KR20100049882A - Method for internet banking using mobile - Google Patents

Abstract

PURPOSE: A method for internet banking using a mobile phone are provided to perform user authentication using a mobile phone when bank transferring through internet banking. CONSTITUTION: A banking server(700) receives a mobile phone number of the mobile phone transmitting a security card number from a mobile server(500). The banking server determines whether the registered mobile phone number is identical to the mobile phone number received from the mobile server or not. The banking server determines whether the received security card number matches with the security card number issuing to the user who is logged in. In case the two mobile phone numbers and the two security card numbers are identical, the banking server approves the transfer request of the user.

Description

Internet banking method using a mobile phone {method for internet banking using mobile}

The present invention relates to an internet banking method using a mobile phone, and in particular, when a user wants to transfer money using internet banking, user authentication is performed using a mobile phone, so that user authentication information is prevented from hacking through the Internet. It's about making Internet banking safer.

1 is a flowchart illustrating a conventional internet banking method.

As shown in FIG. 1, a user first accesses the banking server 20 using his computer 10 and then logs in using an authorized certificate (step S11). Then, the banking server 20 provides the user with Internet banking information such as account number, current balance and deposit and withdrawal transaction history of the user (step S12).

Next, the user requests a transfer to the banking server 20 (step S13). Then, the banking server 20 requests the user to input the security card number (step S14). Here, the security card number is written on the security card issued by the bank to the user to receive the Internet banking or telebanking service. Accordingly, the user checks his security card, and then returns the security card number requested by the banking server 20 (step S15). Usually, a security card has a unique number (e.g., NO.0109934892), a security code (e.g., 1, 2, 3, ..., 35) and a security card number (e.g., 1111, 2222, 3333) for each security code. , ..., 5555). That is, when the banking server 20 informs the user of any security code among the security codes, the user returns the corresponding security card number to the banking server 20.

Next, the banking server 20 checks whether the security card number transmitted by the user computer 20 is correct (step S16), and if it is the correct security card number, approves the transfer request of the user (step S17). Accordingly, the user transmits information such as an account password, a deposit bank, a deposit account number, and a transfer amount to the banking server 20 (step S18).

As a result, in step S19, when the user authenticates, the banking server 20 executes the transfer requested by the user based on the transfer and deposit information sent by the user, and then transfers the transfer result to the user's computer 20.

However, according to the conventional Internet banking method as described above, when the user wants to transfer the account, the user must enter the account password as well as the security card number in the web browser in order to receive the approval of the transfer. However, there is a problem that the user authentication method through the web browser is not free from the risk of keyboard hacking, screen hacking, memory hacking and phishing. Of course, a security device such as a personal firewall or keyboard security program is provided. However, such security devices may be useless in front of advanced hacking means.

The present invention has been made to solve the above-described problems, when the user wants to transfer the account using the Internet banking so that the user authentication using a mobile phone, so that the user's authentication information is safe from hacking over the Internet An object of the present invention is to provide an internet banking method using a mobile phone.

Internet banking method according to an embodiment of the present invention is a computer for accessing the Internet, a banking server for providing a banking service to a user logged in using the computer, a mobile phone for mobile communication, and the mobile phone and the banking (A) a step performed by the banking server of the internet banking system including a mobile server connecting a server, and receiving a mobile number from the logged in user; (B) registering the received mobile phone number; (C) receiving a transfer request from the logged in user; (D) receiving a security card number from the mobile phone through the mobile server; (E) receiving a mobile phone number of the mobile phone which transmits the security card number from the mobile server, and determining whether the mobile phone number received from the mobile server matches the mobile phone number registered in the banking server; (F) determining whether the security card number received in step (d) matches the security card number issued to the logged-in user; And (g) approving the transfer request of the logged-in user when the two mobile phone numbers match as a result of the determination in step (e) and the two security card numbers match as a result of the determination in step (f). It is done by

In addition, when the banking server receives a transfer request from the logged-in user, the banking server transmits a message for requesting a security card number to the logged-in user to a mobile phone corresponding to a mobile phone number registered in the banking server. You can ask the mobile server.

In addition, the banking server may log out the logged-in user when the security card number is not received within a predetermined time after requesting to transmit a message for requesting the security card number.

The Internet banking system may further include an authentication server that generates a one-time password, determines whether the one-time password received from the banking server matches the generated one-time password, and returns the result to the banking server. However, the step (g) may be performed when the one-time password received from the mobile phone through the mobile server matches the one-time password generated in the authentication server.

In addition, the banking server may execute the transfer requested by the logged-in user when the account password received from the mobile phone through the mobile server matches the account password of the logged-in user.

