KR20200103615A - System and Method for Identification Based on Finanace Card Possessed by User - Google Patents

Abstract

The present invention relates to a system for performing user authentication based on a financial card possessed by a user. The system includes: a mobile communication terminal reading out accessible information of a financial card through a user authentication application operated by receiving a user authentication request signal from another application and transmitting the information to a secure application module (SAM) server, and then, obtaining an authentication key which is access to card block information recorded in a financial card possessed by a user and an OTX from the SAM server, transmitting the encrypted card block information read out from the financial card through a near field communication function by using the obtained authentication key and the OTX, and requesting user authentication by transmitting card information encrypted by a first public key to a card company server having issued the financial card upon receiving the information from the SAM server; the SAM server decrypting the encrypted card block information in accordance with success in OTX verification upon receiving the encrypted card block information transmitted from the mobile communication terminal, and transmitting the card information including a card number and an expiry date, which is extracted from the decrypted card block information, to the mobile communication terminal by encrypting the information with the first public key distributed by the card company server having issued the financial card; and the card company server decrypting the card information encrypted with the first public key from the mobile communication terminal by using a first private key paired with the first public key, and reporting a result of performing user authentication through a comparison between the card information and a client database to the mobile communication terminal.

Description

System and Method for Identification Based on Finanace Card Possessed by User}

The present invention relates to an identity authentication technology, and more particularly, to a financial card-based identity authentication system and method possessed by a user.

A ubiquitous computing environment has been established with the development of current wired and wireless communication technologies and mobile communication terminals that can access wired and wireless communication networks anytime, anywhere.

As the ubiquitous computing environment is established in this way, a myriad of things that were performed offline are being performed online. Representative ones may be internet banking and mobile banking of banks, issuance of resident registration copies of public institutions, and online identification of shopping malls.

However, in order to perform any action online, it is necessary to determine whether the subject performing the action is the legitimate subject of the action.

As such subject, that is, identity authentication to verify whether the user is the user, various types of identity authentication methods have been developed and applied. Such a self-authentication method may include a knowledge-based authentication method, a biometric authentication method, and a possession-based authentication method.

Knowledge-based authentication methods include ID and password authentication methods, Personal Identification Number (PIN) authentication methods, and i-PIN authentication methods. In addition, biometric authentication methods include authentication methods using fingerprint, voice, iris and vein recognition. In addition, possession-based authentication methods include One Time Password (OTP) authentication method, SMS authorization number authentication method and ARS authentication method using mobile communication terminals called mobile phones, mobile phones and smartphones.

Among them, possession-based authentication method with high security is widely applied, but in the case of ARS authentication method, there is a possibility that wired/wireless telephones considered to be possessed by the user at the time of authentication may be stolen, and OTP authentication method may be stolen if lost SMS authentication using a mobile communication terminal also has a problem in that an authorization number may be leaked through memory hacking.

Therefore, in order to solve this problem, it is an authentication method that can perform authentication easily while having stronger security. Using Near Field Communication (NFC) of a mobile communication terminal, the financial card Card face-to-face authentication by contact, and by using the financial card's unique identification information (Unique ID: UID) and personal identification number (PIN) to enhance the security of identity authentication without exposing card information. Provides an identity authentication system and method that can be easily performed.

The present invention is a financial card-based identity authentication system possessed by a user including a card company server, and a security application module by reading accessible information of a financial card by an identity authentication application that is driven by receiving an identity authentication request signal from another application. (Secure Application Module: hereinafter referred to as'SAM') After transmitting to the server, obtain an authentication key from the SAM server, which is the authority to access OTX and card block information recorded on the financial card held by the user, and the obtained authentication key And transmitting the encrypted card block information read out from the financial card through the short-range wireless communication function using OTX to the SAM server, and issuing the financial card by receiving the card information encrypted by the first public key from the SAM server. In receiving the encrypted card block information transmitted from the mobile communication terminal that transmits to the card company server to request identity authentication, and returns the identity authentication result received from the card company server to other applications, and the mobile communication terminal that received OTX and authentication key. Accordingly, OTX verification is performed, and as the OTX verification is successful, the encrypted card block information is decrypted, and the card information including the card number and expiration date extracted from the decrypted card block information is sent to the card company that issued the financial card. A SAM server that encrypts with the distributed first public key and transmits it to a mobile communication terminal, and a first secret key that pairs the card information with the first public key as the card information encrypted with the first public key is received from the mobile communication terminal. It decrypts using and compares the card information with the customer database and includes a card company server for notifying the result of self-authentication to the mobile communication terminal.

