KR20080086733A - Finance trade system using a otp - Google Patents

Abstract

A financial transaction system using an OTP(One-Time Password) is provided to process financial transaction normally by using only the OTP without transferring financial information such as account or card information on the online network, and offer convenience by minimizing information needed for performing the financial transaction. A customer information storing module(420) stores financial transaction information of a customer and seed information generated based on the financial transaction information to a customer information database. An OTP authenticating module(450) authenticates an OTP by receiving customer ID and the OTP generated from a customer terminal through the network. A card payment processing module(460) processes payment by using the financial transaction information matched with the received customer ID depending on an OTP authentication result. A seed key generating module(430) generates a seed key for generating the OTP based on the financial transaction information inputted or stored when the customer requests issuance of the OTP. An application transmitting module(440) transmits the seed key to the customer terminal.

Description

Financial transaction system using OTP {FINANCE TRADE SYSTEM USING A OTP}

1 is an exemplary system configuration of a card payment system that is one of the financial transaction system according to an embodiment of the present invention.

2 is a diagram illustrating a program module configuration of an OTP generation application 120 installed in a portable customer terminal according to an embodiment of the present invention.

3 is a partial configuration diagram of a card payment system 400 according to an embodiment of the present invention.

4 is a flowchart illustrating a card payment process using an OTP according to an embodiment of the present invention.

The present invention relates to a financial transaction system, and more particularly, to a system for performing a financial transaction using a one-time password.

The most common financial transaction system is a card payment system and a phone banking or internet banking system in charge of account transfer and inquiry. Card payment was mainly used offline, but a lot of card payments are made online as the recent electronic commerce is activated. Phone banking and internet banking are also exploding.

For example, in the online payment processing process, a cardholder purchases an item through a shopping mall, and enters card information, more specifically, a card name, a card number, an expiration date, and a CVC as the payment method. request. The card information is transmitted to the card company through a van company, and the card company ends the card payment process by inquiring a credit approval process by referring to the transmitted card information. As a more reinforced solution, authentication of a card holder or input of a password may be added, but a description thereof will be omitted for convenience.

As described above, in the online card payment process, information such as card number, CVC, and card name is directly transmitted through a communication network, and thus, it is often exposed to malicious third parties by advanced hacking techniques.

Furthermore, in the existing online card payment process, since the card number, card name, CVC information, etc. are inputted, there is a disadvantage in that it is cumbersome because too much information is input in the card payment process. .

These problems and troubles are common problems in financial transaction systems such as phone banking or internet banking.

Accordingly, an object of the present invention is to solve the above problems, to provide a financial transaction system using OTP that can be normally performed using OTP without the online transmission of financial transaction information such as account information or card information. In the

Furthermore, it is to provide a financial transaction system using OTP to provide convenience for minimizing input information in performing financial transactions.

Financial transaction system using a one-time password (OTP) according to an embodiment of the present invention for achieving the above object,

A customer information storage module for storing seed key information generated based on the financial transaction information of the customer and the financial transaction information in the customer information DB;

An OTP authentication module for receiving the OTP generated by the customer terminal together with the customer identification information through the network and authenticating the OTP (One-Time Password);

And a financial settlement processing module for processing the financial settlement approval based on the financial transaction information of the customer having the customer identification information transmitted according to the OTP authentication result.

According to the above-described configuration, the present invention generates a seed key based on financial transaction information such as card information or account information and provides the seed key to the customer terminal, and the customer terminal uses the seed key to generate the OTP. By sending together to the financial transaction system, the financial transaction system generates an OTP using the seed key issued to the customer and compares it with the received OTP to process the financial settlement approval only if it matches. As financial transaction information is transmitted, it will have the effect of blocking the exposure of information that may occur in advance.

Furthermore, the financial transaction system using the OTP according to another embodiment of the present invention,

A customer information storage module for storing seed key information generated based on the financial transaction information of the customer and the financial transaction information in the customer information DB;

An OTP authentication module for authenticating the OTP by receiving the OTP generated by the customer terminal, the customer identification information and the password for financial settlement through a network;

And a financial settlement processing module for processing financial settlement approval by using the financial transaction information and the password of the customer having the customer identification information transmitted according to the OTP authentication result.

