TWI382741B - Information Protection Method and System of Smart Card - Google Patents

Description

Smart card data protection method and system thereof

A data access protection method and system for a smart card, in particular, a data access protection method and system for a user identification module for a mobile communication device.

In a modern society with developed communications, mobile phones are a must-have portable communication device for everyone. The address book used for contact in mobile phones is an indispensable basic function. In the past, the address book only recorded the phone number of the speaker, but the current address book can be used to record other relevant information of the speaker, for example, the birthday of the speaker, home phone, home address, company address, fax number or E-mail, etc.

Generally, the user stores the address book in a Subscriber Identity Model (SIM), hereinafter referred to as a SIM card. The SIM card is composed of a central processing unit, a read-only memory, a random access memory, a programmable read-only memory, and an output/input circuit. When the mobile phone issues a command to the SIM card, the SIM card will execute or refuse to execute the instructions issued by the mobile phone according to its standard specifications. In the Global System for Mobile Communications (GSM) 11.11 (Global System for Mobile Communications, GSM), all the access actions of the SIM card are more standardized. Users can easily move the account and SMS of the carrier in the SIM card between different mobile phones. And personal address book.

"Figure 1" is a schematic diagram of the address book storage data frame of the SIM card. For each piece of data stored in the address book, it can be considered as a separate data frame. frame. Each of the data frames includes a number of data fields for recording the phone number, name, address or E-mail of the callee. "Picture 2" is a schematic diagram of the architecture of the operation terminal and the SIM card. In this operation, of course, it is not limited to a mobile phone, but may be another device for accessing a SIM card such as a card reader. When the user sends the relevant command to the access interface through the operation terminal, the user accesses the data in the SIM card through the access interface.

The information in the SIM card is the user's personal privacy information for the user. In order to prevent the data in the SIM card from being captured by the user, the Global System for Mobile Communications specifically defines a Personal Identification Number (PIN) to limit the access rights of the SIM card.

The user can use the PIN code to lock the data in the SIM card. Before accessing the data, you need to enter the PIN code to unlock the lock. However, the access settings of the Global System for Mobile Communications are limited to all data at once. After the user opens the access setting of the SIM card, each time the user wants to access each piece of data in the address book, the user must input the PIN code once to remove the access restriction. The PIN code can only allow three input errors. When the third time is entered incorrectly, the SIM card will lock the internal data together until the user enters another set of PIN Unlock Number (PUK). However, the PUK code has ten input restrictions. When the PUK code is input ten times, all the data in the SIM card cannot be read again. In this way, although it is possible to prevent unauthorized users from accessing the address book, the convenience of the legitimate user to access the address book is relatively limited.

The object of the present invention is to provide a data protection method for a smart card, which aims to protect the field data corresponding to the data frame in the read and write smart card.

In order to achieve the above object, the data protection method of the smart card of the present invention is applied to the fields in which the data frame belongs in the smart card. The data protection method of the smart card includes the following steps: selecting according to the first data field Corresponding data framework. According to the encryption method, the data field to which the data frame belongs is subjected to encryption operation processing, thereby generating an encrypted data frame and a camouflage data frame. Then, the encrypted data frame is separately stored in the data storage module, and the camouflage data frame is overwritten to the selected data frame.

In order to achieve the above object, the data protection method of the smart card of the present invention is applied to reading a data frame in a smart card. The data frame includes a first data field for storing personal phone numbers. The protection method includes the following steps: reading the corresponding data frame from the smart card according to the first data field. Determine whether the data frame is a disguised data frame. If the data frame is a camouflage data frame, the first identification code is used to read the encrypted data frame from the data storage module. The decryption operation is performed on the encrypted data frame according to the second identification code.

From another point of view, another object of the present invention is to provide a data protection system for a smart card, the purpose of which is to protect a data frame in a read and write smart card.

