WO2016159462A1

WO2016159462A1 - Token authentication method and system using verification value generated on basis of current time

Info

Publication number: WO2016159462A1
Application number: PCT/KR2015/009769
Authority: WO
Inventors: 이지호
Original assignee: 비씨카드(주)
Priority date: 2015-04-03
Filing date: 2015-09-17
Publication date: 2016-10-06
Also published as: KR101624266B1

Abstract

According to an embodiment of the present invention, there is provided a method for authenticating a token by a token authentication system, using a verification value generated on the basis of a current time. The method comprises the steps of: generating a verification value using a unique key generated on the basis of the current time, generating a virtual card number including the generated verification value and a token, and issuing the virtual card number to a user's terminal, by a token generating server; receiving an authentication request including identification information corresponding to the virtual card number through a merchant terminal recognized by the user's terminal, by a token verification server; performing authentication of the token included in the virtual card number by the token verification server by regenerating a verification value using the unique key generated on the basis of a time at which the virtual card number is generated and comparing the regenerated verification value and the verification value included in the virtual card number corresponding to the identification information; and when the authentication of the token is completed, transmitting a payment request including the token to a payment server to allow a payment to be carried out by a payment mean matched to the token, by the token verification server.

Description

Token authentication method and token authentication system using verification value generated based on current time

The present invention relates to a token authentication method and a token authentication system using a verification value generated based on a current time, and more particularly, to generate a verification value based on a current time and to authenticate a token using the generated verification value. The present invention relates to a token authentication method and a token authentication system for performing payment when token authentication is completed.

In the transactions through mobile devices, in addition to the mobile card issued in the security area, there is a weakness in the security of transaction duplication, so in order to commercialize payment methods in various forms such as text, barcode, QR code, NFC, one-time virtual card number The use of phosphorus tokens is increasing.

To use the token, the token generation server continues to generate new tokens and issue them to the user terminal, and store the issued tokens in the database for a specified time to validate the tokens, and the token verification server at the time of transaction approval. By comparing the token received from the merchant terminal with the token temporarily stored in the database, the validity of the transaction can be verified, thereby providing appropriate security in a simple manner.

However, in the above-described token use method, since a token generation server and a token verification server exist in the same server, that is, a single system configuration is required, there is a problem that a consistent service is not possible in a sudden situation such as a system failure.

In addition, there is a problem that the token is requested to be issued and verified online at all times in order to use the token, and the procedure must be performed.

Accordingly, there is an increasing demand for various systems in which a system for issuing and authenticating tokens can be physically or logically separated, and there is an urgent need for a solution to the aforementioned problems.

An object of the present invention is to provide a token authentication method and a token authentication system for generating a verification value based on a current time, authenticating a token using the generated verification value, and performing payment when token authentication is completed. .

Another object of the present invention is to provide a token authentication method and a token authentication system in which a device for issuing a virtual card number including a token and a device for authenticating a token are physically or logically separated.

In addition, the present invention provides a token authentication method and token authentication system for mitigating the risk of transaction duplication, simplifying the transaction processing system, and stably using tokens in various media and environments in transactions through mobile devices. It aims to do it.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood from the following description.

According to an embodiment of the present invention for achieving the above object, in the method of authenticating a token in the token authentication system, the token generation server generates a verification value by using a unique key generated based on the current time. Generating a virtual card number including the generated verification value and a token and issuing to the user terminal; Receiving, at a token verification server, an authentication request including identification information corresponding to the virtual card number through an affiliated store terminal recognized from the user terminal; In the token verification server, a verification value is regenerated using a unique key generated based on the generation time of the virtual card number, and a verification value included in the regenerated verification value and the virtual card number corresponding to the identification information is generated. Comparing, performing authentication on a token included in the virtual card number; And when the authentication for the token is completed, transmitting, at the token verification server, a payment request including the token to a payment server, so that payment is performed by a payment means matched with the token. Provided is a token authentication method using a verification value generated based on.

The virtual card number issuing step may include generating, at the token generation server, the unique key using Julian minute numbers based on a current time.

