KR20020061719A - Security settlement system of electronic commerce - Google Patents

Abstract

PURPOSE: A security payment system for the EC(Electric Commerce) is provided to prevent the payment information from being stolen by the hacking and being altered or forged and to maximize the security and the convenience by minimizing the loss of the unnecessary time and manpower at the time of buying a product. CONSTITUTION: The payment system connects to a customer(100), an Internet company(200), an EC system(300), a financial payment system(400) and a certification organization(500) through a network such an Internet network and an exclusive line or a PSTN(Public Switch Telecommunication Network). The user requests the purchase of the product and the affiliation to a site operated by the Internet company. The Internet company confirms the payment request and the payment processing result to the EC system, and generates and stores an intrinsic key for the present payment. The Internet company transfers the intrinsic key and a payment screen capable of inputting the payment contents of the payment information to a user's computer. The customer selects the transfer by inputting the payment information after confirming the payment contents.

Description

Security settlement system of electronic commerce

The present invention relates to a payment system in an electronic commerce, in particular, the customer's payment information encrypted with the customer's encryption key generated directly between the customer and the electronic payment system and electronically signed with an electronic certificate through a site operated by an Internet company By transferring the payment information encrypted with the encryption key to the electronic payment system, the payment system of the customer and the payment information of the Internet company are decrypted and compared with each other in the electronic payment system, thereby improving security and errors caused by obstacles such as communication lines. The present invention relates to a security system for electronic commerce that can be used more conveniently by allowing automatic repetitive transmission without re-entry even when it occurs.

In the conventional e-commerce payment system, when a customer enters a credit card or bank account number or account number and password of a customer's credit card or bank account, and pays the purchase price when the product is purchased, the Internet system provides a financial system. A system that directly processes payment using a leased line or through a brokerage system that relays payment with a financial system and processes the purchase price and delivers the payment result to an internet company is widely used.

However, the payment system as described above is transmitted to the financial settlement system by decrypting the customer's payment information in the Internet company or relay system even if the data is transmitted or encrypted or transmitted on the Internet as important information of the customer or the Internet company is input. Because of the high risk of being hacked or stealing important information by malicious, there is a big problem in safety.If an error occurs due to the failure of the public network during the transmission of the payment information, the information entered again and again is repeatedly entered. There is a problem in that the user consumes unnecessary time and manpower, and there is always a possibility of dispute because there is insufficient evidence to clearly verify the transaction details when a dispute occurs between a customer and a shopping mall operator or a payment system operator. .

The present invention has been made in order to solve the above problems, by encrypting the payment information entered by the customer to pass through the Internet payment system to the electronic payment system to decrypt and include the information required by the Internet company in the customer payment information electronic The customer's payment information is encrypted by using the electronic payment system and the customer's encryption key generated directly, and electronically signed by the customer's electronic certificate. As well as transfer to the payment system, by automatically waiting and repeatedly transmitted without having to re-enter the information entered in the event of an error, such as a communication failure due to communication network failure,

It is possible to prevent the theft of personal important payment information from being leaked by hacking or forgery or alteration of payment information, to clearly identify where the problem is in case of dispute, and to minimize unnecessary waste of time and human resources when purchasing products. It is an object of the present invention to provide a security payment system for electronic commerce that maximizes convenience.

1 is a block diagram showing the configuration of the present invention.

Figure 2 is a system flow chart at the time of payment of merchandise sales price of the present invention.

Figure 3 is an embodiment showing the configuration of the customer payment information input field of the present invention.

Figure 4 is an embodiment showing a payment information transmission field sent to the electronic payment system in the Internet company of the present invention.

Figure 5 is an embodiment showing a payment processing result transmission message input field transmitted to the Internet company in the electronic payment system of the present invention.

<Brief description of symbols for the main parts of the drawings>

100: customer 200: Internet company

300: electronic payment system 400: financial payment system

500: Certification Body

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of the present invention, Figure 2 is a system flow chart at the time of payment of goods sales price according to the present invention.

Payment between the customer 100 and the Internet company 200, the electronic payment system 300, the financial settlement system 400, and the certification authority 500 connected to a communication network such as an internet network, a dedicated line, or a public switch telecommunication network (PSTN) network. In the system,

Step (S101) in which the customer 100 applies to purchase a product or register at a site operated by the internet company 200;

Confirming whether the payment request and the payment processing result are received from the internet company 200 to the electronic payment system 300 for the payment related to the purchase or subscription of the product by the customer 100 (S201);

Generating and storing a "unique key" for the payment made by the Internet company (S202);

The payment details of the customer 100 including the "unique key" and the payment information (company ID, service type, amount, etc.) of the Internet company 200 may be input from the Internet company 200 to the computer of the customer 100. Transmitting a payment screen (S203);

