KR102323681B1 - System and method for providing information and computer program for the same - Google Patents

Abstract

A platform system for providing information may include: a first communication module configured to receive an information inquiry request from a usage institution and to provide personal information corresponding to the information inquiry request to the usage institution; a data conversion module configured to convert the information inquiry request into request data corresponding to an information holding institution and to convert result data received from the information holding institution according to the request data into the personal information corresponding to the usage institution; and a second communication module configured to send the request data to the information holding institution and to receive the result data from the information holding institution. In addition, the first communication module may provide the personal information to the usage institution in the form that can be read in a web view method. When the platform system for providing information is used, authentication and call methods for data holders, such as information holding institutions, to provide the personal information to MyData service providers can be standardized using an application programming interface (API), etc., and an interface for consenting to the personal information and the provision thereof can be provided in the form of a web view, thereby reducing the development time and burden of the information holding institution to respond to a transmission request of a MyData service provider.

Description

Information provision platform system, information provision method, and computer program therefor

Embodiments relate to an information providing platform system, an information providing method, and a computer program therefor. More specifically, the embodiments relate to a technology related to a platform that enables an information holding institution, such as a financial institution or a public institution, to conveniently provide personal information in response to a request received from a subject of personal information.

In Korea, after the revision of the Data 3 Act (Personal Information Protection Act, Information and Communications Network Act, Credit Information Act) on August 5, 2020, the My Data business (personal credit information management business) has emerged as the center of attention. My data business refers to a series of processes that enable individuals to directly decide on their data access, scope of provision, and approval of access, and actively utilize them in personal life such as credit management and asset management.

Through the MyData service provider, users can collect and view their data scattered in various places such as banks, insurance companies, and telecommunication companies at a glance. For example, if a user consents to a financial institution sending his or her personal information, the MyData operator may collect the user's financial data from a financial institution such as a bank, and the user may access the MyData operator's service homepage or application ( Alternatively, you can inquire your information through an app or the like and manage your credit information or financial products in a lump.

In order for My Data service providers to provide various personal credit information, security methods and communication methods for exchanging information between My Data service providers and information holding organizations such as banks and credit card companies, as well as specialized methods for the types and formats of data to be exchanged, etc. This should be negotiated in advance, and if there are multiple MyData operators and multiple information holding organizations, these discussions should be conducted for each institution. This acts as a burden on the service provision of the My Data service provider, and there is a problem in that the information holding organization is burdened with time and cost to respond to the My Data service provider's transmission request right.

Laid-open Patent Publication No. 10-2020-0124121

According to one aspect of the present invention for solving the problems of the prior art, personal information held by a data holder such as a financial institution or a public institution can be provided in a standardized format such as a standard API (Application Programming Interface), and the information Provides an information provision platform system that can provide a platform to respond to the transmission request of My Data service providers while minimizing the impact on the existing legacy system of the holding institution, information provision method, and computer program for the same can do.

An information providing platform system according to an aspect of the present invention includes: a first communication module configured to receive an information inquiry request from a user organization and provide personal information corresponding to the information inquiry request to the user organization; a data conversion module configured to convert the information inquiry request into request data corresponding to the information retention organization, and to convert result data received from the information retention organization according to the request data into the personal information corresponding to the user organization; and a second communication module, configured to send the request data to the information retention organization and receive the result data from the information retention organization. In this case, the first communication module is further configured to provide the personal information to the user organization in a form that can be read in a web view method.

In an embodiment, the first communication module is further configured to receive the information inquiry request from the user organization through a preset application programming interface (API).

In one embodiment, each of the request data and the result data is data in a professional format corresponding to the information holding organization. At this time, the data conversion module is further configured to convert the information inquiry request received through the API into the request data in a full text format, and convert the result data in the full text format into the personal information to be displayed in a web view method do.

In one embodiment, the requested data comprises an interface command to the standard database of the information retention organization. At this time, the data conversion module converts the information inquiry request received through the API into an interface command for the standard database, and converts the result data read from the standard database into the personal information for displaying in a web view manner. further configured to convert.

In an embodiment, the first communication module is further configured to provide a web-view type user interface for the user organization to transmit authentication information for user consent to the provision of personal information to the information retention organization .

In the information providing platform system according to an embodiment, a data amount of information received from the user organization through the first communication module or information provided to the user organization through the first communication module is a preset threshold value per unit time. When it exceeds, it further includes a flow rate control module configured to control communication with the user organization through the first communication module.

In an embodiment, the flow control module is further configured to store the threshold value set corresponding to each of a plurality of the using organizations or a plurality of APIs used by the using organizations.

An information providing method according to an aspect of the present invention, the information providing platform system receiving an information inquiry request from a user organization; converting, by the information providing platform system, the information inquiry request into request data corresponding to an information holding organization holding personal information; transmitting, by the information providing platform system, the requested data to the information holding organization; receiving, by the information providing platform system, result data from the information holding organization in response to the requested data; and providing, by the information providing platform system, the result data to the user organization as the personal information in a form that can be viewed by the user organization in a web view method.

In an embodiment, the receiving of the information inquiry request includes, by the information providing platform system, receiving the information inquiry request from the user organization through a preset API.

In one embodiment, each of the request data and the result data is data in a professional format corresponding to the information holding organization. In this case, the converting into the requested data includes, by the information providing platform system, converting the information inquiry request received through the API into the request data in a professional manner. In addition, the step of providing to the user organization includes the step of converting, by the information providing platform system, the result data in a professional format into the personal information to be displayed in a web view format.

In one embodiment, the requested data comprises an interface command to the standard database of the information retention organization. In this case, the converting into the requested data includes, by the information providing platform system, converting the information inquiry request received through the API into an interface command for the standard database. In addition, the providing to the user organization includes, by the information providing platform system, converting the result data read from the standard database into the personal information to be displayed in a web view manner.

In the information providing method according to an embodiment, before transmitting the requested data to the information retention organization, the information providing platform system provides the user organization with authentication information for user consent to the provision of the personal information. The method further includes providing a user interface of a web view type for transmission to the information retention organization to the user organization.

In an information providing method according to an embodiment, in the information providing platform system, the data amount of information received from the user organization to the information providing platform system or information provided to the user organization from the information providing platform system is preset per unit time. The method further includes controlling the flow rate of data transmitted/received between the information providing platform system and the user organization when the set threshold is exceeded.

