KR20160099767A - Secure payment method, digital system, and payment system thereof - Google Patents

Abstract

Disclosed are a secure payment method, a digital system and a payment authentication system thereof. The secure payment method includes: a step in which the digital system transmits client authentication information for authentication of the digital system or an application installed in the digital system to the payment authentication system, which will process payment; a step in which, in case the client authentication information is authenticated by the payment authentication system, the digital system receives activation information capable of activating a protection module of at least a part of the application from the payment authentication system; a step in which the digital system activates an inactivated protection module on the basis of the received activation information; and a step in which the digital system generates a checking signal including payment authentication information on the basis of first part information which is stored in the digital system and corresponds to a part of the payment information of a user, and transmits the generated checking signal to the payment authentication system, through the activated protection module. An authentication checking procedure that the payment authentication information included in the checking signal transmitted by the payment authentication system is authenticated is performed. Only when the authentication checking procedure succeeds, payment processing using payment information of the user is performed. The payment information of the user is specified by the payment authentication system. The first part information is checked from the payment authentication information. Also, checked is second part information which is stored in the payment authentication system and corresponds to at least a part of the rest information except the first part information. The present invention enables the user to perform payment with improved security by using the digital system (for example, mobile phone) of the user simply.

Description

A secure payment method, a digital system, and a payment authentication system by dividing mutual authentication and settlement information,

The present invention relates to a security settlement method, a digital system and a settlement authentication system therefor, and more particularly, to a settlement authentication system which is excellent in security through physical and / or logical division in user authentication and management of settlement information, ≪ / RTI >

Since online services such as financial transactions are activated, the user authentication of the user who requests the service (also referred to as 'user authentication'; the normal payment is performed in conjunction with the user authentication and the payment is called the payment authentication. It can be easily understood that the technical idea of the present invention can be applied variously to payment and separate authentication by ordinary experts in the technical field) It is becoming.

User authentication is especially important for online payment services. Mutual authentication between payment requesters and providers, integrity of messages, and non-repudiation must be provided for payment services, and various protocols and technologies are continuously being developed for this purpose.

As an example of the conventional authentication of the user, there are a personal authentication using a mobile phone, a personal authentication using an official certificate, a personal authentication using an OTP, an i-PIN (Internet Personal Identification Number) authentication or a personal authentication using a credit card.

All of these conventional technologies have a method of collectively inputting a password or an authentication number. Therefore, if a password or an authentication number is exposed to another person, the authentication of the user is inevitably made impossible.

On the other hand, illegal account transfer by frequent memory hacking is likely to occur in settlement. Memory Hacking Unlike pharming attacks that lead to fake Internet (mobile) banking / payment sites, online financial accidents caused by malicious code can be exploited by attackers to use security cards, OTP information, After intercepting various authentication information such as mobile phone authentication information and authorized certificate, illegal financial transaction is performed by abusing necessary information while interrupting normal transaction.

According to the related art, a financial transaction requester at the time of a financial transaction requests transaction information (e.g., a receipt account, a money amount, an implementation fee, etc.) that can specify a financial transaction to a transaction medium (e.g., a computer, a mobile phone, (For example, a password, a credit card information, an OTP, an authorized certificate, a credit card number, etc.) that can authenticate the user, Biometric information, etc.) can be input. Then, the input authentication information is transmitted to a predetermined authentication device included in the financial transaction system to perform authentication, and when the authentication result is successful, the transaction execution device executes the financial transaction using the transaction information inputted by the requestor.

At this time, the malicious code changes the transaction information to be executed by the actual transaction execution device as desired, while keeping the transaction information displayed on the transaction medium so that the requestor can not recognize the transaction information. Such a malicious code-based memory hacking can be said to be very serious because it performs an attack even when it is connected to a site for normal financial transactions.

On the other hand, many attempts have been made for easy settlement. In the conventional simple settlement methods, most of the necessary payment information (for example, card information and the like) is inputted to the user terminal in advance, and when the settlement is performed, user authentication information such as a certificate or a password is inputted so that the settlement can be easily performed . Such conventional techniques have a risk of issuing a fatal security problem when the user authentication information or the payment information is leaked because the payment information is input to the user terminal or the payment server. Simple settlement is a key factor in achieving simple behavior (for example, inputting payment information, inputting user authentication information, etc.) while maintaining security.

Korean Patent Application No. 10-2007-0112532 (Publication Date June 10, 2008) "Internet Banking Control Method for Preventing Memory Hacking and Otitito Large Device Used Therefor" Korean Patent Application No. 10-2011-014652 (Published on August 07, 2012) "Online Financial Transaction Authentication Method and Device" Korean Patent Application Publication No. 10-2013-123985 entitled " Secure Authentication Service System and Method Using Near Field Wireless Communication "

SUMMARY OF THE INVENTION It is a technical object of the present invention to provide a method and system for enabling a user to easily perform a highly secure settlement using a digital system (e.g., a mobile phone) of a user. Specifically, the payment information (for example, card information, account information, etc.) is occupied at least by the user's digital system and the payment authentication system, and the decryption key is segregated and seized, And to provide a settlement method and system that can be used.

It is also an object of the present invention to provide a method and system for preventing mutual authentication between a digital system of a user (for example, a mobile phone) and an authentication entity authenticating a service, thereby preventing an abnormal payment request from being attempted.

Further, it is possible to use payment history information (e.g., payment amount, merchant information, etc.) specified at the time of payment as basic information for generating authentication information required for payment, and to use the payment history information And to provide a method and system that can prevent memory hacking by allowing a payment to be processed when an authentication procedure is successful compared with payment authentication information.

Also, a strong payment authentication method and system can be provided in which a one-time key value is provided at the payment authentication system side to generate authentication information, and authentication information is generated using the one-time key value to prevent reuse of authentication information and improve security .

In addition, payment history information is provided (such as visual display or voice play) so that the user can more accurately recognize the payment history information when generating the authentication information, and the payment authentication information is generated using the confirmed payment history information A method and system for reducing damages of electronic financial fraud such as memory hacking caused by carelessness of a customer.

In addition, by registering the payment information (e.g., card number, account number, etc.), it is possible to reduce the inconvenience that the user has to input the payment information each time the payment is made, And a method and system for enhancing security through segregation and segregation of encryption / decryption keys.

The present invention also provides a secure settlement method and system that makes it impossible for a user terminal having a relatively low security to leak or take over the entire settlement information by allowing the entire settlement information to be confirmed only in the payment authentication system without being confirmed at the user terminal will be.

In addition, according to an embodiment of the present invention, there are three part information having different payment information (first part information corresponding to the digital system, second part information corresponding to the payment authentication system, third part information corresponding to the user authentication information The third part information may be divided into a payment information storage system different from the payment authentication system, but may be payment related part information that exists separately from the second part information in the payment authentication system and is generated corresponding to the user authentication information. The billing authentication system is capable of collecting part information divided into three parts and specifying payment information, thereby providing a highly secure settlement method and system.

According to another aspect of the present invention, there is provided a secure settlement method for a digital settlement system, the secure settlement method comprising: transmitting a client authentication information for authentication of an application installed in the digital system or the digital system to a settlement authentication system Wherein the digital system receives activation information enabling activation of at least a portion of the protection module of the application from the payment authentication system when the client authentication information is authenticated by the payment authentication system, Activating the protection module that is inactivated based on the received activation information; and activating, via the protection module in which the digital system is activated, a first part stored in the digital system and corresponding to a portion of the user's payment information Information And generating an acknowledgment signal including a payment authentication information and transmitting the generated confirmation signal to the payment authentication system, wherein the payment authentication information included in the confirmation signal transmitted by the payment authentication system is an authentication The payment processing is performed using the payment information of the user when the authentication procedure is performed and the authentication confirmation procedure is successful, the payment information of the user is specified by the payment authentication system, And the second part information corresponding to at least a part of the information stored in the payment authentication system and excluding the first part information among the payment information is identified and specified.

Wherein the payment authentication information is generated based at least on a one-time server generation key generated by the payment authentication system, and selectively generates information based on at least one of identification information of the digital system or identification information of the application Lt; / RTI >

The payment authentication information is generated based at least on a one-time server generation key generated by the payment authentication system. Optionally, the payment authentication information may include payment history information of a payment to be performed when the authentication is successful or user authentication information The information that is generated based on at least one of the two types of information.