According to another embodiment of the present invention for achieving the above object, in a method for authenticating a token in a token authentication system, after receiving the key generation information from the token generation server in the user terminal, through the key generation information Generating a verification value by using a unique key generated based on a current time, generating a virtual card number including the generated verification value and a token and issuing it to a token store connected to the user terminal; Receiving, at a token verification server, an authentication request including identification information corresponding to the virtual card number through an affiliated store terminal recognized from the user terminal; In the token verification server, a verification value is regenerated using a unique key generated based on the generation time of the virtual card number, and a verification value included in the regenerated verification value and the virtual card number corresponding to the identification information is generated. Comparing, performing authentication on a token included in the virtual card number; And when the authentication for the token is completed, transmitting, at the token verification server, a payment request including the token to a payment server, so that payment is performed by a payment means matched with the token. Provided is a token authentication method using a verification value generated based on.

The virtual card number issuing step may include generating, at the user terminal, the unique key using Julian minute numbers based on a current time.

According to another embodiment of the present invention for achieving the above object, a verification value is generated by using a unique key generated based on the current time, and a virtual card number including the generated verification value and token is generated. Token generation server to issue to the user terminal; An affiliated store terminal recognizing identification information corresponding to the virtual card number from the user terminal; Receives an authentication request including the recognized identification information through the affiliated store terminal, regenerates a verification value using a unique key generated based on a generation time of the virtual card number, and generates the regenerated verification value and the identification. A token verification server that compares the verification value included in the virtual card number corresponding to the information and performs authentication on the token included in the virtual card number; And a payment server configured to receive a payment request including the token from the token verification server and perform a payment by a payment means matched with the token when authentication of the token is completed. .

The token generation server may generate the unique key using Julian minute numbers based on the current time.

According to another embodiment of the present invention for achieving the above object, after receiving the key generation information from the token generation server, the verification value by using a unique key generated based on the current time through the key generation information A user terminal for generating and issuing a virtual card number including the generated verification value and the token to a token store; An affiliated store terminal recognizing identification information corresponding to the virtual card number from the user terminal; Receives an authentication request including the recognized identification information through the affiliated store terminal, regenerates a verification value using a unique key generated based on a generation time of the virtual card number, and generates the regenerated verification value and the identification. A token verification server that compares the verification value included in the virtual card number corresponding to the information and performs authentication on the token included in the virtual card number; And a payment server configured to receive a payment request including the token from the token verification server and perform a payment by a payment means matched with the token when authentication of the token is completed. .

The user terminal may generate the unique key using Julian minute numbers based on the current time.

According to an embodiment of the present invention, since a device for issuing a virtual card number including a token and a device for authenticating a token may be provided in a token authentication system in which the token is physically or logically separated, even in an unexpected situation such as a system failure. It can provide a consistent service.

In addition, according to an embodiment of the present invention, since the user terminal may generate a verification value by itself, even when offline, and issue a virtual card number including the verification value and the token, the token is not always connected online. Issue of the virtual card number issuance can be made.

According to an embodiment of the present invention, in a transaction through a mobile device, it is possible to reduce the risk of transaction duplication, simplify the system of distance processing, and secure the security of token use in various media and environments. have.

The effects of the present invention are not limited to the above-described effects, but should be understood to include all the effects deduced from the configuration of the invention described in the detailed description or claims of the present invention.

1 is a diagram illustrating a token authentication system according to an embodiment of the present invention.

2 is a diagram illustrating a process of performing a payment through token authentication according to an embodiment of the present invention.

3 is a diagram illustrating a process of performing a payment through token authentication according to another embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings will be described the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is "connected" to another part, it includes not only "directly connected" but also "indirectly connected" with another member in between. . In addition, when a part is said to "include" a certain component, this means that it may further include other components, without excluding the other components unless otherwise stated.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Referring to Figure 1, the token authentication system according to an embodiment of the present invention is a user terminal 100, merchant terminal 200, token generation server 300, token verification server 400 and communication with each other via a communication network and It may include a payment server 500.

First, a communication network can be configured without regard to its communication aspects such as wired and wireless. Local area network (LAN), metropolitan area network (MAN: Metropolitan Area Network), it may be configured with a variety of communication networks such as wide area network (WAN). Preferably, the communication network according to the present invention may be a mobile communication network, and may be another well-known World Wide Web (WWW) or the like.

The user terminal 100 may be any type of handheld based wireless communication that can be connected to an external server through a network such as a mobile phone, a smartphone, a personal digital assistant (PDA), a portable multimedia player (PMP), a tablet PC, and the like. The device may include a device, and may also include a communication device that may be connected to an external server through a network, such as an IPTV including a desktop PC, a tablet PC, a laptop PC, and a set-top box.