The present invention is a financial card-based identity authentication method carried by a user implemented in an identity authentication application executed in a mobile communication terminal equipped with a short-range wireless communication function, and an identity authentication application executed in a mobile communication terminal equipped with a short-range wireless communication function In the financial card-based identity authentication method possessed by a user implemented in, a secure application module (hereinafter referred to as'SAM') by reading accessible information of a financial card as an identity authentication request signal is received from another application H) transmitting to the server, obtaining an authentication key from the SAM server, which is the access authority for the OTX and card block information recorded on the financial card held by the user, and using the obtained OTX and authentication key to the financial card. Reading the recorded encrypted card block information through a short-range wireless communication function, transmitting the read encrypted card block information to the SAM server, and the card company that issued the financial card from the SAM server. 1 Upon receiving the card information including the card number and validity period encrypted with the public key, sending the financial card to the issuing card company server to request identity authentication, and returning the identity authentication result returned from the card company server to other applications It includes the step of.

The present invention is a financial card-based identity authentication method possessed by a user in a security application module (Secure Application Module: hereinafter referred to as'SAM'), and recorded on a financial card together with accessible information of the financial card from a mobile communication terminal. As issuance of an authentication key, which is an access right to the card block information, is requested, authenticating the user through information transmitted from the mobile communication terminal, and then providing the OTX and authentication key to the mobile communication terminal, and encrypted from the mobile communication terminal. As the card block information is transmitted, performing OTX verification; when the OTX verification is successful, decrypting the encrypted card block information; and card information including the card number and validity period from the decrypted card block information. Extracting, encrypting the extracted card information with a first public key distributed by a card company that issued the financial card, and transmitting the encrypted card information to the mobile communication terminal.

The present invention has an effect of increasing security by performing face-to-face authentication of a financial card based on financial card possession by using financial card information obtained by contacting a financial card possessed by a user using NFC of a mobile communication terminal.

The present invention improves security by performing a validity check of the financial card and encrypted communication of the card information by using a Secure Application Module (SAM) server when acquiring card information of a financial card for face-to-face authentication of a financial card. It has the effect of being able to.

1 is a diagram showing the configuration of an identity authentication system based on a financial card possessed by a user according to an embodiment of the present invention.
2 is a block diagram of a card company server according to an embodiment of the present invention.
3 is a signal flow diagram illustrating a method for authenticating an identity based on a financial card possessed by a user according to an embodiment of the present invention.
4 is a signal flow diagram illustrating a method of authenticating a user's financial card-based identity according to another embodiment of the present invention.
5 is a signal flow diagram illustrating a process of providing an authentication key from a SAM server to a mobile communication terminal according to an embodiment of the present invention.
6 is a flowchart illustrating an authentication method of a card company server according to another embodiment of the present invention.

Hereinafter, a financial card-based identity authentication system and method possessed by a user according to a preferred embodiment will be described in detail with reference to the accompanying drawings. Here, the same symbols are used for the same configuration, and detailed descriptions of repetitive descriptions and known functions and configurations that may unnecessarily obscure the subject matter of the invention are omitted. Embodiments of the invention are provided to more completely explain the invention to those with average knowledge in the art. Accordingly, the shapes and sizes of elements in the drawings may be exaggerated for clearer explanation.

Combinations of each block of the attached block diagram and each step of the flowchart may be executed by computer program instructions (execution engine), and these computer program instructions are executed on a processor of a general purpose computer, special purpose computer or other programmable data processing equipment. As it may be mounted, its instructions executed by the processor of a computer or other programmable data processing equipment generate means for performing the functions described in each block of the block diagram or each step of the flowchart.

These computer program instructions may also be stored in computer-usable or computer-readable memory that can be directed to a computer or other programmable data processing equipment to implement a function in a particular manner, so that the computer-usable or computer-readable memory It is also possible to produce an article of manufacture containing instruction means for performing the functions described in each block of the block diagram or each step of the flow chart.

In addition, since computer program instructions can be mounted on a computer or other programmable data processing equipment, a series of operation steps are performed on a computer or other programmable data processing equipment to create a computer-executable process. It is also possible for the instructions to perform the data processing equipment to provide steps for executing the functions described in each block of the block diagram and each step of the flowchart.

In addition, each block or each step may represent a module, segment, or part of code containing one or more executable instructions for executing specified logical functions, and in some alternative embodiments mentioned in the blocks or steps. It should be noted that it is also possible for functions to occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially simultaneously, and the blocks or steps may be performed in the reverse order of a corresponding function as necessary.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the embodiments of the present invention exemplified below may be modified in various other forms, and the scope of the present invention is not limited to the embodiments described below. Embodiments of the present invention are provided to more completely describe the present invention to those of ordinary skill in the art.

1 is a diagram showing the configuration of an identity authentication system based on a financial card possessed by a user according to an embodiment of the present invention.

Referring to FIG. 1, a financial card-based identity authentication system possessed by a user includes a financial card (1a, 1b) possessed by a user, a mobile communication terminal 10, and a secure application module (SAM). Ham) includes a server 20 and a card company server 30.

