/ certification and payment device for m-commerce system and method using the same

Certification and payment device for m-commerce, system and method using the same}

1 is a diagram illustrating an online shopping mall purchase process using SET (Secure Electronic Transaction).

2 is an exemplary diagram for a case in which an e-commerce transaction through the Internet is hacked.

3 is an exemplary diagram of a card user number system utilized by existing card companies.

4 is a schematic diagram illustrating an authentication/payment device for mobile electronic commerce and a mobile terminal according to a first embodiment of the present invention.

5 is a diagram illustrating a sequential flow of a payment method using the authentication/payment device for mobile e-commerce according to the first embodiment of the present invention.

6 is a diagram sequentially illustrating procedures performed in the authentication/payment device for mobile e-commerce according to the first embodiment of the present invention.

7 is an exemplary diagram of a screen displayed on a display unit of a user's portable terminal displayed by the control of the authentication/payment device for mobile e-commerce according to the first embodiment of the present invention.

8 is a front view of an authentication/payment device for mobile e-commerce according to a second embodiment of the present invention.

9 is an exemplary view of a screen that may be displayed on a display unit of a payment card according to a second embodiment of the present invention.

<Explanation of Symbols for Main Parts of Drawings>

100: mobile terminal 101: data port

200: authentication/payment device for mobile e-commerce

218: interface 212: CPU 214: EEPROM

216: clock unit 300: card-type mobile e-commerce authentication / payment device

310: ASIC chip 320: connector

<background-art><p>The present invention relates to a security/authentication module, and more particularly, to an authentication/payment device, system and method for mobile electronic commerce (m-commerce) in which a user number is automatically renewed.</p><p>With the recent development of information and communication technology and the explosive spread of global communication infrastructure such as the Internet, e-commerce is emerging as a new economic activity mode that overcomes time and space constraints. As a result, countries around the world are promoting the revitalization of e-commerce as a key means to strengthen national competitiveness, and the Internet is now becoming a 'business battleground' without borders, breaking away from the concept of 'the sea of information'.</p><p>Electronic Commerce (EC) can be defined in various ways from various perspectives, but all commerce activities and support for buying and selling goods and services in cyberspace such as the Internet between economic entities such as individuals, companies, and governments It is commonly defined as a set of actions that include activities that </p><p>The biggest advantage of e-commerce is that there is no time and space restrictions, so you can reduce the hassle of going to the store directly, there are almost no distribution costs, building rent, inventory costs, etc., and all Internet subscribers around the world are potential customers. In this respect, it is compared to a high-tech golden fishing ground. In addition, e-commerce significantly reduces transaction costs by reducing the distribution stage and is a key means of dramatically improving the efficiency and transparency of the overall economy because all transaction details are recorded/managed by computer.</p><p>However, until now, when the Internet has become the center of everything, the progress of e-commerce in Korea is insignificant, apart from the current status of e-commerce use worldwide. </p><p>Although there are several reasons for such insignificant use of e-commerce, when e-commerce (non-face-to-face transactions) are conducted on the Internet where customers and stores do not physically meet, electronic payment that transmits credit card information through an open network such as the Internet It can be pointed out that the main reason is that users in areas where the use of cash has been emphasized, which is more conservative than Westerners, are anxious about the exposure of personal credit information with respect to the Electronic Payment System. </p><p>In fact, the biggest challenge in e-commerce is effectively protecting credit information. For this purpose, various payment methods such as prepaid card type, credit card type, deposit transfer type, electronic cash type, etc. are used, but fundamental user protection is impossible.</p><p>Currently, there are attempts to standardize and strengthen electronic payment security technology as a way to solve the user information security problem related to the activation of e-commerce, but this too cannot be a fundamental solution when credit card user numbers are exposed when using e-commerce. .</p><p>In this regard, FIG. 1 shows an online shopping mall purchase process using a SET (Secure Electronic Transaction) method in relation to a standardization method of electronic payment security technology. </p><p>When attempting an existing e-commerce transaction, when a user accesses a shopping mall and applies for a purchase by entering a product name or credit card number in the order form on the browser, the credit card number and order form are encrypted with their respective keys and sent to the shopping mall company (104). ), the encrypted and transmitted order form is decrypted using the corresponding decryption key at the shopping mall site (106), and the encrypted credit card number is a credit card company (in some cases, it may be a VAN operator, and in this case, a VAN or PG (Paymnt gateway), an inquiry about approval may be transmitted to a credit card company through a provider) to request approval (108).