The user terminal 100 may perform user authentication by using a pre-registered personal identification means such as SMS, public certificate, payment password, and the like.

The user terminal 100 may generate identification information corresponding to the virtual card number by using the virtual card number issued by the token generation server 300 and allow the corresponding identification information to be recognized by the affiliated store terminal 200. have. Here, the identification information may be formed in various forms such as voice, text, barcode, QR code, NFC tag information, may include information of the payment means, or may include specific information corresponding to the payment means.

That is, the user terminal 100 may be used as various payment means such as voice, text, barcode, QR code, NFC, etc. by using the identification information corresponding to the virtual card number, the identification information is the merchant terminal 200 ), The payment may be requested through a pre-registered payment means corresponding to the identification information.

The affiliated store terminal 200 is a terminal installed in an affiliated affiliate store of a business operator (for example, a card company) operating the payment server 500, and may be a POS terminal, and a POS value may be previously issued to the POS terminal. Here, the POS value may be issued to a part of the plastic card (for example, the TRACK2 area) as a service code value for processing the cooperative service in the card system.

According to one embodiment of the invention, the area in which the POS value is issued to the actual card may be composed of a card number, expiration date, service code (CVC), RPU, etc., virtual card number, token validity period, service code ( CVC), verification values, and the like.

The affiliated store terminal 200 may recognize identification information corresponding to the virtual card number from the user terminal 100.

For example, the affiliated store terminal 200 may recognize identification information such as a barcode and a QR code displayed on the user terminal 100. When the user terminal 100 is located within a certain distance, NFC may be established through short-range communication. Identification information such as a tag may be recognized.

The affiliated store terminal 200 may transmit an authentication request including identification information recognized from the user terminal 100 to the token verification server 400. In this case, the affiliated store terminal 200 may transmit an authentication request to the token verification server 400 so that payment through a pre-registered payment means corresponding to the identification information is performed.

The token generation server 300 may generate a verification value by using a unique key generated based on the current time. In this case, the token generation server 300 may generate a verification value after the user authentication is completed in the user terminal 100.

According to an embodiment of the present invention, the verification value is a hash value generated through cryptographic and hash operations every time a virtual card number is generated or an authentication request, in order to verify the validity of a payment, in the token verification server 400. It can be used to check if the token is issued normally.

In addition, the length of the verification value may be set to be used less than a predetermined digit, in this case, a number located outside the predetermined digit may not be used. For example, when only the first five digits of the verification value are set to be used, when the verification value is eight digits, only the first five digits may be used and the latter three digits may not be used.

Hereinafter, the process of generating the verification value by connecting the token generating server 300 to the payment server 500, but is not limited thereto, the token generating server 300 is included in the payment server 500, payment The server 500 may perform a function of the token generation server 300.

First, the token generation server 300 may obtain a master key from the payment server 500 that manages information about payment means (for example, cards) previously issued to the user. At this time, the payment server 500 may generate and manage a master key for each user registered as a member in advance in order to use a payment method. For example, when the payment server 500 is a card company server, the card company server may A master key can be generated and managed for each user registered as a card member.

According to an embodiment of the present invention, the master key is a unique key that matches the identification number (for example, the card number) of the payment means issued to the user, and may be used in the encryption process when generating the verification value.

The token generation server 300 may generate a card key using the master key. Here, the card key may be utilized for verification or user authentication for each card.

The token generation server 300 may generate a session key using the card key. At this time, the token generation server 300 may generate a separate session key using each minute and additional data using the Julian minute number.

According to one embodiment of the present invention, the Julian minute number is an extension of the Julian date to minutes, which means the number of days that have elapsed since the start of a particular year, for example, Julian for January 15, 2015. The date may be "15".

That is, the line number of minutes means the number of minutes that have elapsed since the start of a particular year. For example, the number of Julian minutes for January 15, 2015, corresponds to 15 days, 24 hours, and 60 minutes. It may be "21600" calculated by multiplying the number.

The token generation server 300 may generate a session key which is a unique key using Julian minute number based on the current time when user authentication is completed, and generate a verification value using the generated session key. That is, the token generation server 300 may generate a verification value by using a unique key generated based on the current time.