In an embodiment, the threshold value is set corresponding to each of the plurality of user organizations or a plurality of APIs used by the user organizations.

The computer program according to an aspect of the present invention is combined with hardware to execute the information providing method according to the above-described embodiments, and may be stored in a computer-readable recording medium.

According to an information providing platform system and information providing method according to an aspect of the present invention, a data holder such as a financial institution, a public institution, etc. can use an API (Application Programming Language) Interface), etc., and provide an interface for consenting to personal information and its provision in a web view method, thereby reducing the development time and burden for information holding organizations to respond to the transmission request rights of My Data service providers. There are advantages to doing it.

In addition, using the information providing platform system and the information providing method according to an aspect of the present invention, it is possible to develop an API for my data service in a short time through a developer tool, and by company, by business, and by API through the operation portal site Management is possible, transaction log inquiry and various monitoring functions enable easy and stable operation of My Data service, and since modules are divided for each function of the platform, rapid modification and There are advantages to be applied.

1 is a schematic block diagram of an information providing platform system according to an embodiment.
2 is a flowchart illustrating each step of a method for providing information according to an embodiment.
3 is a schematic block diagram illustrating a configuration of a communication module and a data conversion module of an information providing platform system according to an embodiment.
4 is a flowchart illustrating each step of a process of processing user authentication in an information providing method according to an embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

1 is a schematic block diagram of an information providing platform system according to an embodiment.

Referring to FIG. 1 , the information providing platform system 300 according to the present embodiment receives an information inquiry request from the user organization 100, and receives personal information corresponding to the information inquiry request from the data retention organization, 100) can be provided. For example, the information providing platform system 300 may be configured to transmit and receive data to and from the user organization 100 through an open application programming interface (API).

In this specification, the user organization 100 refers to an organization that provides personal information according to a request received from a subject of personal information, for example, a My Data provider. The user organization 100 collects the personal information of the user (ie, the subject of personal information) who uses the my data service provided by the user organization 100 from the information holding organization, and provides the user and a service based thereon. can For example, the information holding institution may be a financial institution or public institution such as a bank, insurance company, card company, etc., and the user institution 100 may be a business operator that provides a service by collecting personal information of a user from an information holding institution.

Hereinafter, in the present specification, an operation of the information providing platform system 300 according to embodiments based on a service based on personal credit information of the financial institution 400 will be described. However, the information holding institution to which the information providing platform system 300 according to the present invention can be linked is not limited to the financial institution 400 , and the type of information that can be collected through the information collection platform system 300 is also It is not limited to personal credit information. For example, in addition to finance, the information providing platform system 300 according to the embodiments may operate in connection with information in various fields such as healthcare, energy, distribution, logistics, and communication and an information holding institution having such information.

In one embodiment, the information providing platform system 300 converts the information inquiry request into the request data of a specialized method corresponding to the corresponding financial institution 400 and transmits it to the financial institution 400 , and the financial institution 400 . It is possible to receive result data in a professional manner from In another embodiment, the information providing platform system 300 converts the information inquiry request into an interface command for a standard database (DB) of the financial institution 400, and information stored in the standard DB through the interface command It is also possible to receive result data from the financial institution 400 in a manner of reading .

The user organization 100 of the present specification may include one or more different user organizations 101, 102, ... 10N. Also, the financial institution 400 of the present specification may include one or more different financial institutions 401 , 402 , ... 40N. In the information providing platform system 300 according to the embodiments, one or more user organizations 101, 102, ... 10N are linked with one or more financial institutions 401, 402, ... 40N to access personal credit information. In providing a service accompanying inquiry about It functions as a platform that can inquire and provide personal credit information without receiving it.

For the above operation, the information providing platform system 300 includes one or more user institutions 101, 102, ... 10N and one or more financial institution devices 401, 402, ... 40N through a wired and/or wireless network. ) can be communicatively connected to In addition, in one embodiment, the information providing platform system 300 allows the user organization 100 or the operator of the information providing platform system 300 to inquire about the management of users and authentication, monitoring and statistics on transmission and reception of personal credit information. It may be communicatively connected to the portal server 200 provided to be there. In the present specification, the communication method through the wired and/or wireless network may be implemented using any communication method capable of networking between the object and the object, and may include wired communication, wireless communication, 3G, 4G, or other methods. not limited to by

The devices described herein may be wholly hardware, or may have aspects that are partly hardware and partly software. For example, the information providing platform system 300 and each system, device, server, and each unit included therein communicate therewith, a device for exchanging data in a specific format and content in an electronic communication method and software related thereto can be referred to as As used herein, terms such as “unit”, “module”, “server”, “system”, “platform”, “device” or “terminal” refer to a combination of hardware and software driven by the hardware. it is intended to For example, the hardware herein may be a data processing device including a CPU or other processor. In addition, software driven by hardware may refer to a running process, an object, an executable file, a thread of execution, a program, and the like.

The information providing platform system 300 may be configured to be able to communicate with the server of the user organization 100 that is a my data provider. However, in another embodiment, the information providing platform system 300 may be configured to communicate with a user who uses the My Data service provided by the user organization 100 rather than the server of the user organization 100, in this case, the user organization ( 100) may refer to the device of the corresponding user. For example, users run an application (or an app) for the my data service provided by the user organization 100 in a terminal such as their own smartphone, thereby providing information with the platform system 300 and Communication may also be performed.

In one embodiment, the information providing platform system 300 includes a first communication module 1 , a data conversion module 3 and a second communication module 2 . Also in one embodiment, the information providing platform system 300 further includes a DB (5). Also in one embodiment, the information providing platform system 300 further includes a flow control module (4). Further, in an embodiment, the information providing platform system 300 further includes a portal support module 6 .

In the present specification, each module constituting the information providing platform system 300 is not necessarily intended to refer to a separate physically distinct component. That is, although each module or DB 1-6 constituting the information providing platform system 300 in FIG. 1 is shown as a separate block that is distinguished from each other, this makes the information providing platform system 300 dependent on the operation executed thereby. functionally separated by According to an embodiment, some or all of the above-described modules may be integrated in the same single device, or one or more modules may be implemented as a separate device physically separated from other modules. For example, each part of the information providing platform system 300 may be components communicatively connected to each other in a distributed computing environment.

