JP2002335578A - Communication system and method for transferring right to utilize communication path - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a communication system in which overhead is eliminated, security is kept between a first IC card and a second IC card or between the second IC card and a portable terminal, and a plurality of first IC cards are dealt with by one second IC card. SOLUTION: A first IC card transfers the right to utilize a communication path to a second IC card by delivering a pair of tokens to a portable terminal and the second IC card. The right is transferred to the second IC card by a token for keeping security between the portable terminal and the second IC card through encryption. Mutual authentication is effected between the first IC card and the second IC card using a public key. Furthermore, a public key of the first IC card registered in the second IC card can be updated.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a SIM card (Subsc).
It is used for a system that can change the subscriber information of the mobile terminal by inserting and removing an IC card called a riber identity module card (including a mobile phone) into and out of the mobile terminal.

[0002]

2. Description of the Related Art A portable terminal is provided with an IC called a SIM card.
There is known a service that changes the subscriber information of a mobile terminal by inserting or removing a card, thereby providing flexibility in using the mobile terminal. The SIM card is a GSM (G
lobal System for mobile communications) and IMT (International Mobile Telecommunicat
ions) -The direction that is adopted in -2000 standard mobile terminals.

[0003] In a portable terminal using such a SIM card, a 1st IC card in which subscriber information is written and a 2nd IC card for providing a service to the subscriber are being mounted on the portable terminal together. 1st
The IC card manages the communication path in the mobile terminal,
Conventionally, when the second IC card uses the communication path of the portable terminal, the data is sent to the first IC card once,
The first IC card transfers the data to the communication path of the mobile phone.

FIG. 7 shows a conventional data flow. As shown in FIG. 7, conventionally, when the 2nd IC card wants to use the communication path, the 2nd IC card sends data to the portable terminal, and the portable terminal sends the data to the 1st IC card.
The first IC card sends the data to the portable terminal, and the portable terminal sends the data to the communication path.

[0005]

In such a conventional portable terminal, the overhead may be increased due to the interposition of the first IC card. That is, 1stI
Since the data flow between the C card and the portable terminal and between the second IC card and the portable terminal is as shown in FIG.
The overhead associated with the tIC card is large. Also, the second IC card needs to confirm that the first IC card is the partner to whom the right to use the communication path has been transferred. Further, since the second IC card and the portable terminal are in a non-contact communication standard, the communication between the second IC card and the portable terminal is likely to be wiretapped.

[0006] The present invention has been made in such a background, and can eliminate overhead.
Between the stIC card and the 2nd IC card or 2n
A secure connection between the dIC card and the portable terminal can be maintained, and a plurality of 1s can be secured by one 2nd IC card.
It is an object of the present invention to provide a communication system and a communication path use authority transfer method capable of improving user convenience by supporting a tIC card.

[0007]

According to the present invention, the right of using the communication path of the first IC card is transferred to the second IC card by passing the pair of tokens between the first IC card and the portable terminal and the second IC card. The most important feature of the present invention is to reduce the overhead via the communication terminal and to delegate the authority to use the communication path to the second IC card by using a token encrypted and secured between the portable terminal and the second IC card.

[0008] More specifically, three processes are provided to achieve the object of the present invention. First, the 1st IC card and the 2nd IC card mutually authenticate using the public key, and recognize the 2nd IC card to which the authority to use the communication path is transferred. Second, the mobile terminal and the second IC card communicate securely using the common key generated by the first IC card. Third, the first IC card may delegate the authority of using the communication path to the second IC card. The public key of the second IC card is registered to know the second IC card, or the public key of the first IC card as the connection destination is registered by the second IC card. I do.

The first is that the first IC card sends a random number to the second IC card through the portable terminal, and the second IC card sends the random number to the second IC card.
The IC card encrypts the random number using the secret key of the second IC card and sends it back to the first IC card to send the first random number.
The IC card authenticates the 2nd IC card, the 2nd IC card sends a random number to the 1st IC card, the 1st IC card encrypts with the secret key of the 1st IC card, and the 2nd IC card
By sending back to the card, the 2nd IC card becomes 1stI
Authenticate the C card.

