FI113118B - A system for using a key pair in an encryption algorithm - Google Patents

Description

113118

A SYSTEM FOR USING A Cryptographic Algorithm Key Pair

The present invention relates to a system as defined in the preamble of claim 1 for using a key pair required for encrypting a message to be transmitted in a telecommunications, computer and / or Internet service 5, the key pair comprising the service subscriber and the service provider keys.

A system is known in the art whereby the keys of a 10 service subscriber are stored on a hard disk of a computer where it is read when necessary. The problem is then the insecurity of this storage method. The key can be obtained by anyone with access to that computer. In addition, a system is known which uses a special smart card to store the key and a separate card reader for reading the key. The problem with this system is that separate devices are needed to store and read the key.

. It is an object of the present invention to provide a novel system which eliminates the above problems.

··; In particular, it is an object of the present invention to provide a system where the service subscriber's key can be stored in a mobile phone and a subscriber identity module attached thereto for various applications such as electronic payment. In addition, the key can be flexibly enabled by the functions of the mobile phone.

As regards the characteristic features of the present invention, reference is made to the claims.

. The system of the present invention includes a service subscriber key, a service provider key, a device for maintaining a service subscriber key, a means for utilizing a service subscriber key, a device '*. a service provider key, a means to utilize the service provider key, and a means 113118 2 for transmitting messages. The means utilizing each key is connected to a device holding that key, which in turn is connected to the means for transmitting messages either directly or, in the case of a service subscriber, via a mobile station and, for example, an RS cable.

In the system of the present invention, the subscriber identity module (Subscriber Identity Module, SIM) connected to a computer, such as a GSM-specific subscriber identity module (SIM), is used to store the 10 service subscriber keys used in the communication, computer and / or Internet service. Rivest, Shamir & Adleman, 15 RSA). The mobile station, which is then compatible with, for example, the SIM Application Toolkit, acts as a card reader. In the future, the mobile device may be non-SIM Application Toolkit compliant, such as Wireless Application Protocol (WAP) 20 and / or Mobile Application '(Execution Environment, MAE2), which utilizes the SIM App-: * lication Toolkit commands and / or other incoming tj'j commands between the identity module and the mobile station. Mobile Subscriber Identity Module · '·. The application or computer application encrypts the messages to be sent to the service provider and / or decrypts the messages received from the service provider, utilizing the service subscriber key. held by the service provider and / or the third party is a device for storing service-provider's key 30 and a service application that encrypts. 'messages and / or to terminate the service to be transmitted to the subscriber · received by the service status messages utilizing *** service key..

.... · The advantage of the present invention over the known technical ankle is that, on a separate card, the service subscriber's key is more secure than the computer hard disk. This eliminates the possibility that anyone who has access to the computer, either directly or via the Internet, for example, will have access to the key. A further advantage of the invention is that it is not necessary to obtain special devices for reading and storing the key, such as a separate smart card and a card reader, intended solely for such tasks. This saves costs.

In one embodiment of the system, the service subscriber key is located in the security area of the subscriber identity module 10.

In one embodiment of the system, there are one or more key pairs and encryption algorithms formed by the service subscriber key and the service provider key.

15 In one embodiment of the system, each key pair is unique, that is, the service-wide key encryption can only be decrypted by another key pair held by the service provider, and vice versa.

20 In one embodiment of the system, the mobile station supports an external interface such that the key can: 'be read from a subscriber identity module.

·. / In one embodiment of the system, the mobile station is connected to a means for encryption by means of a '', 25 RS cable, an IR connection, or some other similar means.

In one embodiment of the system, the mobile station is GSM compatible.

The invention will now be described, by way of example, with reference to the accompanying drawings, in which Figure 1 illustrates, by way of example, the system configuration and its use in electronic payment; and. . Figure 2 illustrates the invention by way of example

»I

electronic events of the system according to logic: diagram.