The first communication module 1 may receive an information inquiry request from the user organization 100 , and provide personal credit information corresponding to the information inquiry request to the user organization 100 . In an embodiment, the first communication module 1 may be configured to communicate with the user organization 100 in a communication method using an open API.

In the present specification, communication using an open API designates an API for inquiring through the information providing platform system 300 for personal credit information that requires inquiry among user data scattered in various places such as banks, card companies, insurance companies, and telecommunication companies. It refers to a form in which inquiry of personal credit information is realized by providing the corresponding API so that the user organization 100 can use it according to the agreement between the information providing platform system 300 and the user organization 100 .

In addition, the user organization 100 processes, or inquires, a transfer (withdrawal transfer, deposit transfer, etc.) transaction through API-based communication with the information providing platform system 300 (balance inquiry, transaction history inquiry, account real name inquiry) , remittee information inquiry, etc.) can be implemented to further process financial business such as transaction processing. For example, the financial business processing of the present specification is realized through API, and account information (bank, account holder name, account number, balance, new date, etc.) inquiry, deposit and withdrawal details (bank, account number, transaction date, transaction start, withdrawal amount, deposit amount) , balance after transaction, transaction method, etc.) inquiry, deposit information (account number, deposit type, current balance, contract amount, monthly payment amount, transaction date time, deposit amount, maturity date, etc.), loan information (account number, loan type, loan) Check balance, monthly payment amount, transaction date time, interest amount, interest rate, expiration date, etc.) , real name number, account authenticity, etc.) inquiry.

In addition, the financial business processing in the present specification is realized through API (i) deposit transfer executed based on information such as bank name, transfer amount, deposit account, withdrawal account, account number, printing details, or (ii) bank It may include withdrawal and transfer executed based on information such as name, withdrawal amount, deposit account, withdrawal account, account number, printing details, and payer number.

In an embodiment, the first communication module 1 may be configured to provide the personal credit information received from the financial institution 400 to the user institution 100 in a web view manner. By providing personal credit information in the web view method, the service user of the user organization 100 who inquires about personal credit information does not leave the service (ie, my data service) provided by the user organization 100, the information providing platform The personal credit information provided by the system 300 can be viewed in a web view method, which will be described later in detail with reference to FIG. 4 .

The data conversion module 3 may convert the information inquiry request received by the first communication module 1 into the request data of a specialized method corresponding to the financial institution 400 having the requested corresponding information. For example, the data conversion module 3 may reconstruct the information inquiry request into specialized specification data based on layout information corresponding to the financial institution 400 holding the corresponding personal credit information, wherein the layout information is financial It may be to define the type and/or order of the specification data required for communication with the organization 400 .

In addition, the data conversion module 3 converts the result data of the professional method received from the financial institution 400 in response to the information inquiry request into personal credit information corresponding to the user institution 100 that has transmitted the information inquiry request. can For example, the data conversion module 3 may convert the result data in a professional manner to an individual to be provided to the user organization 100 based on layout information defining the type and/or order of information corresponding to the user organization 100 . It can be converted into credit information. However, this is an example, and in another embodiment, personal credit information may be provided in the form of a standardized web view regardless of the type of the user organization 100 .

In an embodiment, the second communication module 2 may transmit the request data of the telegram converted by the data conversion module 3 to the financial institution 400 . In addition, the second communication module 2 may receive, from the financial institution 400 , the result data of the professional method corresponding to the inquiry result of personal credit information. In addition, the second communication module 2 may send and receive data in a professional format by a communication method (including a communication protocol and data format) corresponding to the corresponding financial institution 400 .

In another embodiment, the data conversion module 3 converts the information inquiry request of the user institution 100 into an interface command for inquiring the standard DB of the financial institution 400 , and in the second communication module 2 , this interface By transmitting the command to the financial institution 400 , result data corresponding to the search result of the standard DB may be received from the financial institution 400 .

In one embodiment, the information providing platform system 300 indicates the transaction history information (eg, log) of the user organization 100 through the API provided to the user organization 100 or the service use status of the user organization 100 . Various code data and the like can be stored in the DB 5 . In addition, the portal support module 6 transmits operational information to the portal server 200 to perform various management related to my data transmission based on transaction history information and/or service usage status information stored in the DB 5 . can be sent to For example, operation information includes transaction history information classified by each user organization 100 or user using the information providing platform system 300, or each API for each personal credit information inquiry, inquiry and transmission/reception of personal credit information It may include, but is not limited to, statistical information related to .

In one embodiment, the flow control module 4 may perform a flow control function for the data amount of personal credit information provided from the financial institution 400 to the user institution 100 . For example, the flow control module 4 may include data of information received from the user organization 100 through the first communication module 1 or information provided to the user organization 100 through the first communication module 1 . When the amount exceeds a preset threshold value per unit time, the data flow rate can be controlled without interruption of the service by temporarily refusing the information inquiry by the user organization 100 .

For example, the flow control module 4 distinguishes the API used by the user organization 100 and the user organization 100 through the access token used by the user organization 100 for the call, and the data amount corresponds to When the threshold value, which is the amount of data per second set for the user organization 100 and/or the corresponding API, is exceeded, an error processing is performed to control the data flow rate. In this case, the threshold value may be set for each user organization 101 , 102 , ... 10N or for each API used by the user organizations 100 .

2 is a flowchart illustrating each step of a method for providing information according to an embodiment. The information providing method according to the embodiments may be performed using the information providing platform system according to the embodiments.

Referring to FIG. 2 , a user 500 using the My Data service provided by the user organization 100 may request the user organization 100 to inquire personal credit information ( S101 ). Upon receiving the request from the user 500 , the user organization 100 may request an information inquiry from the information providing platform system 300 that provides an open platform for my data service provider ( S102 ). For example, the user organization 100 may request the information providing platform system 300 to inquire about the personal credit information of the user 500 related to the bank, insurance, card, financial investment, etc., the user 500 has requested inquire about. .

