WO2023128341A1

WO2023128341A1 - Method and system for fraudulent transaction detection using homomorphically encrypted data

Info

Publication number: WO2023128341A1
Application number: PCT/KR2022/019464
Authority: WO
Inventors: 안용대; 박준홍
Original assignee: 주식회사 디사일로
Priority date: 2021-12-30
Filing date: 2022-12-02
Publication date: 2023-07-06
Also published as: KR102448625B1

Abstract

The present invention relates to a method and system for fraudulent transaction detection using homomorphically encrypted data. The method comprises the steps of: acquiring first location data of a user who has requested a financial service; homomorphically encrypting the first location data; transmitting the first homomorphically encrypted location data to a device that can acquire the location of the user; receiving, from the device, homomorphically encrypted identity information that is computed on the basis of the first homomorphically encrypted location data and second location data of the user; decrypting the homomorphically encrypted identity information; and determining, on the basis of the identity information, whether to provide the financial service.

Description

Fraudulent transaction detection method and system using homomorphic encrypted data

The present invention relates to a method and system for detecting fraudulent transactions using homomorphic encrypted data.

As the channels that provide payment for financial transactions diversify, fraudulent use of non-face-to-face transactions is increasing at a rapid rate. In particular, a financial institution or electronic financial business operator provides financial services through a computing device, so that the user does not face or communicate directly with the employees of the financial institution or electronic financial business operator, and provides real-time financial services in an automated manner. is increasing

Accordingly, the importance of methods for detecting and predicting fraudulent use in non-face-to-face transactions is increasing day by day, and recently, a system for detecting fraudulent transactions using machine learning and deep learning has been developed.

Although numerous fraudulent transaction cases can be detected through this system, it is difficult to detect one-time fraudulent transaction cases in which a user who illegally acquires another person's payment method that has not been reported lost or canceled uses it to withdraw cash or purchase a product. There are downsides.

The background description of the invention has been prepared to facilitate understanding of the present invention. It should not be construed as an admission that matters described in the background art of the invention exist as prior art.

Accordingly, there is a need for a new method of collecting location data that cannot be falsified while an illegal transaction is in progress and identifying whether a user who has requested a current financial service is a legitimate user.

As a result, the inventors of the present invention tried to develop a method for identifying a user through an operation between location data of an ATM or POS terminal and location data of a user corresponding to a payment means, and a system for performing the same.

In particular, the inventors of the present invention configured a method so that the user's personal information is not exposed by homomorphically encrypting two location data and then obtaining a result of homomorphic encryption of the user identification result (identity information).

The tasks of the present invention are not limited to the tasks mentioned above, and other tasks not mentioned will be clearly understood by those skilled in the art from the following description.

In order to solve the above problems, a fraudulent transaction detection method using homomorphic encrypted data according to an embodiment of the present invention is provided. The method may include obtaining first location data of a user requesting a financial service, homomorphically encrypting the first location data, and transmitting the homomorphically encrypted first location data to a device capable of obtaining the location of the user. Receiving, from the device, homomorphically encrypted identity information calculated based on the homomorphically encrypted first location data and the second location data of the user, decrypting the homomorphically encrypted identity information, and the identity information It is configured to include the step of determining whether to provide the financial service based on.

According to a feature of the present invention, the step of transmitting the homomorphically encrypted first location data further comprises transmitting to the device parameters for a homomorphic encryption operation used to homomorphically encrypt the first location data. can do.

According to another feature of the present invention, the homomorphically encrypted identity information may be an operation result based on the homomorphically encrypted first location data and the homomorphically encrypted second location data based on the parameters.

According to another feature of the present invention, the device capable of acquiring the user's location includes a user device possessed by the user, a base station server providing communication services to the user device, and a wireless Internet service providing wireless Internet service to the user device. It can be any one of the communication devices.

According to another feature of the present invention, the first location data includes a request time point of the financial service and location data of a device providing the financial service, and the second location data includes the request time point and the request time point. Location data of the user at the point of view may be included.

According to another feature of the present invention, the step of determining whether to provide a financial service, if the location data of the device and the location data of the user are the same, providing a financial service, and the location data of the device and the location data of the user If the location data is not the same, limiting the financial service may be further included.

According to another feature of the present invention, the homomorphic encryption step uses any one of partial homomorphic encryption, somewhat homomorphic encryption, and fully homomorphic encryption. It may be a step of performing homomorphic encryption.

In order to solve the above problems, an illegal transaction detection method using homomorphic encrypted data according to another embodiment of the present invention is provided. The method may include receiving an operation request including first location data of a user that is homomorphically encrypted from a bank server providing a financial service, obtaining second location data of the user according to the operation request, and performing the homomorphic encryption. and calculating homomorphically encrypted identity information based on the first location data and the second location data, and transmitting the homomorphically encrypted identity information to a bank server.

According to a feature of the present invention, the receiving of the operation request further comprises receiving parameters for a homomorphic encryption operation, used to homomorphically encrypt the first location data, from the device, wherein the obtaining The step may further include homomorphically encrypting the second location data based on the parameter.

According to another feature of the present invention, the calculating of the homomorphically encrypted identity information includes determining a first location corresponding to the homomorphically encrypted first location data and a second location corresponding to the second location data. and calculating a distance value between the first location and the second location corresponding to the identification result.

According to another feature of the present invention, the calculating of the homomorphically encrypted identity information may include, when the distance value is within a preset range, the first location data and the second location data are regarded as identical to a preset single location data. Determining a reference value of , and when the distance value is outside a preset range, determining a value other than the reference value for determining that the first location data and the second location data are not identical. there is.

