KR101129167B1 - Method and system of mobile secure payment - Google Patents

Abstract

The present invention relates to a mobile secure payment method and system for dividing a mobile secure payment server into a server for identity authentication and a server for payment approval, and reducing leakage of personal information by using encryption technology.
In accordance with an embodiment of the present invention, the mobile secure payment method includes receiving a callback message including mobile secure payment authentication server access URL information when a purchase is made; When the mobile communication terminal receives a user input for executing a mobile secure payment method driving program through the message, the mobile terminal executes the mobile secure payment method driving program according to the mobile secure payment authentication server URL information. Accessing the mobile secure payment authentication server; Receiving, by the mobile secure payment authentication server, purchase information; Receiving, by the mobile secure payment authentication server, a mobile secure payment password from the mobile communication terminal; Performing, by the mobile secure payment authentication server, the purchaser's own authentication based on the received mobile secure payment password; When the identity authentication is completed, the mobile communication terminal to the public key of the mobile secure payment approval server through the mobile secure payment method driving program Encrypting payment information including payment means, and encrypting a first identity authentication result value with a public key of the mobile secure payment approval server; Receiving, by the mobile secure payment authentication server, the encrypted payment information and an encrypted first authentication result value from the mobile communication terminal; Transmitting, by the mobile secure payment authentication server, an authentication result value of the first encrypted copy to an external server; Transmitting, by the mobile secure payment authentication server, the first authentication result and the payment information to the mobile secure payment approval server; Receiving, by the mobile secure payment approval server, an authentication result value which is an encrypted second copy from a payment intermediation server; Determining, by the mobile secure payment approval server, whether the received second authentication result is identical to the first authentication result using the private key; If the second authenticator authentication result and the first authenticator result match, decrypting the encrypted payment information using the private key and transmitting the decrypted payment information to the payment intermediation server; Transmitting, by the payment broker server, the purchase information and the received payment information to a purchase company server; The purchase company server may include performing a payment approval based on the received information.

Description

Mobile secure payment method and system {METHOD AND SYSTEM OF MOBILE SECURE PAYMENT}

The present invention relates to a mobile secure payment method and system for helping customers to securely pay using mobile.

Conventionally, customers often see and purchase goods directly, and payment for purchases is mostly made through cash transactions between customers and businesses.

Recently, however, more and more customers purchase goods at home or in the office through Internet shopping, home shopping advertisements, or delivery order phones. This can be efficient in terms of time, cost and fitness.

In addition, when a customer uses home shopping or makes an order call, it is not possible to pay the purchase price in cash, so it is common to pay using a wire transfer or a credit card. In particular, credit cards are easy to hold, and the use of credit cards can be advantageous when receiving income deductions, so the number of customers using credit cards is increasing.

However, if the customer and the merchant is in a different space, it is impossible for the customer to pay directly with the credit card through the merchant terminal. In addition, in the case of a food delivery company, a deliveryman may carry a terminal for payment of a card, but when a customer orders an item through a home shopping advertisement or the like, the delivery company does not directly deliver the goods to the courier company. Since the goods are delivered to the customer via the customer, it is impossible for the customer to pay with the credit card through the card payment terminal. However, it is dangerous for a customer to make a card payment by providing a credit card number to a merchant.

Therefore, when a customer orders a product over the telephone and wants to pay using a credit card, it is urgent to introduce a secure payment system that can prevent the leakage of customer information.

An object of the present invention is to provide a mobile secure payment method and system for efficiently managing the mobile secure payment system by dividing the mobile secure payment server into a server for identity authentication and a server for payment approval.

Still another object of the present invention is to enable the mobile communication terminal to encrypt payment information and identity verification result with the public key of the mobile secure payment approval server, and only the mobile secure payment approval server can decrypt the encrypted data with the private key. It is to provide a mobile secure payment method and system that can prevent the leakage of payment information and personal information.

