KR20110013723A - Auto-certificating system for on-line settlement and method of the same - Google Patents

Abstract

PURPOSE: An automatic online payment security certifying system and a method thereof for automatically certifying mobile terminal information are provided to prevent password breach by automatically detecting a mobile number. CONSTITUTION: An NFC dummy terminal for NFC(Near Field Communication) is added in a user personal computer(40) and extracts information of a mobile terminal(50) included within a specified range. The user personal computer transmits mobile phone information to an online payment system(60). The online payment server receives mobile terminal information from the user personal computer.

Description

Online payment automatic security authentication system and method thereof {AUTO-CERTIFICATING SYSTEM FOR ON-LINE SETTLEMENT AND METHOD OF THE SAME}

The present invention relates to an online payment automatic security authentication system and a method thereof, and more particularly, in addition to primary authentication through password input for an authorized authentication or a secure payment payment tool, a short-range communication means attached to a user terminal in the form of a dummy terminal. Through the mobile phone information contained within a certain range can be quickly and accurately determine the authenticity of the user attempting a payment request, and because the user does not need to enter additional information, the automatic payment security security more convenient A system and method thereof are provided.

As is well known, due to the recent development of information communication technology, development of information providing technology for providing information on various fields via a long distance data communication network to a plurality of subscribers through at least one host server is actively underway.

Based on this, in recent years, information sorting and compression technologies are being developed to provide more convenient access to neighboring technologies such as cache memory expansion technology to provide accurate information to subscribers more quickly and subscribers' tastes and preferences. It is also accelerating the development of various contents and its solutions.

Due to the development of such electronic communication technology, online shopping using a personal computer is recently activated, and the amount of shopping is increasing day by day.

Therefore, in such online shopping, personal authentication should be treated very important at the time of payment, and even if not online shopping, personal authentication is important because it is an important security matter. In particular, since the personal authentication portion may be a hackable area, not only shopping mall companies but also various authentication companies, especially servers provided with financial institutions, are urgently required to take measures against this.

The general personal authentication method is by using ID and password. In other words, the authentication process is performed using the ID and password registered in advance in the server.

In addition, there were methods using a unique personal body, such as reading authentication information through a user's smart card or public certificate, or an iris or fingerprint registered by the user in advance.

1 is a schematic diagram schematically showing the configuration of an online payment system according to a conventional embodiment.

Referring to this, the most common method in the online payment system according to a conventional embodiment is the authentication method through the authentication of a certificate issued in advance, or a payment program (eg, secure payment payment program) issued in advance by a payment destination. to be.

Typically, a conventional online payment system is provided with a user PC (2) is installed, the user's authentication means, the user PC (2) has a certified authentication processor (8) or secure payment payment processor 10 therein It is installed in conjunction with the payment processor (6). Here, the authorized certification processor 8 or the secure payment settlement processor 10 is software, which is a program issued and installed by a financial institution or an authorized certification issuer.

The authorized authentication processor 8 or the secure payment settlement processor 10 authenticates the authenticity of the user by inputting a password through the keyboard 4, and the user PC 2 is connected to the online shopping mall server 20. When the payment tool of the online shopping mall server 20 is driven for payment processing in the state, the authorized authentication processor 8 or the secure payment payment processor 10 pre-installed in the user PC 2 due to the call of the payment tool. ) Is driven.

Therefore, when the user enters the password through the keyboard 4, the input information is transmitted to the online payment server 30 to perform the authentication process, the result is the user PC 2 and the online shopping mall server 20 To send.

At this time, the database 20a configured in the online shopping mall server 20 is a means for storing the ID and password of a user who is a member to store information for member authentication, and the database 30a configured in the online payment server 30. Is a means of storing the unique information and the user password of the user's public certificate or secure payment payment tool.

However, in the conventional online payment system, if the third party who has obtained the user's authorized certificate or password of the secure payment payment tool generates the payment request signal using the corresponding user's PC 2, the third party is the user. There was a problem that the authentication process.

In addition, there is a problem in that the user's PC 2 is remotely hacked to copy the user's authorized certificate or secure payment payment tool, and a third party may generate a payment request signal using the acquired password. In other words, if hacking is possible on the user PC 2, there is a problem that an additional security authentication tool is required because the possibility of leakage of the password is high.

In addition, personal authentication through user's body information such as iris or fingerprint has little possibility of leakage or hacking, but it is convenient. However, there is a disadvantage that equipment for scanning fingerprint or iris is expensive. There is a problem that it takes a long time to compare the iris or fingerprint registered in advance, and the iris or fingerprint of the user input for payment.

