KR20050045157A - Electronic payment system and method thereof - Google Patents

Abstract

The present invention relates to an MPI (Merchant Plug-In, MPI) hosting server, an MPI hosting system, and a method thereof. In applying a 3D secure system to an electronic payment system, an existing electronic payment system is added without adding a new device. For use, based on the transaction information and user authentication received from the user, issuing a token (CAVV), and transmitting the transaction information and token to the card company server to determine whether to approve the transaction.

Description

Electronic payment system and method

The present invention relates to an electronic payment system and a method thereof, and more particularly, to an electronic payment system and a method interoperating with an MPI (MPI) hosting server.

In general, electronic commerce means all business transactions made through the web or the Internet. Such electronic commerce is based on message transmission and electronic payment using the Internet. However, the importance of security determines the success or failure of electronic commerce because various information of users is transmitted through the open Internet.

The types of security applied to electronic commerce can be divided into access security, communication security, content security, and security management. This security consists of different solutions depending on the type of service. In particular, authentication, which is a type of access security that authorizes transactions, guarantees transactions, and blocks denial of transactions through accurate authentication, is one of the most essential components among security solutions applied to electronic commerce. A general electronic payment system to which such certification is applied will be described with reference to the accompanying drawings.

1 is a view showing a general electronic payment system.

As shown in the drawing, a terminal 100 for receiving a product type and user information from a user and encrypting each of them is transmitted to the payment server (PG: Payment Gateway), which transmits the encrypted user information. A mall server 110 for receiving the approval result of the user information from the user and transmitting the transaction approval to the terminal, a payment server 120 for decrypting the encrypted user information and transmitting it to a card company server to be described later; The card company server 130 determines whether to approve financial information based on the user information.

The operation of the electronic payment system configured as described above is as follows.

The terminal 100 receives the type of the product and the user information from the user and encrypts each of them. Preferably, only the personal information and the financial information are partially encrypted among the user information.

Mall server 110 receives the encrypted user information from the terminal 100 and simply transmits to the payment server 120 and receives the approval result of the financial information from the payment server 120 and transmits it to the terminal 100 do. Usually, the mall server 110 is operated by the side providing the shopping service.

The payment server 120 decrypts the encrypted user information and transmits the decrypted user information to the card company server 130. Preferably, the decoding is based on financial information. At this time, the payment server 120 and the card company server 130 is connected by a van (VAN) (not shown). In addition, when the approval result of the financial information is transmitted from the card company server 130 to the payment server 120, the settlement result is also transmitted with respect to the shopping information of the user in the van.

The card company server 130 determines whether the financial information is approved based on the user information and transmits it to the payment server 120, and the payment server 120 transmits it to the mall server 110. 110 determines whether the electronic payment according to the approval. At this time, the process of determining whether to approve financial information through the card company server 130 is called an authentication process.

However, this authentication process exposes the following problems.

First, it is the case that unauthorized use of financial information of others. In other words, the authentication process simply determines whether or not to approve financial information, and there is a problem that other people use it without their permission.

In order to solve this problem, a process of authenticating the identity through a 3D secure system has been introduced into the electronic payment system in place of the above authentication process. This will be described in detail with reference to the accompanying drawings.

2 is a view showing an electronic payment system according to the prior art.

As shown in the drawing, the electronic payment system receives payment information (for example, a product type, user information, and a card number) from a user and encrypts the terminal 200 and the encrypted payment information, respectively. Mall server 210 for transmitting the approval of the payment information from the payment server after transmitting to the payment server (PG: Payment Gateway) to be described later and transmitting the transaction approval to the terminal, and encrypted payment The payment server receives the decryption information and transmits the financial information to the directory server to be described later in order to find out the validity of the financial information such as the card number among the payment information input from the user and the card company server to be described later ( 230, the card company server 240 that determines whether to approve the financial information based on the user information, and the transaction that the user approves. Access control server (ACS) 260 for generating a predetermined token (CAVV) after separately performing user authentication for authentication, and connected to the access control server 260 to register for the user authentication. It is provided with a directory server 250 for checking whether or not to store the authentication result information or to validate the card number.

The terminal 200 receives payment information (eg, card information, product information, user information) desired by the user through a web page. In addition, for separate user authentication, the terminal 200 registers the user's official certificate or ID / password in advance in the directory server 250 or receives the user's official certificate or ID / password from the user and accesses the access. The control server 260 transmits.

Mall server 210 is usually installed in the shopping mall, and performs a function for transmitting the payment information to the payment server (230). In the case of a large shopping mall, the mall server 210 may be installed together with the payment server 230. In this case, the MPI 220 is installed in the payment server 230 and performs the same role as that installed in the mall server 210.