</p><p>A credit card company that has received a request for approval in relation to the credit limit, etc. obtains a credit card number by decrypting the credit card number using a decryption key corresponding to the encryption key (110), and then credit-related information for this number, etc. , and transmits the result of the approval request to the shopping mall company (112). </p><p>In the shopping mall, a series of electronic commerce transactions are performed by displaying information on transaction completion or transaction inability to the purchaser ( 116 ) according to the result of the approval request.</p><p>As can be seen from FIG. 1 , in order to send and receive a product purchase order or credit card number in which personal information is currently written over the Internet, data must be encrypted. However, it is also problematic from a privacy point of view to disclose personal information to unrelated organizations more than necessary. use</p><p>However, from this point of view, in addition to the measures to strengthen the security of personal information, a separate plan must be prepared in case of hacking or finding out the credit card number by an illegal method.</p><p>Meanwhile, FIG. 2 is an exemplary diagram for a case in which an e-commerce transaction through the Internet is hacked. Assuming that you try to purchase a product through e-commerce or try PC banking using the individual PC 202 at home, work, or PC, etc., the information to be transmitted is sent to the server 204, such as an e-commerce company or bank, not through a dedicated line. When transmitted through a network (eg, the Internet), it has a disadvantage that it may be exposed to the third party 206 through the network.</p><p>Next, in relation to user authentication of credit cards, a utility model application has recently been applied for "a device for authenticating a credit card user" (Registered Utility Model No. 1999-23246), which can only be used by entering a password. In the above application, before the user uses the credit card, by using the function of the user authentication device provided in the credit card itself to authenticate the identity of the user without using an external device, in principle, the use of the credit card by others can be prevented. provide the device.</p><p>However, according to the disclosure of the above application, since the credit card number is also fixed for each card and it is necessary to input the fixed user number during the e-commerce transaction, the credit card user number is exposed to others so that others can use the user number during the e-commerce transaction It is defenseless against fraudulent use that steals . </p><p>That is, if the prior technologies are summarized for the case where the card user enters the card user number during e-commerce transactions, it is installed in a workplace, a stock room, or a public place to secretly peek around an individual single-shot device such as a kiosk to be used for public use, or a hacking program When a program such as the above is installed in a PC used for electronic commerce and the card user number is obtained and used, there is a disadvantage that illegal use cannot be prevented fundamentally.</p><p>3 shows a card user number system utilized by existing card companies in relation to such a fixed user number.</p><p>Reference numeral 302 in FIG. 3 denotes BIN No. A card-specific identification number is shown. Reference number 304 indicates a grade for each card, and reference number 306 indicates a card type for distinguishing an individual or a corporation. Reference numbers 308 to 312 are constituent parts for indicating information about an individual. Reference number 308 is a personal identification number, and reference number 310 is a subscriber classification for indicating whether an individual or a family member. and a reference number 312 indicates an issuance sequence for indicating whether theft/lost. Finally, reference number 314 is a portion of an error check number for verification against number theft or arbitrary entry attempts.</p><p>As can be seen above, in the existing card system, if a stolen card number is used in e-commerce transactions, for example, even if a malicious third party cannot find out only the last digit out of the total 16-digit number, transactions are made with several attempts. There is a high possibility that it can be done in the name of another person. </p><p>In order to compensate for these disadvantages, during e-commerce transactions, an individual is first registered as a member in the e-commerce company service, and information such as resident registration number is registered. A method may be used in which the credit card company checks whether the information of the card customer matches the information of the credit card company and grants approval. </p><p>However, the majority of the current Internet users avoid entering detailed information such as resident registration number when registering for membership due to the fact that information about themselves can be used arbitrarily for Internet marketing. There is a problem that a malicious third party can obtain all such data and use it completely. </p><p>On the other hand, in relation to network security, RSA Secure ID of a time synchronization method, a security token of a one time password (OTP) method, a secure card, a once ID, etc. are used for user authentication. </p><p>However, this method uses a separate terminal in a two-factor method, but the number displayed on the terminal for user authentication corresponds to a password. There is a problem that it cannot. </p></background-art><tech><p>Therefore, the technical problem to be achieved by the present invention is to insert an authentication/payment card whose card user number is updated every transaction into a personal portable terminal such as a mobile phone into a data port of a portable terminal to communicate with the portable terminal in the form of a detachable module. An object of the present invention is to provide an authentication/payment device for mobile e-commerce transactions or a card-type authentication/payment device for mobile e-commerce transactions that communicates with a mobile terminal through a connector inserted into a data port of the mobile terminal.</p></tech>

