_SECURITY (S190). Then, the SP 130 extracts and acquires primary CEN / XFS non-standard WFS_SECURITY information previously determined for the application and stored in the authentication information DB 140 (S200).

SP 130 receives information on parameter values included in the primary CEN / XFS non-standard WFS_SECURITY received from the application 110 and determines the information according to the CEN / XFS non-standard WFS_SECURITY information stored in the authentication information DB 140 (S210). For example, the parameter value contained in the primary CEN / XFS nonstandard WFS_SECURITY may be an authentication key, not a CEN / XFS standard command, or an appointment value, such as a specific number or letter promised in advance.

Also, the SP 130 may transmit the verification result of the AP 110 to the AP 110 through the XFS manager 120 (S220, 230). As an example, the SP 130 transmits 'WFS_SUCCESS' to the AP 110 when the AP 110 is successfully verified.

When the verification of the AP 110 fails, the SP 130 transmits a failure message 'WFS_ERR_INVALID_HWND' to the AP 110 and transmits the failure message 'WFS_ERR_INVALID_HWND' to the AP 110 for each device unit of the financial device 10. [ Can be blocked.

When the AP 110 has successfully verified the AP 110 and received the 'WFS_SUCCESS', the AP 110 transmits the secondary CEN / XFS nonstandard WFS_SECURITY to the XFS manager 120 (S240). The XFS manager 120 transmits the secondary CEN / XFS nonstandard WFS_SECURITY received from the AP 110 to the SP 130 (S250). Upon receiving the secondary CEN / XFS non-standard WFS_SECURITY from the XFS manager 120, the SP 130 extracts parameter values included in the secondary CEN / XFS non-standard WFS_SECURITY (S260). Then, the SP 130 extracts and acquires secondary CEN / XFS non-standard WFS_SECURITY information previously determined for the application and stored in the authentication information DB 140 (S270).

The SP 130 determines whether the parameter value included in the secondary CEN / XFS non-standard WFS_SECURITY received in the application 110 is predetermined and matches the CEN / XFS non-standard WFS_SECURITY information stored in the authentication information DB 140 (S280). For example, the parameter value contained in the second CEN / XFS nonstandard WFS_SECURITY may be an authentication key, not a CEN / XFS standard command, or an appointment value, such as a specific number or letter promised beforehand. It may also be of a different form from the parameter values contained in the primary CEN / XFS nonstandard WFS_SECURITY.

In addition, the SP 130 may transmit the verification result of the AP 110 to the AP 110 through the XFS manager 120. As an example, the SP 130 transmits 'WFS_SUCCESS' to the AP 110 when the AP 110 is successfully verified.

When the verification of the AP 110 fails, the SP 130 transmits a failure message 'WFS_ERR_INVALID_HWND' to the AP 110 and transmits the failure message 'WFS_ERR_INVALID_HWND' to the AP 110 for each device unit of the financial device 10. [ Can be blocked.

When the AP 110 has successfully verified the AP 110 and received the 'WFS_SUCCESS', the AP 110 may transmit an operation control command to the XFS manager 120 to control the operation of the unit of the financial instrument (S310). The XFS manager 120 that has received the operation control command of the unit from the AP 110 transfers the command to the SP 130. The SP 130 then transmits the operation control command to the AP 110, 110). If the AP 110 is an authenticated AP, the SP 130 calls an API for executing an operation control command of the unit from the XFS manager 120 to control the operation of the unit (S330).

FIG. 4 is a diagram illustrating a procedure of a CEN / XFS nonstandard WFS_SECURITY-based application authentication procedure according to an embodiment of the present invention.

4, in the process of controlling the financial device through the process of opening and registering the start of up to access the financial device through the conventional CEN / XFS standard command, CEN / XFS non-standard WFS_SECURITY to perform the authentication procedure. When the corresponding AP 110 is authenticated in the authentication procedure, access to the financial device of the corresponding AP 110 is allowed.

FIG. 5 is a diagram illustrating an exemplary embodiment of a CEN / XFS nonstandard WFS_SECURITY-based application authentication portion according to an exemplary embodiment of the present invention. Referring to FIG.

In particular, an exemplary CEN / XFS non-standard WFS_SECURITY will briefly illustrate how authentication is performed using an encryption key.

After being opened by the WFSOPEN, the AP 110 delivers a non-standard CEN / XFS WFS_SECURITY including the HSERVICE and the encryption key, which are handle values for the service generated at the time of OPEN to the SP 130. The SP 130 performs primary authentication for the corresponding AP 110 using the encryption key received from the SP 130. If the authentication is successful, the SP 130 transmits an encryption key (a) for secondary authentication to the AP 110, .