The information inquiry request may be made by communication between the first communication module 1 ( FIG. 1 ) of the information providing platform system 300 and the user organization 100 . For example, communication between the information providing platform system 300 and the user organization 100 may be performed using an open API. Each user organization 100 may transmit a request to the information providing platform system 300 according to the communication method used by the corresponding user organization 100 . In the present specification, the communication method refers to at least some or all of the general matters necessary for data transmission and reception between objects, including communication protocols such as https, TCP/IP, and the like, and the format of data transmitted and received such as JSON and plain text. It is intended to refer to

In one embodiment, the information providing platform system 300 performs verification of the API use of the user organization 100 before processing the information inquiry request, and rejects the processing of the requested financial business if the verification fails It can be done (S103). In the validation process, verification of the information inquiry request or the layout of the information inquiry request, verification of the status of the service realized through the API used in the request, and the application (or app) provided by the user organization or the user organization Verification of whether the use of the API is permitted, verification of whether the failure status of financial institutions related to the API is registered, and/or the transaction identification number (eg, check digit) of the request through the API verification may be included, but is not limited thereto. The verification process will be described later in detail with reference to FIG. 3 .

In addition, this is exemplary, and in another embodiment, the information providing platform system 300 may directly provide personal credit information to the user organization 100 without a separate verification process.

Next, the information providing platform system 300 branches the information inquiry request of the user institution 100 to the financial institution 400 having the corresponding personal credit information (S104), and sends the information inquiry request to the financial institution 400 ) can be converted into a data form having a format and/or order for transmission (S105). In one embodiment, the information providing platform system 300 converts the information inquiry request of the user institution 100 into the request data of the professional method corresponding to the financial institution 400 that provides the corresponding personal credit information, The request data may be transmitted to the financial institution 400 (S106).

More specifically, the information providing platform system 300 branches the information inquiry request based on the content of the information inquiry request of the user institution 100 according to the type of transaction and the type of the target financial institution 400 holding personal credit information. and convert the information inquiry request into specialized specification data (or also referred to as financial institution specification data) corresponding to the type of the branched transaction and the type of the target financial institution 400 . Also, in one embodiment, the information providing platform system 300 may encrypt at least a part or all of information included in the specialized specification data.

The type and/or order of data to be included in the specialized specification data for information inquiry and the communication method in which the specialized specification data is transmitted are different for each financial institution 400 . Accordingly, the information providing platform system 300 stores information on the specialized specification and communication method for each financial institution 400 and uses it to receive the information corresponding to each financial institution 400 from the information inquiry request of the user institution 100 . You can create specification data.

The information inquiry request for the financial institution 400 may be made by communication between the second communication module 2 ( FIG. 1 ) of the information providing platform system 300 and the financial institution 400 . In addition, communication between the information providing platform system 300 and the financial institution 400 may be performed using a communication method used by the financial institution 400 . That is, the information providing platform system 300 is a communication protocol used by the financial institution 400 among communication protocols such as https and TCP/IP, and the financial institution 400 among transmission and reception data formats such as JSON and plain text. Through the data format used, the request data of the professional method may be transmitted to the financial institution 400 .

Meanwhile, in another embodiment, the financial institution 400 may provide personal credit information through the standard DB, including a standard DB having a pre-agreed interface with the information providing platform system 300 . In this case, the information providing platform system 300 includes a standard interface adapter for inquiring the standard DB of the financial institution 400 , and converts the information inquiry request of the user institution 100 into an interface command for the standard DB for financial By transmitting to the institution 400, personal credit information can be received from the standard DB. For example, the interface command for the standard DB may be transmitted through a predefined API.

On the other hand, in order for the financial institution 400 to provide personal credit information to the my data operator through the information providing platform system 300, the information provision consent of the information subject (ie, the user 500) to the my data operator may be required. have. In one embodiment, the information providing platform system 300 provides the user organization 100 with a web view type user interface for consenting to information provision, so that the user 500 using the service of the user organization 100 provides information You may be asked to enter authentication information for consent. When the user 500 performs user authentication by inputting authentication information through the service of the user institution 100 ( S107 ), the information providing platform system 300 transmits the authentication information to the financial institution 400 , thereby providing personal credit information It is possible to make it possible to confirm the information subject of the financial institution 400 . The above process will be described later in detail with reference to FIG. 4 .

Next, the information providing platform system 300 may receive personal credit information corresponding to the inquiry result from the financial institution 400 (S109), and transmit it to the user institution 100 requesting the information inquiry (S110). Also, the user organization 100 may provide the received personal credit information to the user 500 who uses the service of the user organization 100 ( S111 ). This may mean that personal credit information is transmitted to the user 500 after being transmitted to a device such as the server of the user organization 100 , or the user device of the user 500 using the service of the user organization 100 . It may mean that personal credit information is transmitted directly to

In an embodiment, like the request data transmitted to the financial institution 400 , the result data of personal credit information provided by the financial institution 400 may be data in a professional format corresponding to the financial institution 400 . At this time, the information providing platform system 300 converts the result data of the professional method into personal credit information corresponding to the communication method (ie, communication protocol and data format) used by the user organization 100 , and converts it into personal credit information corresponding to the user organization 100 . ) can be provided to (S110). In addition, the information providing platform system 300 provides personal credit information to the user organization 100 and the user 500 in a web view method so that the user 500 can check personal credit information within the my data service of the user organization 100 . ) can be provided to

In an embodiment, when some or all of the personal credit information received from the financial institution 400 is encrypted, the data conversion module 3 may perform decryption on the encrypted information. In addition, the information providing platform system 300 may transmit personal credit information to the user organization 100 through a communication protocol used by the user organization 100 requesting the information inquiry.

3 is a schematic block diagram showing the configuration of a communication module and a data conversion module of the information providing platform system according to an embodiment.

1 and 3 , the first communication module 1 of the information providing platform system 300 according to embodiments serves as an API gateway for receiving an information inquiry request from the user organization 100 . do. Also, the first communication module 1 may provide the personal credit information received from the financial institution 400 to the user institution 100 through a web view interface in response to the information inquiry request. Furthermore, the first communication module 1 may transmit information necessary for operation and management of the My Data providing service by the financial institution 400 to the portal server 200 .

The data conversion module 3 of the information providing platform system 300 branches the information inquiry request of the user institution 100 to correspond to the financial institution 400 that provides the corresponding personal credit information, and inquires the information to the financial institution 400 . can request In this case, the information inquiry request transmitted to the financial institution 400 may be in the form of request data of a professional method or an interface command for a standard DB.