In addition, the banking server may request the mobile server to send a message for requesting an account password to the logged-in user to the mobile phone corresponding to the mobile phone number registered in the banking server.

In addition, the banking server may log out the logged-in user if the account password is not received within a predetermined time after requesting to transmit a message for requesting the account password.

Internet banking method according to another embodiment of the present invention is a computer for accessing the Internet, a banking server for providing a banking service to a user logged in using the computer, a mobile phone for mobile communication, and the mobile phone and the banking (A) a step performed by the banking server of the internet banking system including a mobile server connecting a server, and receiving a user identification code from the logged in user; (B) registering the input user identification code; (C) receiving a transfer request from the logged in user; (D) receiving a security card number and a user identification code from the mobile phone through the mobile server; (E) determining whether the user identification code received in step (d) matches the user identification code registered in the banking server; (F) determining whether the security card number received in step (d) matches the security card number issued to the logged-in user; And (g) approving the transfer request of the logged-in user when the two user identification codes match as a result of the determination in step (e) and the two security card numbers match as a result of the determination in step (f). It is done by

In addition, the banking server requests the mobile server to send a message for requesting a security card number and a user identification code to the mobile phone corresponding to the mobile phone number registered by the logged-in user to the banking server. Can be.

In addition, the banking server may request to transmit a message for requesting the security card number and the user identification code, and log out of the logged in user if the security card number and the user identification code are not received within a predetermined time. have.

The Internet banking system may further include an authentication server that generates a one-time password, determines whether the one-time password received from the banking server matches the generated one-time password, and returns the result to the banking server. However, the step (g) may be performed when the one-time password received from the mobile phone through the mobile server matches the one-time password generated in the authentication server.

In addition, the banking server may execute the transfer requested by the logged-in user when the account password received from the mobile phone through the mobile server matches the account password of the logged-in user.

In addition, the banking server may request the mobile server to send a message for requesting an account password to the logged-in user to a cellular phone corresponding to the cellular phone number registered by the logged-in user to the banking server.

In addition, the banking server may log out the logged-in user if the account password is not received within a predetermined time after requesting to transmit a message for requesting the account password.

According to the Internet banking method using the mobile phone of the present invention, when the user wants to transfer the account by using the Internet banking, the user's important personal information (security card number, account password) by inputting the mobile phone on the web hacking through the Internet There is an effect that can perfectly cope with.

Hereinafter, with reference to the accompanying drawings will be described in detail with respect to the Internet banking method using a mobile phone according to a preferred embodiment of the present invention.

2 is a network diagram of an internet banking system that can be applied to the present invention.

As shown in FIG. 2, the Internet banking system provides a banking service to a user logged in using the Internet 400, a mobile communication network 300, a computer 200 for accessing the Internet 400, and a computer 200. Provided banking server 700, a database that stores a variety of personal information (for example, account number, account password, security card number, authorized certificate password, mobile phone number) of the user subscribed to the banking server 700 (800) ), A mobile phone 100 for mobile communication, a mobile server 500 for connecting the mobile phone 100 and the banking server 700, and a gateway 600 for connecting the banking server 700 and the mobile server 500 It can be made, including).

In addition, the Internet banking system generates a one time password (OTP), determines whether the one-time password received from the banking server 700 matches the one-time password generated by the banking server 700 It may further comprise an authentication server 900 for returning. Here, the one-time password is widely used as a means for user authentication in the Internet banking, in addition to the public certificate, the detailed description thereof will be omitted.

In the above-described configuration, the Internet 400 is a network of networks connecting wired / wireless computer networks scattered around the world, as is well known, and is generally referred to as Transmission Control Protocol / Internet Protocol (TCP / IP). In accordance with the communication protocol, all clients and servers connected to the Internet 400 in accordance with the TCP / IP system are assigned a globally unique IP address to an IP address management agent, that is, an Internet service provider; ISP). Here, the IP address is based on the area where the client or server is located. On the other hand, wireless access to the Internet 400 is based on a platform such as WAP (Wireless Application Protocol) or WIPI and the wireless Internet to access through a mobile communication network or through a public wireless LAN and an access point (Access Point) and For example, there may be a 'mobile Internet' (WiBro or WiMax), a wireless Internet service that provides high-speed Internet access even during stationary or slow travel at ADSL quality and cost.

The computer 200 may be a laptop or desktop with a WAP or Web browser for interfacing with various servers connected to the Internet 400.