The mobile communication terminal 10, the SAM server 20, and the card company server 30 will be connected through a wired/wireless data communication network (not shown). Here, the wired and wireless data communication network includes an Internet network including a Wi-Fi network, a 3G (Third Generation) WCDMA method, a 4G (4Generation: 4G = Long Term Evolution (LTE)) network, and a 5G mobile communication (5Generation Networks). It is a communication network to which a mobile communication network including a is combined.

The identity authentication based on a financial card possessed by a user according to the present invention is performed as an identity authentication event occurs in an institution, a company, a store, etc. in order to provide a service to the user. Here, the institution may be an online or offline bank, a financial institution such as a securities company and an insurance company, a city office, a ward office, a city hall, a government office, etc., and the company is an internet shopping mall operator, an offline company having a number of stores. Could be the back.

The financial cards 1a and 1b include all types of cards that are connected to the mobile communication terminal 10 in a contact or non-contact manner, such as a general credit card or transportation card, to perform financial services and transportation services. For example, a real credit card (1a) and a mobile card (1b) may be included, and one or more chips are embedded in these financial cards (1a, 1b), and the mobile communication terminal 10 and short-range wireless It may be an RF card that can be connected in a contactless manner through communication to exchange data. Here, the short-range wireless communication is not limited, such as RF, infrared communication, PAN communication, and Bluetooth communication, but is preferably a communication method that follows the NFC (Near Field Communication) protocol. In addition, an OS (Operation System) (not shown) and a storage space (not shown) are provided inside the chip of the financial card (1a, 1b), and the storage space is divided into two or more sectors. Hierarchical card-related information may be stored. As the authentication key is transmitted from the mobile communication terminal 10 in the RF method, the operating system (OS) inside the chip of the financial card 1a, 1b performs an authentication algorithm using the authentication key, and the card stored in each sector Related information can be transmitted to the mobile communication terminal 10 in an RF method. A detailed description of this will be described later with reference to FIG. 5.

The mobile communication terminal 10 is a communication terminal that provides a personal authentication channel based on possession of a financial card by connecting the financial card (1a, 1b) and the SAM server 20 or the card company server 30, and is a general mobile phone, smart phone, etc. It may be a personal wireless communication terminal of, but is not limited thereto. That is, the mobile communication terminal 10 is not limited to such a personal wireless communication terminal, and is a terminal that connects to a card and mediates a corresponding service using information stored in the card, and is a general credit card connected to the existing VAN communication network. It could be any other type of wireless card terminal or dongle terminal, such as a terminal.

In this mobile communication terminal 10, an identity authentication application for identity authentication of a user holding a financial card 1a, 1b according to the present invention may be installed as an application program 13a. According to the present invention, the mobile communication terminal 10 is a wireless communication unit 11 for performing wireless Internet communication with the SAM server 20 and the card company server 30, and recording on the financial cards 1a and 1b through short-range wireless communication. A card reader unit 12 for reading the information, a memory unit 13 for storing an application program including an identity authentication application, display user interface information including a process status of the identity authentication application, and receive information from the user. The user authentication process using financial cards 1a and 1b is performed through wireless Internet communication with the SAM server 20 or the card company server 30 by executing the display unit 14 in the form of a touch screen that can be input and the installed identity authentication application. It includes a control unit 15 that proceeds sequentially.

Specifically, the user of the mobile communication terminal 10 downloads the identity authentication application 13a, installs and registers it in the control unit 15, and communicates with the SAM server 20 and the card company server 30 through the identity authentication application 13a. Interlock to perform the identity verification process. That is, when the authentication key is received by the mobile communication terminal 10, the authentication key may be used to access the financial cards 1a and 1b to perform identification. In this case, the short-range wireless communication reader unit 12 RF card information in an encrypted form, that is, card block information, is first read through. The card block information is transmitted to the SAM server 20 as code information for recognizing or identifying the credit card. Thereafter, when the card information corresponding to the card block information is received from the SAM server 20 in an encrypted state with the first blank key key, the control unit 15 transmits the encrypted card information and the user's personal identification information to the card company server 30. Send to and request authorization for identification.

In addition, according to another embodiment of the present invention, the mobile communication terminal 10 may additionally encrypt the card information encrypted with the first public key using an asymmetric key method, but may encrypt the card information with the second secret key so that the electronic signature may be performed. The second secret key is distributed to only the user from the encryption key distribution server (not shown), and the second secret key is owned only by the mobile communication terminal 10, and the public key paired with the second secret key is an unspecified number of Can be distributed to

Here, the SAM server 20 may be configured in a hardware state by being provided with a secure application module (SAM) in the form of at least one chip. In addition, the SAM server 20 may be configured such that the SAM is programmed in the server in a software state, and at this time, the SAM server 20 includes card block information and corresponding card information and identity authentication through a PC or wireless communication means equipped with itself. The process of transmitting and receiving information is automatically processed.

