KR20000063481A - The card for internet e-commerce - Google Patents

Abstract

PURPOSE: A card for an internet electronic commerce is provided to solve an individual information security by using a CD card which enciphers credit card information and stores the information to a CD. CONSTITUTION: The front side of the card which may be used as a CD card and an IC card has a structure of a TC card as shown in Figure 1a, and the back side of the card has a structure of a CD card as shown in Figure 1b. The above-described next generation card is basically operated in a computer CD drive and includes a function of an IC card. Therefore, the card according to the present invention is used when the current card is changed from the CD card to the IC card for thereby building a stable electronic commerce transaction.

Description

Card for Internet e-commerce {THE CARD FOR INTERNET E-COMMERCE}

In general, the electronic payment system is classified into a network type electronic payment system and an IC card type electronic payment system. Currently, research on the electronic payment system is actively conducted at home and abroad. Network type electronic payment systems are mainly developed in the United States, and IC card type electronic payment systems are being developed in Europe. Network-type electronic payment systems are implemented entirely in software and can be distributed at low cost, but have security problems such as viruses and hacking. Also, since it is not mobile, it can only be used on computers with programs. On the other hand, the IC card type electronic payment system can use the IC card or smart card to carry out the encryption algorithm using the IC embedded in the card. I'm having a hard time. Currently, Korea is developing an electronic payment system using a relatively secure IC card rather than a network type consisting entirely of software. However, it is expected that it will take 4-5 years for commercialization because security algorithms and various standardization work for IC cards are delayed. In addition, IC card driver price is expensive and it is expected to take considerable time for it to be common to general users. Therefore, no clear plan for safe e-commerce on the Internet has been proposed.

In the case of Internet home shopping users, the card number and expiration date are directly input to the shopping mall by the method of paying for the goods purchased in the Internet electronic shopping mall, and the information in the shopping mall is connected by a dedicated line to check the credit of the credit card member again. It uses a method of sending a request to a carrier. This approach has the following problems.

First, if you only know information about another person's credit card number and expiration date, you can purchase as much as you want by using another person's credit card.

Second, there is a security problem because important information such as personal credit card information is transmitted unprotected.

Third, since Internet users must inform their credit card information every time they purchase something in a myriad of shopping malls on the Internet, malicious shopping personnel have a high probability of stealing credit information.

In order to solve the three problems presented above, we propose a secure payment system for electronic commerce on the Internet using the following method.

Firstly, next-generation cards are used to prevent leakage of information about credit card numbers and expiration dates. Secondly, the security problem raised is that the credit card information embedded in the next-generation card is encrypted and embedded using a secret key that only the cyber financial institution can decrypt, so that the information contained on the CD card cannot be decrypted by anyone other than the recorder. . In addition, when using a next-generation card as a CD card, the user authentication password is used to minimize problems that may occur when the CD card is lost and to perform a reliable payment process in an electronic shopping mall on the Internet. .

Third, in order to solve the problem of leakage of personal information about shopping malls pointed out as a problem in 1: 1 method between internet users and shopping malls, the payment method using cyber financial institutions, which is the third certification authority in the internet space, is used. By doing so, it aims to build a safer e-commerce environment.

Therefore, as a method for solving the problem in the conventional method operated as described above and secure payment in the Internet electronic shopping mall has the following originality.

(1) By proposing an electronic payment system using a CD card that encrypts the credit card information mounted on the magnetic credit card used in real life and stores it on a CD, it solves the information security problem caused by current electronic commerce on the Internet. In the future, it is possible to apply to the electronic payment system using the IC card that will be used for electronic commerce, thereby solving the information security problem caused by electronic commerce on the Internet.

(2) Unlike traditional payment methods, cyber financial institutions, the third certification authority on the Internet, are used to implement a safer and more reliable electronic commerce system.

(3) In order to protect important information such as credit card information, the following encryption algorithm is embedded in CD card and IC card.