The mobile communication network 300 includes a base station and the base station controller, and both synchronous and asynchronous will be supported. Here, in case of synchronous, the base station will be a base transceiver station (BTS), the base station controller will be a base station controller (BSC), and in case of asynchronous, the base station transmitter is a radio transceiver subsystem (RTS) and the base station controller is an RNC (Radio). Network controller). Of course, the mobile communication network 300 according to an embodiment of the present invention is not limited thereto, and includes a CDMA network as well as a GSM network and an access network of a fourth generation mobile communication system to be implemented in the future.

The cellular phone 100 is a so-called mobile, cellular phone or cellular phone, and includes a PCS (PerSonal Communication System), GSM (Global System for Mobile communications), PDC (Personal Digital Cellular), PHS (Personal Handyphone System), PDA (Personal) All kinds of handheld based mobile communication terminals such as Digital Assistant (IMT), International Mobile Telecommunication (IMT) -2000 terminal, Digital Multimedia Broadcasting (DMB) phone, and Smart Phone. In addition, the mobile phone 100 may be equipped with a module for generating a one-time password.

Specifically, the banking server 700 may include a subscription processing module for enabling a user to use a mobile user authentication service, a user authentication module for authenticating a user who applied for transfer, and a transfer request of an authenticated user. It is configured to include a transfer processing module.

3 is a flowchart illustrating a subscription procedure of a mobile user authentication service, and FIGS. 10 to 12 are screen views illustrating a process of storing a security card number in a mobile phone.

As shown in FIG. 3, the user accesses the banking server 700 using his computer 200, and then logs in using a public certificate (step S21). Then, the banking server 700 provides the user with Internet banking information such as the account number of the logged in user, the current balance and the deposit and withdrawal transaction (step S22).

Next, the user requests the banking server 700 to subscribe to the mobile user authentication service (step S23). Then, the banking server 700 requests the user's mobile phone number to the user (step S24), and in response, the user transmits his mobile phone number to the banking server 700 (step S25).

Here, the banking server 700 may query a server (not shown) operated by the corresponding mobile communication service provider to check whether the received mobile phone number is the logged-in user. If there is an error as a result of the inquiry, the mobile number can be requested again from the user.

Next, the banking server 700 requests the mobile server 500 to transmit a user authentication VM (virtual machine) to the mobile phone 100 corresponding to the mobile phone number received from the user (step S26). Then, the mobile server 500, for example, will send a callback message "Would you like to receive a user authentication VM for mobile Internet banking? 1. Access 2. Cancel" to the mobile phone 100 (step S27).

Next, when the user presses the number key '1', for example, the mobile phone 100 is connected to the mobile server 500 (step S28), whereby the mobile server 500 is the mobile phone 100 In step S29, the user authentication VM is transmitted. Then, the banking server 700 informs the completion of the transmission (step S30). Then, the banking server 700 transmits a message indicating that the user is subscribed to the mobile user authentication service to the computer 200 (S31).

The user can install the user authentication VM in his mobile phone according to the registration procedure, and then store the security card number issued from the bank in his mobile phone. For example, the mobile phone displays a screen as shown in FIG. 10 by executing a user authentication VM. The user can enter a bank name, a serial number of a security card, and a last security code of the security card through the screen. do. Then, the mobile phone switches to the screen shown in Figs. 11 and 12, so that the user registers the security card number corresponding to the security code 1 to 33 on his mobile phone, for example. On the other hand, the user authentication VM may include a function for generating a one-time password (OTP).

4A and 4B are flowcharts illustrating an internet banking method according to a first embodiment of the present invention, and FIG. 13 is a screen that can be displayed when a mobile phone requests a VM password from a user, and FIG. 14 is a security card. The screen for inputting a number is illustrated.

As shown in FIG. 4A, the user (mobile user authentication service subscriber) accesses the banking server 700 using his computer 200 and then logs in using an authorized certificate (step S41). Then, the banking server 700 provides the user with Internet banking information such as the account number, the current balance and the deposit and withdrawal transaction of the logged-in user (step S42).

Next, the user requests a transfer to the banking server 700 (step S43). Then, the banking server 700 requests the mobile server 500 to transmit a message for requesting the security card number to the mobile phone 100 to the user (step S44). Here, the mobile phone to receive the message corresponds to the mobile phone number registered by the user in the banking server 700, that is, the user's own number. Thus, the mobile server 500, for example, will send a callback message, "Do you want to enter the security card number? 1. Connection 2. Cancel" to the mobile phone 100 (step S45).

Meanwhile, the banking server 700 may log out the logged-in user if the security card number is not received from the mobile server 500 within a predetermined time after transmitting the request message of the security card number.

Next, when the user presses the number key 1, for example, when the user presses the number key 1, the mobile phone 100 requests the user to input a VM password for executing the user authentication VM (step S46). Here, the VM password is set by the user after downloading and installing the user authentication VM in his mobile phone (100).

