KR20120094218A - Method for storing and using personal information in a portable terminal - Google Patents

Abstract

PURPOSE: A personal information storing/using method of a portable terminal using intrinsic information is provided to conveniently and safely perform an electronic payment process using a portable terminal and a credit card by using personal information through an extra portable terminal. CONSTITUTION: Personal information and a generation key are inputted through a portable terminal(11). A symmetric key is generated as the generation key and intrinsic information obtained from the portable terminal are combined with each other(13). The personal information is encoded with a password-based encoding type by using the symmetric key(15). The encoded personal information is stored in a storage unit built in the portable terminal(17). The encoded personal information is decoded.

Description

Method for Storing and Using Personal Information in a Portable Terminal}

The present invention relates to a technology for storing and using personal information in a mobile terminal, and more particularly, personal information such as credit card information used for electronic payment in a mobile terminal having its own unique information, such as a feature phone or a smart phone, Based on the key input by the user, it can be encrypted, stored, decrypted and used, so that the electronic payment process using a mobile terminal and a credit card can be performed in a safe and user-friendly manner. It relates to a method of storing and using personal information in.

In general, Internet e-commerce is performed by an interaction between a personal computer (PC) composed of a user's laptop or desktop computer and a shopping mall system having an internet web server. Recently, with the development of the field of electronic communication, the web environment of the Internet has been extended to mobile terminals, also known as smartphones. However, since mobile terminals have various limitations such as small display screens, Internet electronics using mobile terminals Commerce is not very popular.

On the other hand, in order to reduce the security vulnerability of the openness of the Internet environment in which the Internet e-commerce is conducted, to prevent forgery of the electronic information exchanged in the payment process, which is an essential element of the e-commerce, and to perform functions such as denial of electronic transactions. An accredited certificate system for digital signatures is in place.

However, when using an electronic certificate for electronic commerce payment, a digital certificate is generally stored in the user's PC, that is, stored in the hard disk or in another storage device connected to the USB port. Enter the password for the certificate. In order to use a credit card as a payment method, a user must select a card company and input card information such as a card number, expiration date, and a card password. Then, the user's PC decrypts the digital signature key using the inputted certificate password and generates an authentication token by combining the value of the electronic signature with credit card information and product purchase history information for electronic payment, for example. An authentication token is sent to an external authority such as a card approval system. In this case, a security vulnerability exists in which personal information such as certificate password or credit card information that must be input from the user's PC can be simply extracted by a malicious third party using a keyboard hacking program or the like. Furthermore, whenever a user wants to pay using a credit card, the user selects a card company, and then enters card information such as a card number, expiration date, and a card password, which is very cumbersome.

Therefore, there have been proposals to perform electronic payment by using not only a user's PC but also a portable terminal which the user carries with the purpose of eliminating this security vulnerability. For example, in Korean Patent Registration No. 10-0785894 "System and Method for Performing Electronic Signature Using Mobile Phone" (Patent Holder: Korea Financial Services Agency), the electronic signature is performed in the mobile phone and only the result value is transmitted to the subscriber PC. By doing so, there is described a method of performing an electronic signature so that information such as an electronic signature key does not leak to the outside. The electronic payment process using the user's portable terminal together with the user's PC provided by this technology has the advantage of improved security. However, according to this technology, there is a limit that the mobile phone, which is a mobile terminal, plays only a role of automatically generating an electronic signature value and transmitting it to a PC. The limitation is that, for example, in the case of attempting to make an electronic payment using a credit card, since the card information still needs to be input from a PC or a mobile terminal, there is a security vulnerability in the input process of the credit card information. There is still a problem of being cumbersome because you have to enter it manually.

Therefore, in the technology of improving the security of the electronic payment process by using the user's PC and the user's portable terminal together in the electronic payment process using a credit card when making an e-commerce payment, the card information and the certificate of authentication are secured to the mobile terminal. If the electronic payment process is made by using a mobile terminal by storing and using it, it may be advantageous because the security convenience can be eliminated and the convenience of the user can be increased.

The present invention has been made to solve the problems of the electronic payment technology using a credit card of the conventional electronic commerce in view of the above problems and to provide another advantage, the present invention provides an electronic transaction using a credit card in electronic commerce through a communication network By using personal information such as card information required to perform payment through a separate mobile terminal, it is possible to enhance the security of the electronic payment process and to securely store and use personal information used in the mobile terminal at the same time. Provides a process of encrypting, storing, and decrypting personal information in connection with the unique information of the mobile terminal, so that the card information used in the mobile terminal is used every time a user makes an electronic payment using a credit card. So that it can be used safely without typing And that for that purpose.

