KR20240041662A - Method and apparatus for providing digital financial security service - Google Patents

Abstract

A method of operating a digital financial security server operated by at least one processor, comprising: checking connection information of a financial application executed on a user terminal from a financial application server; obtaining the IP address of a router connected to the user terminal from the connection information; It includes the steps of confirming, determining whether the IP address of the router is a malicious IP address, generating router safety status diagnosis information according to the determination, and transmitting the router safety status diagnosis information to the user terminal.

Description

Digital financial security service method and device {METHOD AND APPARATUS FOR PROVIDING DIGITAL FINANCIAL SECURITY SERVICE}

The present invention relates to a digital financial security service method and device.

As digital services become more diverse and complex due to digital transformation, the boundaries between components are becoming blurred, and new cyber security threats are increasing. Components include users, devices, applications, networks, and servers, and major digital security threats such as information theft, authentication bypass, transmission forgery/falsification, malicious apps, man-in-the-middle attacks, and illegal transactions exist.

When mobile banking transactions are activated, security threats in the network environment of terminals attempting mobile banking transactions are emerging as an important issue.

Terminals usually use free Wi-Fi, but sometimes personal information such as passwords can be hacked. Accordingly, a method to prevent such hacking problems is needed.

One technical problem that the present invention seeks to achieve is that when a user terminal connects to a financial application server through a financial application, the financial application server diagnoses the safety status of the router connected to the user terminal and determines whether the user terminal is exposed to hacking. To provide a digital financial security service method and device that diagnoses and provides connection attempt details using login information of a user terminal.

A method according to an embodiment of the present invention is a method of operating a digital financial security server operated by at least one processor, comprising the steps of checking access information of a financial application executed on a user terminal from a financial application server, and sending the user terminal to the user terminal. Confirming the IP address of the connected router from the connection information, determining whether the IP address of the router is a malicious IP address, generating router safety status diagnosis information according to the determination, and providing the router safety status diagnosis information to the user. It includes the step of transmitting to the terminal.

The generating step includes determining whether the IP address of the router is a malicious IP address registered in a blacklist, and if it is determined to be a malicious IP address, generating the safety status diagnosis information including a router status check notification. may include.

After the determining step, if the IP address is not malicious, checking the location information of the router from the IP address of the router, and comparing the location information of the router with the location information of the user terminal and checking the status of the router if there is a discrepancy. The method may further include generating the safety status diagnosis information including a notification.

The router may include a WiFi (WiFi) AP (Access Point).

After the confirming step, receiving IoT device connection information of the user terminal from the financial application server, whether the IP address of the IoT device is a malicious IP address or location information confirmed by the IP address of the IoT device is transmitted to the user terminal. determining at least one of the following: determining whether the IP address matches the location information; if the IP address is determined to be malicious or mismatching the location information, generating IoT device safety status diagnosis information including an IoT device status check notification; It may further include transmitting the IoT device safety status diagnosis information to the user terminal.

After the transmitting step, receiving login connection information of the user terminal from the financial application server, confirming whether the router IP address confirmed from the login connection information and the location confirmed by the router IP address exist in the past login connection history. Step, if it does not exist in the past login connection history, checking the router hacking diagnosis information to determine whether the hacking risk is high, and if the hacking risk is high, transmitting a connection environment inspection notification to the user terminal. You can.

After the step of determining whether the hacking risk is high, if it is determined that the hacking risk is not high, sending a notification of a normal connection environment to the user terminal. It may further include.

After transmitting the connection environment normal notification to the user terminal, requesting the user terminal to register as a frequently accessed environment, and when a registration request is received from the user terminal, the router IP address and the router IP A step of additionally registering the location confirmed by the address in the login connection history may be further included.

A server according to another embodiment of the present invention is a digital financial security server operated by at least one processor, an app connection detection unit that receives access information of a financial application executed on a user terminal from a financial application server, and the app connection detection unit. When the connection of the financial application is confirmed by the detection unit, the IP address of the router connected to the user terminal is checked from the connection information, the router's IP address is determined to be a malicious IP address, and the router's safety status diagnosis information is provided according to the determination. It may include a router hacking diagnosis unit transmitted to the user terminal.

If the router hacking diagnosis unit determines that the IP address of the router is a malicious IP address registered in the blacklist, the router hacking diagnosis unit may transmit the safety status diagnosis information including a router status check notification.

The router hacking diagnosis unit checks the location information of the router from the IP address of the router if it is not a malicious IP address, and compares the location information of the router with the location information of the user terminal. If there is a discrepancy, it sends a router status check notification. The safety status diagnosis information including the safety status may be transmitted.

