KR20020064469A - Transaction Protect Service Offering Method of Public Key Infrastructure Through Internet and System Thereof - Google Patents

Abstract

The present invention relates to a method and a system for providing a public key infrastructure transaction contents protection service using the Internet, comprising: a user registering with a website providing an electronic transaction protection service, downloading a storage service program, and installing the same in a client; Executing a electronic transaction by a user accessing the Internet; Generating an archive file by selecting an archive file type by a user running an archive service program installed in a client to store transaction details and result screens of the electronic transaction using the Internet; The storage service program encrypts the generated archive file and executes a user signature using a user certificate of the file; Generating a transmission file and transmitting it to a web server providing an electronic transaction protection service connected through the Internet when the user signature is completed; Checking whether the received transmission data is forged / modified when the transmission data is received from the client of the registered users; Performing a user verification procedure using a user certificate included in the transmission data in the case of the transmission data that is not forged / falsified as a result of the forgery / modulation inspection of the transmission data; If the user identity of the transmission data is verified, performing a signature verification procedure through a user certificate included in the transmission data; If the user signature of the transmission data is verified, executing a signature for verifying whether the transmission data is normally received through a server certificate; And storing the transmission data in a file management database assigned to the user and transmitting the storage confirmation document to the client.

Therefore, in the present invention, a user executes an electronic transaction such as a product purchase or a bank or securities transaction using the Internet, and encrypts a payment history or a transaction result screen through a certificate including a non-public key in a recording medium on a website. By storing, the contents of transactions on the Internet can be more effectively protected as well as conveniently stored.

Description

Transaction Protect Service Offering Method of Public Key Infrastructure Through Internet and System Thereof}

The present invention relates to a method and a system for providing a public key infrastructure transaction contents protection service using the Internet. The present invention relates to a method and a system for providing a public key infrastructure transaction contents protection service using the Internet, which is capable of protecting the transaction details on the Internet more effectively by storing in a recording medium.

At present, there is a great change in information and transactions due to the development of the Internet-based network, and the era of sharing all information and trading without borders is approaching rapidly.

In addition, the creation of virtual spaces through the network brings about the provision of various services and online real-time transactions in these virtual spaces, and the activation of offline real and various agency services as well as specialized information and electronic commerce online. It's happening.

On the other hand, as the number of Internet users increases rapidly, offline large stores, banks, securities companies, and distribution companies are providing online real-time services using the Internet, and the use frequency of such transaction services is rapidly increasing.

The user who wishes to provide online real-time service using the Internet agrees to the membership agreement through the membership registration procedure of the corresponding website, and if he / she enters his / her personal information, member number (ID) and password, he / she registers as a full member. Therefore, various real-time transactions such as securities trading, banking and product purchase can be provided.

When a user using the Internet purchases a product or executes a bank or securities transaction, and processes a credit card or bankbook to make a payment, the corresponding website outputs the result screen of the transaction and displays it on the screen. Prints the screen and stores it.

However, since the online real-time service using the Internet is provided through the Internet, which is a network, the user's transaction contents are damaged due to various obstacles such as transmission error, communication failure, and forgery / falsification of transaction contents by hacking. The number of examples is increasing, spreading to new social problems.

In addition, the majority of users do not print or print the result screen of the transaction contents, or even if the print output is neglected to keep the contents after a certain period of time can not find the contents of the damage caused by the user's damage is aggravated There is a situation.

The present invention is to solve the above problems, the user performs the purchase of goods or banks and securities transactions using the Internet, and the transaction result screen is stored on a separate recording medium by encrypting the non-public key, the Internet The purpose of the present invention is to provide a method and system for providing a public key infrastructure transaction contents protection service using the Internet, which can effectively protect transaction details in the Internet.

1 is a block diagram schematically showing the configuration of a public key infrastructure transaction content protection service system using the Internet according to the present invention;

2 to 5 are flowcharts for explaining a method for providing a public key infrastructure transaction contents protection service using the Internet according to the present invention;

Figure 6 is an exemplary view showing a data storage screen state of the file management database according to the present invention.