Checking the payment history by the customer 100 and inputting payment information (account number, account password, password card number, etc.) to select transmission (S102);

"Customer decryption key" that allows security program installed in customer's computer to automatically connect with electronic payment system to encrypt and decrypt payment information and "Customer decryption key" that can extract "customer decryption key" from electronic payment system Creating a session ID &quot; and storing the session ID &quot;(S301);

A security program installed on the computer of the customer 100 electronically signs an electronic certificate and encrypts the payment information input by the customer using the "customer encryption key" to transmit the payment information to the Internet company 200 system ( S103);

The Internet company 200 receives the electronically signed payment information from the customer 100 computer and the "customer session ID" stored in the customer computer and retransmits the error in the event of an error. Temporarily storing the step (S204);

Generating and storing payment information including a "unique key" and payment information (company ID, service type, amount, etc.) generated for the settlement in the Internet company 200 system (S205);

The security program for the company installed in the Internet company 200 system is connected to the electronic payment system 300 to create and "exchange the company decryption key" that can encrypt and decrypt the payment information of the company (S302) )Wow;

The security program of the Internet company 200 system electronically signs the company's electronic certificate and, if necessary, encrypts the company's payment information using the "company encryption key" to electronically settle the payment information received from the customer and the "customer session ID". Transmitting to the system 300 and storing the transmission status in the "transmission status ledger" of the Internet company 200 system (S206);

In step S303, the electronic payment system 300 receives the payment information of the company, the payment information of the customer 100 and the "customer session ID" from the Internet company 200 system (S303);

Finding a "customer decryption key" with a "customer session ID" and decrypting customer payment information, and decrypting the company payment information with a "company decryption key" (S304);

The electronic payment system 300 checks the validity of the electronically signed customer payment information and Internet company payment information through the certification authority 500, and stores the payment information and payment information (S501);

(S305) comparing the payment information of the company included in the customer payment information with the payment amount, the Giro number, etc. related to payment among the company payment information directly transmitted from the company (S305);

The electronic payment system 300 transmits the decrypted customer's payment information to the financial settlement system 400 to request a payment and store the transmission state in the "payment status ledger" of the electronic payment system 300 (S306);

The financial settlement system 400 processes the payment request received from the electronic payment system 300 and transmits the payment processing result to the electronic payment system 300 (S401);

The electronic payment system 300 receives the payment processing result from the financial payment system 400 and stores the reception and processing status of the payment processing in the "Payment Status Ledger", and if necessary, electronically signs it with the electronic certificate of the electronic payment system. Encrypting the payment processing result with a "company encryption key" and transmitting the result to the Internet company 200 system (S307);

The Internet company 200 system decrypts the encrypted payment processing result received from the electronic payment system 300 with the "company decryption key" and checks the electronic certificate and stores the receipt and processing result in the "transmission ledger". (S207);

The internet company 200 is configured to transmit a payment processing result to the customer through an internal processing procedure according to a normal or error according to the processing result (S208).

On the other hand, when an error occurs in the flowchart of the present invention described above,

After the payment information of the customer 100 is transferred to the Internet company 200 system, when the customer does not receive the payment processing result due to a network or other obstacle between the customer and the Internet company 200 system, and requests a repayment processing, The Internet company 200 checks whether the payment processing result is notified from the electronic payment system 300 in the "Transmission Ledger" as a "unique key" that manages information on the stored customer payments, and receives the payment processing result. If received, the result is notified to the customer 100, and if not processed, the error history is notified to the customer 100 the processing result (S201 '),

If the payment processing result is not received, a step of extracting the generated "unique key" for this payment case (S201 '') is made and retransmitted to the electronic payment system 300,

After the payment information and payment information of the customer 100 is completed from the Internet company 200 system to the electronic payment system 300, the network or other obstacle is scheduled between the Internet company 200 system and the electronic payment system 300. If the Internet company 200 time system does not receive the payment processing information, the Internet company 200 system step of retransmitting the payment information and payment information of the customer 100 to the electronic payment system 300 (S206 ') and ;

The electronic payment system 300 transmits the customer's payment information received from the Internet company 200 system to the financial settlement system 400, and receives the result of the payment and transmits the payment processing information to the Internet company 200 system. Even if it was not possible, if a request for re-payment from the Internet company 200 system is received by the "unique key" received from the Internet company 200 system, the "payment status ledger" checks the transmission status and retransmits it to the financial settlement system 400 or If the payment processing information is received, the payment processing information is transmitted to the Internet company 200 system (S306 ').

In the present invention having the above-described configuration, the customer 100 refers to an actor who purchases goods or information by using the payment system of the present invention, and the Internet company 200 opens a site on the Internet to thereby obtain goods. Collectively, a group or an individual who seeks profit by selling or relaying a payment, and the electronic payment system 300 is built in addition to the computer system built in the bank, and the financial settlement system 400 is established in the existing financial institution. It is the collective name of account system, card approval, etc.

