KR20010100750A - certification and payment device for m-commerce, system and method using the same - Google Patents

Abstract

The present invention provides an authentication / payment apparatus for mobile e-commerce in which a user number is automatically updated. First, the purchaser is provided with a user number by inserting a mobile electronic commerce authentication / payment device into a personal mobile terminal, and the mobile electronic commerce authentication / payment device is provided only when the entered password matches a previously stored password. If the user number is provided or if the user number is encrypted, the encrypted user number is decrypted and provided using the input password. Next, when the above verification number is requested from the seller's sales system (shopping mall, etc.) or payment for the user number is requested, the authentication / payment system receives the authentication / payment authorization for this user number and sends it to the sales system for commerce. Is finally done. In addition, by allowing another user number to be used for the next authentication / payment, even if the user number is obtained in an illegal manner, an effect which can fundamentally protect the user can be obtained.

Description

Certification and payment device for m-commerce, system and method using the same}

The present invention relates to a security / authentication module, and more particularly, to an authentication / payment apparatus, system, and method for mobile e-commerce (m-commerce) in which a user number is automatically updated.

Recently, with the development of information and communication technology and the explosive spread of global communication infrastructure such as the Internet, e-commerce is emerging as a new mode of economic activity that overcomes time and space constraints. As a result, countries around the world are promoting the activation of electronic commerce as a key means to strengthen their national competitiveness, and the Internet is now becoming a business battleground without borders.

The definition of Electronic Commerce (EC) can vary from many perspectives, but it supports and supports all commercial activities for buying and selling goods and services in cyberspace, such as the Internet, among individuals, businesses, and governments. It is common to define a set of actions that include activities that do.

The biggest advantage of e-commerce is that there is no time and space constraints, which saves you the hassle of going directly to the store, virtually no distribution costs, no rent, no inventory, and all Internet subscribers worldwide. It is likened to a high-tech golden fishery in that respect. In addition, e-commerce is a key means of dramatically improving the efficiency and transparency of the entire economy by reducing the distribution stage and drastically reducing transaction costs and recording and managing all transactions through a computer.

However, apart from the global use of e-commerce, the progress of e-commerce in Korea is minimal.

There are many reasons for the low utilization of e-commerce, but in the case of e-commerce (non-face-to-face transactions) on the Internet where customers and stores do not meet physically, e-payment transmits credit card information through an open network such as the Internet. For the Electronic Payment System, users in the regions that are more conservative than Westerners, and where the use of cash has been important, may point out that they are anxious about exposing personal credit information.

In fact, the biggest problem with e-commerce is protecting credit information efficiently. To this end, various payment methods such as prepaid card type, credit card type, deposit transfer type and electronic cash type are used, but fundamental user protection is impossible.

At present, there are attempts to standardize and strengthen the electronic payment security technology as a way to solve the user information security problem associated with the activation of electronic commerce, but this cannot be a fundamental solution when the credit card user number is exposed when using the electronic commerce. .

In this regard, FIG. 1 illustrates an online shopping mall purchase process using a Secure Electronic Transaction (SET) method in connection with a standardization method of an electronic payment security technology.

When attempting an existing e-commerce, a user accesses a shopping mall, enters a product name or a credit card number into an order on a browser, and then applies for a purchase. The credit card number and the order are encrypted with respective keys and transmitted to the shopping mall company (104). ), The encrypted order is decrypted using a corresponding decryption key at the shopping mall site (106), and the encrypted credit card number may be a credit card company (sometimes a VAN operator, in which case VAN or PG). (paymnt gateway) can be forwarded to the credit card company to the credit card company to request authorization (108).

The credit card company, which has received a request for approval in connection with the credit limit, decodes the credit card number using a decryption key corresponding to the encryption key to obtain the credit card number (110), and then, the credit related information about the number, etc. Search for and transmit the result of the approval request to the shopping mall company (112).

In the shopping mall, a series of electronic commerce is performed by displaying information to the buyer (116) regarding a transaction completion or inability to deal with the result of the approval request.

As can be seen in FIG. 1, data is necessarily encrypted in order to send and receive a purchase order or a credit card number on which personal information is currently described via the Internet. However, it is also a matter of privacy from the point of view that personal information is more than necessary to an unrelated agency, so only the shopping mall can use encrypted orders and only credit card companies can decrypt encrypted credit card numbers. Use

However, in addition to strengthening the security of personal information from this point of view, a separate plan must be prepared for the case where the hacking or credit card number is found in an unjust manner.

