KR20200061264A - Method for certifying user in order to pay with card based on blockchain network, and card company server using the same - Google Patents

Abstract

The present invention relates to a method for authenticating a user for credit card payment based on a blockchain network and a credit card company server using the same. According to the present invention, the method for authenticating a user for credit card payment based on a blockchain network comprises the steps of: (a) determining the risk level of a transaction with a specific user and selecting a specific authentication method; and (b) performing specific authentication according to the specific authentication method and registering specific authentication history information in a distributed ledger. According to the present invention, the illegal use of a user′s credit card can be easily confirmed.

Description

METHOD FOR CERTIFYING USER IN ORDER TO PAY WITH CARD BASED ON BLOCKCHAIN NETWORK, AND CARD COMPANY SERVER USING THE SAME}

The present invention relates to a user authentication method for card payment based on a blockchain network and a card company server using the same, and more specifically, for a specific user corresponding to specific payment request information corresponding to a specific user from a service providing terminal. When the authentication method verification request is obtained from the payment support server, among the card company nodes on the blockchain network, a specific card company node corresponding to a specific card company server extracts and transmits authentication history information corresponding to specific user identification information from the distributed ledger. , With reference to the authentication history information corresponding to the specific user identification information, determines the transaction risk of a specific user according to a preset authentication policy, selects a specific authentication method to be performed in response to the determined transaction risk of the specific user, and selects the selected authentication method. By transmitting the specific authentication method information to the payment support server, the payment support server requests a specific user terminal to perform a specific authentication according to a specific authentication method, and a specific user performs a specific authentication according to a specific authentication method through the specific user terminal. When a specific authentication according to a specific authentication method is completed, specific authentication history information corresponding to a specific authentication is registered in the distributed ledger or at least one card company node on the blockchain network registers specific authentication history information in the distributed ledger. And a card server using the same.

In recent years, the distribution and use of credit cards has increased due to convenience in use and policy encouragement. Typically, a credit card is used to store personal information necessary for financial and commercial transactions of the user who owns the card using a magnetic or IC chip, etc. You can purchase or withdraw cash, and pay the cost later. Due to this convenience, financial services or commerce using credit cards is widely used.

However, due to the convenience that anyone can easily use, there is also a problem that damage to the fraudulent use of the credit card may occur. For example, simply by knowing your password, you can use another user's credit card to withdraw cash or purchase goods, falsify your card through personal information leakage, steal a lost or stolen card, or consult with a seller Thus, you can withdraw your cash and leave a false record as a purchase. The damage caused by fraudulent use of these credit cards is increasing.

In particular, in the case of non-face-to-face transactions occurring in online merchants, the number of illegal use through various methods, such as information theft and hacking, is increasing, so that the card is illegally used by a third party other than the user in the online merchant. It is urgent to prepare measures to prevent them.

On the other hand, in the past, in order to prevent illegal use of the card, card companies analyze the user's card use history, but there is a problem that can be checked only for the user's card use corresponding to the card company. There is a problem in that it is only possible to check for illegal use, and it is impossible to check the card use of other card companies owned by the user, so it is not possible to check whether the user is illegally used.

The present invention aims to solve all of the above-mentioned problems.

In addition, another object of the present invention is to enable the user to confirm illegal use of all cards owned by the user.

In addition, another object of the present invention is to enable the user to check the illegal use of the card by using the use history of all card companies owned by the user.

In addition, another object of the present invention is to enable the user to confirm the illegal use of the card without exposing personal information regarding the user's use of the card.

In addition, another object of the present invention is to make it possible to check whether a user is illegally used in addition to simply checking the user's fraudulent use.

According to an embodiment of the present invention for achieving the above object, in a user authentication method for card payment based on a blockchain network, (a) at least user terminal information of each processing value, owned by each user Card registration information, and authentication history information corresponding to the respective users correspond to respective user identification information corresponding to each of the users, respectively corresponding to respective card company servers according to each card company While registered in a distributed ledger on a blockchain network composed of card company nodes, specific payment request information corresponding to a specific user from a service provision terminal-the specific payment request information is specific order information, specific user terminal information of the specific user , And including specific user information of the specific user-when a request for confirming an authentication method for the specific user is obtained from a payment support server, the specific user information among the plurality of card company servers on the blockchain network The specific card company server corresponding to the specific card registration information included in the specific card company server corresponding to the specific card company server to extract and transmit the authentication history information corresponding to the specific user identification information from the distributed ledger, The transaction risk of the specific user is determined according to a preset authentication policy by referring to the authentication history information corresponding to the specific user identification information, and a specific authentication method to be performed is selected in response to the determined transaction risk of the specific user. To do; And (b) the specific card company server sending the selected specific authentication method to the payment support server, so that the payment support server requests (i) the specific user terminal to perform specific authentication according to the specific authentication method. By allowing the specific user to perform the specific authentication according to the specific authentication method through the specific user terminal, (ii) when the specific authentication according to the specific authentication method is completed, the specific authentication corresponding to the specific authentication Registering historical information in the distributed ledger or allowing at least one card company node on the blockchain network to register the specific authentication history information in the distributed ledger; A method is provided that includes.