The payment system of the present invention including the configuration and flow as described above may use a variety of communication networks such as an internet communication network or a dedicated line, a PSTN network, and purchase goods, membership fees, such as the Internet, a mobile communication network, etc. using a computer or a mobile communication terminal. It is possible to apply the flow and security system of the electronic payment system of the present invention as all payment means in electronic commerce such as payment, electronic money, credit card authorization.

In addition, as shown in FIG. 3, the payment information input field transmitted from the computer of the customer 100 to the electronic payment system 300 is divided into an Internet company 200 area and a customer 100 area. ) Field includes a transaction classification field for selecting a payment method such as direct debit, instant electronic payment, and card approval,

Transaction segment field for input and storage of currency units (between Korean won, foreign currency, between Korean won and foreign currency, etc.) when registering and canceling direct debit,

Media classification field that distinguishes whether it is a transaction using a computer or a TV.

Company ID field that records the unique ID registered in the electronic payment system by the internet company, Transaction code field which gives the unique serial number "unique key" for the electronic payment when a transaction between the customer and the Internet company occurs,

Giro number field for entering the internet number of the Internet company, Payer number field for entering the customer number of the Internet company, Amount field for entering the transaction amount,

It consists of an encryption request item of internet company and a company item field that can be delivered to internet company after decryption in electronic payment system.

The customer area includes a payment account number field for inputting an account number of a payment account that pays a purchase price of a purchased product.

Account password field for entering the payment account password,

Password card serial number field for inputting the serial number of the password card issued by the financial settlement system for identification of payment transactions,

It consists of a password card password field for inputting a password of a password card issued by the financial settlement system.

Among the input screen fields of the present invention as described above, the area of the Internet company 200 is an area which the customer 100 cannot see on the screen, and the customer has a payment account number, an account password, and a password card password of the customer area displayed on the screen. Etc. can be described.

In addition, FIG. 4 illustrates a registration field of a payment information transmission specialist transmitted from the internet company 200 to the electronic payment system 300.

Header section consisting of transaction classification, transaction segmentation, media type, transmission date, transmission time, company ID, transaction code, customer management number, professional length, processing order, etc.

Company data department consisting of processing items, additional storage areas,

The encryption session key (customer session ID), the browser classification, the customer 100 is composed of a customer data portion consisting of input screen fields encrypted and transmitted to the Internet company 200.

In addition, FIG. 5 illustrates a field of a payment processing result transmission message transmitted from the electronic payment system 300 to the Internet company 200.

Header section consisting of transaction classification, transaction segmentation, media type, processing date, processing time, company ID, transaction code, customer management number, professional length, and processing order, and data section consisting of payment classification, company required item, and additional storage area. Wow;

It consists of the result data part consisting of customer name, processing item, and error content.

Each input field configured as described above may have a different configuration for each company.

The present invention payment system of such a configuration can be configured to add the customer's payment information input screen directly from the Internet company 200, it is possible to add the necessary items,

Enhances security and logically directly connects customers, Internet companies, and electronic payment systems, and solves hacking, forgery, and alteration problems in the Internet company's payment information relaying by using customers 'computers, and encrypts them from customers' computers. By comparing the payment information of the customer and the payment information that is defined and delivered by the Internet company can be prevented from changing the payment information from the input and payment information of the Internet company.

In addition, it is possible to check retransmission of unreceived payment result due to network or financial system failure by relaying customer's payment information from internet company, and to prevent double payment processing by managing only serial number according to customer goods purchase information. Therefore, it is possible to improve the safety of payment processing.

As described above, the present invention encrypts and decrypts information transmitted between a customer, an Internet company, and an electronic payment system, and in particular, the customer's payment information is encrypted using an electronic payment system and a directly generated customer encryption key. Payment information digitally signed with the certificate is not only delivered to the electronic payment system through the Internet company, but also the payment information digitally signed with the electronic certificate is verified and verified by the certification authority. By providing a solution even in the event of a network failure between a customer, an internet company, and an internet payment system.

It is possible to prevent personal information from being leaked and stolen by hacking, to clearly identify where the problem is, and to minimize waste of time and human resources when purchasing a product, thereby maximizing safety and convenience.