In addition, the present invention encrypts and decrypts the personal information used in the mobile terminal by linking the personal information used in the electronic payment and the official certificate used in the electronic signature, thereby minimizing the information that the user inputs through the mobile terminal. The purpose is to improve the convenience of the user at the time of payment.

This object is achieved by a method of storing and using personal information in a mobile terminal having unique information according to the present invention.

According to an aspect of the present invention, there is provided a method of storing and using personal information in a mobile terminal having unique information, the method comprising: waiting for personal information and a generation key to be inputted through the mobile terminal; Generating a symmetric key by combining the input generation key and the unique information of the mobile terminal obtained from the mobile terminal; Encrypting personal information using a symmetric key in a password-based encryption method; And storing the encrypted personal information in a storage unit embedded in the mobile terminal, and then decrypting the encrypted personal information.

The decrypting of the encrypted personal information may include: waiting for the generation key to be input through the mobile terminal; Generating a symmetric key by combining the input generation key and the unique information of the mobile terminal obtained from the mobile terminal; And decrypting the encrypted personal information by using the symmetric key.

A method of storing and using personal information in a mobile terminal having unique information provided according to a specific aspect of the present invention is a method for storing and using personal information in a mobile terminal having unique information and storing an authorized certificate. Waiting for inputting personal information and a password of the official certificate through the mobile terminal; Generating a symmetric key by combining the password of the inputted public certificate and the unique information of the mobile terminal obtained from the mobile terminal; Password-based encryption of the personal information using the symmetric key; Storing the encrypted personal information in a storage unit embedded in the mobile terminal; Waiting for the password of the authorized certificate to be input through the portable terminal, and repeating the steps of generating the symmetric key by combining the inputted password of the certified certificate and the unique information of the portable terminal; And decrypting the encrypted personal information by using the generated symmetric key.

In one embodiment, the personal information may be card information including card company information, card number, expiration date, and card password associated with a credit card to be used for electronic payment.

In another embodiment, the unique information may include a phone number and / or an equipment serial number (ESN) of the mobile terminal.

According to the present invention having the above-described configuration, the personal information such as card information required for performing electronic payment using a credit card in an electronic commerce through a communication network is used through a separate mobile terminal, thereby securing the security of the electronic payment process. Can be improved. Furthermore, the present invention encrypts and stores personal information used in connection with specific information of a specific mobile terminal so that the personal information used in the mobile terminal can be safely stored and used in the mobile terminal, and then provided to be decrypted and used. In the process of performing an electronic payment using a credit card, the card information used in the mobile terminal can be used safely without having to enter every payment. In addition, the present invention in the process of encrypting and decrypting the personal information used in the mobile terminal, by configuring the user to associate the personal information, such as credit card information used at the time of electronic payment, and the authentication certificate used for electronic signature, for example, the user By minimizing the information entered through the electronic payment provides a remarkable effect of improving the convenience of the user.

1 is a flowchart illustrating a process of encrypting and storing personal information in a mobile terminal in a method according to an embodiment of the present invention.
FIG. 2 is a flow chart illustrating schematically a process of decrypting a personal information in order to use the encrypted personal information in a mobile terminal in which the personal information is encrypted after being stored in the method according to an embodiment of the present invention.
3 is a flowchart illustrating a process of encrypting, storing, and then decrypting personal information in a method according to a specific embodiment of the present invention.
Figure 4 is a schematic diagram showing an example of a system for performing an electronic payment by performing an electronic signature through a public certificate using the card information stored in the mobile terminal by the method according to the present invention.

Hereinafter, an embodiment of a method for storing and using personal information in a mobile terminal having unique information according to the present invention will be described in detail with reference to the accompanying drawings.

The present invention relates to a method of storing and using personal information in a mobile terminal having unique information. In particular, in electronic commerce, personal information such as credit card information may be used to execute electronic payment through a mobile terminal, and the personal information may be encrypted, stored in the mobile terminal, and then used for decryption.

4 shows an exemplary system capable of performing electronic payment using a mobile terminal storing credit card information according to the method according to the present invention-see Patent Application No. 10-2011-0010599 by the Applicant The overall configuration is shown. In more detail, the electronic payment system using this exemplary mobile terminal includes a shopping mall server 1 for performing e-commerce, a card approval server 2 for approving payment, and a first terminal 3 of the user. It may be configured to include a second terminal 5, and a relay server (4).