In addition, according to an embodiment of the present invention, in a card company server performing user authentication for a payment based on a blockchain network, at least processing values of user terminal information and card registration information owned by each user And authentication card information corresponding to each of the users corresponds to respective user identification information corresponding to each of the users, respective card company nodes corresponding to respective card company servers according to each card company While registered in the distributed ledger on the blockchain network composed of, specific payment request information corresponding to a specific user from a service providing terminal-the specific payment request information includes specific order information, specific user terminal information of the specific user, and the A communication unit for obtaining a request for confirming an authentication method for the specific user from the payment support server, which corresponds to-containing specific user information of a specific user; And (i) a card company node corresponding to the specific card company server among card company nodes on the blockchain network to extract and transmit the authentication history information corresponding to the specific user identification information from the distributed ledger. The process of determining the transaction risk of the specific user according to a predetermined authentication policy by referring to the authentication history information corresponding to the identification information, and selecting a specific authentication method to be performed in response to the determined transaction risk of the specific user, And (ii) by sending the selected specific authentication method to the payment support server, causing the payment support server to (ii-1) request the specific user terminal to perform a specific authentication according to the specific authentication method, thereby allowing the specific user to Allows the user to perform the specific authentication according to the specific authentication method through the specific user terminal, and (ii-2) when the specific authentication according to the specific authentication method is completed, specific authentication history information corresponding to the specific authentication A processor that performs a process of registering the data in the distributed ledger or having at least one card company node on the blockchain network register the specific authentication history information with the distributed ledger; A card company server comprising a is provided.

In addition to this, a computer readable recording medium for recording a computer program for executing the method of the present invention is further provided.

According to the present invention, there are the following effects.

The present invention can check the cards for all card companies owned by the user through the blockchain network, and accordingly, it is possible to check the illegal use of all cards owned by the user.

The present invention enables the user to check the usage history of all cards owned by the user in real time through the blockchain network, thereby making it possible to easily check the user's fraudulent use of the card.

According to the present invention, it is possible to confirm fraudulent use of a card without exposing the user's personal information by processing and registering the personal information of the user's card use through the blockchain network.

Since the present invention can check the use history of all cards owned by the user through the blockchain network, in addition to checking the user's illegal use of the card, it is possible to check whether the user is illegally used.

1 schematically illustrates a system for performing user authentication for blockchain-based card payment according to an embodiment of the present invention,
2 schematically illustrates a user authentication method for blockchain-based card payment according to an embodiment of the present invention,
FIG. 3 schematically illustrates a state in which a user's transaction risk is determined and an authentication method is selected in a user authentication method for blockchain-based card payment according to an embodiment of the present invention,
4 schematically illustrates a process of registering a card through user authentication for blockchain-based card payment according to an embodiment of the present invention,
5 schematically shows a process of performing payment of a card through user authentication for blockchain-based card payment according to an embodiment of the present invention,
6 schematically illustrates a process of performing payment of a card in a state in which user information is changed through user authentication for blockchain-based card payment according to an embodiment of the present invention.

For a detailed description of the present invention, which will be described later, reference is made to the accompanying drawings that illustrate, by way of example, specific embodiments in which the invention may be practiced. These examples are described in detail enough to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the invention are different, but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in relation to one embodiment. In addition, it should be understood that the location or placement of individual components within each disclosed embodiment can be changed without departing from the spirit and scope of the invention. Therefore, the following detailed description is not intended to be taken in a limiting sense, and the scope of the present invention, if appropriately described, is limited only by the appended claims, along with all ranges equivalent to those claimed. In the drawings, similar reference numerals refer to the same or similar functions across various aspects.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those skilled in the art to easily implement the present invention.

1 schematically illustrates a system for performing user authentication for blockchain-based card payment according to an embodiment of the present invention, the system includes a user terminal 10, a service providing terminal 20, and a payment support server It may include (100), the blockchain network 200, and the card company server 300.

