Electronic apparatus for determining whether a card payment has been fraudulently canceled and operating method thereof

Abstract

A method of operation of an electronic device for determining whether a card payment has been fraudulently canceled is disclosed. A method of operation of an electronic device for determining whether a card payment has been fraudulently canceled according to an embodiment of the present invention may include receiving a first card payment approval request including a first KSN (Key Serial Number), and, when a card payment is approved by a card company server in response to the card payment approval request, storing the first KSN; receiving a card payment cancellation request including a second KSN, and, when the fixed value of the previously stored first KSN and the fixed value of the second KSN match, determining that the card payment cancellation request is valid and transmitting the card payment cancellation request to a card company server.

Description

Technology Field

[0001] The present invention relates to an electronic device for determining whether a card payment has been fraudulently canceled and a method of operating the same, and more specifically, to an electronic device for determining the legitimacy of whether a card payment has been fraudulently canceled and a method of operating the same. Background Technology

[0002] Credit payment services based on card payments have become commonplace. A credit payment service is a payment method utilizing an electronic payment infrastructure in which a user purchases goods or services at a merchant via card payment, pays the usage fee for the said goods or services to the card company, etc. on the payment due date, and the merchant receives the sales proceeds of the said goods or services from the card company, etc.

[0003] Meanwhile, the credit payment system is configured by connecting multiple card terminals equipped at multiple merchants, a server (or payment processing server) of a Value Added Network (VAN) company that provides payment processing services related to card payments between multiple merchants and a card company, and a server of a card company that issued a credit card to a user through a communication network.

[0004] As an example of the technology forming the background of the present invention, Korean Registered Patent Publication No. 10-2022-0142065 (November 6, 2023) discloses a card payment system and a card payment method that, when a failure occurs in the card company's direct authorization payment service, controls the card payment system to transmit the card payment authorization request to a VAN company server instead of sending it directly to the card company, thereby minimizing damage from payment failures to the merchant and enabling the direct authorization payment of the merchant to be performed quickly again. The problem to be solved

[0005] The present invention has been devised to solve the aforementioned problems, and aims to provide a method for preventing fraudulent cancellation by verifying a cancellation request for an already approved card payment. means of solving the problem

[0006] A method of operation of an electronic device for determining whether a card payment is fraudulently canceled according to various embodiments of the present invention may include receiving a first card payment approval request including a first KSN (Key Serial Number), and when a card payment is approved by a card company server in response to the card payment approval request, storing the first KSN; receiving a card payment cancellation request including a second KSN, and when the fixed value of the previously stored first KSN and the fixed value of the second KSN match, determining that the card payment cancellation request is valid and transmitting the card payment cancellation request to the card company server.

[0007] An electronic device for determining whether a card payment is fraudulently canceled according to various embodiments of the present invention may include a storage unit and a processor that receives a first card payment approval request including a first KSN, stores the first KSN when the card payment is approved by a card company server in response to the card payment approval request, receives a card payment cancellation request including a second KSN, and determines that the card payment cancellation request is valid when the fixed value of the previously stored first KSN and the fixed value of the second KSN match, and transmits the card payment cancellation request to the card company server. Effects of the invention

[0008] According to various embodiments of the present invention, fraudulent cancellation can be prevented by verifying a cancellation request for an already approved card payment. Brief explanation of the drawing

[0009] FIG. 1 is a drawing of a card payment system according to one embodiment of the present invention. FIG. 2 is a block diagram of an electronic device according to one embodiment of the present invention. FIG. 3 is a flowchart of a card payment cancellation procedure according to one embodiment of the present invention. FIG. 4 is a detailed block diagram of an electronic device according to one embodiment of the present invention. FIG. 5 is a flowchart of an operation method of an electronic device for determining whether a card payment is fraudulently canceled according to an embodiment of the present invention. Specific details for implementing the invention

[0010] The operating principles of preferred embodiments of the present invention will be described in detail below with reference to the attached drawings. Furthermore, in describing embodiments of the invention, detailed descriptions of related known functions or configurations will be omitted if it is determined that such detailed descriptions could obscure the essence of the present disclosure. Additionally, the terms used below are defined considering their functions in the present invention, and these may vary depending on the intentions or conventions of the user or operator. Therefore, the definitions of the terms used should be interpreted based on the content throughout this specification and the corresponding functions.

[0011] FIG. 1 is a drawing of a card payment system according to one embodiment of the present invention.

[0012] Referring to FIG. 1, a card payment system (10) according to one embodiment of the present invention may include a card reader (100), a payment terminal (200), and a VAN server (300).