In an embodiment, the second communication module 2 may include a standard interface adapter 21 for sending and receiving a message, and may be configured to exchange data in a message format with the external system 410 of the financial institution 400 . have. In addition, the standard interface adapter 21 may be configured to transmit/receive data in a professional manner using a communication protocol corresponding to the financial institution 400 , such as https, TCP/IP, and the like.

Specifically, the data conversion module 3 may include a full text conversion module 30 . The telegram conversion module 30 is configured to convert the information inquiry request into telegram request data corresponding to the financial institution 400 having the corresponding credit information. For example, the full text conversion module 30 may reconstruct the information inquiry request into specialized specification data based on layout information corresponding to the financial institution 400 having credit information, in which case the layout information is the financial institution ( 400) may be to define the type and/or order of the technical specification data required for communication with.

In one embodiment, the full text conversion module 30 includes a message format conversion unit 301 , a transaction branching unit 302 , and a full text specification conversion unit 303 . The message format conversion unit 301 is configured to convert the information inquiry request received from the user organization 100 into intermediate data of the message format. For example, the intermediate data may have a data format such as plain text and JSON.

The transaction branching unit 302 branches the intermediate data of the professional method according to the corresponding transaction type and target institution to communicate with the financial institution 400 that provides the requested personal credit information. . To this end, the transaction branching unit 302 includes a transaction type determination unit 302-1 that determines the type of transaction corresponding to the information inquiry request, and a target institution that identifies a financial institution 400 that provides the corresponding personal credit information. It may include a decision unit 302-2.

The message specification conversion unit 303 converts the intermediate data converted by the message type conversion unit 301 with the financial institution 400 based on the type of transaction and/or the target institution determined by the transaction branching unit 302 . It is configured to be converted into specification data for communication. To this end, the full text specification conversion unit 303 may include a specification conversion unit 303-1 for changing the layout of data. In addition, the technical specification conversion unit 303 may further include a response message processing unit 303-2 for receiving result data corresponding to the information inquiry request from the financial institution 400 and processing the result data.

In addition, the telegram conversion module 30 may be further configured to convert the telegram result data received from the financial institution 400 into personal credit information corresponding to the user institution 100 requesting the information inquiry. For example, the full text conversion module 30, based on the layout information defined by the API usage agreement with the user organization 100 that has requested the information inquiry, etc., personal credit for transmitting the result data of the professional method to the user organization 100 information can be reconstructed. In this case, the layout information may define the type and/or order of information required for communication with the user organization 100 .

Meanwhile, in another embodiment, the information providing platform system 300 may be configured to receive personal credit information from the financial institution 400 through access to a standardized DB. In this case, the data conversion module 3 converts the information inquiry request of the user institution 100 into a standard interface command for querying the standard DB 420 of the financial institution 400, and the second communication module The command may be transmitted to the financial institution 400 through the standard DB interface 22 of (2) and the inquiry result may be received from the financial institution 400 . In addition, the standard DB interface 22 may be configured to access the standard DB 420 using a predefined API.

In the case of inquiring personal credit information from the financial institution 400 through the standard DB interface 22, the financial institution 400 may store the information value used in the existing legacy system in the standard DB 420 and separate Since there is no need to generate the transmission/reception message of , the development burden can be reduced. In addition, in the information providing platform system 300, even if the transmission/reception text is different for each user institution 100 or financial institution 400 using the platform, information inquiry is possible through a standardized DB interface, so customization according to the user company is possible. The advantage is that it is not necessary.

In an embodiment, the data conversion module 3 may further perform an authentication process through the authentication server 32 before converting the information inquiry request received from the user organization 100 into a professional method. The information providing authentication server 32 is for managing the service use of the user organization 100 based on the access token for which the validity period is set, and may use, for example, an Open Authorization (OAuth) 2.0 protocol. In one embodiment, the authentication server 32 includes a token issuing unit 321 , an authentication information management unit 322 , and a token verification unit 323 .

The token issuing unit 321 is configured to receive an authentication request from the user organization 100 and to perform verification therefor to issue an access token. In the present specification, the access token is predetermined information used to control the use of the open API by the user organization 100, for example, a data block having a size of several bytes to several kilobytes. However, the present invention is not limited thereto.

For example, the token issuing unit 321 may issue an access token through an authorization grant process through OAuth 2.0. The token issuing unit 321 specifies the user organization 100 through the credentials transmitted by the user organization 100 that has requested authentication, and if the credential information is correct, a redirection URI to the user organization 100 (redirection URI) ) based on an authorization code can be issued. The user organization 100 may receive an access token from the token issuing unit 321 based on the received authentication code. The issued access token can be used until the given validity period.

In one embodiment, the token issued by the token issuing unit 321 is issued and verified in a JWS (JSON web signature) method. It may be configured to enable verification.

In an embodiment, the authentication request from the user organization 100 may be configured using an authentication key previously given to the user organization 100 . Different authentication keys are issued to each user organization 101 , 102 , ... 10N ( FIG. 1 ), and the authentication key for each user organization may be stored and managed in the authentication information management unit 322 . At this time, the user organization 100 that wants to use the open API transmits an authentication request to the authentication server 32 based on the authentication key granted to the user organization 100, and the authentication server 32 includes The authentication key may be verified by checking whether the authentication key corresponds to the corresponding user organization 100 or the like.

The verification of the authentication key is a process of checking whether an authentication request using the authentication key is received from the user organization 100 to which the corresponding authentication key is granted, and whether the authentication key included in the authentication request exists in a valid state. includes For example, since the authentication server 32 stores authentication key information assigned to each user organization 100 , a service contract with the user organization 100 expires or a security leak occurs on the user organization 100 side. In case the service cannot be continued, for example, by treating the authentication key granted to the relevant institution as invalid, the use of the open API by the corresponding user organization 100 can be blocked.

When the authentication key is verified, the authentication server 32 may generate an access token by the token issuing unit 321 and transmit it to the user organization 100 . The user organization 100 may transmit an information inquiry request to the information providing platform system using the access token received from the authentication server 32 . Next, in the information providing platform system, the access token of the user organization 100 is verified through the token verification unit 323 of the authentication server 32 before converting the information inquiry request into professional data or standard DB interface commands. can do.