First, the user terminal 10 is a device that generates a transaction corresponding to a user input related to payment and displays payment information to a user, a personal computer (PC), mobile computer, PDA/EDA, mobile phone, smart Phones, tablets, and the like. In addition, the user terminal 10 is not limited to this, and may include any device such as a portable game machine having a wired/wireless communication function, a digital camera, and personal navigation. In addition, the user terminal 10 may include a communication unit that supports transmission and reception of information and a processor that processes the information. In addition to this, the user terminal 100 may include a fund source app corresponding to a fund source server for payment. In addition, the user terminal 10 may be a terminal that performs purchase in online shopping or offline shopping, and a terminal that performs payment and user authentication using a card, and may be different terminals, and payment and user authentication using a card The terminal for may be a mobile device.

Next, the service providing terminal 20 provides various services that can be used by a user, and may include a communication unit that supports transmission and reception of information and a processor that processes the information. In addition, the service providing terminal 20 is a terminal that performs payment according to a user's card by generating payment request information corresponding to purchase and payment information by the user terminal 10, of a payment terminal in an offline shopping mall or an online shopping mall. It may include a payment server, and may include a server that performs payment for a service or item provided to a user in conjunction with a payment terminal in an offline shopping mall or a payment server in an online shopping mall. In addition to this, the service providing terminal 20 may include all terminals that enable payment by using a user's card to pay for the provision of the service or purchase of the product online or offline.

Next, the payment support server 100 supports blockchain-based card payment, and may be composed of a plurality of servers that perform respective functions to support card use approval. At this time, the payment support server 100 may be a server that manages a user's card and works with a card company server 300, which will be described later, which provides a payment service, or a server that performs some functions of the card company server 300, and the card company server. It may be the same device as 300 or a separate device. In addition, the payment support server 100 may be a server corresponding to each node of the blockchain network 200 or a server that manages each node of the blockchain network 200. In addition, the payment support server 100 may be a transaction server that manages transactions with other devices in relation to approval of card use. Also, the payment support server 100 may be a web application server (WAS).

Specifically, the payment support server is typically a computing device (eg, a computer processor, memory, storage, input device and output device, a device that may include components of other existing computing devices; electronic communication devices such as routers, switches, etc.) ; A combination of network attached storage (NAS) and storage area network (SAN) electronic information storage systems) and computer software (i.e. instructions that enable computing devices to function in a particular way) to achieve desired system performance. It can be achieved.

The communication unit of such a computing device can transmit and receive requests and responses with other computing devices interworking. As an example, such requests and responses may be made by the same TCP session, but are not limited thereto. For example, UDP data It may also be transmitted and received as a gram.

In addition, the processor of the computing device may include hardware configurations such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. Also, it may further include a software configuration of an operating system and an application performing a specific purpose.

Next, the blockchain network 200 may be composed of each card company node 210 corresponding to each card company, and may provide a service related to approval of the user's card use. In addition, the blockchain network 200 may record various information necessary for the use of the card in a distributed ledger through communication with the payment support server 100, and perform an operation of confirming various information required for the use of the card. In this case, although the card company node 210 is shown as four in FIG. 1, the number of the card company node 210 is not limited thereto. What is indicated using the same reference numerals is for convenience of description only, and is not intended to mean that these individual devices are the same. In addition, the distributed ledger records transactions for historical information using a user's card using a blockchain, and records and manages the state of information according to each transaction in a state database.

Next, the card company server 300 is interlocked with a card company node corresponding to itself among each card server node 210 of the blockchain network 200, and the communication unit 310, the processor 320, and fraudulent use The detection unit 330 may include a service for approval of the user's card use and settlement of the service provider, and history information for the owner card of all card companies to determine transaction risk and authentication method based on user authentication Can be selected. At this time, the fraud detection unit 330 for determining the transaction risk and selecting an authentication method may be configured as a separate server from the card company server 300. In addition, the card company server 300 may perform various types of information required to use the card through communication with the payment support server 100.

Specifically, a card company server is typically a computing device (eg, a computer processor, memory, storage, input device and output device, a device that may include components of other existing computing devices; electronic communication devices such as routers, switches, etc.); Achieve desired system performance using a combination of network attached storage (NAS) and electronic information storage systems such as storage area networks (SANs) and computer software (ie instructions that enable computing devices to function in a particular way) It may be.

The communication unit of such a computing device can transmit and receive requests and responses with other computing devices to be linked. As an example, such requests and responses may be made by the same TCP session, but are not limited thereto. For example, UDP data It may also be transmitted and received as a gram.

