KR20090118017A - Processing method for payment service using internet security based on high-density smart card - Google Patents

Abstract

PURPOSE: A processing method for payment service using internet security based on high-density smart card is provided to offer payment service through wire/wireless and mobile using an internet security technique instead of active-x. CONSTITUTION: A PC or browser of a terminal transmits the commodity information for payment to an SCWS(Smart Card Web Server) of a smart card. The SCWS makes the user authentication requesting HTML for the admission information creation request. The user authentication request HTML is transmitted to the browser. The browser receives the user authentication information by outputting the target page on a screen. The user authentication information is transmitted to SCWS. The SCWS carries out the verification using the user authentication information. The SCWS transmits the admission information to the browser by producing the admission information.

Description

Processing Method for Payment Service using Internet Security based on High-Density Smart Card}

The present invention relates to a processing method for a payment service using a large capacity smart card based Internet security.

With the development of the Internet, there is a tendency that the payment of the payment service using the Internet from a PC or a mobile terminal is increasing rapidly.

By the way, in the prior art Internet payment service (Fig. 1), a card reader for credit card payment is required in order to receive the Internet payment service, and an Active-X program for payment must be installed. However, due to the absence of a smart card reader, it is rarely used in practice and uses a weak and non-standard method such as credit card number input and SMS authentication.

However, the Internet payment service according to the prior art has the following disadvantages.

(1) Active-X-based security schemes are international non-standard, and payment service using mobile web that does not support Acitive-X cannot be provided.

(2) Maintenance is difficult because it is not independent of each device and operating system, and service cannot be provided on all devices and platforms.

(3) In addition to USB devices for banking services, there are inconveniences of possessing devices such as security cards and OTPs, and there is anxiety about leaking security contents.

(4) It uses PIN number or SMS authentication which is mainly used as authentication method between user and USB device. In this case, security is weak because it can be recognized by others through PIN number leakage and SMS authentication number hacking.

(5) There is a problem of compatibility by providing a non-standardized program for banking services, which does not provide a personalized user interface (UI) / user experience (UX).

(6) In order to pay the card using the Internet, it is inconvenient to carry a card reader separately, and non-standard payment methods such as card number input and SMS authentication are not used.

The present invention, in view of the above disadvantages of the prior art, provides a processing method for a payment service using a large-capacity smart card-based Internet security.

In order to achieve the above technical problem, the present invention is a processing method for making an Internet payment in a user PC or a mobile terminal,

Transmitting, by the browser of the PC or the terminal, product information to be paid to the SCWS of the smart card; Generating, by the smart card web server, a user authentication request HTML for the approval information generation request to the approval Applet in the smart card to the browser; Outputting the page to a screen by a browser to receive user authentication information and transmitting the same to SCWS; Performing verification by the SCWS to the approval Applet with the user authentication information, generating approval information, and transmitting the approval information to a browser;

Transmitting, by the browser, the approval information to the PG company or the purchaser for approval; PG company or purchaser transmits the approval result to SCWS; After the smart card processes the authorization result, and outputting the payment completion page to the browser.

Using the processing method for a payment service using a large-capacity smart card-based Internet security of the present invention, the following effects can be achieved.

(1) Since the use of a large-capacity smart card-based Internet security, it is possible to provide payment services via wired, wireless and mobile by using the Internet security technology based on international standards that replaces Active-X-based security.

(2) By providing web-based service using a large capacity smart card, it is possible to provide services independent of device, platform, and browser to users.

(3) In the prior art, it is possible to provide financial services such as banking, payment, and securities using mobile web, which have been limited in security due to security based on Active-X.

(4) By integrating Internet security, HSM, OTP, etc. into a single device called a large capacity smart card, users do not need to carry HSM, OTP, etc. devices more conveniently than using a separate security card. And provide security-enhanced services.

(5) For authentication between the user and a large capacity smart card, more secure biometrics such as fingerprint recognition and iris recognition can be used, thereby providing enhanced security compared to conventional PIN number authentication and SMS authentication. Can be provided.

(6) In order to provide a payment service, a web-based program is provided in a large capacity smart card, and the user's personal financial information is not stored in another device, thereby providing a security enhanced service.

(7) The user can set the web-based personalized UI / UX and store it in a large capacity smart card, so that the user can always provide the personalized UI / UX to the user.

