JP2015046114A - Secure device management system, secure device management method and server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently execute recovery processing without depending on a server when the command sequence of setting processing to an application on a secure device is interrupted in the middle.SOLUTION: A secure device management system 100 includes: a server 10 and a communication terminal 20. The server 10 includes: a command transmission/reception part 11 for communicating with the communication terminal 20; a storage part 16 for storing a script defining the command sequence of a secure device 22 disposed in the communication terminal 20; and a control part 12 for generating an APDU (Application Protocol Data Unit) command on the basis of the script, and for transmitting it to the secure device 22. The script defines a first command sequence for confirming the personalized state of the secure device 22, and for determining a recovery type corresponding to the personalized state and a second command sequence for executing personalization corresponding to the recovery type in response to a personalization request to the secure device 22.

Description

  The present invention relates to a secure device management system and a secure device management method in which a server manages a secure device via a network, and a server in such a secure device management system.

  In recent years, various types of secure devices such as IC cards and SIM (Subscriber Identity Module) cards mounted on mobile phones have been used as devices used for personal authentication. For example, applications such as an employee ID card, student ID card, and permission to enter / exit a security room are installed in the secure device. An increasing number of secure devices are equipped with a plurality of applications as well as one.

  For a secure device, processing such as application addition and deletion can be performed by executing a predetermined command sequence. In order to easily execute such processing, a technique for defining a command sequence with a script has been proposed (for example, Patent Documents 1 and 2).

  By defining a command sequence with a script, it is possible to cope with new types of secure devices and applications by editing the script. Therefore, compared with the case where the command sequence is embedded in a program such as C or Java (registered trademark), there is an advantage that it is easy to cope with a new type of secure device or application.

Japanese Patent No. 3887263 Japanese Patent No. 3857190 JP2013-3628A

  In the process of issuing a secure device or the process of mounting / setting an application on an issued secure device, it is necessary to execute a plurality of commands in a prescribed sequence for the secure device.

  If communication interruption occurs during the execution of the command sequence, the response from the secure device to the command from the server may not reach the server. In this case, the server cannot determine whether the command has been executed for the secure device.

  In such a situation, if a command for which no response has been received has not been executed on the secure device, the command sequence may be retried (re-executed) from the command that has not been executed as the recovery process. However, if the command is being executed for a secure device, depending on the type of command, if the same command is executed repeatedly by retrying the command sequence from the command being executed, the secure command The device may transition to a different state than expected. Therefore, the server needs to perform an appropriate recovery process in consideration of these.

  As one method, if the response to a command with a command sequence does not reach the server, initialize the secure device and start issuing again, or delete the application already installed in the secure device and install the application again. -There is a way to redo settings. However, this method was time inefficient.

  As another method, a recovery process is defined according to the interruption location of the command sequence, and if a response to a command does not reach the server, the recovery process defined according to the interruption location is executed. A method has been proposed (Patent Document 3). However, since this method manages the state on the server, processing cannot be continued on other servers, and in order to continue processing on other servers, the state is synchronized between servers. It was necessary to do.

  Accordingly, an object of the present invention made in view of such a point is to efficiently execute a recovery process without depending on a server when a command sequence such as a setting process for an application on a secure device is interrupted in the middle. An object is to provide a secure device management system, a secure device management method, and a server.

  In order to solve the above-described problem, a secure device management system according to the present invention is a secure device management system in which a server and a communication terminal communicate via a network, and the communication terminal stores at least one application. A secure device; a mediating application that controls communication between the secure device and the server; the server includes a command transmission / reception unit that communicates with the communication terminal; and a script that defines a command sequence of the secure device And a control unit that generates an APDU command based on the script and transmits the APDU command to the secure device, and the script responds to a personalization request to the secure device with a personalized state of the secure device. confirm A first command sequence determining recovery type in accordance with the personalization state Te, is characterized in defining a second command sequence to perform the personalization in accordance with the recovery type.

  In order to solve the above problems, a secure device management method according to the present invention is a secure device management method in a secure device management system in which a server and a communication terminal communicate via a network, and the communication terminal includes In response to a personalization request to a secure device, the server confirms the personalized state of the secure device based on a command sequence defined by a script stored in a storage unit included in the server, and recovers according to the personalized state A step of determining a type, and a step of executing personalization according to the recovery type.

  In order to solve the above-mentioned problem, a server according to the present invention is a server that communicates with a communication terminal via a network, and includes a command transmission / reception unit that communicates with the communication terminal, and a secure device provided for waiting for communication And a control unit that generates an APDU command based on the script and transmits the APDU command to the secure device. The script responds to a personalization request to the secure device. Defining a first command sequence for confirming a personalized state of the secure device and determining a recovery type according to the personalized state, and a second command sequence for executing personalization according to the recovery type. It is a feature.