This system also transmits OTP and customer identification information through a communication network to identify financial transaction customers, and determines the authenticity of the customer by using a password, so that financial transaction information is securely compared to previous systems that transmit financial transaction information. There is a profit to protect.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, a detailed description of related known functions or configurations will be omitted. For example, a description of a card reader, a card reader method, a van (VAN) company, etc. required for card payment will be omitted. Further, the following card is assumed to include both prepaid and postpaid payment cards such as MS type credit cards as well as check cards. In the following description, the configuration and operation of the financial transaction system according to an embodiment of the present invention will be described in detail by assuming a card payment system.

1 illustrates a peripheral configuration diagram of a card payment system, which is one of financial transaction systems according to an embodiment of the present invention. The card payment system 400 according to an embodiment of the present invention may be, for example, a shopping mall server 300. ) Can be connected. The shopping mall server 300 performs a role of selling various goods online, and when a purchaser of a product selects a card payment, the shopping mall server 300 receives information necessary for payment and transmits the information to the card payment system 400.

On the other hand, buyers who are card holders purchase goods online through their computer 200 and perform payment using an OTP made based on prepaid or postpaid card information as a payment method. The mobile phone shown in FIG. 1 is used for generating an OTP as a wireless terminal (hereinafter referred to as a customer terminal) 100 used by an article buyer, that is, a cardholder.

Hereinafter, the configuration of an OTP generating application and an OTP card payment system installed and executed in the customer terminal 100 will be described in more detail with reference to FIGS. 2 and 3.

2 illustrates a program module configuration diagram of an OTP generation application 120 installed in a customer terminal 100 according to an embodiment of the present invention. The OTP generation application 120 is an application program issued from the card payment system 400 when, for example, a person who receives an MS type credit card requests issuance of a seed key for generating an OTP online or offline. .

For reference, the card payment system 400 uses an internal algorithm for determining the corresponding card information (card number, expiration date, CVC, card name) when the administrator requests the issuance of a seed key online or offline. Generates a seed key, and downloads the OTP generation application data including the seed key to the corresponding customer terminal. Of course, personal authentication will be required before seed key issuance, and the application will be downloaded via the mobile communication network. The seed key and the OTP generating application may be generated by one or more different entities and downloaded at different times.

2, the user interface module 140 first receives user identification information such as a social security number, a card password, or outputs display data such as an OTP. Provides a user interface screen for

The event index update module 150 updates the event index information every time the user logs in and requests the password update, and stores the event index information in the SEED storage unit 130. The event index information has a value of a serial number that is initialized to "0" at the first user login and increases by one every time an event occurs. When the specified value is reached, it is initialized to "0" again.

The OTP generation module 160 sets the updated and stored event index information and the stored seed key information as a hash function factor and then calculates a hash function value based on the one-way hash function f (x). Then, a single complete OTP is generated by combining the event index information (part of) with the calculated hash function value and displayed and outputted through the user interface module 140.

The OTP generation application 120 described above is an application that can be driven on the terminal virtual machine (VM) framework. In the present embodiment, the OTP is generated by setting the event index information and the seed key information as a hash function factor. However, the present invention may be implemented using a known algorithm that generates the OTP using the seed key. .

Hereinafter, an operation example of the OTP generation application 120 having the above configuration will be described.

First, the person who receives the card (hereinafter referred to as the card holder) requests a issuance of a seed key for generating an OTP by accessing a system designated by the card company (for example, a card payment system). The system receiving the seed key issuance request, for example, the card payment system 400, requests the cardholder's customer identification information (resident registration number) and the password of the issued card. This is to check whether the original card holder. If the request is issued by the original card holder, the card payment system 400 generates a seed key for generating the OTP based on the card number, CVC information, card name, and expiration date information issued to the card holder. The generated seed key is transmitted together with the OTP generated application data or only the seed key to the customer terminal of the card holder. Accordingly, the application 120 having the configuration as shown in FIG. 2 is installed in the customer terminal of the card holder. For reference, the seed key may be generated based on a predetermined algorithm, and the customer terminal information may use the stored customer information when the seed key is issued or stored. If only the seed key is transmitted from the card payment system 200, the OTP generating application may need to be transmitted from another system, for example, a telco server or a linkable server to use the service.

Hereinafter, the process of generating the OTP by the OTP generating application installed in the customer terminal will be described. In the following description, an OTP Generation Application (OTPGA) is defined as representing an OTP generation application 120.

First, a cardholder who purchases a predetermined item by accessing the shopping mall server 300 through the PC 200 selects a card payment as a payment method. According to the card payment selection, the cardholder is requested to transmit card information. The cardholder executes the OTPGA installed in his terminal. When the OTPGA is executed, the event index update module 150 initializes and updates the event index information to "0000" according to the initial user login. The event index update module 150 updates the event index information by one such as 0001, 0002,0003 for each subsequent event occurrence.