The token generation server 300 may generate a virtual card number including the generated verification value and the token, and issue the generated virtual card number to the user terminal 100.

According to an embodiment of the present invention, the token is a virtual card number designated to be used in a payment service, and may be a one-time token that can be used until a predetermined token validity period expires, and the token validity period is in YYMM format. 0 to 4 digits may be used depending on the length of the token. For example, the virtual card number may be a total of 21 digits, the token may be configured to 16 digits, the verification value is 5 digits, but the virtual card number may be configured, but is not limited thereto. have.

The token verification server 400 may receive an authentication request from the affiliated store terminal 200 and regenerate the verification value using a unique key generated based on the token generation time.

Upon regenerating the verification value, the token verification server 400 generates a session key which is the only key using the Julian minute number, as described above, based on the time at which the token generation server 300 generates the virtual card number. You can regenerate verification values.

The token verification server 400 may perform authentication on the token by comparing the regenerated verification value with the verification value included in the virtual card number, that is, the verification value generated by the token generation server 300. In this case, the verification value generated by the token generation server 300 and the verification value generated by the token verification server 400 are the same or corresponding values, and the token verification server 400 compares the verification values and compares them. If the result matches or is found to match, the authentication for the token can be completed.

For example, the validity period is set to 3 minutes in the virtual card number, and the token generation server 300 generates the first verification value based on the current time at 10:05, thereby generating the first verification value and the token. After issuing the virtual card number, it is assumed that the token verification server 400 received the authentication request from the merchant terminal 200 at 10:08.

First, the token verification server 400 may generate a second verification value based on 10: 7 within 10 minutes from 3 minutes to 10 minutes, and compare the first verification value with the second verification value. When the first verification value is generated based on 10: 5 and the second verification value is generated based on 10: 7, the comparison result may not match.

Thereafter, the token verification server 400 may generate a second verification value based on 10: 6, which is one minute earlier than 10: 7, and may compare the first verification value with the second verification value. The results may not match.

Thereafter, the token verification server 400 may generate a second verification value based on 10: 5, which is one minute earlier than 10: 6, and may compare the first verification value with the second verification value. Since both the first verification value and the second verification value are generated based on 10:05, the comparison result is consistent, so that authentication of the token can be completed.

That is, the token verification server 400 accelerates the time by one minute from the time when the authentication request is received until the validity period set in the virtual card number, generates a verification value based on each time, and compares the token to the token through the comparison process. Authentication can be performed.

Accordingly, when generating the virtual card number including the token and authenticating the token, since verification data can be generated only if the basic data and algorithm are known, it is not necessary to generate or verify by one subject. As shown in FIG. 3, separation of the token generation server 300 and the token verification server 400 may be possible. However, the present invention is not limited thereto, and the token generation server 300 and the token verification server 400 may be implemented as one integrated server.

When the authentication for the token is completed, the token verification server 400 may transmit a payment request to the payment server 500. At this time, the token verification server 400 may check the token included in the virtual card number corresponding to the identification information by using the identification information included in the authentication request received from the merchant terminal 200, and includes the corresponding token. The payment request may be transmitted to the payment server 500.

The payment server 500 may receive a payment request including the token from the token verification server 400 that has completed the authentication of the token, and check the payment method matched with the token to perform payment with the corresponding payment method. Can be.

When the payment is completed, the payment server 500 may transmit the payment completion details to the user terminal 100 or the affiliated store terminal 200.

In FIG. 2, a process of performing operations in the token generation server 300 and the token verification server 400, respectively, is not limited thereto, and the token generation server 300 and the token verification server 400 are integrated into one. The server may perform operations, and the payment server 500 may include both the token generation server 300 and the token verification server 400, and may perform all operations in the payment server 500.

First, in step S201, the user terminal 100 may perform the user authentication by the user authentication means such as SMS, authorized certificate, payment password.

In operation S202, the user terminal 100 may transmit user authentication completion information for notifying that the user authentication is completed, to the token generation server 300. At this time, in step S201, when the user terminal 100 performs the user authentication through the payment server 500, such as payment password, the token generation server 300 receives the user authentication completion information from the payment server 500 You may.

The token generation server 300 may confirm that the user authentication is completed in the user terminal 100 by using the user authentication completion information received in step S202.