① Authentication function for card users through password authentication

② Secret key encryption algorithm for credit card information stored in card

③ Security protocol using public key infrastructure, other national authentication infrastructure

(User Signature Algorithm and Cyber Financial Institution's Public Key Cryptography Algorithm)

(5) In accordance with the development and trend of information and communication, we propose a next-generation card that can be used in parallel with the IC card to be used in the future as a way to supplement the problems of the current e-commerce.

1 is a next generation card form.

2 is an operation of the electronic payment system using a next-generation card

2a, b is a security plan of the electronic payment system using the next-generation card (CD card)

Figure 2c is a security plan for banking using the next-generation card (CD card)

Figure 2d, e is a security scheme of the electronic payment system using the next generation card (IC card)

Figure 2f is a security plan for banking using the next generation card (IC card)

<Explanation of symbols for the main parts of the drawings>

10: Front of next generation card (IC card), 20: IC embedded in IC card,

30: Home made to work with the CD driver.

40: back of next generation card (CD card), 50: optical storage medium (CD)

The present invention devised to achieve the object as described above is largely configured as follows and described in detail by the accompanying drawings as follows.

(Description of Fig. 1)

Figure 1 shows the structure of the proposed next-generation card that can be used in parallel with the CD card and IC card, the front structure has the structure of the IC card as shown in (a), the rear structure of the CD card as shown in (b) It is in the form of a structure. As described above, the next-generation card should be basically configured as a structure that can be operated by a computer CD driver, and includes a function of an IC card to be spread in the future, so that it can be used without difficulty when converting from a CD card to an IC card.

(Description of the operation of Figure 2)

2 is an operation flowchart of the "electronic payment system on the Internet using the next-generation card", the user's card information and password for payment is directly transmitted to the cyber financial institution via the shopping mall, the user's card information and password Regarding matters that cannot be interpreted in a shopping mall, they are classified into six processes as follows. In each process, the operation of FIG. 2 will be described. Also, a case where a next-generation card is used as a CD card and an IC card is used for a security protocol applied for transmission security on the Internet as shown in FIGS. 2A, 2B, and 2C. Explain separately.

(1) When using next generation card as CD card

If the user uses the next-generation card as a CD card, the payment method through cyber financial institutions when purchasing goods in an Internet shopping mall (see FIGS. 2, 2A and 2B) and the banking processing method through cyber financial institutions (FIG. 2, see FIG. 2C). First of all, the payment method and security method through cyber financial institution when purchasing goods in the internet shopping mall are as follows.

① Next Generation Card Issuance Process:

A bank or credit card company can issue a next-generation card that can operate on the Internet against existing card members, or a cyber financial institution (hereinafter referred to as a bank, credit card company, or card issuer) that is a trusted institution on the Internet. Can be issued next-generation card.

In case of using next-generation card as CD card, cyber financial institution encrypts card information using its own secret key cryptographic algorithm to compensate for the problem of loss. Also, at the request of the user, the next-generation card encrypted by storing the credit card information is accessed online through the cyber financial institution, and the identity information and password are inputted, and the next-generation card is issued or applied and received offline, and the identity verification process is performed. After going through the next generation card is issued. The next generation card is issued online only to customers who have an existing magnetic credit card, and is issued through a simple identification process by the credit card company or bank. In addition, the next-generation card is equipped with a cryptographic algorithm using a public key method together with encrypted card information for the card member. It contains information on affiliated stores and products that can be used with the card under the agreement with other cyber financial institutions, and URLs and product information on related shopping malls. In addition, it can contain index information on various shopping malls that can be helpful to users and home shopping site information that can be accessed by clicking only. Also, card information files issued by various banks and credit card companies can be used for cyber financial institutions. Through the user can be issued to one integrated next generation card.

