KR20060003712A - Memory assignment and cancel method for a smart card with plural security domains - Google Patents

Abstract

The present invention relates to a method for allocating and releasing memory for each security area for a smart card having a plurality of security areas. According to a request of the host computer, the smart card grasps available information of its own memory and provides it to the host computer. When the host computer requests memory allocation for each security zone, the host computer determines an identifier of the security zone and a memory size to be allocated from the received memory allocation request signal, and then, as much as the memory size to allocate for the security zone corresponding to the identified identifier, is determined. The fixed allocation is performed. The memory allocation information is stored in the fixed allocation area, and the host computer is notified of the completion of allocation. In addition, the smart card reads the memory information fixedly allocated to each of the security areas stored therein and provides the host computer to the host computer according to the request of the host computer. After identifying the identifier of the secured area from the signal, the allocated memory is released for the secured area corresponding to the identified identifier, the memory release information for the corresponding secured area is stored, and the host computer is notified of the completion of release. Free the allocated memory.

Smart card, memory allocation by security area, memory release, host computer

Description

Memory assignment and cancel method for a smart card with multiple security zones {Memory assignment and cancel method for a smart card with plural security domains}

1 is an internal configuration diagram of a conventional open platform-based smart card.

2 is a signal flow diagram illustrating a process of allocating a fixed memory for each security area according to an embodiment of the present invention.

3 is a signal flow diagram illustrating a process of releasing a fixed memory allocated to each security area according to an embodiment of the present invention.

The present invention relates to a smart card, and more particularly, to a method of allocating and releasing memory for each security area of a smart card having a plurality of security areas.

Generally, smart card is a chip or credit card type and has a point-of-sale management system, a cash machine and a card reader function with a built-in CPU for operation and memory for storage (RAM, EEPROM, etc.). , Vending machines, computers, etc. are used in various forms, and their use is gradually increasing.

Examples of applications to which smart cards are currently used are prepaid cards, credit cards, mobile banking, securities, etc. In addition, they are used as mileage cards to accumulate points provided by companies or stores, or users It is used to store information about. Smart cards can be applied to many applications.

Currently, open platform-based smart card technology has been developed to accommodate many applications in a single smart card, so that multiple applications can be loaded on a single card.

The above-described open platform based smart card will be briefly described with reference to FIG. 1. 1 is an internal configuration diagram of a conventional open platform-based smart card.

As shown in FIG. 1, the conventional open platform-based smart card 100 includes a hardware and a basic OS 110, an open platform environment unit 120, and an application environment unit 130.

Hardware and basic OS 110 is composed of basic hardware and operating system (OS) for the operation of the smart card.

In addition, the open platform environment unit 120 is a module representing a card issuer on a smart card, and is configured to include a cardholder authentication program in addition to the issuer security area 130 and the open platform environment unit 120 described above.

The open platform environment 120 described throughout the present invention is a module representing a card issuer on a smart card, and provides an application program interface to an installed application so that applications can use the functions of the open platform environment 120 and the like. It also serves to manage card content, and includes an issuer security area 121 for the card issuer. In addition, the open platform environment unit 120 includes an authentication program for cardholders.

The issuer security area 121 is an area allocated to the card issuer, and stores a key set assigned to the card issuer and loads, installs, or deletes card content of the card issuer or the AP. In charge. Otherwise, the same function as that of the general AP security zone 133 is performed.

The application environment unit 130 includes applications 131 mounted by the card issuer, applications 132 mounted by an application provider (hereinafter referred to as an 'AP'), and an AP security domain. 133.

The AP security area 133 is a module representing the AP on the card. The AP security area 133 stores a key set of the AP and serves as key management, encryption, signature generation, and signature verification. The issuer application 131 is an application mounted on the card by the card issuer, and the AP application 132 is an application loaded in the card after the AP has passed a predetermined authorization process of "delegation management" to the card issuer.

In addition, the smart card 100 includes a runtime environment unit 140 and an OPAI (Open Platform Application Interface) unit 150 for driving the open platform environment unit 120, and the like (140, 150, etc.). ) Will be linked to the operation of the hardware of the smart card (100).