<p>Authentication / payment device according to the features of the present invention for achieving this technical problem, </p><p>a memory in which a plurality of encrypted card user numbers are stored; </p><p>a processing unit that sequentially reads one encrypted card user number from the memory according to a setting sequence whenever a password is input, and then decrypts the read card user number based on the input password;</p><p>an interface for communicating with a data port of the portable terminal;</p><p>The display unit and the keypad display the decrypted card user number on a display unit mounted on the portable terminal, and input the password using a keypad mounted on the portable terminal. </p><p>Hereinafter, the most preferred embodiment in which a person of ordinary skill in the art to which this invention pertains can easily implement this invention will be described in detail with reference to the accompanying drawings.</p><p>4 is a schematic diagram illustrating an authentication/payment device for mobile electronic commerce and a mobile terminal according to a first embodiment of the present invention. Reference numeral 100 denotes a mobile terminal, 101 a data port for data input/output of the mobile terminal, 200 denotes an authentication/payment device for mobile e-commerce, 218 RS232 interface, 212 CPU, 214 EEPROM, and 216 clock represents wealth.</p><p>In order to implement the authentication/payment device for mobile e-commerce, preferably, the CPU inside the mobile terminal and the inside of the authentication/payment device for mobile e-commerce of the present application have the same data protocol. In addition, when the internal voltage of the mobile phone and the voltage required by the CPU of the authentication/payment device for mobile e-commerce are different, it is obvious that a DC-DC converter or regulator is needed to adjust the voltage.</p><p>In the authentication/payment card according to the embodiment of the present invention, as shown in FIG. 4 , the CPU 212 communicates serially with the LCD and the keypad mounted in the portable terminal through the RS232 interface. To this end, the CPU according to the present invention adopts the same protocol as the protocol adopted by each mobile terminal manufacturer, for example, the ESMS protocol (SK side data format) or the EIF protocol (similar to ESMS but based on the Internet).</p><p>When the authentication/payment device for mobile e-commerce, in which the user number is automatically renewed, is inserted into the data port of the portable terminal, and authentication or payment is attempted, the user selects an authentication/payment function by operating a function button of the terminal. When the authentication/payment device for mobile e-commerce is inserted into the data port of the portable terminal, a command (eg, SETLCD=1) for acquiring control of the display unit (LCD) of the portable terminal and a key input unit (key) of the portable terminal A command (eg, SETKEY=1) for acquiring control of the pad) is automatically executed.</p><p>An authentication/payment initial screen is displayed on the terminal LCD, and the user inputs an authentication/payment device password for mobile e-commerce to perform authentication/payment.</p><p>The authentication/payment device 200 for mobile electronic commerce in FIG. 4 may include each of a CPU 212 , an EEPROM 214 , and a clock unit 216 , but a one-chip unit integrating the CPU, EEPROM and clock unit. ) type MCU may be implemented. </p><p>The keypad 102 mounted on the terminal consists of a plurality of keys for inputting a password, etc., and the EEPROM 214 stores a doctor card user number and basic CPU procedure information. In particular, a plurality of pseudo card user numbers are stored in the EEPROM 214, and these pseudo card user numbers are sequentially used according to a set order (referred to as a use order). The CPU 212 decodes the pseudo card user number stored in the EEPROM 214 according to a set rule whenever a password is input through the keypad 102 according to the clock signal provided from the clock unit 216, In particular, from among a plurality of pseudo-card user numbers stored in the EEPROM 214, one pseudo-card user number is sequentially read and decrypted according to the order of use to generate a usable card user number. And the display unit 103 mounted on the terminal displays the generated card user number so that the purchaser can use it.</p><p>In some cases, it is also apparent that the EEPROM 214 stores a previous card user number (or encrypted personal identification information and time or step information) and the like to generate a card user number according to a series of rules. </p><p>5 is a diagram illustrating a sequential flow of a payment method using the authentication/payment device for mobile e-commerce according to the first embodiment of the present invention. When a user registered as a member who can receive the payment service of the payment system inserts the authentication/payment device 200 for mobile e-commerce into the data port of the terminal and then inputs a password through the keypad 102 of the terminal, The CPU 212 of the authentication/payment device 200 for mobile e-commerce displays a usage confirmation message (which may be omitted in some cases) through the display unit 103 of the terminal to allow the user to authenticate/pay for mobile e-commerce. It is checked again whether the device 200 is to be used (S60 to S61). After confirming the user's use of the authentication/payment device for mobile e-commerce, the CPU 212 reads, from the EEPROM 214, a pseudo-card user number corresponding to the turn to be currently used according to the order of use, and then the input secret The number is decrypted using the decryption key to generate a card user number, and accordingly, the display unit 103 of the terminal displays the generated card user number (S62). </p><p>As such, in addition to the method in which the authentication/payment device 200 for mobile e-commerce generates and shows a card user number by performing a decryption process using the password as the decryption key, the password for decryption is initially operated for mobile e-commerce It is also possible to use a method of storing the authentication/payment device 200, comparing the number to be input in the future with the stored password, and showing the decrypted card user number if they match. </p><p>When the card user number is displayed on the display unit of the personal portable terminal communicating with the authentication/payment device 200 for mobile e-commerce according to the password input, the purchaser provides the card user number to the commerce system to make payment ( S63). That is, when a buyer purchases a product from a shopping mall site, etc. through the network, the card user number is transmitted to the commerce system using the purchaser terminal. Enter it into the commerce system, which is a card inquiry machine.</p><p>As described above, the commerce system receiving the card user number from the purchaser transmits the transaction details and the card user number-related matters to the payment system through the network (S64). Here, an identification number assigned to the authentication/payment device 200 for mobile e-commerce may be included among data transmitted to the payment system.</p><p>The payment processing unit of the payment system receives the card user number and transaction details transmitted from the commerce system, and then determines whether the card user number matches the card user number to be used in the current transaction according to the order of use ( S65 ).</p><p>That is, the payment processing unit searches the issuance information database based on the recipient identification number, and among a plurality of card user numbers assigned to the authentication/payment device for mobile e-commerce of the purchaser who requested payment, according to the order of use, Finds one card user number and determines whether it matches the card user number transmitted from the commerce system (S65), and if the two card user numbers do not match, notifies the payment system of re-entering the card number (S66), If the user numbers match, the credit card number and transaction details of the card company matching the card user number are transmitted to the authentication system operated by the card company to request transaction approval (S67). </p><p>When the transaction approval is notified from the authentication system or the transaction approval is determined by itself, the transaction approval result is transmitted to the commercial transaction system together with the corresponding card user number (S68 to S69).