The shopping mall server 1 may be, for example, a web server that provides information of an article under a web environment of the Internet, and selects and purchases and pays a desired article. The card approval company server 2 is a system for receiving the payment approval request from the shopping mall server 1, approving or rejecting the payment, and notifying the shopping mall server 1 of the result of the payment. Such a shopping mall server 1 and a card approval company server 2 are widely known in the field of electronic commerce on the Internet.

In the related art, it is common for a user to perform an electronic commerce using a single terminal. First, a user visits an e-commerce web page provided by the shopping mall server 1 by using the first terminal 3, examines the displayed item information, and selects a desired item to apply for a purchase. In this process, product purchase information is generated. The generated product purchase information may include information such as a product name, a product model, a quantity, a price, a purchase date, a seller's name and contact information, a buyer's name and contact information, and a delivery address. When the selection of the goods is completed and a purchase is requested, the shopping mall server 1 may start an electronic payment process and provide a screen for starting payment to the first terminal 3 of the user. Here, the user can select a payment method. In this exemplary system, in particular, the user pays attention only to the process of making a payment using a credit card. When the card payment is selected from the first terminal 3 of the user, the shopping mall server 1 requests to select a card company, and the credit card information of the selected card company, that is, the credit card number, the expiration date of the credit card, the password of the credit card, and the like. You are asked to enter your card information. When such information is input from the first terminal 3 of the user, the shopping mall server 1 combines the goods purchase information and the card information to generate the payment approval request information, and transmits it to the card approval company server 2. The card approval company server (2) requests the electronic signature to the first terminal (3) of the user for the received payment approval request information, the user inputs the digital signature by entering the password of the certificate in the first terminal (3) The first terminal 3 transmits this to the card approval company server 2. The card approval company server 2 receives and verifies the electronic signature value transmitted from the first terminal 3 of the user to perform payment approval.

Compared to the conventional electronic payment method described above, in the credit card payment method according to the exemplary system shown in FIG. 4, the second terminal provides the card information and the electronic signature using the authorized certificate. Has For this purpose, the user must essentially have two terminals. This is easily realized since a mobile phone or a smart phone is a reality that is almost essential as a personal portable item.

The first terminal 3 of the user plays a role of selecting the item that the user wants to purchase and selecting a credit card as a payment method, as in a normal e-commerce. The mobile phone number of the second terminal 5 may be input and transmitted to the shopping mall server 1. For example, the second terminal 5 of the user may input a password of an authorized certificate required for payment, perform an electronic signature using the same, and generate an authentication token required for payment by combining previously stored card information. You may be in charge. Meanwhile, the relay server 4 may play a role of delivering the authentication token generated by the user's second terminal 5 to the card approval company server 2.

Here, the first terminal 3 of the user is described as a personal computer such as a notebook or a desktop, but is not limited thereto. Any system capable of performing electronic commerce in a wired or wireless web environment on the Internet can be used without limitation. . On the other hand, the second terminal 5 of the user is a communication terminal that can be uniquely identified using a mobile phone number or a phone number.

Referring back to FIG. 4, the first terminal 3 of the user may access the shopping mall server 1 under a web environment of the Internet, for example. The user selects a desired product to purchase based on the product information provided by the shopping mall server 1 by using the first terminal 3, selects a credit card as a payment method, and provides mobile phone information of the second terminal to be digitally signed. By inputting, it is possible to start the electronic payment for the goods to be purchased. The shopping mall server 1 may transmit a purchase history and a mobile phone number to the card approval company server 2 to request a payment. The card approval company 2 may transmit the payment request information to the relay server 4 to request electronic signature and card information necessary for payment. The relay server 4 may request the electronic signature and the card information by accessing the second terminal 5 which is the user's mobile terminal using the mobile phone number. Then, the user may run the required application in the second terminal 5, execute the electronic signature, generate an authentication token including the card information, and transmit the same to the relay server 4. When the authentication token is transmitted from the relay server 4 to the card approval company 2, the card approval company may verify the electronic signature included in the authentication token and approve the payment.

When providing the electronic signature and the card information by using the mobile terminal as in the electronic payment process using the mobile terminal as described above, the card information for payment is stored in the mobile terminal rather than the user inputting the card information cumbersomely. Since it is stored in advance, it may be very convenient to configure it so that the user can use it without any input.

The present invention encrypts and decrypts personal information such as card information only by input of an electronic signature password, such as an accredited certificate password, so that it can be used when personal information for electronic payment is to be entered in a mobile terminal as in the exemplary system. It has the feature to make it possible. Accordingly, the user can only provide the convenience of using the digital signature and the decrypted card information by the authentication certificate by inputting only the password of the authentication certificate.

Now, with reference to FIGS. 1 to 3, a method of storing and using personal information in a mobile terminal having unique information according to the present invention will be described.