The AP 110 having received the encryption key (a) generates an encryption key value using the encryption key (a) and transmits the non-standard CEN / XFS WFS_SECURITY including the generated key value to the SP 130. The SP 130 receiving the key value from the AP 110 performs the secondary authentication with respect to the AP 110. When the authentication is successful, the SP 130 uses the CEN / XFS standard command Allow access to the unit of the unit.

FIG. 6 is a diagram illustrating three cases according to the conventional method and whether the CEN / XFS non-standard WFS_SECURITY-based application is authenticated according to the present invention.

Case 1 can not control the financial device unless the AP 110 transmits the WFSOPEN command to the SP 130 via the XFS manager 120 and transmits the CEN / XFS non-standard WFS_SECURITY to the AP 130 .

In case 2, the AP 110 transmits the WFSOPEN command to the SP 130 via the XFS manager 120 and then transmits the CEN / XFS non-standard WFS_SECURITY to attempt authentication. However, since the authentication fails and the financial device can not be controlled .

In case 3, the AP 110 transmits a WFSOPEN command to the SP 130 via the XFS manager 120, and then transmits a CEN / XFS non-standard WFS_SECURITY to perform authentication. When the authentication is successful, the AP 110 ) Is a case in which units of a financial instrument can be controlled.

FIG. 7 is a view schematically showing a general device accessing method according to an existing method. 6 is an example corresponding to case 1.

The AP 110 sends a start command to the XFS manager 120 to access the unit of the financial instrument. In response, the XFS manager 120 sends an ack signal, and the AP 110 transmits a 'WFSOPEN' command, which is a standard command of the XFS (Extended Financial Service), to the XFS manager 120. The XFS manager 120 receiving the 'WFSOPEN' command transfers the command to the SP 130. Upon receiving the 'WFSOPEN' command, the SP 130 simply checks the associated file and transmits the result of the authentication to the XFS manager 120 only if the device unit can be operated according to the command after the application has been authenticated. The XFS manager 120, which has received the file check result, delivers the file check result to the AP 110. However, in this case, the AP 110 attempts to control the unit of the financial device without performing a separate application verification step using the CEN / XFS nonstandard WFS_SECURITY. However, since the AP 110 has not been authenticated, I can not.

FIG. 8 is a diagram schematically illustrating a case where a CEN / XFS nonstandard WFS_SECURITY-based application authentication fails according to an embodiment of the present invention.

The AP 110 sends a start command to the XFS manager 120 to access the unit of the financial instrument. In response, the XFS manager 120 sends an ack signal, and the AP 110 transmits a 'WFSOPEN' command, which is a standard command of the XFS (Extended Financial Service), to the XFS manager 120. The XFS manager 120 receiving the 'WFSOPEN' command transfers the command to the SP 130. Upon receiving the 'WFSOPEN' command, the SP 130 simply checks the associated file and transmits the result of the authentication to the XFS manager 120 only if the device unit can be operated according to the command after the application has been authenticated. The XFS manager 120, which has received the file check result, delivers the file check result to the AP 110.

Then, if there is no abnormality in the basic file check result of the SP 130, the AP 110 transmits the CEN / XFS nonstandard WFS_SECURITY to the XFS manager 120. The XFS manager 120 transmits the CEN / XFS non-standard WFS_SECURITY received from the AP 110 to the SP 130. The SP 130 performs authentication using the cryptographic key included in the CEN / XFS nonstandard WFS_SECURITY received from the AP 110. However, the authentication fails and the failure message 'WFS_ERR_INVALID_HWND' is transmitted to the XFS manager 120 do. Accordingly, the XFS manager 120 delivers the failure message 'WFS_ERR_INVALID_HWND' to the AP 110.

Since the AP 110 fails to authenticate, the AP 110 can not access the unit of the financial instrument afterwards by using the CEN / XFS standard command.

FIG. 9 is a diagram schematically illustrating an example of successful authentication of a CEN / XFS nonstandard WFS_SECURITY based application according to an embodiment of the present invention.

