KR20020016192A - E-commerce system capable of integratively confirming authentication together with a plurality of authentication organs and method for confirming the authentication the same - Google Patents

Abstract

PURPOSE: An EC(Electronic Commerce) system and a method for verifying a certification are provided to lower the cost of establishing an EC shopping mall system by making one verifying server verify the certifications of a plurality of certification organizations. CONSTITUTION: The shopping mall server(40) requests an encoded electronic signature to the purchaser through the purchaser computer(10) when the purchaser sends a purchase order and a payment information to the shopping mall server. The shopping mall server sends the coded information received from the purchaser to the certification verifying device(50a). The certification verifying device decodes the coded information, identifies the certifying organization issued the certification to the purchaser and sends the result to the certification verifying device of the each certifying organization(50b). The certification verifying device of each certifying agency requests and receives a publication key from the purchaser, and, by using the publication key, confirms the certification. The certification verifying device of each certifying agency sends the result of the certification verification to the shopping mall server.

Description

E-COMMERCE SYSTEM CAPABLE OF INTEGRATIVELY CONFIRMING AUTHENTICATION TOGETHER WITH A PLURALITY OF AUTHENTICATION ORGANS AND METHOD FOR CONFIRMING THE AUTHENTICATION THE SAME }

The present invention relates to an electronic commerce system capable of confirming authentication by interworking with a plurality of certification bodies and a method for confirming authentication in electronic commerce using the same.

In recent years, with the development of information and communication technology, electronic commerce that enables buyers to purchase goods using a terminal without visiting a store has been activated. In such an electronic commerce, the buyer pays the price of the goods online, so the buyer is issued a certificate from an authorized certification authority and makes an electronic payment. There are a plurality of authorized certification bodies, and each certification authority uses a different certification system. Accordingly, each e-commerce shopping mall is provided with the same number of authentication verification servers as the certification authority, so that one certification verification server is connected to one certification authority server corresponding thereto to confirm the purchaser's certificate.

However, according to the authentication verification method of the prior art as described above, since a plurality of authentication confirmation server is required for each e-commerce shopping mall, there is a problem that the cost required to build the e-commerce system is greatly increased.

The present invention has been made in an effort to provide an electronic commerce system capable of confirming authentication by interworking with a plurality of certification bodies and a method of verifying authentication in electronic commerce using the same in order to effectively solve the above-mentioned problems of the prior art.

1 is a block diagram showing an electronic commerce system that can verify the authentication in conjunction with a plurality of certification authorities according to an embodiment of the present invention.

2A to 2C are diagrams illustrating data stored in a comprehensive information management database and a format thereof by the shopping mall server of FIG.

FIG. 3 is a diagram showing data stored in a certification authority information database and its format by the authentication verification server in FIG.

FIG. 4 is a flow chart illustrating a method for verifying authentication in electronic commerce using the system in FIG.

FIG. 5 is a diagram illustrating a procedure of retrieving information stored in a certification authority information database in order to identify a certification authority that issued a certificate to a buyer in the flowchart of FIG. 4.

FIG. 6 is a schematic diagram showing an authentication confirmation procedure of a buyer according to the present invention using the system shown in FIG.

<Explanation of symbols for the main parts of the drawings>

1: Network 10: Buyer Computer

20, 22, 24: first to third authentication server 30: communication server

40: shopping mall server 50: authentication verification server

60: Comprehensive Information Management Database 70: Certificate Authority Information Database

One aspect of the present invention for achieving the object of the present invention relates to an electronic commerce system that can verify the authentication in conjunction with a plurality of certification authorities. The electronic commerce system of the present invention includes data storage means including a product information database for storing information on a plurality of products and a certification authority information database for storing information for a plurality of authorized certification authorities; When providing a plurality of product information stored in the product information database to the terminal of the buyer connected through the communication network, and receives a purchase order message for the predetermined product from the terminal of the buyer, the purchase order to the buyer A shopping mall server for requesting electronic signature and encryption to receive encrypted information from the buyer terminal, and confirming the purchaser's payment for the purchase order; And receiving the encrypted information of the buyer from the shopping mall server, verifying the certification authority that issued the certificate to the buyer by decrypting the encrypted information, and confirming the authentication of the buyer through the certification authority. Include a server.