The mobile terminal used according to the present invention is a communication terminal uniquely identifiable using a mobile phone number as already mentioned with reference to FIG. It may also be, for example, a terminal that includes a Equipment Sereal Number (ESN) that can uniquely identify the machine itself. In more detail, the mobile terminal may include a mobile phone, also called a feature phone, capable of data communication through a 2G network or a 3G network, or a smartphone capable of data communication through a wireless Internet such as a 3G network or a Wi-Fi network. However, the mobile terminal according to the present invention is not necessarily limited to a mobile phone or a smart phone, but is a communication terminal having a phone number and / or an ESN, and includes a storage unit capable of storing data such as, for example, a flash memory. It is sufficient to satisfy only the condition that the terminal includes an input means for inputting data and can perform at least a processing function capable of encryption and decryption.

Specifically, in the form of at least one or more applications executed in a mobile terminal having unique information, which may be a phone number and / or an ESN as described above, personal information as shown in FIG. 1 according to an embodiment of the present invention. It may be provided a process of encrypting and storing, and a process of decrypting in order to use the personal information is encrypted and stored as shown in FIG.

As shown in FIG. 1, the process of storing personal information includes: waiting 11 for input of personal information and a generation key through a mobile terminal; Generating a symmetric key by combining the input generation key and the unique information of the mobile terminal obtained from the mobile terminal (13); Encrypting the personal information using a generated symmetric key in a password-based encryption method (15); And storing the encrypted personal information in a storage unit embedded in the mobile terminal.

The personal information, which may be information used in an electronic payment process such as credit card information according to the method according to the present invention, is embedded in the "generation key" input by the user and the mobile terminal itself to uniquely identify each mobile terminal. It is characterized by being encrypted with a symmetric key generated using "unique information" together.

Here, the generated key is information input by the user, and thus may have a form of a password (password) combining letters and / or numbers.

An example of the symmetric key generation process is as follows. First, when the generation key is P and the unique information of the mobile terminal is Q, the P + Q value is hashed 1024 times with the SHA256 algorithm, and 16 bytes of the result value can be used as the symmetric key. The other 20 bytes of the result value may be used as a message authentication code (MAC).

When encrypting personal information using a symmetric key, a well-known password-based encryption scheme such as PKCS # 5 can be applied. In addition, MAC can be added to personal information encrypted through password-based encryption to ensure the integrity of the message.

The personal information encrypted and MAC added may be stored in a storage unit such as a flash memory embedded in the mobile terminal. This stored information cannot be used as it is, and can only be used after it has been decrypted to its original state.

In the present invention, encryption and decryption of personal information are performed by the same key, that is, a symmetric key. At this time, it is preferable that the symmetric key used for encryption is not stored in the portable terminal. This is because when stored in the mobile terminal, there is a risk that the symmetric key will leak out of the mobile terminal. Therefore, it is preferable that a symmetric key is newly generated when encrypting and decrypting personal information. The symmetric key for decryption can be generated using the same generation key and unique number of the mobile terminal as the " generation key "

According to a specific embodiment of the present invention, the decryption of the encrypted personal information stored in the portable terminal, as shown in Figure 2, through the portable terminal is the same as the generated key used in the encryption process is input Waiting to be carried out (21); Generating a symmetric key by combining the input generation key and the unique information of the mobile terminal obtained from the mobile terminal (23); Decrypting the encrypted personal information using the generated symmetric key may include (25, 27).

According to a particularly preferred embodiment, by storing only the certificate and the card information in advance in the mobile terminal, by entering only the password of the certificate, the electronic payment request and the electronic signature using a credit card can be made at the same time. In Figure 3 as a method that can be configured for this, using a symmetric key derived based on the authentication certificate password, after encrypting the card information to store the encrypted card information in the mobile terminal, which is stored later on electronic payment An example of a process of reading 'encrypted card information' and then decrypting using the regenerated symmetric key is shown.

Referring to FIG. 3, the method assumes a mobile terminal having a public certificate already stored and having identification information unique to a terminal such as a phone number or an ESN. When a user attempts to store card information by driving an application implementing the method in such a mobile terminal, the application first waits for the user to input personal information to be encrypted (31). In this case, the personal information is preferably information related to a credit card to be used for electronic payment, that is, card information. After the card information is input or at the same time wait 32 to enter the password of the public certificate stored in the mobile terminal. In these steps 31 and 32, the user can input card information, such as card company information, credit card number, credit card expiration date, credit card password, CVC number, etc. through the input screen provided by the application. In addition, it is also possible to enter the password of the public certificate in the form of a combination of numbers and / or letters, for example. If there are several accredited certificates stored in the mobile terminal, it is obvious that a step of providing a user to select a desired accredited certificate may be added.