In order to achieve the above object, the present invention provides a mobile communication terminal, when the purchase is made, receiving a callback message including mobile secure payment authentication server access URL information; When the mobile communication terminal receives a user input for executing a mobile secure payment method driving program through the message, the mobile terminal executes the mobile secure payment method driving program according to the mobile secure payment authentication server URL information. Accessing the mobile secure payment authentication server; Receiving, by the mobile secure payment authentication server, purchase information; Receiving, by the mobile secure payment authentication server, a mobile secure payment password from the mobile communication terminal; Performing, by the mobile secure payment authentication server, the purchaser's own authentication based on the received mobile secure payment password; When the identity authentication is completed, the mobile communication terminal to the public key of the mobile secure payment approval server through the mobile secure payment method driving program Encrypting payment information including payment means, and encrypting a first identity authentication result value with a public key of the mobile secure payment approval server; Receiving, by the mobile secure payment authentication server, the encrypted payment information and an encrypted first authentication result value from the mobile communication terminal; Transmitting, by the mobile secure payment authentication server, an authentication result value of the first encrypted copy to an external server; Transmitting, by the mobile secure payment authentication server, the first authentication result and the payment information to the mobile secure payment approval server; Receiving, by the mobile secure payment approval server, an authentication result value which is an encrypted second copy from a payment intermediation server; Determining, by the mobile secure payment approval server, whether the received second authentication result is identical to the first authentication result using the private key; If the second authenticator authentication result and the first authenticator result match, decrypting the encrypted payment information using the private key and transmitting the decrypted payment information to the payment intermediation server; Transmitting, by the payment broker server, the purchase information and the received payment information to a purchase company server; And the purchaser server provides a mobile secure payment method comprising the step of performing the payment approval based on the received information.

In order to achieve the above object, the present invention, when a purchase is made, receives a callback message including mobile secure payment authentication server access URL information, receives a user input for executing a mobile secure payment method driving program through the message, Run the mobile secure payment method driving program to access the mobile secure payment authentication server according to the mobile secure payment authentication server URL information, and if the authentication is completed, the mobile secure payment approval server through the mobile secure payment method driving program A mobile communication terminal for encrypting the payment information including the payment means and the first authenticity authentication result with the public key of the mobile terminal;

Receive purchase information, receive a mobile secure payment password from the mobile communication terminal, perform authentication of a buyer based on the received mobile secure payment password, and receive the encrypted payment information and the encrypted information from the mobile communication terminal. A mobile secure payment authentication server configured to receive a first authentication result result, transmit the encrypted first authentication result to an external server, and transmit the first authentication result to the mobile secure payment approval server; Receiving an encrypted second authentication result value from a payment intermediation server and using the private key of the mobile secure payment approval server, whether the received second authentication result is identical to the first authentication result A mobile secure payment approval server for determining, and if the second authentication result is identical to the first authentication result, the mobile payment settlement server decrypts the encrypted payment information using the private key and transmits the encrypted payment information to the payment intermediation server; A payment intermediation server for transmitting the purchase information and the received payment information to a purchase company server; And it provides a mobile secure payment system comprising a purchaser server for performing the payment approval based on the received information.

According to an embodiment of the present invention, the mobile secure payment server is divided into a server for identity authentication and a server for payment approval, thereby enabling efficient management of the mobile secure payment system.

On the other hand, the mobile terminal can encrypt the payment information and the authentication result with a public key, and only the mobile secure payment approval server can decrypt the encrypted data using the private key. The effect of preventing the leakage of information can be obtained, thus ensuring the stability and reliability of transactions.

In addition, since payment is made through a mobile communication terminal, it can provide convenience and convenience to a customer.

1 is a block diagram of a mobile secure payment system related to an embodiment of the present invention.
2 is a view for explaining a mobile secure payment method related to an embodiment of the present invention.
3 is a flowchart illustrating a mobile secure payment method according to an embodiment of the present invention.
4 is a view for explaining a method of encrypting with a private key of a customer according to an embodiment of the present invention.