[0010] The second is the first IC card,
A common key derived from the secret key of the 1st IC card is generated and sent to the portable terminal, and the portable terminal sends the same to the 2nd IC card. The subsequent communication between the 2nd IC card and the portable terminal is performed by the sender. The mobile terminal can communicate while authenticating that the 2nd IC card is the correct partner by performing encryption and hash calculation with the common key, and the receiver decrypting and hash-verifying it. In addition, the possibility of communication contents leaking to the outside is reduced.

The third is that the first IC card is 2
The public key of the second IC card is 1st for the 2nd IC card
Although the public key of the IC card is held, it can be updated as needed.

That is, a first aspect of the present invention comprises two IC card readers / writers, a first IC card and a second IC card respectively connected to the two IC card readers / writers, and the first IC card is portable. Information indicating the right to use the communication path of the terminal is written, and the portable terminal is a communication system including means for making the communication path available according to the information indicating the right.

Here, the present invention is characterized in that the first IC card includes a means for generating a token derived from a secret key of the first IC card, and a means for sending the token to the portable terminal and the second IC card. Wherein the means for enabling the communication path includes means for enabling the communication path by regarding the token as information indicating the right, and wherein the second IC card uses the communication path by the token. Means for directly accessing the enabling means and utilizing the communication path of the portable terminal.

Thus, the second IC card can use the communication path of the portable terminal without passing through the first IC card, so that the overhead can be reduced as compared with the case where the first IC card is passed.

The 2nd IC card has the 1st IC
The public key of the card is written in advance,
The public key of the 2nd IC card is written in the C card in advance, and the 1st IC card and the 2nd IC card are written in advance.
The IC card generates random numbers and exchanges them with each other, encrypts the exchanged random numbers with their own public keys and exchanges them again, and writes the exchanged encrypted random numbers in advance. Desirably, means for decrypting with the public key of the partner card and performing mutual authentication.

Thus, the first IC card and the second
Mutual authentication is performed with the C card, and the two IC cards can be kept secure.

The portable terminal and the second IC card use the token as a session key which is a common key derived from a secret key of the first IC card, and the communication between the portable terminal and the second IC card is encrypted using the common key. And a means for calculating a hash.

As described above, by encrypting the second IC card and the portable terminal using the common key, the security can be maintained.

The 2nd IC card uses the public key of the 1st IC card written in advance for another 1s.
Means for updating the public key of the tIC card may be provided.

Thus, the 2nd IC card can correspond to a plurality of 1st IC cards by updating the public key, thereby improving user convenience.

A second aspect of the present invention is a method for delegating the authority to use a communication channel.
1stI connected to each C card reader / writer
C card and 2nd IC card.
Information indicating the right to use the communication path of the mobile terminal is written in the IC card, and the mobile terminal is applied to a communication system that enables the communication path in accordance with the information indicating the right. 1st IC
Generating a token derived from the secret key of the card, sending the token to the portable terminal and the 2nd IC card, the portable terminal regards the token as the information indicating the right, makes the communication path available, 2ndI
The C card is where the portable terminal is directly accessed by the token to use the communication path of the portable terminal.

The 2nd IC card has the 1st IC
The public key of the card is written in advance,
The public key of the 2nd IC card is written in the C card in advance, and the 1st IC card and the 2nd IC card are written in advance.
The IC card generates a random number and exchanges them with each other, encrypts the exchanged random number with its own public key and exchanges them again, and exchanges the exchanged encrypted random number with that of the partner card previously written. It is desirable to perform mutual authentication by decrypting with a public key.

The portable terminal and the second IC card use the token as a session key which is a common key derived from a secret key of the first IC card, and the communication between the portable terminal and the second IC card is encrypted using the common key. And a hash calculation is desirable.

The 2nd IC card uses the public key of the 1st IC card written in advance for another 1s.
It can be updated to the public key of the tIC card.

[0025]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A communication system and a method of transferring a communication channel use right according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a diagram showing a state in which a 2nd IC card of the present invention and a portable terminal are directly accessing. FIG. 2 is a block diagram of the communication system according to the embodiment of the present invention.

A first aspect of the present invention is, as shown in FIGS. 1 and 2, two IC card reader / writers (not shown) and a first IC card 10 connected to each of the two IC card reader / writers. And a second IC card 20. Information indicating the right to use the communication path of the mobile terminal 1 is written in the first IC card 10, and the mobile terminal 1 makes the mobile terminal 1 use the communication path according to the information indicating the right. This is a communication system including a terminal IC card I / F unit 4.