When the event index information is updated according to the occurrence of the event, the OTP generation module 160 sets the updated event index information and the stored seed key information as a hash function factor and then calculates a hash function value based on the one-way hash function. The OTP generation module 160 adds the updated event index information, preferably some information of the event index information, to the calculated hash function value to generate one complete OTP and display it through the user interface module 140. Output In the embodiment of the present invention, it is assumed that a ten-digit two-digit value of the serial number of the event index information is added to the OTP. Based on these assumptions, the calculation basis of the OTP information finally generated and displayed is as follows.

OTP = f (seed, event index info) * 100 + ((event index info) mod 100)

In the above formula, f (x) represents a one-way hash function for generating OTP. As a hash function, MD4, MD5, SHA, and the like can be used. The x value passed as an argument to the hash function is seed and event index information as in the above formula. For example, if the seed value is "1qaz", the event index is "1234", and the result of the hash function is "495724",

OTP = f (1 qaz, 1234) * 100 + (1234 mod 100) = 49572434 In other words, the OTP finally displayed and output is a value obtained by adding a hash function value of f (x) (called a hash function value) to the last two digits of the event index information.

When the OTP is generated and displayed as described above, the terminal user transmits OTP information and his / her customer identification information (eg, a resident registration number or his ID) obtained through the customer terminal to the shopping mall server 300 through the PC 200. Such information is transmitted to the card payment system 400 and used as information for card payment processing.

Meanwhile, when a new event such as an OTP update request occurs, the event index update module 150 updates the event index information updated to "0000" to "0001". When the event index information is updated according to the occurrence of the event, the OTP generation module 160 sets the updated event index information and the stored seed key information as a hash function factor and then calculates a hash function value again based on the one-way hash function. In addition, the updated event index information is added to the end of the value to generate a new OTP, and is output through the user interface module 140.

If there is an OTPGA termination request from the user, the event index update module 150 stores the current event index information in the SEED storage unit 130 and terminates the OTPGA according to the embodiment of the present invention. By storing the updated event index information, the stored next order value is updated with a new event index value when a later event occurs.

Hereinafter, the card payment system 400 performing card payment using the OTP information generated by the above-described OTPGA will be described.

3 illustrates a partial configuration of a card payment system 400 according to an embodiment of the present invention.

Referring to FIG. 3, the customer information storage module 420 stores the card information (card number, CVC, expiration date, card name, etc.) and seed key information of the card issuing customer in the customer information DB 470. That is, the customer information DB 470 stores the customer name, customer identification information, card information, seed key information, and the like.

Seed key generation module 430 is a seed key for OTP generation on the basis of card information (financial transaction information) stored in the input or customer information DB 470, if there is an OTP issuance request online or OTP issuance request through the administrator computer Create The generated seed key is transmitted to the terminal of the cardholder who has requested to issue the seed key, and is stored and managed in the customer information DB 470 by the customer information storage module 420.

The application transmission module 440 transmits the generated seed key and the OTP generated application data to the client terminal. At this time, it is assumed that the customer terminal means a portable terminal designated by the card holder. For reference, the OTP generated application data is stored in the system internal memory or in the application transmission module 440. In some cases, the application transmission module 440 may transmit only the seed key to the designated customer terminal.

Meanwhile, the OTP authentication module 450 receives the OTP generated by the customer terminal and the customer identification information through the network and authenticates the received OTP. The OTP authentication module 450 includes an event index information generation module for generating event index information added to the OTP transmitted from the customer terminal side. More specifically, it is preferable that the event index information generation module generates event index information having the event index information added to the authentication-requested OTP as an end point for fast search of the event index information and fast authentication of the OTP. For example, if the event index information added to the authentication-required OTP is "67" as the tenth unit information, the event index information having the index information, that is, the event index such as "3967", "4067", "4167", ... It is responsible for generating information.

Further, the OTP authentication module 450 sets a seed function generated by the seed key generation module 430 and event index information generated by the event index information generation module as a hash function factor to calculate a hash function value. The calculation module further includes an OTP comparison module for comparing the calculated hash function value with the hash function value included in the OTP transmitted through the network. The OTP comparison module requests generation of the event index information according to the OTP authentication result or transmits the authentication result to the card payment processing module 460 which is a financial settlement processing module.

The card payment processing module 460 transmits the card payment approval process to the customer having the customer identification information received from the card holder according to the OTP authentication result and transmits the result to the shopping mall server 300.