The terms used in this specification will be briefly described and the present invention will be described in detail.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. In addition, in certain cases, there is also a term arbitrarily selected by the applicant, in which case the meaning will be described in detail in the description of the invention. Therefore, the terms used in the present invention should be defined based on the meanings of the terms and the contents throughout the present invention, rather than the names of the simple terms.

Throughout the specification, the purchase information means information on a purchase history of the customer. The purchase information includes information on a purchased product (product code, date of manufacture, expiration date, product price, manufacturer, color, size, product quantity, etc.), information on the affiliated store (name of affiliated store, affiliated store owner, location of affiliated store, affiliated store telephone number) Etc.), information about a purchase date and time may be included.

Payment information throughout the specification refers to information necessary for payment for the purchased goods. When the customer pays with a credit card, the payment information may include information such as a card number, an expiration date, a CVC value, a payment card company, a payment bank, an installment status, and an installment month. On the other hand, when the customer wants to pay through account transfer, the payment information may include information such as bank account number, bank name, branch name that opened the bank account.

In the entire specification, the authentication result of the user means that the customer confirms the purchase information, the payment information, and the like, so that the purchase information and the payment information are correct, and thus the customer's own authentication result content is desired. The identity verification result value may be generated by a customer inputting a mobile secure payment (ISP) password using a mobile communication terminal.

In addition, the first authentication result in the entire specification means a self-authentication result value transmitted by the mobile secure payment authentication server to the external server, the second authentication result is the mobile payment authentication server from the payment intermediation server Receives the result of identity verification. In other words, the first authentication result and the second authentication result should not differ in content. Therefore, when the difference in the result value, it can be seen that the second identity verification result value is a forgery or tampering result value during the transmission process.

Throughout the specification, encryption refers to the conversion of information into an unknown format (password). The information can be protected by storing the information in a form of cipher text in a storage device or transmitting it through a communication line.

Meanwhile, decryption throughout the specification refers to a process of converting a cipher text into plain text by an encryption algorithm as a reverse process of the encryption process.

Throughout the specification, the public key refers to a key that is public among asymmetric key pairs used in public key-based cryptography. It is mainly used for authenticity in signature systems.

The public key cryptography method discloses the encryption key among the encryption key and the decryption key that decrypts the encryption to the outside, and the other party sends information using the public encryption key, It is an information encryption method that can decrypt the received information using the decryption key. In this case, in the public key cryptography method, the encryption key and the decryption key are different from each other, and thus the decryption key cannot be determined by the public encryption key. The public key infrastructure (PKI) encryption algorithm may include RSA, LUC, Diffie-Hellman, Elliptic Curve, and the like.

In addition, in the specification, a private key refers to an undisclosed key used only by an individual among asymmetric key pairs of an individual. It is an encryption key that only knows each other that exchanges secret messages. If one of them loses the key, it causes a danger to the system. To solve this problem, there is a combination of secret and public keys.

On the other hand, throughout the specification, message digest (MD) converts a given information (message) into a very large numeric value (hash value) within a certain length using a one-way hash function. When this information is sent along with the cipher text, this message digest (MD) is sent. The recipient receives the decrypted information, creates a plain text, obtains its hash value, Check if it matches. If the values are the same, it can be confirmed that the information has not changed during the transmission of the information. Of course, this hash value can be transmitted encrypted by an encryption algorithm. The message digest (MD) algorithm may include Snefru, CRC-32, CRC-16, MD2, MD4, MD5, SHA, Haval, and the like.

Hereinafter, with reference to the accompanying drawings will be described in detail with respect to the mobile secure payment method and system according to an embodiment of the present invention.

1 is a block diagram of a mobile secure payment system related to an embodiment of the present invention.

As shown in FIG. 1, according to an embodiment of the present invention, the mobile secure payment system 100 is a mobile communication terminal 110, a merchant server 120, and a mobile secure payment authentication server 130 through a network. The mobile secure payment approval server 140, the payment intermediation server 150, and the purchaser server 160 may transmit or receive information between each other.