The conventional smart card 100 configured as described above cannot be allocated by fixing the memory (EEPROM, etc.) for each issuer security area 121 and AP security area 1330, and among the applications mounted on each security area first. The installed application is supposed to take up memory.

However, when several card issuers cooperate to provide various applications in a single card, the card issuer prefers to issue a card independently if the card memory cannot be secured in advance in the security area allocated to the card issuer. This causes inconvenience and economic waste for the user to carry several cards.

Accordingly, an object of the present invention is to enable a fixed allocation and release of card memory for each security area in an open platform smart card.

The present invention for achieving the above object is a method for allocating memory for each security area for a smart card having a plurality of security areas using a host computer, the smart card is available information of its own memory in accordance with the request of the host computer Identifying and providing the same to the host computer; A second step of determining, by the smart card, an identifier of a security area and a memory size to be allocated from the memory allocation request signal received from the host computer according to a memory allocation request for each security area of the host computer; A third step of fixedly allocating as much as the size of the memory to be allocated to the security area corresponding to the identified identifier; And a fourth step of storing memory allocation information for the fixed-allocated security region and notifying the host computer of the completion of the allocation.

In order to achieve the above object, the present invention provides a method of releasing memory allocated for each security area for a smart card having a plurality of security areas by using a host computer, wherein the smart card is stored in accordance with a request of the host computer. A first step of reading fixedly allocated memory information for each security area and providing the same to the host computer; A second step of identifying, by the smart card, an identifier of a security region from the memory release request signal received from the host computer according to a memory release request for each security region of the host computer; A third step of releasing the allocated memory for the security area corresponding to the identified identifier; And a fourth step of storing memory release information for the corresponding security area and notifying the host computer of the completion of the release. .

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings.

Prior to the description, the present invention will be described an embodiment of the above-described conventional smart card. Herein, the smart card to which the present invention is applied is not limited to the structure of the conventional smart card described above, but may be applied to a smart card having a plurality of AP security areas and a plurality of issuer security areas. It will be apparent to those skilled in the art that it can be easily implemented. On the other hand, the smart card applied to the present invention preferably set a certain area in the memory allocation management DB of the internal memory of the open platform environment.

For the purposes of the present invention, an external device for transmitting a command of the operator to the smart card 100 is required. The external device is an apparatus that can form an interface with the open platform environment unit 120 of the smart card 100 to transmit a control command and provide data to the smart card 100, in particular, the host computer 200 of the card issuer or the like. Preferably, the host computer 200 of the AP.

Hereinafter, a process of allocating a fixed memory for each security area according to an embodiment of the present invention will be described with reference to FIG. 2. 2 is a signal flow diagram illustrating a process of allocating a fixed memory for each security area according to an embodiment of the present invention.

First, the worker connects the input / output terminal of the smart card 100 to the host computer 200 and then manipulates the host computer 200 to call the open platform environment unit 120 of the smart card 100 (201). The open platform environment 120 then receives the call signal from the host computer 200 and transmits a response signal to the host computer 200 to the host computer 200 (202).

When the response signal is received from the open platform environment unit 120, the host computer 200 transmits a memory information request signal for requesting information about the available memory of the smart card 100 to the open platform environment unit 120 (203). .

 When the open platform environment unit 120 receives the memory information request signal, the open platform environment unit 120 transmits the received information to the hardware and the OS unit 110 (204). The hardware and OS unit 110 checks information on the available capacity in its own memory and uses the available capacity. Information about the data is transmitted to the open platform environment unit 120 as memory information (205). The usable capacity is the usable capacity of the EEPROM or / and RAM included in the hardware and OS unit 110.

The open platform environment unit 120 receiving the memory information from the hardware and the OS unit 110 stores the memory information, that is, the available capacity information of the memory in the memory allocation management DB allocated to its own memory (206), and stores the memory information. Provided to host computer 200 (207).

