WO2022186681A1

WO2022186681A1 - Terminal, card device, and method for generating card data-based virtual security code by using nfc

Info

Publication number: WO2022186681A1
Application number: PCT/KR2022/095022
Authority: WO
Inventors: 유창훈
Original assignee: 주식회사 센스톤
Priority date: 2021-03-04
Filing date: 2022-02-07
Publication date: 2022-09-09
Also published as: KR20230030606A

Abstract

The present invention relates to a terminal, a card device, and a method for generating a device for generating a card data-based virtual security code by using NFC. According to the present invention, a virtual security code required for user authentication can be generated by using card data obtained on the basis of an NFC scheme even without a separate OTP device. In addition, according to the present invention, multiple pieces of tag information are stored in an NDEF form in a smart card including card data, so that NFC data, which is card data, can be obtained without being limited by the type of user terminal, and accordingly, an OTP can be generated without being limited by the type of operating system S of a user terminal.

Description

Terminal, card device and method for generating virtual security code based on card data using NFC

The present invention relates to a terminal, a card device and a method for generating a virtual security code based on card data using NFC.

More specifically, it relates to an apparatus and method for generating a virtual security code based on card data and time data obtained using an NFC tag.

Coded data is used in many areas. In addition to the card number and account number used for payment, the IPIN number and resident registration number for user identification are code-type data.

However, many leaks occur in the process of using such code data. In the case of the card number, the actual card number is written on the surface of the card as it is, so it is visually leaked to others, and the card number is leaked as it is delivered to the POS device when making a payment using a magnet.

There have been many attempts to use the virtual code to prevent the actual code from being leaked, but data for identifying the user is required to search for the actual code corresponding to the virtual code.

However, in the case of OTP (One Time Password), a separate OTP generating device is required, which is inconvenient, and in particular, in the case of a user terminal, there is a security vulnerability due to leakage of seed data used for OTP generation.

Therefore, OTP code is generated like generating a virtual security code required for user authentication based on the card data of the card possessed by many users. We need a way to increase security. However, an appropriate method for this has not yet been proposed.

The present invention for solving the above-described problems can provide a terminal, a card device, and a method for generating a virtual security code based on card data using NFC.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

A method for generating a virtual security code based on card data using NFC according to the present invention for solving the above-mentioned problems, the method comprising: obtaining, by a user terminal, seed data necessary for generating a virtual security code from a smart card; generating, by the user terminal, a virtual security code based on the seed data and time data; and transmitting the virtual security code to a server to request user authentication.

In this case, the smart card includes a plurality of tag information, and the plurality of tag information is stored separately in a plurality of storage areas allocated for each type of tag information in the smart card, and the acquiring step includes: identifying at least one type of tag information related to the virtual security code from among the types of tag information; identifying at least one storage area corresponding to the identified tag information type among the plurality of storage areas; and reading tag information stored in the identified storage area from among the plurality of tag information and obtaining the seed data as the seed data.

On the other hand, the plurality of tag information is stored separately in the plurality of storage areas in the format of NDEF (NFC Data Exchange Format), and the seed data is, when the smart card is tagged in the user terminal, NFC method. can be obtained on the basis of

In addition, the plurality of tag information is stored separately in the plurality of storage areas by matching with use order information of each tag information of the user terminal set according to the type of the tag information, or the plurality of pieces of tag information are stored in a text format. It may be stored separately in the storage area.

In addition, the identified tag information type includes a financial transaction type requested by the user terminal, and the seed data is stored in at least one storage area corresponding to the financial transaction type requested by the user terminal from among the plurality of storage areas. It can be obtained from stored tag information.

In addition, the method for generating a virtual security code based on card data using NFC according to the present invention comprises the steps of: generating, by the user terminal, the virtual security code based on the obtained seed data and transmitting the virtual security code to a server; and verifying the virtual security code from the server, wherein the server may verify the virtual security code by comparing time data of the virtual security code with time data at which the virtual security code is received have.

At this time, the server extracts the user identification information by searching for a storage location of the user identification information based on the virtual security code, and performs user authentication based on the extracted user identification information, and the virtual security code is , a plurality of detailed codes, wherein the plurality of detailed codes include: a first code for setting a starting point of a search for a storage location of the user identification information; and a second code for setting a search path from the starting point to a storage location of the user identification information according to a specific search method.

In addition, the smart card stores first tag information including execution data of a program for generating the virtual security code in a first storage area among the plurality of storage areas, and stores second tag information including the seed data It may be stored in a second storage area among the plurality of storage areas.

A card device for generating a virtual security code based on card data using NFC according to the present invention for solving the above problems includes: an IC chip having a plurality of storage areas allocated to each type of tag information; and a communication unit for performing NFC-based communication with the user terminal during tagging, wherein a plurality of tag information including seed data required for generating a virtual security code in the user terminal is separated in the plurality of storage areas, each It is stored, and the seed data is characterized in that it is provided to the user terminal through the NFC-based communication when tagging with the user terminal.

Also, the virtual security code may be generated by the user terminal based on the seed data and time data and transmitted to the server for user authentication.

In addition, in the seed data, at least one tag information type related to the virtual security code is identified by the user terminal among types of the tag information, and at least one corresponding to the identified tag information type among the plurality of storage areas. One storage area may be identified, and tag information stored in the identified storage area may be read and obtained from among the plurality of tag information.