[0013] For example, the card reader (100) is a device for obtaining card information including card numbers, and may be various devices such as an MSR (Magnetic Strip Reader) that reads card information from a magnetic card, an IC (Integrated Circuit) card reader that reads card information from an IC card, an NFC reader that receives card information using a near-field wireless communication method, or a barcode reader that reads card information using a barcode.

[0014] For example, the payment terminal (200) may be a terminal equipped with payment functions, such as a POS (point-of-sale terminal) or a CAT (Credit Authorization Terminal). The payment terminal (200) may be equipped with at least one card reader (100) to receive card information.

[0015] Typically, the card reader (100) and the payment terminal (200) may be configured separately but may also be used in combination. For example, the POS terminal (200) may be equipped with one or more card readers (100). Here, the POS terminal (200) may be referred to as a POS system (200) because it is equipped with both a payment function and a card reader function.

[0016] Additionally, the card reader (100) can be used separately from the POS terminal (200), and if connected via an appropriate interface, it can be used in combination with a PC, a mobile computing device such as a smartphone, a PDA (personal digital assistant), or a tablet.

[0017] Hereinafter, various embodiments of the present invention will be described on the premise that a card reader (100) is provided in and used in a payment terminal (200), but the card reader (100) may be used in conjunction with various electronic devices such as the smartphone described above.

[0018] For example, a payment terminal (200) can generate an approval request message using card information received from a card reader (100). Specifically, when a card payment transaction occurs at a merchant, the payment terminal (200) can generate an approval request message based on card information read by the card reader (100), information regarding the payment amount, payment history, etc., which is entered through the input interface of the payment terminal (200) or is previously processed and stored in the computer system, and the payer's signature information, and transmit it to a VAN server (300).

[0019] For example, the VAN server (300) may be a server of a Value Added Network (VAN) company that provides payment processing services in an electronic payment system using credit cards, as an example of a financial server.

[0020] In one example of the present invention described above, the VAN server (300) can transmit an approval result message, which is a response to an approval request message, to a payment terminal (200).

[0021] Here, the term "financial server" may refer to a server that processes information related to financial transactions. For example, a financial server may include a bank server that mediates transactions between financial accounts, a VAN company server that mediates electronic financial card payments, a credit card company server that processes payment approvals for credit card transactions, and various other types of servers. Additionally, depending on specific functions, there may be forms in which actual financial transaction functions and other supplementary functions are separated into separate servers.

[0022] Generally, the devices, systems, and methods disclosed herein may include a number of different devices and computer systems, such as, for example, general-purpose computing systems, server-client computing systems, consumer-merchant computing systems, mainframe computing systems, cloud computing infrastructure, telephone computing systems, laptop computers, desktop computers, smartphones, cellular phones, personal digital assistants (PDAs), tablet computers, and other mobile devices, and may be implemented within the number of different devices and computer systems. The devices and computer systems may include one or more databases and other storage devices, servers, and additional components, for example, processors, modems, terminals and displays, computer-readable media, algorithms, modules and applications, and other computer-related components. The devices and computer systems and / or computing infrastructure may be configured, programmed, and adapted to perform the functions and processes of the systems and methods disclosed herein.

[0023] FIG. 2 is a block diagram of an electronic device according to one embodiment of the present invention.

[0024] Hereinafter, various embodiments of the present invention will be described on the premise that the electronic device (300) is a VAN server (300), but the interpretation will not be limited to a VAN server (300).

[0025] Referring to FIG. 2, the VAN server (300) may include a storage unit (310) and a processor (320).

[0026] The storage unit (310) may include a volatile or non-volatile recording medium.

[0027] The storage unit (310) is connected to one or more processors and can store codes that cause the processor (320) to control the display unit when executed by the processor (320). Additionally, the storage unit (310) can store a payment information library, a hardware control information library, an internal display unit control information library, an external display touch control library, etc.

[0028] Here, the storage unit (310) may include magnetic storage media or flash storage media, but the scope of the present invention is not limited thereto. The storage unit (310) may include internal memory and / or external memory, and may include volatile memory such as DRAM, SRAM, or SDRAM, non-volatile memory such as OTPROM (one time programmable ROM), PROM, EPROM, EEPROM, mask ROM, flash ROM, NAND flash memory, or NOR flash memory, flash drives such as SSD, CF (compact flash) card, SD card, Micro-SD card, Mini-SD card, or memory stick, or storage devices such as HDD.

