KR20080009242A - Service system for instant payment utilizing a wireless telecommunication device - Google Patents

Abstract

A system for providing a debit payment service with a mobile terminal is provided to secure the payment service against hacking by transferring only the PIN(Personal ID Number) such as a mobile number between a seller server and a PG(Payment Gateway) server, and process an authentication procedure quickly by needing no communication procedure between the mobile terminal and the PG server. A mobile terminal(100) displays an OTP(One-Time Password) based on key manipulation and an inputted PIN by downloading/installing a time or event-synchronized OTP generation algorithm. A seller server(200) receives the PIN and the OTP. A PG debit payment server(400) receives the PIN, the OTP, and order details from the seller terminal, verifies the order details, and transmits the PIN, the OTP, and the order details to a bank debit payment server(500). The bank debit payment server authenticates a member by using the PIN/OTP, processes debit payment with a linked account based on the order details, and transmits payment details to the seller server through the PG debit payment server. The bank debit payment server authenticates the linked account by comparing the received OTP with the OTP, which is generated by the OTP generation algorithm based on the received OTP/PIN, and time or event information.

Description

Service system for instant payment utilizing a wireless telecommunication device

The present invention relates to a direct debit payment service system using a mobile communication terminal, and in particular, a direct debit payment service system using a user unique number such as a mobile communication terminal number and a one-time password of a time synchronization or event synchronization method downloaded to a mobile communication terminal. .

Increasing commerce behavior online and offline, as well as the convenience and security of payments when purchasing products, are becoming an important concern for payment related institutions, commerce service providers and users, and mobile phones have become a necessity in various commerce. There are attempts to make payments that utilize the portability of mobile phones.

In the authentication process of online and offline commerce, the Korean Patent Application No. 1999-48471, 1999-57586, 2000-14506, etc. sends the authentication number from the authentication server to the mobile phone at the request of the authentication request server and the authentication entered by the user. A technology for verifying a number by an authentication server and providing a settlement service for the commerce is disclosed. This service technology is being extended from the "phone bill" mobile phone micropayment method, which uses so-called mobile phone billing, to the payment method of traditional post-pay financial institutions such as debit or credit cards.

The mobile payment method is widely used in terms of payment convenience, but if a third party knows the user's mobile phone number and social security number and has a mobile phone, anyone can make a payment by entering only the authorization number. There is also the possibility of damage through the phone. Since the micro-payment method for mobile phones takes a billing method that charges post-pay bills for mobile phone usage charges, it takes a long time to collect the payouts and poses a problem of credit failure. In addition, this approach is difficult to apply to offline commerce.

Korean Patent Publication No. 10-0412510 omits the procedure of inputting the approval number in the conventional mobile phone payment method described above, and accesses a callback SMS (specific wireless phone page) including an OTP (One Time Password) to the mobile phone. A payment method that sends a URL (Uniform Resource Locator) that contains a two-way text message) and sends a preset password to a specific phone page by pressing the OK button on the mobile phone. It is. However, although this method is a security method with enhanced security compared to the prior art, the payment method has a limitation of the payment amount and the date of money recovery due to the post-communication method of the same mobile phone bill as the prior art.

Korean Patent Publication No. 2003-82090 discloses a transaction for a commerce between a user and a seller through a card settlement including a credit card or a debit card. Receives the user mobile terminal unique number and the transaction history information, and transmits the information including the mobile terminal unique number to the server of the credit card company, the server of the credit card company checks the credit card number linked to the mobile terminal unique number A payment gateway that allows the user to perform card payments without exposing the user's credit card number to the merchant server or to the user in such a way that the query results are sent and the user enters an ID and password to approve the transaction. Electronic payment settlement system including server To provide. The credit card number is not exposed to the seller, but because the phone number, ID and password to access the account can all be exposed, the purpose of the credit card number cannot be achieved. The authentication procedure must be performed or a separate authentication procedure must be performed by callback SMS method.

All of the above electronic payment systems have a one-way or two-way communication process between the mobile phone user and the payment gateway server (or authentication server) in addition to the payment approval process between the seller and the payment gateway server. There is a risk of delay, and above all, there is a problem of delaying the calculation procedure in multiple facilities due to the delay time caused by the communication.