A terminal for generating a virtual security code based on card data using NFC according to the present invention for solving the above-mentioned problems, NFC-based communication at the time of tagging with a smart card that provides seed data necessary for generating a virtual security code communication unit to perform; and a control unit that obtains the seed data through the communication unit, generates the virtual security code based on the seed data and time data, and transmits the virtual security code to a server to request user authentication. do it with

In addition, a plurality of tag information is stored separately in a plurality of storage areas each allocated for each type of tag information in the smart card, and the controller includes at least one of the types of tag information related to the virtual security code. Identifies a tag information type, identifies at least one storage area corresponding to the identified tag information type from among the plurality of storage areas, reads tag information stored in the identified storage area from among the plurality of tag information, and It can be obtained as seed data.

According to the present invention as described above, the user can generate a virtual security code required for user authentication with card data obtained based on the NFC method without a separate OTP device.

In this case, since a plurality of tag information is stored in the smart card including card data in the form of NDEF, it is possible to obtain NFC data, which is card data, without being limited by the type of the user terminal. Through this, OTP generation is possible without being limited by the type of OS of the user terminal of the present invention.

On the other hand, since the plurality of tag information matches the use order information in the user terminal set according to the type of tag information, the user terminal can read appropriate tag information corresponding to a command, process, etc. performed through communication with the server. .

In addition, according to the present invention, since an algorithm for generating a virtual security code and searching for a user identification information storage space is added, the existing process can be maintained as it is. For example, if an application that provides financial transaction services generates and provides a virtual security code that is not duplicated, the POS device and PG company server are maintained as they are, and the virtual security code is delivered to the server, and the server sends the virtual security code to the virtual security code. The payment may be performed by searching the storage area of the corresponding user identification information. Through this, it is possible to minimize the part that needs to be changed in the existing process to increase security, and the user does not need to perform a separate step for improving security.

Effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a block diagram of a system for generating a virtual security code based on card data according to an embodiment of the present invention.

2 is a schematic configuration diagram of a smart card according to an embodiment of the present invention.

3 is an exemplary diagram of tag information stored in an NDEF format according to an embodiment of the present invention.

4 is a diagram illustrating a type 4 tag NDEF structure.

5 is a diagram illustrating an example of a type 4 NDEF file for a text RTD (Record Type Definition).

6 is a block diagram of a user terminal according to an embodiment of the present invention.

7 is a schematic flowchart of a method for generating a virtual security code based on card data using NFC according to an embodiment of the present invention.

8 is a schematic flowchart of a method for obtaining seed data according to an embodiment of the present invention.

9 is a schematic flowchart of a method of verifying a virtual security code according to an embodiment of the present invention.

10 is a schematic flowchart of a method for authenticating a user based on a virtual security code according to an embodiment of the present invention.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only these embodiments allow the disclosure of the present invention to be complete, and those of ordinary skill in the art to which the present invention pertains. It is provided to fully inform those skilled in the art of the scope of the present invention, and the present invention is only defined by the scope of the claims.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural, unless specifically stated otherwise in the phrase. As used herein, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other components in addition to the stated components. Like reference numerals refer to like elements throughout, and "and/or" includes each and every combination of one or more of the recited elements. Although "first", "second", etc. are used to describe various elements, these elements are not limited by these terms, of course. These terms are only used to distinguish one component from another. Therefore, it goes without saying that the first component mentioned below may be the second component within the spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used herein will have the meaning commonly understood by those of ordinary skill in the art to which this invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless clearly specifically defined.

In the present specification, "character" is a component constituting a code, and includes all or part of uppercase alphabets, lowercase alphabets, numbers, and special characters.

In this specification, "code" means a character string in which characters are listed.

In the present specification, the "virtual security code" is a random code (eg, One Time Password (OTP)) that is temporarily generated for user authentication and is changed every unit time, and may include a code of a specific number of characters. The virtual security code may be used to retrieve the user's identification information stored in the server according to an embodiment of the present invention.

In addition, the "virtual security code" is additionally 2 after the primary authentication of the user is performed through the authentication virtual code (OTAC: One Time Authentication Code) temporarily generated for the user authentication and the authentication virtual code It may include a random code (eg, One Time Password (OTP)) used for car authentication.

As used herein, a “smart card” refers to a card that provides data for generating a virtual security code. In addition, it is an arbitrary card that conducts financial transactions, such as a credit card, a check card, and a cash card, and there is no limitation on the type and purpose of the card.

As used herein, a “user terminal” is any electronic device having an application processor (AP) capable of running an application. The user terminal is a non-portable desktop computer or a portable mobile device (eg, a smart phone, a tablet PC, a personal digital assistant (PDA), an enterprise digital assistant (EDA), a portable multimedia (PMP) player), personal navigation device (PND), wearable device, etc., but is not limited thereto.

In this specification, "virtual security code generation function" refers to a function that generates a virtual security code. Examples include, but are not limited to, One Time Password (OTP).

In the present specification, the "detail code generation function" refers to a function that generates each detailed code constituting the virtual security code.

In the present specification, the "detail code combination function" refers to a function that generates a virtual security code by combining or combining a plurality of detailed codes.