Claims (2)

In the payment system in which the customer 100 and the Internet company 200, the electronic payment system 300, the financial settlement system 400, the certification authority 500 is connected to a communication network such as an Internet network, a dedicated line or a PSTN network, Step (S101) in which the customer 100 applies to purchase a product or register at a site operated by the Internet company 200; Confirming whether the payment request and the payment processing result are received from the internet company 200 to the electronic payment system 300 for the payment of the product purchase or membership of the customer 100 (S201); Generating and storing a "unique key" for the payment made by the Internet company (S202); The payment details of the customer 100 including the "unique key" and the payment information (company ID, service type, amount, etc.) of the Internet company 200 may be input from the Internet company 200 to the computer of the customer 100. Transmitting a payment screen (S203); Confirming payment details by the customer 100 and inputting payment information (account number, account password, password card number, etc.) to select transmission (S102); A security program installed on the customer's computer automatically connects with the electronic payment system to encrypt and decrypt payment information, and the customer decryption key can be extracted from the electronic payment system. Creating a session ID " and storing the session ID "(S301); The security program installed in the computer of the customer 100 is electronically signed with the electronic certificate, and the payment information entered by the customer is encrypted by using the "customer encryption key" and electronically signed by the electronic certificate, and the payment information is internet company 200. Transmitting to the system (S103); The Internet company 200 receives the electronically signed payment information from the customer 100 computer and the "customer session ID" stored in the customer computer and retransmits the error in the event of an error. Temporarily storing the step (S204); Generating and storing payment information including a "unique key" and payment information (company ID, service type, amount, etc.) generated for the settlement in the Internet company 200 system (S205); The security program for the company installed in the Internet company 200 system is connected to the electronic payment system 300 to generate and "exchange the company decryption key" that can encrypt and decrypt the payment information of the company (S302) )Wow; The security program of the Internet company 200 system electronically signs the company's electronic certificate and, if necessary, encrypts the company's payment information using the company's encryption key and electronic payment of the customer's payment information and the "client session ID". Transmitting to the system 300 and storing the transmission status in the "transmission status ledger" of the Internet company 200 system (S206); In step S303, the electronic payment system 300 receives the payment information of the company, the payment information of the customer 100 and the "customer session ID" from the Internet company 200 system (S303); Finding a "customer decryption key" with a "customer session ID" and decrypting customer payment information, and decrypting the company payment information with a "company decryption key" (S304); The electronic payment system 300 checks the validity of the electronically signed customer payment information and Internet company payment information through the certification authority 500, and stores the payment information and payment information (S501); (S305) comparing the payment information of the company included in the customer payment information with the payment amount, the Giro number, etc. related to payment among the company payment information directly transmitted from the company (S305); The electronic payment system 300 transmits the decrypted customer's payment information to the financial settlement system 400 to request a payment and store the transmission state in the "payment status ledger" of the electronic payment system 300 (S306); The financial settlement system 400 processes the payment request received from the electronic payment system 300 and transmits the payment processing result to the electronic payment system 300 (S401); The electronic payment system 300 receives the payment processing result from the financial payment system 400 and stores the reception and processing status of the payment processing in the "Payment Status Ledger", and if necessary, electronically signs it with the electronic certificate of the electronic payment system. Encrypting the payment processing result with a "company encryption key" and transmitting the result to the Internet company 200 system (S307); Internet company 200 system decrypts the encrypted payment processing result received from the electronic payment system 300 with the "company decryption key" to confirm the electronic certificate and store the receipt and processing results in the "state of transfer ledger" (S207); In the Internet company 200, according to the processing result, the security payment system of the electronic commerce, characterized in that it comprises a step (S208) of transmitting the payment processing result to the customer through the internal processing procedure according to the normal or error. According to claim 1, After receiving the payment information of the customer 100 to the Internet company 200 system after the completion of the network or other failure between the customer and the Internet company 200 system customer is not notified of the payment processing result Upon request for repayment processing, the Internet company 200 checks whether the payment processing result is notified from the electronic payment system 300 in the "Transmission Ledger" as a "unique key" that manages information on stored customer payments. If the payment processing result is received and the result is notified to the customer 100, and if not processed, the error history to the customer 100 to notify the processing result (S201 '), If the payment processing result has not been received, a step of extracting the generated "unique key" for the present payment case (S201 '') is made and retransmitted to the electronic payment system 300. After the payment information and payment information of the customer 100 is completed from the Internet company 200 system to the electronic payment system 300, the network or other obstacle is scheduled between the Internet company 200 system and the electronic payment system 300. If the Internet company 200 time system does not receive the payment processing information, the Internet company 200 system step of retransmitting the payment information and payment information of the customer 100 to the electronic payment system 300 (S206 ') and ; The electronic payment system 300 transmits the customer's payment information received from the Internet company 200 system to the financial settlement system 400, and receives the result of the payment and transmits the payment processing information to the Internet company 200 system. Even if it was not possible, if a repayment request comes from the Internet company 200 system, it is re-transmitted to the financial settlement system 400 after checking the transmission status in the "Payment Status Ledger" as the "unique key" received from the Internet company 200 system. , If the payment processing information is received, the payment processing information is transmitted to the Internet company (200) system (S306 ') characterized in that the security payment system of the e-commerce.