Another aspect of the present invention for achieving the other object of the present invention relates to a method for authentication verification in electronic commerce. The authentication confirmation method in the electronic commerce according to the present invention comprises the steps of A) receiving a purchase order for a predetermined product from a terminal of a buyer connected through a communication network; Requesting an electronic signature and encryption for the purchase order from the buyer through the buyer terminal; C) receiving and decrypting the encrypted information of the buyer from the buyer terminal; Confirming a certification authority that issued a certificate to the purchaser using the decrypted information; E) requesting the buyer's public key by accessing a server of a certification authority that issued a certificate to the buyer through the communication network; And receiving the public key of the buyer from the server of the certificate issuing authority, and confirming the purchaser's authentication using the received public key of the buyer.

The objects, features and advantages of the present invention described above will be more clearly understood through the following detailed description taken in conjunction with the accompanying drawings. Then, with reference to the accompanying Figures 1 to 6 will be described in detail with respect to the electronic commerce system that can confirm the authentication in conjunction with a plurality of certification authorities according to the present invention and the authentication method in the electronic commerce using the same.

1 is a block diagram showing an electronic commerce system that can verify the authentication in conjunction with a plurality of certification authorities according to an embodiment of the present invention.

As shown in FIG. 1, the electronic commerce system according to the present invention includes a purchaser terminal 10, first to third authentication servers 20, 22, and 24, and a communication server 30 connected to the communication network 1. The authentication server connected to the shopping mall server 40, the authentication confirmation server 50, the comprehensive information management database 60 connected to the shopping mall server 40 and the authentication confirmation server 50 connected to the communication network (1) through An information database 70.

The purchaser terminal 10 is a purchaser's terminal issued a certificate from an authorized certification authority, and includes a computer 10, a personal digital assistant (PDA) 10a, an IMT-2000 terminal 10b, a mobile phone 10c, It may include a notebook computer (10d) and the like, this embodiment will be described by taking the computer 10 as an example. The buyer may transmit a purchase order message for a predetermined product to the shopping mall server 40 through the purchaser computer 10 and settle the price of the product. Further, the purchaser can receive the public key of the shopping mall from a predetermined authentication server using the purchaser computer 10, and encrypt the electronic signature using the received public key of the shopping mall when paying for the product price.

The first to third authentication server (20, 22, 24) is a server of an authorized certification authority that provides authentication services to the buyer, each of the authentication server (20, 22, 24) uses a different authentication scheme It issues a certificate to the buyer and stores the buyer's public key and the shopping mall's public key. Accordingly, each of the first to third authentication servers 20, 22, and 24 transmits the public key of the shopping mall requested from the purchaser computer 10 to the purchaser computer 10. In the present embodiment, three authentication servers 20, 22, and 24 exist, but are not limited thereto. In another embodiment of the present invention, two or more authentication servers may exist.

The communication server 30 has a built-in communication program, the purchaser computer 10 and the shopping mall server 40 and the first to third authentication server (20, 22, 24) and the authentication confirmation connected through the communication network (1) Interfaces messages and information exchanges between servers 50.

The shopping mall server 40 manages information stored in the comprehensive information management database 60, and is a server provided in the shopping mall to sell a product to a buyer connected through the communication network 1. The shopping mall server 40 provides information on a plurality of products sold to the purchaser computer 10 connected through the communication network 1, and receives a purchase order message of the buyer from the purchaser computer 10. Stored in the management database 60. The purchase order message of the buyer includes the name of the buyer, an identification number of the product, and the like. Then, the shopping mall server 40 receives the payment information for the purchase price of the product from the buyer computer 10 and stores it in the comprehensive information management database (60). In addition, the shopping mall server 40 requests the buyer to digitally sign and encrypt the payment in order to confirm whether the buyer is a legitimate buyer.

In this case, the shopping mall server 40 may be distributed to a plurality of means for performing only a specific function to facilitate processing of information and messages managed in the system of the present invention. In this embodiment, the shopping mall server 40 is connected to the communication server 30, the web means 40a for providing a web service, product information management means 40b connected to the web means 40a, sales information It is distributed to the management means 40c and the payment confirmation means 40d.

When the purchaser computer 10 is connected to the web means 40a via the communication server 30, the web means 40a stores the product information stored in the comprehensive information management database 60 from the product information management means 40b. Received and provided to the buyer computer (10). Subsequently, when the purchase order message of the buyer is received from the purchaser computer 10, the web means 40a transmits the received purchase order message to the sales information management means 40c, and the sales information management means 40c. ) Stores the purchase order message in the comprehensive information management database (60). Then, when payment information such as a card number, payment amount, etc. to be paid for the goods is received from the purchaser computer 10, the web means 40a transmits the received payment information to the payment confirmation means 40d. . At this time, the payment confirmation means 40d requests the buyer's computer 10 to digitally sign and encrypt the buyer to confirm whether the buyer is a legitimate buyer, and stores the buyer's payment information in the comprehensive information management database 60. .