In the present specification, "UID (user identification)" refers to a value in the form of a unique code that is not duplicated for each user to identify a user.

In the present specification, "unit count" is a unit defined as being set at a specific time interval and changing as the time interval elapses. For example, 1 count may be set to a specific time interval (eg, 1.5 seconds) and used.

Referring to FIG. 1 , the card data-based virtual security code generation system includes a smart card 100 , a user terminal 200 , and a server 300 .

According to an embodiment of the present invention, the user terminal 200 generates a virtual security code for user authentication based on card data received and obtained from the smart card 100 .

More specifically, a program or application in the user terminal 200 generates a virtual security code based on the seed data and time data obtained from the smart card 100 . To this end, the program or application may include an OTP function.

The seed data of the smart card 100 may include user information of the corresponding smart card 100 . That is, when a program or application of the user terminal 200 is executed, the smart card 100 may be manufactured based on user identification information [UID (User ID)] input and set by the user.

More specifically, when a program or application through the user terminal 200 is executed, input from the user or when user identification information is set based on the user's log-in information, based on the user identification information The smart card 100 is manufactured. Consequently, each smart card 100 includes user identification information corresponding to each user.

However, the user identification information of the present invention is not limited thereto, and specific unique information set as a default when the smart card 100 is manufactured, which is not set by the user, such as the serial number of the smart card 100, is provided for a specific user. It may be set or used as user information by matching. In addition, the user identification information may include personal information such as a resident registration number, a bank account number, and a credit card number, as well as a UID.

Meanwhile, the user terminal 200 generates a virtual security code based on the seed data obtained from the smart card 100 . In this case, as described above, the virtual security code may be generated by an OTP (One Tim Password) function. In this case, the virtual security code is generated at the time of requesting to generate the seed data and the virtual security code or at the time of acquiring the seed data. It is created based on time data.

Specifically, the virtual security code is generated by a virtual security code generation function provided in the user terminal 200, and in particular, the virtual security code may include at least one or a plurality of detailed codes, which will be described in detail later. do.

Meanwhile, the server 300 performs user authentication based on the virtual security code received from the user terminal 200 . In this case, the server 300 may be a financial company server that communicates with the user terminal 200 , but is not limited thereto. Also, referring to FIG. 1 , the server 300 is shown as being configured as one server, but a plurality of servers may be configured in a system form linked to each other.

Meanwhile, according to an embodiment of the present invention, the server 300 may further perform a process of verifying whether the received virtual security code is normally generated or used repeatedly.

Hereinafter, a method and apparatus for generating a virtual security code based on card data using NFC as an embodiment of the present invention will be described with reference to FIGS. 2 to 10 .

First, referring to FIG. 2 , the smart card 100 includes a communication unit 110 , an IC chip 120 , an applet 130 , and a process 140 .

The communication unit 110 transmits card data to the user terminal. In more detail, although not clearly shown in the drawings, the communication unit 110 includes a Narrow Frequency Communication (NFC) module (not shown).

When the smart card 100 and the user terminal 200 are tagged with each other, the processor 140 of the smart card 100 transmits the card data stored in the IC chip 120 to the user terminal through the communication unit 110 . Send to (200).

On the other hand, the IC chip 120 is mounted in the PCB board to contact the terminal of the IC type card reader to perform data exchange. The IC chip 120 includes any form, such as a component including an integrated circuit (IC), a system on chip (SoC), or the like. For example, the IC chip may be an ISO 14443 NXP Mifare Classic type according to the present invention, but is not limited thereto.

In addition, although not shown in the drawings, a memory (not shown) for storing card data of the smart card 100 is included. As described above, the card data includes user identification information and card identification information of a user who applied for issuance of a corresponding smart card.

In addition to user identification information, the IC chip 120 may store a URL address of a card company or a financial company that issues and manages the smart card 100 . For example, when the URL address of a specific financial company is stored in the IC chip 120 of the smart card 100, when the smart card 100 is tagged in the user terminal, the user terminal can obtain the URL address. . In this case, the URL address may relate to installation information or execution information of a program or application of the financial company.

That is, various information is stored in the IC chip 120 in addition to user identification information. When the smart card 100 is tagged to the user terminal 200 , the user terminal 200 receives the corresponding information from the smart card 100 .

Hereinafter, each piece of information stored in the IC chip is referred to as tag information to help the understanding of the present invention.

The applet 130 stores and manages a plurality of tag information in the smart card 100 .

In this case, according to an embodiment of the present invention, the applet 130 of the smart card 100 may separately store a plurality of pieces of tag information in a plurality of storage areas in the memory based on the NFC Data Exchange Format (NDEF). That is, the plurality of tag information is stored in the smart card 100 in a standardized NDEF format so that the smart card 100 and the user terminal 200 can exchange information with each other through NFC.

At this time, in an embodiment of the present invention, as a method of storing the plurality of tag information in the smart card 100, an empty storage area (Sector) is searched for in the memory (not shown) of the smart card 100, and the A plurality of storage areas are allocated for each type of tag information in the searched empty storage area, and the plurality of tag information is separated in the allocated plurality of storage areas and stored using MAD (Mifare Application Directory) and NDEF Message TLV. can Through this, the plurality of tag information is stored in a text format in a message or text format in each of the storage areas (Record).