The payment server 230 transmits the payment information to the directory server 250 to check whether the payment information received from the user is valid, in addition to the function of transmitting the payment information to the card company server 240, and whether the payment information is valid. Receive sent. At this time, MPI (MPI: Merchant Plug-In, hereinafter MPI) 220 receives the payment information from the payment server 230 and transmits to the directory server 250 and receives the registration information for the payment information The payment server 230 transmits.

The directory server 250 is interlocked with the MPI 220 and the access control server 260. That is, upon confirmation of the validity of the payment information requested from the mall server 260, the directory server 250 checks whether the user is registered from the access control server 260 (that is, whether or not the token exists). The registration result is transmitted to the mall server 210. In addition, the directory server 250 stores information such as a request and response for authentication of the payment information.

On the other hand, the access control server 260 receives the payment information from the directory server 250 and confirms the registration, and then generates a predetermined token (CAVV) as a result of the registration whether the directory server 250 To transmit. In addition, the terminal 200 is connected to perform user authentication.

The operation of the electronic payment system according to the related art configured as described above will be described.

When a user makes a purchase and payment request through a predetermined website of the mall server 210, the mall server 210 receives payment information from the terminal 200 and transmits the payment information to the payment server 230. Then, the MPI 220 is activated and the MPI 220 transmits the payment information to the above-mentioned directory server 250 to confirm the validity of payment information (especially the validity of the card number) and registers the payment information. Receive or not. That is, the directory server 250 transmits the payment information to the access control server 260. Then, the access control server 260 determines whether the payment information is valid (that is, whether it is a valid card number) and transmits the result to the MPI 220 via the directory server 250.

Thereafter, if the card number is valid, the MPI 250 instructs the terminal 200 to authenticate the user. Then, the terminal 200 requests user authentication to the access control server 260 for the user authentication.

After receiving the user authentication request, the access control server 260 verifies whether the payment information of the user received from the terminal 200 is a legitimate owner of the payment information of the user, and responds to the user authentication. A predetermined token (CAVV) is issued and transmitted to the terminal 200. Then, the terminal 200 receives the token and transmits it to the MPI 220.

That is, the token is issued by the access control server 260 only when the user is authenticated. In addition, when authentication is not performed, only a predetermined error value is transmitted to the terminal 200. Then, the MPI 220 transmits whether the user authentication to the mall server 210.

The subsequent process is applicable only when the mall server 210 receives a token CAVV indicating that the user is authenticated from the MPI 220.

That is, the mall server 210 receives the encrypted payment information and tokens from the terminal 200 and transmits the received payment information to the payment server 230, and receives the approval result of the financial information from the payment server 230 and the terminal 200. To send).

In addition, the payment server 230 decrypts the encrypted user information and transmits only the token to the card company server 240. The card company server 240 determines whether to approve financial information based on the token and transmits it to the payment server 230, and the payment server 230 transmits it to the mall server 210 and the mall server ( 210 approves the electronic transaction. At this time, between the payment server 230 and the card company server 240 is connected to a van (Value Aided Network) (VAN) (not shown). In addition, when the approval result of the financial information is transmitted from the card company server 240 to the payment server 230, the settlement result is also transmitted with respect to the shopping information of the user in the van.

However, the electronic payment system according to the related art as described above has a problem in that the MPI installed in the mall server must be installed in all shopping malls and payment gateways. That is, since there are more than hundreds of shopping malls and payment servers in Korea, there is a problem in that a new MPI for user authentication is installed in each mall server or the cost of maintenance thereof is very large.

Accordingly, it is an object of the present invention to provide an electronic payment system and method for enabling the use of an existing electronic payment system without adding a new device in applying the 3D secure system to the electronic payment system.

In order to achieve the above object, the electronic payment system according to the present invention, the electronic payment using the credit card information received from the user, and the token (CAVV) to ensure that the transaction authenticated by the user for the electronic transaction In the payment system, at least one terminal receiving the credit card information, later receiving the token (CAVV) and transmitting to the mall server, and after confirming that the transaction is authenticated by the user connected to the terminal token (CAVV) At least one access control server (ACS) for issuing a card, and receiving credit card information and transaction information from the terminal and transmitting it to the access control server allows the access control server to connect with the terminal to authenticate a user for a transaction. The token is received from the access control server after user authentication is completed. It characterized in that it comprises a: (Merchant Plug-In MPI) empiahyi hosting server for transmitting to the end.

The terminal may further include a plug-in device for automatically transmitting credit card information input from a user and the token CAVV received from an MPI hosting server to the mall server.