Accordingly, the comprehensive information management database 60 stores information on a plurality of sales products, sales information on products sold to the buyer, and payment information on the purchase products of the buyer. In this case, the comprehensive information management database 60 may be distributed and managed in the product information database 60a, the sales information database 60b, and the payment information database 60c. When the comprehensive information management database 60 is distributed and managed as described above, the comprehensive information management database 60 can quickly process information and messages provided or requested from the shopping mall server 40.

2A to 2C are diagrams illustrating data stored in a comprehensive information management database and a format thereof by the shopping mall server of FIG.

Referring to FIG. 2A, the product information database 60a stores general information about a product such as a manufacturer, a price, a product name, a video image of a product, a product feature, a product identification number, and the like.

Referring to FIG. 2B, the sales information database 60b stores information on the products sold to the buyer, such as the name of the buyer, the identification number of the products sold, the quantity of the products sold, and the date and time of sale.

Referring to Figure 2c, the payment information database 60c stores the buyer's payment history for the goods sold, such as the buyer's name, card number to pay the goods price, payment amount, payment date, identification number of the goods sold, etc. do.

On the other hand, the payment confirmation means 40d transmits the encrypted information to the authentication confirmation server 50 when encrypted information is received from the purchaser computer 10. In this embodiment, the certification verification server 50 provides information on the certificate issuing authority from the certification authority verification means 50a and the certification authority verification means 50a to confirm the certification authority that issued the certificate to the purchaser. It is provided with a certification verification means (50b) for each certification authority to check whether the buyer is a legitimate buyer. Accordingly, the encrypted information of the buyer is transmitted from the payment confirmation means 40d to the certification authority confirmation means 50a. At this time, the certification authority checking means 50a decrypts the encrypted information of the buyer with the private key of the shopping mall and extracts the unique code number of the certification authority that issued the certificate to the buyer. Then, the certification authority checking means 50a sequentially compares the extracted unique code number of the certification authority with the information stored in the certification authority information database 70 to identify the certification authority that issued the certificate to the buyer, and The information on the confirmed certification authority is transmitted to the certification verification means 50b for each certification authority. Referring to FIG. 3, the certification authority information database 50b stores information about each certification authority, such as a certification authority name, an email address of the certification authority, a unique code number, and the like. The certification verification means (50b) for each certification authority requests and receives the buyer's public key from the server of the certification authority, and confirms whether the buyer is a legitimate buyer. And, the authentication verification means 50b for each certification authority transmits the verification result to the payment verification means 40d. If the verification of the purchaser is not confirmed, the certification verification means 50b for each certification authority is a communication server ( 30, the buyer computer 10 is notified of the authentication confirmation. In this case, the authentication confirmation server 50 can be confirmed by integrating the authentication of a number of buyers certified by a number of certification authorities.

FIG. 4 is a flow chart illustrating a method for verifying authentication in electronic commerce using the system in FIG.

As shown in Figs. 1 and 4, when a purchaser connects to the web means 40a using the purchaser computer 10, the web means 40a refers to a product to be sold to the product information management means 40b. Ask for information. At this time, the product information management means 40b withdraws the information on a plurality of products stored in the product information database 60a, and provides the buyer computer 10 with the product information extracted through the web means 40a. When the purchaser decides to purchase a predetermined product and inputs a purchase order message to the purchaser computer 10, the web means 40a receives the purchase order message of the purchaser from the purchaser computer 10 (S100). ). In this case, the web means 40a transmits a purchase order message to the sales information management means 40c, and the sales information management means 40c stores the purchase order message of the buyer in the sales information database 60b.

Then, the web means 40a requests the purchaser's payment information, such as a card number and a payment amount, to pay the purchase price to the purchaser computer 10, and receives payment information from the purchaser computer 10 (S110). . At this time, the web means 40a transmits the payment information of the buyer to the payment confirmation means 40d, and the payment confirmation means 40d stores the payment information of the buyer in the payment information database 60c.

In this state, the payment confirmation means 40d requests the buyer's computer 10 to digitally sign and encrypt the payment information through the web means 40a (S120). At this time, the purchaser uses the purchaser computer 10 to electronically sign, receive the public key of the shopping mall from the server of the certification authority that issued the certificate to the buyer, encrypt the electronic signature, and check the encrypted information. Send to 40d. Then, the payment confirmation means (40d) receives the encrypted information (S130), and transmits the encrypted information to the certification authority confirmation means (50a).