♣ Explanation of symbols for main part of drawing ♣

10: Client 20: Internet

30: Website 40: Web Server

41: program storage 42: member information database (DB)

43: file management database (DB) 44: service information database (DB)

The present invention for the above object, the user signing up for a website providing an electronic transaction protection service to download and install the storage service program on the client; Executing a electronic transaction by a user accessing the Internet; Generating an archive file by selecting an archive file type by a user running an archive service program installed in a client to store transaction details and result screens of the electronic transaction using the Internet; The storage service program encrypts the generated archive file and executes a user signature using a user certificate of the file; Generating a transmission file and transmitting it to a web server providing an electronic transaction protection service connected through the Internet when the user signature is completed; Checking whether the received transmission data is forged / modified when the transmission data is received from the client of the registered users; Performing a user verification procedure using a user certificate included in the transmission data in the case of the transmission data that is not forged / falsified as a result of the forgery / modulation inspection of the transmission data; If the user identity of the transmission data is verified, performing a signature verification procedure through a user certificate included in the transmission data; If the user signature of the transmission data is verified, executing a signature for verifying whether the transmission data is normally received through a server certificate; And storing the transmission data in a file management database assigned to the user and transmitting the storage confirmation document to the client. do.

Another aspect of the invention is a user client for a user to access the Internet through a personal computer; An internet, which is a network for transmitting and receiving data through communication at a remote location; Websites such as banks, securities companies, and shopping malls that provide predetermined real-time electronic transaction services to users registered as members through the Internet; And when the client users access a website through the Internet to execute a predetermined real-time electronic transaction service, and select a result screen, a transaction history, and a document file as an archive file in order to protect the transaction details, Provides a public key infrastructure transaction content protection service system using the Internet, characterized in that it comprises a web server for storing the archive file in the assigned recording medium.

Hereinafter, a method and system for providing a public key infrastructure transaction contents protection service using the Internet according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram schematically illustrating the structure of a transaction content protection service system using the Internet according to the present invention, and FIGS. 2 to 5 are based on the public key using the Internet according to the present invention. 6 is a flowchart illustrating a structure transaction content protection service providing method, and FIG. 6 is a diagram illustrating a data storage screen state of a file management database according to the present invention.

Referring to this, as shown in FIG. 1, the public key infrastructure transaction contents protection service system using the Internet according to the present invention allows a user, such as an individual, an enterprise, and a public office, to access the Internet 20 through a personal computer. Client 10; The Internet 20, which is a network for transmitting and receiving data through remote communication; Websites such as banks, securities companies and shopping malls that provide various real-time e-commerce services to users registered as members through the Internet 20; The client 10 can access the website 30 through the Internet 20 to receive the real-time electronic transaction service and to store the transaction result screen in a separate recording medium in order to protect the transaction content. It consists of a web server 40 that provides space to users.

The web server 40 includes a program storage unit 41 for storing a storage service program provided to users registered as members, and a member information database 42 for storing and managing personal information and certificates of users who are members. ), A file management database (43) for encrypting and storing the result screens that have been transacted through the internet of registered users, and for encrypting and storing the general files requested by the user, the service overview and site map of the e-commerce protection website. It consists of a service information database 44 to store.

The operation of the public key infrastructure transaction content protection service system using the Internet according to the present invention having the above configuration will be described in detail with reference to FIGS. 2 to 6.

The e-commerce protection website company operating the web server 40 guides and promotes the overview of the e-commerce protection service and the service providing procedure through the homepage to users connected through the Internet 20, and as a member. In addition to providing a free protection service program for registering users, it also provides free storage space of 30M, for example, which can store internet transaction result screens and personal files. Here, if the user requires a storage space of 30M or more, for example, the storage space for a fee is provided.