Next, the cellular phone 100 determines whether the VM password input by the user matches that of being stored (step S47). Herein, when the user inputs an incorrect number five or more times, the mobile phone 100 may delete all the security card numbers previously stored by the user.

 Next, the mobile phone 100 is connected to the mobile server 500 if the VM password entered by the user is correct (step S48), accordingly, the mobile server 500 is a security card number to the mobile phone 100 Is requested (step S49).

Next, the cellular phone 100 encrypts the security card number input by the user and transmits the encrypted security card number to the mobile server 500 (step S50). That is, as shown in FIG. 14, the mobile server 500 notifies the user of a specific security code (eg, security code 11 and 25) designated by the banking server 700 among the security codes. Is the security card number (eg, the first 2 digits of the security code 11, the second 2 digits of 25) to return to the banking server 700. Here, when the security card number is stored in the mobile phone 100, the mobile phone 100 may automatically transmit the number to the mobile server 500. In other words, the user does not need to enter the security card number.

Next, the mobile server 500 transmits the number of the mobile phone 100 to the banking server 700 together with the security card number transmitted by the mobile phone 100 (step S51). Then, the banking server 700 determines whether the mobile number received from the mobile server 500 matches the mobile number registered on the banking server 700 (that is, the mobile number registered by the user requesting the transfer). In operation S52, it is determined whether the security card number received from the mobile server 500 matches the security card number issued to the logged-in user.

As a result of the determination, when the two mobile phone numbers match and the two security card numbers match, the banking server 700 approves the transfer request of the logged-in user (step S53). On the other hand, if the received security card number is incorrect, the computer 200 may inform the error and request retransmission.

In this case, the banking server 700 receives a mobile phone number from a user in advance and receives a mobile phone number other than a security card number from the mobile server 500, and then determines whether the two mobile phone numbers match. The security card number received from the 500 is for checking whether the transfer request has been sent by the user.

Next, the user who has approved the transfer transmits the transfer information (for example, withdrawal account number, deposit bank, deposit account number and transfer amount) to the banking server 700 (step S54).

Then, as illustrated in FIG. 4B, the banking server 700 requests the mobile server 500 to transmit a message for requesting an account password to the mobile phone 100 to the user (step S55). Thus, the mobile server 500, for example, will send a callback message, "Do you want to enter the account password? 1. Connection 2. Cancel" to the mobile phone 100 (step S56).

Meanwhile, the banking server 700 may log out the logged-in user if the account password is not received from the mobile server 500 within a predetermined time after transmitting the request message of the account password.

Next, the cellular phone 100 encrypts the account password entered by the user and transmits the encrypted account password to the mobile server 500 (step S57). Accordingly, the mobile server 500 transmits the number of the mobile phone 100 to the banking server 700 together with the account password transmitted by the mobile phone 100 (step S58).

Next, the banking server 700 determines whether the mobile phone number received from the mobile server 500 matches the mobile phone number registered in the banking server 700, and the account password received from the mobile server 500 is logged in. It is determined whether or not the coincidence with the user's account password (step S59).

As a result of the determination, the banking server 700 executes the transfer requested by the logged-in user when the two mobile phone numbers match and the two account passwords match (step S60). On the other hand, if the received account password is incorrect, the computer 200 may inform the error and request retransmission.

Next, the banking server 700 transmits the transfer result to the computer 100 (step S61).

5A and 5B are flowcharts illustrating an internet banking method according to a second embodiment of the present invention.

As shown in FIG. 5A, the user's computer 200 logs in to the banking server 700 using a public certificate or the like (step S71). Then, the banking server 700 provides the Internet banking information to the computer 200 (step S72).

Next, the user's computer 200 requests the transfer to the banking server 700 (step S43). Then, the banking server 700 requests the transfer information (step S74).

Next, the computer 200 returns the transfer information input by the user to the banking server 700 (step S75). Then, the banking server 700 requests the mobile server 500 to transmit a message for requesting the security card number and the account password to the mobile phone 100 to the user (step S76). Thus, the mobile server 500, for example, will send a callback message to the mobile phone 100, "Do you want to enter the security card number and account password? 1. Access 2. Cancel" (step S77).

Next, for example, when the user presses the number key 1, the cellular phone 100 requests the user to input a VM password for executing the user authentication VM (step S78).

Next, the cellular phone 100 determines whether the VM password input by the user matches that of being stored (step S79).

 Next, the mobile phone 100 is connected to the mobile server 500, if the VM password entered by the user is correct (step S80), accordingly, the mobile server 500 is a security card number and The account password is requested (step S81).