The host computer 200 receives and displays the memory information, and the worker confirms the available capacity through the memory information. In addition, the host computer 200 may identify identification information of the security area to which memory is allocated and size information of the memory to be allocated to the security area in order to allocate memory for each security area within the available capacity according to the operator's operation. It is included in the secure area memory allocation request signal and transmitted to the open platform environment unit 120 (208). When the open platform environment unit 120 receives the memory allocation request signal, the open platform environment unit 120 transmits the signal to the hardware and OS unit 110 (209).

The hardware and OS unit 110 checks the identification information of the security area and the memory size to be allocated through the received memory allocation request signal and allocates the memory size to be allocated as the memory for the security area from the available capacities of the memory ( 210). When the memory allocation is performed in this way, the hardware and OS unit 110 transmits a response signal indicating the completion of the memory allocation to the open platform environment unit 120 (211).

When the open platform environment unit 120 receives a response signal indicating that the memory allocation is completed, after storing the memory allocation information for the specific security area performed by the hardware and the OS unit 110 in the memory allocation management DB (212), the memory allocation The response signal informing of completion is transmitted to the host computer 200 (213).

When the host computer 200 receives a response signal informing that the memory allocation is completed, the host computer 200 displays this on the screen, and the worker knows that the work has been successfully completed.

The memory of a specific capacity fixedly allocated to the hardware and the memory of the OS unit 110 through the above-described process is used for the corresponding security area, and the process of allocating the memory of the predetermined capacity for the other security area is repeated. Is achieved.

Hereinafter, a method of releasing a fixed memory allocated to each security area according to an embodiment of the present invention will be described with reference to FIG. 3. 3 is a signal flow diagram illustrating a process of releasing a fixed memory allocated to each security area according to an embodiment of the present invention.

First, the worker connects the input / output terminal of the smart card 100 to the host computer 200 and then manipulates the host computer 200 to call the open platform environment unit 120 of the smart card 100 (301). The open platform environment 120 then receives the call signal from the host computer 200 and transmits a response signal to the host computer 200 to the host computer 200 (302).

When the host computer 200 receives the response signal, the host computer 200 transmits a security area memory allocation information request signal for requesting memory information fixedly allocated to the security area to the open platform environment unit 120 (303).

In this case, the security region memory allocation information request signal may include identifier information of the corresponding security region that is the request target, and may include an available capacity request message of the smart card. When the available capacity request message of the smart card is included, the host computer 200 is provided with the available capacity information of the smart card at the present time along with the memory allocation information for the corresponding security area from the open platform environment unit 120. .

 The open platform environment unit 120 determines which security area is an identifier of the security area included in the security area memory allocation information request signal received from the host computer 200, and stores the memory allocation information corresponding to the identified security area. Read from the allocation management DB and transmits it to the host computer 200 (304).

When the host computer 200 receives the memory allocation information for the security area from the open platform environment unit 120, the host computer 200 displays the information on the screen so that the operator can know it. Then, the worker knows the memory information fixedly allocated to the security area, and instructs the host computer 200 to release the confirmed fixed allocation memory information.

The host computer 200 transmits a secure area memory release request signal to the open platform environment unit 120 to request release of the fixedly allocated memory for the corresponding security area according to an operator's command (305), and the open platform environment unit ( 120 transmits the secure area memory release request signal to the hardware and OS unit 110 (306). The security region memory release request signal includes the identifier and memory allocation information of the security region.

When the hardware and OS unit 110 receives the secure area memory release request signal, the hardware and OS unit 110 releases the fixedly allocated memory for the corresponding secure area (307), and sends a response signal to the open platform environment unit 120 to indicate completion of memory allocation. Transmit (308).

Then, the open platform environment unit 120 stores the memory allocation release information according to the received response signal and deletes the memory allocation information for the corresponding security area stored in the memory allocation management DB (309). In operation 310, the open platform environment unit 120 transmits a response signal indicating the completion of memory allocation to the host computer 200.

When the host computer 200 receives the response signal, the host computer 200 displays it on the screen to let the user know.