A general user who wishes to receive the electronic transaction protection service using the Internet 20 executes a web browser installed on his or her client 10, accesses the Internet 20, and inputs the domain of the website in the address bar. If so, the web server 40 reads the service summary and site member stored in the service information database 44 and outputs it through the homepage (S11). The homepage guides service overview of the website, service procedures and advertisements, and suggests damage cases and countermeasures of electronic transactions to induce membership.

When the user agrees to the member registration guide presented through the homepage (S12) and selects membership, the web server 40 checks whether the user owns the certificate (S13). Here, the certificate is issued by face-to-face from an accredited certification authority (Securities Computing, KFTC, Information Authentication) so that users using the Internet 20 can be protected by the Digital Signature Act. It includes a user's identity information, a public key that is open to all, and a non-public key that only the user can verify.

When the user is a new member who does not have a certificate, the web server 40 outputs a member application form on the screen, and personal information input by the user such as a member number (ID), password, address, contact information, main bank, The securities company and the shopping mall are registered and stored in the member information database 42 (S14).

The web server 40 provides a new member user with a certificate issued by the website, stores the generated certificate in the member information database 42, and displays an electronic transaction result screen and a general file using the Internet 20. By checking whether or not to use the storage space that can be stored, for example, 30M space of the file management database 43 is freely allocated to the desired new members. Here, if a user registered as a member requires additional storage space, the storage space for a fee is provided.

The web server 40 requests the user who owns the certificate to submit a certificate (S15), and when the user submits a user certificate possessed by the user (S16), after storing the certificate in the member information database 42 When the download is completed by downloading and executing the storage service program stored in the program storage unit 41 to the client 10 of the user, the user installs the storage service program on the personal computer which is his client 10 (S17).

With the storage service program installed in the user client 10, the user accesses a website 30 such as a bank, a securities company, and a shopping mall that provides an online real-time service through the Internet 20, and provides the same from the website. After executing the e-commerce that is, when driving the storage service program installed in the client 10 to store the transaction result screen (S21), as shown in Figure 3 the storage service program is the user's archive file format A guide window for determining the screen is output to the screen (S22) to determine whether the file format to be stored is a web page (S23).

As a result of the determination, when the file format to be stored is a web page, the storage service program acquires a result screen of the contents of the Internet e-commerce selected by the user (S24) and generates the archive file (S25). Here, the acquired web screen is a user acquires a screen of a web browser in which an e-commerce activity has occurred by using the Internet 20, and an address for providing data displayed on the screen to prevent the user from tampering with the web screen. Together to prevent the acquired data from being tampered with by the user.

As a result of the determination, if the file format to be stored is a general document file instead of a web page, a guide message is output to the screen for the user to select the document, and the general file selected by the user is generated as an archive file (S26).

When the file to be archived is generated or selected, the storage service program encrypts the file (S27), and executes a user signature through a user's certificate submitted at the time of membership registration to identify the user of the file (S28). In operation S30, the transmission file is generated and transmitted to the web server 40 that provides the electronic transaction protection service connected through the Internet 20 (S30). Here, the transmitted file is transmitted using a non-public key that is not disclosed to others provided with a certificate along with an electronic signature that the user transmits the corresponding material by using a certificate of an accredited certification authority protected by the digital signature law. Digital signature (encryption processing) will be performed on the data.

As shown in FIG. 4, the web server 40 providing the electronic transaction protection service through the Internet 20 receives the transmission data from the client 10 of the registered users (S51). In the case of forgery / modulation (S52), in the case of forged / modulated transmission data, the transmission error message according to the forgery / modulation is transmitted to the corresponding client 10, and the corresponding processor is terminated.

In the forgery / modulation inspection method of the transmission data, the data transmitted by the user using the storage service program transmits the original document and the hash value obtained by using the hash function. The web server 40 acquires a new hash value by using a hash function of the received original document, compares whether it is the same value as the hash value sent by the user, and if the value is the same, the document was not forged / modulated. You will know. In this case, when the hash function processes any variable message, the hash function generates a fixed compressed message result value, and the generated result value may not generate the same result value according to the message, and the original message may be obtained from the result value. It is a function that cannot be used.