In order to solve the above problems, a fraudulent transaction detection method using homomorphic encrypted data according to another embodiment of the present invention is provided. The method includes acquiring a user's request for using a financial service, homomorphically encrypting previously stored location data according to the request for using a financial service, and transmitting the homomorphically encrypted location data to a device capable of obtaining the user's location. , Receiving homomorphically encrypted identity information calculated based on the homomorphically encrypted location data and the location data of the user from the device, decrypting the homomorphically encrypted identity information, and the financial information based on the identity information. It is configured to include the step of determining whether to provide a service.

Other embodiment specifics are included in the detailed description and drawings.

The present invention can prevent fraudulent transactions in a non-face-to-face financial service providing system by using location data that cannot be forged or altered. In particular, according to the present invention, the user's personal information (location data) can be safely protected by homomorphically encrypting the location data and obtaining identity information of the location data in a state of homomorphic encryption.

Effects according to the present invention are not limited by the contents exemplified above, and more various effects are included in the present invention.

1 is a schematic diagram of a fraudulent transaction detection system according to an embodiment of the present invention.

2 is a block diagram showing the configuration of a device for providing financial services according to an embodiment of the present invention.

3 is a block diagram showing the configuration of a bank server managing financial services according to an embodiment of the present invention.

4 is a flowchart of a fraudulent transaction detection method using a bank server according to an embodiment of the present invention.

5 is a block diagram showing the configuration of a device for user location identification according to an embodiment of the present invention.

6 is a flowchart of a fraudulent transaction detection method using a user location identification device according to an embodiment of the present invention.

7 and 8 are schematic flowcharts of a fraudulent transaction detection method using the fraudulent transaction detection system according to an embodiment of the present invention.

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and will be implemented in various forms different from each other, only these embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention pertains. It is provided to completely inform the person who has the scope of the invention, and the present invention is only defined by the scope of the claims. In connection with the description of the drawings, like reference numerals may be used for like elements.

In this document, expressions such as "has," "may have," "includes," or "may include" indicate the existence of a corresponding feature (eg, numerical value, function, operation, or component such as a part). , which does not preclude the existence of additional features.

In this document, expressions such as “A or B,” “at least one of A and/and B,” or “one or more of A or/and B” may include all possible combinations of the items listed together. . For example, “A or B,” “at least one of A and B,” or “at least one of A or B” (1) includes at least one A, (2) includes at least one B, Or (3) may refer to all cases including at least one A and at least one B.

Expressions such as “first,” “second,” “first,” or “second,” used in this document may modify various elements, regardless of order and/or importance, and refer to one element as It is used only to distinguish it from other components and does not limit the corresponding components. For example, a first user device and a second user device may represent different user devices regardless of order or importance. For example, without departing from the scope of rights described in this document, a first element may be named a second element, and similarly, the second element may also be renamed to the first element.

A component (e.g., a first component) is "(operatively or communicatively) coupled with/to" another component (e.g., a second component); When referred to as "connected to", it should be understood that the certain component may be directly connected to the other component or connected through another component (eg, a third component). On the other hand, when an element (eg, a first element) is referred to as being “directly connected” or “directly connected” to another element (eg, a second element), the element and the above It may be understood that other components (eg, third components) do not exist between the other components.

As used in this document, the expression "configured to" means "suitable for," "having the capacity to," depending on the circumstances. ," "designed to," "adapted to," "made to," or "capable of." The term "configured (or set) to" may not necessarily mean only "specifically designed to" hardware. Instead, in some contexts, the phrase "device configured to" may mean that the device is "capable of" in conjunction with other devices or components. For example, the phrase "a processor configured (or configured) to perform A, B, and C" may include a dedicated processor (e.g., embedded processor) to perform those operations, or by executing one or more software programs stored in a memory device. , may mean a general-purpose processor (eg, CPU or application processor) capable of performing corresponding operations.

Terms used in this document are only used to describe a specific embodiment, and may not be intended to limit the scope of other embodiments. Singular expressions may include plural expressions unless the context clearly dictates otherwise. Terms used herein, including technical or scientific terms, may have the same meaning as commonly understood by a person of ordinary skill in the art described in this document. Among the terms used in this document, terms defined in a general dictionary may be interpreted as having the same or similar meaning as the meaning in the context of the related art, and unless explicitly defined in this document, an ideal or excessively formal meaning. not be interpreted as In some cases, even terms defined in this document cannot be interpreted to exclude the embodiments of this document.

Each feature of the various embodiments of the present invention can be partially or entirely combined or combined with each other, and as those skilled in the art can fully understand, various interlocking and driving operations are possible, and each embodiment can be implemented independently of each other. It may be possible to implement together in an association relationship.

For clarity of interpretation of this specification, terms used in this specification will be defined below.

Referring to FIG. 1 , a fraudulent transaction detection system 1000 may include a device 100 for providing financial services, a bank server 200, and a device 300 for identifying a user's location.

The fraudulent transaction detection system 1000 may identify whether a user who wants to use a non-face-to-face financial service is a legitimate user by using location data. Specifically, the fraudulent transaction detection system 1000 compares the location data of the user requesting the non-face-to-face financial service with the location data of the user who issued the payment means that can use the non-face-to-face financial service, and compares the location data of the user who currently requested the non-face-to-face financial service. It may be determined whether is the same user as user B who issued the payment method.

For example, the fraudulent transaction detection system 1000 detects user B's location data acquired by the financial service providing device 100 in a situation where user A, who has fraudulently obtained user B's payment method, attempts to withdraw cash. Whether or not the location data of the user B obtained through the identification device 300 is the same may be determined. Accordingly, when the two location data are not the same, the device 100 for providing financial services may block cash withdrawal.

In the fraudulent transaction detection system 1000, the device for providing financial services 100, the bank server 200, and the device for identifying the user's location 300 can exchange all data in an encrypted state, and the device for providing financial services ( 100), the bank server 200, and the device for user location identification 300 may encrypt data through a homomorphic encryption technique to enable data operation in an encrypted state.

That is, in the fraudulent transaction detection system 1000, the data exchanged between the financial service provision device 100, the bank server 200, and the user location identification device 300 is homomorphic encrypted data, not a data source, The original data can be stored in each device.