In addition, such additional authentication or authentication using personal body information requires a user to input a separate process, which is problematic for the user.

The present invention has been made in view of the above-described circumstances of the prior art, and in addition to primary authentication through password input for an authorized authentication or secure payment payment tool, a predetermined range through a short range communication means attached to a user terminal in the form of a dummy terminal. It is possible to accurately and quickly judge the authenticity of a user who attempts a payment request by scanning mobile phone information contained within, and the user does not have to enter additional information, so the online payment automatic security authentication system is more convenient and its method The purpose is to provide.

In order to achieve the above object, according to a preferred embodiment of the present invention, in the online shopping mall server for uploading a variety of product information to sell goods through online payment, the mobile phone information added to the user PC, included in a certain range A short distance communication dummy terminal for extracting; To generate an authentication request signal by combining a payment processor requesting an online payment signal to a remote server side, a combination of an authentication certificate or password and authentication information that extracts authentication information and a password entered by a user from an authorized certificate and transmits the authentication information to a payment server. A user PC equipped with a secure payment payment processor and transmitting mobile phone information extracted from the short-range communication dummy terminal to an online payment server; In addition to the authentication information or safety payment authentication information from the user PC, and receives the mobile phone information included in the short-range communication range and performs the authentication process, the first authentication for the authentication information or safety payment authentication information, and the user There is provided an online payment automatic security authentication system comprising an online payment server that performs payment processing for a shopping product through second authentication depending on whether the mobile phone is included in a short range communication range.

Preferably, the short-range communication dummy terminal is provided with an online payment automatic security authentication system, characterized in that the terminal for Bluetooth or Zigbee communication.

Preferably, the user PC is provided with an on-line payment automatic security authentication system, characterized in that the mobile phone detection unit for detecting the mobile phone number information in the mobile phone information within a predetermined short-range communication range extracted by the short-range communication dummy terminal therein is provided. .

Preferably, the mobile phone information is provided with an online payment automatic security authentication system, characterized in that the mobile phone number information or the unique number of the device.

Preferably, the online payment server is an online payment automatic security authentication system comprising a mobile phone authentication setting management unit for managing the second authentication setting information or the second authentication release information for authenticating the user mobile phone information therein This is provided.

Preferably, when the online payment server receives a setting or release signal for mobile phone authentication from a specific user PC, the online payment server is configured to perform setting and release processing according to whether the mobile phone information of the user is included in the short range communication range of the user PC. An online payment automatic security authentication system is provided.

On the other hand, the present invention comprises a first step of determining whether a payment request signal is received from a specific user PC via an online shopping mall server; A second step of causing the user PC to drive an authentication program mounted therein; A third step in which the online payment server receives the password through the authentication program of the user PC; A fourth step of detecting, by the user PC, cellular phone information included in the range of the local area network; A fifth step of transmitting mobile phone information to an online payment server; A sixth step of the online payment server comparing and authenticating the password; A seventh step of determining whether the registered cellular phone information is included in the received detection cellular phone information; If the two-factor authentication is normal, there is provided an online payment automatic security authentication method comprising the eighth process of performing the payment processing.

Preferably, the password is not input through the third process, the mobile phone information is not detected through the fourth process, the password is mismatched through the sixth process, or the registered mobile phone information is detected by the sixth process. If not included, the online payment server is provided with an automatic payment automatic security authentication method, characterized in that further comprising the step of outputting the screen to the payment processing information to the user PC.

Preferably, during the first to eighth process, in order to request the setting or release of additional mobile phone authentication, a process of determining whether a mobile phone number registered by the user is detected through a local area network of the user PC. There is provided an online payment automatic security authentication method characterized in that it has to go through.

Online payment automatic security authentication system and method according to the present invention is to perform a second authentication to automatically detect and authenticate the mobile phone number at the moment that the user does not recognize very precise and accurate user authentic authentication As a result, it is possible to prevent a password leak or an accident that requires the use of another user's PC by false payment. In addition, since the additional cost of hardware is very small, there is an advantage that the economy is very high.

EMBODIMENT OF THE INVENTION Hereinafter, this invention is demonstrated in detail with reference to drawings.

Figure 2 is a schematic diagram showing the configuration of an online payment automatic security authentication system according to an embodiment of the present invention.

Referring to this, the online payment automatic security authentication system according to an embodiment of the present invention is a short-range communication means attached to the user PC in the form of a dummy terminal, in addition to the first authentication through the password input for the authorized authentication or secure payment payment tool Through the mobile phone information contained within a certain range can be quickly and accurately determine the authenticity of the user attempting the payment request, and the user does not need to enter additional information is more convenient system.