The mobile communication terminal 110 is capable of accessing the mobile secure payment authentication server 130 and authenticating by executing a mobile secure payment method driving program (VM), of the mobile secure payment authentication server 130 The public key can encrypt the payment information and the first authentication result. In addition, the mobile communication terminal 110 may generate a digital signature using a private key of a customer.

The mobile communication terminal 110 may be implemented in various forms. For example, the mobile communication terminal 110 described herein may be a mobile phone, a smart phone, a personal digital assistant (PDA), a portable multimedia player (PMP), navigation, an e-book terminal, and the like. .

The affiliated server 120 refers to a server of an affiliated store that sells goods to a customer, and the affiliated server 120 may be plural.

The mobile secure payment authentication server 130 is a server for performing an authentication by the mobile secure payment (ISP) password received from the mobile communication terminal 110 and generating a result of the authentication. The mobile secure payment authentication server 130 provides the identity verification result value to the mobile communication terminal 110 so that the mobile communication terminal 110 can encrypt the identity verification result value.

The mobile secure payment authentication server 130 is the payment information encrypted with the public key of the mobile secure payment approval server 140 transmitted by the mobile communication terminal 110 in the database, the mobile secure payment approval server 140 The authentication result value, which is the first copy encrypted with the public key, the message digest payment information, the authentication result value which is the message digested first, the synthesis message digested, and the synthesis information encrypted after the message digest may be stored.

The mobile secure payment approval server 140 is a server for approval of payment, and the first result received from the mobile secure payment approval server 130 is the authentication result value and the first payment received from the payment broker server 150. It is possible to determine whether two authentication results match.

The payment intermediation server 150 is a server that can play a role of intermediary so that payment can be made in the middle of the merchant server 120 and the purchase company server 150. The payment intermediation server 150 may be a single server or may be composed of a plurality of servers. For example, the payment intermediation server 150 may be configured as a payment gateway 151 and a value-added network (VAN) server 152.

The payment server 151 is a credit that a buyer transacts on behalf of a seller (shopping mall) so that a buyer can use a credit card or transfer money on the internet for payment in an electronic commerce through an internet shopping mall or the like. It is a kind of electronic payment agency that provides a service that collects a payment from a card company or a bank, removes a certain fee, and pays the rest to the seller.

The value-added network (VAN) provides voice or data information that has added value such as accumulating, processing, and converting information beyond a simple transmission function by directly owning a line or renting or using a line of a carrier. A comprehensive and complex set of services.

The purchaser server 160 refers to a server of a purchaser that can substantially pay a payment. The purchase company server 160 may include a credit card company server, financial company server, and the like.

2 is a view for explaining a mobile secure payment method related to an embodiment of the present invention.

The customer selects a product to purchase through home shopping, internet shopping, and the like, and the customer requests a payment through a method such as calling the affiliated store. In this case, the customer may request to make a mobile secure payment while providing his mobile communication terminal number. When the customer visits the merchant directly and makes a payment or makes a secure payment on the Internet, the leakage of personal information of the customer may not be a problem. However, when a customer places a telephone order or the like, the customer must provide the merchant with the payment information including the card number, and in this case, since the personal information of the customer may be leaked, the mobile secure payment method may be used. There is a need.

When the mobile secure payment request is received, the mobile communication terminal 110 may receive a callback message including mobile secure payment authentication server access URL information. Callback URL SMS refers to a service that leaves an Internet URL through a short message service (SMS) and automatically connects to a wireless Internet site at the corresponding address when a mobile phone user presses a call button.

The mobile communication terminal 110 may have a mobile secure payment method driving program installed. The mobile secure payment method driving program may be terminal application software such as a virtual machine (VM). Hereinafter, for convenience, the mobile secure payment method driving program will be referred to as a VM or a virtual machine (VM). When the VM is not installed in the mobile communication terminal 110, it may be possible to install the VM through a wireless application protocol (WAP) connection. WAP (wireless application protocol) refers to a communication protocol designed to allow a mobile terminal such as a mobile communication device, a personal digital assistant (PDA), or a wireless terminal to access the Internet.