In this case, the certification authority verification means 50a decrypts the encrypted information with the private key in the shopping mall (S140), and extracts the unique code number of the certification authority that issued the certificate to the buyer from the decrypted information (S150). . Subsequently, the certification authority verification means 50a compares the extracted unique code number of the certification authority with the information stored in the certification authority information database 70 to confirm the certification authority that issued the certificate to the buyer (S160). In the present embodiment, since the first to the third certification authority uses a different authentication scheme, the checking step (S160) is the first to third identification code number of the extracted certification authority stored in the certification authority information database 70 A procedure of sequentially comparing the identification code number of the third certification authority is performed. In other words, as shown in Figure 5, by comparing the unique code number of the extracted certification authority and the unique code number of the first certification authority to check whether the two unique code numbers match (S162), the extracted authentication If the unique code number of the institution and the unique code number of the first certification authority do not match, it is determined whether the two unique code numbers match by comparing the extracted unique certification code number of the certification authority with the unique code number of the second certification authority. Check (S164).

Then, the certification authority verification means 50a transmits information on the certification authority that issued the certificate to the purchaser to the certification verification means 50b for each certification authority, and the certification verification means 50b for each certification authority is the verified certification authority. Request the public key of the buyer by accessing the server (S170). Subsequently, when the buyer's public key is received (S180), the authentication verification means 50b for each certification authority confirms the buyer's authentication using the buyer's public key (S190).

In the confirming step (S190), if the purchaser's certification is not confirmed, the authentication verification means 50b for each certification authority notifies the purchaser computer 10 of the purchase confirmation via the communication server 30 (S192). The verification result may be transmitted to the payment verification means 40d to perform the step S120 of requesting an electronic signature and encryption.

Figure 6 is a schematic diagram showing the authentication confirmation procedure of the buyer according to the present invention using the system in Figure 1.

As shown in FIG. 6, when a buyer transmits a purchase order message and payment information to the shopping mall server 40 using the purchaser computer 10, the shopping mall server 40 transmits the purchase order message to the buyer through the purchaser computer 10. Request digital signature and encryption. Subsequently, when encrypted information is received from the purchaser computer 10, the shopping mall server 40 transmits the encrypted information to the certification authority checking means 50a. At this time, the certification authority verification means 50a decrypts the encrypted information to confirm the certification authority that issued the certificate to the purchaser, and transmits the verification result to the certification verification means 50b for each certification authority. The certification verification means 50b for each certification authority connects to the server of the verified certification authority, requests and receives the buyer's public key, and verifies the authentication using the received buyer's public key. Subsequently, the authentication confirmation means 50b for each certification authority transmits the authentication confirmation result to the shopping mall server 40. As described above, in the present invention, it is possible to integrate and verify certifications from a plurality of certification authorities by using one certification verification server 50.

In addition, the above-described embodiments of the present invention may be written as a program that can be executed in a computer. And, using a medium used in a computer, it can be implemented in a general-purpose digital computer for operating the program. The medium may be a magnetic recording medium (for example, a ROM, a floppy disk, a hard disk, etc.), an optical reading medium (for example, a CD-ROM, a DVD, etc.) and a carrier wave (for example, Recording media such as, for example, transmission via the Internet.

An embodiment of the recording medium records an authentication confirmation method in an electronic commerce, A) module for receiving a purchase order for a predetermined product from a terminal of a buyer connected through a communication network; B) module for requesting the electronic signature and encryption for the purchase order to the buyer through the buyer terminal; C) module for receiving and decrypting the encrypted information of the buyer from the buyer terminal; A module for identifying a certification authority that has issued a certificate to the purchaser using the decrypted information; E) module for accessing the server of the certification authority that issued the certificate to the buyer through the communication network, requesting the buyer's public key; And a program code having an F) module for receiving the buyer's public key from the server of the certificate issuing authority and confirming the buyer's authentication using the received buyer's public key.

Functional modules for implementing the present invention as described above can be easily implemented by programmers with average knowledge in the technical field to which the present invention belongs.

Although the present invention has been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. . For example, in the above-described embodiment of the present invention, a plurality of certification authorities are shown and described as authenticating a user using different authentication schemes. However, when the plurality of certification authorities use the same authentication scheme, the unique authentication scheme is used. Simply extracting the code number identifies the certification body that issued the certificate to the buyer. In addition, in the above-described embodiment, the wired computer communication network has been described as an example of the communication network 1, but is not limited thereto. In another embodiment of the present invention, the personal mobile terminal 10a, the IMT-2000 terminal 10b, A wireless communication network used for communication of the mobile phone 10c, the notebook computer 10d having a wireless modem, or the like can be used. Therefore, the true technical protection scope of the present invention will be defined by the appended claims technical spirit.