When the user enters the card information and the password of a specific public certificate, the application combines the unique information of the mobile device, such as a telephone number or ESN, obtained from the mobile device with the password of the public certificate entered and, for example, using the SHA256 algorithm. For example, the symmetric key may be generated by taking a hash of 1024 times and then selecting some of the result values (33). Using the generated symmetric key, the card information may be encrypted using a password-based encryption scheme such as PKCS # 5 scheme (34). The encrypted card information is stored in the mobile terminal (35).

Then, when the user uses the credit card information and makes an electronic signature, for example for electronic payment, the user can run an application that implements the method of the present invention. The application then repeats the step 32 of waiting for the password of the public certificate to be input and generating the symmetric key 33 by combining the phone number and / or ESN information of the password mobile terminal of the public certificate. .

Using the symmetric key generated as described above, the card information stored in the encrypted state in the portable terminal can be decrypted (36), and the decrypted card information can be provided for use in the electronic payment process (37). .

According to the method of the present invention as described above, since personal information such as card information is stored and stored in the mobile terminal, it is possible to securely store the card information. Then, when a user wants to use the card information, the user inputs a password for decryption. In addition, for example, it may be provided that there is no need to input card information one by one.

In addition, according to the present invention, the symmetric key for encrypting and decrypting the card information is not stored in the portable terminal, but is generated by a combination of a generation key input by the user whenever necessary and the unique information of the portable terminal that can be obtained from the portable terminal. . Therefore, even if the card information stored in the portable terminal is leaked to the outside it can be provided that the security is improved because the generation of the symmetric key for the decryption is impossible outside of the portable terminal.

Furthermore, if the generated key for encryption and decryption of the card information is the same as the password of the public certificate, as in the preferred embodiment of the present invention, the user may use the public certificate only by entering the password of the public certificate once, for example, It may be characterized by executing the signature and acquiring the card information necessary for the electronic payment. In general, since there may be several types of passwords entered by users for transactions in e-commerce or online banking, in the light of the inconvenience of users in the process of creating, remembering and entering multiple passwords, By only entering one password according to the present invention, the use of an authorized certificate and the use of personal information such as card information at the same time are provided with the advantage of being very convenient for the user.

While the present invention has been described as a preferred embodiment, the present invention is not limited thereto, and various modifications can be made without departing from the gist of the invention.

1: shopping mall server
2: card acceptor server
3: Terminal 1 (PC)
4: relay server
5: second terminal (smartphone)

Claims (5)

As a method for storing and using personal information in a mobile terminal having unique information,
Waiting (11) for inputting personal information and a generation key through the mobile terminal;
Generating a symmetric key by combining the input generation key and the unique information of the mobile terminal obtained from the mobile terminal (13);
Encrypting (15) the personal information using the symmetric key in a password-based encryption scheme;
Storing the encrypted personal information in a storage unit embedded in the mobile terminal (17),
Thereafter further comprising the step of decrypting the encrypted personal information. The method of claim 1, wherein the encrypted personal information is decrypted:
Waiting (21) for input of the generated key through the mobile terminal;
(23) generating a symmetric key by combining the input generation key and the unique information of the mobile terminal obtained from the mobile terminal;
Decrypting the encrypted personal information using the symmetric key (25, 27)
Method for storing and using personal information in a mobile terminal having a unique information, characterized in that it comprises a. As a method for storing and using personal information in a mobile terminal having unique information and storing a certificate,
Waiting (31, 32) for inputting personal information and a password of the official certificate through the mobile terminal;
Generating a symmetric key by combining the password of the inputted public certificate and the unique information of the mobile terminal obtained from the mobile terminal (33);
Password-based encryption (34) of the personal information using the symmetric key;
Storing (35) the encrypted personal information in a storage unit embedded in the mobile terminal;
Waiting for the password of the authorized certificate to be input through the mobile terminal, and repeating the steps 32 and 33 of generating the symmetric key by combining the password of the input certificate and the unique information of the mobile terminal. ;
Decrypting the encrypted personal information using the generated symmetric key (36)
Method for storing and using personal information in a mobile terminal having a unique information, characterized in that it comprises a. The personal information of claim 3, wherein the personal information is card information including card company information, card number, expiration date, and card password associated with a credit card to be used for electronic payment. How to save and use. The method of claim 3, wherein the unique information includes a phone number and an equipment serial number (ESN) of the mobile terminal.

Images