(8) Since a large capacity smart card-based card payment service is provided, a card reader is not required separately and it is possible to provide a service that is more convenient and secured than a conventional payment method.

Now, the operation according to the configuration of the present invention will be described in detail with reference to the drawings.

Figure 2 also shows the configuration of a large capacity smart card used in the present invention.

Large-capacity smart card of the present invention, COS (Card Operating System), SCWS (Smart Card Web Server), OPT (One Time Password), HSM, Certified, Web-based to support Multi-Thread, Multi-Processing and USB interface It is composed of the application (Web Application), the application program (Applet), etc. to support the application-based service platform. In addition, secure data can be transmitted via PSK-TLS secure sessions.

In addition, by using SCWS-based Internet security module, not Active-X-based, and integrating HSM and OTP-related applications, it is possible to provide payment service with enhanced security based on large-capacity smart card and user's personalized integrated UI / UX Provision is possible.

In addition, in the case of a mobile environment, a USIM-type large-capacity smart card for mobile can be used, thereby providing an integrated UI / UX that is not dependent on the terminal platform.

3 illustrates a case where a user uses a HSM type smart card and a USIM type large capacity smart card together. The figure on the left shows the connection of a smart card for banking and payment services, such as banking and payment, which is not included in the HSM type, to the USB port of a PC. By connecting a high-capacity smart card of the HSM Type shows the use of financial services such as banking, payment, etc. mounted on the smart card of the HSM Type on the mobile terminal. In this case, if necessary, the PC and the mobile terminal may provide services by interworking with each other through a wireless network.

Next, without using Active-X as in the prior art, using a large-capacity smart card-based Internet security service in accordance with the present invention for the Internet payment service on a PC or mobile terminal with reference to Figures 4 and 5 Let's explain.

1) The browser of the PC or the terminal transmits the product information to be paid by HTTP to the SCWS of the large capacity smart card (S1).

2) SCWS creates a user authentication request HTML for approval information generation request to the approval Applet and sends it to the browser (S2), and the browser outputs the page and receives the user authentication information (S3).

3) The verification is performed on the approved Applet using the received user authentication information and a flow for generating the approval information is performed (S4). The communication between the SCWS and the accepting Applet uses the APDU or internal function call method. Authorization Applet's functionality can also be developed as a web application to handle all flows inside SCWS.

4) When the SCWS transmits the approval information to the browser (S5), the browser transmits the information to the PG company and the purchaser for approval, and the PG company and the purchaser transmit the approval result to the SCWS (S6).

5) SCWS of the large-capacity smart card processes the approval result and outputs the payment completion page to the browser (S7).

As a result, the payment service of the present invention generates an internet payment progress page using SCWS and provides an internet payment service using a credit card payment application installed in a large capacity smart card.

In addition, since the HTTP protocol is used, a separate plug-in installation is not necessary. Since Internet security technology is used instead of Active-X security, the Internet payment service using the mobile web can be provided.

In addition, the payment program provided by PG can be installed in a large capacity smart card, so an independent service model is possible without PG.

Now, as another embodiment of the present invention, a method of performing an internet payment service in a mobile terminal using a large capacity smart card regardless of whether Active-X is used will be described with reference to FIGS. 6 and 7.

1) Request payment by clicking the USIM payment button on a PC-based website (S11).

2) The payment web server requests SMS transmission for triggering SCWS of a large-capacity smart card to an SMSC (SMS Cennter) or OTA (Over The Air) server of the carrier (S12).

3) The SMSC or OTA server sends an SMS to the SCWS of the customer terminal (S13). This SMS refers to SMS received and processed by a large capacity smart card, not plain text.

4) SCWS triggers and receives the SMS, SCWS accesses the payment web server as an HTTP client and requests product information for payment (S14).

5) the web server transmits the product information to be paid to the SCWS of the large capacity smart card (S15).

6) SCWS creates a user authentication HTML for approval information generation request to the approval Applet and sends it to the browser (S16), the browser outputs the page to receive the user's authentication information (S17).

7) SCWS performs user authentication on the approved Applet with the received user authentication information, and performs a flow for generating approval information (S18). The communication between the SCWS and the accepting Applet uses the APDU or internal function call method. Authorization Applet's functionality can also be developed as a web application to handle all flows inside SCWS.