Meanwhile, referring to FIG. 3 , the NDEF is a binary format composed of a message that can include multiple tag information, and the tag information is stored in each record 501 , wherein the tag information includes a header 502 and a payload. (Payload) 503 . The header 502 includes indicators for various elements related to tag information. For example, the type of payload that is the tag information content, the length of the payload, etc. correspond to this. The payload 503 is the content of tag information, and includes the aforementioned URL, MIME media, or NFC data. Through this, the present invention enables NFC data exchange between the smart card and the user terminal without being limited by the type of the operating system (OS) of the user terminal.

Meanwhile, according to an embodiment of the present invention, the applet 130 identifies each tag information type of the plurality of tag information, and stores the plurality of tag information for each identified tag information type in the plurality of storage areas. Each is stored separately in the storage area.

That is, each type of tag information to be stored is allocated in advance to each of the plurality of storage areas. For example, the tag information includes first URL information regarding installation of an application (or program) for generating a virtual security code and virtual security information. Second URL information regarding the execution of an application (or program) for code generation and seed data used for generating a virtual security code may be included.

In this case, the smart card 100 may store the first URL information, the second URL information, and the seed data in corresponding storage areas among the plurality of storage areas, respectively. Meanwhile, the plurality of storage areas may match not only the type of tag information but also the order information in which each tag information is used in the user terminal 200 .

In an embodiment of the present invention, after searching for a record in which data is not stored among a plurality of records, the applet 130 may store the seed data in the corresponding record. More specifically, the applet 130 includes data (eg, URL information for running the application or program) that can execute an application (or program) for generating a virtual security code in the user terminal 100 . One tag information may be stored in the first record area, and second tag information including seed data may be stored in the second record area.

Meanwhile, according to an embodiment of the present invention, corresponding tag information among the plurality of tag information is stored in the plurality of storage areas, respectively, and the use order information of the user terminal 200 for the corresponding tag information is stored with the stored tag information Each may be matched and stored.

In addition, the smart card 100 according to the present invention may be in the form of a combination card including a plurality of first IC chips 121 and second IC chips 122 . In this case, the first IC chip 121 may be a credit card international standard EMV chip, and the second IC chip 122 may be a Mifare classic type NFC chip.

The first IC chip may be used for payment through card insertion, and the second IC chip may be used for contactless payment or data transfer to the user terminal 200 through an NFC antenna.

For example, the second IC chip may store seed data necessary for generating a virtual security code in the user terminal 200 . Hereinafter, a method in which the smart card 100 stores stored data such as seed data for generating a virtual security code to be transmitted through contactless communication (NFC communication) will be described in detail.

In addition, according to an embodiment of the present invention, storage data such as seed data for generating a virtual security code may be stored in a format of NFC Data Exchange Format (NDEF). The type of operating system (OS) of the user terminal (eg, Google's Android, Apple's iOS, Symbian's Symbian platform, BlackBerry's BlackBerry OS, Microsoft's Windows Phone, Qualcomm's BREW, Samsung Electronics' In order to deliver stored data to a user terminal through NFC regardless of Tizen, Kai OS, etc.), it is necessary to use the NDEF standard format.

As an embodiment of a method of storing data transmitted to the user terminal 200 of the present invention in the smart card 100, the applet 130 of the smart card 100 converts the plurality of tag information to NDEF (NFC Data Exchange). Format), it can be stored separately in each storage area of the meta applet in the EMV-type first IC chip 121 . That is, the plurality of tag information may be stored in the EMV type first IC chip 121 in a standardized NDEF format so that information can be exchanged through the tags of the smart card 100 and the user terminal 200 .

As another embodiment of a method of storing data transmitted to the user terminal 200 in the smart card 100 of the present invention, after checking an empty storage area (Sector) in the second IC chip 122, the checked While each of a plurality of pieces of tag information is stored in the empty storage area, the stored format may be set as the NDEF format using the MAD (Mifare Application Directory) storage area (Sector 0) and the NDEF Message TLV.

Through this, the plurality of tag information may be stored in a text format in the empty storage area in a message or text format. For example, for postpaid transportation cards in Korea, the seed data transmitted to the user terminal in the NDEF format is stored in the sector where data is not stored other than the sector stored in the credit card or check card, and transmitted to Sector 0. It is possible to save the descriptive information about the sector in which the data for use is stored.

In addition, as another embodiment of a method of storing data transmitted to the user terminal 200 in the smart card 100 of the present invention, when the second IC chip is an NFC Type 4 Tag, the second IC chip is included. The second IC chip necessary for generating a virtual security code in the additional storage space being used may store seed data and the like.

For example, since the second IC chip, which is an NFC Type 4 Tag, has a memory that can be utilized up to 32 Kbytes per service, the second IC chip required for generating a virtual security code can store seed data and the like in the corresponding storage space. For example, when the second IC chip 122 in which tag information is stored in the NDEF format according to an embodiment of the present invention is ISO 14443 NXP Mifare "Classic", the Mifare classic type of the second IC chip 122 is It may be type 4, and in the case of type 4, it may have an object-oriented memory format using files rather than blocks for data storage.

Hereinafter, a process of storing tag information in the NDEF format in the second IC chip 122 of the Mifare classic type 4 will be described in detail with reference to FIGS. 4 and 5 .

4 is a diagram illustrating a type 4 tag NDEF structure.