The web server 40 performs a user verification procedure using the user certificate included in the transmission data, if the forgery / forgery test result of the transmission data (S54) and whether the identity of the user matches the certificate If it is determined whether or not (S56) does not match, and transmits an error message according to the identity mismatch to the client 10 and terminates the processor. In this case, when the user certificate is a certificate issued from an accredited certification authority, the identity of the user is confirmed by accessing the relevant accredited certification authority (not shown) through the Internet 20, and the user certificate provides an electronic transaction protection service. In the case of a certificate issued at the time of membership registration of the website, the user identity is verified based on the user certificate stored in the member information database 42.

When the user identity of the transmission data is confirmed, the web server 40 performs a signature verification procedure through the user certificate included in the transmission data (S56) and determines whether the signature of the user matches the certificate (S57). If it does not match, the client 10 sends an error message according to the user signature mismatch and terminates the processor. Here, the method for verifying the user signature is to verify the user's signature by decrypting (verifying) the data encrypted with the non-public key that the user does not disclose to others with the public key existing in the user's certificate.

When the user signature of the transmission data is confirmed, the web server 40 executes a signature for verifying that the transmission data transmitted by the user has been normally received as a server certificate (S58), and transmits the transmission data to the user. In addition to storing in the management database 43, the storage confirmation document is transmitted to the client 10 (S59).

When the user accesses the homepage of the website providing the electronic transaction protection service through the Internet 20 as shown in FIG. 5 to search for his archive file (S61), the web server 40 If the user is required to submit a certificate (S62) and the user is a registered member normally, as shown in FIG. 6, the user storage data search window is displayed on the screen to display a list of data stored in the file management database 43 on the screen. It is displayed (S63).

When the user selects the predetermined search data output on the screen (S64), the web server 40 reads the search data from the file management database 43 and downloads the search data to the user client (S45).

The user decrypts the archive data downloaded to his client 10 using a non-public key through the archive service program, so that the contents of the archive data can be checked.

As described above, the method and system for providing a public key infrastructure transaction contents protection service using the Internet according to the present invention, after the user executes an electronic transaction using the Internet, discloses a payment history or a transaction result screen on a separate recording medium. By encrypting and storing the certificate with the key, it is possible to more effectively protect the transactions on the Internet.

In addition, the method and system for providing a public key infrastructure transaction contents protection service using the Internet according to the present invention are not limited to the above embodiments, and various modifications and changes can be made without departing from the technical spirit of the present invention. .

As described above, according to the present invention, a user executes an electronic transaction such as a product purchase or a bank or securities transaction using the Internet, and displays a payment history or a transaction result screen on a website in which a non-public key is included in a certificate. By encrypting and storing through, it is effective to protect the transaction contents on the Internet more effectively, as well as convenient storage.

Claims (11)