</p><p>On the other hand, when the transaction approval rejection is notified from the authentication system or the transaction approval is rejected by the payment system itself, the payment system sends a message indicating that the transaction approval has not been made together with the card user number to the commercial transaction system to input the correct number. .</p><p>In this way, after notifying the result of the approval according to the payment request, the number issuing unit of the payment system records that the transaction has been made once regardless of the approval result or in the case of approval, the transaction is made once, and the next transaction is set Use the card user number corresponding to the following sequence according to the sequence. </p><p>The procedures performed in the authentication/payment device for mobile e-commerce are sequentially illustrated in FIG. 6 . </p><p>The authentication/payment device 200 for mobile e-commerce may not perform the step of selecting the type or company of the card to be used, and after the button input signal is input through the keypad 102 in the normal waiting step (S70) When the password is entered in (S71), a use confirmation message is displayed through the display unit 103 to inquire whether to use again (S72).</p><p>Next, when the user presses the OK button (S73), the card is canceled again and a query is made through the display unit 103 whether to use the card next time (S74). If not, the entered password matches the stored password. Regardless of whether or not, the card user number is obtained by decrypting the doctor card user number stored in the EEPROM 214 (the doctor card user number to be used in the current transaction according to the setting sequence) using the input password as the decryption key. to generate (S75). </p><p>Next, if the password is the same as the stored password, the card user number that can receive transaction approval by decrypting the doctor card user number with the correct decryption key is displayed on the display unit 103 (S76), while the password is If the password is not the same as the stored password, the card user number that cannot be approved for the transaction is displayed on the display unit 103 because the doctor card user number is decrypted with the wrong decryption key (S79). Therefore, if a third party maliciously enters a random number as a password, the card user number decrypted using these numbers, that is, a number that cannot be authenticated, is displayed, and accordingly, the third party uses this number to conduct e-commerce transactions. Since it is not possible to obtain approval even if such attempts are made, damage due to card number theft can be easily prevented.</p><p>On the other hand, the pseudo card user number may be sequentially decrypted and displayed according to the order of use only if it matches the stored password each time the password is input. In this case, security may be improved by setting the password twice.</p><p>As such, the CPU 212 of the authentication/payment device 200 for mobile e-commerce displays the card user number decrypted according to the input of the password on the display unit 103 of the terminal, and then when a predetermined time elapses, the card user After stopping the number display operation, it returns to the standby state (S78). It goes without saying that, in some cases, steps S73 to S75 may be appropriately omitted according to a modified embodiment.</p><p>7 illustrates an example of a screen that can be displayed on a display unit of a user's portable terminal displayed by control in the authentication/payment device for mobile e-commerce according to the first embodiment. </p><p>Figure 7 (a) is a screen waiting for input of a password for decrypting the user number, Figure 7 (b) is a screen for entering a password, (c) and (d) of Figure 7 (c) and (d) are currently available cards It shows a screen displayed on the display unit so that the user can know the user number.</p><p>Another example of the authentication/payment device for mobile e-commerce according to the present invention is a structure having a separate connector inserted into a data port, and FIG. 8 is an authentication/payment for mobile e-commerce according to a second embodiment according to the present invention This is a front view of the device. Reference number 100 is a mobile terminal, 101 is a data port for data input and output of the mobile terminal, 300 is a card-type authentication/payment device for mobile e-commerce, 310 is an ASIC chip having a normal card thickness, and 320 is a mobile terminal and card-type mobile Represents a connector for providing an interface between authentication/payment devices for e-commerce.</p><p>The authentication/payment method of the card-type mobile electronic commerce authentication/payment device according to the second embodiment is the same as that described in the first embodiment. </p><p>However, the card-type authentication/payment device for mobile e-commerce according to the second embodiment differs from the authentication/payment device for mobile e-commerce according to the first embodiment in the ASCI of the mobile terminal and the card-type mobile e-commerce authentication/payment device. Since there is a connector 320 for providing an interface between the chips 310, a card form of a general standard, for example, an ISO 7816 standard, can be used as an authentication/payment device for mobile e-commerce. Since the authentication/payment device for mobile e-commerce can have the same form as a general credit card and can include a magnetic stripe, general card information recorded in the magnetic stripe can be read at an ATM or CD terminal during offline payment. . Accordingly, the password required by the ATM or CD terminal can be generated in the same manner as described in the first embodiment by inserting the authentication/payment device for mobile e-commerce into the connector 320 inserted into the mobile phone. have.</p><p>Since a password used in a general ATM or CD terminal requires 4 digits, the operation of the display unit of the authentication/payment device for mobile e-commerce according to the second embodiment is to have two selection modes, unlike the first embodiment. desirable. Here, the password used in the ATM or CD terminal is possible by utilizing a specific 4-digit number of the user number generated by utilizing the user number generation algorithm that can be generated according to the present invention.</p><p>9 shows an example of a screen that can be displayed on the display unit of the payment card according to the second embodiment. </p><p>Fig. 9 (a) is a screen for allowing the user to select which number among the card user number and ATM password required for online payment, and Figs. 9 (b) and (c) are for decrypting the user number The screen on which a password is input, FIG. 9(d) shows a screen displayed on the display unit so that the user can know the currently available card user number. 9(e) shows a screen displayed on the display unit so that the user can know the currently available card user number.</p><p>The card-type authentication/payment device for mobile electronic commerce according to the second embodiment may also implement a function of a normal electronic money by utilizing a communication function of a mobile phone. That is, when a card-type mobile e-commerce authentication/payment device is inserted through the connector, a mobile phone with Internet function can access a specific site that implements an electronic money service to purchase, recharge, or check the balance. , it is also possible to transfer the balance to another person's authentication/payment device for mobile e-commerce.</p>