When the payment authentication information is information generated based on the payment history information, the digital system receives and confirms the payment history information from the payment authentication system and generates the payment authentication information based on the confirmed payment history information .

Wherein when the payment authentication information is information generated based on the payment history information, the authentication confirmation procedure specifies authentication authentication information based on execution payment history information to be executed by the payment authentication system, It can be determined whether or not the information and the settlement authentication information correspond to each other.

Wherein the step of activating the protection module that is inactivated based on the activation information received by the digital system decrypts the protection module in which the digital system is stored in an encrypted state using the decryption key included in the activation information Step < / RTI >

The step of decrypting the protection module stored in the encrypted state using the decryption key included in the activation information may include decrypting the decryption key and the second decryption key based on the decryption key and the user authentication information obtained from the user, And decrypting the protection module based on the key.

The secure settlement method may further include re-deactivating the protection module after the digital system transmits the confirmation signal to the payment authentication system.

Wherein the step of transmitting the client authentication information to a payment authentication system for performing authentication includes generating the client authentication information based on at least one of identification information of the digital system, identification information of the application, or user authentication information And transmitting the generated client authentication information to the payment authentication system.

And the second part information is information that is decrypted and confirmed by the payment authentication system based on at least a part of the identification information of the digital system, the identification information of the application, or the user authentication information.

Wherein the second part information is a part of information other than the first part information and is information that is decrypted and confirmed based on identification information of the digital system, identification information of the application, or a part of the user authentication information, The third part information corresponding to information excluding the first part information and the second part information is decoded based on the identification information of the digital system, the identification information of the application, or the remaining part of the user authentication information It can be information that is confirmed.

According to another aspect of the present invention, there is provided a secure settlement method including: receiving, from a digital system, a client authentication information for authentication of a digital system of a user performing a settlement request or an application installed in the digital system; The method comprising: authenticating the client authentication information based on information previously registered in the authentication system; when the authentication of the client authentication information is successful, the payment authentication system activates at least a part of the protection module To the digital system, the protection module, which is inactivated in the digital system, based on the transmitted activation information, through the protection module activated and activated, The payment authentication system receiving the confirmation signal from the digital system when an acknowledgment signal including payment authentication information based on the first part information corresponding to a part of the payment information of the payment authentication system is generated, Performing an authentication check procedure in which the payment authentication information included in the confirmation signal is authenticated, and performing a payment process using the payment information of the user when the authentication confirmation procedure is successful, The second part information corresponding to at least a part of the remaining information excluding the first part information stored in the payment authentication system and stored in the payment information, from the payment authentication information, Specify payment information.

Wherein the payment authentication information is generated based at least on a one-time server generation key transmitted to the digital system by the payment authentication system, and optionally the identification information of the digital system, the identification information of the application, The payment history information of the payment to be made, or the user identification information that can authenticate the user.

Wherein the settlement authentication system transmits the payment history information to the digital system when the settlement authentication information is information generated based on the settlement history information, and when the payment history information is confirmed by the digital system, And the settlement authentication information is generated based on the history information.

Wherein when the payment authentication information is information generated based on the payment history information, the step of performing the authentication confirmation step comprises: the payment authentication system, based on the execution payment history information to be executed by the payment authentication system, And determining whether the specified authentication information for identification and the payment authentication information correspond to each other.

Wherein the payment authentication system transmits activation information to the digital system capable of activating at least a portion of the protection module of the application comprises the protection module in which the payment authentication system is stored encrypted in the digital system A second decryption key based on user authentication information decrypted by the decryption key or obtained from a user; and a second decryption key based on user authentication information obtained from the user by the decryption key in the digital system, And the protection module is decrypted based on the decryption key.

Wherein the payment authentication system authenticates the client authentication information based on previously registered information, wherein the payment authentication system is based on at least one of identification information of the digital system, identification information of the application, or the user authentication information Receiving the client authentication information, specifying authentication authentication information corresponding to the received client authentication information, and determining whether the specific authentication authentication information and the received client authentication information correspond to each other.

The settlement authentication system may decode the second part information based on at least a part of the identification information of the digital system, the identification information of the application, or the user authentication information.

Wherein the second part information is a part of information other than the first part information and is information that is decrypted and confirmed based on identification information of the digital system, identification information of the application, or a part of the user authentication information, The third part information corresponding to information excluding the first part information and the second part information is decoded based on the identification information of the digital system, the identification information of the application, or the remaining part of the user authentication information And is information that is confirmed.

The above method can be implemented by a computer program installed in the data processing apparatus.

According to an aspect of the present invention, there is provided a digital system including a communication module for transmitting client authentication information for authentication of the digital system or an application installed in the digital system to a payment authentication system, a deactivated protection module, Wherein the control module receives activation information capable of activating at least a part of the protection module of the application from the payment authentication system via the communication module when the client authentication information is authenticated by the payment authentication system Activating the protection module that is inactivated based on the received activation information, activating the protection module that is inactivated based on the received activation information, and generating, based on the first part information stored in the digital system through the activated protection module, And An authentication confirmation procedure is performed in which a generated confirmation signal is transmitted to the payment authentication system and the payment authentication information included in the confirmation signal transmitted by the payment authentication system is authenticated, The payment processing using the payment information of the user is performed, the payment information of the user is specified by the payment authentication system, the first part information is confirmed from the payment authentication information, and the payment information is stored in the payment authentication system And the second part information corresponding to at least a part of the remaining information of the payment information excluding the first part information may be identified and specified.

According to an aspect of the present invention, there is provided a billing authentication system comprising: a communication unit for receiving client authentication information for authentication of a digital system of a user performing a payment request or an application installed in the digital system; A DB in which information about an application is registered, an authentication module for authenticating the client authentication information based on information previously registered in the DB, and activating at least a part of the protection module of the application when authentication of the client authentication information is successful And a control unit for activating and deactivating the protection module which is inactivated in the digital system based on the transmitted activation information, When a confirmation signal including payment authentication information based on the first part information corresponding to a part of the payment information stored in the digital system is generated and received through the call module, Wherein the control unit performs a payment process using the payment information of the user when the authentication confirmation process is successful and transmits the settlement authentication information from the payment authentication information to specify the payment information of the user Checking the first part information, checking the second part information corresponding to at least a part of the information stored in the payment authentication system and excluding the first part information from the payment information, do.

The settlement authentication system further includes a key generation unit for generating a disposable server generation key to be transmitted to the digital system, wherein the settlement authentication information includes at least a server generation key generated by the key generation unit and transmitted to the digital system, Based on at least one of identification information of the digital system, identification information of the application, payment history information of a payment to be performed when authentication is successful, or user authentication information capable of authenticating a user And is generated information.

Wherein the control unit specifies authentication authentication information corresponding to the payment authentication information, performs the authentication authentication process by determining whether the specified authentication authentication information and the payment authentication information correspond to each other, In the case of information generated based on the information, the authentication authentication information can be specified based on the execution payment history information to be executed by the payment authentication system.

The client authentication unit may include a decryption key for decrypting the protection module, which is stored in an encrypted state in the digital system, in the activation information.

According to the technical idea of the present invention, there is an effect that a user can provide a highly secure settlement method using only a digital system of a user (for example, a mobile phone).

In addition, mutual authentication between a digital system of a user requesting settlement and an authentication unit authenticating a service is strengthened to prevent an unauthorized settlement attempt, thereby preventing an unauthorized attack.

In addition, when the client authentication is attempted, by generating the client authentication information based on both the identification information of the digital system and the identification information of the application, it is possible to prevent the application from being leaked or installed in other terminals, There is an effect that can be improved.

In addition, the payment history information itself is used as basic information for generating authentication information required for authentication, and compared with verification authentication information based on payment history information actually executed in the payment processing step, There is an effect that it is possible to prevent the electronic financial fraud such that the intended payment history information is transformed before execution of the financial transaction.

Also, in order to generate authentication information, the settlement authentication system provides a one-time key value and generates authentication information using the one-time key value, thereby preventing reuse of authentication information and improving security.