In addition, the processor of the computing device may include hardware configurations such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. Also, it may further include a software configuration of an operating system and an application performing a specific purpose.

Meanwhile, in the above, the payment support server 100, the card company server 210, and the card company server 300 are separately described, but unlike these servers, these servers may be configured as one server and perform each operation. It can be distinguished by software modules.

The user authentication method for card payment based on a blockchain network according to an embodiment of the present invention through the system configured as described above will be described with reference to FIG. 2 as follows.

At least processing values of user terminal information, card registration information owned by each user, and authentication history information corresponding to the respective users correspond to respective user identification information corresponding to each of the users Thus, while registered in the distributed ledger on the blockchain network 200 composed of respective card company nodes corresponding to respective card company servers according to each card company, specific order information from the service providing terminal 20, specific A request for confirmation of an authentication method for a specific user corresponding to specific payment request information corresponding to a specific user including specific user terminal information of the user and specific user information of the specific user is obtained from the payment support server 100 (S1) When, among a plurality of card company servers 300 on the blockchain network 200, that is, a specific user among a plurality of card company servers 300 corresponding to each card company node 210 on the blockchain network 200 The specific card company server 300 corresponding to the specific card registration information included in the information causes the specific card company node 210 corresponding to the specific card company server 300 to identify the specific user from the distributed ledger on the blockchain network 200. The authentication history information corresponding to is extracted and transmitted (S2). At this time, the authentication history information corresponding to the specific user identification information may include authentication history information for cards issued by other card companies as well as cards issued by a specific card company.

Then, the specific card company server 300, that is, the fraud detection unit 330 determines the transaction risk of a specific user according to a preset authentication policy by referring to authentication history information corresponding to the specific user identification information, and determines the determined specific user Select a specific authentication method to be performed in response to the transaction risk of (S3). In addition, the authentication method may include any method capable of authenticating a user, such as PIN authentication, ARS authentication, biometric authentication, fingerprint authentication, and certificate authentication.

At this time, the authentication history information corresponding to each user, for each of the card registration information owned by each user, the user terminal information used for a specific payment and the processing value of the order information, information on the authentication method at a specific payment , And authentication result information by an authentication method in a specific payment, and the specific card company server 300 corresponds to all card companies owned by a specific user in authentication history information corresponding to the specific user identification information. The transaction risk of a specific user may be determined by referring to previous authentication history information corresponding to previous payments corresponding to all card registration information.

In addition, the specific card company server 300 generates processing values of specific user terminal information and specific order information by applying a predetermined operation to specific user terminal information and specific order information included in the specific payment request information, and the generated specific Compared with the processing values of the user terminal information and the specific order information and the processing values of the user terminal information and the order information registered in the previous authentication history information, if it does not match, it is determined that the transaction risk of the specific user is high, authentication The specific authentication method having high strength can be selected. Through this, it is possible to identify fraudulent transactions of the user's card usage without exposing the user-related information.

In addition, the specific card company server 300 compares the processed values of the generated specific user terminal information and specific order information with the processed values of user terminal information and order information registered in the previous authentication history information. In this case, the transaction risk of a specific user can be determined by referring to the recognition method and authentication result information in the previous authentication history information registered immediately before.

As an example, referring to FIG. 3, when a user without a payment history in “1” performs the first payment with the A card of the A card company, the A card company server may select a PIN authentication method. In addition, the history of the user making a payment with the B card of the B card company in “2” is shared, and when the user makes a payment with the A card in “3”, the A card company server authenticates the existing history, that is, the authentication of the A card company. The unauthorized processing can be selected by referring to the history and the authentication history of the B card company. That is, A card company refers to the normal transaction risk according to PIN authentication at “1” and the normal transaction risk at fingerprint authentication at “2”, and the transaction risk at “3” is set to white to lower the transaction risk. It is judged that it is possible to select an unauthorized authentication method. Subsequently, if the user wants to proceed with the payment by using the C card of C card company in “4”, the changed value of the collected information, that is, the processing value of the user terminal information and the order information that is the collected information due to the change of the terminal information. Since the C card company is changed, unlike the A card company's unauthorized processing in "3", it is possible to select the ARS authentication method by increasing the authentication strength. In addition, if the user wants to proceed with the payment using the A card of the A card company in “5”, the A card company proceeds with the payment because the collected information is the same as the previous collected information, but the ARS authentication in “4” Since the transaction risk has been set to black due to failure, unlike the unauthorized authentication process in “3”, the transaction risk has increased, so you can select the PIN authentication method by increasing the authentication strength.