Next, the cellular phone 100 encrypts the security card number and the account password entered by the user and transmits them to the mobile server 500 (step S82). Accordingly, the mobile server 500 transmits the number of the mobile phone 100 to the banking server 700 together with the security card number and the account password transmitted by the mobile phone 100 as shown in FIG. S83).

Next, the banking server 700 determines whether the mobile number received from the mobile server 500 matches the mobile number registered in the banking server 700, and the security card number received from the mobile server 500 is determined. It is determined whether it matches the security card number issued to the logged-in user, and it is determined whether the account password received from the mobile server 500 matches the account password of the logged-in user (step S84).

As a result of the determination, the banking server 700 executes the transfer requested by the logged-in user when the two mobile phone numbers match, the two security card numbers match, and the two account passwords match (step S85). On the other hand, if the received security card number or account password is incorrect, the computer 200 may inform the error and request retransmission.

Next, the banking server 700 transmits the transfer result to the computer 100 (step S86).

6A to 6C are flowcharts illustrating an internet banking method according to a third embodiment of the present invention.

As shown in FIG. 6A, the user's computer 200 logs in to the banking server 700 using a public certificate or the like (step S91). Then, the banking server 700 provides the Internet banking information to the computer 200 (step S92).

Next, the user's computer 200 requests the transfer to the banking server 700 (step S43). Then, the banking server 700 requests the security card number while notifying the user of the security code (step S94).

Next, as shown in FIG. 6B, the cellular phone 100 is requested to execute the user authentication VM from the user (step S95). Thus, the cellular phone 100 requests the user to enter the VM password (step S96).

Next, the cellular phone 100 determines whether the VM password input by the user matches that of the stored (step S97). As a result of the determination, if the VM password entered by the user is correct, the mobile server 500 is accessed (step S98), and then the security card number entered by the user is encrypted and transmitted to the mobile server 500 (step S99). Accordingly, the mobile server 500 transmits the number of the mobile phone 100 to the banking server 700 together with the security card number transmitted by the mobile phone 100 (step S100).

Next, the banking server 700 determines whether the mobile number received from the mobile server 500 matches the mobile number registered in the banking server 700, and the security card number received from the mobile server 500 is determined. It is determined whether or not it matches the security card number issued to the logged-in user (step S101).

As a result of the determination, the banking server 700 approves the transfer request of the logged-in user when the two mobile phone numbers match and the two security card numbers match (step S102). On the other hand, if the received security card number is incorrect, the computer 200 may inform the error and request retransmission.

Next, the user who has approved the transfer transmits the transfer information (for example, withdrawal account number, deposit bank, deposit account number and transfer amount) to the banking server 700 (step S104). Then, the banking server 700 requests the account password (step S104).

Next, as shown in FIG. 6C, the cellular phone 100 receives an account password from the user (step S105), and encrypts the received account password and transmits it to the mobile server 500 (step S106). Accordingly,

The mobile server 500 transmits the number of the mobile phone 100 to the banking server 700 together with the security card number transmitted by the mobile phone 100 (step S100).

Next, the banking server 700 determines whether the mobile phone number received from the mobile server 500 matches the mobile phone number registered in the banking server 700, and the account password received from the mobile server 500 is logged in. It is determined whether or not the user's account password matches (step S108).

As a result of the determination, the banking server 700 executes the transfer requested by the logged-in user when the two mobile phone numbers match and the two account passwords match (step S109). On the other hand, if the received account password is incorrect, the computer 200 may inform the error and request retransmission.

Next, the banking server 700 transmits the transfer result to the computer 100 (step S110).

7A and 7B are flowcharts illustrating an internet banking method according to a fourth embodiment of the present invention.

As shown in FIG. 7A, the user's computer 200 logs in to the banking server 700 using a public certificate or the like (step S121). Then, the banking server 700 provides the Internet banking information to the computer 200 (step S122).

Next, the user's computer 200 requests the transfer to the banking server 700 (step S123). Then, the banking server 700 requests the transfer information (step S124).

Next, the computer 200 returns the transfer information input by the user to the banking server 700 (step S125). Then, the banking server 700 requests the security card number and the account password from the user (step S126).

Next, as shown in FIG. 7B, the cellular phone 100 is requested to execute the user authentication VM from the user (step S127). Thus, the cellular phone 100 requests the user to enter the VM password (step S128).

Next, the cellular phone 100 determines whether or not the VM password input by the user matches that of being stored (step S129). As a result of the determination, if the VM password entered by the user is correct, the mobile server 500 is accessed (step S130), and then the security card number and the account password entered by the user are encrypted and transmitted to the mobile server 500 (step S131). Accordingly, the mobile server 500 transmits the number of the mobile phone 100 to the banking server 700 together with the security card number and the account password transmitted by the mobile phone 100 (step S132).