In operation S203, the token generation server 300 may generate a session key which is the only key based on the current time, and generate a verification value by using the session key and user information or payment information. A virtual card number including a token, a verification value, and the like may be generated.

For example, the token generation server 300 may generate a 21-digit virtual card number including a 16-digit token corresponding to the actual card number issued to the user and a 5-digit verification value generated based on the current time.

When generating the virtual card number in the token generation server 300, a Cryptogram version value, a transaction classification value, PAN, PAN validity period, MD key, etc. may be used or generated.

According to an embodiment of the present invention, the Cryptogram version value is a value that specifies the type and length of encryption and data used for generation and authentication of a verification value for payment service, and the most efficient encryption according to the environment in which the virtual card number is issued. It can be a formatted, version-separated value.

According to an embodiment of the present invention, the transaction division value is a code value for division of a transaction type of a payment service, and may be a code value separately provided for each payment method.

According to an embodiment of the present invention, the PAN is a real card number matched with the token, the PAN validity period is a card validity period set in the real card, and may be in the form of YYMM, and the MD key is a HSM (High Speed Memory) master master key. Can be stored).

In operation S204, the token generation server 300 may issue and transmit the virtual card number generated in operation S203 to the user terminal 100.

In operation S205, the user terminal 100 may generate identification information corresponding to the virtual card number by using the virtual card number issued from the token generation server 300. That is, the user terminal 100 may generate identification information corresponding to the virtual card number so that the user terminal 100 may be used as various payment means such as voice, text, barcode, QR code, and NFC.

In operation S206, the user terminal 100 may transmit identification information to the affiliated store terminal 200, and the affiliated store terminal 200 may recognize the corresponding identification information.

Specifically, when the user terminal 100 directly transmits identification information such as an NFC tag to the affiliated store terminal 200 using near field communication, the affiliated store terminal 200 may recognize the corresponding identification information, and the user When the terminal 100 displays identification information such as a barcode or a QR code on the screen, the affiliated store terminal 200 may recognize the identification information using a reader connected to the affiliated store terminal 200.

In operation S207, the affiliated store terminal 200 may transmit an authentication request including identification information recognized from the user terminal 100 to the token verification server 400. At this time, the affiliated store terminal 200 may transmit an authentication request to the token verification server 400 in a VAN or a direct approval method.

In operation S208, the token verification server 400 may generate a unique key based on the generation time of the virtual card number generated in operation S203, and then regenerate the verification value using the generated unique key. have.

Thereafter, the token verification server 400 checks the virtual card number corresponding to the identification information included in the authentication request received in step S207, compares the verification value included in the virtual card number with the regenerated verification value to the token. Authentication can be performed. At this time, the token verification server 400 may allow the transaction for payment by completing the authentication for the token when the verification values match.

According to an embodiment of the present invention, the data used for token authentication may be a token, a token validity period, Julian minute number, a verification value, a POS value, a Cryptogram version value, a transaction classification value, and the like.

In step S209, the token verification server 400 may transmit a payment request including the token to the payment server 500 in step S207 when authentication for the token is completed.

In operation S210, the payment server 500 may check the token included in the payment request according to the payment request received in operation S209 and perform payment by a payment means matched with the token.

Thereafter, the payment server 500 may transmit the payment completion details to the user terminal 100 or the affiliated store terminal 200.

In FIG. 3, a process of generating a virtual card number in the user terminal 100 is illustrated, and a description overlapping with the description in FIG. 2 will be omitted.

First, in step S301, the user terminal 100 may perform user authentication, as in step S201.

If the user terminal 100 is provided with a secure token storage secured, or if the user terminal 100 and the token storage is connected, even if the user authentication is completed, the token generation server 300 directly to the virtual card number You can only perform the process of requesting token issuance without creating it. For example, the token generation server 300 may transmit only key generation information, which is basic data required for key generation, to the user terminal 100.

In operation S302, the user terminal 100 may generate a unique key by using the Julian minute number based on the operation performed by the token generation server 300 in operation S203, that is, the current time, and generate the unique key. Using to generate a verification value, to generate a virtual card number including the verification value and the token, it is possible to issue the generated virtual card number to the token storage.

When the virtual card number is generated, the user terminal 100 may generate a verification value by itself using the key generation information received from the token generation server 300 in advance, so that the user terminal 100 generates the verification value every time a transaction request is generated. Since the verified value does not need to be received, the virtual card number can be generated even offline.