Thereafter, the specific card company server 300 transmits the selected specific authentication method to the payment support server 100, thereby allowing the payment support server 100 to perform specific authentication according to the specific authentication method with the specific user terminal 10. It is possible to request a specific user to perform a specific authentication according to a specific authentication method through the specific user terminal 10.

Then, when the specific authentication according to the specific authentication method is completed, the specific card company server 300 registers specific authentication history information corresponding to the specific authentication to the distributed ledger on the blockchain network 200 or at least one card company on the blockchain network. The node 210 may allow specific authentication history information to be registered in the distributed ledger on the blockchain network 200.

At this time, the specific card company server 300 allows the payment support server to process specific user information included in specific payment request information, specific order information and specific user terminal information, specific authentication method information, and specific authentication according to specific authentication It is possible to generate specific authentication history information including result information.

Meanwhile, in the distributed ledger of the blockchain network 200, transactions corresponding to user card registration, transaction history according to a payment request, etc. may be stored in a blockchain structure, and various information according to each transaction may be recorded in a state database. Can be.

For example, the status database is a user status database in which the merchant number of each card company and the like are matched with the business identification information, and the merchant status database, the hash value of the terminal information, the shipping address information, the registration card information, etc. are matched with the user identification information, and recorded. User identification information such as transaction history status database, card registration information, hash value of user terminal information and order information, authentication method information, authentication result information, etc. The authentication history may be classified into a state database that is matched and recorded, but is not limited thereto, and the state database may be implemented in various methods.

The process of registering a payment card and performing payment through user authentication for card payment based on a blockchain network according to an embodiment of the present invention will be described with reference to FIG. 4 as follows.

When the user performs payment for order information in the service providing terminal 20 in order to pay for the use of the service or purchase the product online or offline using a registered card, the service providing terminal 20 supports payment Request payment for the user's order information by transmitting the payment request information to the server 100 (S11) or allowing another device linked to the service providing terminal 20 to transmit. At this time, the payment request information may include order information, terminal information, and user information. In addition, the order information may include an amount, an affiliate store name, installment information, item information, and order information, and may include a business number, an affiliate store number, or an affiliate store ID as affiliate store identification information. In addition, the terminal information may include a telephone number, a user's international mobile device identification code (IMEI) value, a universal unique identifier (UUID) value, and browser information for local storage. In addition, the user information may include user identification information, shipping address information, shopping mall membership number, and card token ID, which is registration card information.

Then, the payment support server 100 refers to the merchant identification information, and the registered merchant number corresponding to the card company corresponding to the requested card token ID from among the merchant numbers registered for the distributed ledger on the blockchain network 200. It is possible to check (S12) or at least one card company node 210 on the blockchain network 200 to check the merchant number. Then, the payment support server 100 checks the user information registered in the distributed ledger on the blockchain network 200 by referring to the user identification information (S13) or at least one card company node 210 on the blockchain network 200 You can have the user confirm the user information.

At this time, since the current user has not registered the card for payment, the distributed ledger on the blockchain network 200 does not have the registration card information for the user, so the card to be used for payment with the user terminal 10 Requests card registration information for registering (S14).

Then, when the card registration information is obtained from the user terminal 10 (S15), the payment support server 100 requests card registration from the card company server 300 (S16). At this time, the card registration information may include information on a card to be registered, information on a PIN code, and the like, and PIN information may be stored as browser information in the local storage of the user terminal 10. However, the PIN code is illustratively described, and in the present invention, in addition to the PIN code, it may include all authentication codes for user access, such as passwords, fingerprints, and biometric information.

Then, when the user's card registration is completed (S17) from the card company server 300 and the card token ID as the registration card information is obtained, the payment support server 100 divides the terminal information and the user information on the blockchain network 200. Record in the ledger (S18) and update the user state database, or allow at least one card company node 210 on the blockchain network 200 to record terminal information and user information in a distributed ledger and update the user state state database. Can be. At this time, since the card company server 300 is a registration of a new card, user authentication may be performed through setting and checking a PIN code according to an authentication policy without selecting an authentication method according to a transaction risk.

Thereafter, when terminal information and user information are registered in the distributed ledger on the blockchain network 200 (S19), the payment support server 100 requests approval of payment request information requested by the card company server 300 (S20). ), when the approval is completed from the card company server 300 (S21), the information on the approval is transmitted to the service providing terminal 20 (S22), and the transaction information according to the approval is completed, that is, the transaction transaction is blockchain. Record in the distributed ledger on the network 200 (S23) and update the transaction history state database, or at least one card company server 210 on the blockchain network 200 records the transaction transaction in the distributed ledger and the transaction history state database So that it can be updated.