In addition, payment history information is provided (such as visual display or voice play) so that the user can more accurately recognize the payment history information when generating the authentication information, and the payment authentication information is generated using the confirmed payment history information Thereby reducing the damage of the electronic financial fraud such as memory hacking caused by the carelessness of the customer.

In addition, by registering the payment information (e.g., card number, account number, etc.), it is possible to reduce the inconvenience that the user has to input the payment information each time the payment is made, And the encryption / decryption key is segregated and occupied, thereby providing an effect of greatly enhancing security.

In addition, since the entire payment information can be confirmed only in the payment authentication system without being confirmed at the user terminal, there is an effect that security can be secured even if settlement is leaked or seized at a user terminal having a relatively low security.

In addition, three pieces of part information having different settlement information (first part information corresponding to the digital system, second part information corresponding to the payment authentication system, third part information corresponding to the user authentication information It may be divided into a payment information storage system different from the payment authentication system, but it may be the payment related part information which exists separately from the second part information in the payment authentication system and is generated corresponding to the user authentication information) , The payment authentication system can collect the part information divided into three different parts and specify the payment information, so that there is an effect that very strong security is provided.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
FIG. 1 shows a schematic configuration for implementing a secure settlement method according to an embodiment of the present invention.
FIG. 2 shows a schematic configuration of a digital system for a secure settlement method according to an embodiment of the present invention.
FIG. 3 shows a schematic configuration of a payment authentication system for a secure payment method according to an embodiment of the present invention.
4 shows a schematic data flow of a secure settlement method according to an embodiment of the present invention.
FIG. 5 shows a schematic data flow of a security settlement method according to another embodiment of the present invention.
6 shows an example in which transaction information is displayed in a digital system according to an embodiment of the present invention.

In order to fully understand the present invention, operational advantages of the present invention, and objects achieved by the practice of the present invention, reference should be made to the accompanying drawings and the accompanying drawings which illustrate preferred embodiments of the present invention.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component. Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the preferred embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

FIG. 1 shows a schematic configuration for implementing a secure settlement method according to an embodiment of the present invention.

Referring to FIG. 1, a digital system 100 and a payment authentication system 200 may be provided to implement a secure payment method according to an embodiment of the present invention. According to an embodiment, a predetermined data processing apparatus 300 may be further provided. Further, the settlement system 400 connected to the settlement authentication system 200 to actually perform settlement may be further provided.

The digital system 100 can implement the technical idea of the present invention while transmitting / receiving necessary information to / from the payment authentication system 200 through a wire / wireless network.

Other conventional user authentication methods (for example, authentication using a public certificate, etc.) may be performed before or after the payment authentication according to the technical idea of the present invention is performed for stronger security.

Although the digital system 100 is illustrated as a mobile phone in FIG. 1, it may be defined to include all types of data processing devices capable of communicating with the payment authentication system 200 through a wired or wireless network. For example, the digital system 100 may be a data processing device that is easily carried by a user, such as a tablet, a music player, a wearable device, or the like. The digital system 100 is preferably capable of communicating with the payment authentication system 200 and / or the data processing apparatus 300 via a network.

In the digital system 100, an application for implementing the technical idea of the present invention may be installed. An application system capable of implementing the technical idea of the present invention can be implemented by organically combining the application and the hardware of the digital system 100. Hereinafter, when the digital system 100 performs a predetermined function or operation, it may be understood that the application system may perform the function or operation.

The digital system 100 may be a terminal requesting payment. Alternatively, a user of the digital system 100 may request payment using a predetermined data processing device (e.g., a computer, a mobile phone, etc.) 300, and perform payment authentication using the digital system 100. In this case, the digital system 100 functions as an authentication medium for performing payment authentication. In any case, since users generally have the digital system 100, it is not necessary to possess a separate security torque and OTP token for payment authentication.

The payment authentication system 200 may mean a system for performing payment authentication according to the technical idea of the present invention. According to an example, the payment authentication system 200 may refer to a system of an intermediary agency (for example, PG, VAN, etc.) for mediating settlement. In this case, the payment authentication system 200 communicates with a settlement institution system (e.g., a credit card company system, a bank or a securities company system 400) to transmit settlement information to the settlement institution system (400).

In this specification, the payment information may mean information that can identify the payment means necessary for settlement. The payment information may be, for example, a card number, but is not limited thereto. The payment information may be account information according to the payment method, or a predetermined identification code defined for each payment service for payment may be used as the payment information . In any case, the payment information may refer to information capable of identifying the payment means or information defined by the service side to identify the payment means.

Although the settlement authentication system 200 and the settlement system 400 are implemented as separate physical devices in FIG. 1, the settlement authentication system 200 may be implemented by the settlement system 400, As shown in FIG. In other words, payment software authentication and / or settlement according to the technical idea of the present invention may be performed by installing predetermined software that implements the functions of the payment authentication system 200 in the settlement agency system 400.

The data processing apparatus 300 may be a device for outputting a payment request inputted by a user on-line, such as a user's PC. Alternatively, the data processing apparatus 300 may be a predetermined merchant terminal (a POS device installed in a store, a mobile merchant terminal, or the like). In this case, the user or the merchant may transmit the authentication request to the payment authentication system 200 by inputting the identification information (e.g., telephone number) of the digital system 100 of the user to the merchant terminal.

According to an embodiment, the user may notify identification information of the digital system 100 of his / her own to the franchisee to perform settlement at a remote place. Then, the merchant may transmit the payment request to the payment authentication system 200 by inputting the identification information using the data processing device 300. [ Then, if the digital system 100 and the payment authentication system 200 perform the payment authentication defined in this specification and the payment authentication is successful, the payment requested by the data processing apparatus 300 can be finally approved.

The digital system 100 may request payment to the payment authentication system 200. Alternatively, the data processing apparatus 300 may request payment.

According to the technical idea of the present invention, the digital system 100 may perform the client side authentication first by communicating with the payment authentication system 200.

Client-side authentication in this specification may mean authentication for the digital system 100 itself and / or authentication for an application installed in the digital system 100 to implement the technical idea of the present invention .

The digital system 100 may transmit the client authentication information to the payment authentication system 200 to perform the client side authentication. The client authentication information may refer to information that can authenticate the identification information of the digital system 100 and / or the identification information of the application, and may include identification information of the digital system 100 and / And information obtained by performing predetermined encryption, encoding, and / or hashing based on the information. Of course, the identification information of the digital system 100 and / or the identification information of the application itself may be combined in a predetermined manner and included in the client authentication information.

According to an embodiment, the client authentication information may be information generated based on user authentication information capable of authenticating a user. It is preferable that at least one of the identification information of the digital system 100 or the identification information of the application is based on generating the client authentication information even when the client authentication information is generated based on the user authentication information have.

In the payment authentication system 200, information for authenticating the client authentication information may be registered in advance. For example, the identification information of the digital system 100 and / or the identification information of the application itself may be registered in the payment authentication system 200, and encryption, encoding, and / or hashing may be performed and stored It is possible. In any case, the client authentication information generated based on the identification information of the digital system 100 and / or the identification information of the application can be authenticated by the payment authentication system 200. Depending on the implementation, it may be generated based on a disposable server generation key generated by the payment authentication system 200 described later.

Hereinafter, when the client authentication information or payment authentication information is generated based on predetermined information in the present specification, the predetermined information is defined as basic information.

For example, when the client authentication information (payment authentication information to be described later) is generated by a plurality of basic information (for example, identification information of the digital system 100 and identification information of the application) (Or mixed) by a predetermined method, and the like.

According to the embodiment, information in which each of the plurality of pieces of basic information is protected (e.g., encoded, encrypted, and / or hashed) in a predetermined manner is included in the client authentication information, A plurality of pieces of information may be combined (or mixed) in a predetermined manner to include protection-processed information, or a plurality of pieces of basic information may be combined (or mixed) in a predetermined manner to include protected-processed information.

In any manner, the authentication side (i.e., the payment authentication system 200) knows the information corresponding to each of the basic information on which the client authentication information (or the payment authentication information) is generated, Authentication information for authentication that can authenticate the client authentication information (or payment authentication information) in a manner corresponding to the manner in which the information is generated.

Accordingly, when the predetermined client authentication information (or settlement authentication information) is authenticated, it means that each of the basic information based on the generation of the client authentication information (or the settlement authentication information) is authenticated. The fact that each basic information is authenticated means that a device, user, or software corresponding to the basic information is legitimate.