In addition, in detail, the SAM server 20 performs affiliate store or user information authentication through an identity authentication application installed in the mobile communication terminal 10, and uses OTX for validating the authentication key and later decryption of card block information with card access authority. When the encrypted card block information is received from the authentication server 20A and the mobile communication terminal 10, which generates and transmits, decrypts the card block information, and encrypts the card information corresponding to the decrypted card block information with a public key, the mobile communication terminal 10 ) To provide an encoding server 20B.

The authentication server 20A authenticates user information through an identity authentication application so that the identity authentication process of the financial cards 1a and 1b can be performed in the mobile communication terminal 10, and the authentication key, which is the card access authority, is transmitted to the mobile communication terminal 10. ). In addition, when an authentication key request is received from the mobile communication terminal 10, the SAM server 20 generates a 16-byte OTX of a unique value using the request time in the authentication server 20A, and the authentication server DB (not shown) ). Then, the authentication server 20A transmits the authentication key and the generated OTX to the mobile communication terminal 10.

When the card block information is received from the mobile communication terminal 10, the encryption server 20B extracts the card information including the card number and expiration date by decrypting the card block information, encrypts the extracted card information, and moves it. It returns to the communication terminal 10. At this time, when the encryption server 20B receives the card number decryption request, it sends the OTX received from the mobile communication terminal 10 to the authentication server 20A, and the authentication server 20A verifies whether the card number decryption request is valid with OTX. After that, the result is returned to the encryption server 20B.

The encryption server 20B encrypts the card information using the first public key distributed by the card company server 30. That is, in the present invention, an asymmetric key encryption method is used in which the key to be encrypted and the key used for decryption are different, that is, a private key (private key) that is never exposed to others and a public key created based on the private key are paired. It is a form that achieved. In the present invention, the secret key is stored by the card company server 30, and the public key is distributed by the card company server 30 and used by the encoding server 20B.

The card company server 30 may be a server system composed of a plurality of servers such as banks, securities, and insurance companies. The card company server 30 receives the identity authentication request information from the mobile communication terminal 10, compares the card information included in the identity authentication request signal with the card information previously registered for the user identification information to perform identity authentication. Then, the user authentication result is provided to the mobile communication terminal 10.

The card company server 30 includes a memory in which an identity authentication application that performs a financial card-based identity authentication method possessed by a user to be described later with reference to FIGS. 3 to 6 is programmed and stored in a software state, or a user in a hardware state It is composed of a chip that stores process information for performing a financial card-based identity authentication method possessed by the device, and may be stored in a memory or configured as a chip through the CPU of a processing PC equipped with itself.

2 is a block diagram of a card company server according to an embodiment of the present invention.

Referring to FIG. 2, the card company server 30 includes a decryption unit 31, a customer DB 32, an identity verification verification unit 33, and a message transmission processing unit 34. Additionally, it may further include an authentication permitted time check unit 35 and an authentication permitted time information DB 36.

The decryption unit 31 decrypts the received card information encrypted with the first public key with the first secret key and decrypts the personal identification information with the symmetric key. At this time, according to another embodiment of the present invention, the card information may be encrypted over two times. That is, the card information may be encrypted with a first public key, which is a primary encryption key, and then encrypted with a second secret key, which is a secondary encryption key. Then, the decryption unit 31 first decrypts the card information with the second public key paired with the second private key, and then secondly decrypts the card information with the first private key to obtain the card information. That is, the second private key is held only by the mobile communication terminal 10, and when the card information is encrypted and transmitted with the second private key, and the card company server 30 decrypts it with the second public key, personal authentication The function can be further enhanced. This is because only the mobile communication terminal 10 has the second secret key.

The identification verification unit 33 compares the card information and personal identification information with the information of the customer DB 32 to perform identification. The customer DB 32 stores card issuance information, and stores card information and personal identification information for each customer. That is, if the received card information and personal identification information match the information stored in the customer DB 32, it is determined that the user is authenticated.

The message sending processing unit 34 notifies the mobile communication terminal 10 of the result of the identification of the identification verification unit 33.

Additionally, the authentication allowance time check unit 35 searches the authentication allowance time information DB 36 and extracts the authentication allowance time information set by the customer corresponding to the decrypted card information and personal identification information. In other words, it is possible to set the user authentication time in advance for each customer. Therefore, if identity authentication is requested at a time other than the set time, it is regarded as an illegal identity authentication request, and the identity authentication request is not performed. Instead, the identity authentication request through the message sending unit 34 is impossible and card information Allows theft warning message to be sent. In this way, the security of identity authentication can be further strengthened.