At least two of the financial service providing device 100, the bank server 200, and the user location identification device 300 may homomorphically encrypt data using a web page or application/program capable of processing homomorphic encrypted data, , operations between homomorphic encrypted data can be performed. At least two of the financial service providing device 100, the bank server 200, and the user location identification device 300 may perform an operation between homomorphic ciphertext or between homomorphic ciphertext and plaintext, using various homomorphic encryption algorithms. Location data can be homomorphically encrypted. For example, the device 100 for providing financial services, the bank server 200, and the user location identification device 300 are partially homomorphic encryption, somewhat homomorphic encryption, and fully homomorphic encryption. Homomorphic Encryption) may be used to homomorphically encrypt location data.

The device 100 for providing financial services is a device capable of providing non-face-to-face financial services to users, and may include, for example, an automatic teller machine (ATM), a card terminal (POS terminal), and the like.

The device 100 for providing financial services provides financial services (eg, cash withdrawal service, short-term cash loan service, bill payment service) to a user who presents a means of using financial services such as a bankbook or an OTP card in addition to a payment means such as a card. can provide

When obtaining a financial service use request from a user, the device 100 for providing financial services transmits the financial service use request together with its identification information (eg, device 100 serial number and location data) to the bank server 200. ) can be transmitted.

The device 100 for providing financial services may provide financial services or limit financial services depending on whether the financial services provided by the bank server 200 are provided. In addition, when the device 100 for providing financial services is an automatic teller machine, in the process of restricting financial services, a face image of a user who has illegally acquired a means of payment and means of using financial services is obtained, and transferred to the bank server 200. can be sent

In various embodiments, the device 100 for providing financial services may homomorphically encrypt its own location data using an encryption key in which the parameters are reflected, and for the homomorphic encryption operation, the bank server ( 200) can be sent. Specifically, the parameter may be a polynomial degree of a function used for homomorphic encryption operation, a scale bit designated for homomorphic encryption operation, and a coefficient.

The bank server 200 is a server of a provider providing financial services, manages a plurality of devices 100 for providing financial services, and can verify validity of a request for using financial services. For example, the bank server 200 may be implemented as a PC, tablet PC, smart phone, general-purpose computer, laptop, and cloud server.

The bank server 200 may homomorphically encrypt the location data of the financial service providing device 100 according to a request for use of a financial service, and together with the location data homomorphically encrypted by the device 300 for user location identification, a payment means or Operation with the location data of the user who issued the means of using the financial service may be requested. Here, requesting an operation may be a request to determine whether the location data of the user determined by the bank server 200 (a user located in front of the device 100 for providing financial services) is the same as the location data of the actual user, and to obtain the same result. there is.

In addition, the location data homomorphically encrypted by the bank server 200 includes the user's request for financial service and the location data of the device 100 providing the financial service, and the actual user's location data is the financial service request time point. and location data of the user at the time of request. That is, the bank server 200 may regard the location of the user requesting the financial service as the location of the device 100 for providing financial services.

The bank server 200 may transmit parameters for the homomorphic encryption operation together to the device 300 for identifying the user's location in order to request the operation of the homomorphic encrypted data. Here, the parameter is a parameter reflected by the bank server 200 in the encryption key of the homomorphically encrypted location data, and may be used for a homomorphic encryption operation.

The bank server 200 may receive identity information subjected to a homomorphic encryption operation using the previously transferred parameters from the user location identification device 300, decrypt it, and determine whether financial services are provided as a result of the decryption (identity information). can decide For example, the bank server 200 provides a financial service when the location data of the device 100 for providing financial services is the same as the location data of the actual user, and the location data of the device 100 for providing financial services and the actual user's location data. If the user's location data is not the same, financial services may be restricted.

In various embodiments, the bank server 200 may request the user's location data to the user location identification device 300 and receive the location data of the user that is homomorphically encrypted using the same parameters. That is, the bank server 200 may calculate the location data directly homomorphically encrypted by itself and the location data of the user, and may receive a decrypted result (identity information) from the device 300 for user location identification.

As such, since the bank server 200 receives the homomorphically encrypted operation result or the homomorphically encrypted user location data from the user location identification device 300, the bank server 200 and the user location identification device 300 cannot actually check the current user's location, and accordingly, the user's personal information can be safely protected.

The device 300 for user location identification is a device capable of providing location data of a user, and includes a user's portable device 300a or a server 300b or device 300b that provides a communication service to the portable device 300a. can include For example, the device 300 for user location identification includes a user device (eg, a tablet PC, a smart phone, a wearable device) possessed by a user 300a and a base station server 300b that provides a communication service to the user device 300a. ), it may be a wireless communication device (eg, Access Point) 300b that provides a wireless Internet service to the user device 300a.

The device 300 for user location identification may periodically or in real time collect location data (eg, GPS coordinates) of the user, and may match and store it with time. For example, the device 300 for user location identification is {(t ₀ , Ux ₀ , Uy ₀ ), (t ₁ , Ux ₁ , Uy ₁ ), (t ₂ , Ux ₂ , Uy ₂ ), ... , (t _N , Ux _N , Uy _N )}, a pair of location data such as may be collected and stored. Here, Ux _N and Uy _N are location information, and may be coordinate values of the user's location at t _N , respectively.

The device 300 for user location identification may receive an operation request with homomorphically encrypted location data from the financial service providing device 100 or the bank server 200 . The device 300 for user location identification calculates homomorphically encrypted identity information through an operation with the user location data in plain text form according to an operation request, or received from the device 100 for providing financial services or the bank server 200. Homomorphically encrypted identity information may be calculated by encrypting the location data of the user using an encryption key in which the parameter is reflected, and calculating two pieces of location data that are homomorphically encrypted.