4 and 5 , in order to read tag information in the NDEF format from Type 4, a series of selection and reading must be performed in order to correctly access the tag information. First, you need to select the NDEF application represented by the application ID of 0xD2760000850101. Second, the NDEF application must have a function container file with file ID 0xE103.

Here, to read the contents of the CC, the first two bytes are first read to determine the length of the CC, and then the rest of the CC is read, the CC contains the file ID information for the NDEF data, and all NDEF data from the tag should be used to read the correct file id to read . The CC may also include a TLV field for each stored NDEF message. At this time, since there may be multiple NDEF files in a single tag, information about each individual NDEF file should be stored in CC.

Referring to FIG. 6 , the user terminal 200 includes a communication unit 210 , a virtual security code generation unit 220 , a detailed code generation unit 230 , and a control unit 230 .

Referring to FIG. 7 , first, the user terminal 200 receives and obtains seed data for generating a virtual security code from the smart card 100 through the communication unit 210 ( S410 ).

Specifically, the communication unit 210 of the user terminal 200 receives the seed data from the smart card 100, as a wireless communication method, NFC (Near Field Communication), Bluetooth (Bluetooth), BLE (Bluetooth Low Energy), Beacon, Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wideband (UWB), ZigBee, etc. may be used.

Preferably, when the smart card 100 is tagged to the user terminal 200 , the communication unit 210 may receive the seed data through NFC communication.

Meanwhile, referring to FIG. 8 , according to an embodiment of the present invention, step S410 includes identifying types of tag information stored in the plurality of storage areas ( S411 ), and seed data for generating a virtual security code among a plurality of tag information. and reading ( S412 ).

In detail, the user terminal 200 identifies at least one type of tag information related to the virtual security code among the types of the tag information, and selects at least one type of tag information corresponding to the identified type of tag information from among the plurality of storage areas. A storage area may be identified, and tag information stored in the identified storage area may be read out of the plurality of pieces of tag information to obtain the seed data.

In more detail, the control unit 240 of the user terminal 200 identifies the type of each tag information among a plurality of tag information received from the smart card 100 . As described above, the plurality of tag information in the NDEF format includes not only seed data but also various information related to installation and execution of a program for generating a virtual security code.

Accordingly, after identifying the types of the plurality of tag information, the controller 240 reads the tag information of the seed data type required to generate the virtual security code. For this, payload type information stored in the header of tag information may be used.

Meanwhile, according to an embodiment of the present invention, the type of tag information may be set according to a financial transaction type requested by the user terminal. In this case, in step S410, a financial transaction type requested by the user terminal may be identified, and tag information of a tag information type corresponding to the financial transaction type may be read.

That is, the type of tag information may be set according to the type of financial transaction performed by the user terminal 200 or requested by the server 300 . For example, if it is assumed that a transaction type requiring user authentication during a financial transaction is a first type, seed data used for user authentication among a plurality of tag information is set as a tag information type corresponding to the first type.

After identifying the user's financial transaction type being performed in the virtual security code generation program, the control unit 240 reads only tag information matching the corresponding financial transaction type, and it is possible to extract appropriate tag information corresponding to each process .

On the other hand, when NFC is tagged with the smart card 100 for the generation of the virtual security code according to the present invention, the control unit 240 may read the seed data from the smart card 100 and use it to generate a virtual security code. .

On the other hand, if the control unit 240 is tagged with the smart card 100 and the NFC communication method at a time other than the generation time of the virtual security code described above, the intention of the user who tagged the smart card 100 with the smart card 100 is Since the application (or program) associated with the smart card 100 is intended to be used rather than the generation of the virtual security code, data related to the execution of the application (or program) associated with the smart card 100 from the smart card 100 is retrieved. can be obtained

At this time, when a plurality of applications (or programs) associated with the smart card 100 are installed in the user terminal 200, the controller 240 controls the application (or the application having the highest preset priority among the plurality of applications (or programs)) or program) execution related data may be obtained from the smart card 100 . For example, the priority may include at least one of an application (or program) set as a default in the smart card 100 and a user's frequency of use.

In addition, even when execution-related data of the corresponding application (or program) is obtained from the smart card 100 , the control unit 240 blocks the corresponding application (or program) from being automatically executed based on the obtained execution-related data. Also, in this case, only when authentication through the user's password is successful, the corresponding application (or program) may be executed and outputted on the screen. In this case, the password is based on at least one of text information (a combination of one or more of Korean, English, numbers, special characters, and symbols) and user's biometric information (at least one of a fingerprint, iris, and face) set by the user. can be set by the user.

That is, the application (or program) has no purpose of use, but is accidentally tagged with the smart card 100 and NFC, or the application (or program) receives execution-related data from the smart card 100 due to external factors such as hacking. Even if obtained, the actual user's intention to use is confirmed through an additional user authentication process, and the corresponding application (or program) is executed only when the authentication is successful.

Meanwhile, referring to FIG. 7 , the user terminal 200 generates a virtual security code based on the seed data and time data obtained from the smart card ( S420 ).

Hereinafter, a specific method of generating a virtual security code according to an embodiment of the present invention will be described.