The present invention can be used as a payment method of commerce on-line as well as off-line commerce using a mobile phone, and only a user's unique number such as a mobile phone number in the payment process is provided through a section between a seller server and a payment agent server. It is to provide a high security direct payment system against hacking by being transmitted.

The present invention is to provide a direct debit payment service system that can be quickly performed without the communication procedure between the mobile phone user and the payment gateway server (or authentication server).

According to the present invention, a one-time password (OTP) generation algorithm of a time-synchronous or event-synchronous method is downloaded and installed to display a one-time password with a predetermined key operation and a PIN number input; A seller server or a seller terminal through which a user identification number and the disposable password are input; A payment gateway debit processing server that receives the user's unique number, the one-time password and the order history from the seller server or the seller terminal and determines the validity of the order history of the seller; Authenticate that the user is a service subscriber from the user ID and the one-time password received via the payment gateway debit processing server, and make a direct debit payment for the linked account based on the valid order history received via the payment gateway debit processing server. It is made of a financial company debit processing server that performs and transmits the payment details to the seller server or the seller terminal via the payment gateway debit processing server, the financial company debit processing server corresponding to the received one-time password and the user's unique number Provided is a direct payment service system using a mobile communication terminal that performs authentication on a linked account by comparing a one time password generated by the one time password generation algorithm based on a PIN value and time information or event information.

The direct debit service system of the present invention is simple and convenient because there is no one-way or two-way communication procedure between the user of the mobile terminal and the authentication server except for the initial subscription, and a problem of delaying the calculation procedure in multiple facilities due to the delay of payment occurs. Do not. The password is a one-time only, unique number is transmitted through the section between the seller server and the payment agent server provides a secure direct debit system for hacking.

The mobile communication terminal refers to a terminal having a central operation function, a memory function and a display function, and having a two-way communication while being equipped with a mobile communication module, and having a mobile communication module capable of PCS, cellular phone, smartphone or two-way data communication. Includes PDA and notebook forms. In the present invention, the user wireless communication terminal is most preferably in the form of a CDMA or TDMA mobile phone or mobile phone.

The unique user number is not limited to a mobile communication terminal number but refers to a unique number for each user, such as a resident registration number or a virtual resident registration number.

In the present invention, the disposable password display may be displayed independently or may be displayed together with a user identification number, and the display thereof may be displayed in text of numbers or letters by a liquid crystal display or in a one-dimensional or two-dimensional pattern. The pattern requires a dedicated reader, for example, a barcode which is a one-dimensional pattern.

The direct debit service system of the present invention can be used not only for online commerce but also for offline commerce. When used online, the direct debit service system stores the user's unique number and the one-time password through a separate user terminal connected to the seller server through the Internet. Enter on merchant server. When used offline, the user identification number and the time synchronization or event synchronization one-time password are dictated by the user and entered by the employee on the seller's terminal or directly by the user on the seller's terminal. It may be inputted automatically by a dedicated reader provided in the seller terminal.

Although the present invention mainly describes direct debit, it can be applied to the post-payment method of credit card substitution as it is. In this case, the direct debit includes a transfer to a merchant account and a virtual account generated by a transaction.

Disposable password used in the present invention is a time synchronization or event synchronization. Event Sync. Is a method that uses a secret value and the number of times a particular event has occurred as the input of a hash function when generating a response value. That is, compared with the query / response method, it can be regarded as using the numerical value of a specific event as the query value. This eliminates the need to receive query values from the server side. The disposable password used in the present invention is preferably time synchronized. By inputting the secret value and the current time (real time) as the input of the hash function, the authentication server side and the user's mobile communication terminal can be synchronized by having a common value of time. Normally this type of token will be changed once every minute. U.S. Patent No. 4720860 discloses a basic technique of such a time synchronization method. In addition, US Patent No. 4885778 discloses a method for generating a plurality of ciphers in a plurality of time units around a server time in an authentication server, and correcting the time error by comparing secret values on the client side. In addition, US Patent No. 51685208 discloses a technique for synthesizing a PIN and a generated password, transmitting the PIN, and separating the PIN and the password from an authentication server and performing an authentication procedure to enhance security. This time-synchronous one-time password has high security since there is no procedure for receiving unnecessary query values without exposing the fixed password on the network. This time-synchronized one-time password generation method is used integrated in the present invention.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the debit payment service system using a mobile communication terminal according to the present invention.