The apparatus may further include a directory server for searching for the access control server between the MPI hosting server and the at least one access control server.

In addition, the electronic payment system according to the present invention, at least one to receive payment information from the user, later receives a token (CAVV) to ensure that the user approved the transaction from the outside to transmit the token (CAVV) to the mall server At least one access control server (ACS) for issuing a token (CAVV) after confirming that the transaction is authenticated by the user connected to the terminal, and credit card information and transaction information among the payment information from the terminal. MPI hosting that receives the input and transmits it to the access control server to allow the access control server to connect with the terminal to perform user authentication for the transaction, and receive the token from the access control server and transmit the token to the terminal after user authentication is completed. Payment form receives the credit card information and the token (CAVV) from the server and the terminal Mall server for transmitting to (PG), Payment server (PG) for receiving the credit card information and token (CAVV) from the mall server and transfers to the card company server processing credit card transfer, and the payment server (PG) The card company server that receives credit card information and tokens from the card company and sends the credit card information and tokens to a card company for transaction approval. It characterized in that it comprises a card company server for transmitting to.

The terminal may further include a plug-in device for automatically transmitting credit card information input from a user and the token CAVV received from an MPI hosting server to the mall server.

The apparatus may further include a directory server for searching for the access control server between the MPI hosting server and the at least one access control server.

In addition, the electronic payment method according to the present invention, in the electronic payment system for performing the electronic payment using the credit card information input from the user and the token (CAVV) to ensure that the transaction authenticated by the user for the transaction, And a second step of issuing a token (CAVV) based on credit card information and user authentication input from a user, and a second step of determining whether to approve a transaction by transmitting the credit card information and token to a card company server. It features.

The first step includes receiving credit card information from a user for transaction approval, transmitting the credit card information from the terminal to an MPI hosting server, and authenticating the credit card information from the MPI hosting server. Transmitting to the server, authenticating the user after checking the validity of the credit card information, issuing the token (CAVV) if the authentication passes, and transmitting the token (CAVV) to the MPI hosting server. And transmitting the encrypted token (CAVV) to the terminal from the MPI hosting server.

The second step may include transmitting credit card information and tokens (CAVV) from the terminal to the mall server, and transmitting the credit card information and tokens (CAVV) from the mall server to the payment server PG. And transmitting the credit card information and token (CAVV) from the payment server (PG) to the card company server, and transmitting the credit card information and token (CAVV) from the card company server to the card company server. After checking the credit card information and the token received from the server, it characterized in that it comprises a step of notifying the mall server through the card company server, payment server whether the transaction approval.

With reference to the accompanying drawings will be described embodiments in which the features of the present invention well shown.

3 is a diagram illustrating an electronic payment system according to a first embodiment of the present invention.

As shown in the drawing, the electronic payment system includes at least one terminal 300 which receives payment information from a user and later receives a token (CAVV) for ensuring that the transaction is approved by the user from the outside, and encrypts it; At least one access control server (ACS) 360 for issuing a token (CAVV) after confirming that the transaction is authenticated by the user connected to the terminal 310 and credit card information among the payment information from the terminal 300. And the transaction information is received and transmitted to the access control server 360 to allow the access control server 360 to connect with the terminal 300 to perform user authentication for the transaction, and after the user authentication is completed, the token. The MPI (MPI: Merchant Plug-In, hereinafter referred to as MPI) hosting server 350 which is transmitted from the access control server 360 and transmitted to the terminal 300, and from the terminal 300 The mall server 320 receives the credit card information and the token CAVV and transmits it to the payment server PG, and receives the credit card information and the token CAVV from the mall server 320 to transfer the credit card. Payment server (PG) 330 to be transmitted to the processing company, the payment server (PG) receives the credit card information and tokens from the payment server (330) through the payment server 330 to approve the transaction approval Mall server 320 There is provided a card company server 340 to inform.

The terminal 300 receives payment information from the user, and later receives a token (CAVV) that guarantees that the user has approved the transaction, encrypts them, and transmits the encrypted information to the mall server 320. In this case, input means (not shown) for receiving the payment information (eg, transaction information, user information, credit card information) is required. The input means is a means for electronic commerce, it may be implemented in the form of a web page. The apparatus may further include a plug-in device (not shown) that automatically transmits the payment information input from the user and the token CAVV received from the MPI hosting server 350 to the mall server 320. .