② Purchase Process in the Internet Shopping Mall:

A user accesses an internet shopping mall using a shopping mall URL embedded in a next-generation card, selects a product, adds a purchase price using a shopping cart, inputs information related to a purchase as a payment process, and then replaces an existing credit. Instead of inputting the card information, the encrypted file member information file and the password input file of the next generation card are encrypted and transmitted to the shopping mall by using the executable file provided in the next generation card. That is, the user encrypts the encrypted card information file embedded in the next-generation card and the password input by the user with the public key of the cyber financial institution, thereby constructing a package C1 that only the cyber financial institution can decrypt. In addition, C2 is generated by attaching information (purchase product information, user information, purchase price, etc.) to C1 to the shopping mall, encrypts it with the public key of the shopping mall, and generates a final ciphertext Y1 to be transmitted to the shopping mall.

③ Payment request process at shopping mall:

In the shopping mall, some of the information transmitted from the user is processed by the shopping mall, and the information about the shopping mall is added to the encrypted content to be transmitted to the cyber financial institution and transmitted to the cyber financial institution to request payment. That is, the shopping mall decrypts the information Y1 received from the user with the private key of the shopping mall to generate C2, and C2 is divided into information P1 to be delivered to the shopping mall and information C1 to be delivered directly to the cyber financial institution. Information required by the shopping mall (purchase product information, user information, purchase price) P1 is stored in its own DB and merges information related to the shopping mall (shopping mall information, payment price) to information (C1) that will be sent directly from the user to the cyber financial institution. Generate C3, encrypt it again with the public key of the cyber financial institution, generate Y2, and send it to the cyber financial institution.

④ Payment process at cyber financial institutions:

The cyber financial institution decodes the information (Y2) received from the shopping mall with its own private key to generate C3, and separates and extracts the information (P2) received from the shopping mall and the package (C1) directly received from the user. Shopping mall information and payment information (P ') is extracted from the information received from the shopping mall. On the other hand, the package (C1) received from the user decrypts by using its own private key, extracts the encrypted card information and password embedded in the next-generation card, the cyber financial institutions to extract the secret key used in connection with the next-generation card issuance Decode next-generation card information using By using the card information and password embedded in the next-generation card, it compares and confirms the contents recorded in the next-generation card user database, goes through the user verification process, connects to the bank or credit card company connected by leased line, and checks the credit Make a request.

⑤ Notification of payment to the shopping mall:

The cyber financial institution encrypts the result data received from the bank or credit card company through a private line with the public key of the shopping mall and transmits the result data to the shopping mall. At this time, as a result of the payment, the file (R) and Y2 received from the shopping mall are stored in the DB.

⑥ Notification of payment to the user:

The shopping mall extracts the result file R using its private key from the file received from the cyber financial institution, and stores R '. In the case of the "Approve" command, the user is notified that the payment or credit settlement is completed. In the case of the "Accept" command, an error message is sent to the user, and the transaction is not closed.

When the transaction is completed, the shopping mall issues an electronic receipt including a purchase price, an authorization number, etc. to the internet user in real time to generate R ', encrypts it with the user's public key, and stores the result file R'. The user decrypts the information transmitted from the shopping mall using his private key, and extracts the electronic receipt and purchase result data. The goods are delivered through the courier company, and in the case of a credit transaction, the purchase price is debited from the user's account to the shopping mall account from the next month's settlement date.

In the above process, when the user directly connects with the cyber financial institution to perform banking and payment processing such as wire transfer, account debit, etc., the processes of ②, ③, and ⑤ related to the shopping mall are omitted, and the user's card information and A password and bank transaction information are directly encrypted with a public key of a cyber financial institution and transmitted, and the cyber financial institution decrypts it and processes the financial business. Such an operation flowchart is indicated by a thick arrow in the figure of FIG. 2 and uses a security scheme as shown in FIG. 2C.

(2) When using next generation card as IC card

When a user uses a next-generation card as an IC card, the payment method (see Fig. 2, Fig. 2D and Fig. 2E) through cyber financial institutions when purchasing goods in an Internet shopping mall and the banking processing method through a cyber financial institution (Fig. 2, see FIG. 2F). First of all, the payment method and security method through cyber financial institution when purchasing goods in the internet shopping mall are as follows.