On the other hand, Figure 2 is an illustration of a case where the e-commerce through the Internet is hacked. Assuming a home, business, or PC, such as using an individual PC 202 to purchase goods or attempt banking via e-commerce, the information you want to transfer is not a leased line to a server 204 such as an e-commerce company or bank. If delivered over a network (eg, the Internet), it may be exposed to third parties 206 via the network.

Next, in connection with the user authentication of a credit card, a utility model has been recently applied for an "apparatus for authenticating a credit card user" (registration utility model No. 1999-23246) which can be used only by entering a password. In the above application, before the user uses the credit card, the user can authenticate himself or herself without using an external device by using the function of the user authentication device provided on the credit card itself, thereby preventing the use of the credit card by another person. Provide the device.

However, according to the contents disclosed by the above application, since the credit card number is fixed for each card and the fixed user number must be entered during the e-commerce process, the credit card user number is exposed to the other person so that the other person can use the user number during the e-commerce transaction. It is defenseless against fraudulent use to steal.

That is, when the card users enter the card user number in the e-commerce, the prior arts can be secretly peeped around an individual single-head machine such as a kiosk installed in a workplace, a stock room or a public place to be used for public use, or a hacking program. If a program such as the above is installed on a PC used for electronic commerce and the card user number is obtained and used, there is a disadvantage in that it cannot fundamentally prevent fraudulent use.

3 illustrates a card user number system utilized by an existing card company in relation to such a fixed user number.

Reference numeral 302 in Fig. 3 denotes BIN No. 1. A card unique identification number is shown, reference numeral 304 denotes a card-specific rating, and reference numeral 306 denotes a card type for distinguishing an individual or a corporation. Reference numerals 308 to 312 are components for indicating information about an individual, and reference numeral 308 denotes a personal identification number, and reference numeral 310 denotes a subscriber classification for indicating whether an individual or a family. And reference numeral 312 denotes an issuing order for indicating whether theft / loss is indicated. Finally, reference numeral 314 is the error identification number portion for number stealing or verification of any input attempt.

As can be seen from the above, in the existing card system, if a card number used in e-commerce is used, for example, a malicious third party does not try to find the last digit of the 16-digit number. There is a good chance that we can make a name in another person's name.

In order to make up for this shortcoming, an e-commerce transaction requires an individual to register as a member of the e-commerce company service while registering information such as a social security number, and encrypts this information together with payment approval request information to request approval and approval. The card company may use a method of confirming whether the card company matches the information of the card customer and granting the approval.

However, due to the fact that most of the current Internet users can use information about themselves arbitrarily in internet marketing, they avoid evaluating detailed information such as social security numbers when they register, even if they register and use it. The problem is that a malicious third-party can obtain all such material and steal it completely.

On the other hand, in relation to network security, a time-synchronized RSA Secure ID, a one time password (OTP) secure token, a secure card, a once ID, and the like are used for user authentication.

However, this method uses a separate terminal as a two-factor method, but the number displayed on the terminal for user authentication corresponds to a password. Thus, the function is limited to user authentication only. There is a problem that can not be.

Therefore, a technical problem of the present invention is to insert an authentication / payment card whose card user number is updated at each transaction into a detachable module type which can communicate with the portable terminal by inserting it into a data port of the portable terminal such as a mobile phone. A mobile electronic commerce authentication / payment apparatus or a card type mobile electronic commerce authentication / payment apparatus communicating with a mobile terminal through a connector inserted into a data port of a mobile terminal.

1 is a diagram illustrating an online shopping mall purchase process using a SET (Secure Electronic Transaction).

2 is an exemplary diagram of a case where e-commerce through the Internet is hacked.

3 is an exemplary diagram of a card user number system utilized by an existing card company.

4 is a schematic diagram showing a mobile terminal and an authentication / payment apparatus for mobile e-commerce according to a first embodiment of the present invention.

5 is a diagram illustrating a sequential flow of a payment method using an authentication / payment apparatus for mobile e-commerce according to a first embodiment of the present invention.

FIG. 6 is a diagram sequentially illustrating a procedure performed in the authentication / payment apparatus for mobile e-commerce according to the first embodiment of the present invention.

7 is an exemplary view of a screen displayed on a display unit of a user's portable terminal displayed by the control of the authentication / payment apparatus for mobile e-commerce according to the first embodiment of the present invention.

8 is a front view of an authentication / payment apparatus for mobile e-commerce according to a second embodiment of the present invention.