The detailed code generator 230 generates one or a plurality of detailed codes. The detailed code refers to some codes constituting the virtual security code. The virtual security code may consist only of the detailed code, or by combining one or more detailed codes with the first virtual security code generated by the OTP function, the final It may be formed in the form of a virtual security code (OTAC).

The user terminal 200 includes a virtual security code generation function that generates a virtual security code, and the virtual security code generation function generates a virtual security code by combining the detailed code generation function and the detailed code generation function for generating one or more detailed codes. Includes a subcode combining function that generates (ie, a rule for combining multiple subcodes).

That is, when the virtual security code includes a plurality of detailed codes, the virtual security code generating function generates a plurality of detailed codes using the plurality of detailed code generating functions, and the plurality of detailed codes through the detailed code combining function are combined in a preset combination to generate a virtual security code.

In an embodiment, the detailed code generation unit 230 may generate the virtual security code by a detailed code generation function based on seed data obtained as the smart card 100 is tagged.

There is a correlation between the plurality of detailed codes used by the server 300 to search for a storage space of user identification information.

That is, the server 300 includes a search algorithm (storage space search algorithm), the search algorithm extracts a plurality of detailed codes included in the virtual security code received from the user terminal 200, and the plurality of detailed codes Based on the correlation of , the storage space of user identification information [UID (User identification)] assigned to the user is searched.

As an embodiment of the correlation of the plurality of detailed codes, the search algorithm included in the server 300 determines the correlation between the plurality of detailed codes from a waypoint corresponding to one or more detailed codes among the plurality of detailed codes. Based on the calculation, the storage location of the user identification information may be searched. In this case, there may be one or a plurality of the waypoints, and the number and order are not limited.

In addition, as an embodiment of the plurality of detailed codes, the plurality of detailed codes may include a first code and a second code, and the detailed code generating unit 210 is a first function and a second function as a detailed code generating function. Including, the first code and the second code are generated.

The first code and the second code have a correlation for searching the storage space of the user identification information (UID) in the server 300, but the user terminal 200 generates the first code to increase security. The first function and the second function for generating the second code may be included as the detailed code generating function, and data on the correlation between the first code and the second code may not be included.

As a specific example of the correlation between the first code and the second code, the first code and the second code may perform respective roles for searching a storage space of user identification information (UID). That is, the first code may include information on the waypoint, and the second code may include information necessary for an operation that can reach the storage space of the user identification information from the waypoint.

Meanwhile, according to an embodiment of the present invention, the first code may be generated based on the first count, and the second code may be generated based on the second count.

In this case, the first count is the number of unit counts that have elapsed from the first time the virtual security code generation function is driven in the server 300 to the time when the virtual security code is generated, and the second count is the user's user identification information (UID) may include the number of unit counts that have elapsed from the time of registration with the server 300 or the time of registration with the server 300 through the user terminal 200 after the user's smart card 100 is issued.

That is, the first function generating the first code is a function providing a specific code value corresponding to the first count, and the second function generating the second code is a function providing a specific code value corresponding to the second count. to be.

Through this, it is possible to prevent duplicate generation of the same virtual security code regardless of the generation time and user of the virtual security code.

For example, the first code is any one code value [for example, when generation of a virtual security code is requested ( or a code value corresponding to the count)], and the user terminal 200 generates a first code having a different code value at each generation time of the virtual security code in the same user.

Also, even at the same time point, each user terminal 200 always has a different second count value, so that the user terminal 200 always generates a different second code at the same time point for each user.

That is, the first code has a different code value for each count, and the second code has a different code value for each app card application installed in the user terminal 200 of each user at the same time, as a result, the first code and the second code The virtual security code (OTAC) in which the two codes are combined is always output as a code value that is not the same or does not overlap regardless of the user and the time of request for generating the virtual security code.

Also, in another embodiment, the virtual security code generating function may generate the first N-digit code or the second code with M characters, and in this case, the virtual security code generating function is different M ^N The code includes a first function and a second function that respectively provide a first code or a second code that is sequentially changed for each unit count.

That is, the first function or the second function is a function that generates M ^N codes not to be duplicated as the count increases, and a specific one of M ^N codes is designated as the first code or the second code at a count corresponding to a specific time point. create Through this, the user terminal 200 does not repeatedly generate the same first code or second code within the M ^N counts (ie, the length of time corresponding to the MN counts), and a new detailed code (ie, the first code or second code) to generate a new virtual security code (OTAC) for each unit count.

Specifically, the virtual security code generation function generates the N-digit first code or the second code with M characters. When using the M ^N codes as the first code or the second code, the first code Alternatively, the second code is matched for each count from the initial time point at which the detailed code generation function is driven.

For example, when the unit count is set to 1 second, different M ^N codes are matched every second from the time when the detailed code generating function is first driven. And, the period of using a specific detailed code generation function or the period of use of a program or application for generating a virtual security code in the user terminal 200 is a time length corresponding to M ^N count (for example, when 1 count is 1 second) , M ^N seconds), the first code or the second code is not duplicated with the same code during the use cycle.

That is, when the count increases over time, when the user generates a virtual security code at a specific time point, the user terminal 200 sets the code value matched to the count corresponding to the specific time point as the first code or the second code. It can be created in code.