[0029] For example, the storage unit (310) can store an encryption key management protocol. For example, the VAN server (300) can store a protocol for implementing DUKPT (Derived Unique Key Per Transaction), which is one of the encryption key management methods. Here, DUKPT is a method of generating an encryption key used when the payment terminal (200) encrypts card information and transmits it to the VAN server (300) whenever a card transaction occurs. When using DUKPT, even if the encryption key used for transmitting card information is leaked, the security of the card payment can be guaranteed because a different encryption key is changed for the next transmission.

[0030] The processor (320) can control the overall operation of the VAN server (300).

[0031] For example, the processor (320) can perform an operation to determine whether a card payment has been fraudulently cancelled.

[0032] For example, the processor (320) can determine whether a card payment has been fraudulently cancelled using the KSN (Key Serial Number). For example, the KSN may be 10-byte (80-bit) information used in DUKPT.

[0033] For example, KSN may include a fixed value and a variable value including a Transaction Count. For example, KSN may consist of a fixed value [BDK (2 Bytes) + Date (2 Bytes) + Issue Count (27 Bits)] and a variable value [Transaction Count (21 Bits)].

[0034] Here, the fixed value may include a Base Derivation Key (BDK) ID value and KSN issuance information. For example, the VAN server (300) may generate a BDK that can be used as a first encryption key using a Hardware Security Module (HSM) device, generate an Initial Pin Encryption Key (IPEK) by combining the BDK and KSN in the HSM device, and then the IPEK may be destroyed after generating a Future Key. Additionally, the KSN issuance information may include a KSN creation date value and a KSN issue count value. The KSN issuance information may consist of values ​​that are updated each time a KSN is issued.

[0035] According to one embodiment of the present invention, the processor (320) can determine whether the card payment cancellation request is fraudulent by comparing the KSN information included in the card payment approval request and the KSN information included in the card payment cancellation request.

[0036] Specifically, the processor (320) receives a first card payment approval request including a first KSN, and if the card payment is approved by the card company server in response to the card payment approval request, the processor (320) may store the first KSN. Additionally, the processor (320) may receive a card payment cancellation request including a second KSN, and if the fixed value of the first KSN stored previously matches the fixed value of the second KSN, the processor may determine that the card payment cancellation request is valid and transmit the card payment cancellation request to the card company server.

[0037] For example, the first card payment approval request described above may be a card payment approval request message including a first KSN and first payment information. Additionally, the second card payment cancellation request may be a card payment cancellation request message including a second KSN and second payment information.

[0038] For example, the first KSN may include a fixed value of the first KSN and a variable value including a first transaction count. Additionally, the second KSN may include a fixed value of the second KSN and a variable value including a second transaction count.

[0039] Here, the fixed value of the first KSN and the fixed value of the second KSN may include a BDK (Base Derivation Key) value and KSN issuance information.

[0040] For example, the VAN server (300) can generate a BDK that can be used as a first encryption key using an HSM device, and generate an IPEK (Initial Pin Encryption Key) by combining the BDK and KSN in the HSM device, and then the IPEK can be destroyed after generating a Future Key. In addition, the KSN issuance information may include a KSN creation date value and a KSN issuance count (Issue Count) value. The KSN issuance information may consist of values ​​that are updated each time a KSN is issued.

[0041] According to one embodiment of the present invention, the processor (320) can determine whether a card payment cancellation request is fraudulent by comparing the fixed values ​​of the KSN. That is, if the fixed value of the first KSN and the fixed value of the second KSN match, the processor (320) determines that the card payment cancellation request is not fraudulent and can transmit this to the card company server. For example, the processor (320) compares the BDK value (or BDK ID), KSN issue date, and issue count included in the fixed value of the first KSN with the BDK value, KSN issue date, and issue count included in the fixed value of the second KSN, and if they match, determines that the card payment cancellation request is not fraudulent and can transmit the received card payment cancellation request to the card company server.

[0042] According to another embodiment of the present invention, the processor (320) may determine that a card payment cancellation request is valid if the fixed value of the first KSN and the fixed value of the second KSN match, and the first payment information and the second payment information match. Here, the first payment information and the second payment information may include a card number, a payment amount, and a payment approval number.

[0043] For example, if the first KSN fixed value and the second KSN fixed value match, and the card number, payment amount, and payment approval number included in the first payment information match the card number, payment amount, and payment approval number included in the second payment information, the processor (320) determines that the card payment cancellation request is not fraudulent and may approve the card payment cancellation request or transmit it to the card company server. In this case, the processor (320) may continuously perform a refund procedure following the card payment cancellation.

[0044] According to various embodiments of the present invention, fraudulent cancellation can be prevented by verifying a cancellation request for an already approved card payment.