Next, a process of performing card payment through user authentication for card payment based on a blockchain network according to an embodiment of the present invention will be described with reference to FIG. 5 as follows. In the following description, portions that can be easily inferred from the description of FIG. 4 will be omitted.

When the user performs payment for order information in the service providing terminal 20 in order to pay for the use of the service or purchase the product online or offline using a registered card, the service providing terminal 20 supports payment Request payment for the user's order information by transmitting the payment request information to the server 100 (S31) or allowing another device interlocked with the service providing terminal 20 to transmit.

Then, the payment support server 100 refers to the merchant identification information, and stores the registered merchant number corresponding to the card company corresponding to the requested card token ID from among the merchant numbers registered by the credit card company in the distributed ledger on the blockchain network 200. It is possible to confirm (S32) or at least one card company node 210 on the blockchain network 200 to check the merchant number. Then, the payment support server 100 checks the user information registered in the distributed ledger on the blockchain network 200 by referring to the user identification information (S33) or at least one card company node 210 on the blockchain network 200 You can have the user confirm the user information.

At this time, the payment support server 100 may obtain the registered authentication history information corresponding to the user identification information from the distributed ledger on the blockchain network 200. That is, the payment support server 100 may obtain authentication history information performed on all cards owned by the user, including cards of other card companies, in addition to the card for which the current payment is to be performed, from the authentication history state database of the distributed ledger.

Then, when the user information is confirmed, the payment support server 100 requests the card information and the authentication method from the card company server 300 (S34), or causes another device linked to the payment support server 100 to perform the card company server 300. ) To request card information and authentication method.

On the other hand, as a result of checking the user information, the payment support server 100 may register a card to be used by the same method as in FIG. 4 when there is no registration card information for the card to be paid. When registration is complete, the card company server 300 requests the card information and the authentication method (S34), or another device linked to the payment support server 100 requests the card company server 300 to request the card information and authentication method. can do.

Then, the card company server 300 checks the registration card information corresponding to the stored user identification information, that is, the card token ID, and refers to the authentication history information corresponding to the user identification information, according to a preset authentication policy. The transaction risk is determined, and a specific authentication method to be performed is selected in response to the determined user's transaction risk (S35).

Thereafter, the specific card company server 300 transmits the checked card information and the selected authentication method to the payment support server 100 (S36), and the payment support server 100 uses the terminal according to the checked card information and the authentication method. (10) Requests user authentication for the corresponding card (S37).

Then, when the user completes user authentication according to the authentication method requested through the user terminal 10 (S38), the payment support server 100 requests approval of payment request information requested by the card company server 300. (S39), and when the approval is completed from the card company server 300 (S40), and transmits the information about the approval completion to the service providing terminal 20 (S41), the transaction information according to the approval completion, that is, the transaction transaction Record in the distributed ledger on the blockchain network 200 (S42) and update the transaction history state database, or at least one card company server 210 on the blockchain network 200 records the transaction transaction in the distributed ledger and the transaction history Lets you update the state database. In addition, the payment support server 100 registers authentication history information corresponding to user authentication to the distributed ledger on the blockchain network 200, that is, updates the authentication history status database or at least one card company on the blockchain network 400. The node 210 may register the authentication history information in the distributed ledger, that is, update the authentication history state database.

Next, the process of performing payment of the card while the user information is changed through user authentication for the payment of the card based on the blockchain network according to an embodiment of the present invention is schematically illustrated. In the following description, portions that can be easily inferred from the description of FIGS. 4 and 5 will be omitted.

When the user performs payment for order information in the service providing terminal 20 in order to pay for the use of the service or purchase the product online or offline using a registered card, the service providing terminal 20 supports payment Request payment for the user's order information by transmitting the payment request information to the server 100 (S51) or allowing another device interlocked with the service providing terminal 20 to transmit.

Then, the payment support server 100 refers to the merchant identification information, and the registered merchant number corresponding to the card company corresponding to the requested card token ID from among the merchant numbers registered for the distributed ledger on the blockchain network 200. It is possible to check (S52) or at least one card company node 210 on the blockchain network 200 to check the merchant number. Then, the payment support server 100 checks the user information registered in the distributed ledger on the blockchain network 200 by referring to the user identification information (S53) or at least one card company node 210 on the blockchain network 200 You can have the user confirm the user information.