The features of the present invention are as follows.
The stIC card 10 includes a first IC card token management unit 11 that generates a token derived from a secret key of the first IC card 10, and the token is transmitted to the mobile terminals 1 and 2n.
1st IC card I / F sent to dIC card 20
Means 14 and a portable terminal IC card I / F means 4
Considers the token as the information indicating the right and can use the communication path. The second IC card 20 directly accesses the portable terminal IC card I / F means 4 using the token and uses the communication path of the portable terminal 1. Where you do it.

The public key of the first IC card 10 is written in the second IC card key management means 23 of the second IC card 20 in advance, and the first key of the first IC card 10 is stored.
The public key of the second IC card 20 is written in advance in the C card key management means 12, and the first IC card encryption means 13 and the second IC card encryption means 24 of the first IC card 10 and the second IC card 20 generate random numbers and exchange them with each other. Then, the exchanged random number is encrypted with its own public key and exchanged again, and the exchanged encrypted random number is decrypted with the public key of the partner card written in advance to perform mutual authentication.

Mobile terminal IC card token management means 2 and 2ndI of mobile terminal 1 and 2nd IC card 20
The C card token management means 22 stores the token for 1s
The portable terminal IC card I / F means 4 and the second IC card I / F means 21 perform communication between the portable terminal 1 and the second IC card 20 as a session key which is a common key derived from the secret key of the tIC card 10. Encryption and hash calculation are performed using a common key.

The second IC card key management means 23 of the second IC card 20 stores the first IC card written in advance.
The public key of the card 10 can be updated to the public key of another 1st IC card.

A second aspect of the present invention is a method for delegating authority to use a communication channel.
1st IC card 10 and 2nd IC card 20 respectively connected to a C card reader / writer (not shown)
Information indicating the right to use the communication path of the portable terminal 1 is written in the first IC card 10 and the portable terminal 1
Is applied to a communication system that makes the communication path available according to the information indicating this right, and the first IC card 1
0 generates a token derived from the secret key of the first IC card 10 and transfers this token to the portable terminal 1 and the second IC.
Card, and the mobile terminal 1 regards the token as information indicating the right to use the communication path. The 2nd IC card 20 directly accesses the mobile terminal 1 using the token and communicates with the mobile terminal 1. There is a road.

The public key of the first IC card 10 is previously written in the second IC card 20, the public key of the second IC card 20 is previously written in the first IC card 10, the first IC card 10 and the second IC card
The card 20 generates a random number and exchanges it with each other, encrypts the exchanged random number with its own public key and exchanges them again, and exchanges the exchanged encrypted random number with the previously written counterpart card. Decrypt with the public key and perform mutual authentication.

Mobile terminal 1 and 2nd IC card 20
The mobile terminal 1 uses the token as a session key, which is a common key derived from the secret key of the first IC card 10.
The communication between the second and the second IC card 20 is encrypted and hashed using the common key.

The second IC card 20 uses the public key of the first IC card 10 written in advance for another 1s.
It can be updated to the public key of the tIC card.

FIG. 3 shows the operation of the communication system according to the embodiment of the present invention.
This will be described with reference to FIG. FIG. 3 is a sequence diagram showing the operation at the time of mutual authentication. FIG. 4 is a sequence diagram showing an operation at the time of generating a token. FIG. 5 shows data transmission from the 2nd IC card to the communication channel and data transmission from the communication channel.
FIG. 9 is a sequence diagram illustrating an operation when data is received to an ndIC card. FIG. 6 is a sequence diagram showing the operation at the end of communication.