For example, the fact that the basic information of the client authentication information for the client side authentication is the identification information of the digital system 100 and / or the identification information of the application, and that the client authentication information is authenticated indicates that the digital system 100 and the application May be a legitimate digital system and application that is (is) (or is) registered in the payment authentication system 200. In addition, when the one-time information is further used as the basic information in the client authentication information, the client authentication information may be given a one-time function to further enhance security.

When both the digital system 100 and the identification information of the application are used as the basic information of the client authentication information, the digital system 100 and the application are both scheduled (on) the payment authentication system 200, (Or registered) device and software. That is, this means that the client authentication information is authenticated only when the application is installed in the digital system 100, which means that authentication is not performed when the application is installed in another apparatus. Therefore, it can mean that the application can be normally executed only in the digital system 100 designated in advance.

As the basic information of the client authentication information, user authentication information (e.g., password, pattern, certificate information, or biometric information of the application) may be further used.

On the other hand, for stronger security, not only the client side is authenticated by the payment authentication system 200 but the payment authentication system 200 needs to be authenticated by the client side (i.e., the digital system 100 or the application) . That is, mutual authentication between the payment requester (digital system 100) and the authenticator (payment authentication system 200) may be required.

Although message-based authentication (e.g., MAC or HMAC, etc.) has conventionally been used for mutual authentication, according to the technical idea of the present invention, at least a part of the application (hereinafter referred to as a protection module) Or the like. And activate at least a portion of the application that is deactivated, i. E., The protection module, based on the activation information received from the payment authentication system 200 if the client side is authenticated. For example, the protection module is stored in the digital system 100 in an encrypted state, and is activated (decrypted) when a decryption key that can be used for decrypting the encrypted protection module is included in the activation information and received . The decryption key may be an asymmetric key as well as a symmetric key. If the client side authentication is unsuccessful, the application will not operate normally, and thus a strong mutual authentication mechanism can be provided.

The digital system 100 may decrypt the protection module using only a decryption key included in the activation information. However, in order to secure stronger security, the digital system 100 may provide user authentication information (e.g., password, pattern, certificate information, biometric information, And decrypting the protection module by using a second decryption key based on the second decryption key. Wherein the decoding key and the second decryption key are decrypted based on the decryption key and the second decryption key, wherein the decryption key and the second decryption key are sequentially decrypted or generated through a predetermined operation Decryption key may be combined in a predetermined manner) to be decoded by the integrated decryption key. Or it may be a sequential double decryption that is decrypted with the decryption key and activated by decryption with the second decryption key (or vice versa).

In the case of decryption by the integrated decryption key, the protection module is encrypted with the encryption key corresponding to the integrated decryption key. In order to activate the protection module, not only the reception of the activation information, but also the input of valid user authentication information It means that the protection module is decrypted and operated normally only by the user. Therefore, even if the activation information is leaked by an attack, the protection module may not be activated by the attacker, and the decryption key may not operate at all.

In addition, inactivation and activation of the protection module may be implemented not only by encryption but also by encoding the protection module in a predetermined manner, and the activation information includes information necessary for decoding. At this time, the decoding information included in the activation information and the second decoding information based on the user authentication information may be used for decoding.

In any case, the protection module is normally deactivated so as not to normally perform the operation or function to be performed by the application, and when the client side authentication is successful, the protection module is received from the payment authentication system 200 Based on the activation information, an activation state in which an operation or a function can be normally performed. Of course, the protection module may be implemented to return to the inactive state again after performing its operation or function. The operation or function of the protection module may be, for example, generation of payment authentication information for authenticating an authentication request as described later.

When the activation information for activating the deactivated protection module is received from the payment authentication system 200, the payment authentication system 200 controls the protection module 200 in the inactive state, Can be mutually authenticated because it can mean that it is a legitimate system capable of activating.

In addition, a stronger authentication protocol may be possible than simply performing mutual authentication by simply encrypting / decrypting a specific message based on a shared key. That is, as compared with the message-based mutual authentication (MAC, etc.), the authentication process to be performed later may not be started at all by encrypting a part of the application itself to be authenticated, or the forgery and falsification itself may not be easy.

Meanwhile, the protection module may be all or part of the application except for the client side authentication and the configuration for activation of the protection module. In addition, the protection module may include a configuration for generating payment authentication information at least as described later.

The settlement authentication information is information that the digital system 100 transmits to the payment authentication system 200 in order to authenticate the legitimacy of the payment request transmitted from the digital system 100 or the data processing apparatus 300 have. When the payment authentication information is authenticated by the payment authentication system 200, the requested payment request can be authenticated and processed by the payment authentication system 200. It means that a series of procedures are performed in which payment information is transmitted to the settlement institution system 400 so that the settlement is normally performed so that the settlement is completed. Of course, when the settlement authentication system 200 is included in the settlement institution system 400, it may mean that a procedure for completing the settlement based on the specified settlement information is performed.

The settlement authentication information may be generated by at least one basic information as described above. The basic information of the payment authentication information may include first part information which is a part of the payment information. The first part information may be part of the payment information and may be information stored in the digital system 100. Of course, the digital system 100 may be protected by various encoding schemes such as encryption. The first part information may be calculated in a predetermined manner so as to be recovered by the payment authentication system 200 and used to generate the payment authentication information. The payment authentication information may be included in the confirmation signal and transmitted to the payment authentication system 200.

The basic information of the payment authentication information may further include a server generation key. The server creation key may be information generated by the payment authentication system 200 and transmitted to the digital system 100. The server creation key may be a random number value generated by one-time use or an OTP or the like which generates predetermined information as a seed value. In any case, the server creation key may be one-time information used at a specific point in time, and may not be re-used information. Therefore, since the one-time server generation key is used as basic information of the settlement authentication information, reuse of the settlement authentication information can be prevented. The server generation key may be used as basic information of the client authentication information or the payment authentication information.

The identification information of the digital system 100 and / or the identification information of the application may be further used as basic information of the settlement authentication information. The identification information of the digital system 100 and / or the identification information of the application may be used again as basic information of the settlement authentication information, which has already been used for client side authentication, and thus, Can be achieved is well known in the security arts. Of course, the information used as the basic information of the client authentication information among the identification information of the digital system 100 or the identification information of the application may not be used as basic information of the payment authentication information. The identification information of the digital system 100 may include identification information (e.g., identification information of a USIM, identification information of a USIM, etc.) of the hardware of the digital system 100 (hardware included in the digital system 100 IMSI, IMEI, MAC address, OS ID, etc.), or a telephone number if the digital system 100 is a telephone. Further, the identification information of the application may be information unique to the application, and may be given by the distribution subject of the application.

On the other hand, user authentication information may be further used as basic information of the settlement authentication information. The user authentication information is information that can authenticate the user, and as is widely known, a password, secret pattern, certificate information, biometric information of the user, etc. set by the user can be used.

Further, according to the technical idea of the present invention, predetermined payment history information may be used as basic information of the payment authentication information. The payment history information may be information that can be specified to perform settlement and specify a settlement transaction. The payment history information may mean a payment amount, a name of a merchant to be paid, a merchant code, and the like.

The payment authentication information may be information generated based on a plurality of basic information as described above. The payment authentication information is based on at least first part information and is information generated based on at least one of a server generation key, identification information of the digital system 100, application identification information, user authentication information, Lt; / RTI > Here, the fact that the payment authentication information is generated based on a plurality of basic information does not mean that only one payment authentication information is generated based on all of the plurality of basic information. A case in which the first payment authentication information is generated based on a part of a plurality of basic information when a plurality of basic information exists and a second payment authentication information is generated based on remaining basic information. Accordingly, transmitting an acknowledgment signal including the payment authentication information to the payment authentication system 200 includes transmitting the first confirmation signal including the first payment authentication information, and transmitting the second confirmation signal including the second payment authentication information, And a case in which an acknowledgment signal is transmitted.