<p>As described above, the present invention provides an authentication/payment device for mobile e-commerce that can be automatically updated after a transaction is performed so as to fundamentally solve personal credit information exposure and can be inserted into a personal portable terminal. to provide. According to the present invention, it is possible to obtain the effect of fundamentally protecting the card user even when the card user number is obtained by an illegal method by allowing another card user number to be used for the next authentication/transaction.</p><p>In addition, not only can you be notified of the authentication/payment status immediately, but you can also receive information related to your current payment limit, so you can use your card more smoothly. You can do it and you can truly inform the cardholder of this right away, thus avoiding further losses.</p><p> As described above, when using a card in which the user number can be updated according to the present invention, in addition to the advantage of being able to safely use the card by updating the user number, as can be seen from the omitted part by anyone skilled in the art in the above-described part, It has the advantage that all authentication/payment related cards such as all credit cards, bank cards, stock cards, department store cards, gas station cards, etc. can be integrated into one card.</p><p>In addition, the authentication/payment device for mobile e-commerce according to the present invention can utilize the keypad unit and display unit of the terminal, which are necessary for authentication/payment actions, so that the size of the module itself becomes more compact than that of the card, and the LCD and keypad of the terminal By using , the user has the advantage that authentication/payment can be made more conveniently.</p><p>In addition, the authentication/payment device for mobile e-commerce according to the present invention may have a card form of ISO 7816 standard, so that the keypad unit and display unit required through a magnetic stripe when performing authentication/payment through an ATM or CD terminal are those of the terminal. Because it can be utilized, the size of the module itself becomes more compact than that of the card, and by using the LCD and keypad of the terminal, the user has the advantage that it can be used more conveniently.</p>