According to the electronic commerce system of the present invention and the authentication confirmation method in the electronic commerce using the same, as described above, it is possible to confirm the authentication in a number of certification authorities using one authentication verification server, to build a system of the e-commerce shopping mall The cost of doing so can be significantly reduced.

Claims (9)

In the authentication confirmation method in e-commerce, A) receiving a purchase order for a predetermined product from the terminal of the buyer connected through the communication network; Requesting an electronic signature and encryption for the purchase order from the buyer through the buyer terminal; C) receiving and decrypting the encrypted information of the buyer from the buyer terminal; Confirming a certification authority that issued a certificate to the purchaser using the decrypted information; E) requesting the buyer's public key by accessing a server of a certification authority that issued a certificate to the buyer through the communication network; And Receiving the public key of the buyer from the server of the certificate issuing authority, and confirming the purchaser's authentication using the received public key of the buyer; Authentication confirmation method in the e-commerce, characterized in that it comprises a. According to claim 1, wherein step B) Receiving payment information including the card number of the buyer to be paid for the goods from the terminal of the buyer, and storing in the database. The method of claim 1 or 2, wherein step D) Extracting a unique code number of a certification authority that issued a certificate to the buyer from the decrypted information; And D2) step of detecting the certification authority having a unique code number matching the unique code number of the extracted certification authority by retrieving the unique code numbers for a plurality of certification authorities stored in the database Authentication confirmation method in the e-commerce, characterized in that it comprises a. The method of claim 3, wherein the step D2) And a one-to-one comparison of the extracted unique code numbers of the extracted certification authorities and unique code numbers for the plurality of retrieved certification authorities in sequential order. In the e-commerce system, Data storage means including a product information database storing information on a plurality of products and a certification authority information database storing information on a plurality of authorized certification bodies; When providing a plurality of product information stored in the product information database to the terminal of the buyer connected through the communication network, and receives a purchase order message for the predetermined product from the terminal of the buyer, the purchase order to the buyer A shopping mall server for requesting electronic signature and encryption to receive encrypted information from the buyer terminal, and confirming the purchaser's payment for the purchase order; And Receiving the encrypted information of the buyer from the shopping mall server, verifying the certification authority that issued the certificate to the buyer by decrypting the encrypted information, the authentication verification server for confirming the authentication of the buyer through the certification authority E-commerce system that can verify the authentication in conjunction with a plurality of certification bodies, characterized in that it comprises a. The method of claim 5, And a communication server connected to the terminal of the purchaser and a plurality of certificate authority servers through the communication network. The method of claim 5 or 6, wherein the authentication verification server Decrypting the encrypted information to extract the unique code number of the certification authority that issued the certificate to the buyer, by comparing the extracted unique code number of the certification authority with the information stored in the certification authority information database, the certificate to the buyer Certification authority verification means for confirming the certification authority that issued the; And Authentication verification means for each certification authority for accessing the server of the certification authority identified in the certification authority identification means through the communication network to confirm the authentication fact at the certification authority for the purchaser. E-commerce system that can verify the authentication in conjunction with a plurality of certification bodies, characterized in that it comprises a. The method of claim 7, wherein the shopping mall server Web means for providing the electronic commerce service through the terminal of the buyer connected to the communication means; Commodity information management means for transmitting information on a plurality of commodities stored in the commodity information database to the purchaser's terminal through the web means; Sales information management means for receiving a purchase order message for a predetermined product from the buyer terminal through the web means, and storing the received purchase order message in the data storage means; And Receive payment information including the card number of the buyer to be paid for the goods from the terminal of the buyer to store in the data storage means, receives the encrypted information of the buyer and transmits to the certification authority verification means Payment verification means E-commerce system that can verify the authentication in conjunction with a plurality of certification bodies, characterized in that it comprises a. In a recording medium recording a method for confirming the purchaser's certification in an e-commerce transaction, A) module for receiving a purchase order for a predetermined product from a terminal of a buyer connected through a communication network; B) module for requesting the electronic signature and encryption for the purchase order to the buyer through the buyer terminal; C) module for receiving and decrypting the encrypted information of the buyer from the buyer terminal; A module for identifying a certification authority that has issued a certificate to the purchaser using the decrypted information; E) module for accessing the server of the certification authority that issued the certificate to the buyer through the communication network, requesting the buyer's public key; And F) module for receiving the buyer's public key from the server of the certificate issuer and confirming the buyer's authentication using the received buyer's public key Recording medium recording the authentication confirmation program in the electronic commerce as a program code executable on a computer comprising a.