For example, the basic information of the payment authentication information includes first part information and authentication information (e.g., a server generation key, identification information of the digital system 100, application identification information, user authentication information , Or payment history information). The first payment authentication information is generated based on the authentication object information, and a first confirmation signal including the first payment authentication information may be transmitted to the payment authentication system 200. [ When the first payment authentication information is authenticated, the payment authentication system 200 generates second payment authentication information based on the first part information, and when a second confirmation signal including the second payment authentication information is the payment authentication System 200 as shown in FIG. At this time, the second payment authentication information may be information based only on the first part information, or information generated based on at least a part of the authentication object information. In any case, the payment authentication system 200 may be configured to specify or recover the first part information based on the second payment authentication information.

In other words, in the present specification, the payment authentication information is generated based on a plurality of basic information may include a case where a plurality of payment authentication information is generated, and an acknowledgment signal is transmitted, And may include a case where an acknowledgment signal including each of the authentication information is transmitted a plurality of times. The fact that the payment authentication information is authenticated means that the authentication object information to be authenticated among the basic information of each of the plurality of payment authentication information is authenticated. The fact that the first part information is confirmed from the payment authentication information may mean that the first part information is extracted or restored from the payment authentication information based on the first part information among the plurality of payment authentication information.

Meanwhile, the payment history information may be information that can specify a specific payment order (or a payment request), and the predetermined information such as a merchant store identification code in the payment history information is specified by the user's payment request behavior But may be information that can be grasped by the settlement authentication system 200 or the settlement system 400 as necessary. For example, the payment history information may be information that requires authentication according to the technical idea of the present invention when payment is executed such as a merchant to be paid, a payment amount, a payment account, and the like.

When the payment history information is included as basic information of the payment authentication information, electronic financial fraud such as the memory hacking described above can be prevented.

That is, the payment history information may be information on a payment intended by a user, and payment authentication information in which payment history information is used as basic information may be generated based on at least the transaction information intended by the requestor. Accordingly, when the payment authentication information is authenticated, it means that the payment history information, which is basic information of the payment authentication information, is authenticated. At the same time, it means that the payment history information in which the payment authentication system 200 actually makes a payment matches the payment history information intended by the user.

In the settlement authentication system 200, information corresponding to the settlement history information may specify the actual settlement history information to be actually executed by the settlement authentication system 200 or the settlement institution system 400. That is, the payment authentication system 200 can identify the authentication authentication information based on the execution payment history information to be actually executed by the payment authentication system 200 or the payment agency system 400, It is possible to perform authentication by comparing whether payment authentication information received from the digital system 100 corresponds. In this case, the payment authentication information is authenticated means that the payment history information intended by the user matches the execution payment history information to be actually executed.

According to the technical idea of the present invention, when the payment authentication information generated in the digital system 100 is authenticated by the payment authentication system 200 as described above, not only the basic information of the payment authentication information is authenticated, When the payment history information is included, it is confirmed whether the payment settlement history information to be actually executed by the payment authentication system 200 and / or the settlement institution system 400 matches the payment history information intended by the user, A strong effect occurs.

In order to secure stronger security, it may be very important to prevent forgery and falsification of the payment authentication information to be transmitted to the payment authentication system 200. Accordingly, the digital system 100 and the payment authentication system 200 can establish a protected communication channel to transmit the payment authentication information. For example, MAC, HMAC, etc. may be used to establish the communication channel.

The payment authentication system 200 can specify authentication authentication information to authenticate payment authentication information received from the digital system 100. [ It is obvious that the basic information used for generating the payment authentication information can be registered or confirmed in the payment authentication system 200 in advance.

The information corresponding to the settlement history information among the basic information may be the execution settlement history information to be executed by the settlement institution system 400 as described above. The execution payment history information may be transmitted to the payment authentication system 200 through any route. For example, the payment history information entered by the user into the digital system 100 or the data processing apparatus 300 may be transmitted to the payment authentication system 200, and the payment history information transmitted may be transaction information to be executed. Then, the payment authentication system 200 authenticates the payment history information to be executed by the payment authentication system 200 before finally performing the payment processing, so that the payment authentication system 200 can store the payment history information, Hacking and the like can be prevented.

The server generation key of the basic information may be stored in the payment authentication system 200 since it is the information generated by the payment authentication system 200 and transmitted to the digital system 100. In addition, identification information of the digital system 100 and identification information of the application among the basic information may be registered in the payment authentication system 200 by the user or by the payment authentication system 200 in advance.

The payment authentication system 200 specifying the authentication authentication information may mean simply extracting or recognizing basic information of the payment authentication information from previously stored information or known information.

Or generating the authentication information for authentication in a manner corresponding to the embodiment in which the payment authentication information is generated. That is, the process of generating the authentication information for authentication, which is the information for authenticating the payment authentication information by performing the same protection processing (for example, encryption, encoding, hashing, etc.) performed in the payment authentication information have.

If the verification authentication information is specified, the payment authentication information received from the digital system 100 can be authenticated. The settlement authentication system 200 can perform the settlement processing when the settlement authentication information is successfully authenticated and receive the result from the settlement institution system 400 and transmit the result to the digital system 100 or the data processing apparatus 300 Lt; / RTI >

The payment authentication system 200 may perform protection processing for at least a part of the basic information in advance. For example, when the protection processing is a hashing, the payment authentication system 200 may determine the information (for example, the identification information of the digital system 100, the identification information of the application, the user authentication information, etc.) Each can be stored by hashing, combined and stored after hashing. In this case, there is an effect that the information can not be leaked even if the payment authentication system 200 is attacked. When the payment authentication information is received, the authentication (that is, the payment authentication information is also the information based on the hashed information It is possible to do so).

According to the technical idea of the present invention, the digital system 100 and the application may be stored in advance in the payment authentication system 200 so as to be set in pairs and correspond to each other. This means that the payment authentication information is authenticated only when a predetermined application is installed in the digital system 100 set as a pair. That is, according to the embodiment of the present invention, the billing authentication information can be implemented to be generated based on the identification information of the digital system 100 and the identification information of the application. In this case, Since the payment authentication information can be authenticated by the payment authentication system 200 only when the application is installed and executed, the security is further enhanced.

According to the technical idea of the present invention, the settlement authentication system 200 is a system in which the settlement history information input by the user into the digital system 100 or the data processing apparatus 300 or the behavior of the user And then transmits the information including the acquired payment history information to the digital system 100 again. The transmitted payment details information may further include information (e.g., merchant identification information or code) confirmed by the payment authentication system 200 or the settlement institution system 400 in addition to the payment history information specified by the user .

At least some of the transmitted payment history information may be verified by the digital system 100. After the settlement authentication system 200 obtains at least a part of the settlement history information and transmits predetermined information (hereinafter referred to as confirmation information) including the settlement history information and is confirmed by the digital system 100, It is possible to confirm whether the history information is actually identical to the information recognized by the payment authentication system 200. [

Further, when at least a part of the payment history information is confirmed in the digital system 100, important information (information that can be a subject of forgery or falsification), particularly among the information to be confirmed by the user, . ≪ / RTI > Such an example is as shown in Fig.

For example, as shown in FIG. 6, a letter representing the location (for example, B) of a merchant to be paid, a name of a merchant (for example, C) and a payment amount (for example, Colors, fonts, and the like may be displayed in different forms. The name of the account, the location of the merchant, the name of the merchant, and the like are not the payment history information specified by the user's action but the payment history information identified by the payment authentication system 200 or the payment institution system 400, It may be information.

In addition, the UI itself as shown in FIG. 6 may be displayed through a UI (pop-up window, etc.) separate from a screen that the user is viewing (i.e., a screen for requesting settlement).

When at least a part of the payment history information is displayed on the digital system 100, the user can confirm the information through the digital system 100. For example, the act of clicking or touching an OK button may be such. Then, the confirmed payment history information can be specified as basic information of the payment authentication information. The payment history information confirmed by the user may be specified as the basic information since it is the information recognized by the payment authentication system 200 and the user's intended information.

The data flow of the security settlement method according to the embodiment of the present invention will be schematically described with reference to FIG.

Referring to FIG. 4, the digital system 100 may transmit the client authentication information to the payment authentication system 200 (S100). It is noted that the digital system 100 or the data processing apparatus 300 can perform the settlement request to the settlement authentication system 200 or the settlement institution system 400 as described above. Also, the user may input his / her user authentication information.