The AP 110 sends a start command to the XFS manager 120 to access the unit of the financial instrument. In response, the XFS manager 120 sends an ack signal, and the AP 110 transmits a 'WFSOPEN' command, which is a standard command of the XFS (Extended Financial Service), to the XFS manager 120. The XFS manager 120 receiving the 'WFSOPEN' command transfers the command to the SP 130. Upon receiving the 'WFSOPEN' command, the SP 130 simply checks the associated file and transmits the result of the authentication to the XFS manager 120 only if the device unit can be operated according to the command after the application has been authenticated. The XFS manager 120, which has received the file check result, delivers the file check result to the AP 110.

Then, if there is no abnormality in the basic file check result of the SP 130, the AP 110 transmits the primary CEN / XFS nonstandard WFS_SECURITY to the XFS manager 120. The XFS manager 120 transmits the primary CEN / XFS nonstandard WFS_SECURITY received from the AP 110 to the SP 130. The SP 110 performs authentication using the encryption key included in the primary CEN / XFS non-standard WFS_SECURITY received from the AP 110, and the AP 110 receives the primary authentication success message.

The AP 110, which has received the first authentication success, then transmits the second CEN / XFS nonstandard WFS_SECURITY to the XFS manager 120. Then, the XFS manager 120 transfers the secondary CEN / XFS nonstandard WFS_SECURITY received from the AP 110 to the SP 130. The SP 110 performs authentication using the cipher key included in the secondary CEN / XFS non-standard WFS_SECURITY received from the AP 110, and the AP 110 receives the secondary authentication success message.

Since the AP 110 has succeeded in the secondary authentication, the SP 130 transmits an API for executing the operation control command of the unit to the XFS manager 120 with respect to the operation command of the unit of the financial instrument of the AP 110 To control the operation of the unit.

FIG. 10 is a diagram illustrating a detailed configuration of a financial device to which an authentication apparatus according to an embodiment of the present invention is applied.

The financial instrument 10 according to the present invention includes an input unit 11, a display unit 13, a communication unit 15, a control unit 17, a storage unit 19, a recognition device 100, and a medium processing device 200 can do. Here, the control unit may process the signals transmitted between the respective units of the financial instrument 10.

The input unit 11 is a means for receiving customer information, such as a keypad, a soft key on a touch panel, or the like. In addition, the input unit 11 may include a financial transaction selection unit that allows a customer to select a financial transaction. At this time, if a financial transaction is selected by the financial transaction selection unit, the control unit 10 allows the financial transaction selected by the customer to be processed.

The display unit 13 is a means for outputting transaction progress information, processing status, and the like of the financial instrument 10. For example, the display unit 13 may display a transaction screen or a guidance screen corresponding to each transaction progress stage while the withdrawal transaction proceeds. When the display unit 13 is implemented as a touch screen, the input unit 11 and the display unit 13 may be integrally formed.

The communication unit 15 may include a communication module that supports a communication interface for transmitting and receiving signals between the financial device 10 and the host. At this time, the communication unit 15 can transmit a message for transaction processing to the host and receive a response to the message from the host when a predetermined transaction is performed in the financial device 10. [

The control unit 17 controls the overall operation of the financial instrument 10. That is, the control unit 17 controls the media input / output unit to input or eject the medium, or controls the medium storage unit to eject the medium for storing or storing the recognized medium and to be drawn out through the medium input / output unit, To receive data such as commands or information from the user or to display information to the user through the display unit 20. [

In addition, the control unit 17 processes various financial transactions according to the request of the customer. For example, the control unit 17 transmits the financial transaction information according to the request of the customer to the host, and processes the requested financial transaction according to the approval result from the host.

The storage unit 19 may store data, information, and programs necessary for the operation of the financial instrument 10. As an example, the storage unit may store set values and algorithms necessary for deposit and withdrawal operation, transfer operation, inquiry operation and the like of the financial instrument 10, and an algorithm for processing an error occurring in the medium processing may be stored .

In addition, the storage unit 19 may store information of an application authenticated by the server, and may store an algorithm for verifying an instruction from the application.

The storage unit 19 according to an embodiment of the present invention may be a hard disk drive (HDD), a read only memory (ROM), a random access memory (RAM), a flash memory, a memory Card) and a solid state drive (SDD).

The media processing apparatus 200 determines whether the card is inserted into the card input port and the passbook input port and whether or not the passbook is input, and recognizes the information of the card and the passbook inserted through these input ports. To this end, it is determined whether the inserted medium is a card or a bankbook, and the information of the corresponding medium is recognized according to the determination result.