In addition, various methods may be applied as a method of generating one virtual security code (OTAC) by combining a plurality of detailed codes. As an example of the detailed code combining function, the detailed code combining function may generate a virtual security code by alternately arranging an N-digit first code and an N-digit second code. In addition, as another example, the detailed code combining function may generate a virtual security code by combining the second code after the first code. As the number of detailed codes included in the virtual security code increases, a corresponding virtual security code may also be generated in various ways without being duplicated.

The virtual security code generation unit 220 serves to generate a virtual security code by combining one or more detailed codes generated by the detailed code generation unit 230 .

Hereinafter, a method of verifying the virtual security code in the server 300 and authenticating the user based on the verified virtual security code will be described. 9 is a schematic flowchart of a method for verifying a virtual security code according to an embodiment of the present invention, and FIG. 10 is a schematic flowchart of a method for authenticating a user based on a virtual security code according to an embodiment of the present invention to be.

4 is a diagram illustrating a type 4 tag NDEF structure.

As an embodiment of the correlation of the plurality of detailed codes, the search algorithm included in the server 300 determines the correlation between the plurality of detailed codes from a waypoint corresponding to one or more detailed codes among the plurality of detailed codes. Based on the calculation, the storage location of the user identification information may be searched. In this case, there may be one or a plurality of the waypoints, and there is no limitation on the number and order.

4 is a diagram illustrating a type 4 tag NDEF structure.

Referring to FIG. 9 , in an embodiment of the present invention, the server 300 receives the virtual security code from the user terminal 200 ( S440 ) and time data and the virtual security code received and verifying the virtual security code by comparing time data of the security code (S450).

Specifically, it is verified whether the virtual security code transmitted from the server 300 through the user terminal 200 is normally generated. That is, after the server 300 receives the virtual security code, the received virtual security code is normally generated at the time of the financial transaction request based on information stored in the server 300 (ie, virtual security code generation function and seed data). Check whether the virtual security code is normal or not.

For example, the server 300 (eg, a financial institution server) uses the virtual security code generation function (ie, OTP function) to input a count within a specific range from the count of receiving the virtual security code, and a virtual among the calculated OTP numbers. Check whether there is a value that matches the security code. The server 300 applies the inverse function of the virtual security code generation function to the virtual security code to find a count corresponding to the time when the virtual security code is generated. As there is a difference between the time when the virtual security code is generated in the user terminal 200 and the time when the server 300 receives the virtual security code due to the transmission time or delay of the virtual security code, the server 300 generates the virtual security code Since the count of receiving , and the count of generating the OTP number corresponding to the virtual security code may not match, the server 300 allows an error range from the count of receiving the virtual security code.

Meanwhile, in the above-described card data-based virtual security code generation method as an embodiment of the present invention, the server 300 extracts the user identification information by searching for a storage location of the user identification information based on the virtual security code ( S460) and performing user authentication based on the extracted user identification information (S470).

At this time, as described above, the virtual security code includes a plurality of detailed codes. The plurality of detailed codes includes a first code for setting a starting point of a search for a storage location of user identification information and a specific search method, the starting point It may be composed of a second code for setting a search path from the to the storage location of the user identification information.

On the other hand, as a specific example of the first code and the second code, the code value (the first code value) corresponding to the first code is the first in the OTP code in the count corresponding to the current time based on the driving time of the virtual security code generation function. It may be a value obtained by adding a virtual security code value. The first code value serves as a waypoint in the actual code search process. The code value (second code value) corresponding to the second code may be a value obtained by subtracting a storage location value of user identification information (eg, UID) from the first code value. The second code value is a count from the waypoint (first code value) to the storage location value of the user identification information.

That is, an embodiment of the first code and the second code generated by the user terminal 200 are as follows.

1st code = current time count + OTP code (1st virtual security code)

2nd code = 1st code - actual code storage location value

As described above, the final virtual security code may be composed of the first virtual security code, the first code, and the second code generated by the OTP function. In this case, the first virtual security code is a code generated by the OTP function, and is a code generated differently every time. Therefore, since the detailed code is generated differently depending on the generation time of the virtual security code, it is possible to prevent duplicated generation, and there is an effect of enhancing security.

As another specific example of the first code and the second code, a code value (first code value) corresponding to the first code is a value obtained by adding user identification information (UID) to an OTP code value, and a code value corresponding to the second code (second code value) may be an OTP code value. At this time, the value of the user identification information (UID) is given to the user or the user terminal 200 at a specific time (eg, product manufacturing time, user registration time, payment method registration time, etc.), each user or user terminal It is a code value that can be identified.

That is, another embodiment of the first code generated by the user terminal 200 is as follows. At this time, the virtual security code is generated based on the first virtual security code and the first code.

1st code = OTP code (1st virtual security code) + UID

The method according to the present invention described above may be implemented as a program (or application) and stored in a medium in order to be executed in combination with a hardware device.

The above-described program is C, C++, JAVA, machine language, etc. that a processor (CPU) of the computer can read through a device interface of the computer in order for the computer to read the program and execute the methods implemented as a program It may include code (Code) coded in the computer language of Such code may include functional code related to a function defining functions necessary for executing the methods, etc. can do. In addition, the code may further include additional information necessary for the processor of the computer to execute the functions or code related to memory reference for which location (address address) in the internal or external memory of the computer should be referenced. have. In addition, when the processor of the computer needs to communicate with any other computer or server located remotely in order to execute the above functions, the code uses the communication module of the computer to determine how to communicate with any other computer or server remotely. It may further include a communication-related code for whether to communicate and what information or media to transmit and receive during communication.