The mobile communication terminal 110 may access the mobile secure payment authentication server 130 using an application program executed on a virtual machine (VM).

On the other hand, when the identity authentication is completed, the mobile communication terminal 110 is the payment information and the first person authentication result with the public key of the mobile secure payment approval server 140 through the mobile secure payment method driving program (VM) It can also be used to encrypt values.

The affiliated store server 120 may transmit the purchase information to at least one of the mobile secure payment authentication server 130 and the payment broker server 150. In this case, the mobile secure payment authentication server 130 may receive the purchase information directly from the affiliated store server 120, or the purchase server server 120 transmits the purchased information to the payment brokerage server 150. It is also possible to receive from the payment intermediation server 150.

In addition, the affiliated store server 120 may receive the authentication result value of the encrypted first copy from the mobile secure payment authentication server 130, and transmits the received authentication result value of the encrypted first copy to the payment intermediation server. 150 can be sent as it is.

The mobile secure payment authentication server 130 receives a mobile secure payment (ISP) password from the mobile communication terminal 110, and authenticates the customer's identity based on the received Internet Secure Payment (ISP) password. Can be performed.

In addition, the mobile secure payment authentication server 130 receives the encrypted payment information and the authentication result value of the first encrypted from the mobile communication terminal 110, and the authentication result value of the first encrypted encrypted Can be sent to an external server. The external server may be at least one of the affiliated store server 120 and the payment broker server 150.

Meanwhile, the mobile secure payment approval server 140 may receive a first authentication result from the mobile secure payment authentication server 130. In addition, the mobile secure payment approval server 140 may receive an authentication result value, which is an encrypted second copy, from the payment intermediation server 150. In this case, the mobile secure payment approval server 140 may decrypt the second authenticator authentication result with a private key and determine whether the received second authenticator authentication result matches the first authenticator authentication result. have. According to one embodiment of the present invention, when the second authenticator authentication result and the first authenticator authentication result match, the mobile secure payment approval server 140 sends the mobile secure payment authentication server 130 to the Encrypted payment information can be requested and received.

According to another embodiment of the present invention, when the mobile secure payment approval server 140 receives the first authentication result from the mobile secure payment authentication server, the encrypted payment information may also be received.

When the second authenticator authentication result and the first authenticator authentication result match, the mobile secure payment approval server 140 uses the private key of the mobile secure payment approval server 140 to encrypt the encrypted payment information. Decryption may be transmitted to the payment broker server 150.

The settlement brokerage server 150 may receive the purchase information from the affiliated store server 120. In addition, the payment intermediation server 150 may receive the decrypted payment information from the mobile secure payment approval server 140. In this case, the payment intermediation server 150 may transmit the purchase information and the received payment information to the purchase company server 160.

The purchase company server 160 receives the purchase information and payment information from the payment intermediation server 150, and performs payment authentication based on this.

3 is a flowchart illustrating a mobile secure payment method according to an embodiment of the present invention.

An embodiment of the present invention shown in FIG. 3 will be described with reference to the mobile secure payment system shown in FIG. 2.

According to an embodiment of the present invention, when the customer provides a mobile communication terminal number to the affiliated store server 120 to use mobile secure payment, the mobile communication terminal 110 is a mobile secure payment authentication server 130 A call-back message including URL information may be received from the affiliated store server 120 (S301). When the customer receives the callback message, the customer may check the purchase information, and if the purchase information is correct, the customer may input to execute the mobile secure payment method driving program (VM). In this case, the mobile communication terminal is able to access the mobile secure payment authentication server 130 according to the URL information by executing the VM (S303).

According to one embodiment of the present invention, the mobile secure payment authentication server 130 may receive the purchase information from the affiliated store server 120 or the payment broker server 150 (S305). In addition, the mobile secure payment authentication server 130 may transmit the purchase information to the mobile communication terminal (110). At this time. The customer may check the received purchase information, and if the purchase information is correct, the customer may input payment information such as a card type, a card number, and an installment month. If the payment information is correctly entered, the customer enters the mobile secure payment (ISP) password. The mobile secure payment authentication server 130 performs an authentication process through receiving an input of a mobile secure payment (ISP) password (S307).