A user signing up for a website providing an electronic transaction protection service, downloading a storage service program and installing the same in a client; Executing a electronic transaction by a user accessing the Internet; Generating an archive file by selecting an archive file type by a user running an archive service program installed in a client to store transaction details and result screens of the electronic transaction using the Internet; The storage service program encrypts the generated archive file and executes a user signature using a user certificate of the file; Generating a transmission file and transmitting it to a web server providing an electronic transaction protection service connected through the Internet when the user signature is completed; Checking whether the received transmission data is forged / modified when the transmission data is received from the client of the registered users; Performing a user verification procedure using a user certificate included in the transmission data in the case of the transmission data that is not forged / falsified as a result of the forgery / modulation inspection of the transmission data; If the user identity of the transmission data is verified, performing a signature verification procedure through a user certificate included in the transmission data; If the user signature of the transmission data is verified, executing a signature for verifying whether the transmission data is normally received through a server certificate; And storing the transmission data in a file management database assigned to the user and transmitting the storage confirmation document to the corresponding client. The method of claim 1, The membership registration process includes the steps of a user agreeing to a membership agreement presented through the homepage of the website; Checking whether the user owns the certificate and requesting the user who owns the certificate to submit the certificate when the user selects membership; If the user is a new member who does not own a certificate, displaying a member application form on a screen, issuing personal information and a user certificate input by the user, and registering and storing the registration information in a member information database; Allocating a storage space of a file management database for storing an electronic transaction result screen and a general file using the Internet; And downloading and executing the storage service program to the client of the user to the user whose membership is completed. The method according to claim 1 or 2, The certificate is issued by face-to-face from an accredited certification authority so that Internet users can be protected by the Digital Signature Act. The issued certificate includes a public key algorithm, and only the user and the public key that are disclosed to all users. Public key infrastructure transaction content protection service providing method using the Internet, characterized in that consisting of a non-public key that can be confirmed. The method of claim 1, In the generating of the archive file, the archive service program outputs a guide window for determining the archive file format on a screen to determine whether the archive file format selected by the user is a web page; If the file format to be stored is a web page as a result of the determination, acquiring a result screen of the contents of the Internet e-commerce selected by the user and generating an archive file; And generating a general document file selected by the user as an archive file when the file format to be stored is a general document file. The method of claim 4, wherein The obtained web screen is to acquire a screen of a web browser in which an e-commerce activity occurs by using the Internet, and to acquire a provision address of data displayed on the screen together in order to prevent the user from tampering with the web screen. Public key infrastructure transaction content protection service providing method using the Internet. The method of claim 1, In the forgery / falsification test method of the transmission data, the user transmits the original document and the original document together with the hash value obtained using the hash function, and the received original document uses the hash function. A method of providing a public key infrastructure transaction contents protection service using the Internet, characterized in that it acquires a new hash value and compares whether or not the document has the same value as the hash value sent by the user. The method according to claim 1 or 2, If the user certificate is a certificate issued from an accredited certification authority, the user is connected to the relevant accredited certification authority through the Internet to confirm the identity of the user, and the user certificate is issued when registering a member of a website that provides electronic transaction protection services. If the received certificate, the public key infrastructure transaction content protection service providing method using the Internet, characterized in that for verifying the user identity based on the user certificate stored in the member information database. The method of claim 1, The method of verifying the user signature is a public key infrastructure transaction using the Internet, characterized in that the user decrypts a non-public key encrypted data that is not disclosed to others by using a public key present in the user's certificate to verify the signature of the user. How to provide content protection services. The method of claim 1, Accessing a homepage of a website providing an e-commerce protection service through the Internet for a user to retrieve his archived file; Requesting submission of a user's certificate and displaying a list of data stored in a file management database by outputting a user storage data search window to a screen when the user is a registered member; If the user selects predetermined search data outputted on the screen, reading the search data from the file management database and downloading the search data to the user client; And the user decrypts the archive data downloaded to his client using a non-public key through a storage service program, and decrypts the archive data and checks the archive data. How to provide key infrastructure transaction contents protection service. A user client 10 for the user to access the Internet 20 via a personal computer; The Internet 20, which is a network for transmitting and receiving data through remote communication; A website 30 such as a bank, a securities company, a shopping mall, etc. that provides a predetermined real-time electronic transaction service to users registered as members through the Internet 20; And Users of the client 10 access the website 30 through the Internet 20 to execute a predetermined real-time electronic transaction service, and store the result screen, transaction details, document files, etc. in order to protect the transaction contents. If selected as a public key infrastructure transaction content protection service system using the Internet, characterized in that configured to include a web server for storing the archive file in the recording medium assigned to the user at the time of membership registration. The method of claim 10, The web server 40 includes a program storage unit 41 for storing a storage service program provided to users registered as a member; A member information database 42 for storing and managing personal information and certificates of registered users; A file management database 43 for encrypting and storing the transaction history and the result screen and the general document file requested by the user through the Internet of the registered users; And A public key infrastructure transaction content protection service system using the Internet, comprising a service information database (44) for storing a service overview and a site map of a website providing an electronic transaction protection service.