113118 4

Figure 1 illustrates a system where the computer 5 is connected to the Internet 6. The subscriber connects his GSM phone 3 to the computer 5 via an RS cable 4. He then turns on the computer 5 5 and connects to the bank's electronic payment service via the Internet 6. For example, the RSA envelope method is used to encrypt the payment traffic, whereby the message is encrypted with, for example, the Data Encryption Standard (DES) 10 and the RSA algorithm encrypts the keys of the 3DES algorithm and a signature is made. The SIM card 2 of the GSM phone 3 stores the service subscriber key 1, by means of which the application on the SIM card 2 encrypts the messages sent by the service subscriber and decrypts the messages received from the bank. Similarly, the bank has a second key 8, which is used to encrypt messages sent by the bank and to decrypt messages from the service subscriber. Bank of key 8 can also be held by a third party, which may be, for example, only the key 20 of preserving and / or encrypt the focused service "providers in. After making payment transactions, the subscriber terminates the application and disconnects the GSM phone 3 »* * · ,,, from the computer 5. The connection between the mobile station 3 and the computer 5 can also be effected, for example, via IR port * ', 25 or any other mobile station. 3 support; Y connection method.

t

Figure 2 shows the electrical events of the system of the invention as a logic diagram. An application on PC 5 requests encryption. The request and ,, 30 the message to be encrypted is forwarded to the SIM 2 • card of the mobile station 3, where the application performs encryption using the service subscriber key 1 on the SIM card 2. application.

· 35 The invention is not limited to the above embodiments only, but many modifications are possible within the scope of the inventive idea defined in the claims 113118 5.

Claims (9)

A system for using a key pair that requires an encryption algorithm, which encryption algorithm is used for encrypting messages that are transmitted in a telecommunications, computer and / or Internet service, which key pair includes a key for a service subscriber (1) and a key for a service provider (8), and which system includes a device for storing the key of the service subscriber (2); A means for utilizing the service subscriber key (2), a device for storing the service provider's key (7), a means for utilizing the service provider's key (7), and means for conveying messages which comprise a computer (5) and a telecom Communication network (6), characterized in that - the subscriber identity module (2) of the service subscriber's mobile terminal (3) functions as a device for storing the key of the service subscriber, which subscriber identity module is connected to the mobile terminal 20 (3); - an application on the subscriber identity module> # (2) of the service subscriber's mobile terminal (3) or on the service subscriber's computer (5) functions as means for utilizing the service subscriber's key, which application encrypts and / or decrypts messages; - a device (7) held by either the service provider and / or a third party functions as:: device for storing the key of the service provider; - a service application (7) that the service provider and / or the third party one holds acts as a means of utilizing the service provider's key electricity, which service application encrypts and / or decrypts messages; and the '' means for conveying messages (5, 6) i. are connected to the service subscriber's mobile terminal (3) and to the service provider. 113118 10 2. The system of claim 1, wherein the service subscriber key (1) is located within the security area of the subscriber identity module (2). System according to claim 1 or 2, characterized in that there are one or more key pairs and encryption algorithms. System according to any of the preceding claims 1 - 3, characterized in that each 10 and a key pair is individual, whereby an encryption performed with the service subscriber key (1) can be decrypted only with the second key (8). of the key-electric pair held by the service provider, and vice versa. System according to any of the preceding claims 1 - 4, characterized in that the mobile terminal (3) supports an external connection so that the key can be read from the subscriber identity module (2). System according to any of the preceding patent claims 1 to 5, characterized in that the mobile terminal (3) is connected to means (5, 6) which utilize the encryption with an RS cable (4), an IR signal. : connection or in some other similar way. System according to any of the preceding claims 1 - 6, characterized in that the motor terminal (3) is GSM compatible. A method for making electronic payment in connection with a telecommunications, computer and / or Internet service in a system, which includes a key for a service subscriber (1), a key for a service provider ( 8), a device for storing the service provider's key (2), a means for utilizing the service provider's key (2), a device for storing the service provider's key (7), a means for utilizing the service provider's key (7), and means for conveying the payment movement messages, which means comprise a computer (5) and a telecommunications network (6), characterized in that the method comprises the following steps: the subscriber identity module (2) of the service subscriber is connected to the service subscriber's mobile terminal (3); 5. means for conveying payment movement messages (5,6) are combined with the service provider's mobile terminal (3) and with the service provider; - payment transaction messages that the subscriber sends are encrypted with the service subscriber key (1), which is located within the security area of the service subscriber's subscriber identity module; - payment transaction messages sent by the subscriber are decrypted in a service application (7) with the service provider's key (8); 15. payment transaction messages sent to the service provider by the service provider are encrypted with the service provider's key (8), which is located in a service application (7); and - payment movement messages sent by the service provider are decrypted with the subscriber's private key (1), which is located within the security area of ;;; service subscriber identity module (2). 9. A method according to claim 8, characterized in that electronic payment is made! By means of the telecommunication network (6), such as the Internet and / or the GSM network, mediation. > »R> <· '· 1 i ·» »