An IoT device that obtains the IoT device connection information of the user terminal from the financial application server, diagnoses the IoT device safety status based on the IoT device connection information, and transmits an IoT device status check notification or IoT device status normal notification to the user terminal. The device may further include a security diagnosis unit.

The IoT device security diagnosis unit determines at least one of whether the IP address of the IoT device is a malicious IP address or whether the location information confirmed by the IP address of the IoT device matches the location information of the user terminal, and determines whether the malicious IP address is a malicious IP address. If it is determined to be an address or a mismatch in location information, an IoT device status check notification can be sent.

It further includes a login safety diagnosis unit that obtains login connection information of the user terminal from the financial application server, diagnoses the connection environment status based on the login connection information, and transmits a connection environment normal notification or connection environment inspection notification to the user terminal. can do.

The login safety diagnosis unit checks whether the router IP address confirmed from the login connection information and the location confirmed by the router IP address exist in the past login connection history, and if not present in the past login connection history, provides the router hacking diagnosis information. It is determined whether the risk of hacking is high, and if the risk of hacking is high, a connection environment inspection notification can be sent to the user terminal.

According to the embodiment, it is possible to provide a safe financial service that analyzes not only direct components such as terminals or apps (APPs) that use financial services, but also indirect component vulnerabilities such as the terminal connection environment.

Figure 1 shows the connection relationship between a digital financial security server and its surrounding components according to an embodiment.
Figure 2 is a block diagram showing the configuration of a digital financial security server according to an embodiment.
Figure 3 is a flowchart showing a terminal location confirmation operation according to one embodiment.
Figure 4 is a flowchart showing a router hacking diagnosis operation according to an embodiment.
Figure 5 is a flowchart showing an IoT (Internet of Things) device security diagnosis operation according to an embodiment.
Figure 6 is a flowchart showing a login safety diagnosis operation according to an embodiment.
Figure 7 is an example diagram of a digital safe security service menu screen according to an embodiment.
Figure 8 is an example diagram of a digital safe security service screen according to an embodiment.
Figure 9 is an example diagram of a router diagnosis screen according to one embodiment.
10 is an exemplary diagram of a manual inspection menu screen according to an embodiment.
Figure 11 is an example diagram of an inspection completion page according to one embodiment.
Figure 12 is a block diagram showing the hardware configuration of a digital financial security server according to an embodiment.

Below, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily implement the present invention. However, the present invention may be implemented in various different forms and is not limited to the embodiments described herein. In order to clearly explain the present invention in the drawings, parts that are not related to the description are omitted, and similar parts are given similar reference numerals throughout the specification.

Throughout the specification, when a part "includes" a certain component, this means that it may further include other components rather than excluding other components, unless specifically stated to the contrary.

In addition, the terms “…unit”, “…unit”, and “…module” used in the specification refer to a unit that processes at least one function or operation, which may be implemented as hardware, software, or a combination of hardware and software. there is.

With reference to the drawings, a digital financial security service method and device according to an embodiment will be described.

FIG. 1 shows a connection relationship between a digital financial security server and its surrounding components according to an embodiment, and FIG. 2 is a block diagram showing the configuration of a digital financial security server according to an embodiment.

Referring to FIG. 1, the digital financial security server 100 may be connected to the financial application server 200 through an internal network (eg, Ethernet).

The digital financial security server 100 is connected to the router 400, the user terminal 500, and the user's IoT (Internet of Things) device 600 through the Internet network 300.

When the user terminal 500 accesses the financial application server 200 through a financial application, the digital financial security server 100 monitors the safety status of the router 400 connected to the user terminal 500. It provides a digital financial security service that diagnoses whether the user terminal 500 is exposed to hacking, and provides a history of connection attempts using the login information of the user terminal 500.

The financial application server 200 operates in conjunction with a financial application executed on the user terminal 500. The financial application server 200 may be a mobile banking server.

The router 400 may be a WiFi device.

The user terminal 500 is a phone terminal carried by a user, and may be used in terms such as smartphone, mobile phone, mobile terminal, etc.

The user terminal 500 installs and executes a financial application. The financial application may be a mobile banking application.

The IoT device 600 is a user device and may include a CAM, printer, CCTV, computer, etc. The user can access the financial application server 200 using the user terminal 500 to use financial services, and use additional services using the IoT device 600.

Referring to FIG. 2, the digital financial security server 100 includes an app connection detection unit 110, a terminal location confirmation unit 120, a router hacking diagnosis unit 130, and an IoT device security diagnosis unit 140 according to detailed functions. ), may include a login safety diagnosis unit 150.