The access control server (ACS) 360 is connected to the terminal 310 and confirms that the transaction is authenticated by the user, and issues a token (CAVV). That is, the access control server 360 transmits a token (CAVV) to the terminal 300 by checking the validity and the owner of the certificate as a method of verifying the validity of the electronic signature. In this case, when a user registers an ID / password, the user receives a user password from the terminal 300 and authenticates the user. In addition, the authentication may be performed using the IC card included in the credit card, or authentication may be performed by applying a biometric method including fingerprint recognition and iris recognition.

The MPI hosting server 350 receives the credit card information and the transaction information among the payment information from the terminal 300 and transmits the credit card information and the transaction information to the access control server 360 so that the access control server 360 and the terminal 300 are connected. Connect to perform a user authentication for a transaction, and after the user authentication is completed, receives the token from the access control server 360 and transmits to the terminal 300.

The mall server 320 receives the credit card information and the token CAVV from the terminal 300 and transmits it to the payment server PG. The mall server 320 is usually installed in a shopping mall. At this time, unlike the prior art that has to be provided with the MPI 220 or payment server 230, the two devices are not required in the present invention.

The payment server (PG) 330 receives the credit card information and the token (CAVV) from the mall server 320 and transmits to the card company server 340 that processes the credit card transfer.

The card company server 340 receives the credit card information and the token from the payment server PG, checks the transaction, and transmits the transaction approval to the mall server 320 through the payment server 330.

At this time, the payment server 330 and the card company server 340 is connected to the van (VAN) (not shown). In addition, when the credit card information approval result is transmitted from the card company server 340 to the payment server 330, the settlement result is also transmitted with respect to the shopping information of the user in the van.

In addition, the mall server 320, the payment server 330, and the card company server 340, unlike the prior art transmits the information further includes a token (CAVV) in addition to credit card information.

The operation of the electronic payment system according to the present invention configured as described above is largely divided into two descriptions. That is, a description will be given by issuing a token (CAVV) based on the transaction information and user authentication input from the user, and determining whether to approve the transaction by transmitting the credit card information and the token to the card company server.

First, a step of issuing a token (CAVV) based on transaction information and user authentication input from the user will be described.

When a user makes a purchase or payment request through a predetermined website of the mall server 320, the payment information is transmitted to the MPI hosting server 350. Then, the MPI hosting server 350 requests the access control server 360 to confirm whether the user is a legitimate user.

Thereafter, the access control server 360 checks whether the payment information is registered in the authorized authentication system in response to the request of the MPI hosting server 350 and transmits the information to the MPI hosting server 350.

Then, the MPI hosting server 350, if the payment information is the information registered in the authorized authentication system, the access control server 360 generates a predetermined token (CAVV) and encrypts it, then the terminal Token 300 is transmitted to the token (CAVV).

However, if the information is not registered, the terminal 300 transmits an instruction to perform a procedure for registration in the authorized authentication system.

Meanwhile, the step of determining whether to approve a transaction by transmitting the payment information and the token to the card company server 340 will be described. This is similar to the conventional transaction approval process described in FIG.

That is, after the token is issued, the terminal encrypts the payment information and the token CAVV to the mall server 320 and transmits the encrypted information. Then, the mall server 320 transmits the payment information and the token (CAVV) to the payment server 330, the payment server 330 decodes the payment information and token (CAVV) card company server 340 To send). Thereafter, after checking the payment information and the token received from the card company server 340, and transmits the transaction approval to the mall server 320 through the payment server, the mall server 320 according to the approval Determine whether electronic payment is made.

4 is a diagram showing an electronic payment system according to a second embodiment of the present invention.

As shown in the drawing, the electronic payment system according to the second embodiment of the present invention includes the access control server 360 between the MPI hosting server 350 and the access control server 360 in the system of FIG. It further includes a directory server 370 for searching.

That is, when the financial institutions corresponding to the user's payment information input from the terminal 300 are different, the directory server 370 searches for the access control server 360 of the financial institution corresponding to the user's payment information. The payment information from the MPI hosting server 350 is transmitted.

As described in detail above, the electronic payment system according to the present invention has the following advantages.

First, since it continues to operate the Figure 1 and the conventional electronic payment system, there is an effect that can reduce the maintenance cost and operating cost of the MPI server and the labor cost. In addition, there is no need to expand the server even for an increasing number of shopping malls, and the mall server can be managed efficiently.

Second, only when the MPI hosting server is installed for the first time, the certificate is issued by requesting a certificate for a certification authority, and there is no need for the cumbersome work of installing it separately.

Third, when changing a card or adding a brand of a financial institution, there is no need for the hassle of changing the settings of each MPI.

Fourth, because MPI hosting server for the user authentication message, there is an effect that can reduce the individual DB operation and its cost.

Fifth, the mall server or payment server using the conventional MPI has the effect of minimizing the modification.