1 is a conceptual diagram schematically showing a direct debit service system using a mobile communication terminal of the present invention. When a user first subscribes to a service, a one-time password (OTP) generation algorithm of a time synchronization method is downloaded by a financial institution debit processing server 500 to a mobile communication terminal 100 used by a user according to a predetermined procedure. Applied only when subscribing to a service, it is installed with a dotted line). When the user enters a PIN number in the OTP generation mode of the mobile communication terminal 100, a one-time password is generated and displayed on the display. The user manually or automatically provides the affiliated seller terminal 200 with the user's unique number (for example, a mobile phone number) and the disposable password on offline. On-line, the user accesses the seller server 300 by the user's PC (not shown) and inputs the mobile communication terminal number and the one-time password in the trade signing authentication mode. The payment gateway debit processing server 400 receives the user's unique number, the one-time password and the order details from the seller server 300 or the seller terminal 200, and confirms whether the seller is affiliated with the order. Determine the validity of the statement. Financial company debit processing server 500 authenticates that the service subscriber from the user ID and the one-time password received via the payment gateway debit processing server 400 and performs a debit payment for the linked account and the payment details Via the payment gateway debit processing server 400 is transmitted to the seller server 300 or the seller terminal 200.

The direct debit service system of the present invention first requires the user to subscribe to the service and download and install the OTP algorithm. Figure 2 illustrates a flowchart for this user subscription procedure. The user receives the user information such as the social security number, mobile communication terminal number, and other personal information of the user to be subscribed to through the user information input unit A01 in the input mode provided by the financial company and the online subscription site provided by the financial company. The mobile communication company A08 is requested through the confirmation module A02 for the validity of the user. When the result from the mobile communication company A08 is transmitted to the validity determining unit A03, if the validity determining unit A03 determines to be valid, the mobile communication terminal number, which is the unique number of the user, is transferred to the OTP processing module A04. To pass. The OTP processing module A04 transfers the user's unique number to the financial company host account system A07, and the financial company host account system A07 modifies the user's debit account information by adding an OTP function to the user's debit account information. And notifies the OTP processing module A04 of the result. The OTP processing module receives a PIN A06 to be used by the OTP generation module 523 of the authentication server 520 from the subscriber. The user ID and PIN (A06) is transmitted to the authentication server (520). The authentication server 520 generates an authentication profile for the user by using a PIN and a user's unique number, generates and stores a seed SEED to a predetermined location of the download server A05, and stores the mobile communication terminal number and Send the storage address of OTP generated S / W processed in short text together to communication module (A02). The communication module A02 transmits the short information to the user's mobile communication terminal 100 through the short transmission server of the mobile communication company A08 connected by a dedicated line. The mobile communication terminal 100 of the user directly connects to the download server A05 through the received short information and downloads the OTP-generated S / W, and when the downloaded OTP-generated S / W is first executed, the wireless communication network is executed again. Through the connection to the download server (A05) through the additional authentication of the justification of the mobile communication terminal 100, the SEED is received and encrypted and stored in the mobile communication terminal 100 to complete the subscriber processing process. This is done only once at the time of subscription.

3 is a flowchart illustrating a procedure of generating an OTP in the user mobile communication terminal 100. The user's PIN is input through the telephone keypad input unit B01, and the OTP generating unit B02 receives the SEED B03 and the mobile communication terminal 100 encrypted and stored in the mobile communication terminal 100. After generating the first OTP using its algorithm (Fn (Fn (Seed) * Fn (Time))) by using the extracted time information, the final OTP is generated by hashing the first OTP and the PIN value. In step B04, the user identification number B05 extracted from the mobile communication terminal 100 and the final OTP generated by the OTP generation unit B02 are sent to a display determination unit B06. After the user decides to display the barcode or text according to the user's selection, the barcode is sent to the barcode processing unit B07 to display the barcode type through the liquid crystal display unit B08. To be displayed.