3 is a signal flow diagram for explaining a method for authenticating a user's financial card based identity according to an embodiment of the present invention, and FIG. 4 is a method for authenticating a user based identity based on a financial card according to another embodiment of the present invention 5 is a signal flow diagram for explaining a process of providing an authentication key and an OTX from a SAM server to a mobile communication terminal according to an embodiment of the present invention.

Referring to FIGS. 3 and 4, first, according to an identity authentication request signal received (S101) in response to an identity authentication event for an arbitrary service requested by a user, the mobile communication terminal 10 is downloaded in advance by the user. Run the installed identity authentication application. Such an identity authentication request may be made as an identity authentication event occurs in organizations, companies, and stores in order to provide a service to the user. In addition, the identity authentication request signal may be a signal generated from other applications executed in institutions, companies, and stores through the mobile communication terminal 10. For example, when a transcript issuing service is provided from a university, an identity authentication request signal may be generated from a certificate issuing application, and when a shopping payment service is provided, an identity authentication request signal may be generated from a payment application of a corresponding company. .

The mobile communication terminal 10 requests a user authentication application through wireless communication with the SAM server 20 so that user information is authenticated. At this time, the SAM server 20 authenticates user information through the identity authentication application 13a installed in the mobile communication terminal 10 and supplies an authentication key capable of reading card block information (S102). The authentication key may be a security access key enabling access from the financial cards 1a and 1b to a storage space in which user authentication information is stored. At this time, the SAM server 20 generates an OTX and transmits it to the mobile communication terminal 10 together with an authentication key. Here, the OTX is generated by the authentication server 20A, and is used for validating the card number decryption request. That is, OTX is used for the purpose of preventing the validity of the decryption request and the reuse and use of card block information after storage. An embodiment of providing an authentication key and OTX according to the present invention will be described with reference to FIG. 5.

Referring to FIG. 5, the mobile communication terminal 10 drives the short-range wireless communication reader unit 12 to provide unique identification information (Unique ID: UID) or chip serial number of the financial cards 1a and 1b. : CSN) is obtained to prepare to read card information (S210). In detail, after activating the short-range wireless communication reader unit 12 driven by the execution of the identity authentication application, a message requesting to contact the financial cards 1a and 1b through the display unit 14 is displayed, In response to this, when the financial cards 1a and 1b contact the short-range wireless communication reader unit 12, unique identification information (Unique ID: UID) or chip serial number (Chip Serial Number) through the short-range wireless communication reader unit 12 CSN) can be obtained. Here, the unique identification information (Unique ID: UID) or chip serial number (Chip Serial Number: CSN) is information that can be read by the mobile communication terminal 10 in the RF method without a separate authentication key, and is 4 bytes of information. I can.

The mobile communication terminal 10 transmits the UID or CSN to the SAM server 20 to request a primary authentication key (S220). Then, the SAM server 20 verifies forgery or the like through the financial cards 1a and 1b having a UID or CSN, and provides a primary authentication key to the mobile communication terminal 10 (S230). Here, the primary authentication key may be 6 bytes of information. Then, the mobile communication terminal 10 drives the short-range wireless communication reader unit 12 and uses the primary authentication key provided from the SAM server 20 to determine the first sector (1st) of the card information from the financial cards 1a and 1b. sector) information is read (S240). That is, the financial card (1a, 1b) receives the primary authentication key from the mobile communication terminal 10 in the RF method, so if the primary authentication key is valid, the first sector information stored in the storage space is stored in the mobile communication terminal. Pass it to (10).

Then, the mobile communication terminal 10 transmits the first sector (1st sector) information of the financial card (1a, 1b) to the SAM server 20 to request a secondary authentication key (S250). Then, the SAM server 20 authenticates the first sector (1st sector) information, and transmits a secondary authentication key having access rights to the encrypted card block information to the mobile communication terminal 10 (S260). At this time, the authentication server 20A of the SAM server 20 generates a 16-byte OTX, which is a unique value, using the authentication key request time, and stores it in the authentication server DB (not shown). Then, the authentication server 20A transmits the generated OTX to the mobile communication terminal 10 a secondary authentication key (S260).

Referring back to FIGS. 3 and 4, after the user's authentication process of the mobile communication terminal 10 is performed, the user directly accesses the financial cards 1a and 1b using the authentication key that is the card access authority from the SAM server 20. When tagging the mobile communication terminal 10, the mobile communication terminal 10 reads the card block information from the short-range wireless communication reader unit 12 (S110). Here, the authentication key may be a secondary authentication key obtained in FIG. 5. Here, the card block information is encrypted information. The mobile communication terminal 10 transmits the card block information to the SAM server 20 through the wireless communication unit 11 (S120). At this time, the mobile communication terminal 10 transmits the OTX received in step S102 together.

