KR20030013877A - System and Method for Internet Credit Card Payment through Non-Payment Gateway based on Certificates - Google Patents

Abstract

The present invention reduces unnecessary fees incurred in electronic payment processing by eliminating intermediate processes such as payment gateways or VAN operators that exist in the electronic payment processing process on the Internet, and based on certificates and payment information The present invention relates to a secure and efficient certificate-based Non-Payment Gateway type electronic credit card electronic payment method and system by encrypting and digitally signing a digital signature.

The present invention receives an Internet credit card including a certificate of the certification authority through the card company, installed in the user terminal, and electronically signed by the user, including information on the transaction details of the user and the user's certificate during the Internet electronic transaction, encryption The payment information and the Internet credit card information to the non-payment gateway server of the internet store. At this time, the Non-Payment Gateway server extracts only transaction details and transmits payment information and Internet credit card information to the card company's payment authorization processing server, so that the card company's payment authorization processing server decrypts and processes the encrypted payment information and the Internet credit card information. After receiving and storing a result, an electronic receipt attached to a certificate of an internet shop is transmitted to a user terminal.

Description

Certificate-based Non-Payment Gateway-based Internet Credit Card Payment and System {System and Method for Internet Credit Card Payment through Non-Payment Gateway based on Certificates}

The present invention relates to a method and a system for processing an electronic payment using a public key certificate and securely processing an electronic payment on the Internet without an electronic payment agency or a VAN operator existing in the middle of an electronic payment processing process.

With the development of the Internet, users can order goods through their terminals and pay for transactions using cards without going to the store. However, the current Internet electronic payment system has many problems in terms of safety, efficiency and cost.

For example, the most widely used electronic payment system using a card is an electronic payment agency (or VAN operator) that makes payments between an internet store and a card company. The user sends his card number and transaction information to an Internet store, which sends the card number and payment information to the electronic payment agency, who in turn sends the card number and payment information to the card company to confirm payment from the card company. There is a way to receive. This approach has been perceived as a privacy concern because an intermediary internet store or electronic payment agency knows the user's card number, and the processing time is long because the electronic payment agency is involved in the payment process. There is a problem in that various processing costs, such as additional fees.

Looking at the prior art patent application technology, in order to protect the user card information for the Internet store has been applied for a patent "certificate-based virtual card issuance and payment system and method" (application number: 10-2000-0054969). Although the proposed patent increases security than the conventional method by preventing the user from knowing the user's card number, it is difficult for a new organization called Virtual Card to be added to the payment process to reduce the processing time and user payment information is electronically paid. Problems exposed to agencies and virtual card companies have not been solved. In addition, electronic payment agencies and virtual cards are involved in the electronic payment processing process, which incurs additional processing fees.

The present invention has been made to solve the problems of the prior art as described above, the object of which is to manage user payment information more securely in electronic commerce, and significantly reduce the processing fees and processing time required for payment processing by reducing the payment processing step To provide a certificate-based Non-Payment Gateway-type Internet credit card electronic payment method and system reduced therewith.

1 is a configuration diagram of an existing credit card payment system including a payment gateway and a VAN operator;

2 is a configuration diagram of a certificate-based Internet credit card payment system currently being serviced in Korea;

3 is a block diagram of a certificate-based Non-Payment Gateway type electronic credit card electronic payment system according to the present invention,

4 is a system configuration diagram for issuing an Internet credit card in a certificate-based Non-Payment Gateway type electronic credit card electronic payment system according to the present invention;

5 is a flow chart of an Internet credit card issuing process in a certificate-based Non-Payment Gateway type electronic credit card electronic payment system according to the present invention;

6 is a diagram of an embodiment of a method for configuring an internet credit card stored in a user terminal;

7 is a configuration diagram of an electronic payment process of a certificate-based Non-Payment Gateway type electronic credit card electronic payment system according to the present invention;

8 is a flowchart illustrating an electronic payment process using an internet credit card according to the present invention;

9 is a view for explaining the card payment processing flow according to the present invention.

[Description of Symbols for Main Parts of Drawing]

11, 21, 31, 41, 71: user

12, 24, 32, 72: Internet shop

13, 25: Electronic payment agency or VAN operator

14, 22, 33, 42, 73: card company

34, 43: Certification Body

35: Trading Bank Of Stores

23: virtual card company

41a, 71a: Plug-in module in the user terminal

42a, 73c: Card Authorization Server

42b, 73b: DB company's DB server

42c, 73a: Card company's Internet credit card registration server

43a: Issuing server of certification authority

72a: Web server of an internet shop

72b: Non-Payment Gateway Server in Internet Store

As a means for achieving the above object of the present invention, the certificate-based Non-Payment Gateway type electronic credit card electronic payment system and the method using the system,