In various embodiments, the device 300 for user location identification may receive a request for user location data from the financial service providing device 100 or the bank server 200 . In this case, the device 300 for user location identification generates an encryption key reflecting the parameters provided in the request process, encrypts the user's location data, and transfers the encrypted location data to the device 100 for providing financial services or the bank server. (200).

That is, when isomorphically encrypted location data is calculated in the device 300 for user location identification, decryption of the calculation result (identity information) may be performed in the device 100 for providing financial services or the bank server 200. .

In various embodiments, the financial service providing device 100, the bank server 200, and the user location identification device 300 are stored in their respective devices to reduce the burden of homomorphic encryption calculation before performing homomorphic encryption. Position data can be preprocessed. For example, the device 100 for providing financial services, the bank server 200, and the device 300 for identifying a user's location convert location data into location coordinates to calculate a similarity to the device 100 or user's location. can do. That is, each location data may be converted into designated location coordinates of a discretized grid system.

So far, the fraudulent transaction detection system 1000 according to an embodiment of the present invention has been described. According to the present invention, data exchanged between the device 100 for providing financial services, the bank server 200, and the device 300 for user location identification are all in a state of homomorphic encryption, while determining the identity of the user's location. There is no possibility of the user's actual location being exposed, and a situation in which personal information is infringed can be prevented.

Hereinafter, the device 100 for providing financial services that provides financial services based on user location data will be described.

Referring to FIG. 2 , a device for providing financial services 100 may include a memory interface 110 , one or more processors 120 and a peripheral interface 130 . Various components within the device 100 for providing financial services may be connected by one or more communication buses or signal lines.

The memory interface 110 may be connected to the memory 150 and transfer various data to the processor 120 . Here, the memory 150 is a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (eg SD or XD memory, etc.), RAM, SRAM, ROM, EEPROM, PROM, network storage storage, cloud , It may include at least one type of storage medium among blockchain databases.

In various embodiments, the memory 150 may include data constituting an interface screen for outputting a financial service processing result, unique identification information (eg, serial number), location coordinates, an algorithm for homomorphic encryption, and homomorphically encrypted location data. , parameters for homomorphic encryption operations, etc. can be stored.

In various embodiments, memory 150 includes operating system 151 , communication module 152 , graphical user interface module (GUI) 153 , sensor processing module 154 , telephony module 155 , and application module 156 . ) At least one or more of them may be stored. Specifically, the operating system 151 may include instructions for processing basic system services and instructions for performing hardware tasks. The communication module 152 may communicate with at least one of one or more other devices, computers, and servers. A graphical user interface module (GUI) 153 may process a graphical user interface. Sensor processing module 154 may process sensor-related functions (eg, process voice input received through one or more microphones 192 ). The phone module 155 may process phone-related functions. The application module 156 may perform various functions of a user application, such as electronic messaging, web browsing, media processing, navigation, imaging, and other processing functions. In addition, the device 100 for providing financial services may store one or more software applications 156-1 and 156-2 (eg, financial services and fraudulent transaction detection applications) associated with any one type of service in the memory 150. there is.

In various embodiments, memory 150 may store digital assistant client module 157 (hereinafter referred to as DA client module), and thus may store instructions for performing client-side functions of the digital assistant.

In addition, the DA client module 157 may output audio-visual and tactile data. For example, the DA client module 157 may output data consisting of a combination of at least two of voice, sound, notification, text message, menu, graphic, video, animation, and vibration. In addition, the DA client module 157 may communicate with a digital assistant server (not shown) using the communication subsystem 180 .

In various embodiments, the DA client module 157 collects additional information about the surrounding environment of the device for providing financial services 100 from various sensors, subsystems, and peripheral devices to construct a context associated with user input. can do. For example, the context information is information related to the state of the software of the device 100 for providing financial services (eg, processes running in the device 100 for providing financial services, installed programs, past and present network activity, background services, errors). logs, resource usage, etc.).

In various embodiments, the memory 150 may include added or deleted commands, and furthermore, the device 100 for providing financial services may include additional components other than the components shown in FIG. 2 or may exclude some components. there is.

The processor 120 may control overall operations of the device 100 for providing financial services, and may execute various commands for implementing a financial service interface by driving an application or program stored in the memory 150 .

The processor 120 may correspond to an arithmetic device such as a central processing unit (CPU) or an application processor (AP). In addition, the processor 120 may be implemented in the form of an integrated chip (IC) such as a System on Chip (SoC) in which various computing devices performing machine learning, such as a Neural Processing Unit (NPU), are integrated. .

In various embodiments, the processor 120 may obtain a request for using a financial service from a user presenting a means of payment or means of using a financial service through the touch screen 143 or other input controller 142 . The processor 120 may transmit a financial service confirmation request along with the corresponding request through the communication module 152 and may receive whether or not the financial service is provided from the bank server 200 again.

For example, the processor 120 may provide a financial service or limit the financial service depending on whether the financial service provided by the bank server 200 is provided. In addition, when the financial service providing device 100 is an automatic teller machine, the processor 120, in the process of limiting the financial service, uses the camera subsystem 170 to obtain a payment method or a financial service use method illegally. A face image of may be acquired and transmitted to the bank server 200 .

In various embodiments, the processor 120 may directly exchange homomorphic encrypted location data with the device 300 for user location identification instead of the bank server 200 . In this case, the processor 120 transmits the location data of the user that has been homomorphically encrypted to the device 300 for user location identification according to the user's request to use the financial service, and from the device 300 for user location identification to the user that has been homomorphically encrypted. A position calculation result (identity information) may be received. The processor 120 may decrypt the homomorphically encrypted identity information to determine whether the current user is a valid user possessing a means of payment or means of using a financial service.

The peripheral interface 130 may be connected to various sensors, subsystems, and peripheral devices to provide data so that the financial service providing device 100 can perform various functions. Here, it can be understood that the device 100 for providing financial services performs a function performed by the processor 120 .