Then, before decrypting the card block information, the encryption server 20B of the SAM server 20 performs validity verification on the request for decryption of the card block information with OTX transmitted from the mobile communication terminal 10 (S121 to S125). That is, the encryption server 20B requests OTX verification to the authentication server 20A (S121). Then, the authentication server 20A verifies whether the card number decryption request is valid with OTX (S122), and then returns the OTX verification result (S123). That is, the authentication server 20A verifies whether the OTX requested for verification by the mobile communication terminal 10 is an OTX issued by the authentication server 20A. At this time, once OTX verification is completed, the OTX stored in the authentication server DB is deleted, so once used OTX cannot be reused. In addition, a verification failure result may be returned to reject a decryption request that has passed a predetermined time (eg, 3 minutes) by checking the generation time in the OTX.

If the result of the OTX verification transmitted in S123 is unsuccessful, the encryption server 20B transmits an identity authentication impossible message to the mobile communication terminal 10 (S125). Then, the mobile communication terminal 10 transmits an identity authentication impossible message to another application requesting identity authentication (S126), and ends the identity authentication process.

On the other hand, if the OTX verification result transmitted in S123 is successful, the encryption server 20B decrypts the card block information (S130). Then, the SAM server 20 extracts card information for identity authentication from the decrypted card block information (S135), and distributes the first disclosure by the card company server 30 that issued the financial cards 1a and 1b. The extracted card information is encrypted using the key (S140). Here, the card information may include a card number and an expiration date. Then, the SAM server 20 transmits the card information to the mobile communication terminal 10 in an encrypted state with the first public key (S150).

According to an embodiment of the present invention shown in FIG. 3, as the mobile communication terminal 10 receives the received card information in an encrypted state, a personal identification number (PIN) together with the encrypted card information Is transmitted to the card company server 30 to request identity authentication (S160, S170).

That is, the mobile communication terminal 10 displays a message requesting input of a personal identification number, obtains and encrypts a PIN input through the input means (S160). Here, the user identification information may be one or more of a user name, a date of birth, a resident registration number, a mobile communication terminal phone number, etc., but it is preferable that the user identification information is a date of birth or a mobile communication terminal phone number. Here, the mobile communication terminal 10 and the mobile terminal possessed by the user may be the same, and when the mobile communication terminal 10 is a terminal installed at an affiliate store, the mobile terminal possessed by the user may be different from the mobile communication terminal 10. May be.

Meanwhile, according to another embodiment of the present invention shown in FIG. 4, the mobile communication terminal 10 may additionally encrypt card information encrypted with the first public key with the second private key (S155). To this end, the mobile communication terminal 10 may pre-distribute a second secret key, which is an encryption key to be held only by the mobile communication terminal, from an encryption key distribution server (not shown) in advance. The second secret key is distributed to only the user from the encryption key distribution server (not shown), and the second secret key is owned only by the mobile communication terminal 10, and the second public key paired with the second secret key is It can be distributed to an unspecified number of people. That is, in the case of the current credit card or the like, if the physical card itself is illegally acquired, the acquirer can make illegal payments using the credit card, so there is no way to prevent the illegal use of the card when the card is lost. Therefore, through this, it is possible to strengthen the identification of the cardholder.

In addition, according to an embodiment of the present invention shown in FIG. 3, the card company server 30 receiving the identity authentication request signal decrypts the card information included in the identity authentication request signal with the first secret key (S180). Specifically, the card information decrypted with the first public key is decrypted with a second private key paired with the first public key. Meanwhile, according to another embodiment of the present invention illustrated in FIG. 4, the card information may be encrypted over a second time. That is, the card information may be encrypted with a first public key, which is a primary encryption key, and then encrypted with a second secret key, which is a secondary encryption key. Then, the decryption unit 31 first decrypts the card information using the second public key paired with the second private key (S175), and then secondly decrypts the card information with the first private key to obtain the card information (S185). That is, the second secret key is held only by the mobile communication terminal 10, and when the card information is encrypted and transmitted with the second secret key, and the card company server 30 decrypts it with the second public key, personal identification The function can be further enhanced. This is because only the mobile communication terminal 10 has the second secret key. This second public key may be requested in real time from an encryption key distribution server (not shown), or may be matched and stored in the customer DB 32 together with the personal identification information of the card user.

The card company server 30 searches the customer DB 32 with the decrypted card information and personal identification information and performs identity authentication (S185). At this time, the card company server 30 may perform identity authentication based on a preset allowable time slot in performing identity authentication, which is a kind of siren service to prevent theft of card information. It will be described later with reference to FIG. 5.

Then, the card company server 30 notifies the user authentication result to the mobile communication terminal 10 (S190). At this time, the identity authentication result may be transmitted as a mobile communication message. At this time, the authentication result is a mobile communication message such as a short message service (SMS), a long message service (LMS), and a multimedia message service (MMS), a push message, and a specific application execution. It could be a request signal.

