KR20020029450A - A method of electronic commercial transaction reinforced security - Google Patents

Abstract

PURPOSE: A method of electronic commercial transaction reinforced security is provided to effectively give security against the Trojan Horse hacking program by using a disposable connecting password. CONSTITUTION: The method comprises steps of a user using the services of a web site by inputting only the ID after connecting to the web site, the user requesting a disposable password assigning system to assign a disposable password before payment by inputting user recognition information to the disposable password assigning system via a telephone, the disposable password assigning system inquiring the user recognition information, generating a disposable password, and transmitting the disposable password to the user and the web site, and the user and the web site performing payment by using the disposable password.

Description

A method of electronic commercial transaction reinforced security}

The present invention relates to a security enhanced electronic commerce method.

Recently, as e-commerce using the Internet is rapidly expanding, security in electronic commerce has emerged as an important problem. Currently, as a security countermeasure in electronic commerce, a fingerprint recognition or a key method has been proposed, but it has not been widely used due to problems of facilities and inconveniences of consumers.

Therefore, at present, a method of encrypting information on a network or checking whether transmission contents on a network are leaked is mainly used. While these methods have some effect on the security of information on the network, they are not effective for the so-called "Trojan-type hacking programs" where hackers sneak into your computer and monitor your computer.

The Trojan-type hacking program is attached to a function that can completely remove all the contents input by the user on the computer, and if abused, it is inevitable to leak the user name (ID) and password entered when accessing a specific website. If the web site to which the user is connected is a web site that is important to the user, in particular, such as an e-commerce site or a securities site, the damage can be very serious.

For example, if a user connects to an online transaction such as a bank without knowing that the Trojan hacking program is installed on the user's computer, the user's access password may be leaked to hackers and cause financial damage to the user. Can be. Such damages are expected to intensify as e-commerce via the Internet becomes active. In particular, Trojan-type hacking programs have open source code and the finished programs are readily available on the Internet, and the potential risks are significant.

Another feature of these Trojan-type hacking programs is that they can be installed on a user's computer without their knowledge and are hidden from public programs on the Internet. As a result, the user is installed on the user's computer when running the open program without any doubt. If the Trojan-type hacking program is installed in the recent popular PC rental room, many users' password leakage is inevitable.

An object of the present invention is to provide an e-commerce method that can effectively respond to the Trojan-type hacking program.

The present invention is to provide an electronic commerce method that can effectively maintain the security even for Trojan-type hacking program using a one-time access password every time you connect. The present invention provides a method of accessing a specific web site for electronic commerce and then calling the one-time access password granting system immediately before the payment and receiving the one-time access password, and then using the same to conduct a one-time e-commerce transaction with the specific web site. do. The one-time access password grant system generates a one-time access password after inquiring the user's password, voice or image, and notifies the user and the web site by telephone.

1 is a block diagram of a system for implementing the present invention.

2 is a flowchart illustrating an operation of electronic commerce between a user and a web site using a one-time access password.

3 is a flowchart illustrating an application, generation, and notification of a one-time access password according to the present invention.

4 is a block diagram of an example of a speech recognition device used in the present invention.

※ Code explanation for main part of drawing

10: user 20: one-time access password grant system

30: Website 40: Telephone Network

50: Internet network 60: speech recognition device

11: user's phone 12: user's terminal

21: ARS server for one-time access password system

22: application of one-time access password system

23: database of one-time access encryption system

24: One-Time Access Password Generator 31: Web Server

32: Web Database

The electronic commerce method of the present invention for achieving the above problems, (i) the user 10 accesses the web site 30 and then inputs only the user's ID to use the service of the web site 30; (Ii) the user 10 inputting the user identification information by telephone to the one-time access password granting system 20 and applying for the one-time access password immediately before the payment; (Iii) inquiring the recognition information of the user 10 in the one-time access password grant system 20 and generating a one-time access password and notifying the user 10 and the web site 30 of this; (Iii) making a one-time payment with the one-time access password notified by the user 10 and the website 30; Characterized in that made.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 is a block diagram of a system for implementing the present invention largely user 10 phone and terminal, one-time access password grant system 20, Web site 30, the telephone network 40 connecting them to each other and the Internet network It consists of 50. The one-time access encryption system 20 is composed of an automatic response system (ARS) server 21, the application 22, the database 23 and the one-time access password generator 24, the website 30 is a web It is composed of a server 31, a database 32, a firewall, a controller, an application program, and the like.