The peripheral interface 130 may receive data from the motion sensor 160, the light sensor (light sensor) 161, and the proximity sensor 162, and through this, the device for providing financial services 100 may receive orientation, light , and proximity sensing functions can be performed. As another example, the peripheral interface 130 may receive data from other sensors 163 (positioning system-GPS receiver), through which the device for providing financial services 100 communicates with the other sensors 163. related functions can be performed.

In various embodiments, the device 100 for providing financial services may include a camera subsystem 170 connected to the peripheral interface 130 and an optical sensor 171 connected thereto, through which the device 100 for providing financial services ) can perform various shooting functions such as taking pictures and recording video clips.

In various embodiments, the device 100 for providing financial services may include a communication subsystem 180 connected to the peripheral interface 130 . The communication subsystem 180 is composed of one or more wired/wireless networks, and may include various communication ports, radio frequency transceivers, and optical transceivers.

In various embodiments, the device 100 for providing financial services includes an audio subsystem 190 connected to a peripheral interface 130, and this audio subsystem 190 includes one or more speakers 191 and one or more microphones ( 192), the device 100 for providing financial services may perform voice-activated functions, such as voice recognition, voice duplication, digital recording, and telephone functions.

In various embodiments, the device 100 for providing financial services may include an I/O subsystem 140 coupled with a peripheral interface 130 . For example, the I/O subsystem 140 may control the touch screen 143 included in the financial service providing device 100 through the touch screen controller 141 .

For example, the touch screen controller 141 uses any one of a plurality of touch sensing technologies such as capacitive, resistive, infrared, surface acoustic wave technology, proximity sensor array, and the like to provide a user's touch and motion or touch. and cessation of movement. For another example, I/O subsystem 140 may control other input/control devices 144 included in device for providing financial services 100 through other input controller(s) 142 . As an example, other input controller(s) 142 may control one or more buttons, rocker switches, thumb-wheels, infrared ports, USB ports, and pointer devices such as styluses and the like.

So far, the device 100 for providing financial services according to an embodiment of the present invention has been described. According to the present invention, the device 100 for providing financial services calculates its own location data and the user's location data using a homomorphic encryption method before providing the financial services according to the user's request for using the financial services, so that the corresponding user can access financial services. You can accurately identify whether you are a legitimate user who can use the service.

Hereinafter, the bank server 200 capable of determining whether to provide financial services will be described.

Referring to FIG. 3, the bank server 200 may include a communication interface 210, a memory 220, an I/O interface 230, and a processor 240, each of which includes one or more communication buses or signals. They can communicate with each other through lines.

The communication interface 210 may be connected to a plurality of financial service provision devices 100 and a user location identification device 300 through a wired/wireless communication network to exchange data. For example, the communication interface 210 may receive a financial service confirmation request together with location data of the device 100 considered as the user's location from the device 100 for providing financial services, and the device for providing financial services ( 100) may transmit a result of determining whether to provide financial services. For another example, the communication interface 210 may transmit homomorphically encrypted location data to the user location identification device 300 and receive homomorphically encrypted identity information from the user location identification device 300 .

On the other hand, the communication interface 210 enabling the transmission and reception of such data includes a communication pod 211 and a wireless circuit 212, where the wired communication port 211 is one or more wired interfaces, for example, Ethernet, This may include Universal Serial Bus (USB), FireWire, and the like. Also, the wireless circuit 212 may transmit/receive data with an external device through an RF signal or an optical signal. In addition, wireless communication may use at least one of a plurality of communication standards, protocols and technologies, such as GSM, EDGE, CDMA, TDMA, Bluetooth, Wi-Fi, VoIP, Wi-MAX, or any other suitable communication protocol.

The memory 220 may store various data used in the bank server 200 . For example, the memory 220 may include identification information (eg, serial number, location coordinates) of the plurality of financial service providing devices 100, a function for converting location data into a form capable of homomorphic encryption, and an algorithm for homomorphic encryption. etc. can be stored.

In various embodiments, the memory 220 may include volatile or non-volatile recording media capable of storing various data, commands, and information. For example, the memory 220 may be a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (eg SD or XD memory, etc.), RAM, SRAM, ROM, EEPROM, PROM, network storage storage , Cloud, and a blockchain database may include at least one type of storage medium.

In various embodiments, the memory 220 may store configurations of at least one of the operating system 221 , the communication module 222 , the user interface module 223 , and one or more applications 224 .

Operating system 221 (e.g. embedded operating systems such as LINUX, UNIX, MAC OS, WINDOWS, VxWorks, etc.) is a variety of software for controlling and managing general system tasks (e.g. memory management, storage device control, power management, etc.) components and drivers, and may support communication between various hardware, firmware, and software components.

The communication module 223 may support communication with other devices through the communication interface 210 . The communication module 220 may include various software components for processing data received by the wired communication port 211 or the wireless circuit 212 of the communication interface 210 .

The user interface module 223 may receive a user's request or input from a keyboard, touch screen, microphone, etc. through the I/O interface 230 and provide a user interface on a display.

Applications 224 may include programs or modules configured to be executed by one or more processors 230 . Here, an application for computing location data may be implemented on a server farm.

The I/O interface 230 may connect at least one of an input/output device (not shown) of the bank server 200, such as a display, a keyboard, a touch screen, and a microphone, to the user interface module 223. The I/O interface 230 may receive user input (eg, voice input, keyboard input, touch input, etc.) together with the user interface module 223 and process a command according to the received input.

The processor 240 is connected to the communication interface 210, the memory 220, and the I/O interface 230 to control overall operations of the bank server 200 and to run applications or programs stored in the memory 220. Through this, various commands for processing homomorphic encrypted data can be performed.

The processor 240 may correspond to an arithmetic device such as a central processing unit (CPU) or an application processor (AP). In addition, the processor 240 may be implemented in the form of an integrated chip (IC) such as a System on Chip (SoC) in which various computing devices are integrated. Alternatively, the processor 240 may include a module for calculating an artificial neural network model, such as a Neural Processing Unit (NPU).