The customer information storage module 420, the seed key generation module 430, the application transmission module 440, the OTP authentication module 450, and the card payment processing module 460 described above are operating systems of the card payment system 400. It can be implemented as a single application that can be run on the 410 and may be broadly referred to as an OTP authentication and card processing unit.

Hereinafter, the operation of the card payment system 400 having the above-described configuration will be described with reference to FIG. 4.

4 is a flowchart illustrating a card payment processing using an OTP according to an embodiment of the present invention.

Referring to FIG. 4, first, the seed key generation module 430 generates a seed for generating an OTP based on a card number, CVC information, a card name, and an expiration date information issued to a corresponding card owner when a seed key issuing request is issued from the card owner. Generate a key (S1). The generated seed key is transmitted to the application transmission module 440, so that the application transmission module 440 transmits the OTP-generated application data including the received seed key to the customer terminal of the card holder who requested to issue the seed key (S2). .

In this way, the cardholder who has received the OTP generating application data to the customer terminal executes the application every time the card is needed to generate one OTP. Since the process of generating the OTP in the customer terminal has been described in detail in the operation description of FIG. 2, the description thereof will be omitted.

When one OTP is generated by executing an application installed in the customer terminal, the card holder inputs the generated OTP together with the customer identification information through the card payment site of the shopping mall server 300. This input information will finally be sent to the card payment system 400.

The OTP authentication module 450 in the card payment system 400 receiving the OTP and the customer identification information authenticates whether the received OTP is generated by a normal card holder. More specifically, the event index information generating module constituting the OTP authentication module 450 first generates event index information having the event index (EI) information added to the OTP requested for authentication as an end (S3). Event index information to be generated is reinitialized when the set maximum value is exceeded.

When the event index information is generated, the hash function calculating module calculates a hash function value (fx) by setting seed key information of the user who requested card payment and newly generated event index information as a hash function factor (S4).

After the calculation of the hash function value f (x) is completed, the OTP comparison module compares the calculated hash function value with the hash function value included in the transmitted OTP (S5). If the hash function value is different as a result of the comparison, the OTP comparison module requests generation of event index information, and the event index information generation module generates event index (EI) information having event index (EI) information added to the OTP again. That is, the OTP authentication module 224 generates the event index information until the hash function value calculated by using the newly generated event index information is the same as the hash function value included in the one-time password requested for authentication. In this case, the event index information having the event index (EI) information added to the authentication-requested OTP as a digit is generated.

If the above-described generation of the event index information and the authentication of the comparison of the hash function value are exemplified as specific values, the event index information previously stored for the user who requested the card payment is called “3940”, and the event index added to the transmitted OTP If the information is " 46 ", the OTP authentication module 450 generates a hash function calculated using the values generated while sequentially generating event index information such as "3946", "4046", "4146", .. The value is compared with the hash function value included in OTP.

When it is determined that the hash function value is the same in the comparison process (S6), the OTP comparison module transmits the comparison result to the card payment processing module 460 corresponding to the financial settlement processing module, and finally generates the event index. Requesting the storage of the information to the customer information storage module 420 (S7).

The card payment processing module 460 performs a general card payment approval procedure for the card possessed by the customer having the received customer identification information and transmits the result to the shopping mall server 300.

Accordingly, the cardholder who has requested a card payment can realize a credit card (check card) transaction online only by transmitting his or her identification information without transmitting specific card information such as card number and CVC information.

Therefore, the present invention can obtain the effect that can prevent the leakage of card information in advance online.

On the other hand, as another embodiment of the present invention is provided with a determination module for copying the OTP generation application can determine whether or not the OTP generation application (OTPGA).

That is, the OTP authentication application replication determination module compares the event index information used to obtain a hash function value that matches the hash function value included in the OTP input by the customer with the event index information stored in the customer information DB 470. . If the event index information used to obtain the hash function value that matches the hash function value included in the input transmitted OTP has a value smaller than the stored event index information for each user, any one OTP is illegally copied. It means that the generated by the OTP generating application, and passes the result of the determination to the OTP authentication module 450. Accordingly, the OTP authentication module 450 outputs the fact to the card payment processing module 460 or the manager terminal, which is a financial settlement processing module, or measures the copy fact to be notified to the customer terminal using SMS.

Therefore, the present invention also has the effect of detecting that the OTP generating program is illegally duplicated and double used.