8) transmit the approval information to the purchaser (S19), and transmits the approval result to the SCWS (S20).

9) After the SCWS processes the approval result, the payment completion page is output to the user terminal browser (S21), the payment completion is sent to the web server (S22), and the web server notifies the PC browser that the payment is completed. Informs that the payment is completed (S23).

Finally, a user UI / UX providing method using a large capacity smart card based SCWS will be described with reference to FIG.

The user can set up a web-based UI / UX (bookbook displayed in the browser of FIG. 8) for a list of applications (Uri Bank, Kookmin Bank, BC Card application displayed in the browser of FIG. 8) installed and registered by the user through a PC and a mobile interface. , Account transfer, value added service menu). The configured UI / UX is stored on a large capacity smart card, so it can be kept device independent. This means that you can provide a user-friendly, convenient web interface and a personalized, customized, and integrated UI / UX.

While the preferred embodiments of the present invention have been described above, it should be noted that the present invention is not limited to these embodiments, but various modifications and changes can be made without departing from the spirit of the present invention.

1 illustrates an Internet payment service according to the prior art.

Figure 2 illustrates a large capacity smart card used in the present invention.

Figure 3 illustrates a method of connecting a large capacity smart card to a PC or mobile terminal in the present invention.

Figure 4 illustrates a large capacity smart card based Internet payment service in accordance with the present invention.

Figure 5 illustrates a flow of a large capacity smart card based Internet payment service according to the present invention.

Figure 6 illustrates the Internet payment service using a large capacity smart card in a mobile terminal according to the present invention.

Figure 7 illustrates a flow of the Internet payment service using a large capacity smart card in a mobile terminal according to the present invention.

8 illustrates a method for providing a user UI / UX in the present invention.

Claims (8)

In the processing method for making an Internet payment in a user PC or a mobile terminal, Transmitting, by the browser of the PC or the terminal, product information to be paid to the SCWS of the smart card; Generating, by the smart card web server, a user authentication request HTML for the approval information generation request to the approval Applet in the smart card to the browser; Outputting the page to a screen by a browser to receive user authentication information and transmitting the same to SCWS; Performing verification by the SCWS to the approval Applet with the user authentication information, generating approval information, and transmitting the approval information to a browser; Transmitting, by the browser, the approval information to the PG company or the purchaser for approval; PG company or purchaser transmits the approval result to SCWS; And processing the approval result by the smart card and outputting the payment completion page to the browser. The processing method for making an internet payment in a user PC or a mobile terminal. The method of claim 1, Communication between the SCWS and the approved Applet is characterized in that using the APDU or internal function call method, the processing method for making an Internet payment in a user PC or mobile terminal. The method of claim 1, And developing a function of the approval Applet as a web application, and performing the approval information generation step in the SCWS. The method of claim 1, The smart card has a web-based UI or UX for the list of applications installed and registered by the user, characterized in that the processing method for making an Internet payment in a user PC. In the processing method for making an Internet payment in the user's mobile terminal, Requesting a payment by clicking a USIM payment button on a PC-based website; Requesting an SMS transmission for the payment web server to trigger SCWS of a smart card; Receiving, by the SCWS, requesting product information for payment from a payment web server; Transmitting, by the web server, product information to be paid to SCWS of the smart card; SCWS sending a user authentication page to the browser for requesting approval information generation to the approval Applet; A browser outputting a corresponding page to receive authentication information of a user; SCWS receives the authentication information and performs user authentication to the approval Applet as the authentication information and generates the approval information; SCWS transmits the approval information to the purchaser and the agent sends the approval result to the SCWS; After the SCWS processes the approval result, the payment completion page is output to the user terminal browser, and the payment is sent to the web server so that the web server notifies the PC browser that the payment has been completed. And a step of making an internet payment in a mobile terminal of the user. The method of claim 5, Communication between the SCWS and the approved Applet is characterized in that using the APDU or internal function call method, the processing method for making an Internet payment in a user PC or mobile terminal. The method of claim 5, And developing a function of the approval Applet as a web application, and performing the generation of the approval information in the SCWS. The processing method for making an Internet payment in a user PC or a mobile terminal. The method of claim 5, The smart card has a web-based UI or UX for the list of applications installed and registered by the user, characterized in that the processing method for making an Internet payment in a mobile terminal of the user.

Images