The object of the present invention is to provide a data protection system for a smart card, in which a user inputs data into a data frame in a smart card through a data access interface. among them, The data frame includes a first data field for storing personal phone numbers. The data protection system includes a data protection module, an encryption and decryption module and a data storage module. The data protection module is respectively coupled to the data access interface and the smart card for generating the encrypted data frame and the camouflage data frame, and storing the camouflage data frame in the smart card. The encryption and decryption module is coupled to the data protection module and is used to generate an encrypted data frame. The data storage module is coupled to the encryption and decryption module for storing the encrypted data frame.

The object of the present invention is to provide a data protection system for a smart card, which is used to read a specific data frame in a smart card through a data access interface, the data frame includes a first data field, and the data protection system includes a data protection module. They are respectively coupled to the data access interface and the smart card. And according to the first data field, it is used to judge whether the data frame is a camouflage data frame. If the data frame is a camouflage data frame, the masquerading data frame is transmitted back to the data access interface; if the data frame is not a masquerading data frame, the data frame is transmitted back to the data access interface.

The present invention protects a particular item in the address book by writing the spoofed material into a data frame in the smart card. The user does not have to encrypt all the contacts in the SIM card in order to lock these specific items. Even if this SIM card is placed in another mobile phone, the address book items that have been encrypted in the SIM card cannot be displayed.

The features and implementations of the present invention are described in detail below with reference to the preferred embodiments.

Fig. 3 is a schematic view of a preferred embodiment of the present invention. In the present invention A smart card data protection method and system are provided for protecting data read and written in a smart card. In the present invention, the smart card is particularly referred to as a Subscriber Identity Model (SIM) card 100 for use in a mobile communication device, hereinafter referred to as SIM card 100. The embodiment of the present invention includes a SIM card 100, an operation terminal 310, a data access interface 320, and a data protection system 330.

The SIM card 100 is used for storing personal communication data, and the SIM card 100 further includes a plurality of data frames 110 for storing data. At least one first data field 111 and a plurality of data fields are included in each of the data frames 110. It is assumed here that the first data field 111 is for storing the first telephone number of the caller, and the other data fields are for storing the name, address, photo, ringtone or E-mail of the caller. The operation terminal 310 is configured to accept an instruction from the user, and then access the data in the SIM card 100 through the data access interface 320. For example, the operating terminal 310 can access the data in the SIM card 100 by using a card reader in conjunction with a related software or mobile phone.

The data access interface 320 is coupled to the operating terminal 310. The data access interface 320 provides various application interfaces (APIs) for accessing the SIM card 100. For example, there are standard tool kits (STK) for various types of mobile phones, and SIM Managements for user identification. The data protection system 330 is connected between the SIM card 100 and the data access interface 320. The data protection system 330 further includes a data protection module 331, an encryption and decryption module 332, and a data storage module 333. The data protection module 331 is coupled to the data access interface 320 and the SIM card 100. The data protection module 331 is configured to generate an encrypted data frame and a camouflage data frame (not shown), and The data frame is overwritten with the original data frame 110. Please refer to "Figure 1" for the structure of the encrypted data frame and the disguised data frame. The encryption and decryption module 332 is coupled to the data protection module 331. The encryption and decryption module 332 is configured to generate an encrypted data frame according to the received data frame 110 and the encryption algorithm. The data storage module 333 is coupled to the encryption and decryption module 332 for storing the encrypted data frame generated by the encryption and decryption module 332.

Please refer to "Figure 4" for the data protection write flow diagram of the present invention. First, the corresponding data frame is selected according to the first data field (step S410). Next, the data field in the data frame is subjected to encryption operation processing according to the encryption method (step S420), and an encrypted data frame and a masquerading data frame are respectively generated (step S430). Finally, the masquerading data frame is overwritten into the original data frame (step S440), and the encrypted data frame is stored in the data storage module (step S450).