Further, in the embodiment of the present invention, but do not enter the password of the card, the system may be configured to supplement the security weakness by additionally requiring the input of the password. That is, the OTP authentication module 450 in the card payment system 400 requires a user to input a password of a card issued to the user, and user authentication is normally performed only when the password matches the password provided by the user in the card issuing process. Can be considered complete.

In the above embodiment, the embodiment of the present invention has been described by exemplifying a card payment system as one of the financial transaction systems, but the present invention can be applied to a financial transaction system that performs account transfer and inquiry without any other modification. That is, when the seed key is generated based on the account information of the financial transaction customer, and the OTP is generated based on the seed key and transmitted along with the customer identification information to the financial transaction system, the financial transaction system authenticates the OTP and the result Depending on the transfer between accounts or provide account inquiry service. Accordingly, the risk of exposing financial transaction information such as account information online can be prevented in advance.

As described above, the present invention does not transmit financial transaction information such as card number, CVC information, specific card information such as expiration date or account information online, and the problem that financial transaction information may be lost due to hacking or the like. Has an effect that can be removed,

Furthermore, financial transactions can be made only by OTP transmission, and there is no need to input various financial transaction information.

On the other hand, the present invention has been described with reference to the embodiments shown in the drawings, which are merely exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. For example, in the embodiment of the present invention, the seed key generation module and the application transmission module are included in the card (financial) payment system for the purpose of understanding the invention, but the seed key generation module and the application transmission module are separately provided. It may be implemented to be included in the server so that the server and the card (financial) payment system interwork with each other to achieve the object of the present invention. That is, seed key generation and transmission are performed in the service server, and the card (financial) payment system receives the generated seed key, stores it for each customer, and authenticates the generated OTP using the seed key. It can be produced as a system. Therefore, the true technical protection scope of the present invention should be defined only by the appended claims.

Claims (10)

A customer information storage module for storing seed key information generated based on the financial transaction information of the customer and the financial transaction information in the customer information DB; An OTP authentication module for receiving the OTP generated by the customer terminal together with the customer identification information through the network and authenticating the OTP (One-Time Password); And a financial settlement processing module for processing the financial settlement approval based on the financial transaction information of the customer having the customer identification information transmitted according to the OTP authentication result. The seed key generation module of claim 1, further comprising: a seed key generation module configured to generate a seed key for generating an OTP based on financial transaction information of a customer input or stored at the time of issuing an OTP request; Application transaction module for transmitting the seed key to the customer terminal side; financial transaction system using the OTP further comprising. The method according to claim 1 or 2, wherein the OTP authentication module, An event index information generation module for generating event index information added to the OTP transmitted through the network; A hash function calculation module for calculating a hash function value by setting seed key information and generated event index information of a financial transaction customer as a hash function factor; A financial transaction system using an OTP, comprising: an OTP comparison module for comparing the hash function value included in the OTP transmitted through the network with the calculated hash function value. The financial transaction system using the OTP according to claim 1 or 2, wherein the financial settlement processing module performs financial settlement approval processing using one of financial information of card information or account information. The financial transaction system using OTP according to claim 2, wherein the application transmission module additionally transmits OTP generation application data to a customer terminal. A customer information storage module for storing seed key information generated based on the financial transaction information of the customer and the financial transaction information in the customer information DB; An OTP authentication module for authenticating the OTP by receiving the OTP generated by the customer terminal, the customer identification information and the password for financial settlement through a network; And a financial settlement processing module for processing financial settlement approval using the financial transaction information and the password of the customer having the customer identification information transmitted according to the OTP authentication result. The method according to claim 6, Seed key generation module for generating a seed key for generating the OTP based on the financial transaction information of the customer input or stored at the time of the OTP issuing request; And an application transmission module for transmitting the seed key and the OTP generated application data to a customer terminal. The method according to claim 6 or 7, wherein the OTP authentication module, An event index information generation module for generating event index information added to the OTP transmitted through the network; A hash function calculation module for calculating a hash function value by setting the seed information and generated event index information as a hash function factor; A financial transaction system using an OTP, comprising: an OTP comparison module for comparing the hash function value included in the OTP transmitted through the network with the calculated hash function value. The method according to claim 8, wherein the event index information generating module, A financial transaction system using an OTP, characterized in that it generates sequentially the event index information having the event index information added to the OTP transmitted through the network to the end. The financial transaction system using the OTP according to claim 6 or 7, wherein the financial settlement processing module performs financial settlement approval processing by using any one of the financial transaction information of the card information or the account information.

Images