Next, the banking server 700 determines whether the mobile number received from the mobile server 500 matches the mobile number registered in the banking server 700, and the security card number received from the mobile server 500 is determined. It is determined whether it matches the security card number issued to the logged-in user, and it is determined whether the account password received from the mobile server 500 matches the account password of the logged-in user (step S133).

As a result of the determination, the banking server 700 executes the transfer requested by the logged-in user when the two mobile phone numbers match, the two security card numbers match, and the two account passwords match (step S134). On the other hand, if the received security card number or account password is incorrect, the computer 200 may inform the error and request retransmission.

Next, the banking server 700 transmits the transfer result to the computer 100 (step S135).

8A and 8B are flowcharts illustrating an internet banking method according to a fifth embodiment of the present invention.

As shown in FIG. 8A, the user's computer 200 logs in to the banking server 700 using a public certificate or the like (step S141). Then, the banking server 700 provides the Internet banking information to the computer 200 (step S142).

Next, the user requests a transfer to the banking server 700 (step S143). Then, the banking server 700 requests the user's mobile number (step S144).

Next, the computer 200 transmits the mobile phone number input by the user to the banking server 700 (step S145). Then, the banking server 700 requests the mobile server 500 to transmit a message for requesting the security card number and the user identification code to the mobile phone 100 (step S146). In this case, the mobile phone to receive the message corresponds to the mobile phone number transmitted by the user to the banking server 700 in step S145. Thus, the mobile server 500, for example, send a callback message "Would you enter the security card number and user identification code? 1. Access 2. Cancel" to the mobile phone 100 (step S147).

Next, for example, when the user presses the number key 1, the cellular phone 100 requests the user to input a VM password for executing the user authentication VM (step S148).

Next, the cellular phone 100 determines whether or not the VM password input by the user matches that of being stored (step S149). Herein, when the user inputs an incorrect number five or more times, the mobile phone 100 may delete all the security card numbers previously stored by the user.

 Next, the mobile phone 100 is connected to the mobile server 500 if the VM password entered by the user is correct (step S150), accordingly, the mobile server 500 is a security card number to the mobile phone 100 And request a user identification code (step S151).

Next, the cellular phone 100 encrypts the security card number and the user identification code input by the user and transmits the encrypted encryption code to the mobile server 500 (step S152). Accordingly, the mobile server 500 transmits the security card number and the user identification code received from the mobile phone 100 to the banking server 700 (step S153).

Next, the banking server 700 determines whether the user identification code received from the mobile phone 100 through the mobile server 500 matches the user identification code registered in the banking server 700, and the mobile server 500 It is determined whether the security card number received from) matches the security card number issued to the logged-in user (step S154).

As a result of the determination, when the two user identification codes match and the two security card numbers match, the banking server 700 approves the transfer request of the logged-in user (step S155). On the other hand, if the received security card number is incorrect, the computer 200 may inform the error and request retransmission.

Here, the user identification code is for checking whether the security card number received from the mobile server 500 is sent by the transfer request user, and the user who requested the transfer is registered in advance in the banking server 700. In other words, the banking server 700 is a means for identifying a user, by using a mobile phone number of the user or a user identification code (for example, numbers, letters, or a combination thereof) set as described above.

Next, the user who has received the transfer allows the transfer information to be sent to the banking server 700 (step S156).

Then, as shown in FIG. 8B, the banking server 700 requests the mobile server 500 to transmit a message for requesting an account password to the mobile phone 100 to the user (step S157). Thus, the mobile server 500, for example, will send a callback message, "Do you want to enter the account password? 1. Connection 2. Cancel" to the mobile phone 100 (step S158).

Next, the cellular phone 100 encrypts the user identification code together with the account password entered by the user and transmits it to the mobile server 500 (step S159). Accordingly, the mobile server 500 transmits the account password and the user identification code transmitted from the mobile phone 100 to the banking server 700 (step S160).

Next, the banking server 700 determines whether the user identification code received from the mobile server 500 matches the user identification code registered in the banking server 700, and the account password received from the mobile server 500 is logged in. It is determined whether or not the user's account password matches (step S161).

As a result of the determination, the banking server 700 executes the transfer requested by the logged-in user when the two user identification codes match and the two account passwords match (step S162). On the other hand, if the received account password is incorrect, the computer 200 may inform the error and request retransmission.

Next, the banking server 700 transmits the transfer result to the computer 100 (step S163).