Then, the mobile communication terminal 10 returns the identity authentication result received from the card company server 30 to another application (S195) to complete the identity authentication process.

6 is a flowchart illustrating a customer authentication method in a card company server according to an embodiment of the present invention.

6, the authentication allowance time check unit 35 of the card company server 30 searches the authentication allowance time information DB 36 to allow authentication set by a customer corresponding to the decrypted card information and personal identification information. Time information is searched (S310). To this end, the card company server 30 may transmit the user authentication allowable time input from the user to the card company server to be registered in advance. In other words, it is possible to set the allowable time for personal authentication in advance for each customer. Therefore, if the authentication allowance time check unit 35 of the card company server 30 is requested to authenticate at a time other than the set time, this is regarded as an illegal identity authentication request, and does not perform the identity authentication request, instead Through the message sending unit 34, the user authentication request impossibility and personal information theft warning message are transmitted (S340). In this way, the security of identity authentication can be further strengthened.

On the other hand, when the user is requested to authenticate at a time set by the customer, the authentication performing unit 35 of the card company server 30 compares the information of the customer DB 32 and performs the authentication (S350). As a result of the determination of S350, if the received card information and personal identification information match the information stored in the customer DB 32, it is determined that identity verification has been confirmed, and the message sending processing unit 34 of the card company server 30 authenticates the identity. Send a confirmation message (S380). On the other hand, as a result of the determination of S350, if the received card information and personal identification information do not match the information stored in the customer DB 32, it is determined that identity authentication has failed, and the message sending processing unit 34 of the card company server 30 Sends an identity authentication error message (S380).

Claims (22)