At this time, the payment support server 100 may obtain the registered authentication history information corresponding to the user identification information from the distributed ledger on the blockchain network 200. That is, the payment support server 100 may obtain authentication history information performed on all cards owned by the user, including cards of other card companies, in addition to the card for which the current payment is to be performed, from the authentication history state database of the distributed ledger.

And, as a result of checking the user information, the payment support server 100 matches the registration card information, but when the user information such as terminal information or order information does not match (S54), the card company server 300 authenticates the card information and authentication. Method (S55), or other devices linked to the payment support server 100 may request the card company server 300 to request card information and an authentication method.

Then, the card company server 300 checks the registration card information corresponding to the stored user identification information, that is, the card token ID, and refers to the authentication history information corresponding to the user identification information, according to a preset authentication policy. The transaction risk is determined, and a specific authentication method to be performed is selected in response to the determined user's transaction risk (S56).

Thereafter, the specific card company server 300 transmits the checked card information and the selected authentication method to the payment support server 100 (S57), and the payment support server 100 uses the terminal according to the checked card information and the authentication method. In step (10), user authentication for the corresponding card is requested (S58).

Then, when the user completes user authentication according to the authentication method requested through the user terminal 10 (S59), the payment support server 100 requests approval to the payment request information requested by the card company server 300. (S60), and when the approval is completed from the card company server 300 (S61), and transmits information about the approval completion to the service providing terminal 20 (S62), the transaction information according to the approval completion, that is, the transaction transaction Record in the distributed ledger on the blockchain network 200 (S63) and update the transaction history state database, or at least one card company server 210 on the blockchain network 200 records the transaction transaction in the distributed ledger and the transaction history Lets you update the state database. In addition, the payment support server 100 registers authentication history information corresponding to user authentication to the distributed ledger on the blockchain network 200, that is, updates the authentication history status database or at least one card company on the blockchain network 400. The node 210 may register the authentication history information in the distributed ledger, that is, update the authentication history state database. In addition to this, the payment support server 100 registers user information such as changed terminal information or order information in the distributed ledger on the blockchain network 400, that is, updates the user state database or at least one on the blockchain network 400. The card company node 210 may register the changed user information in the distributed ledger, that is, update the user state database.

In addition, the embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components to be recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention or may be known and usable by those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs, DVDs, and magneto-optical media such as floptical disks. media), and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes produced by a compiler, but also high-level language codes executable by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

In the above, the present invention has been described by specific matters such as specific components, etc. and limited embodiments and drawings, which are provided to help the overall understanding of the present invention, but the present invention is not limited to the above embodiments , Those skilled in the art to which the present invention pertains can make various modifications and variations from these descriptions.

Therefore, the spirit of the present invention is not limited to the above-described embodiment, and should not be determined, and all claims that are equally or equivalently modified with the claims as described below belong to the scope of the spirit of the present invention. Would say

10: user terminal,
20: service provision terminal,
100: payment support server,
200: blockchain network,
300: card company server

Claims (10)