Referring to Figure 4 will be described in detail the debit payment procedure for merchants that are merchants in offline commerce. The user inputs a PIN to the user's mobile phone 100 for payment so that the user identification number and OTP authentication information required for direct debit authentication are displayed on the liquid crystal display unit B08 of the user's mobile communication terminal. The authentication information of the communication terminal liquid crystal display unit B08 is input through the seller terminal input unit 210 by various input methods (manual input, automatic input into a barcode processor, etc.) provided by the merchant terminal 200. The input order information and authentication information is transmitted to the merchant information processing unit 220. The merchant information processing unit 220 transmits payment information, in which the merchant information 230 is added to the order information and the authentication information received, to the seller terminal communication module 240, and the seller terminal communication module 240 is connected by a private chart. The payment information is delivered to the payment debit processing server 400 and waits for the result. The payment gateway debit processing server 400 delivers the results of authentication and payment to the seller terminal communication module 240. The seller terminal communication module 240 transmits the result transmitted from the payment gateway debit processing server 400 to the seller terminal output unit 250. The seller terminal output unit 250 outputs the cause of the failure if the result is a failure, and if the result is success, the seller terminal output unit 250 includes the payment information for the corresponding debit payment and completes the function execution.

Referring to Figure 5 will be described in detail with respect to the merchant server that is the merchant in online commerce. A user who is a service subscriber accesses the seller server 300 through the PC 310 which is a user terminal. The seller server input unit 320 inputs a PIN to the mobile communication terminal 100 in the authentication request mode, and provides the subscriber terminal with authentication information such as a user's unique number and OTP required for direct debit authentication displayed on the liquid crystal display B08 of the mobile communication terminal. Received through the PC 310 receives the order history and authentication information to the merchant information processing unit 330. The merchant information processing unit 330 transfers payment information, in which the merchant information 360 is added to the order history and the authentication information received, to the seller server communication module 340, and the seller server communication module 340 is connected by a dedicated line. The payment information is delivered to the gateway debit processing server 400 and waits for a result. The payment gateway debit processing server 400 delivers the results of authentication and payment to the seller server communication module 340. The seller server communication module 340 transmits the result transferred from the payment gateway debit processing server 400 to the seller server output unit 350. The seller server output unit 350 outputs the cause of the failure if the result is a failure, and if the result is success, to the user terminal PC 310 including the payment information for the corresponding debit payment and performs a function. do.

6 illustrates a payment gateway debit processing server 400 in detail. The payment gateway debit processing server 400 processes the authentication information and the payment information transmitted from the merchant seller terminal 200 and the seller server 300 through a dedicated line. The merchant information processing module 410 sends the final payment information and the authentication information added with the merchant additional information 360, such as the account of the merchant (seller), to the payment information to the payment gateway authentication module 430. The payment gateway authentication module 430 transmits the authentication information and the final payment information to the payment gateway communication module 440, and the payment gateway communication module 440 is the authentication information to the financial company debit processing server 500 connected by a dedicated line. And deliver the final payment information and wait for a result. The financial company debit processing server 500 delivers the results of authentication and payment to the payment gateway communication module 440. The payment gateway communication module 440 transfers the result to the payment gateway authentication module 430 and the payment gateway authentication module 430 delivers the result to the payment gateway result module 450. The payment gateway result module 450 processes the entire data such as payment fee and transmits the result value to the merchant seller terminal 200 and the seller server 300 through a dedicated line and completes the execution.