In various embodiments, the processor 240 may determine whether the user is identical in a state in which the user's personal information is not exposed, which will be described below with reference to FIG. 4 .

Referring to FIG. 4 , the processor 240 may obtain first location data of a user who has requested a financial service (S110). Specifically, the processor 240 may obtain a financial service confirmation request along with identification information of the corresponding device 100 from the financial service providing device 100 through the communication interface 210 . For example, the processor 240 may include identification information (eg, serial number, location data (coordinates)) of the device 100 for providing financial services, information on a payment method or means of using financial services, and a request for use of financial services. information can be obtained. The processor 240 may determine the location coordinates of the device 100 as the user's first location data based on the identification information stored in the memory 220 .

In various embodiments, the processor 240 may pre-process the first location data to reduce the burden of the homomorphic encryption operation. For example, the processor 240 may convert the location data into designated location coordinates of a discretized grid system in order to calculate a degree of similarity with second location data that is a comparison target with the first location data.

After step S110, the processor 240 may homomorphically encrypt the first location data (S120). In detail, the processor 120 may homomorphically encrypt the first location data using an encryption key in which a parameter for a homomorphic encryption operation is reflected.

In various embodiments, the processor 240 receives the first location data using any one of partial homomorphic encryption, somewhat homomorphic encryption, and fully homomorphic encryption. Homomorphic encryption is possible.

After step S120, the processor 240 may transmit the homomorphically encrypted first location data to a device (device 300 for user location identification) capable of acquiring the location of the user through the communication module 152 (S130). For example, the device 300 for user location identification includes a user device 300a possessed by a user who issued a means of payment or means of using financial services, a base station server 300b providing communication services to the user device 300a, It may be a wireless access point (300b) that provides Internet service to the user device (300a).

In addition, the processor 240 may transmit an operation request including the homomorphically encrypted first location data and parameters used in the process of homomorphically encrypting the first location data to the device 300 for identifying the location of the user. For example, the parameter may be a polynomial degree of a function used for homomorphic encryption operation, a scale bit designated for homomorphic encryption operation, a coefficient, and the like.

After step S130, the processor 240 determines the homomorphically encrypted identity calculated based on the first location data that is homomorphically encrypted from the device 300 for user location identification and the second location data of the user identified based on the first location data. Information may be received (S140). Specifically, the first location data includes the location data of the financial service request time and the device 100 providing the financial service, and the user location identification device 300 is the user location data (t _N , Ux _N , Uy _N ) can be used for homomorphic encryption operations.

In various embodiments, the homomorphically encrypted identity information is a result of an operation based on the homomorphically encrypted first location data and the homomorphically encrypted second location data based on the parameters provided in step S130, or the homomorphically encrypted first location data. It may be a result calculated based on the data and the second position data in a plain text state.

That is, the first and second location data can be calculated in a homomorphic encrypted state using an encryption key to which the same parameter is reflected, and accordingly, the identification result calculated by the device 300 for user location identification can be correctly decrypted. can

After step S140, the processor 240 may decrypt the homomorphically encrypted identity information (S150). Specifically, the processor 240 may obtain identity information about whether the location of the financial service providing device 100 and the location of the user are the same.

After step S150, the processor 240 may determine whether to provide a financial service based on the identity information (S160). The processor 240 provides the financial service when the location data (first location data) of the device 100 for providing financial services and the location data (second location data) of the user are the same, and provides the device 100 for providing financial services. ) If the location data (first location data) and the user's location data (second location data) are not the same, it may be determined to limit the financial service.

In addition, the processor 240 may transmit a result of determining whether to provide financial services to the financial service providing device 100 or the user device 300b through the communication interface 210 .

In various embodiments, the processor 240 receives isomorphically encrypted location data of the user from the device 300 for user location identification through the communication interface 210, and receives the location data of the device 100 in plain text form and isomorphism. Encryption can also be performed. The processor 240 converts the two positional data converted into discretized positional coordinates into a distance similarity calculation method (eg, Euclidean distance measurement method, Minkowski distance measurement method (Minkowski distance), cosine similarity calculation method ( Cosine Similarity), mean squared difference similarity calculation method (Mean Squared Difference Similarity), Pearson Similarity calculation method (Pearson Similarity), etc. may be used to calculate the distance between location data. When the calculated distance value is within a preset range, the processor 240 determines a single preset reference value for considering the first location data and the second location data to be the same, and when the calculated distance value is outside the preset range , it is possible to determine a value other than the reference value for determining that the first location data and the second location data are not the same. The reference value and values other than the reference value correspond to identity information, and when decoded from the device 300 for user location identification thereafter, the reference value means that the location data of the device 100 and the location data of the user are the same, , Values other than the reference value may mean that the location data of the device 100 and the location data of the user are not the same.

That is, when the processor 240 directly performs the homomorphic encryption operation, the identity information according to the result of the homomorphic encryption operation may be provided from the device 300 for identifying the location of the user.

So far, the bank server 200 according to an embodiment of the present invention has been described. According to the present invention, the bank server 200 managing a number of devices 100 for providing financial services can quickly detect a one-time fraudulent transaction case by using location data of the devices 100 .

Hereinafter, the device 300 for user location identification that provides user location data to detect fraudulent transactions will be described.

In FIG. 5, for convenience of explanation, the device 300 for identifying a user location is described as a base station server 300b, and descriptions of the same configuration as the bank server 200 of FIG. 3 are omitted.

Referring to FIG. 5, a device for identifying a user location 300 may include a communication interface 310, a memory 320, an I/O interface 330, and a processor 340, each of which includes one or more communication elements. They can communicate with each other through a bus or signal line.