In operation S303, the user terminal 100 may generate identification information corresponding to the virtual card number, as in operation S205.

In operation S304, the user terminal 100 may transmit identification information to the affiliated store terminal 200, in operation S206.

In operation S305, the affiliated store terminal 200 may transmit an authentication request including identification information to the token verification server 400, as in operation S207.

In operation S306, the token verification server 400 may perform authentication on the token, as in operation S208.

In operation S307, the token verification server 400 may transmit a payment request to the payment server 500 as in operation S209.

In operation S308, the payment server 500 may perform payment according to a payment request, as in operation S210.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is represented by the following claims, and it should be construed that all changes or modifications derived from the meaning and scope of the claims and their equivalents are included in the scope of the present invention.

100: user terminal

200: merchant terminal

300: token generation server

400: token verification server

500: payment server

Claims

A method of authenticating a token in a token authentication system,

Generating, at a token generation server, a verification value by using a unique key generated based on a current time, and generating and issuing a virtual card number including the generated verification value and a token to a user terminal;

Receiving, at a token verification server, an authentication request including identification information corresponding to the virtual card number through an affiliated store terminal recognized from the user terminal;

In the token verification server, a verification value is regenerated using a unique key generated based on the generation time of the virtual card number, and a verification value included in the regenerated verification value and the virtual card number corresponding to the identification information is generated. Comparing, performing authentication on a token included in the virtual card number; And

When the authentication for the token is completed, the token verification server, the payment request containing the token to the payment server, so that the payment is performed by the payment means matched with the token, the current time Token authentication method using the verification value generated as a basis.
The method of claim 1,

The virtual card number issuing step,

Generating, at the token generation server, the unique key using the Julian minute number based on the current time, using the verification value generated based on the current time.
A method of authenticating a token in a token authentication system,

After receiving the key generation information from the token generation server, the user terminal generates a verification value using the unique key generated based on the current time through the key generation information, and includes the generated verification value and the token. Generating a virtual card number and issuing it to a token store connected to the user terminal;

Receiving, at a token verification server, an authentication request including identification information corresponding to the virtual card number through an affiliated store terminal recognized from the user terminal;

In the token verification server, a verification value is regenerated using a unique key generated based on the generation time of the virtual card number, and a verification value included in the regenerated verification value and the virtual card number corresponding to the identification information is generated. Comparing, performing authentication on a token included in the virtual card number; And

When the authentication for the token is completed, the token verification server, the payment request containing the token to the payment server, so that the payment is performed by the payment means matched with the token, the current time Token authentication method using the verification value generated as a basis.
The method of claim 3,

The virtual card number issuing step,

Generating, at the user terminal, the unique key using the Julian minute number based on the current time, using the verification value generated based on the current time.
A token generation server generating a verification value using a unique key generated based on a current time, generating a virtual card number including the generated verification value and a token and issuing it to a user terminal;

An affiliated store terminal recognizing identification information corresponding to the virtual card number from the user terminal;

Receives an authentication request including the recognized identification information through the affiliated store terminal, regenerates a verification value using a unique key generated based on a generation time of the virtual card number, and generates the regenerated verification value and the identification. A token verification server that compares the verification value included in the virtual card number corresponding to the information and performs authentication on the token included in the virtual card number; And

And a payment server configured to receive a payment request including the token from the token verification server when the authentication of the token is completed, and to perform a payment by a payment means matched with the token.
The method of claim 5,

And the token generation server generates the unique key using Julian minute digits based on the current time.
After receiving key generation information from the token generation server, a verification value is generated using the unique key generated based on the current time through the key generation information, and a virtual card number including the generated verification value and token is generated. A user terminal that generates and issues the token storage;

An affiliated store terminal recognizing identification information corresponding to the virtual card number from the user terminal;

Receives an authentication request including the recognized identification information through the affiliated store terminal, regenerates a verification value using a unique key generated based on a generation time of the virtual card number, and generates the regenerated verification value and the identification. A token verification server that compares the verification value included in the virtual card number corresponding to the information and performs authentication on the token included in the virtual card number; And

And a payment server configured to receive a payment request including the token from the token verification server when the authentication of the token is completed, and to perform a payment by a payment means matched with the token.
The method of claim 7, wherein

And the user terminal generates the unique key using Julian minute digits based on the current time.