① Next Generation Card Issuance Process:

A bank or credit card company can issue a next-generation card that can operate on the Internet against existing card members, or a cyber financial institution (hereinafter referred to as a bank, credit card company, or card issuer) that is a trusted institution on the Internet. Can be issued next-generation card.

When using the next generation card as an IC card, the next generation card is used in the IC card driver installed in the computer. The credit card information of the user is securely stored in the next generation card.

② Purchase Process in the Internet Shopping Mall:

A user accesses an internet shopping mall using an internet web browser, selects a product, sums up a purchase price using a shopping cart, inputs information related to a purchase as a payment process, and then inputs existing credit card information. Instead, by inputting the next-generation card into the IC card driver and operating an encryption operation program, the credit card information is encrypted and transmitted to the shopping mall. That is, the user encrypts the card information file embedded in the next-generation card with the public key of the cyber financial institution to construct a package C1 that only the cyber financial institution can decrypt. In addition, C2 is generated by attaching information (purchase product information, user information, purchase price, etc.) to C1 to the shopping mall, encrypts it with the public key of the shopping mall, and generates a final ciphertext Y1 to be transmitted to the shopping mall.

③ Payment request process at shopping mall:

In the shopping mall, some of the information transmitted from the user is processed by the shopping mall, and the information about the shopping mall is added to the encrypted content to be transmitted to the cyber financial institution and transmitted to the cyber financial institution to request payment. That is, the shopping mall decrypts the information Y1 received from the user with the private key of the shopping mall to generate C2, and C2 is divided into information P1 to be delivered to the shopping mall and information C1 to be delivered directly to the cyber financial institution. Information required by the shopping mall (purchase product information, user information, purchase price) P1 is stored in its own DB and merges information related to the shopping mall (shopping mall information, payment price) to information (C1) that will be sent directly from the user to the cyber financial institution. It generates C3, encrypts it again with the public key of the cyber financial institution, generates Y2, and sends it to the cyber financial institution.

④ Payment process at cyber financial institutions:

The cyber financial institution decrypts the information (Y2) received from the shopping mall with its own private key to generate C3, and separates and extracts the information (P2) received from the shopping mall and the package (C1) directly received from the user. . Shopping mall information and payment information (P ') is extracted from the information received from the shopping mall. On the other hand, the package (C1) received from the user is decrypted using its own private key, extracts the encrypted card information embedded in the next-generation card, the cyber financial institution uses the secret key algorithm used in connection with the next-generation card issuance By deciphering the next generation card information, and comparing and confirming with the contents recorded in the next generation card user database, the user undergoes a verification process and connects to a bank or credit card company connected by a leased line to request credit inquiry and payment.

⑤ Notification of payment to the shopping mall:

The cyber financial institution encrypts the result data received from the bank or credit card company through a private line with the public key of the shopping mall and transmits the result data to the shopping mall. At this time, as a result of the payment, the file (R) and Y2 received from the shopping mall are stored in the DB.

⑥ Notification of payment to the user:

The shopping mall extracts the result file R using its private key from the file received from the cyber financial institution, and stores R '. In the case of the "Approve" command, the user is notified that the payment or credit settlement is completed. In the case of the "Accept" command, an error message is sent to the user, and the transaction is not closed.

When the transaction is completed, the shopping mall issues an electronic receipt including a purchase price, an authorization number, etc. to the internet user in real time to generate R ', encrypts it with the user's public key, and stores the result file R'. The user decrypts the information transmitted from the shopping mall using his private key, and extracts the electronic receipt and purchase result data. The goods are delivered through the courier company, and in the case of a credit transaction, the purchase price is debited from the user's account to the shopping mall account from the next month's settlement date.