In the user authentication method for card payment based on the blockchain network,
(a) At least processing values of user terminal information, card registration information owned by each user, and authentication user information corresponding to the respective users, each user identification information corresponding to each of the users Corresponding to the field, while registered in the distributed ledger on the blockchain network consisting of respective card company nodes corresponding to respective card company servers according to each card company, a specific payment request corresponding to a specific user from the service provision terminal Information-The specific payment request information includes specific order information, specific user terminal information of the specific user, and specific user information of the specific user. When obtained from the specific card company server corresponding to the specific card registration information included in the specific user information among the plurality of card company servers on the blockchain network, the specific card company node corresponding to the specific card company server causes the distributed ledger It extracts and transmits the authentication history information corresponding to the specific user identification information from, and determines the transaction risk of the specific user according to a preset authentication policy by referring to the authentication history information corresponding to the specific user identification information and , Selecting a specific authentication method to be performed in response to the determined transaction risk of the specific user; And
(b) the specific card company server sends the selected specific authentication method to the payment support server, thereby causing the payment support server to (i) request the specific user terminal to perform a specific authentication according to the specific authentication method Allows the specific user to perform the specific authentication according to the specific authentication method through the specific user terminal, and (ii) when the specific authentication according to the specific authentication method is completed, a specific authentication history corresponding to the specific authentication Registering information in the distributed ledger or causing at least one card company node on the blockchain network to register the specific authentication history information in the distributed ledger;
How to include. According to claim 1,
The authentication history information corresponding to the respective users, for each of the card registration information owned by each user, the user terminal information used for a specific payment and the processing value of the order information, the authentication method in the specific payment Information, and authentication result information by the authentication method in the specific payment,
In step (a),
The specific card company server, in the authentication history information corresponding to the specific user identification information, the previous authentication history information corresponding to previous payments corresponding to all card registration information corresponding to all card companies owned by the specific user A method characterized by determining the transaction risk of the specific user with reference. According to claim 2,
The specific card company server generates a processing value of the specific user terminal information and the specific order information by applying a predetermined operation to the specific user terminal information and the specific order information included in the specific payment request information, and generates Compared with the processed values of the specific user terminal information and the specific order information, and the processed values of the user terminal information and the order information registered in the previous authentication history information, and if they do not match, the transaction of the specific user A method characterized by determining that the risk is high and selecting the specific authentication method having high authentication strength. According to claim 3,
The specific card company server matches the processed values of the generated specific user terminal information and the specific order information with the processed values of the user terminal information and the order information registered in the previous authentication history information. If it does, a method characterized by determining the transaction risk of the specific user with reference to the recognition method and authentication result information in the previous authentication history information registered immediately before. According to claim 1,
In step (b),
The specific card company server allows the payment support server to process the specific user information, the specific order information and the specific user terminal information included in the specific payment request information, the specific authentication method information, and the specific authentication. Method for generating the specific authentication history information, including the specific authentication result information according to. In a card company server that performs user authentication for a payment based on a blockchain network,
At least processing values of user terminal information, card registration information owned by each user, and authentication history information corresponding to the respective users correspond to respective user identification information corresponding to each of the users By doing so, in a state registered in a distributed ledger on a blockchain network composed of respective card company nodes corresponding to respective card company servers according to each card company, specific payment request information corresponding to a specific user from a service providing terminal-above The specific payment request information includes the specific order information, the specific user terminal information of the specific user, and the specific user information of the specific user-obtaining an authentication method verification request for the specific user from the payment support server corresponding to Communication; And
(i) Among the card company nodes on the blockchain network, a specific card company node corresponding to the specific card company server extracts and transmits the authentication history information corresponding to the specific user identification information from the distributed ledger, and identifies the specific user A process of determining a transaction risk of the specific user according to a predetermined authentication policy by referring to the authentication history information corresponding to the information, and selecting a specific authentication method to be performed in response to the determined transaction risk of the specific user, and (ii) By sending the selected specific authentication method to the payment support server, the payment support server requests (ii-1) the specific user terminal to perform a specific authentication according to the specific authentication method, so that the specific user Through the specific user terminal, the specific authentication according to the specific authentication method is performed, and (ii-2) when the specific authentication according to the specific authentication method is completed, specific authentication history information corresponding to the specific authentication is displayed. A processor that performs a process of registering with the distributed ledger or allowing at least one card company node on the blockchain network to register the specific authentication history information with the distributed ledger;
Card company server comprising a. The method of claim 6,
The authentication history information corresponding to the respective users, for each of the card registration information owned by each user, the user terminal information used for a specific payment and the processing value of the order information, the authentication method in the specific payment Information, and authentication result information by the authentication method in the specific payment,
The processor,
In the process (i), in the authentication history information corresponding to the specific user identification information, previous authentication history information corresponding to previous payments corresponding to all card registration information corresponding to all card companies owned by the specific user. Card company server, characterized in that to determine the transaction risk of the specific user with reference to. The method of claim 7,
The processor generates processing values of the specific user terminal information and the specific order information by applying a predetermined operation to the specific user terminal information and the specific order information included in the specific payment request information, and the generated the Compared to the processing values of the specific user terminal information and the specific order information, and the processing values of the user terminal information and the order information registered in the previous authentication history information, and if they do not match, the transaction risk of the specific user Card company server characterized in that it is determined to be high, and selecting the specific authentication method having a high authentication strength. The method of claim 8,
The processor compares the generated processing values of the specific user terminal information and the specific order information with the processing values of the user terminal information and the order information registered in the previous authentication history information, and matches them. A card company server characterized by determining the transaction risk of the specific user by referring to the recognition method and authentication result information in the previous authentication history information registered immediately before. The method of claim 6,
The processor,
In the (ii) process, the payment support server causes the specific user information, the specific order information, and the processing value of the specific user terminal information included in the specific payment request information, the specific authentication method information, and the specific Card company server, characterized in that to generate the specific authentication history information, including specific authentication result information according to the authentication.

Images