The app connection detection unit 110 may receive connection information of the user terminal 500 from the financial application server 200. The connection information may include the IP address of the router to which the user terminal 500 is connected, connection records (terminal IP address, login information, etc.), and location information transmitted from the user terminal 500.

The terminal location confirmation unit 120 determines whether the location information of the user terminal 500 obtained from the app connection detection unit 110 and the location information searched in conjunction with the telecommunication company based on the phone number of the user terminal 500 match. You can. If there is a mismatch, a security threat notification may be transmitted to the user terminal 500 through the financial application server 200.

The router hacking diagnosis unit 130 checks whether the router IP address obtained from the app connection detection unit 110 is a malicious IP address, and determines whether the location information confirmed by the router IP address matches the location information of the user terminal 500. , Router hacking diagnosis information according to the judgment result can be transmitted to the user terminal 500 through the financial application server 200. At this time, the router hacking diagnosis information may include a normal notification or a security threat notification.

At this time, since the technology for confirming location information using an IP address can use various known technologies, a detailed description will be omitted.

The IoT device security diagnosis unit 140 checks whether the IP address of the IoT device 600 obtained from the app connection detection unit 110 is a malicious IP address, and the location information confirmed by the IP address is the location information of the user terminal 500. It is determined whether it matches, and IoT device diagnosis information according to the determination result can be transmitted to the user terminal 500 through the financial application server 200. At this time, the IoT device diagnosis information may include a normal notification or a security threat notification. At this time, location information can be confirmed using the IP address of the IoT device, assuming that it is connected through a wired network.

The login safety diagnosis unit 150 receives the login connection record of the user terminal 500 from the app connection detection unit 110, diagnoses whether the login is normal based on the login connection record, and reports the results to the financial application server 200. ) can be transmitted to the user terminal 500. At this time, the login safety diagnosis information may include a normal notification or a security threat notification.

Additionally, in this specification, the match comparison of location information may be a match comparison within a certain range of a critical distance.

FIG. 3 is a flowchart showing a terminal location confirmation operation according to an embodiment, and the operation of the terminal location confirmation unit 120 in FIG. 2 is explained.

Referring to FIG. 3, the terminal location confirmation unit 120 receives access information of the financial application executed on the user terminal 500 from the financial application server 200 (S101).

The terminal location confirmation unit 120 obtains location information transmitted from the financial application of the user terminal 500 through S101 (S102).

The terminal location confirmation unit 120 searches for the user's location using the mobile phone number of the financial application user registered in the financial application server 200 (S103).

The terminal location confirmation unit 120 performs terminal location authentication to determine whether the location information obtained in S102 matches the location information searched in S103 (S104).

At this time, if the terminal location authentication fails due to a mismatch in the terminal location, the terminal location confirmation unit 120 may link with the financial application server 200 to transmit information indicating a suspected financial abnormal transaction to the financial application screen.

FIG. 4 is a flowchart showing a router hacking diagnosis operation according to an embodiment, and the operation of the router hacking diagnosis unit 130 in FIG. 2 is explained.

Referring to FIG. 4, the router hacking diagnosis unit 130 checks the IP address of the router to which the user terminal 500 is connected (S201).

The router hacking diagnosis unit 130 determines whether the router IP address confirmed in S201 is a blacklist registered IP address (S202).

If it is determined in S202 that the IP address is not blacklisted, the router hacking diagnosis unit 130 searches for location information using the router IP address (S203).

The router hacking diagnosis unit 130 determines that the location information searched in S203 is the location information of the user terminal 500 confirmed through FIG. 3, that is, the location information received from the user terminal 500, and the location searched by the user's mobile phone number. Determine whether it matches the information (S204).

At this time, if they match, the router hacking diagnosis unit 130 ends the step.

On the other hand, if there is a mismatch, the router hacking diagnosis unit 130 outputs a router hacking diagnosis notification to the user terminal 500 (S206). At this time, even if it is a blacklisted IP address in S202, the router hacking diagnosis unit 130 outputs a router hacking diagnosis notification to the user terminal 500 (S206).

FIG. 5 is a flowchart showing an IoT (Internet of Things) device security diagnosis operation according to an embodiment, and the operation of the IoT device security diagnosis unit 140 in FIG. 2 is explained.

Referring to FIG. 6, the IoT device security diagnosis unit 140 receives user IoT device connection information (IP address) from the financial application server 200 (S301).

The IoT device security diagnosis unit 140 determines whether the IP address of the IoT device 600 is a blacklist registered IP address (S302).

The IoT device security diagnosis unit 140 searches for location information using the IP address of the IoT device 600 (S303).

The IoT device security diagnosis unit 140 determines whether the location information of the user terminal 500 and the location information of the IoT device 600 match (S304).