On the other hand, the present invention can perform memory allocation for one security area as described above, but can deallocate memory for the entire security area that is fixed memory allocation in a batch. In the case of batch processing, the present invention can achieve this by making the identifier of the security area to be deallocated memory refer to the entire security area.

As described above, the present invention can release all of the fixedly allocated memories for the secure area and only partially release the memory. In this case, the present invention can achieve this by including the size information of the memory to be released or the size information of the memory to be released in the memory release request signal.

The technical spirit of the present invention has been described above with reference to the accompanying drawings, but this is by way of example only and not intended to limit the present invention. In addition, it is obvious that any person skilled in the art can make various modifications and imitations without departing from the scope of the technical idea of the present invention.

The present invention, by adding a card memory fixed allocation function for each security area to the smart card, it is possible to provide a variety of applications to a single smart card by the cooperation of several card issuers, each card issuer receives a rental cost By re-lease, smart card memory distribution and rental business is possible. In addition, the present invention has the effect of providing the convenience of use to customers because it is possible to use a variety of applications mounted on one card.

Claims (7)

In the method for allocating memory for each security zone for a smart card having a plurality of security zones by using a host computer, A first step of identifying, by the smart card, available information of its own memory and providing it to the host computer according to a request of the host computer; A second step of determining, by the smart card, an identifier of a security area and a memory size to be allocated from the memory allocation request signal received from the host computer according to a memory allocation request for each security area of the host computer; A third step of allocating the smart card to the secure area corresponding to the identified identifier by as much as the size of the memory to be allocated; And The smart card includes a fourth step of storing the memory allocation information for the fixed-allocated security area and notifying the host computer of the completion of the allocation, for each security area of the smart card having a plurality of security areas. Memory allocation method. The method of claim 1, After the first step, the smart card further comprises the step of storing the memory available information identified in the first step in a separate database for storing memory allocation information for each security area. Method of memory allocation by security zone for smart card with. A method of releasing memory allocated for each security zone for a smart card having a plurality of security zones by using a host computer, A first step of reading, by the smart card, the memory information fixedly allocated to each of the secure areas stored therein and providing the smart card to the host computer according to a request of the host computer; A second step of identifying, by the smart card, an identifier of a security region from the memory release request signal received from the host computer according to a memory release request for each security region of the host computer; A third step of the smart card releasing the allocated memory for the security area corresponding to the identified identifier; And The smart card includes a fourth step of storing the memory release information for the corresponding security area and notifying the host computer of the completion of release. . The method of claim 3, The memory release request signal includes the identifier of the security area and the size information of the memory to be deallocated, characterized in that the security area for each security area for a smart card having a plurality of security areas. The method of claim 4, wherein The size information of the memory to be released is a memory size for each security area for a smart card having a plurality of security areas, characterized in that the memory size fixedly allocated to the security area or a portion of the memory size fixedly allocated to the security area. On smart card, A first step of identifying, by the smart card, available information of its own memory and providing it to the host computer according to a request of a host computer; A second step of determining, by the smart card, an identifier of a security area and a memory size to be allocated from the memory allocation request signal received from the host computer according to a memory allocation request for each security area of the host computer; A third step of allocating the smart card to the secure area corresponding to the identified identifier by as much as the size of the memory to be allocated; And The smart card is a computer-readable recording medium having stored therein a program for executing the fourth step of storing the memory allocation information for the fixed-allocated security area and informing the host computer of the completion of the allocation. On smart card, A first step in which the smart card reads the memory information fixedly allocated to each of the secure areas stored in the storage area and provides it to the host computer according to a request of a host computer; A second step of identifying, by the smart card, an identifier of a security region from the memory release request signal received from the host computer according to a memory release request for each security region of the host computer; A third step of the smart card releasing the allocated memory for the security area corresponding to the identified identifier; And The smart card is a computer-readable recording medium having stored therein a program for executing the fourth step of storing the memory release information for the security area and informing the host computer of the completion of release.

Images