According to the embodiments described above, data transmitted from the user organization 100 to the information providing platform system 300 is encrypted on an individual transaction basis based on the access token issued to the user organization. Therefore, even if a network packet between the user organization 100 and the information providing platform system 300 is leaked or stolen, a third party is fundamentally blocked from decrypting or using the data included in the packet. It is possible to maintain security related to fintech services without high cost security measures such as (Virtual Private Network; VPN), security modules, and private networks.

In an embodiment, at least a part of the full text specification data converted by the full text conversion module 30 may be encrypted by the encryption module 36 . For example, the encryption module 36 may encrypt a portion corresponding to the personal information of the information subject, such as a mobile phone number and an email address, among information included in the professional specification data. In addition, at this time, the encryption process by the encryption module 36 is issued by the authentication server 32 and may be performed using authentication information (eg, access token) corresponding to the user organization.

In one embodiment, the validation module 31 of the data conversion module 3 is configured to convert the information inquiry request into an interface command to the full specification data or standard DB, the user's device or the user's device using the service of the user organization It is also possible to verify the validity of the information inquiry request received from the

The validation module 31, in the information inquiry request through the my data service for using the API provided by the financial institution 400, the request, the service related to the API, and permission to use the API of the user institution 100, etc. It plays a role in verifying the validity of the request based on For example, the validation module 31 includes a layout verification unit 311 , an API service verification unit 312 , a user organization verification unit 313 , a failure registration history verification unit 314 , and a transaction unique number verification unit 315 . It may include one or a plurality of functional units.

The layout verification unit 311 serves to verify whether the information inquiry request received using the API conforms to a format defined in relation to the use of the corresponding API. For example, processing of an information inquiry request received in a format different from a layout set in advance in relation to the corresponding API may be rejected.

The API service verification unit 312 serves to verify whether a service related to an API used for an information inquiry request is currently available. Even if the API provided by the financial institution 400 in the past, the use of the API may be prohibited in the future. have.

The user organization verification unit 313 may verify whether the user organization 100 is permitted to use the API in relation to the API used for the information inquiry request. Based on the identification information of the application (or app) of the user organization 100 or the user organization 100 permitted to use the API set for each API, the API is obtained from the user organization 100 that is not permitted to use the API. When a request is received, a verification process for rejecting the request may be performed.

The failure registration history verification unit 314 receives and stores information related to a temporary failure state related to the service of a specific API from each financial institution 400, and the API used for the request of the user institution 100 or the user is a failure. In the case of a service registered as a status, a verification process for rejecting an information inquiry request may be performed.

The transaction unique number verification unit 315 assigns a unique transaction number to each information inquiry request received from the user organization 100 or the user and manages it, and uses the processing result corresponding to each request as a response to the request to be provided to the institution 100 or the user. In addition, the transaction identification number includes a check digit calculated by a predetermined equation using other information of the information inquiry request as variables, and the check digit included in the information inquiry request is the transaction identification number verification unit 315 ), it is possible to prevent the information inquiry request from being made by a malicious user rather than a legitimate user by rejecting the business process if it is different from the check digit calculated by itself.

For the above verification, the management module 35 to be described later may store layout information related to each API, service status information, and information on the usage permission status of the user organization 100 . That is, the management module 35, the above-described validation module 31, the first communication module 1, the authentication server 32, the data conversion module 3 and / or the operation of the second communication module (2) It stores basic information necessary for

In an embodiment, the management module 35 includes the information DB 350 , the API management unit 351 , the customer management unit 352 , the metadata management unit 353 , the message and code management unit 354 , the log and It may include one or a plurality of functional units among the statistics management unit 355 and the monitoring unit 356 .

The API management unit 351, the current state of the service related to each API, or the application (or app) list of the user organization 100 and/or the user organization 100 permitted to use the API in relation to each API related information can be stored.

The customer management unit 352 may store information related to a customer who uses the information providing platform system 300 , that is, the user organization 100 . Processing of an information inquiry request received from the user organization 100 that does not use the information providing platform system or an application (or app) of the user organization 100 may be rejected.

The metadata management unit 353 stores various metadata included in the API-based information inquiry request, for example, an identifier of each financial institution 400 , an identifier of each user institution 100 , an identifier of each financial business process, and the like. .

The message and code management unit 354 serves to store the layout related to the information inquiry request through the API for each API, so that the information inquiry request can be verified based on the layout.

The information DB 350 is the information of personal credit information made through the information providing platform system 300, such as the information inquiry request received in the information providing platform system 300 and the personal credit information reception history from the financial institution 400. It serves to store all matters related to the inquiry history.

The log and statistics management unit 355 serves to generate log information and statistical information related to the use of a financial settlement network based on information stored in the information DB 350 . For example, statistical information related to the use of the financial settlement network includes information related to the transaction status such as the number or amount of financial business processing for each user institution, each user, and/or each API, or information that aggregates such transaction status. However, the present invention is not limited thereto.

The monitoring unit 356 serves to monitor the operation state of each functional unit of the data conversion module 3 and/or each other functional unit of the information providing platform system 300 and detect whether a failure or the like occurs. For example, the monitoring unit 356 may monitor the API being serviced to the user organization 100 to detect a failure, and notify the operator of the information providing platform system 300 when a failure occurs so that a quick response is possible. have.

The information provided by the management module 35 configured as described above may be processed into operational information by the portal support module 6 and transmitted to the portal server 200 through the first communication module 1 . The operation information transmitted to the portal server 200 can be inquired by the operator of the financial institution 400 that provides the My Data service, and through this, inquiry or control of usage by institution and/or API can be performed. . For example, the financial institution 400 that provides the My Data service can check the information usage for each user institution 100 by inquiring information on the portal server 200 using the API or check the transaction log. .

The operator of the information providing platform system 300 or the operator of the financial institution 400 may control the usage for each user institution and/or each API through the portal server 200 or set a threshold value for flow control. In addition, the operator of the information providing platform system 300 may verify the API for transmitting and receiving information between the user institution 100 and the financial institution 400 through the portal server 200 . In particular, in one embodiment, the portal support module 6 provides API verification information between a plurality of different user organizations 100 and a plurality of financial institutions 400 so that the My Data service provider can verify and test the API. environment can be provided.