That is, in the online payment automatic security authentication system according to an embodiment of the present invention, in the state in which the user does not recognize, additional authentication processing for detecting the user's mobile phone information through a local area network and comparing with the mobile phone information of the registered user. It is a system that performs automatically.

For example, the online payment server 60 included in the online payment automatic security authentication system according to an embodiment of the present invention is set in addition to the official certificate of the mobile phone automatic authentication, the mobile phone registration number is 010-123-4567 Under the assumption, when the user PC 40 detects the mobile phone number included in a certain range through the local area network, it is assumed that the detected mobile phone number is 010-222-3333, 010-333-2222, 010-123-4567. When the presence of the user is detected, it is determined that the additional authentication is successful, so that others can prevent the payment process by randomly inputting the previously leaked password through the user PC 40 equipped with the certificate.

In this case, since the online payment automatic security authentication system according to an embodiment of the present invention is to perform the mobile phone authentication as a secondary secondary authentication, after the first authentication is executed through the official certificate or the secure payment payment tool, which is the basic authentication, If the first authentication fails, even if the second authentication succeeds, payment processing is impossible.

More specifically, the online payment automatic security authentication system according to an embodiment of the present invention uploads and posts various product information therein to a web page, and pays the payments with an online payment server 60 provided in a financial institution such as a credit card company. An online shopping mall server 20 for transmitting a request signal is provided.

In addition, the online payment automatic security authentication system according to an embodiment of the present invention is added to the user PC 40, the short-range communication dummy terminal 42 for extracting information of the mobile phone 50 included in a predetermined range is provided The online payment request signal is requested to the online payment server 60 through a remote server, that is, the online shopping mall server 20, and the certificate request code and password or the security payment processor code and password online together with the payment request signal. A user PC 40 is provided for transmitting to the payment server 60 and transmitting a plurality of mobile phone information detected through the short-range communication dummy terminal 42 to the online payment server 60.

In addition, the on-line payment automatic security authentication system according to an embodiment of the present invention receives the mobile phone information included in the short-range communication range in addition to the authorized authentication information or safety payment authentication information from the user PC 40 to perform the authentication process And through the first authentication for the authentication information or the safety payment authentication information and the second authentication based on whether or not the user's mobile phone (50) within the short-range communication range to perform payment processing for shopping products An online payment server 60 is provided.

At this time, the online payment server 60 stores the authentication certificate code information and its password information donated to each subscriber therein, and the database for storing the secure payment program code information and its password information granted to each subscriber ( 60a) is provided.

In addition, the online shopping mall server 20 is provided with a database (20a) for storing the personal information and ID and password information of the subscriber therein, and stores the information on the merchandise.

3 is a block diagram showing the configuration of a user PC included in the online payment automatic security authentication system according to an embodiment of the present invention.

Referring to this, the user PC 40 included in the online payment automatic security authentication system according to an embodiment of the present invention provides an online payment request signal through a remote server, that is, an online shopping mall server 20. A payment processor 44 for requesting to the server 60 side is provided.

In addition, the user PC 40 extracts the authentication information and the password inputted by the user from the public certificate therein and requests the authentication by combining the authentication authentication processor 8 or password and authentication information transmitted to the online payment server 60. The secure payment settlement processor 10 for generating a signal is mounted, and the mobile phone information extracted from the short-range communication dummy terminal 42 for performing short-range communication through a short-range communication network for a plurality of user mobile phones 50. Mobile phone detection unit 45 for detecting mobile phone information for transmission to the online payment server 60 is provided.

In addition, the user PC 40 is provided with a communication module 43 for performing web communication to the online shopping mall server 20 and the online payment server 60 therein, and the authorized certificate or security payment tool A keyboard 4 is provided for inputting a password.

In addition, the user PC 40 is provided with a control unit 46 for controlling each configuration therein and performing sequential driving to transmit the first authentication and the second authentication information for payment.

At this time, the short-range communication dummy terminal 42 may be a Bluetooth or Zigbee communication terminal.

In addition, the mobile phone information is a mobile phone number information or a unique number of the device.

4 is a block diagram showing the configuration of an online payment server included in the online payment automatic security authentication system according to an embodiment of the present invention.

Referring to this, the online payment server 60 included in the online payment automatic security authentication system according to an embodiment of the present invention performs web communication with respect to the user PC 40 and the online shopping mall server 20 therein. The communication module 62 is provided, and an authentication processor management unit 64 that performs authentication on a code number and a password for an authorized certificate or a secure payment payment tool donated for each subscriber is provided.