When the identity is authenticated through the input of the ISP password, the payment information and the first authentication result may be encrypted by the mobile communication terminal 110 with the public key of the mobile secure payment approval server 140 ( S309). The first authentication result value may include data such as the mobile secure payment (ISP) password verification value, mobile secure payment serial number (ISP Serial No.), information and transaction authentication OTP (One Time Password).

The mobile secure payment authentication server 130 may receive the encrypted payment information and the first authentication result from the mobile communication terminal 110 (S311). In this case, the mobile secure payment authentication server 130 separates the encrypted payment information and the encrypted first authentication result and transmits only the encrypted first authentication result to the external server. (S313). According to one embodiment of the present invention, since the encrypted payment information is not transmitted to the external server, it is possible to more securely protect the personal information of the customer.

The external server refers to all servers except the mobile secure payment authentication server 130 and the mobile secure payment approval server 140. That is, the external server may include the affiliated store server 120 and the payment broker server 150. In addition, since the payment broker server 150 may be composed of a plurality of servers, there may be a first broker server, a second broker server, etc., which may be a payment server and a VAN server.

Therefore, according to an embodiment of the present invention, the mobile secure payment authentication server 130 may send the encrypted result of authentication being the first copy to the affiliated store server 120. In this case, the affiliated store server 120 may transmit the received authentication result, which is the first encrypted copy, to the payment broker server 150 again.

According to another embodiment of the present invention, the mobile secure payment authentication server 130 may transmit the authentication result value of the encrypted first copy to the payment intermediation server 150. In this case, if the payment intermediation server 150 is composed of a plurality of servers, the first intermediary server receives the authentication result value of the first encrypted encrypted from the mobile secure payment authentication server 130, the second You can also send it to an intermediary server. Details thereof will be described later.

The mobile secure payment authentication server 130 may reduce the leakage of personal information of the customer by transmitting only the authentication result value, which is the encrypted first copy except the payment information, to the external server. In addition, the external server does not need to confirm the contents of the first authentication result itself, however, it does not matter if the external server receives only the authentication result value of the encrypted first copy.

The mobile secure payment approval server 140 may receive an authentication result value of the first person from the mobile secure payment authentication server 130 (S315). The first authentication result value may or may not be encrypted. In addition, the mobile secure payment approval server 140 may receive an authentication result value of the encrypted second copy from the payment intermediation server 150 (S317).

In this case, since the mobile secure payment approval server 140 can decrypt the encrypted second authentication result with its own private key, whether the first authentication result is identical to the second authentication result. It can be determined (S319).

If it does not match, because the forgery or tampering with the result of the personal authentication is made, the mobile secure payment authentication server 130 will not proceed any further process for secure payment.

If the decrypted first authentication result is identical to the second authentication result, the mobile secure payment authentication server 130 uses the private key of the mobile secure payment authentication server 130 for the payment information. Decrypt

Since the encrypted payment information, the first authentication result, etc. are stored in the mobile secure payment authentication server 130, the mobile secure payment approval server 140 makes a request for providing the encrypted payment information whenever necessary. can do. Therefore, according to an embodiment of the present invention, the mobile secure payment approval server 140 first determines whether the first authenticator authentication result and the second authenticator authentication result value match, and the encrypted only if they match. Payment information may be requested (S321).

According to another embodiment of the present invention, the mobile secure payment approval server 140 receives the encrypted payment information when receiving the first authentication result from the mobile secure payment authentication server 130. Can be.

If the decrypted first authenticator authentication result and the second authenticator authentication result coincide with each other, the mobile secure payment approval server 140 transmits the decrypted payment information and the first authenticator authentication result to the payment intermediation server. Can be transmitted to 150 (S323).

However, if the payment intermediation server 150 includes a plurality of servers, the decrypted information is transmitted to the server that transmitted the encrypted second authentication result to the mobile secure payment approval server 140. I can do it.