In order to facilitate the explanation of the system components of the data protection writing of the embodiment and the operation thereof, please refer to FIG. 3 and FIG. 4 at the same time. First, the user selects a data frame 110 according to a first data field 111 (corresponding to step S410). The first data field 111 is a mobile phone number, and the information related to the mobile phone number corresponding to the mobile phone number is recorded in the data frame 110. Take the mobile phone number as an example, because the mobile phone number has a single correspondence with the user. In other words, each mobile phone number only corresponds to one caller. Of course, the first data field can also be related to other callers, but not limited to mobile phone numbers. The user can determine the encryption method used by the system (corresponding to step S420) to encrypt the data in the data frame 110. The encryption method is Secure Hashing (Secure Hashing). Algorithm, SHA-1), Public Key Cryptography (RSA), Advanced Encryption Standard (AES), or MD5 hash algorithm.

Next, the system calculates the encrypted data frame and the masquerading frame by the data frame 110 via the encryption/decryption module 332 according to the encryption method selected by the user (corresponding to step S430). The encrypted data frame is obtained by the data frame 110 after the above-described encryption algorithm. The camouflage data frame is a data protection module that uses a random data or blank data to write it into the first data field 111 to which the camouflage data frame belongs. Finally, the system respectively overwrites the spoofed data frame to the original data frame 110 and the encrypted data frame to the data storage module 333 (corresponding to steps S440 and S450).

Please refer to "Figure 5" for a schematic diagram of the data protection read flow of the present invention. The user selects the first data field, and reads the corresponding data frame from the SIM card according to the first data field as an index (step S510). At this time, it should be noted that if the data stored in the data frame 110 is an unencrypted address book, the user can directly read the related data of the data frame 110. If the data stored in the data frame 110 is a camouflage data frame, the information obtained by the user is a meaningless or blank message, so as to prevent the interested person from accessing the address book in the data frame 110.

For the original user, if the data is directly accessed, the information of the above camouflage frame is also obtained. Therefore, if the original user wants to take out the correct address book data, the following steps are required. It is judged whether or not the material frame 110 is a camouflage material frame (step S520). If the data frame 110 is a camouflage data frame, according to the first knowledge The code is used to read the encrypted data frame from the data storage module (step S530). The first identification code may be one of a user password, a personal identification number (PIN), or an International Mobile Station Identity (IMSI). Next, the decryption operation is performed on the encrypted material frame according to the second identification code (step S540). The decrypted original material frame 110 is read (step S550). The second identification code can be one of a user password, a personal identification number, or an international mobile subscriber identity.

The following explains the detailed operation of the system for reading data. Please refer to "3" and "5". First assume that the original user accesses his address book and the user enters a set of mobile phone numbers. The system will find out from the SIM card 100 whether or not the data frame 110 has the phone number based on the set of mobile phone numbers (corresponding to step S510). The data frame 110 will be displayed back to the user. If the data frame 110 having the phone number is not protected by data protection, the system displays relevant information contained in the data frame 110, such as the owner name, address, E-mail or company fax number of the phone number. Wait. Conversely, if the data frame is stored in the data frame 110, the data displayed by the system is a meaningless or blank message (corresponding to steps S520 and S550). Therefore, when the user wants to read the address book in the original data frame 110, the user needs to read the address book of the original data frame 110 through the verification of the data storage module and the encryption and decryption module. The verification method may be verified by one of a user password, a personal identification number, or an international mobile subscriber identity (corresponding to steps S530 to S550).

According to the data protection system and method described above, the user can perform different encryption processes for different data frames. For example, different data frames are protected with different passwords or encryption algorithms. Further, the display message of the camouflage data frame can be changed. For example, when the system reads the masquerading data frame, the system can display various fake messages such as "Check no contact" or "This is a wrong call" to deceive illegal users.

The invention is used to access a data frame in a SIM card through a data protection system. After the data of the data frame is protected and decrypted, the masquerading data frame and the encrypted data frame are respectively written into the original data frame and the data storage module 333. When other users want to access the data frame, only the data that has been overwritten by the camouflage data frame can be read. And the user is free to choose the data frame to be protected.