In addition, the online payment server 60 includes a mobile phone authentication setting management unit 68 for managing secondary authentication setting information or secondary authentication release information for authenticating user mobile phone information therein.

That is, the user can be set to perform the second authentication by detecting additional mobile phone information after performing the first authentication at the time of payment through the authentication certificate or the secure payment payment tool for the online payment server 60, the online payment server ( The mobile phone authentication setting management unit 68 provided at 60 manages the mobile phone authentication setting state of each user to determine whether to perform additional authentication, and transmits the pre-registered mobile phone information and the user PC 40. Cell phone authentication is performed by comparing the detected cell phone information.

On the other hand, the online payment server 60 is provided with a payment processing unit 70 for performing a payment processing if it is determined that the normal user after performing the authentication therein, the authentication certificate code information and password information donated for each subscriber And a database 60a for storing the security payment program code information and the password information assigned to each subscriber.

In addition, the online payment server 60 controls the respective components therein and performs the second authentication through the first authentication and the mobile phone information detection through an authorized certificate or a safe payment payment tool according to the user's setting status. The control unit 72 that proceeds is included.

At this time, the online payment server 60 is set according to whether the mobile phone information of the user is included in the short-range communication range of the user PC 40 when receiving the setting or release signal for the mobile phone authentication from a specific user PC (40) And an on-off process.

The function and operation of the online payment automatic security authentication system according to an embodiment of the present invention having the above-described configuration will be described in detail with reference to the accompanying drawings.

5 is a flowchart illustrating a signal flow of an online payment automatic security authentication system according to an embodiment of the present invention, and FIG. 6 is a mobile phone authentication setting of a signal flow of an online payment automatic security authentication system according to an embodiment of the present invention. And a flow chart showing the modification process.

First, the online payment automatic security authentication system according to an embodiment of the present invention basically performs the first authentication by a certificate or a secure payment payment tool, additionally the user's mobile phone is located in the vicinity of the user PC (40) Can be set to perform secondary authentication.

Therefore, the online shopping mall server 20 included in the online payment automatic security authentication system according to an embodiment of the present invention determines whether a payment request signal is received from a specific user PC 40.

Then, the user PC 40 which generated the payment request signal searches for an authentication program mounted therein and drives the authentication program. The certification program consists of an accredited certificate driving program and a secure payment settlement program.

When the authentication program is driven, the authentication program guides the user to enter a password, and when the password is input, the user PC 40 transmits the input password to the online payment server 60.

Then, the online payment server 60 receives the password through the authentication program of the user PC (40).

In this state, the user PC 40 activates the short-range communication dummy terminal 42 to detect cellular phone information included in a predetermined range of the corresponding local area network.

For example, the detected mobile phone information may be a mobile phone number or a mobile phone device code, but under the assumption that the mobile phone number is a mobile phone number, the detected mobile phone number is 010-222-3333, 010-333-2222, 010- in a predetermined local area network. Assuming 123-4567, the user PC 40 transmits the mobile phone number, the certificate code, and the password to the online payment server 60.

Then, the online payment server 60 compares the password of the pre-registered certificate and the received certificate password, performs the first authentication, and determines whether the pre-registered mobile phone information is included in the received detection mobile phone information. Perform secondary authentication.

That is, if the user registered cell phone number is 010-123-4567 and the received cell phone number is 010-222-3333, 010-333-2222, 010-123-4567 Since it is included in the number, it is determined that the user exists in the vicinity of the user PC 40 to request the payment, and successfully processes the second authentication.

Then, the online payment server 60 performs a payment process.

On the other hand, when the online payment server 60 does not enter a password, mobile phone information is not detected, certificate password mismatch, or the registered mobile phone information is not included in the detected mobile phone information, payment to the user PC 40 Transmits unprocessable information and outputs the screen.

Therefore, the online payment automatic security authentication system according to an embodiment of the present invention performs a second authentication that automatically detects and authenticates a mobile phone number at a moment that the user does not recognize, so that the user authenticity authentication is very quick and convenient. Because it can be performed, it is possible to prevent the leakage of passwords or accidents requiring false payment by using the user's PC by others. In addition, the extra cost of the hardware is very small, so the economics are very high.

Referring to FIG. 6, a user may set additional mobile phone authentication with the online payment server 60 and may release the setting.