In the above process, when the user directly connects with the cyber financial institution to perform banking and payment processing such as wire transfer, account debit, etc., the processes of ②, ③, and ⑤ related to the shopping mall are omitted, and the user's card information and Bank transaction information is directly encrypted with the public key of the cyber financial institution and transmitted, and the cyber financial institution decrypts it and processes the financial business. Such an operation flowchart is indicated by a thick arrow in the figure of FIG. 2 and uses a security scheme as shown in FIG. 2F.

In the present invention operating as described in detail above, the effects obtained by the representative ones of the disclosed inventions will be briefly described as follows.

In the case of Internet home shopping users, the card number and expiration date are inputted to the shopping mall as a payment method for the goods purchased in the Internet electronic shopping mall, and the shopping mall is sent to the information and communication company again to check the credit of the card member. I use a request method. This is a safety issue because important information such as card number and expiration date are delivered to the shopping mall in an unprotected state and then to an information and communication company. However, the payment method according to the present invention is as follows.

By installing the next-generation card and related software according to the present invention in a personal computer connected to the Internet, the encrypted data read from the next-generation card and the data related to the purchase are encrypted together by the payment method using the next-generation card, and thus, a third party, not a shopping mall. By transferring to the cyber financial institution, which is a trusting institution, the cyber financial institution can make payments, thereby providing a new payment method for secure electronic commerce in cyber space.

In addition, when the cyber financial institution is a bank, users can directly access and transmit encrypted files using next-generation cards. Therefore, the problem of the current electronic commerce is solved by using a CD card, and in the future by suggesting a next-generation card to use the IC card, it is possible to build a more secure electronic commerce.

Claims (3)

The proposed next generation card structure refers to a financial transaction card having both a CD card function and an IC card function. As shown in Fig. 1, the front of the next-generation card basically having the structure of a CD card is generally designed for advertisements. However, in this method, by installing an IC that can function as an IC card, the function of the IC card to be introduced in the future will be described. Means the card proposed to be parallel. This next-generation card is designed to solve the problems of the current e-commerce system on the Internet. It introduces a CD card that contains encrypted card information, a password and a signature algorithm, and utilizes the functions of the IC card that will be used in the future. Means the card installed. The back of the next-generation card is a card that is operated by using a CD driver attached to a computer, and is a method for an Internet user to purchase an item at an internet shopping mall and pay the bill. The present invention relates to a method of paying a purchase price by sending card information to a cyber financial institution without providing it. The main password and authentication method used in the method of the invention is that when an individual Internet user visits an Internet e-shopping mall and purchases a product on a web browser, the cyber financial institution uses the encrypted next-generation card information and the password file inputted by him for payment. By encrypting with the public key, the cipher text for the card information sent by the user is transmitted to the cyber financial institution via the shopping mall. At each stage, the countermeasure against the risks of eavesdropping and tampering by encrypting with the public key of the other party as a security measure for the transmission part through the Internet. In addition, when a user directly accesses a cyber financial institution and conducts a banking business, the card information and password of the user are directly encrypted and transmitted using the public key of the cyber financial institution, and the cyber financial institution decrypts it and processes the financial business. . The front of the next-generation card is a card that is operated by using an IC card driver, which will be installed as a basic specification in a future computer, and is a method for internet users to purchase goods and make payment in an internet shopping mall. The present invention relates to a method of paying a purchase price by sending credit card information to a cyber financial institution without providing card information to a shopping mall. The main encryption and authentication method used in the method of the invention is that when an individual Internet user visits an Internet e-shopping mall and purchases a product on a web browser, the encrypted next-generation card information is encrypted with the public key of the cyber financial institution for payment. The cryptography for the card information sent by the user is transmitted to the cyber financial institution via the shopping mall. At each stage, the countermeasure against the risks of eavesdropping and tampering by encrypting with the public key of the other party as a security measure for the transmission part through the Internet. In addition, when a user directly accesses a cyber financial institution and conducts a banking business, the card information and password of the user are directly encrypted and transmitted using the public key of the cyber financial institution, and the cyber financial institution decrypts it and processes the financial business. .