While the present invention has been described above in terms of the preferred embodiments thereof, it is not intended to limit the invention, and the invention may be modified and modified without departing from the spirit and scope of the invention. The patent protection scope of the invention is subject to the definition of the scope of the patent application attached to the specification.

100‧‧‧User Identification Module

110‧‧‧Information Framework

111‧‧‧First data field

210‧‧‧Operator

220‧‧‧data access interface

310‧‧‧Operator

320‧‧‧Data access interface

330‧‧‧Data Protection System

331‧‧‧ Data Protection Module

332‧‧‧Encryption and decryption module

333‧‧‧ Data Storage Module

Figure 1 is a schematic diagram of the address book storage data frame of the SIM card.

Figure 2 is a schematic diagram of the architecture of the operating terminal and the SIM card.

Figure 3 is a schematic illustration of one preferred embodiment of the invention.

Figure 4 is a schematic diagram of the data protection writing process of the present invention.

Figure 5 is a schematic diagram of the data protection reading process of the present invention.

100‧‧‧User Identification Module

110‧‧‧Information Framework

111‧‧‧First data field

310‧‧‧Operator

320‧‧‧Data access interface

330‧‧‧Data Protection System

331‧‧‧ Data Protection Module

332‧‧‧Encryption and decryption module

333‧‧‧ Data Storage Module

Claims (11)

A data protection method for a smart card is applied to a data frame written in a smart card, and at least a first data field is included in the data frame for storing data, the method comprising the following steps: according to the first data The field selection corresponds to the data frame; according to an encryption method, the data field to which the data frame belongs is subjected to an encryption operation process to generate an encrypted data frame and a camouflage data frame; and the encrypted data frame is stored to a data storage In the module; and overwriting the masquerading data frame to the selected data frame. The method for protecting a smart card according to claim 1, wherein the smart card is a Subscriber Identity Model (SIM). The method for protecting a smart card according to claim 1, wherein the first data field stores a first telephone number. For example, in the data protection method of the smart card described in claim 1, wherein the encryption method selects a Secure Hashing Algorithm (SHA-1), a public key cryptography (RSA), and an advanced encryption. An Advanced Encryption Standard (AES) or an MD5 hash algorithm is used to encrypt and process data in the data field of the data frame, thereby generating the encrypted data frame. For example, the data protection method for the smart card described in claim 1 of the patent application, wherein the camouflage data frame is generated, further includes the following steps: A random data or a blank data is generated and written into the data fields in the camouflage data frame. A data protection system for a smart card is used to input a data frame of a smart card for storing a personal telephone number through a data access interface, the data frame including a first data field, and the data protection system includes a data protection module coupled to the data access interface and the smart card for generating a camouflage data frame and storing the camouflage data frame in the smart card; an encryption and decryption module coupled The data protection module is configured to encrypt the data frame to generate the encrypted data frame, and a data storage module coupled to the encryption and decryption module for storing the encrypted data frame. For example, the data protection system of the smart card described in claim 6 is wherein the smart card is a Subscriber Identity Model (SIM). The data protection system of the smart card as claimed in claim 6, wherein the first data field is a first telephone number. For example, the data protection system of the smart card described in claim 6 wherein the encryption and decryption module selects a Secure Hashing Algorithm (SHA-1), a public key cryptography (RSA), and a Advanced Encryption Standard (AES) or an MD5 hash algorithm for encrypting the data in the data field of the data frame to generate the encryption Data framework. For example, in the data protection system of the smart card described in claim 6, wherein the corresponding data fields of the camouflage data frame are respectively written into the data fields by using a random data or a blank data. A smart card data protection system for reading a specific data frame in a smart card through a data access interface, the data frame including a first data field for storing a personal telephone number, the data protection system The method includes: a data protection module coupled to the data access interface and the smart card, and configured to determine whether the data frame is a camouflage data frame according to the first data field, if the data frame is the camouflage In the data frame, the spoofing data frame is transmitted back to the data access interface, and if the data frame is not the masquerading data frame, the data frame is transmitted back to the data access interface.