In addition, the media processing apparatus 200 transports the medium inserted by the customer according to a predetermined path, determines whether the medium is true or false, and stores the normal medium in the medium storage box. On the other hand, if there is a withdrawal request from the customer, the media processing apparatus 200 picks up the medium of the requested amount from the media storage box, transfers it according to the predetermined route, and releases it to the customer through the media input / output unit.

The detailed configuration and operation of the media processing apparatus 200 will be described in more detail with reference to the embodiment of FIG.

8, a media processing apparatus 200 according to the present invention includes a media input / output unit 1110, a medium recognition unit 1120, a temporary storage 1130, a media storage 1140, a collection box 1150 and 1170, And a replenishment recovery bin 1160. In addition, the media processing apparatus 200 may further include a passbook entry / exit portion for entering and leaving the passbook, and a card entry / exit portion for entering / leaving the card, depending on the type of the financial instrument.

Here, the modules constituting the media processing apparatus 200, for example, the media input / output unit 1110, the media recognition unit 1120, the temporary storage 1130, the media storage 1140, the collection boxes 1150 and 1170 And the replenishment recovery box 1160 may be connected by a plurality of transfer paths.

The media input / output unit 1110 is a means for inputting or ejecting a medium such as cash and checks. The media input / output unit 1110 has a media storage space accessible by a customer, and the storage space can be selectively interlocked with the outside by a shutter or the like. The media input / output unit 1110 includes pickup means for separating and transporting the media one by one from the storage space when the customer stores the media, integration means for integrating and discharging the transferred media when the customer takes out the medium May be included.

The medium recognizing unit 1120 recognizes the inputted medium from the customer, identifies the information of the corresponding medium, and recognizes the authenticity of the medium. Here, the medium recognition unit 1120 may include a contact image sensor (CIS) that acquires an image for identifying a medium that is input to the medium recognition unit 1120. The abnormal medium recognized by the medium recognition unit 1120 can be returned to the customer through the medium input / output unit 1110. [

In addition, the medium recognition unit 1120 recognizes the information of the medium transferred to the medium storage box 1140 from the replenishment collection box 1160, that is, the identification information of the medium, . Of course, the medium recognition unit 1120 allows identification information, which is input by the customer or recognized from the medium to be released to the customer, to be transmitted to the control unit of the financial apparatus.

The temporary storage 1130 temporarily stores the medium recognized by the medium recognition unit 1120 so as to be finally confirmed by the customer before storing the medium in the storage units 1140a to 1140d.

The medium storage unit 1140 may include a plurality of storage units 1140a to 1140d for storing the media identified by the medium recognition unit 1120 for each type. At this time, the media storage box 1140 can be stored in each of the storage units 1140a to 1140d for each type of media. If the media withdrawal command is input, the storage units 1140a to 1140d in which the media is stored pick up the received media and provide it to the media input / output unit 1110. [

The collection boxes 1150 and 1170 store a medium recognized as an abnormal medium by the medium recognition unit 1120. Also, the withdrawal boxes 1150 and 1170 may store the media withdrawn by the customer at the request of the customer, which is not withdrawn by the customer.

The replenishment recovery bin 1160 holds media for replenishing the media stored in the media storage 1140. At this time, the media stored in the replenishment collection box 1160 are transferred to the medium recognition unit 1120, sorted by the media recognition unit 1120, and stored in the media storage box 1140. In some cases, the replenishment recovery container 1160 may temporarily store the media input via the media input / output unit 1110. [ In addition, the replenishment recovery bin 1160 temporarily stores a predetermined number of media picked up in the media storage 1140 for the purpose of correction. At this time, the predetermined number of media temporarily stored in the replenishment recovery container 1160 is stored in the original media storage box 1140 again via the medium recognition unit 1120. [

When an instruction is input from an application that requests a financial transaction in a financial device and processes a financial transaction, the authentication device 100 uses the cryptographic key included in the CEN / XFS non-standard WFS_SECURITY output from the application via the service provider to transfer the application Verify. At this time, the authentication apparatus 100 may allow or block access to at least one financial unit (device) unit for the application according to the verification result.

When access to at least one device unit for the application is blocked, the authentication device 100 can output the information via the display unit 13 and inform the user of the information. At this time, the financial transaction requested by the customer is canceled and the card or the like is returned to the customer, and the display unit 13 can return to the most-reduced transaction menu screen.

In addition, the information of the application that failed to be verified may be stored in the storage unit 19 and may be later inquired by a staff member and / or an administrator.