If the IoT device security diagnosis unit 140 determines a match, the step ends.

If it is determined that there is a mismatch, the IoT device security diagnosis unit 140 outputs an IoT device hacking diagnosis notification to the user terminal 500 (S306).

FIG. 6 is a flowchart showing a login safety diagnosis operation according to an embodiment, and the operation of the login safety diagnosis unit 150 in FIG. 2 is explained.

Referring to FIG. 6, the login safety diagnosis unit 150 receives login connection information (router IP information) of the user terminal 600 from the financial application server 200 (S401).

The login safety diagnosis unit 150 checks whether the router IP address and the location identified by the router IP address exist in the past login connection history (S402).

The login safety diagnosis unit 150 determines whether it exists in the past history at S402 (S403), and if not, checks the router hacking diagnosis information (S404).

The login safety diagnosis unit 150 determines whether the risk of hacking the router is high (S405), and if the risk of hacking the router is high, outputs a connection environment inspection notification to the user terminal 500 (S406).

If the login safety diagnosis unit 150 determines that the risk of hacking the router is not high in S405, it outputs a notification of a normal connection environment to the user terminal 500 (S407).

The login safety diagnosis unit 150 inquires from the user terminal 500 whether to register a frequently accessed environment (S408), and when a registration request is received (S409), the login connection history is recorded using the router IP address and the location confirmed by the router IP address. Add to (S408).

Figure 7 is an example diagram of a digital safe security service menu screen according to an embodiment, and Figure 8 is an example view of a digital safe security service screen according to an embodiment.

Referring to FIG. 7 , the financial application server 200 may provide a digital safe security service menu screen to the user terminal 500.

The digital safe security service menu (P11) may be displayed in the authentication/security item (P10) of the financial application. When the user clicks on the digital safe and secure service menu (P11), the financial application server 200 may provide the digital safe and secure service screen (P20) as shown in FIG. 8 to the user terminal 500.

Referring to Figure 8, the digital safe security service screen (P20) includes a subscription item and a cancellation item. When the subscription item is clicked, the financial application server 200 processes subscription to the digital safe security service in conjunction with the digital financial security server 100 and outputs a subscription completion screen (P30).

Figure 9 is an example diagram of a router diagnosis screen according to one embodiment.

Referring to FIG. 9, the digital financial security server 100 may provide a router diagnosis guidance notification on the financial application screen (P40) of the user terminal 500 in conjunction with the financial application server 200. When the user clicks on the “View Details” item, the digital financial security server 100 may transmit a screen (P50) displaying router hacking diagnosis information according to the operation of the router hacking diagnosis unit 130 to the user terminal 500. .

When the user clicks the “Close” item on the financial application screen (P40), the financial application server 200 provides a password input screen (P60) to proceed with the banking service.

10 is an exemplary diagram of a manual inspection menu screen according to an embodiment.

Referring to FIG. 10, when the manual inspection menu is clicked on the financial application screen (P70), the financial application server 200 transmits the manual inspection menu screen (P80) to the user terminal 500. At this time, when the check item is clicked, the financial application server 200 may request a diagnosis from the digital financial security server 100. Here, the diagnosis request may include a terminal location confirmation request, a router hacking diagnosis request, an IoT device hacking diagnosis request, and a login diagnosis request.

Figure 11 is an example diagram of an inspection completion page according to one embodiment.

Referring to FIG. 11, a maintenance completion page including the results of the diagnosis of FIG. 10 is shown. The maintenance completion page may display “normal diagnosis” information (P91) or “inspection required” information (P92). At this time, when Check Details is clicked on the screen where the “Inspection Required” information is displayed, the digital financial security server 100 sends at least one diagnostic information among terminal location confirmation, router hacking diagnosis, IoT device hacking diagnosis, and login diagnosis to the user terminal. It can be sent to (500).

Meanwhile, FIG. 12 is a block diagram showing the hardware configuration of a digital financial security server according to an embodiment, and shows the hardware configuration of a computing device that implements the operation of the digital financial security server described in FIGS. 1 to 11.

Referring to FIG. 12 , the computing device 700 includes a processor 710, a memory 720, a storage 730, and a communication device 740, and these components are connected to each other through a bus 750.

The communication device 740 is connected to at least one processor 710 and transmits and/or receives data. The memory 720 is connected to at least one processor 710 and stores a program including instructions for executing the configuration and/or method according to the embodiments described in FIGS. 1 to 11. The program implements the present invention in combination with hardware such as memory 720 and at least one processor 710. The storage 730 includes information necessary for operating the computing device 700. The processor 710 executes the present invention in combination with hardware such as memory 720 and storage 730.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements made by those skilled in the art using the basic concept of the present invention defined in the following claims are also possible. It falls within the scope of rights.