The payment broker server 150 receives the decrypted data from the mobile secure payment approval server 140, and receives the purchase information from the affiliated store server 120. Therefore, the payment intermediation server 150 transmits the received payment information and purchase information to the purchase company server 160, and makes a payment approval request (S325).

The purchase company server 160 proceeds with the payment approval process based on the payment information and the purchase information received from the payment intermediation server 150 (S327).

According to an embodiment of the present invention, the payment intermediation server 150 may be configured as the payment server 151 and the VAN server 152. Hereinafter, the mobile secure payment method in the case where the payment intermediation server 150 is composed of the payment server 151 and the VAN server 152 will be described in detail.

According to one embodiment of the present invention, the encrypted first authentication result is transmitted from the mobile secure payment authentication server 130 to the shopping mall server 120, the shopping mall server 120 in the payment server ( 151, and from the payment server 151 to the VAN server 152. Finally, the authentication result value of the encrypted second copy may be transmitted from the VAN server 152 to the mobile secure payment approval server 140. However, if the payment intermediation server 150 is configured only with the VAN server 152, the encrypted first person authentication result value is directly transmitted from the shopping mall server 120 to the VAN server 152. will be.

According to another embodiment of the present invention, the encrypted first authentication result is transmitted from the mobile secure payment authentication server 130 to the payment server 151, the payment server 151 in the VAN Sent to server 152. After that, the encrypted second copy authentication result is transmitted from the VAN server 152 to the mobile secure payment authentication server 130.

The mobile secure payment authentication server 130 compares the authentication result value of the first copy with the authentication result value of the second copy received from the VAN server 152 to determine whether the result is the same. In this case, the mobile secure payment approval server 140 may decode and transmit the payment information and the first authentication result value to the VAN server 152.

Meanwhile, the VAN server 152 may receive the purchase information from the payment server 151 or the mobile secure payment verification server 130. Accordingly, the VAN server 152 may transmit the received payment information, purchase information, and the like to the purchaser server 160.

On the other hand, in one embodiment of the present invention, the mobile secure payment method may further include encrypting with a private key of the customer in order to prevent denial of the transaction of the customer. This will be described with reference to FIG. 4.

4 is a view for explaining a method of encrypting with a private key of a customer according to an embodiment of the present invention.

As shown in FIG. 4, according to one embodiment of the present invention, the mobile communication terminal 110 may perform a message digest on the payment information (S410). In addition, the mobile communication terminal 110 may also perform a message digest on the purchase information received from the affiliated store server 120 or the mobile secure payment authentication server 130 (S420).

In this case, the mobile communication terminal 110 may encrypt the composite information about the message digested payment information and the message digested purchase information with a private key of a customer (S430). As such, encrypting the information with the customer's private key can only be performed by the customer with the private key, so that the customer can prove that the order was made by the payment method, thereby preventing the customer from denying the transaction. have. This is a kind of electronic signature, called a digital signature. This enables more stable commerce.

The mobile secure payment authentication server 130 may include the message digest payment information, the message digest purchase information, the message digest composite information, and the message digest synthesized after the message digest from the mobile communication terminal 110. It can be received for (S440). In this case, the mobile secure payment authentication server 130 may store the information in a database (S450).

After the message is digested, the encrypted composite information is decrypted with the public key of the customer, and the purchase information and the transaction information are digested to confirm whether the message is matched, thereby preventing the customer from denying the transaction. Thus, the mobile secure payment authentication server 130 ), And if necessary, it can be transmitted to another external server and the mobile secure payment approval server 140 if necessary.

Those skilled in the art to which the present invention pertains will understand that the above-described present invention can be implemented in other specific forms without changing the technical spirit or essential features.