9 is an exemplary view of a screen that may be displayed on a display unit of a payment card according to a second embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

100: mobile terminal 101: data port

200: authentication / payment device for mobile e-commerce

218: interface 212: CPU 214: EEPROM

216: Clock unit 300: Card type mobile electronic commerce authentication / payment device

310: ASIC chip 320: connector

An authentication / payment device according to a feature of the present invention for achieving the technical problem,

A memory in which a plurality of encrypted card user numbers are stored;

A processing unit which reads one encrypted card user number from the memory in order according to a setting sequence every time a password is input, and then decrypts the read card user number based on the input password;

An interface for communicating with a data port of the portable terminal;

Wherein the display unit and the keypad display the decrypted card user number on the display unit mounted on the portable terminal, and input the password using the keypad mounted on the portable terminal.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

4 is a schematic diagram showing a mobile terminal and an authentication / payment apparatus for mobile e-commerce according to a first embodiment of the present invention. Reference numeral 100 denotes a portable terminal, 101 denotes a data port for data input / output of the portable terminal, 200 denotes an authentication / payment apparatus for mobile e-commerce, 218 denotes an RS232 interface, 212 denotes a CPU, 214 denotes an EEPROM, and 216 denotes a clock. Represents wealth.

In order to implement such an authentication / payment device for mobile e-commerce, the CPU inside the mobile terminal and the authentication / payment device for mobile e-commerce of the present application preferably have the same data protocol. In addition, when the internal voltage of the mobile phone and the voltage required by the CPU of the authentication / payment device for mobile e-commerce are different, it is obvious that a DC-DC converter or a regulator is required to adjust it.

In the authentication / payment card according to the embodiment of the present invention, as shown in FIG. 4, the CPU 212 communicates serially with an LCD and a keypad mounted on a portable terminal through an RS232 interface. To this end, the CPU according to the present invention adopts the same protocol adopted by each mobile terminal company, for example, the ESMS protocol (data format on the SK side) or the EIF protocol (similar to ESMS but based on the Internet).

When inserting an authentication / payment device for mobile e-commerce in which a user number is automatically updated into a data port of a mobile terminal and attempting to authenticate or pay, the user selects an authentication / payment function by operating a function button of the terminal. When the mobile electronic commerce authentication / payment device is inserted into the data port of the mobile terminal, a command (for example, SETLCD = 1) for obtaining the control right of the display unit (LCD) of the mobile terminal and a key input unit (key of the mobile terminal) A command for obtaining the control right of the pad (for example, SETKEY = 1) is automatically executed.

The terminal LCD displays an initial screen for authentication / payment, and a user inputs an authentication / payment device password for mobile e-commerce for authentication / payment.

Although the authentication / payment apparatus 200 for mobile e-commerce of FIG. 4 may include a CPU 212, an EEPROM 214, and a clock unit 216, respectively, a one-chip incorporating a CPU, an EEPROM, and a clock unit. It can also be implemented as a) MCU.

The keypad 102 mounted on the terminal is composed of a plurality of keys for inputting a password and the like, and the EEPROM 214 stores a pseudo card user number and basic CPU procedure information. In particular, a plurality of pseudo card user numbers are stored in the EEPROM 214, which are used sequentially according to the set order (named use order). The CPU 212 decrypts the pseudo card user number stored in the EEPROM 214 according to a set rule every time a password is input through the keypad 102 according to the clock signal provided from the clock unit 216, In particular, one pseudo card user number is sequentially read and decrypted in order of use among a plurality of pseudo card user numbers stored in the EEPROM 214 to generate a usable card user number. The display unit 103 mounted on the terminal displays the generated card user number so that the purchaser can use it.

In some cases, it is obvious that the EEPROM 214 may store a previous card user number (or encrypted personal identification information and time or step information) and the like to generate a card user number according to a set of rules.

5 is a diagram illustrating a sequential flow of a payment method using an authentication / payment apparatus for mobile e-commerce according to a first embodiment of the present invention. When a user registered as a member who can receive payment service of a payment system inserts a mobile electronic commerce authentication / payment device 200 into a data port of a terminal and inputs a password through the keypad 102 of the terminal, The CPU 212 of the authentication / payment device 200 for mobile e-commerce displays a usage confirmation message (in some cases, may be omitted) through the display unit 103 of the terminal, thereby allowing the user to authenticate / pay for mobile e-commerce. Check again whether the device 200 is to be used (S60 to S61). After confirming the user's use of the authentication / payment device for mobile e-commerce, the CPU 212 reads from the EEPROM 214 the pseudo card user number corresponding to the turn that should be currently used in the order of use, and then enters the secret entered. A card user number is generated by decrypting the number as a decryption key, and accordingly, the display unit 103 of the terminal displays the generated card user number (S62).