Receives an Internet credit card containing a certificate from a certificate authority through a card company and electronically signs payment information during an electronic transaction with an Internet store, encrypts the electronic signature with the card company's public key, and sends it to a non-payment gateway server in an internet store. And a first step of receiving and verifying a receipt for the transaction from the internet store through the user terminal;

A second step of checking transaction information transmitted from the user, transferring the user's card information and payment information to the card company, receiving a transaction approval from the card company, and issuing a certificate attached receipt for the transaction to the user at the Internet store;

After receiving a request for issuing an Internet credit card from the user, verifying the validity, requests for issuing a user certificate and issues an Internet credit card to a certification authority, and decrypts user card information and payment information entered through a non-payment gateway server of an internet store. A third step of confirming and approving the transaction to the internet store by the card company;

Receiving a request for a user certificate from a card company, and a fourth step of issuing and managing the certificate by the certification authority;

And a fifth step of depositing the transaction with the bank of the Internet store having the account of the Internet store so that the card company can deposit the card sales amount at the request of the Internet store.

Hereinafter, with reference to the accompanying drawings, it will be described in detail the configuration and operation of the certificate-based Non-Payment Gateway type electronic credit card electronic payment system according to the present invention.

1 is a block diagram of an electronic payment system using a conventional credit card that does not use a conventional certificate. First, the user 11 selects a merchandise transaction list from the internet shop 12, and then encrypts his or her card number and transaction list with the public key of the internet store to apply for a product purchase. The Internet store 12 sends the card account number and payment information to the Payment Gateway provider (or VAN provider) 13, and the PG provider (or VAN provider) 13 sends the user's card account number and payment information to the card company 14 Send a request for payment to the user to notify the Internet store 12 of the result.

Both the Internet store 12 and the Payment Gateway provider (or VAN provider) 13 can confirm payment information such as a user's credit card number, thereby causing a problem of personal information leakage and abuse.

FIG. 2 is a certificate-based virtual card payment system, which was applied for a patent in September 2000, that uses an e-commerce through the Internet and receives and uses an Internet credit card, and examines the user's credit information when the card issuing request. The card company 22, which is the subject of the Internet credit card issuance, transmits an electronic certificate from the card company 22 upon issuing an Internet credit card, and stores the user information and the virtual card information. Virtual card company 23 for the post-payment process, an Internet store 24 that provides goods or services to the user through the Internet and receives a predetermined cost in return, and the user's Internet sent from the Internet store 24 Decrypt the credit card information to determine if the certificate is valid and send the approval request to the Internet credit card company. Is composed of Payment Gateway Provider (25) acting on behalf of the processing.

In the system of FIG. 2, a virtual card company other than a credit card company can check and leak payment information such as a user's credit card number, and a payment gateway operator and a virtual card company are added to the Internet payment processing process in comparison with the system according to the present invention. There exists a problem of processing time delay and additional fee incurred.

3 is a block diagram of a certificate-based Non-Payment Gateway type electronic credit card electronic payment system according to the present invention. The user 31 is composed of a terminal connected to the server company 33, the Internet store 32, etc. of the card company via the Internet, and a plug-in module that can process the user's electronic payment process. It is issued and connected to an internet store to conduct electronic transactions for goods. The internet shop 32 is connected to the Internet with the user 31 to check the product transaction information sent by the user and transmit payment and user card-related information to the card company 33 in an encrypted state to receive payment confirmation. The card company 33 receives the user 31 certificate with the help of the certification authority 34, makes an Internet credit card, issues it to the user 31, and decodes and confirms the user card information and payment information sent from the Internet store 32. The payment is confirmed to the Internet shop 32, and later, the card payment is settled through the trading bank 35 of the shop. The merchant bank 35 of the store has an account of the internet store 32, and the store 32 receives the card payment from the card company 35 through this account.

4 is a block diagram of a system for issuing an Internet credit card of a certificate-based electronic payment system according to the present invention. 41 is a user terminal connected to the Internet and has a plug-in 41a for issuing and using an Internet credit card, and 42 is a card company which receives user information transmitted from the plug-in 41a for issuing and issuing an audit. When it is determined that it is possible to issue, the registration server 42a sends a certificate issuance request to the certification authority 43 and makes an Internet credit card using the certificate to the user 41, and the card number of the user and the customer information transmitted from the user. DB server (42b) for storing and managing the payment and payment authorization server (42c) that is responsible for the payment processing of the user card during electronic transactions, 43 is a certificate authority to the user in accordance with the issuance request from the card company 42 A certificate issuing server 43a for issuing a certificate and a DB server 43b for storing and managing certificate issuing information are provided.