Therefore, it is to be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

100: mobile secure payment system
110: mobile communication terminal
120: merchant server
130: Mobile Secure Payment Authentication Server
140: Mobile Secure Payment Approval Server
150: payment broker server
151: payment server
152: VAN Server
160: purchase company server

Claims (6)

When the purchase is made, receiving, by the mobile communication terminal, a callback message including mobile secure payment authentication server access URL information;
When the mobile communication terminal receives a user input for executing a mobile secure payment method driving program through the message, the mobile terminal executes the mobile secure payment method driving program according to the mobile secure payment authentication server URL information. Accessing the mobile secure payment authentication server;
Receiving, by the mobile secure payment authentication server, purchase information;
Receiving, by the mobile secure payment authentication server, a mobile secure payment password from the mobile communication terminal;
Performing, by the mobile secure payment authentication server, the purchaser's own authentication based on the received mobile secure payment password;
When the identity authentication is completed, the mobile communication terminal to the public key of the mobile secure payment approval server through the mobile secure payment method driving program Encrypting payment information including payment means, and encrypting a first identity authentication result value with a public key of the mobile secure payment approval server;
Message digesting the payment information by the mobile communication terminal;
Message digesting the purchase information by the mobile communication terminal;
Encrypting, by the mobile terminal, composite information including the message digested payment information and the message digested purchase information with a private key of a customer;
The mobile secure payment authentication server is encrypted after the encrypted payment information, the encrypted first copy authentication result value, the message digested payment information, the message digested purchase information, and the message digested from the mobile communication terminal. Receiving the synthesis information;
Transmitting, by the mobile secure payment authentication server, an authentication result value of the first encrypted copy to an external server;
Transmitting, by the mobile secure payment authentication server, the first authentication result and the payment information to the mobile secure payment approval server;
Receiving, by the mobile secure payment approval server, an authentication result value which is an encrypted second copy from a payment intermediation server;
Determining, by the mobile secure payment approval server, whether the received second authentication result is identical to the first authentication result using the private key;
If the second authenticator authentication result and the first authenticator result match, decrypting the encrypted payment information using the private key and transmitting the decrypted payment information to the payment intermediation server;
Transmitting, by the payment broker server, the purchase information and the received payment information to a purchase company server; And
And a step of performing the payment approval on the basis of the received information by the purchaser server. The method of claim 1, wherein the external server
Mobile secure payment method comprising at least one of a merchant server and the payment broker server. delete When a purchase is made, a callback message including mobile secure payment authentication server access URL information is received, a user input for executing a mobile secure payment method driving program is received through the message, and the mobile secure payment method driving program is executed. Access to the mobile secure payment verification server according to the mobile secure payment verification server URL information, and if the authentication is completed, a payment including a payment means as a public key of the mobile secure payment approval server through the mobile secure payment method driving program; A mobile communication terminal for encrypting the information and the first authentication result;
Receive purchase information, receive a mobile secure payment password from the mobile communication terminal, perform authentication of a buyer based on the received mobile secure payment password, and receive the encrypted payment information and the encrypted information from the mobile communication terminal. A mobile secure payment authentication server configured to receive a first authentication result result, transmit the encrypted first authentication result to an external server, and transmit the first authentication result to the mobile secure payment approval server;
Receiving an encrypted second authentication result value from a payment intermediation server and using the private key of the mobile secure payment approval server, whether the received second authentication result is identical to the first authentication result A mobile secure payment approval server for determining and if the second authentication result is identical to the first authentication result, the mobile payment settlement server decrypts the encrypted payment information using the private key and transmits the encrypted payment information to the payment intermediation server;
A payment intermediation server for transmitting the purchase information and the received payment information to a purchase company server; And
Includes a purchase company server for performing the payment approval based on the received information,
The mobile communication terminal message digests the payment information, message digests the purchase information, encrypts the synthesized information including the message digested payment information and the message digested purchase information with a private key of a customer, and the message digest. Payment information, the message digested first authentication result value, and the synthesized encrypted information after the message digest is transmitted to the mobile secure payment authentication server. The method of claim 4, wherein the mobile secure payment system
Further comprising a merchant server that receives payment requests from customers,
The external server is secure mobile payment system, characterized in that it comprises at least one of the merchant server and the payment broker server. delete

Images