The database 23 of the one-time access password granting system stores the user's recognition information, that is, a password, a voice, an image, and the like, so that the user can input the identification information.

The present invention made through the block configuration diagram configured as described above will be described with reference to the operation flowchart of FIGS.

First, the user 10 accesses the web site 30 as shown in FIG. 2, inputs only the user's ID, and uses the service of the web site 30. Next, if the user needs to pay the cost on the e-commerce, the user 10 inputs the user's identification information by telephone to the one-time access password grant system 20 and immediately applies for the one-time access password as shown in FIG. 3. The one-time access password system 20 generates a one-time access password after querying the input user recognition information, and stores it after notifying the user 10 and the website 30. In this case, the user's password, the user's voice or the user's image may be used as the recognition information of the user.

When voice is used as the recognition information of the user, various types of voice recognition devices may be used. As an example of the speech recognition apparatus, an A / D converter for converting an analog voice signal into a digital signal as shown in FIG. 4, a filter processor for filtering a 12-bit digital signal converted from the A / D converter into a channel, and noise from the filter processor A feature extractor for extracting a voice feature, a word boundary detector for determining start and end information of the voice signal based on the voice signal converted into the digital signal, and based on the voice feature and the start and end information of the voice signal. It is preferable to use a speech recognition device insensitive to external noise by providing an analysis processing unit for coding and outputting the final result through a time normalization and a classification process using neural networks.

The inquiry of the user recognition information uses the information stored in the database 23, and the one-time access password generator 24 is used to generate the one-time access password. It is more efficient to operate the one-time access encryption system 20 as an automatic answering system (ARS), and in order to reduce the burden on the user 10 and to activate the use, it is more preferable that the telephone charge is toll free. The one-time access password granting system 20 may be separately operated at each specific web site 30, but more preferably, it is more preferable to provide services to various web sites 30 while operating collectively by an independent service company.

Next, the web site 30 queries the input one-time access password and approves the payment. To this end, the one-time access password notified by the one-time access password grant system 20 is automatically temporarily stored in the database 32 of the website 30. The one-time access password is valid for payment between the user 10 and the website 30 only once in the current connection, and in case of re-connection after the type of connection, the new one-time access password must be used only in the e-commerce cost. I can make a payment.

As described above, the present invention does not need to input a real user's password on the network by generating and using a one-time access password for each connection through the telephone network. As a result, information is prevented from being leaked by the Trojan hacking program. In the case of executing the present invention, the one-time access password may be leaked by the Trojan-type hacking program, but the leaked access password is one-time, and if the user is already accessing, another person cannot access twice with the same access password. There is nothing wrong with maintaining security.

The present invention uses a one-time access password so that there is no need to enter a user's password on the network. As a result, information can be effectively prevented from being leaked by the Trojan-type hacking program.

Claims (3)

In the electronic commerce between the user 10 and the website 30, (i) the user 10 accesses the website 30 and inputs only the user's ID to use the service of the website 30; (Ii) the user 10 inputting the user identification information by telephone to the one-time access password granting system 20 and applying for the one-time access password immediately before the payment; (Iii) inquiring the recognition information of the user 10 in the one-time access password grant system 20 and generating a one-time access password and notifying the user 10 and the web site 30 of this; (Iii) making a one-time payment with the one-time access password notified by the user 10 and the website 30; Security-enhanced e-commerce method, characterized in that consisting of. The method of claim 1, wherein the one time access encryption system (20) is configured as an auto answering system (ARS). The method of claim 1, wherein the user recognition information is a user's password, a user's voice, or a user's image.