As shown in FIG. 3, the second IC card 20
When the communication path connection request is passed from the second IC card I / F means 21 to the portable terminal IC card I / F means 4, the portable terminal IC card I / F means 4 passes it to the first IC card I / F means 14. . The first IC card I / F unit 14 inquires whether the public key of the second IC card 20 is registered in the first IC card key management unit 12. If not registered, the communication connection request is rejected. Then, a random number is generated and passed to the portable terminal IC card I / F means 4, and the portable terminal IC card I / F means 4
Is passed to the second IC card I / F means 21. Then 2n
It receives the secret key of the dIC card 20, requests the second IC card encryption means 24 to encrypt the random number using the secret key, and receives the encrypted random number. 2nd IC card 20
Passes the received encrypted random number to the portable terminal IC card I / F means 4, and the portable terminal IC card I / F means 4
The information is passed to the stIC card I / F means 14. The first IC card I / F unit 14 obtains the public key of the second IC card 20 from the first IC card key management unit 12 and checks whether the key and the encrypted random number are used by the first IC card encryption unit 13 to determine whether the key is really from the second IC card 20. If invalid, the communication path connection request is rejected.

Next, the second IC card 20 generates a random number, passes it to the portable terminal IC card I / F means 4, and outputs the random number.
The card is passed to the C card I / F unit 14. 1st IC card I /
The F means 14 is provided by the first IC card key management means 12
The secret key of the stIC card 10 is obtained, and the secret key and the random number are passed to the first IC card encryption means 13 to obtain an encrypted random number. Then, it passes it to the portable terminal IC card I / F means 4, and the portable terminal IC card I / F means 4 sends it to 2n.
It is passed to the dIC card I / F means 21. The 2nd IC card I / F means 21 acquires the public key of the 1st IC card 10 from the 2nd IC card key management means 23, passes it and the encrypted random number to the 2nd IC card encryption means 24, and checks whether it is really from the 1st IC card 10. If invalid, the communication path connection request is rejected.

As shown in FIG. 4, next, the first IC card I / F means 14 converts the first IC card secret key into the first
It is passed to the C card token management means 11 to generate a common key which is a token. The generated common key is passed to the portable terminal IC card I / F means 4, and the portable terminal IC card I / F means 4 registers it in the portable terminal IC card token management means 2. And copy the 2nd IC card I / F
Hand over to means 21. The 2nd IC card I / F means 21 registers the common key in the 2nd IC card token management means 22.

As shown in FIG. 5, the second IC card 20 can use the communication path of the portable terminal 1 without passing through the first IC card 10. 2nd IC card 20
When it is desired to pass data from the second to the communication path, the second IC card I / F means 21 obtains a common key from the second IC card token management means 22 and passes the data to be transmitted to the communication path to the second IC card encryption means 24, Obtain the encrypted data. In some cases, a hash of the encrypted data is also added to the encrypted data. It is sent to the portable terminal IC card I / F means 4. The portable terminal IC card I / F means 4 obtains a common key from the portable terminal IC card token management means 2 and passes it and encrypted data to the portable terminal IC card encryption means 3 to obtain decrypted data. Verify the hash, if any. Then, the portable terminal IC card I / F means 4 sends the decrypted data to the communication path.

The data flowing from the communication path is transmitted to the second IC
When handing over to the card 20, a common key is obtained from the portable terminal card I / F management means 4, and the portable terminal IC card I / F is acquired.
The means 4 requests the portable terminal IC card encryption means 3 for the data received from the communication path to obtain encrypted data. In some cases, a hash of the encrypted data is added to the encrypted data. It is passed to the 2nd IC card I / F means 21,
The second IC card I / F means 21 acquires the common key from the second IC card token management means 22, requests the second IC card encryption means 24 to decrypt the common key and the encrypted data, and obtains the decrypted data. If there is a hash, verify the hash. The subsequent data exchange is the same.

As shown in FIG. 6, when the exchange of data with the communication channel is completed, the portable terminal IC card I / F means 4
Requests that the token registered in the mobile terminal IC card token management means 2 be deregistered.

The registration of the public key of the second IC card 20 to the first IC card 10 is timely requested to the first IC card key management means 12. 1st to 2nd IC card 20
The registration of the public key of the IC card 10 is timely requested to the second IC card key management means 23.

[0043]

As described above, according to the present invention,
The overhead can be omitted, the connection between the first IC card and the second IC card or the connection between the second IC card and the portable terminal can be kept secure, and the use of one 2nd IC card for a plurality of 1st IC cards enables User convenience can be improved.

[Brief description of the drawings]

FIG. 1 is a diagram showing a state in which a 2nd IC card of the present invention and a mobile terminal are directly accessing.

FIG. 2 is a block diagram of a communication system according to an embodiment of the present invention.