The communication interface 310 may be connected to a plurality of financial service providing devices 100 or the bank server 200 through a wired/wireless communication network to exchange data. For example, the communication interface 210 may receive a user's request for location data together with a parameter for a homomorphic encryption operation from the financial service providing device 100 or the bank server 200, and the financial service providing device ( 100) or to the bank server 200, the location data of the user that is homomorphically encrypted may be transmitted.

The memory 320 may periodically or in real time collect location data (eg, GPS coordinates) of the user, and may match and store it with time. For example, the device 300 for user location identification is {(t ₀ , Ux ₀ , Uy ₀ ), (t ₁ , Ux ₁ , Uy ₁ ), (t ₂ , Ux ₂ , Uy ₂ ), ... , (t _N , Ux _N , Uy _N )}, a pair of location data such as may be collected and stored. Here, Ux _N and Uy _N are location information, and may be coordinate values of the user's location at t _N , respectively.

The processor 340 is connected to the communication interface 210, the memory 220, and the I/O interface 330 to control the overall operation of the device 300 for user location identification, and the application stored in the memory 320. Alternatively, various commands for processing homomorphically encrypted data may be executed through a program.

In various embodiments, the processor 340 may provide identity information by utilizing location data of the user according to a request from the financial service provider, which will be described below with reference to FIG. 6 .

Referring to FIG. 6 , the processor 340 may receive an operation request including homomorphically encrypted first location data of the user from the bank server 200 providing financial services through the communication interface 310 (S210). ). The operation request may include a parameter for the homomorphic encryption operation used to homomorphically encrypt the first location data, user information (eg, mobile terminal number) to request a location, and information on when the use of a financial service is requested.

After step S210, the processor 340 may obtain second location data of the user according to the operation request (S220). The processor 340 may obtain a pair of location data by checking location coordinates (GPS coordinates) at a corresponding point in time based on the information at the point in time of requesting use of a financial service. For example, the processor 340 may obtain the user's second location data configured in the form of (t _N , Ux _N , Uy _N ).

In various embodiments, the processor 340 may homomorphically encrypt the user's second location data using the encryption key to which the parameter received in step S210 is reflected.

In various embodiments, the processor 340 may perform homomorphic encryption using any one of partial homomorphic encryption, somewhat homomorphic encryption, and fully homomorphic encryption. .

After step S220, the processor 340 may calculate homomorphically encrypted identity information based on the homomorphically encrypted first location data and the second location data (S230). Specifically, the processor 340 converts two location data to a distance similarity calculation method (eg, Euclidean distance measurement method, Minkowski distance measurement method, Cosine similarity calculation method, The distance between location data may be calculated by calculating using a mean squared difference similarity calculation method, a Pearson similarity calculation method, or the like.

To this end, the processor 340 may determine a first location corresponding to the homomorphically encrypted first location data and a second location corresponding to the plaintext second location data. For example, the processor 340 may determine a location corresponding to each location data as a real number value or a location vector using a Hexagonal Hierarchical Spatial Index (H3) system.

When the calculated distance value is within a preset range, the processor 340 determines a single preset reference value for considering the first location data and the second location data to be the same, and when the calculated distance value is outside the preset range , it is possible to determine a value other than the reference value for determining that the first location data and the second location data are not the same. Values other than the reference value and the reference value correspond to identity information, and accordingly, the processor 340 calculates identity information indicating that the reference value is the same as the location data of the device 100 and the location data of the user, and the reference value Other values may calculate identity information indicating that the location data of the device 100 and the location data of the user are not the same.

Meanwhile, although the meaning of the operation result between homomorphic encrypted data has been explained as above, the identity information can be decrypted by the bank server 200, and the processor 340 cannot confirm the similarity result between the two location data. .

After step S230, the processor 340 may transmit the homomorphically encrypted identification result to the bank server 200 (S240). The identification result obtained by homomorphic encryption can be decrypted by the bank server 200, and accordingly, the processor 340 processes the location data (first location) of the device for providing financial services 100 without exposing the location data of the user. Data) and user location data (second location data) may be calculated and provided to the bank server 200 .

In various embodiments, the processor 340 exchanges homomorphic encrypted data with the device for providing financial services 100 rather than the bank server 200 through the communication interface 310, and may detect fraudulent transactions of the user. .

Also, the processor 340 may simply perform homomorphic encryption of the user's location data and transmit the same to the financial service providing device 100 or the bank server 200 without performing a homomorphic encryption operation. In this case, the processor 340 may receive homomorphically encrypted identity information again from the financial service providing device 100 or the bank server 200, decrypt it, and transmit it.

So far, the device 300 for user location identification according to an embodiment of the present invention has been described. According to the present invention, since the device 300 for user location identification delivers only homomorphically encrypted identity information, it is possible to minimize the risk associated with sensitive information processing.

Hereinafter, a fraudulent transaction detection method between multiple parties including the device 100 for providing financial services, the bank server 200, and the device 300 for user location identification will be schematically described.

Referring to FIG. 7 , the device 100 for providing financial services may obtain a user's request for using a financial service (S10), and may make a financial service confirmation request to the bank server 200 (S11). Here, the financial service confirmation request may include identification information (eg, serial number, location data (coordinates)) of the device 100 for providing financial services, and information on a means of payment or a means of using financial services.

In various embodiments, the bank server 200 may regard the location data of the device 100 for providing financial services as the location of the user who has requested the current financial service, and homomorphically encrypt it (S12).

The bank server 200 may request the user's location data from the user location identification device 300 for the homomorphic encryption operation (S13). The corresponding request may include a parameter for homomorphic encryption operation and time information for requesting a financial service.

The device 300 for user location identification obtains user location data corresponding to the time information of the financial service request (S14), encrypts the user location data using an encryption key in which the parameters are reflected, and transfers the user location data to the bank server 200. It can be transmitted as (S15).