[0045] FIG. 3 is a flowchart of a card payment cancellation procedure according to one embodiment of the present invention.

[0046] Referring to FIG. 3, prior to performing the card payment process, a procedure to generate and share an encryption key between the card reader (100), the payment terminal (200), and the VAN server (300) may be performed.

[0047] Specifically, the payment terminal (200) can transmit an encryption key transmission request to the VAN server (300) (S310). The VAN server (300) can generate KSN and IPEK (S320) and transmit them to the card reader (100) (S330). In this case, the card reader (100) can store the KSN and generate and store a Future Key (FK) based on the KSN and IPEK (S340).

[0048] Next, after the card payment approval process is performed between the card reader (100), the payment terminal (200), and the VAN server (300), the card payment cancellation process can be performed.

[0049] For example, a payment terminal (200) transmits a card payment approval request to a VAN server (300), and the VAN server (300) receives the approval result of the card company server for the card payment and transmits it to the payment terminal (200) (S350). In this case, the VAN server (300) can receive and store the KSN included in the card payment approval request.

[0050] For example, a VAN server (300) may receive a card payment cancellation request (S360). Here, the VAN server (300) may verify or determine whether the card payment cancellation request is fraudulent by comparing the fixed value of the KSN included in the card payment cancellation request with the fixed value of the KSN received included in the aforementioned card payment approval request (S370). Based on the verification result, the VAN server (300) may transmit whether to approve the payment cancellation or reject the payment cancellation to the payment terminal (200) or card reader (100) (S380).

[0051] According to various embodiments of the present invention, fraudulent cancellation can be prevented by verifying a cancellation request for an already approved card payment.

[0052] FIG. 4 is a detailed block diagram of an electronic device according to one embodiment of the present invention.

[0053] Referring to FIG. 4, the electronic device (400) may include a communication unit (410), a storage unit (420), and a processor (430).

[0054] The communication unit (410) can perform communication. The communication unit (410) can communicate with external electronic devices through various communication methods such as BT (Bluetooth), WI-FI (Wireless Fidelity), ZigBee, IR (Infrared), NFC (Near Field Communication), etc.

[0055] The storage unit (420) can store an O / S (Operating System) software module for operating the electronic device (400), data for configuring various UI screens provided in the display area, etc.

[0056] In addition, the storage unit (420) is readable and writable.

[0057] The processor (430) can control the overall operation of the electronic device (400) using various programs stored in the storage unit (420).

[0058] Specifically, the processor (430) may include RAM (431), ROM (432), main CPU (433), graphics processing unit (434), first to n interfaces (435-1 to 435-n) and a bus (436).

[0059] Here, RAM (431), ROM (432), main CPU (433), graphics processing unit (434), first to n interfaces (435-1 to 435-n), etc. can be connected to each other via a bus (436).

[0060] The first to n interfaces (435-1 to 435-n) are connected to the various components described above. One of the interfaces may be a network interface connected to an external device through a network.

[0061] The ROM (432) stores a set of instructions for booting the system, etc. When a turn-on command is input and power is supplied, the main CPU (433) copies the O / S stored in the storage unit (430) to the RAM (1141) according to the instructions stored in the ROM (432), and executes the O / S to boot the system.

[0062] When booting is complete, the main CPU (433) can copy various stored application programs to RAM (431) and execute the application programs copied to RAM (431) to perform various operations.

[0063] The main CPU (433) can access the storage unit (420) and perform booting using the O / S stored in the storage unit (430). Additionally, the main CPU (433) can perform various operations using various programs, content, data, etc. stored in the storage unit (430).

[0064] The graphics processing unit (434) can generate a screen containing various objects such as icons, images, and text using the operation unit and the rendering unit.

[0065] FIG. 5 is a flowchart of an operation method of an electronic device for determining whether a card payment is fraudulently canceled according to an embodiment of the present invention.

[0066] Referring to FIG. 5, the operation method of an electronic device for determining whether a card payment is fraudulently canceled according to an embodiment of the present invention may include receiving a first card payment approval request including a first KSN, and when the card payment is approved by a card company server in response to the card payment approval request, a process of storing the first KSN (S510); receiving a card payment cancellation request including a second KSN, and when the fixed value of the first KSN and the fixed value of the second KSN stored previously match, determining that the card payment cancellation request is valid and transmitting the card payment cancellation request to a card company server (S520).

[0067] In one embodiment of the present invention described above, the fixed value of the first KSN and the fixed value of the second KSN may include BDK value and KSN issuance information.

[0068] For example, KSN issuance information may include a KSN creation date value and a KSN issuance count value.