4 is a flowchart illustrating each step of a process of processing user authentication in an information providing method according to an embodiment.

Referring to FIG. 4 , when a user 500 requests transmission of personal credit information to a user institution 100 such as a My Data service provider ( S201 ), the user institution 100 is a financial institution affiliated with the user institution 100 ( 400) A list of data holders may be provided to the user based on the information (S202). The user 500 may select the financial institution 400 corresponding to the personal credit information that he/she wants to inquire from the list of data holders received from the user institution 100 (S203). Next, the user institution 100 may request the information providing platform system 300 to inquire personal credit information for the financial institution 400 ( S204 ).

The information providing platform system 300 may perform the validation as described above with reference to FIG. 3 for the information inquiry request from the user organization 100 (S205), and transmit the verification result to the user organization 100 ( S205). For example, the user organization 100 transmits an authorization code issuance request including a service ID, a reply address (Redirect URI), status, etc. to the information providing platform system 300 when requesting an information inquiry, and the information providing platform system ( In 300), the service ID and status of the user organization 100 may be checked, and it may be verified whether the user organization 100 is authorized to use the platform. In addition, in the information providing platform system 300 , the user organization 100 may verify the reply address by checking whether the API address for receiving information is correct.

In an embodiment, the information providing platform system 300 may provide a web view for self-authentication of the user 500 who is a data holder prior to providing personal credit information. When the user organization 100 calls the authentication web view to the information providing platform system 300 (S207), the information providing platform system 300 provides a web view for self-authentication to the user organization 100, 500) without departing from the service of the user organization 100, allowing the user to input authentication information using the authentication web view (S209).

In the present specification, that the information providing platform system 300 provides a web view corresponds to a web view in the server of the user organization 100 or a user application (or app) for using the service of the user organization 100 . By accessing the address, it means that the user interface provided by the information providing platform system 300 is accessible. Accordingly, the device for accessing the web view may be a server of the user organization 100 or a user device such as a smartphone of the user 500 who uses the service of the user organization 100, and in this specification, the user organization 100 ) is intended to cover all of these uses.

The authentication information input by the user 500 through the web view is transmitted to the information providing platform system 300 (S210), and the information providing platform system 300 uses the received authentication information to the data holder financial institution 400 ) may request verification of a member (ie, a user) (S211). In this case, the member verification refers to a process of confirming whether the personal credit information of the user 500 , the data subject, is managed by the financial institution 400 , that is, whether the user 500 is a member of the financial institution 400 . do. The financial institution 400 may transmit the member verification result for the user 500 to the information providing platform system 300 (S212).

When the user 500 is a member of the financial institution 400 , the information providing platform system 300 requests the financial institution 400 for a list of personal credit information of the user 500 held by the financial institution 400 . (S213), a list of personal credit information of the user 500 held by the financial institution 400 may be received from the financial institution 400 (S214). Next, the information providing platform system 300 transmits a transmission request web view for the user 500 to select the information to be inquired from the received personal credit information list to the user organization 100 (S215), and the user ( 500) may select the information to be inquired by itself (S216).

The user 500 may also input details of consent to the provision of personal credit information in the process of selecting personal credit information to be inquired. The personal credit information selected by the user (eg, account list, etc.) and consent history information (eg, consent time, etc.) is transmitted to the information providing platform system 300 through the web view (S217), and the information providing platform system ( In 300), by transmitting this to the financial institution 400, the user 500 may request the financial institution 400 to inquire about the personal credit information selected (S218).

The financial institution 400 , which has been requested to inquire about personal credit information, may store the user's 500 transmission request consent information. On the other hand, the information providing platform system 300 generates an authorization code for the user organization 500 for the personal credit information for which the user 500 has completed consent (S219), and transmits the authorization code information to the user organization 100 ) can be sent to

In this case, the authorization code is a JWS-type access that allows a user using the service of the user organization 100 or the user organization 100 to access personal credit information inquired through the web view method through the information providing platform system 300 . It can refer to a token. In addition, the information providing platform system 300 may further transmit status information regarding whether the corresponding information can be inquired through the information providing platform system 300 when the authorization code information is transmitted. In this case, the status information means information on whether information selected by the user 500 can be inquired from the financial institution 400 through the information providing platform system 300 .

The user organization 100 may verify the authorization code information and status information received from the information providing platform system 300 , and if there is no problem in providing personal credit information, the authentication result may be provided to the user 500 . When the user 500 using the service provided by the user organization 100 receives an authentication result from the service application (or app) of the user organization 100, the user 500 receives personal credit information through the user device in which the application is executed. can be viewed.

In the information providing method according to the above-described embodiments, the information providing platform system 300 stores the layout of each information for inquiring personal credit information, and the received personal credit information is provided to the user 500 in the form of a web view. By providing the information, even when the authentication method or design required by the financial institution 400 holding the information is different, the personal credit information inquiry screen can be provided without modifying the original data.

In addition, in the information providing method according to the embodiments, the information providing platform system 300 performs a data flow control function in the external network (DMZ) of the financial institution 400 , so that the user institution 100 such as a my data operator Even when a large amount of information is requested, flow rate control is possible without affecting the legacy system of the financial institution 400 that is an information holding institution.

The threshold value for flow control can be set for each company and/or API service using the information providing platform system 300 , and the operator of the information providing platform system 300 or the operator of the financial institution 400 is the portal server 200 . ), you can set or change the threshold through the admin screen. As such, flow control is performed by comparing the amount of data transmitted and received through the first communication module 1 ( FIG. 1 ) serving as an API gateway in the information providing platform system 300 with a threshold value, and the threshold value is dynamically changed and It can be applied to control data flow without service interruption.

In an embodiment, the threshold value for flow control may be set differently for each type of web view provided to the user organization 100 . For example, referring to FIGS. 1 and 4 , in the information providing platform system 300 , there are two types of a web view for authentication of the user 500 and a web view for the user 500 to request transmission of personal credit information. Each of the web views is provided, but a threshold value for the user organization 100 to call each web view may be separately set.