The payment authentication system 200 may transmit the server generation key to the digital system 100. [ The transmission of the server creation key can be performed any time before the digital system 100 generates payment authentication information. For example, the activation information may include a server generation key, and the server generation key may be transmitted to the digital system 100 separately from the activation information.

The payment authentication system 200 can authenticate the received client authentication information (S110). When the client authentication information is authenticated, the payment authentication system 200 may transmit the activation information to the digital system 100 (S120). Also, payment history information to be transmitted by the digital system 100 may be transmitted as described above.

The digital system 100 may activate the protection module based on the received activation information (S130).

The activated protection module can generate payment authentication information (S140). The payment authentication information may be generated based on at least the first part information. Also, when the payment authentication information is generated based on a plurality of basic information, the protection module may generate a plurality of payment authentication information as described above. As the basic information of the settlement authentication information, a server generation key may be further included. When payment history information is used as basic information, payment history information may be specified by a user or a product or service selected by the user. Or the payment history information confirmed by the user may be specified as basic information. Alternatively, the digital system 100 may further use the identification information, the identification information of the application, and / or the user authentication information as basic information.

The digital system 100 includes basic information for generating the payment authentication information (including at least first part information and optionally a server generation key, identification information of the digital system 100, identification information of the application, , And / or payment history information), and generates payment authentication information based on the specified basic information, and transmits an acknowledgment signal including the generated payment authentication information to the payment authentication system 200, (S150).

Then, in the payment authentication system 200, the authentication authentication information for identifying the authentication authentication information and authenticating the received authentication information based on the specific authentication authentication information may be performed (S160, S170) . The authentication confirmation procedure may include authentication information (e.g., a server creation key, identification information of the digital system 100, application identification information, user authentication information, and / or authentication information) excluding the first part information of the basic information of the payment authentication information. Or payment history information) of the user. At this time, the information corresponding to the payment history information as the basic information of the authentication information for authentication may be the execution payment history information to be actually executed by the payment authentication system 200, as described above, Financial fraud can be prevented as described above. It goes without saying that at least some of the basic information to be included in the authentication information for authentication or the authentication authentication information may be specified in advance before the payment authentication information is received.

If the payment authentication information is successfully authenticated, the payment authentication system 200 can confirm the second part information stored in the payment authentication system 200. The second part information may be protected by the payment authentication system 200 in a predetermined manner (for example, encryption, encoding, etc.).

For example, the payment authentication system 200 may encrypt the second part information so that the second part information can be decrypted using the user authentication information.

Depending on the implementation, the information may be decrypted by information generated based on at least one of the user authentication information, the identification information of the digital system 100, or the identification information of the application.

Since the client authentication information may be information generated based on at least one of the user authentication information, the identification information of the digital system 100, or the identification information of the application, the second part information may be decrypted May be implemented. In this case, the second part information is extracted or restored prior to the first part information, and the first part information provided from the digital system 100 may be combined later so that the settlement process can proceed. Therefore, it is needless to say that the order in which the payment authentication system 200 extracts or restores the part information (e.g., the first part information and the second part information) may be changed as needed.

According to an embodiment, the second part information may be encrypted so as to be decrypted based on the first part information. Or may be decrypted by a combination of user authentication information, identification information of the digital system 100, identification information of the application, first part information, and the like. As described above, the encryption and decryption methods of the second part information can be implemented in various ways.

It should be understood that the present invention can also be implemented by various other encoding or decoding methods other than encryption and decryption methods to protect the second part information by the ordinary experts in the technical field of the present invention.

Then, the payment information can be specified based on the first part information and the second part information confirmed from the payment authentication information (S180), and the payment processing can be performed using the specific payment information (S190). It goes without saying that the payment processing result can be transmitted to the digital system 100 or the data processing apparatus 300 (S191).

Meanwhile, the second part information may be the entirety of the information other than the first part information of the user's payment information, but may be some of the remaining information. In this case, the third part information, which is information other than the first part information and the second part information, may be stored in a predetermined storage system. The system in which the third part information is stored may be the payment authentication system 200 or a payment information storage system (not shown) implemented separately from the payment authentication system 200.

When the storage system is implemented as a payment information storage system implemented as a separate physical device from the payment authentication system 200, the security of the technical idea of the present invention can be further enhanced.

Also, even when the third part information is stored in the payment authentication system 200, the second part information and the third part information may be logically separated information. That is, different information may be required for the payment authentication system 200 to confirm (restore) the second part information and the third part information.

For example, the payment authentication system 200 can obtain the identification information of the digital system 100, the identification information of the application, or the user authentication information from the client authentication information or the payment authentication information.

The second part information is then transmitted to the digital system 100 based on the identification information of the digital system 100, the identification information of the application, or a part of the user authentication information (for example, identification information of the digital system 100 and / Information that can be decoded. The third part information may include identification information of the digital system 100, identification information of the application, or information (e.g., identification information of the digital system 100 and / (E.g., identification information of the application), and information (e.g., user authentication information) other than the information (e.g., identification information of the application).

According to the technical idea of the present invention, at least three pieces of payment information are divided, and a part of the divided payment information (for example, first part information and second part information) may be stored in a physically divided system . In some implementations, some of the partitioned payment information (e.g., the second part information and the third part information) are logically separated as described above even though they are stored in the same system (e.g., payment authentication system 200) Can be. And the conditions required to verify the stored information may be different. Therefore, security can be enhanced.

Meanwhile, when the storage system is implemented as the payment information storage system physically separated from the payment authentication system 200, the digital system 100 transmits the payment authentication information using the first part information to the payment authentication system 200). The digital system 100 may transmit a request signal to the payment authentication system 200 to transmit the third part information to the payment information storage system. According to an embodiment of the present invention, the payment authentication system 200 may transmit a request signal requesting transmission of the third part information to the payment information storage system.

The payment information storage system may transmit the third part information in response to the request signal. Of course, the third part information may also be protected information through a predetermined protection processing. At this time, the information necessary for confirming / restoring the second part information may include identification information of the digital system 100, identification information of the application, or a part of the user authentication information (for example, identification information of the digital system 100 and / Or identification information of the application), and the information required to confirm / restore the third part information may be identification information of the digital system 100, identification information of the application, or a remaining part of the user authentication information ).

The request signal transmitted from the digital system 100 or the payment authentication system 200 to the payment information storage system 500 may include identification information for identifying the client side, Corresponding third part information may be specified by the payment information storage system.

In a case where the payment information divided into at least three is stored and the payment information divided by the payment authentication system 200 is collected only when there is a request from a legitimate client, very strong security is obtained There is an effect that can be.

On the other hand, FIG. 5 shows an example in which a plurality of payment authentication information is generated as described above.

FIG. 5 shows a schematic data flow of a security settlement method according to another embodiment of the present invention.

Referring to FIG. 5, after the protection module is activated as shown in FIG. 4, the protection module may generate first payment authentication information (S141). The first payment authentication information includes, for example, authentication object information (e.g., a server generation key, identification information of the digital system 100, application identification information, user authentication information, and / or payment history information) As shown in FIG. Then, the digital system 100 may transmit a first confirmation signal including the first payment authentication information to the payment authentication system 200 (S151). Then, the payment authentication system 200 identifies authentication authentication information and performs authentication (S160, S170). Then, the payment authentication system 200 can transmit the authentication result to the digital system 100 (S171). Then, the protection module of the digital system 100 may generate the second payment authentication information (S142). The second payment authentication information may be information generated based on the first part information. According to the embodiment, the second payment authentication information may be generated based on the predetermined authentication object information. Then, the digital system 100 can transmit a second confirmation signal including the second payment authentication information (S152). The payment authentication system 200 receiving the second payment authentication information can confirm (extract or restore) the first part information based on the second payment authentication information. Of course, when the second payment authentication information is generated based on the predetermined authentication object information, the authentication confirmation procedure for authenticating the authentication object information can be performed again. If the authentication confirmation procedure is successful, the first part information can be confirmed based on the second payment authentication information, and the payment information can be specified using the first part information that has been confirmed.

The configurations of the digital system 100 and the payment authentication system 200 for implementing the technical idea of the present invention are shown in Figs. 2 and 3. Fig.

FIG. 2 shows a schematic configuration of a digital system for a secure settlement method according to an embodiment of the present invention. FIG. 3 shows a schematic configuration of a payment authentication system for a secure payment method according to an embodiment of the present invention.