In this case, the online payment server 60 included in the online payment automatic security authentication system according to an embodiment of the present invention corresponds to the dummy terminal 42 for short-range communication when the user wants to set or release additional mobile phone authentication. It is possible to set and release the second authentication only when the user's mobile phone information is detected.

That is, since a third party having a password of a public certificate may set and release additional secondary authentication through a mobile phone, in order to prevent this, in order to request setting or release of additional mobile phone authentication, Through the local area network of the user PC 40, it is necessary to go through the process of determining whether the mobile phone number registered by the user is detected.

Of course, only when the authentication for the accredited certificate or the secure payment payment tool is completed, it is possible to set and release additional mobile phone authentication.

On the other hand, the online payment automatic security authentication system according to an embodiment of the present invention is not limited only to the above-described embodiment is possible various modifications within the scope not departing from the technical gist.

1 is a schematic diagram schematically showing the configuration of an online payment system according to a conventional embodiment;

Figure 2 is a schematic diagram schematically showing the configuration of the automatic payment security system for online payment according to an embodiment of the present invention,

Figure 3 is a block diagram showing the configuration of a user PC included in the online payment automatic security authentication system according to an embodiment of the present invention,

4 is a block diagram showing a configuration of an online payment server included in an automatic payment security system for online payment according to an embodiment of the present invention;

5 is a flowchart illustrating a signal flow of an online payment automatic security authentication system according to an embodiment of the present invention;

6 is a flowchart illustrating a process of setting and changing a mobile phone authentication during a signal flow of an online payment automatic security authentication system according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

20: online shopping mall server, 40: user PC,

42: dummy terminal for short distance communication, 50: mobile phone,

60: online payment server.

Claims (9)

In the online shopping mall server that uploads various product information and sells the product through online payment, A short-term communication dummy terminal added to a user PC and configured to extract mobile phone information included in a predetermined range; To generate an authentication request signal by combining a payment processor requesting an online payment signal to a remote server side, a combination of an authentication certificate or password and authentication information that extracts authentication information and a password entered by a user from an authorized certificate and transmits the authentication information to a payment server. A user PC equipped with a secure payment payment processor and transmitting mobile phone information extracted from the short-range communication dummy terminal to an online payment server; In addition to the authentication information or safety payment authentication information from the user PC, and receives the mobile phone information included in the short-range communication range and performs the authentication process, the first authentication for the authentication information or safety payment authentication information, and the user An online payment automatic security authentication system, characterized in that consisting of an online payment server that performs payment processing for shopping products through the second authentication depending on whether the mobile phone is included in the short-range communication range. The system of claim 1, wherein the short-range communication dummy terminal is a Bluetooth or Zigbee communication terminal. The online payment automatic security authentication system according to claim 1, wherein the user PC includes a mobile phone detecting unit configured to detect mobile phone number information among mobile phone information within a predetermined short range communication range extracted by the short distance communication dummy terminal. . The automatic payment authentication system of claim 1, wherein the mobile phone information is mobile number information or a unique number of a device. The method of claim 1, wherein the online payment server includes a mobile phone authentication setting management unit for managing second authentication setting information or secondary authentication release information for authenticating user mobile phone information therein. Security authentication system. The mobile payment server of claim 1, wherein the online payment server receives the setting or desetting signal for mobile phone authentication from a specific user PC, and performs the setting and desetting process according to whether the mobile phone information of the user is included in the short range communication range of the user PC. Online payment automatic security authentication system, characterized in that performed. A first step of determining whether a payment request signal is received from a specific user PC through an online shopping mall server; A second step of causing the user PC to drive an authentication program mounted therein; A third step in which the online payment server receives the password through the authentication program of the user PC; A fourth step of detecting, by the user PC, cellular phone information included in the range of the local area network; A fifth step of transmitting mobile phone information to an online payment server; A sixth step of the online payment server comparing and authenticating the password; A seventh step of determining whether the registered cellular phone information is included in the received detection cellular phone information; If the two-factor authentication is normal, the online payment automatic security authentication method comprising the eighth process of performing the payment processing. The method of claim 7, wherein the password is not input through the third process, the mobile phone information is not detected through the fourth process, the password is mismatched through the sixth process, or the registered mobile phone information is detected through the seventh process. If it is not included in the mobile phone information, the on-line payment automatic security authentication method further comprises the step of outputting the screen by transmitting the payment processing impossible information to the user PC. The method of claim 7, wherein in order to request setting or releasing additional mobile phone authentication during the first to eighth processes, it is determined whether a mobile phone number registered by the user is detected through a local area network of the user PC. Online payment automatic security authentication method characterized in that the process to go through.

Images