The bank server 200 may calculate the homomorphically encrypted location data of the user and the plain text location data, calculate the homomorphically encrypted identity information, and transmit the same to the user location identification device 300 (S16).

The device 300 for user location identification decrypts the identity information and transmits it to the bank server 200 (S17), and the bank server 200 determines whether or not to provide financial services based on the identity information, and the device 100 for providing financial services ) can be delivered (S19).

Through a series of processes, the device 100 for providing financial services may provide or restrict financial services to the user (S19), and the bank server 200 may monitor the user's use of financial services according to the result of decoding the identity information. It can be transmitted to the user device 300a.

Meanwhile, operations between homomorphic encrypted data may be performed in the device 100 for identifying a user's location in the same manner as in the bank server 200 .

In relation to this, referring to FIG. 9 , steps S30 to S32 are the same as the previous steps, but in the next step, the bank server 200 uses the device 300 for identifying the user location to determine the location of the user including parameters for homomorphic encryption calculation. An operation request can be transmitted (S33).

In various embodiments, the device 300 for identifying the user's location, according to the data identification request, homomorphically encrypts the user's location data using the same parameters as those used when the first location data was homomorphically encrypted (S35), Homomorphically encrypted identity information may be calculated based on the homomorphically encrypted first and second location data (S36) (that is, the homomorphically encrypted data may be calculated).

The device 300 for user location identification may transmit the isomorphically encrypted operation result to the bank server 200 (S26), and the bank server 200 may decrypt the identity information (S38).

Finally, the bank server 200 determines whether to provide financial services according to the identity information (S39), and the device 100 for providing financial services provides financial services to the current user according to the decision result received from the bank server 200. provided or limited.

Although one embodiment of the present invention has been described in more detail with reference to the accompanying drawings, the present invention is not necessarily limited to these embodiments, and may be variously modified and implemented without departing from the technical spirit of the present invention. there is. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the equivalent range should be construed as being included in the scope of the present invention.

Claims

obtaining first location data associated with a user who requested a financial service;

homomorphically encrypting the first location data;

transmitting the homomorphically encrypted first location data to a device capable of acquiring the location of the user;

Receiving homomorphically encrypted identity information calculated based on the homomorphically encrypted first location data and the user's second location data from the device;

decrypting the homomorphically encrypted identity information; and

determining whether to provide the financial service based on the identity information; Fraudulent transaction detection method using homomorphic encrypted data comprising a.
According to claim 1,

Transmitting the homomorphically encrypted first location data comprises:

Transmitting, to the device, a parameter for a homomorphic encryption operation used to homomorphically encrypt the first location data;
According to claim 2,

The homomorphically encrypted identity information,

The fraud detection method using homomorphically encrypted data, which is an operation result based on the homomorphically encrypted first location data and the homomorphically encrypted second location data based on the parameter.
According to claim 1,

The device capable of obtaining the location of the user,

A fraudulent transaction detection method using homomorphic encrypted data, which is any one of a user device possessed by the user, a base station server providing communication service to the user device, and a wireless communication device providing wireless Internet service to the user device.
According to claim 1,

The first location data,

Including the request time of the financial service and the location data of the device providing the financial service,

The second location data,

Fraudulent transaction detection method using homomorphic encrypted data, including the request time point and the location data of the user at the request time point.
According to claim 5,

The step of determining whether to provide the financial service,

If the location data of the device and the location data of the user are the same, providing a financial service;

If the location data of the device and the location data of the user are not the same, limiting the financial service; Fraud transaction detection method using homomorphic encrypted data, further comprising.
According to claim 1,

In the homomorphic encryption step,

Personal identification method using homomorphic encrypted voice, which is a step of homomorphic encryption using any one of partial homomorphic encryption, somewhat homomorphic encryption, and fully homomorphic encryption. .
Receiving an operation request including homomorphically encrypted first location data of a user from a bank server providing financial services;

acquiring second location data of a user according to the operation request;

calculating homomorphically encrypted identity information based on the homomorphically encrypted first location data and the second location data; and

transmitting the homomorphically encrypted identity information to a bank server; Fraudulent transaction detection method using homomorphic encrypted data comprising a.
According to claim 8,

Receiving the operation request,

Receiving parameters for a homomorphic encryption operation used to homomorphically encrypt the first location data from the bank server;

The obtaining step is

Homomorphically encrypting the second location data based on the parameter; and fraudulent transaction detection method using homomorphically encrypted data.
According to claim 9,

The step of calculating the homomorphically encrypted identity information,

determining a first location corresponding to the homomorphically encrypted first location data and a second location corresponding to the second location data; and

Calculating a distance value between the first location and the second location corresponding to the identity information;
According to claim 8,

The first location data,

Including the request time of the financial service and the location data of the device providing the financial service,

The second location data,

Fraudulent transaction detection method using homomorphic encrypted data, including the request time point and the location data of the user at the request time point.
According to claim 10 or 11,

The step of calculating the homomorphically encrypted identity information,

When the distance value is within a preset range, determining a single preset reference value for considering that the first location data and the second location data are identical;

If the distance value is out of a preset range, determining a value other than the reference value for determining that the first location data and the second location data are not identical; Denial using homomorphic encrypted data further comprising: Transaction detection method.
According to claim 8,

In the homomorphic encryption step,

Detection of fraudulent transactions using homomorphic encrypted data, which is a step of homomorphic encryption using any one of partial homomorphic encryption, somewhat homomorphic encryption, and fully homomorphic encryption. method.
obtaining a user's request for use of a financial service;

Homomorphically encrypting pre-stored location data according to the financial service use request;

transmitting the homomorphically encrypted location data to a device capable of acquiring the location of the user;

Receiving homomorphically encrypted identity information calculated based on the homomorphically encrypted location data and the location data of the user from the device;

decrypting the homomorphically encrypted identity information; and

determining whether to provide the financial service based on the identity information; Fraudulent transaction detection method using homomorphic encrypted data comprising a.