Upon receiving the user authentication request signal from other applications, the accessable information of the financial card is read by the user authentication application and transmitted to the secure application module (Secure Application Module: hereinafter referred to as'SAM') server, and the SAM Acquires OTX for validating the decryption of card block information from the server and an authentication key that is the access authority for the card block information recorded in the user's financial card, and uses the obtained authentication key to perform short-range wireless communication function from the financial card. The encrypted card block information and OTX read through is transmitted to the SAM server, and as the card information encrypted by the first public key is received from the SAM server, the card company that issued the financial card is sent to request identity authentication, and the card company A mobile communication terminal that returns the identity authentication result received from the server to another application,
Upon receiving the encrypted card block information and OTX transmitted from the mobile communication terminal provided with the authentication key, OTX verification is performed, and as the OTX verification is successful, the encrypted card block information is decrypted and extracted from the decrypted card block information. A SAM server that encrypts card information, including the card number and validity period, with the first public key distributed by the card company that issued the financial card and transmits it to the mobile communication terminal;
As the card information encrypted with the first public key is received from the mobile communication terminal, the card information is decrypted using the first private key paired with the first public key, and the card information is compared with the customer database to authenticate itself. A financial card-based identity authentication system possessed by a user including a card company server that notifies the mobile communication terminal.
The method of claim 1, wherein the SAM server
An authentication server that generates and issues an authentication key and OTX,
Including an encryption server for decrypting the card block information,
Encryption server
As card block information and OTX are received, requesting OTX verification to the authentication server,
The authentication server is
A financial card-based identity authentication system possessed by a user who verifies whether the OTX requested for verification is the OTX issued by the user and returns the verification result to the encryption server.
The method of claim 1, wherein the SAM server
As the OTX verification fails, a message that cannot be authenticated is transmitted to the mobile communication terminal,
Mobile communication terminal
A financial card-based identity authentication system possessed by a user that transmits a message that cannot be authenticated to other applications.
The method of claim 2, wherein the authentication server
When OTX verification is complete, a financial card-based identity authentication system possessed by the user who deletes OTX.
The method of claim 2, wherein the authentication server
A financial card-based identity authentication system possessed by a user who checks the generation time recorded in OTX and returns a result of OTX verification failure when a certain time has elapsed from the OTX creation time.
The method of claim 1, wherein the mobile communication terminal
Obtain additional personal identification number (PIN) of the user, and request additional authentication by transmitting personal identification information to the card company server along with the card information,
The card company server
As a personal identification number is additionally received along with the card information, a financial card-based identity authentication system possessed by a user including a card company server for additional authentication.
The method of claim 6, wherein the personal identification number is
A financial card-based identity authentication system possessed by a user, which is the user's social security number or the number of a mobile terminal possessed by the user.
The method of claim 1, wherein the mobile communication terminal
The card information encrypted by the first public key is additionally encrypted with a second secret key held only by the mobile communication terminal and transmitted to the card company server to request identity authentication,
Card company terminal
A financial card-based identity authentication system possessed by a user who decrypts the additional encrypted card information with a second public key paired with a second private key and then decrypts it with the first private key.
The method of claim 1, wherein the mobile communication terminal
Registering in advance by transmitting the allowable time for personal authentication input from the user to the card company server,
The card company server
Registers a preset allowable time for authentication for each user, detects the allowable time for authentication of the user when receiving a request for authentication, determines whether the request for authentication is valid based on the time allowed for authentication, and the request for authentication is valid If not, a financial card-based identity authentication system possessed by a user that transmits a message that cannot be authenticated to a mobile communication terminal.
In the financial card-based identity authentication method possessed by a user implemented in an identity authentication application executed in a mobile communication terminal equipped with a short-range wireless communication function,
Reading the accessible information of the financial card as the user authentication request signal is received from another application and transmitting it to a secure application module (Secure Application Module: hereinafter referred to as'SAM') server; and
Acquiring an OTX for validating decryption of card block information from a SAM server and an authentication key that is an access authority for card block information recorded in a financial card held by a user;
Reading the encrypted card block information recorded on the financial card using the obtained authentication key through a short-range wireless communication function,
Transmitting the read encrypted card block information and OTX to the SAM server,
Upon receiving the card information including the card number and the validity period encrypted with the first public key distributed by the card company that issued the financial card from the SAM server, sending the card information to the card company server that issued the financial card to request identity authentication;
Financial card-based identity authentication method possessed by a user comprising the step of returning the identity authentication result returned from the card company server to another application.
The method of claim 10, wherein the step of requesting identity verification
A financial card-based identity authentication method possessed by a user, comprising the step of additionally obtaining a user's Personal Identification Number (PIN) and transmitting the personal identification information together with the card information to a card company server to request additional authentication.
The method of claim 11, wherein the personal identification number is
A financial card-based identity authentication method possessed by a user, which is the user's social security number or the number of a mobile terminal possessed by the user.
The method of claim 10, wherein the step of requesting identity verification
Receiving a second secret key, which is an encryption key to be held only by the mobile communication terminal, from the encryption key distribution server in advance;
A financial card-based identity authentication method possessed by a user, further comprising the step of additionally encrypting the card information encrypted by the first public key with a second secret key held only by the mobile communication terminal.
The method of claim 10,
Financial card-based identity authentication method possessed by a user, further comprising the step of registering in advance by transmitting the allowable time for identity authentication input from the user to the card company server.
The method of claim 10,
A financial card-based identity authentication method possessed by a user, further comprising the step of transmitting an identity authentication impossible message to another application upon receiving an identity authentication impossible message due to an OTX verification failure from the SAM server.
In the method of authentication based on a financial card held by a user in a secure application module (Secure Application Module: hereinafter referred to as'SAM') server,
As the mobile communication terminal requests the issuance of an authentication key that is the access authority for the card block information recorded on the financial card along with the accessible information of the financial card, the user is authenticated through the information transmitted from the mobile communication terminal, and then the Providing an OTX and an authentication key for validating decryption of card block information, and
As the OTX and the encrypted card block information are transmitted from the mobile communication terminal, performing OTX verification; and
If the OTX verification is successful, decrypting the encrypted card block information,
Extracting card information including a card number and a valid period from the decrypted card block information; and
Encrypting the extracted card information with the first public key distributed by the card company that issued the financial card;
Financial card-based identity authentication method possessed by a user, comprising the step of transmitting the encrypted card information to a mobile communication terminal.
The method of claim 16,
If the OTX verification fails, the method of authenticating a user based on a financial card, further comprising the step of transmitting a decryption impossible message to a mobile communication terminal.
The method of claim 16, wherein performing OTX verification
A financial card-based identity authentication method held by a user who verifies whether the OTX requested for verification is an OTX issued by the user. The method of claim 16, wherein performing OTX verification
When OTX verification is complete, a financial card-based identity authentication method held by the user who deletes OTX.
The method of claim 16, wherein performing OTX verification
Financial card-based identity authentication method possessed by the user who checks the generation time recorded in OTX and returns the result of OTX verification failure when a certain time has elapsed from the OTX creation time.
The identity authentication application that performs the financial card-based identity authentication method possessed by the user according to any one of claims 10 to 15 includes a memory programmed and stored in a software state, or finance held by a user in a hardware state A mobile communication terminal configured with a chip that stores process information that performs a card-based identity authentication method, and performs a financial card-based identity authentication method possessed by a user consisting of a chip or stored in a memory through the CPU of a processing PC equipped with itself.
The secure application module (SAM) is programmed in software state and stored in memory, or it is composed of a chip that stores secure application module (SAM) information in hardware state, and the CPU of the processing PC equipped with itself By performing wireless communication through a mobile communication terminal through a separate wireless communication means through a security application module that processes the financial card-based identity authentication method possessed by the user according to any one of claims 16 to 20 ( Secure Application Module: SAM) server.

Images