1 is a view showing a general electronic payment system.

2 is a view showing an electronic payment system according to the prior art.

3 is a diagram illustrating an electronic payment system according to a first embodiment of the present invention.

4 is a diagram showing an electronic payment system according to a second embodiment of the present invention.

Explanation of Major Codes in Drawings

300: terminal

310: mall server

320: payment server

340: card company server

350: MPI hosting server

360: access control server (ACS)

370: directory server

Claims (14)

In the electronic payment system using the credit card information received from the user and the token (CAVV) to ensure that the transaction authenticated by the user for the transaction, the electronic payment system, At least one terminal for receiving the credit card information and later receiving the token (CAVV) and transmitting it to a mall server; At least one access control server (ACS) for issuing a token (CAVV) after confirming that the transaction is authenticated by the user connected to the terminal; By receiving credit card information from the terminal and transmitting the credit card information to the access control server, the access control server connects with the terminal to perform user authentication for a transaction, and after the user authentication is completed, the token from the access control server. Electronic payment system characterized in that it comprises a MPI (Merchant Plug-In) hosting server for receiving and transmitting to the terminal. The method of claim 1, The terminal further comprises a plug-in device for automatically transmitting the credit card information received from the user and the token (CAVV) received from the MPI hosting server to the mall server. The method of claim 1, And a directory server between the MPI hosting server and the at least one access control server for searching for the access control server. At least one user terminal receiving payment information from a user and later receiving a token (CAVV) that guarantees that the user has approved the transaction, and transmitting the token (CAVV) to a mall server; At least one access control server (ACS) for issuing a token (CAVV) after confirming that the transaction is authenticated by the user connected to the terminal; By receiving credit card information and transaction information among the payment information from the terminal and transmitting the credit card information and transaction information to the access control server, the access control server connects with the terminal to perform user authentication for the transaction, and after the user authentication is completed, the token MPI hosting server receiving the transmission from the access control server to the terminal, A mall server that receives the credit card information and the token CAVV from the terminal and transmits the credit card information to the payment server PG; A payment server (PG) which receives the credit card information and the token (CAVV) from the mall server and transmits the credit card information to a card company server that processes credit card transfer; A card company server which receives credit card information and tokens from the payment server (PG) and transmits them to a card company for transaction approval; And a card company server for receiving and checking the credit card information and the token from the card company server and transmitting the transaction approval to the mall server through the card company server and the payment server. The method of claim 4, wherein The at least one terminal further comprises a plug-in device for automatically transmitting the credit card information received from the user and the token (CAVV) received from the MPI hosting server, automatically to the mall server. Electronic payment system. The method of claim 4, wherein And a directory server between the MPI hosting server and at least one access control server for searching for the access control server. The method of claim 4, wherein Electronic payment system, characterized in that the mall server and the payment server is integrated into one. In the electronic payment system using the credit card information received from the user and the token (CAVV) to ensure that the transaction authenticated by the user for the transaction, the electronic payment system, A first step of issuing a token (CAVV) based on credit card information and user authentication input from the user; And a second step of determining whether to approve the transaction by transmitting the credit card information and the token to the card company server. The method of claim 8, wherein the first step Receiving credit card information from the user for transaction approval; Transmitting the credit card information from the terminal to an MPI hosting server; Transmitting the credit card information from the MPI hosting server to an authentication server; Authenticating the user after checking the validity of the credit card information; Issuing the token (CAVV) when passing the authentication; Transmitting the token (CAVV) to the MPI hosting server; Encrypting the token (CAVV) and transmitting from the MPI hosting server to the terminal. The method of claim 9, wherein authenticating the user comprises: Electronic payment method characterized in that performing the authentication using a certificate. The method of claim 9, wherein authenticating the user comprises: Electronic payment method characterized in that performing the authentication using the ID and password. The method of claim 9, wherein authenticating the user comprises: The electronic payment method, characterized in that for performing the authentication using the IC card included in the credit card. The method of claim 9, wherein authenticating the user comprises: Electronic payment method, characterized in that for performing authentication by applying a biometric method, including fingerprint recognition, iris recognition. The method of claim 8, wherein the second step, Transmitting the credit card information and the token (CAVV) from the terminal to the mall server, Transmitting the credit card information and token (CAVV) from the mall server to a payment server (PG), Transmitting the credit card information and token (CAVV) from the payment server (PG) to the card company server; Transmitting the credit card information and token (CAVV) from the card company server to a card company server; And checking the credit card information and the token inputted from the card company server, and notifying the mall server whether the transaction is authorized through the card company server or the payment server.