9A and 9B are flowcharts illustrating an internet banking method according to a sixth embodiment of the present invention.

As shown in FIG. 8A, the user's computer 200 logs in to the banking server 700 using a public certificate or the like (step S171). Then, the banking server 700 provides the Internet banking information to the computer 200 (step S172).

Next, the user requests a transfer to the banking server 700 (step S173). Then, the banking server 700 requests the user's mobile number (step S174).

Next, the computer 200 transmits the mobile phone number input by the user to the banking server 700 (step S175). Then, the banking server 700 requests the mobile server 500 to transmit a message for requesting the security card number and the user identification code to the mobile phone 100 (step S176). In this case, the mobile phone to receive the message corresponds to the mobile phone number transmitted by the user to the banking server 700 in step S175. Thus, for example, the mobile server 500 sends a callback message to the mobile phone 100, "Do you want to enter the security card number, user identification code and one-time password (OTP)? S177).

Next, when the user presses the number key 1, for example, the cellular phone 100 requests the user to input a VM password for executing the user authentication VM (step S178).

Next, the cellular phone 100 determines whether the VM password input by the user matches that of the stored (step S179). Herein, when the user inputs an incorrect number five or more times, the mobile phone 100 may delete all the security card numbers previously stored by the user.

 Next, the mobile phone 100 is connected to the mobile server 500, if the VM password entered by the user is correct (step S180), accordingly, the mobile server 500, the security card number, The user identification code and the one-time password OTP are requested (step S181).

Next, the mobile phone 100 encrypts the security card number and the user identification code input by the user, and the one-time password generated by the OTP generation module and transmits the encrypted password to the mobile server 500 (step S182). Accordingly, the mobile server 500 transmits the security card number, the user identification code and the one-time password received from the mobile phone 100 to the banking server 700 (step S183).

Next, the banking server 700 determines whether the received security card number, user identification code and one-time password are correct (step S184). That is, the banking server 700 determines whether the user identification code received from the mobile phone 100 through the mobile server 500 matches the user identification code registered in the banking server 700, and the mobile server 500 It is determined whether the security card number received from the security card number is issued to the logged-in user. In addition, the banking server 700 determines whether the one-time password received from the mobile phone 100 through the mobile server 500 matches the one-time password generated by the authentication server 900.

As a result of the determination, the banking server 700 may approve the transfer request of the logged-in user when two user identification codes match, two security card numbers match, and two disposable passwords match (step S185). On the other hand, if the received security card number is incorrect, the computer 200 may inform the error and request retransmission.

Here, the additional authentication method through the one-time password provides a more secure user authentication, in which the transfer request is ignored when the user identification code is exposed and the user does not have a valid OTP generation module even when the user attempts to authenticate the user with a mobile phone of a third party. do. In addition, the additional authentication scheme may be implemented in the first to fifth embodiments described above.

Next, the user who has received the transfer allows the transfer information to be sent to the banking server 700 (step S186).

Then, as illustrated in FIG. 9B, the banking server 700 requests the mobile server 500 to transmit a message for requesting an account password to the mobile phone 100 to the user (step S187). Thus, the mobile server 500, for example, will send a callback message, "Do you want to enter the account password and one-time password? 1. Connection 2. Cancel" to the mobile phone 100 (step S188).

Next, the mobile phone 100 encrypts the user identification code and the OTP together with the account password entered by the user and transmits them to the mobile server 500 (step S189). Accordingly, the mobile server 500 transmits the account password, the user identification code and the OTP transmitted from the mobile phone 100 to the banking server 700 (step S190).

Next, the banking server 700 determines whether the received account password, the user identification code and the OTP are correct (step S191).

As a result of the determination, the banking server 700 executes the transfer requested by the logged-in user when the two user identification codes match and the two account passwords match, and the two OTPs match (step S192). On the other hand, if the received account password is incorrect, the computer 200 may inform the error and request retransmission.

Next, the banking server 700 transmits the transfer result to the computer 100 (step S193).

The internet banking method using the mobile phone of the present invention is not limited to the above-described embodiments, and various modifications can be made within the range allowed by the technical idea of the present invention.

1 is a flowchart illustrating a conventional internet banking method.

2 is a network diagram of an internet banking system that can be applied to the present invention.

3 is a flowchart illustrating a subscription procedure of a mobile user authentication service.

4A and 4B are flowcharts illustrating an internet banking method according to a first embodiment of the present invention.

5A and 5B are flowcharts illustrating an internet banking method according to a second embodiment of the present invention.

6A to 6C are flowcharts illustrating an internet banking method according to a third embodiment of the present invention.