FIG. 3 is a sequence diagram showing an operation at the time of mutual authentication.

FIG. 4 is a sequence diagram showing an operation when a token is generated.

FIG. 5 is a sequence diagram showing an operation when data is transmitted from the 2nd IC card to the communication path and when data is received from the communication path to the 2nd IC card.

FIG. 6 is a sequence diagram showing an operation at the end of communication.

FIG. 7 is a diagram showing a conventional data flow.

[Explanation of symbols]

 Reference Signs List 1 mobile terminal 2 mobile terminal IC card token management means 3 mobile terminal IC card encryption means 4 mobile terminal IC card I / F means 10 1st IC card 11 1st IC card token management means 12 1st IC card key management means 13 1st IC card encryption means 14 1st IC card I / F means 20 2nd IC card 21 2nd IC card I / F means 22 2nd IC card token management means 23 2nd IC card key management means 24 2nd IC card encryption means

Continued on the front page (72) Inventor Eiichi Niwano 2-3-1 Otemachi, Chiyoda-ku, Tokyo F-term (reference) in Nippon Telegraph and Telephone Corporation 5B035 AA13 BB09 BC00 5B058 KA31 KA35 YA20 5J104 AA08 KA02 KA05 NA02 NA35 NA36 NA37 NA38 NA41 PA02 5K027 AA11 BB09 MM03 5K067 AA30 AA34 EE02 HH22 HH23 HH36 KK13 KK15

Claims (8)

[Claims] 1. An IC card reader / writer comprising a first IC card and a second IC card respectively connected to the two IC card readers / writers, wherein the first IC card has a right to use a communication path of a portable terminal. Indicating that the mobile terminal can use the communication path according to the information indicating the right. The first IC card generates a token derived from a secret key of the first IC card. Means for sending the token to the portable terminal and the 2nd IC card. The means for making the communication path available means that the token is regarded as the information indicating the right and the communication path is usable. The 2nd IC card can use the communication path with the token. Communication system characterized by comprising a means for utilizing a communication path of the mobile terminal directly accesses the means to. 2. The 2nd IC card has the 1stI
The public key of the C card is written in advance, the public key of the second IC card is written in the first IC card in advance, the first IC card and the second IC card generate random numbers and exchange them with each other, Means for encrypting the exchanged random number with its own public key and exchanging them again, and means for decrypting the exchanged encrypted random number with the public key of the partner card written in advance and performing mutual authentication. The communication system according to claim 1. 3. The portable terminal and the second IC card use the token as a session key, which is a common key derived from a secret key of the first IC card, to communicate between the portable terminal and the second IC card using the common key. The communication system according to claim 1, further comprising means for performing encryption and hash calculation. 4. The 2nd IC card uses the public key of the 1st IC card written in advance as another 1st IC card.
2. The communication system according to claim 1, further comprising means for updating the public key of the stIC card. 5. A first IC card and a second IC card respectively connected to two IC card reader / writers, wherein information indicating a right to use a communication path of the portable terminal is written in the first IC card, Is applied to a communication system that enables the communication path according to the information indicating the right. The 1st IC card generates a token derived from a secret key of the 1st IC card. The mobile terminal regards the token as information indicating the right and makes the communication path available, and the 2nd IC card directly accesses the mobile terminal with the token to open the communication path of the mobile terminal. A method of delegating authority to use a communication channel, characterized by using the communication channel. 6. The 2nd IC card has the 1stI
The public key of the C card is written in advance, the public key of the 2nd IC card is written in the 1st IC card in advance, and the 1st IC card and the 2nd IC card are
Random numbers are generated and exchanged with each other, the exchanged random numbers are encrypted with their own public keys and exchanged again, and the exchanged encrypted random numbers are decrypted with the previously written public key of the partner card. 6. The communication path use authority transfer method according to claim 5, wherein the mutual authentication is performed after the communication. 7. The portable terminal and the second IC card use the token as a session key, which is a common key derived from a secret key of the first IC card, to communicate between the portable terminal and the second IC card using the common key. 6. The method according to claim 5, wherein encryption and hash calculation are performed. 8. The 2nd IC card uses the public key of the 1st IC card written in advance as another 1st IC card.
6. The method according to claim 5, wherein the public key of the stIC card is updated.