FIG. 5 is a flowchart showing an Internet credit card issuing process performed by the system shown in FIG. Issuance of the Internet credit card begins with the user 41 who wishes to issue the card accessing the Internet credit card registration server 42c of the card company 42 (501) and inputting the personal information (502). If the user already has a certificate, the user information and certificate is transmitted to the card company (503), and the card company investigates the user's creditworthiness using the internal system based on the information sent by the user 41 and proceeds with the Internet card issuance examination. (504). If the certificate is not held, a private key and a public key used for signing and encryption are generated (505), and the user information and public key are transmitted to the card company 42 (506). Like the above 504, the card company 42 proceeds with the Internet card issuance examination (507). The above examination results. If it is determined that it is possible to issue, the Internet credit card registration server 42a of the card company 42 transmits a certificate issuance request message to the issuing server 43a of the certification authority 43 (508), thereby registering the certification authority 43. The server 43a issues a certificate and transmits it to the card company 42 (509). The card company 42 extracts the serial number of the user certificate, etc. (510), and stores the user related information in the DB server managing the customer information for later use in electronic payment processing (511). The card company 42 signs the card-related information (card number, expiration date, etc.) to be contained in the card to be issued with the certificate received from the certification authority 43 by signing with the private key of the card company 42, Encrypted with a public key and securely delivered to the user (512). The user 41 confirms the card information received from the card company 42 (513) and adds its signature to the card-related information and stores it securely (514).

6 illustrates an embodiment of a method for configuring an internet credit card that a user 41 stores in his terminal. 61 is a certificate of the card company 42 used to verify the card company electronic signature 62, 62 is an electronic signature of the card company 42 for the card-related information 63, 63 is a user Internet card issued by the card company 42 Information 64 is the user's electronic signature for the card related information 63 and 65 is the user's certificate. The card company's certificate 61, the card company's signature 62, the card related information 63, and the user's certificate 65 are information that the card company 42 sends to the user 41, but 64 is the user's own private key. Information added using. In the above method of constructing an Internet credit card, all the information (61, 62, 63, 64, 65) related to the Internet credit card is encrypted with the user's public key and stored securely.

7 is a block diagram of a payment system in an electronic transaction using the Internet credit card issued as described above. 71 is a user terminal connecting to the Internet and has a plug-in 71a for payment. 72 is an Internet store and transmits from a user and a web server 72a for providing Internet transaction services such as goods transaction information to the user. Non-PaymentGateway server 72b for transmitting the received payment information to the card company's payment processing server and receiving the result, and the card company 73 provides a registration server 73a for card issuance and a DB server for managing customer related information ( 73b), a payment approval server 73c for processing user payment information using the DB server 73b, and the payment processing server 73c is linked with a non-payment gateway server 72b of an internet store to Process payment information.

FIG. 8 is a flowchart illustrating a certificate-based Non-Payment Gateway type electronic credit card electronic payment process performed through the system shown in FIG. 7 and the payment process will be described in detail with reference to this. First, a user accesses a web server 72a of an internet shop 72 and selects a service or a product to be traded (81). The web server 72a of the store 72 transmits and displays the transaction information screen to the user 71 (82). The user 71 transmits transaction related information, encrypted payment information, and internet credit card information to a non-payment gateway server of an internet store by using the plug-in 71a module for electronic payment (83). The non-payment gateway server 72b of the Internet store 72 extracts and confirms transaction-related information (84), and accepts the encrypted payment information and the Internet credit card transmitted by the user as the payment authorization server 73c of the card company. (85). The card company 73 decrypts the payment related information and the Internet credit card information to verify the validity of the payment related information and the card related information 62, and the DB server 73b by the card number included in the card related information 62. A DB is searched and the current credit status of the user is checked to determine if the payment is approved (86). In case of payment authorization, the authorization message is transmitted to the non-payment gateway server 72b of the internet store 72 together with the authorization number of the card company (87). The internet store 72 stores the transaction approval number and the approval message and issues 88 an electronic receipt to the user 71 to which the transaction details and the certificate of the internet store are attached. User 71 confirms and stores the electronic receipt (89).

FIG. 9 is a flowchart illustrating a card payment process occurring between the internet store 32, the card company 33, and the store's trading bank 35 after the electronic transaction by the user is completed. The card company 33 calculates the accumulated credit card payment amount of the store when it is determined according to the agreement with the Internet store 32 (91), deposits the card payment amount into the bank account of the Internet store (92). In step 93, the internet store confirms whether or not the payment amount from the card company is deposited by checking the account of the bank.

Certificate-based Non-Payment Gateway type electronic credit card electronic payment system according to the present invention eliminates the role of a payment gateway (Payment Gateway provider) or VAN company in the payment processing process, compared to the conventional method, credit card payment more quickly In addition, it is possible to reduce unnecessary credit card payment fees, which had to be paid to payment agencies of Internet stores, and relay fees that card companies had to pay to VAN.