The storage medium is not a medium that stores data for a short moment, such as a register, a cache, a memory, etc., but a medium that stores data semi-permanently and can be read by a device. Specifically, examples of the storage medium include, but are not limited to, a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like. That is, the program may be stored in various recording media on various servers accessible by the computer or in various recording media on the computer of the user. In addition, the medium may be distributed in a computer system connected by a network, and a computer-readable code may be stored in a distributed manner.

The steps of the method or algorithm described in relation to the embodiment of the present invention may be implemented directly in hardware, implemented as a software module executed by hardware, or implemented by a combination thereof. A software module may include random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, hard disk, removable disk, CD-ROM, or It may reside in any type of computer-readable recording medium well known in the art to which the present invention pertains.

As mentioned above, although embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art to which the present invention pertains can realize that the present invention can be embodied in other specific forms without changing its technical spirit or essential features. you will be able to understand Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive.

Claims

obtaining, by the user terminal, seed data necessary for generating a virtual security code from the smart card;

generating, by the user terminal, a virtual security code based on the seed data and time data; and

sending the virtual security code to a server to request user authentication,

A method of generating a virtual security code based on card data.
According to claim 1,

The smart card includes a plurality of tag information,

The plurality of tag information is stored separately in a plurality of storage areas allocated to each type of tag information in the smart card,

The acquisition step is

identifying at least one type of tag information related to the virtual security code from among the types of tag information;

identifying at least one storage area corresponding to the identified tag information type among the plurality of storage areas; and

reading tag information stored in the identified storage area from among the plurality of tag information and obtaining the seed data as the seed data;

A method of generating a virtual security code based on card data.
3. The method of claim 2,

The plurality of tag information is stored separately in the plurality of storage areas in a format of NDEF (NFC Data Exchange Format),

The seed data is

When the smart card is tagged in the user terminal, obtained based on the NFC method,

A method of generating a virtual security code based on card data.
4. The method of claim 3,

The plurality of tag information,

The card is stored separately in the plurality of storage areas by matching the use order information of each tag information of the user terminal set according to the type of the tag information, or stored separately in the plurality of storage areas in a text format, Card Data-based virtual security code generation method.
3. The method of claim 2,

The identified tag information type includes a financial transaction type requested by the user terminal,

The seed data is obtained from tag information stored in at least one storage area corresponding to the type of financial transaction requested by the user terminal among the plurality of storage areas,

A method of generating a virtual security code based on card data.
3. The method of claim 2,

generating, by the user terminal, the virtual security code based on the obtained seed data and transmitting the virtual security code to a server; and

The method further comprising: verifying the virtual security code from the server;

The server verifies the virtual security code by comparing the time data for receiving the virtual security code with the time data of the virtual security code,

A method of generating a virtual security code based on card data.
7. The method of claim 6,

The server extracts the user identification information by searching for a storage location of the user identification information based on the virtual security code, and performs user authentication based on the extracted user identification information,

The virtual security code includes a plurality of detailed codes,

The plurality of detailed codes,

a first code for setting a starting point of a search for a storage location of the user identification information; and

a second code for setting a search path from the starting point to a storage location of the user identification information according to a specific search method;

A method of generating a virtual security code based on card data.
3. The method of claim 2,

The smart card is

First tag information including execution data of a program for generating the virtual security code is stored in a first storage area of the plurality of storage areas, and second tag information including the seed data is stored in a second storage area of the plurality of storage areas 2 to save to the storage area,

A method of generating a virtual security code based on card data.
an IC chip having a plurality of storage areas each allocated to each type of tag information; and

Including; a communication unit that performs NFC-based communication when tagging with the user terminal;

In the plurality of storage areas, a plurality of tag information including seed data required for generating a virtual security code in the user terminal is separately stored,

The seed data is provided to the user terminal through the NFC-based communication at the time of tagging with the user terminal,

Card device for generating virtual security code based on card data.
10. The method of claim 9,

The virtual security code is generated by the user terminal based on the seed data and time data and transmitted to the server for user authentication,

Card device for generating virtual security code based on card data.
11. The method of claim 10,

The seed data is

At least one tag information type related to the virtual security code is identified from among the types of the tag information by the user terminal, and at least one storage area corresponding to the identified tag information type is identified from among the plurality of storage areas, , obtained by reading out the tag information stored in the identified storage area from among the plurality of tag information,

Card device for generating virtual security code based on card data.
a communication unit for performing NFC-based communication when tagging with a smart card that provides seed data necessary for generating a virtual security code; and

a control unit that obtains the seed data through the communication unit, generates the virtual security code based on the seed data and time data, and transmits the virtual security code to a server to request user authentication;

A terminal for generating a virtual security code based on card data.
13. The method of claim 12,

A plurality of tag information is stored separately in a plurality of storage areas allocated to each type of tag information in the smart card,

The control unit is

identify at least one type of tag information related to the virtual security code among the types of tag information;

identify at least one storage area corresponding to the identified tag information type among the plurality of storage areas;

reading tag information stored in the identified storage area from among the plurality of tag information and obtaining the seed data as the seed data;

A terminal for generating a virtual security code based on card data.