[0069] In one embodiment of the present invention described above, the first KSN may include a variable value including a fixed value of the first KSN and a first transaction count. Additionally, the second KSN may include a variable value including a fixed value of the second KSN and a second transaction count.

[0070] For example, the first card payment approval request may be a card payment approval request message including a first KSN and first payment information. Additionally, the second card payment cancellation request may be a card payment cancellation request message including a second KSN and second payment information.

[0071] In addition, the process of approving the above-described card payment cancellation request may include a process of approving the card payment cancellation request when the fixed value of the first KSN and the fixed value of the second KSN match, and the first payment information and the second payment information match.

[0072] In addition, the aforementioned first payment information and second payment information may include a card number, a payment amount, and a payment approval number.

[0073] Meanwhile, the method of operation of an electronic device for determining whether a card payment has been fraudulently canceled according to various embodiments of the present invention described above may be provided to each server or device to be executed by a processor while being implemented as computer-executable program code and stored on various non-transitory computer-readable media.

[0074] For example, a non-transitory computer-readable medium may be provided that stores a program that receives a first card payment approval request including a first KSN, and when a card payment is approved by a card company server in response to the card payment approval request, stores the first KSN, and receives a card payment cancellation request including a second KSN, and when the fixed value of the first KSN and the fixed value of the second KSN stored previously match, determines that the card payment cancellation request is valid and transmits the card payment cancellation request to a card company server.

[0075] A non-transient readable medium refers to a medium that stores data semi-permanently and can be read by a device, rather than a medium that stores data for a short period of time, such as a register, cache, or memory. Specifically, the various applications or programs described above may be stored and provided on non-transient readable media such as CDs, DVDs, hard disks, Blu-ray discs, USBs, memory cards, and ROMs.

[0076] Although embodiments of the present invention have been illustrated and described above, those skilled in the art will understand that various modifications in form and detail may be made without departing from the spirit and scope of the embodiments as defined by the appended claims and equivalents. Explanation of the symbols

[0077] Card Payment System: 10 Payment terminal: 100 VAN Server: 300 Storage: 310, 420 Processors: 320, 430 Communications Department: 410

Claims

Claim 1 A method of operation of an electronic device for determining whether a card payment is fraudulently canceled, comprising: receiving a first card payment approval request, which is a card payment approval request message including a first KSN (Key Serial Number) and first payment information, and, when a card payment is approved by a card company server in response to the first card payment approval request, storing the first KSN and first payment information; and receiving a second card payment cancellation request, which is a card payment cancellation request message including a second KSN and second payment information, and, when the first BDK value, the first KSN creation date, and the first KSN issue count included in the fixed value of the previously stored first KSN match the second BDK value, the second KSN creation date, and the second KSN issue count included in the fixed value of the second KSN match, and the first payment information and the second payment information match, determining that the card payment cancellation request is valid and transmitting the card payment cancellation request to the card company server; Claim 2 delete Claim 3 delete Claim 4 A method of operation of an electronic device according to claim 1, wherein the first KSN includes a variable value including a fixed value of the first KSN and a first transaction count, and the second KSN includes a variable value including a fixed value of the second KSN and a second transaction count. Claim 5 delete Claim 6 delete Claim 7 A method of operation of an electronic device according to claim 1, wherein the first payment information and the second payment information include a card number, a payment amount, and a payment approval number. Claim 8 An electronic device for determining whether a card payment is fraudulently canceled, comprising: a storage unit; and a processor that receives a first card payment approval request, which is a card payment approval request message including a first KSN (Key Serial Number) and first payment information, and when a card payment is approved by a card company server in response to the first card payment approval request, stores the first KSN and first payment information, receives a second card payment cancellation request, which is a card payment cancellation request message including a second KSN and second payment information, and when the first BDK value, the first KSN creation date, and the first KSN issue count included in the fixed value of the previously stored first KSN match the second BDK value, the second KSN creation date, and the second KSN issue count included in the fixed value of the second KSN match, and when the first payment information and the second payment information match, determines that the card payment cancellation request is valid and transmits the card payment cancellation request to the card company server. Claim 9 delete Claim 10 delete Claim 11 An electronic device according to claim 8, wherein the first KSN comprises a variable value including a fixed value of the first KSN and a first transaction count, and the second KSN comprises a variable value including a fixed value of the second KSN and a second transaction count. Claim 12 delete Claim 13 delete Claim 14 In paragraph 8, the electronic device comprising the first payment information and the second payment information, wherein the first payment information and the second payment information include a card number, a payment amount, and a payment approval number.

Images