At this time, when the amount of data transmitted and received with the user organization 100 exceeds the threshold (first threshold) set in the transmission request web view, the flow control module 4 calls the user organization 100 additionally calls the transmission request web view. When the flow control is executed to return an error response, the service user of the user organization 100 ( 500) can lead the inquiry request to the self-authentication stage and reduce the bottleneck of My Data service as much as possible.

The operation by the information providing method according to the embodiments described above may be implemented at least partially as a computer program and recorded in a computer-readable recording medium. The computer-readable recording medium in which the program for implementing the operation according to the method according to the embodiments is recorded includes all kinds of recording devices in which computer-readable data is stored. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device. In addition, the computer-readable recording medium may be distributed in a network-connected computer system, and the computer-readable code may be stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the present embodiment may be easily understood by those skilled in the art to which the present embodiment belongs.

Further, each block or each step shown in the flowcharts herein may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function(s). It is also possible for functions recited in blocks or steps to occur out of order in some alternative embodiments. For example, it is possible that two blocks or steps shown one after another may in fact be performed substantially simultaneously, or that the blocks or steps may sometimes be performed in the reverse order according to the corresponding function.

Although the present invention as described above has been described with reference to the embodiments shown in the drawings, it will be understood that these are merely exemplary and that various modifications and variations of the embodiments are possible therefrom by those of ordinary skill in the art. However, such modifications should be considered to be within the technical protection scope of the present invention. Accordingly, the true technical protection scope of the present invention should be defined by the technical spirit of the appended claims.

Claims (15)

As an information providing platform system,
a first communication module configured to receive an information inquiry request from a user organization and to provide personal information corresponding to the information inquiry request to the user organization;
a data conversion module configured to convert the information inquiry request into request data corresponding to the information retention organization, and to convert result data received from the information retention organization according to the request data into the personal information corresponding to the user organization; and
a second communication module configured to send the request data to the information retention organization and receive the result data from the information retention organization;
The first communication module,
a first web view for receiving the information inquiry request from the user organization through a preset API, and for the user organization transmitting authentication information for user consent to the provision of the personal information to the information retention organization; and The user organization is further configured to provide a second web view for viewing the personal information,
Each of the first web view and the second web view is configured by accessing addresses corresponding to the first web view and the second web view in the server of the user organization or a user device for using the service of the user organization. , for accessing the user interface provided by the information providing platform system within the service provided by the user organization,
The information inquiry request includes a request for issuing an authorization code including the service ID of the user organization and the reply address of the user organization,
The information providing platform system further configured to verify the service ID and the reply address, and to generate an authorization code for the user organization according to the personal information for which the user's consent for provision has been completed, and transmit it to the user organization.
delete According to claim 1,
Each of the request data and the result data is data in a professional format corresponding to the information holding organization,
The data conversion module provides information further configured to convert the information inquiry request received through the API into the request data in a message format, and convert the result data in the message format into the personal information to be displayed in a web view format platform system.
According to claim 1,
The request data includes an interface command to the standard database of the information retention organization,
The data conversion module converts the information inquiry request received through the API into an interface command for the standard database, and converts the result data read from the standard database into the personal information to be displayed in a web view manner. A more structured information provision platform system.
delete According to claim 1,
When the data amount of information received from the user organization through the first communication module or information provided to the user organization through the first communication module exceeds a preset threshold value per unit time, through the first communication module The information providing platform system further comprising a flow control module configured to control communication with the user organization.
7. The method of claim 6,
The flow control module is further configured to store the threshold value set corresponding to each of a plurality of the use organizations or a plurality of APIs used by the use organizations,
The threshold value is an information providing platform system that is separately set in each of the first web view and the second web view.
receiving, by the information providing platform system, an information inquiry request from a user organization;
converting, by the information providing platform system, the information inquiry request into request data corresponding to an information holding organization holding personal information;
transmitting, by the information providing platform system, the requested data to the information holding organization;
receiving, by the information providing platform system, result data from the information holding organization in response to the requested data; and
Comprising the step of providing, by the information providing platform system, the result data to the user organization as the personal information in a form that can be viewed by the user organization in a web view method,
Receiving the information inquiry request includes, by the information providing platform system, receiving the information inquiry request from the user organization through a preset API,
Before the step of transmitting the requested data to the information retention organization, the information providing platform system, a first web for the user organization to transmit authentication information for user consent to the provision of the personal information to the information retention organization further comprising the step of providing a view;
The providing to the user organization includes, by the information providing platform system, providing a second web view for the user organization to read the personal information,
Each of the first web view and the second web view is configured by accessing addresses corresponding to the first web view and the second web view in the server of the user organization or a user device for using the service of the user organization. , for accessing the user interface provided by the information providing platform system within the service provided by the user organization,
The information inquiry request includes a request for issuing an authorization code including the service ID of the user organization and the reply address of the user organization,
verifying, by the information providing platform system, the service ID and the reply address; and
The information providing method further comprising the step of generating, by the information providing platform system, an authorization code for the user organization corresponding to the personal information for which the user consent has been completed, and transmitting it to the user organization.
delete 9. The method of claim 8,
Each of the request data and the result data is data in a professional format corresponding to the information holding organization,
The converting into the request data includes, by the information providing platform system, converting the information inquiry request received through the API into the request data in the full text format,
The step of providing to the user organization includes, by the information providing platform system, converting the result data in a professional format into the personal information to be displayed in a web view format.
9. The method of claim 8,
The request data includes an interface command to the standard database of the information retention organization,
The converting into the request data includes, by the information providing platform system, converting the information inquiry request received through the API into an interface command for the standard database,
The step of providing to the user organization includes, by the information providing platform system, converting the result data read from the standard database into the personal information to be displayed in a web view manner.
delete 9. The method of claim 8,
When the data amount of the information provided by the information providing platform system to the information providing platform system from the user organization or provided from the information providing platform system to the user organization exceeds a preset threshold value per unit time, the information The information providing method further comprising the step of controlling the flow rate of data transmitted and received between the providing platform system and the user organization.
14. The method of claim 13,
The threshold value is set corresponding to each of the plurality of using organizations or a plurality of APIs used by the plurality of using organizations, and the information providing method is separately set in the first web view and the second web view.
A computer program stored in a computer-readable recording medium to perform the information providing method according to any one of claims 8, 10, 11, 13 and 14 in combination with hardware.

Images