As described above, the mobile electronic commerce authentication / payment apparatus 200 performs a decryption process using the password as a decryption key to generate and display a card user number. The method may store the authentication / payment apparatus 200, compare the number input in the future with the stored password, and display the decrypted card user number if it matches.

When the card user number is displayed on the display unit of the personal mobile terminal communicating with the mobile electronic commerce authentication / payment apparatus 200 according to the password input, the buyer provides the card user number to the commerce system so that payment can be made ( S63). That is, when a purchaser purchases a product at a shopping mall site through a network, the purchaser's terminal transmits a card user number to a commerce system.If a purchaser purchases a product at a general card merchant, the card user number is provided to the merchant owner. Enter it into the commerce system, which is a card checker.

As such, the commerce system provided with the card user number from the buyer transmits the transaction details and the matters related to the card user number to the payment system through the network (S64). Here, the identification number assigned to the authentication / payment apparatus 200 for mobile e-commerce may be included among the data transmitted to the payment system.

The payment processing unit of the payment system receives the matters related to the card user number and the transaction details transmitted from the commerce system, and then determines whether the card user number to be used in the current transaction is matched according to the order of use (S65).

That is, the payment processing unit searches the issued information database based on the receiver identification number and corresponds to the turn to be used according to the order of use among the plurality of card user numbers assigned to the authentication / payment device for the mobile e-commerce of the buyer who requested the payment. Find one card user number to determine whether it matches the card user number sent from the commerce system (S65). If the two card user numbers do not match, notify the payment system of the card number re-entry (S66), and the two cards. If the user numbers match, the credit card number and transaction details of the card company matching the card user number are transmitted to the authentication system operated by the card company to request transaction approval (S67).

When the transaction approval is notified from the authentication system or the transaction approval is determined by itself, the transaction approval result is sent to the commerce system together with the card user number (S68 to S69).

On the other hand, if the payment system is notified of the transaction approval rejection from the authentication system or the transaction approval is rejected by itself, the payment system sends a message to the commerce system indicating that the transaction approval has not been performed together with the card user number to input the correct number. .

In this way, after notifying the approval result according to the payment request, the number issuing unit of the payment system records that the transaction is made once in response to the card in which the payment was made regardless of the approval result or, if approved, and is set in the next transaction. Use the card user number in the following order.

The procedure performed in the mobile electronic commerce authentication / payment apparatus is shown sequentially in FIG. 6.

In the mobile electronic commerce authentication / payment device 200 may not perform the step of selecting the type of card or company, the button input signal is input through the keypad 102 in the normal waiting step (S70) If the password is entered in (S71), and displays the use confirmation message via the display unit 103 to query whether or not to use again (S72).

Next, when the user presses the OK button (S73), the card is canceled again and is queried through the display unit 103 to be used next time (S74). If not, the entered password matches the stored password. Regardless of whether or not the card user number is decrypted, the card user number is decrypted by decrypting the pseudo card user number (pseudo card user number to be used in the current transaction in the setting order) stored in the EEPROM 214 with the inputted password as the decryption key. To generate (S75).

Next, if the password is the same as the stored password, the pseudo card user number is decrypted with the correct decryption key so that the card user number that can be authorized for the transaction is displayed on the display unit 103 (S76). If it is not the same as the stored password, the pseudo card user number is decrypted with the wrong decryption key, so that the card user number which cannot be authorized for transaction is displayed on the display unit 103 (S79). If you enter a password as a password, the card user number decrypted using these numbers, that is, a number that cannot be authorized, will be displayed. Therefore, damage by card number theft can be easily prevented.

On the other hand, the pseudo card user number may be sequentially decoded and displayed in order of use only when the password matches each stored password, and in this case, the password may be set to double to improve security.

As described above, the CPU 212 of the authentication / payment apparatus 200 for mobile e-commerce displays the card user number decrypted according to the password input on the display unit 103 of the terminal, and then after a certain time has elapsed, the card user. After the number display operation is stopped, the process returns to the standby state (S78). In some cases, steps S73 to S75 may be appropriately omitted depending on the modified embodiment.

FIG. 7 illustrates an example of a screen that can be displayed on a display unit of a user's portable terminal displayed by control on the authentication / payment apparatus for mobile e-commerce according to the first embodiment.

FIG. 7A illustrates a screen waiting for a password input for decrypting a user number, FIG. 7B illustrates a screen on which a password is input, and FIGS. 7C and 7D show a currently available card. The screen displayed on the display unit so that the user number is known to the user is shown.