Referring to FIGS. 2 and 3, the digital system 100 includes a control module 110, a communication module 120, and a protection module 130. The payment authentication system 200 includes a control unit 210, a communication unit 220, a client authentication unit 230, and a DB 240. The payment authentication system 200 may further include a key generation unit 250.

Herein, a module or a part may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, each of the above configurations may refer to a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and may be a code physically connected to one another or a specific type of hardware May be easily deduced to the average expert in the field of the present invention. Thus, each of the above configurations refers to a combination of hardware and software that performs the functions defined herein, and does not mean a specific physical configuration.

The control module 110 may control the functions and / or resources of other configurations included in the digital system 100 (e.g., the communication module 130 and / or the protection module 140) have. As described above, the configuration of the digital system 100 may mean a configuration of an application system in which the application installed in the digital system 100 and the hardware resources of the digital system 100 are combined and implemented.

The digital system 100 may further include a predetermined input device (e.g., a keypad, a keyboard, a mouse, and / or a touch screen) for receiving predetermined information from a user.

The communication module 120 may transmit the client authentication information for the application installed in the digital system 100 or the digital system 100 to the payment authentication system 200 for authentication on the client side. It goes without saying that the generation of the client authentication information can be performed by the control module 110.

The protection module 130 may be part of the application stored in the digital system 100 in a disabled state at normal times. The protection module 130 may include at least a configuration (e.g., software code) for generating payment authentication information, and other configurations, other than the communication module 120 and the control module 110, Or may be included in the protection module 130.

The control module 110 may activate the protection module 130 when activation information is received from the payment authentication system 200 through the communication module 120. The control module 110 may activate the protection module 130 only by using the decryption key included in the activation information, or may be a sequential (decryption) key using the decryption key included in the activation information and the second decryption key based on the user authentication information. The protection module 130 can be activated through the decryption and the protection module 130 can be activated using the decryption key and the integrated decryption key generated based on the second decryption key as described above .

Then, the protection module 130 can generate payment authentication information. The control module 110 may transmit an acknowledgment signal including the generated payment authentication information to the payment authentication system 200. [

Then, the payment authentication system 200 can perform an authentication check procedure for authenticating payment authentication information.

In addition, the control module 110 can receive the payment history information confirmed from the payment authentication system 200, and can display the received payment history information in a predetermined form in the digital system 100, As shown above. At this time, the protection module 130 may specify the confirmed payment history information as basic information when the payment history information is confirmed by the user.

In addition, when the protection module 130 generates the payment authentication information, the control module 110 returns the protection module 130 to the inactive state, and deletes the received activation information to prohibit reuse have.

The payment authentication system 200 is not necessarily implemented as any one physical device, and a plurality of physical devices may be organically combined to implement the payment authentication system 200.

The control unit 210 may control functions and / or resources of other configurations of the payment authentication system 200. [ Also, the controller 210 may perform an authentication procedure for authenticating payment authentication information received from the digital system 100. In addition, the controller 210 may identify the first part information from the payment authentication information and identify the payment information by checking the second part information stored in the payment authentication system 200.

The communication unit 220 may receive from the digital system 100 client authentication information for authentication of a digital system 100 of a user performing an authentication request or an application installed in the digital system 100.

Information on at least the digital system or the application may be registered in the DB 240. The identification information of the digital system 100 or the identification information of the application may be stored as such and each information or the combined information may be subjected to predetermined protection processing (encryption, encoding, or hashing, etc.) May be performed and stored in the DB 240. It should be noted that the DB 240 may further store user authentication information in a predetermined manner. Also, the second part information may be stored. Also, the third part information as described above may be stored.

The client authentication unit 230 can authenticate the received client authentication information based on the information registered in the DB 240 in advance.

In addition, when the authentication of the client authentication information is successful, the client authentication unit 230 transmits activation information for activating at least a protection module of the application to the digital system 100 through the communication unit 220 . The activation information may include a decryption key for decrypting the protection module stored in the digital system 100 in an encrypted state. The decryption key may be stored in advance in the DB 240 for each application. Alternatively, when the protection module 130 is encoded in a predetermined manner according to an embodiment, information for performing decoding corresponding thereto may be included in the activation information as described above.

When the control unit 210 receives the confirmation signal including the payment authentication information from the digital system 100, the control unit 210 performs an authentication check procedure for authenticating the payment authentication information (i.e., the authentication object information) included in the confirmation signal .

If the authentication confirmation procedure is successful, the controller 210 may identify the payment information through a procedure for confirming the first part information. The settlement processing can be performed using the specified settlement information. The controller 210 can confirm the first part information and the second part information for specifying the payment information. The second part information may be information that can be confirmed / restored using information based on at least one of identification information of the digital system 100, identification information of the application, or user authentication information, as described above.

Also, according to an embodiment, the payment information may be divided into first part information, second part information, and third part information and stored. The second part information and the third part information may be stored in the payment authentication system 200, and the third part information may be received from a separate payment information storage system. In any case, the information necessary for confirming / restoring the second part information and the third part information may be different from each other. The division of the second part information and the third part information can be logically or physically performed as described above.

For this, the controller 210 specifies the authentication information for authentication based on the information stored in the DB 240 as described above, determines whether the specified authentication authentication information and the received payment authentication information correspond to each other, The authentication procedure can be performed. When the payment history information is used as the basic information of the payment authentication information, the control unit 210 can specify the execution payment history information to be executed by the payment authentication system 200 as basic information of the authentication authentication information Is as described above. It goes without saying that the execution settlement history information may be specified immediately before the settlement authentication system 200 performs settlement processing.

In addition, the control unit 210 may transmit the payment history information received from the digital system 100 to the digital system 100, which is specified by the user, and may be confirmed by the user.

The key generation unit 250 may generate a disposable server generation key to be transmitted to the digital system 100. The server creation key may be various types of disposable information such as a random number, an OTP, a time value, etc., as described above. The generated server creation key can be transmitted to the digital system 100 through the communication unit 220. [

The security settlement method as described above may be used for settlement. However, according to the embodiment, the technical idea of the present invention may be used not only for authentication for payment but also for user authentication (authentication) for authenticating a user for various services. That is, a predetermined identification code (for example, a resident registration number, an I-PIN, an identification code of an electronic resident card, etc.) necessary for user authentication may be divided and stored as described above. It will also be readily apparent to one of ordinary skill in the art that the above-described strong mutual authentication can be applied to user authentication (authentication).

Accordingly, the scope of the present invention includes a user authentication and billing authentication method through segregation of logical / physical division of a predetermined identification code and encryption / decryption or encoding / decoding and decryption key for confirming the combination of the identification code, It can be applied to a system.

The security settlement method according to the embodiment of the present invention can be implemented as a computer-readable code on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, an optical data storage device, and the like in the form of a carrier wave (for example, . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

Claims (25)