The application authentication apparatus 100 corresponds to the authentication apparatus 100 described above with reference to FIGS. 1 to 6, and redundant description of the configuration and operation of the application authentication apparatus 100 is omitted.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. That is, within the scope of the present invention, all of the components may be selectively coupled to one or more of them. In addition, although all of the components may be implemented as one independent hardware, some or all of the components may be selectively combined to perform a part or all of the functions in one or a plurality of hardware. As shown in FIG. The codes and code segments constituting the computer program may be easily deduced by those skilled in the art. Such a computer program can be stored in a computer-readable storage medium, readable and executed by a computer, thereby realizing an embodiment of the present invention. As the storage medium of the computer program, a magnetic recording medium, an optical recording medium, a carrier wave medium, or the like may be included.

Furthermore, the terms "comprises", "comprising", or "having" described above mean that a component can be implanted unless otherwise specifically stated, But should be construed as including other elements. All terms, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used terms, such as predefined terms, should be interpreted to be consistent with the contextual meanings of the related art, and are not to be construed as ideal or overly formal, unless expressly defined to the contrary.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

10: financial instrument 11: input
13: Display section 15:
17: storage unit 19: control unit
20: server 100: authentication device
110: Application (AP) 120: XFS manager
130: Service Provider (SP) 140: Authentication Information DB
200: Media processing device

Claims (13)

An application for operating a drive for at least one device unit included in a financial instrument;
A service provider for receiving the operation control command of the at least one device unit from the application and driving the corresponding at least one device unit; And
And an authentication information DB for managing authentication information for the application,
The service provider receives the WFSOPEN for accessing the at least one device unit from the application, extracts the CEN / XFS non-standard WFS_SECURITY information stored in advance for the application from the authentication information DB, and verifies the application ,
It is determined whether the file exists or the file version is checked using the WFSOPEN,
If the WFSOPEN success is successful,
The service provider receives the CEN / XFS nonstandard WFS_SECURITY from the application and verifies the application using the received CEN / XFS nonstandard WFS_SECURITY and the CEN / XFS nonstandard WFS_SECURITY information stored in advance for the application from the authentication information DB An application authentication device. The method according to claim 1,
WFSOPEN received from the application is a CEN / XFS standard command,
The service provider checks the file existence or file version check according to the WFSOPEN,
And transmits the result of the WFSOPEN success to the application.
delete The method of claim 2,
Wherein the verification using the CEN / XFS nonstandard WFS_SECURITY information can be performed a plurality of times. The method of claim 4,
Wherein the CEN / XFS nonstandard WFS_SECURITY includes an encryption key. The method according to any one of claims 1, 2, 4 and 5,
The service provider comprises:
Wherein when the verification of the application is completed, access to the device unit for the application is permitted, and if the verification fails, access to the entire device unit of the financial device is blocked. The method of claim 6,
The authentication information DB
An application authentication device implemented in an internal memory of the media processing device of the financial device. The method of claim 7,
And an XFS manager for connecting the application and the service provider. Receiving an XFS command from an application attempting to access at least one device unit included in a financial instrument;
Receiving a WISEOPEN from the application, checking a corresponding file, and transmitting a WISEOPEN success or failure;
Receiving CEN / XFS nonstandard WFS_SECURITY from the application and extracting the extracted CEN / XFS non-standard WFS_SECURITY information from the authentication information DB in advance for the application; And
And comparing the received CEN / XFS non-standard WFS_SECURITY with the extracted CEN / XFS non-standard WFS_SECURITY information to verify the corresponding application,
Performing a step of verifying the application if the WISEOPEN success is successful,
And allowing access to the at least one device unit for the application according to a result of the verifying step. delete The method of claim 9,
Wherein the verification using the CEN / XFS nonstandard WFS_SECURITY information can be performed a plurality of times. The method of claim 11,
Wherein the CEN / XFS nonstandard WFS_SECURITY includes an encryption key. A storage unit for storing authentication information for each application authenticated by the server;
A control unit for controlling driving of at least one device unit included in the financial device through each application;
An authentication device for authenticating each application accessing the at least one device unit; And
And a media processing apparatus for processing a financial transaction under the control of the control section,
The authentication device includes:
Standard non-standard WFS_SECURITY outputted from the application through the service provider and the CEN / XFS non-standard WFS_SECURITY information for the corresponding application stored in the storage unit to verify the application, and according to the verification result, Allow or block access to one device unit,
After receiving WISEOPEN for accessing from the application to the at least one device unit by the service provider, the WFSOPEN is used to check whether a file exists or a file version, and if successful, And verifies the application that verifies the application.

Images