Based on these savings, we can provide benefits such as merchant fee reduction or user installment fee reduction to Internet shops and individual users.We cannot extract and store your credit card information during payment processing other than credit card companies. Therefore, the effect of satisfying the safety and reliability of electronic payment on the Internet can be obtained. In addition, by using the electronic receipt attached to the store's certificate, it is possible to prepare a legal basis for protecting consumers even when e-commerce via the Internet.

Claims (6)

In the certificate-based Non-Payment Gateway type electronic credit card electronic payment system and method using the system, Receives an Internet credit card containing a certificate from a certificate authority through a card company and electronically signs payment information during an electronic transaction with an Internet store, encrypts the electronic signature with the card company's public key, and sends it to a non-payment gateway server in an internet store. And a first step of receiving and verifying a receipt for the transaction from the internet store through the user terminal; A second step of checking transaction information transmitted from the user, transferring the user's card information and payment information to the card company, receiving a transaction approval from the card company, and issuing a certificate attached receipt for the transaction to the user at the Internet store; After receiving a request for issuing an Internet credit card from the user, verifying the validity, requests for issuing a user certificate and issues an Internet credit card to a certification authority, and decrypts user card information and payment information entered through a non-payment gateway server of an internet store. A third step of confirming and approving the transaction to the internet store by the card company; Receiving a request for a user certificate from a card company, and a fourth step of issuing and managing the certificate by the certification authority; Certificate-based Non-Payment Gateway type, characterized in that it includes a fifth step of depositing the transaction with the bank of the Internet store that has the account of the Internet store so that the card company can deposit the card sales amount at the request of the Internet store. · Payment method using wireless internet. The wired / wireless Internet card transaction of claim 1, wherein the user terminal adopts a communication protocol (TCP / IP, WAP, ME) that supports wired / wireless Internet, and includes an operating system and a browser for the Internet. Electronic payment method to perform. The electronic payment method according to any one of claims 1 to 2, wherein the electronic payment of a credit card through a wired / wireless internet method is based on a certificate, and the card approval is performed using a non-payment gateway method. The non-payment gateway server of claim 1, wherein the electronic payment process comprises the steps of a user transmitting transaction information, encrypted payment information, and internet credit card information to a non-payment gateway server of an internet store upon internet electronic payment. Extracting the transaction information from the transaction information, payment information, and Internet credit card information received from the user, and transmitting the payment information and the Internet credit card information to the card company's payment authorization server; Decrypting the information and internet credit card information, verifying the payment information and certificate and credit card information, processing and responding to the payment authorization, receiving the approval result from the card company and electronic receipt to the user including the certificate of the store according to the result Issuing a step, the user to check and save the electronic receipt Certificate-based Non-Payment Gateway type wired and wireless Internet credit card electronic payment method characterized in that consisting of steps. The method according to any one of claims 1 to 4, wherein after the electronic payment processing, the Internet store issues an electronic receipt attached to the user's transaction details and the certificate of the Internet store, and the user receives the electronic receipt to receive the transaction details and the Internet. A method for processing electronic electronic receipts that identify, store and manage a store. In case of electronic payment, the user terminal transmits transaction information, encrypted payment information and internet credit card information to the non-payment gateway server of the internet store, and receives transaction information, payment information, and internet credit card information from the user. Non-Payment Gateway server that extracts and sends payment information and Internet credit card information to the card company's payment authorization server, receives the result, and issues the electronic receipt to the user including the store's certificate according to the result. In the certificate-based Non-Payment Gateway type electronic credit card electronic payment system, characterized in that consisting of the payment authorization server of the card company that processes and responds to the payment authorization based on the information and Internet credit card information. Receives an Internet credit card containing a certificate from a certificate authority through a card company and electronically signs payment information during an electronic transaction with an Internet store, encrypts the electronic signature with the card company's public key, and sends it to a non-payment gateway server in an internet store. And a user terminal device for receiving and verifying a receipt for a transaction from an internet shop; An internet shop for checking transaction information transmitted from the user, transferring the user's card information and payment information to the card company, receiving a transaction approval from the card company, and issuing a certificate attached receipt for the transaction to the user; After receiving a request for issuing an Internet credit card from the user, verifying the validity, requests for issuing a user certificate and issues an Internet credit card to a certification authority, and decrypts user card information and payment information entered through a non-payment gateway server of an internet store. A card company that checks and approves the transaction to the Internet shop; A certification authority that issues and manages a certificate when receiving a user certificate request from a card company; Card approval based on certificate-based Non-Payment Gateway type wired / wireless Internet, characterized in that it consists of a trading bank of an internet store that has an account of the internet store so that the card company can deposit the card sales amount at the request of the internet store. Electronic payment system to service.