7, the authentication procedure and the direct payment procedure of the financial institution debit processing server 500 will be described in detail. The financial company debit processing server 500 performs authentication and payment using data received through a dedicated line from the payment gateway debit processing server 400. The financial company authentication module 510 requests the authentication server 520 to separate the user identification number and the OTP for authentication among the data transmitted from the payment gateway debit processing server 300. The authentication server 520 performs authentication on the received user ID and OTP, and transmits the result to the financial institution authentication module 510 as "success" in case of a legitimate user and "failure" in case of an invalid user. The financial institution authentication module 510 notified of the authentication result from the authentication server 520 transfers the result to the financial institution payment module 530. The financial company payment module 530 transfers payment details such as merchant information, a user identification number, a debit payment amount, and a date to the user account management module 540 only when authentication is successful. The user account management module 540 looks up the user's account using the received user's unique number to determine whether the payment is possible for the corresponding account, and if the payment is possible, transfers the amount of payment from the account to the seller's account. Debit payment is performed, and if the corresponding account cannot be settled due to lack of money, the payment is delivered to the financial institution payment module 530 as a debit payment failure. The financial company payment module 530 transfers the result transferred from the user account management module 540 to the financial company settlement module 550. The financial institution settlement module 550 processes the result of the debit payment processing and delivers it to the payment gateway debit processing server 400 through a dedicated line to complete the function execution.

8 illustrates the authentication process of the authentication server 520 of the bank debit processing server 500 will be described in more detail. First, the user identification number received from the financial institution authentication module 510 in the financial institution debit processing server 500 is compared with the DB of the user information management module 521 in the authentication server 520. The user information management module 521 checks the existence of the user to be authenticated by the DB (522) and transmits the authentication failure to the authentication result processing module 525 when the user does not exist. If the user exists, it is checked whether the delivered OTP is valid (524). To this end, the OTP generation module 523 in the authentication server 520 generates an OTP corresponding to the user based on data necessary for generating the OTP such as a token serial number, PIN, SEED and current time assigned to the user (OTP = Fn). (Fn (Seed) * Fn (Time)) is generated and compared with the delivered OTP. If the two OTPs match, the authentication succeeds. If the two OTPs do not match, the authentication result processing module 525 fails. The authentication result is delivered The authentication result processing module 525 transmits the authentication result to the financial institution settlement module 530 in the financial institution debit processing server 500.

1 is a conceptual diagram schematically showing a direct debit service system using a mobile communication terminal of the present invention;

2 is a flowchart of a user registration procedure;

3 is a flowchart illustrating a procedure of generating an OTP in a user mobile communication terminal 100.

4 is a block diagram showing a procedure for inputting a user identification number and an OTP to an affiliated merchant terminal in off-line commerce.

FIG. 5 is a block diagram showing a process of processing a user identification number and an OTP in an affiliate merchant server in online commerce; FIG.

6 is a block diagram showing a payment gateway debit processing server 400 configuration;

7 is a block diagram showing the configuration of a financial institution debit processing server 500;

8 is a flowchart illustrating an authentication process of the authentication server 520 of the financial institution debit processing server 500.

Claims (5)

A user mobile communication terminal having a one-time password (OTP) generation algorithm of a time synchronization or event synchronization method downloaded and installed to display a one-time password by a predetermined key operation and input of a PIN; A seller server or a seller terminal through which a user identification number and the disposable password are input; A payment gateway debit processing server that receives the user's unique number, the one-time password and the order history from the seller server or the seller terminal and determines the validity of the order history of the seller; Authenticate that the user is a service subscriber from the user ID and the one-time password received via the payment gateway debit processing server, and make a direct debit payment for the linked account based on the valid order history received via the payment gateway debit processing server. It is made of a financial company debit processing server that performs and transmits the payment details to the seller server or the seller terminal via the payment gateway debit processing server, the financial company debit processing server corresponding to the received one-time password and the user's unique number Debit payment service system using a mobile communication terminal that authenticates the linked account by comparing the one-time password generated by the one-time password generation algorithm based on the PIN value and time information or event information The direct payment service system of claim 1, wherein the disposable password is a time-synchronous mobile communication terminal. The method of claim 2, wherein the disposable password corresponds to the user identification number Hash the one-time password seed and the value generated by the time again by the PIN value Direct debit service system using generated mobile communication terminal The direct payment service system of claim 3, wherein the user ID is a mobile communication terminal number. The direct payment service system of claim 4, wherein the mobile communication terminal is a mobile phone.

Images