Transmitting, by the digital system, client authentication information for authentication of the digital system or an application installed in the digital system to a payment authentication system for performing payment;
Receiving activation information enabling the digital system to activate at least a portion of the protection module of the application from the payment authentication system when the client authentication information is authenticated by the payment authentication system;
Activating the protection module inactivated based on the activation information received by the digital system; And
Through the protection module in which the digital system is activated, an acknowledgment signal including payment authentication information based on the first part information, which is stored in the digital system and corresponds to a part of the payment information of the user, and generates an acknowledgment signal To the payment authentication system,
By the payment authentication system,
An authentication confirmation process is performed in which the payment authentication information included in the transmitted confirmation signal is authenticated, a payment process is performed using the payment information of the user in case the authentication confirmation process is successful,
The payment information of the user,
Wherein the first part information is identified by the payment authentication system, the first part information is identified from the payment authentication information, and the first part information is stored in the payment authentication system and corresponds to at least a part of the remaining information excluding the first part information And the second part information is identified and specified.
The method according to claim 1,
Is generated based at least on a one-time server generation key generated by the payment authentication system, and is optionally generated based on at least one of identification information of the digital system or identification information of the application Secure payment method.
The method according to claim 1,
At least one of the payment history information of the settlement to be performed or the user authentication information capable of authenticating the user, which is generated based on at least one-time server generation key generated by the payment authentication system, Wherein the information is generated based on the security information.
4. The method according to claim 3, wherein when the payment authentication information is information generated based on the payment history information,
Wherein the digital system receives and confirms the payment history information from the payment authentication system and generates the payment authentication information based on the confirmed payment history information.
4. The method according to claim 3, wherein when the payment authentication information is information generated based on the payment history information,
The authentication procedure includes:
Wherein the authentication authentication information is specified based on the execution settlement history information to be executed by the settlement authentication system, and whether or not the specified authentication authentication information and the settlement authentication information correspond to each other is determined.
2. The method of claim 1, wherein activating the protection module, which is inactivated based on the activation information received by the digital system,
And decrypting the protection module in which the digital system is stored in an encrypted state, using a decryption key included in the activation information.
The method as claimed in claim 6, wherein the step of decrypting the protection module, in which the digital system is stored in an encrypted state, using a decryption key included in the activation information,
The digital system decrypting the protection module based on the decryption key and a second decryption key based on user authentication information obtained from the user.
The security settlement method according to claim 1,
Further comprising deactivating the protection module after the digital system transmits the confirmation signal to the payment authentication system.
The method according to claim 1, wherein the step of transmitting the client authentication information to a payment authentication system for performing authentication comprises:
Wherein the digital system generates the client authentication information based on at least one of identification information of the digital system, identification information of the application, or user authentication information, and transmitting the generated client authentication information to the payment authentication system .
10. The method of claim 9,
Wherein the information is decrypted and confirmed by the payment authentication system based on at least a part of the identification information of the digital system, the identification information of the application, or the user authentication information.
10. The method of claim 9,
And is part of the remaining information excluding the first part information and is information that is decrypted and confirmed based on the identification information of the digital system, the identification information of the application, or a part of the user authentication information,
The third part information corresponding to information excluding the first part information and the second part information of the payment information is decrypted based on the identification information of the digital system, the identification information of the application, or the remaining part of the user authentication information And the information is confirmed.
Receiving, from the digital system, client authentication information for authentication of a digital system of a user performing a payment request or an application installed in the digital system;
Authenticating the client authentication information based on information previously registered in the payment authentication system;
Sending, to the digital system, activation information enabling the payment authentication system to activate at least a portion of the protection module of the application if authentication of the client authentication information is successful;
The first part information corresponding to a part of the payment information stored in the digital system and corresponding to a part of the user, through the protection module activated and activated by the protection module inactivated in the digital system based on the transmitted activation information Receiving, by the payment authentication system, the confirmation signal from the digital system when an acknowledgment signal including the payment authentication information based on the electronic signature is generated;
Performing an authentication check procedure in which the payment authentication information included in the confirmation signal received by the payment authentication system is authenticated; And
And performing payment processing using the payment information of the user if the authentication confirmation procedure is successful,
The payment authentication system includes:
The second part information corresponding to at least a part of the remaining information excluding the first part information, which is stored in the payment authentication system and is stored in the payment information, from the payment authentication information, Of the payment information.
13. The method according to claim 12,
At least based on a one-time server generation key transmitted to the digital system by the payment authentication system, and selectively generating identification information of the digital system, identification information of the application, payment details of a payment to be performed when authentication is successful Information that is generated based on at least one of information, user identification information that can authenticate the user, and user identification information that can authenticate the user.
14. The method according to claim 13, wherein when the payment authentication information is information generated based on the payment history information,
Wherein the settlement authentication system transmits the payment history information to the digital system and the settlement authentication information is generated based on the payment history information confirmed when the payment history information is confirmed by the digital system Payment Method.
14. The method according to claim 13, wherein when the payment authentication information is information generated based on the payment history information,
The step of performing the authentication procedure includes:
The settlement authentication system specifies the authentication authentication information based on the execution settlement history information to be executed by the settlement authentication system, and determines whether the specified authentication authentication information and the payment authentication information correspond to each other A secure payment method.
13. The method of claim 12, wherein the payment authentication system transmitting activation information to the digital system, the activation information being capable of activating at least a portion of the protection module of the application,
The payment authentication system including a decryption key to be used for decrypting the protection module stored in an encrypted state in the digital system, in the activation information,
In the digital system, the protection module is decrypted based on the second decryption key and the decryption key based on the user authentication information decrypted by the decryption key or obtained from the user by the decryption key .
The method according to claim 12, wherein the payment authentication system authenticates the client authentication information based on information previously registered,
The payment authentication system receives the client authentication information based on at least one of the identification information of the digital system, the identification information of the application, or the user authentication information, and transmits authentication authentication information corresponding to the received client authentication information And determining whether the specific authentication authentication information and the received client authentication information correspond to each other.
18. The method of claim 17,
The payment authentication system
Wherein the second part information is decrypted based on at least a part of identification information of the digital system, identification information of the application, or the user authentication information.
18. The apparatus of claim 17, wherein the second part information comprises:
And is part of the remaining information excluding the first part information and is information that is decrypted and confirmed based on the identification information of the digital system, the identification information of the application, or a part of the user authentication information,
The third part information corresponding to information excluding the first part information and the second part information of the payment information is decrypted based on the identification information of the digital system, the identification information of the application, or the remaining part of the user authentication information And the information is confirmed.
A computer program recorded on a data processing device for performing the method of any one of claims 1 to 19.
In a digital system,
A communication module for transmitting client authentication information for authentication of the digital system or an application installed in the digital system to a payment authentication system;
A protection module in a deactivated state; And
A control module,
The control module includes:
Receiving activation information capable of activating at least a part of the protection module of the application from the payment authentication system via the communication module when the client authentication information is authenticated by the payment authentication system,
Activates the protection module that is inactivated based on the received activation information,
When the confirmation signal including the payment authentication information based on the first part information corresponding to a part of the payment information stored in the digital system through the activated protection module is generated, Lt; / RTI >
By the payment authentication system,
An authentication confirmation process is performed in which the payment authentication information included in the transmitted confirmation signal is authenticated, a payment process is performed using the payment information of the user in case the authentication confirmation process is successful,
The payment information of the user is specified by the payment authentication system,
The first part information is confirmed from the payment authentication information, the second part information corresponding to at least a part of the information stored in the payment authentication system and excluding the first part information is identified and specified A digital system that performs secure payment.
In a payment authentication system,
A communication unit for receiving, from the digital system, client authentication information for authentication of a digital system of a user performing a payment request or an application installed in the digital system;
A DB in which information about the digital system or the application is registered;
Wherein the client authentication information is authenticated based on information previously registered in the DB and activation information enabling activation of at least a part of the protection module of the application when authentication of the client authentication information is successful is transmitted to the digital A client authentication unit for transferring the data to the system; And
Based on the first part information corresponding to a part of the payment information of the user and stored in the digital system through the activated and activated protection module, the protection module inactivated in the digital system based on the transmitted activation information And a control unit for performing an authentication check procedure in which the payment authentication information included in the confirmation signal is authenticated when an acknowledgment signal including payment authentication information is generated and received,
Wherein,
The payment processing using the payment information of the user is performed if the authentication confirmation procedure is successful,
The first part information is confirmed from the payment authentication information so as to specify the payment information of the user, and the payment information stored in the payment authentication system and corresponding to at least a part of the remaining information excluding the first part information And confirms the payment information of the user by checking the second part information.
23. The payment authentication system according to claim 22,
Further comprising a key generation unit for generating a disposable server generation key to be transmitted to the digital system,
The settlement authentication information includes:
Wherein the digital signature is generated based at least on a server generation key generated by the key generation unit and transmitted to the digital system, and is selectively generated based on identification information of the digital system, identification information of the application, History information, or user authentication information capable of authenticating the user, based on at least one of the history information, the history information, and the user authentication information.
24. The apparatus of claim 23,
The authentication authentication information corresponding to the settlement authentication information is identified, the authentication verification process is performed by determining whether the specified authentication authentication information and the payment authentication information correspond,
If the payment authentication information is information generated based on the payment history information,
And specifies the authentication authentication information based on the execution settlement history information to be executed by the settlement authentication system.
24. The apparatus according to claim 23,
And a decryption key for decrypting the protection module stored in an encrypted state in the digital system is included in the activation information for transmission.

Images