Claims (15)

A method of operating a digital financial security server operated by at least one processor, comprising:
Checking access information of the financial application executed on the user terminal from the financial application server,
Confirming the IP address of the router connected to the user terminal from the connection information,
Determining whether the IP address of the router is a malicious IP address and generating diagnostic information on the router's safety status based on the determination, and
Transmitting the router safety status diagnosis information to the user terminal
Method, including. In paragraph 1:
The generating step is,
A step of determining whether the IP address of the router is a malicious IP address registered in the blacklist, and
If it is determined that the IP address is malicious, generating the safety status diagnosis information including a router status check notification.
Method, including. In paragraph 2,
After the above judgment step,
If the IP address is not malicious, checking the location information of the router from the IP address of the router, and
Comparing the location information of the router with the location information of the user terminal and if there is a discrepancy, generating the safety status diagnosis information including a router status inspection notification.
A method further comprising: In paragraph 1:
The router,
A method including a WiFi AP (Access Point). In paragraph 1:
After the above confirmation step,
Receiving IoT device connection information of the user terminal from the financial application server,
Determining at least one of whether the IP address of the IoT device is a malicious IP address or whether location information confirmed by the IP address of the IoT device matches location information of the user terminal,
If it is determined to be a malicious IP address or a mismatch in location information, generating IoT device safety status diagnosis information including an IoT device status check notification, and
Transmitting the IoT device safety status diagnosis information to the user terminal
A method further comprising: In paragraph 1:
After the transmitting step,
Receiving login access information of the user terminal from the financial application server,
Checking whether the router IP address confirmed from the login connection information and the location confirmed by the router IP address exist in the past login connection history,
If it does not exist in the past login connection history, checking the router hacking diagnosis information to determine whether the risk of hacking is high;
If the hacking risk is high, transmitting a connection environment inspection notification to the user terminal.
A method further comprising: In paragraph 6:
After the step of determining whether the risk of hacking is high,
If it is determined that the risk of hacking is not high, sending a notification of normal connection environment to the user terminal.
A method further comprising: In paragraph 7:
After transmitting the connection environment normal notification to the user terminal,
Requesting the user terminal to register as a frequently accessed environment, and
When a registration request is received from the user terminal, additionally registering the router IP address and the location confirmed by the router IP address in the login connection history.
A method further comprising: A digital financial security server operated by at least one processor, comprising:
An app connection detection unit that receives access information of the financial application executed on the user terminal from the financial application server, and
When access to the financial application is confirmed by the app connection detection unit, the IP address of the router connected to the user terminal is checked from the connection information to determine whether the IP address of the router is a malicious IP address, and the router's security status according to the determination. Router hacking diagnostic unit that transmits diagnostic information to the user terminal
Including, a digital financial security server. In paragraph 9:
The router hacking diagnosis unit,
A digital financial security server that transmits the safety status diagnosis information including a router status check notification when the IP address of the router is determined to be a malicious IP address registered in the blacklist. In paragraph 10:
The router hacking diagnosis unit,
If the IP address is not malicious, the location information of the router is checked from the IP address of the router, and the location information of the router is compared with the location information of the user terminal. If there is a discrepancy, the safety status diagnosis includes a router status check notification. A digital financial security server that transmits information. In paragraph 9:
An IoT device that obtains the IoT device connection information of the user terminal from the financial application server, diagnoses the IoT device safety status based on the IoT device connection information, and transmits an IoT device status check notification or IoT device status normal notification to the user terminal. Device security diagnostic section
Further comprising a digital financial security server. In paragraph 12:
The IoT device security diagnosis unit,
By determining at least one of whether the IP address of the IoT device is a malicious IP address or whether the location information confirmed by the IP address of the IoT device matches the location information of the user terminal, the IP address is determined to be a malicious IP address or location information If a discrepancy is determined, a digital financial security server sends an IoT device health check notification. In paragraph 9:
A login safety diagnosis unit that obtains the login connection information of the user terminal from the financial application server, diagnoses the connection environment status based on the login connection information, and transmits a normal connection environment notification or a connection environment inspection notification to the user terminal.
Further comprising a digital financial security server. In paragraph 14:
The login safety diagnosis section,
Check whether the router IP address confirmed from the login connection information and the location confirmed by the router IP address exist in the past login connection history. If not in the past login connection history, check the router hacking diagnosis information to determine whether the risk of hacking is high. A digital financial security server that determines that the risk of hacking is high and transmits a connection environment inspection notification to the user terminal.