7A and 7B are flowcharts illustrating an internet banking method according to a fourth embodiment of the present invention.

8A and 8B are flowcharts illustrating an internet banking method according to a fifth embodiment of the present invention.

9A and 9B are flowcharts illustrating an internet banking method according to a sixth embodiment of the present invention.

10 to 12 are screen views showing a process of storing the security card number in the mobile phone.

FIG. 13 is a screen that may be displayed when the mobile phone requests a VM password from the user.

14 illustrates a screen for inputting a security card number.

*** Explanation of symbols for the main parts of the drawing ***

100: mobile phone 200: computer

300: mobile network 400: internet

500: mobile server 600: gateway

700: banking server 800: database

900: authentication server

Claims (15)

Internet banking comprising a computer for accessing the Internet, a banking server for providing a banking service to a user logged in using the computer, a mobile phone for mobile communication, and a mobile server for connecting the mobile phone and the banking server. Performed by the banking server of the system, (A) receiving a mobile number from the logged-in user; (B) registering the received mobile phone number; (C) receiving a transfer request from the logged in user; (D) receiving a security card number from the mobile phone through the mobile server; (E) receiving a mobile phone number of the mobile phone which transmits the security card number from the mobile server, and determining whether the mobile phone number received from the mobile server matches the mobile phone number registered in the banking server; (F) determining whether the security card number received in step (d) matches the security card number issued to the logged-in user; And And (g) approving the transfer request of the logged-in user when the two mobile phone numbers match as a result of the determination in step (e) and the two security card numbers match as a result of the determination in step (f). Internet banking method made. The method of claim 1, When the transfer request is received from the logged-in user, requesting the mobile server to transmit a message for requesting a security card number to the logged-in user to the mobile phone corresponding to the mobile phone number registered in the banking server. Featuring internet banking method. 3. The method of claim 2, And requesting to transmit a message for requesting the security card number, and logging out the logged-in user if the security card number is not received within a predetermined time. The method of claim 1, The Internet banking system further comprises a certificate server for generating a one-time password, determining whether the one-time password received from the banking server matches the generated one-time password, and returning the result to the banking server. The step (g) is performed when the one-time password received from the mobile phone through the mobile server matches the one-time password generated in the authentication server. 5. The method according to any one of claims 1 to 4, And if the account password received from the mobile phone through the mobile server matches the account password of the logged-in user, executing the transfer requested by the logged-in user. The method of claim 5, And requesting the mobile server to transmit a message for requesting an account password to the logged-in user to a mobile phone corresponding to a mobile phone number registered in the banking server. The method of claim 6, And requesting to transmit a message for requesting the account password, and logging out the logged-in user if the account password is not received within a predetermined time. Internet banking comprising a computer for accessing the Internet, a banking server for providing a banking service to a user logged in using the computer, a mobile phone for mobile communication, and a mobile server for connecting the mobile phone and the banking server. Performed by the banking server of the system, (A) receiving a user identification code from the logged in user; (B) registering the input user identification code; (C) receiving a transfer request from the logged in user; (D) receiving a security card number and a user identification code from the mobile phone through the mobile server; (E) determining whether the user identification code received in step (d) matches the user identification code registered in the banking server; (F) determining whether the security card number received in step (d) matches the security card number issued to the logged-in user; And And (g) approving the transfer request of the logged-in user when the two user identification codes match as a result of the determination of step (e) and the two security card numbers match as a result of the determination of step (f). Internet banking method made. The method of claim 8, Internet banking requesting the mobile server to send a message for requesting a security card number and a user identification code to the logged-in user to a mobile phone corresponding to the mobile phone number registered to the banking server. Way. The method of claim 9, Internet banking, if the security card number and the user identification code is requested to be transmitted, and the security card number and the user identification code are not received within a predetermined time period. Way. The method of claim 8, The Internet banking system further comprises a certificate server for generating a one-time password, determining whether the one-time password received from the banking server matches the generated one-time password, and returning the result to the banking server. The step (g) is performed when the one-time password received from the mobile phone through the mobile server matches the one-time password generated in the authentication server. The method according to any one of claims 8 to 11, And if the account password received from the mobile phone through the mobile server matches the account password of the logged-in user, executing the transfer requested by the logged-in user. The method of claim 12, And requesting the mobile server to transmit a message for requesting an account password to the logged-in user to a mobile phone corresponding to a mobile phone number registered by the logged-in user to the banking server. The method of claim 13, And requesting to transmit a message for requesting the account password, and logging out the logged-in user if the account password is not received within a predetermined time. A computer readable medium having recorded thereon a program for executing the Internet banking method according to any one of claims 1 to 4.

Images