Another example of an authentication / payment apparatus for mobile e-commerce according to the present invention is a structure having a separate connector inserted into a data port, and FIG. 8 illustrates authentication / payment for mobile e-commerce according to a second embodiment according to the present invention. Front view of the device. Reference numeral 100 denotes a portable terminal, 101 denotes a data port for data input and output of the portable terminal, 300 denotes an authentication / payment device for card type mobile e-commerce, 310 denotes an ASIC chip having a general card thickness, and 320 denotes a portable terminal and a card-type mobile device. Represents a connector for providing an interface between authentication / payment devices for electronic commerce.

The authentication / payment method of the authentication / payment apparatus for card-type mobile e-commerce according to the second embodiment is the same as that described in the first embodiment.

However, the authentication / payment apparatus for card type mobile e-commerce according to the second embodiment is different from the authentication / payment apparatus for mobile e-commerce according to the first embodiment. There is a connector 320 for providing an interface between the chips 310, it is possible to use a card form of a general standard, for example, ISO 7816 standard as the authentication / payment device for mobile e-commerce. Since the authentication / payment device for mobile e-commerce can have the same form as a general credit card form and can include a magnetic stripe, it is possible to read general card information recorded on the magnetic stripe at an ATM or CD terminal at the time of offline payment. . This password can be inserted into the connector 320 inserted into the mobile phone for the mobile e-commerce authentication / payment device to generate a password required by the ATM or CD terminal in the same manner as described in the first embodiment. have.

Since a password used in a general ATM or CD terminal requires 4 digits, the operation of the display unit of the authentication / payment apparatus for mobile e-commerce according to the second embodiment may have two selection modes unlike the first embodiment. desirable. Here, the password used for the ATM or CD terminal can be utilized by utilizing a specific four-digit number of the user number generated by using a user number generation algorithm that can be generated according to the present invention.

9 shows an example of a screen that can be displayed on the display unit of the payment card according to the second embodiment.

9A is a screen for allowing a user to select which number of a card user number and an ATM password required for online payment, and FIGS. 9B and 9C are for decrypting a user number. A screen in which a password is input, FIG. 9D shows a screen displayed on the display unit so that the user can know the currently available card user number. FIG. 9E shows a screen displayed on the display unit so that the user can know the currently available card user number.

The authentication / payment apparatus for card-type mobile electronic commerce according to the second embodiment may also implement a function of a normal electronic money by utilizing a communication function of a mobile phone. In other words, when an authentication / payment device for a card-type mobile e-commerce is inserted through the connector, a mobile phone with an Internet function can access a specific site that executes an electronic money service to purchase, charge or check balances. In addition, the balance may be transferred to another person's authentication / payment device for mobile e-commerce.

As described above, the present invention provides a mobile electronic commerce authentication / payment apparatus which can automatically update a user number after a transaction, so as to fundamentally solve personal credit information exposure, and insert it into a personal mobile terminal. to provide. According to the present invention, it is possible to fundamentally protect the card user even when the card user number is obtained in an illegal manner by allowing another card user number to be used at the next authentication / transaction.

In addition, not only can you be immediately notified of the authentication / payment status, but you can also receive information related to your current payment limit, so that you can use your card more smoothly. You can do this immediately and let the cardholder know about this immediately, thus avoiding any further losses.

As described above, in addition to the advantage that the card can be used safely by updating the user number when using the card that can be updated according to the present invention, as those skilled in the art in the above-described part can be seen in the omitted portion One card has the advantage that all authentication / payment related cards such as entire credit cards, bank cards, stock cards, department store cards, gas station cards, etc. can be integrated.

In addition, the authentication / payment device for mobile e-commerce according to the present invention can utilize the keypad portion and the display portion of the terminal necessary for the authentication / payment, the size of the module itself is more compact than the card, LCD and keypad of the terminal By using, the user has an advantage of more convenient authentication / payment.

In addition, the authentication / payment device for mobile e-commerce according to the present invention may have a card form of the ISO 7816 standard, the keypad and the display unit required through the magnetic stripe at the time of authentication / payment through the ATM or CD terminal of the terminal Since the size of the module itself is more compact than that of the card, the user can use the LCD and keypad of the terminal more conveniently.

Claims (1)

A memory in which a plurality of encrypted card user numbers are stored; A processing unit which reads one encrypted card user number from the memory in order according to a setting sequence every time a password is input, and then decrypts the read card user number based on the input password; An interface for communicating with a data port of the portable terminal; Wherein the display unit and the keypad display the decrypted card user number on the display unit mounted on the portable terminal, and input the password using a keypad mounted on the portable terminal. Authentication / Payment Device.