  According to the present invention, when a command sequence such as a setting process for an application on a secure device is interrupted halfway, a recovery process can be efficiently executed without depending on a server.

It is a figure which shows the structure of the secure device management system which concerns on one Embodiment of this invention. It is a sequence diagram which shows an example of the operation | movement in the case of the first personalization in the secure device management system which concerns on one Embodiment of this invention. It is a sequence diagram which shows an example of the operation | movement in the case of a retry in the secure device management system which concerns on one Embodiment of this invention. It is a figure which shows an example of the definition of a command sequence. It is a figure which shows an example of the definition of confirmation of a personalization state. It is a figure which shows an example of the definition of a recovery type.

  Hereinafter, embodiments according to the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing a configuration of a secure device management system according to an embodiment of the present invention. In the secure device management system 100, the server 10 and the communication terminal 20 are connected and communicate via a network 30 such as the Internet or a LAN. The server 10 is a server that manages secure devices, and the communication terminal 20 is, for example, a smartphone.

  First, the server 10 will be described.

  The server 10 includes a command transmission / reception unit 11, a control unit 12, a storage unit 16, and a user information DB (database) 17. The control unit 12 includes a business process control unit 13, an operation management unit 14, and a script control unit 15. .

  The command transmission / reception unit 11 transmits an APDU (Application Protocol Data Unit) command to the communication terminal 20 and receives an APDU response from the communication terminal 20. Here, the APDU is data used for an instruction (command) to the secure device 22 and a response (response) from the secure device 22. A command transmitted from the command transmission / reception unit 11 to the secure device 22 is referred to as an “APDU command”, and a response received by the command transmission / reception unit 11 from the secure device 22 is referred to as an “APDU response”. The APDU command includes commands such as “WRITE” and “READ”, and the APDU response includes a status code indicating a state.

  The control unit 12 includes a business process control unit 13, an operation management unit 14, and a script control unit 15. The control unit 12 controls the entire server 10.

  The business process control unit 13 controls the business process in response to a request from the command transmission / reception unit 11.

  The operation management unit 14 requests the script control unit 15 to generate an APDU command.

  The script control unit 15 interprets the script stored in the storage unit 16 and generates an APDU command that the command transmission / reception unit 11 transmits to the secure device 22. The processing that the script control unit 15 interprets and executes the script will be described in detail in the description of the sequence diagrams of FIGS.

  The storage unit 16 stores a script that defines a command sequence for the secure device 22. For example, the script checks a personalized state of the secure device 22 and determines a recovery type corresponding to the personalized state (first command sequence), or a command sequence that executes personalization corresponding to the recovery type (second And a command sequence for executing personalization on the secure device 22 are defined. A script is a template for generating an APDU command.

  The user information DB 17 is a database that manages information related to a user such as a user ID embedded in an APDU command.

  Next, the communication terminal 20 will be described.

  The mediation application 21 controls communication between the secure device 22 and the server 10.

  The secure device 22 is a device in which a unique ID number for specifying a telephone number is recorded, and is, for example, a UICC (Universal Integrated Circuit Card). The secure device 22 stores at least one application. The application stored in the secure device 22 is, for example, an employee ID card, a student ID card, permission to enter or leave the security room, and the like.

  The operation of the secure device management system 100 according to an embodiment of the present invention will be described below with reference to the sequence diagrams of FIGS. As will be described later, when personalizing the secure device 22, the server 10 determines whether the personalization is an initial personalization or a retry (personalization when processing is interrupted in the middle). FIG. 2 is a sequence diagram in the case of the first personalization, and FIG. 3 is a sequence diagram in the case of a retry.

  First, the operation of the secure device management system 100 in the case of the first personalization will be described with reference to the sequence diagram of FIG.

  When the user of the communication terminal 20 requests personalization to the secure device 22, the mediation application 21 of the communication terminal 20 transmits a personalization request to the command transmission / reception unit 11 of the server 10 (step S101).

  The command transmission / reception unit 11 notifies the control unit 12 of the received personalization request (step S102).

  The business process control unit 13 of the control unit 12 requests the operation control unit 14 to perform a business process to the script control unit 15 based on the personalization request. The operation management unit 14 requests the script control unit 15 for command generation processing. The script control unit 15 requests a script from the storage unit 16 (step S103).

  The script control unit 15 of the control unit 12 reads the script from the storage unit 16 (step S104).

  The script control unit 15 of the control unit 12 requests the user information DB 17 for information for determining whether it is the first personalization or the retry (step S105), and from the user information DB 17 for the first personalization. Information for determining whether there is a retry is acquired (step S106).

  The script control unit 15 of the control unit 12 determines whether the requested personalization is the first execution or a retry based on the information acquired from the user information DB 17 (step S107). Since the sequence diagram shown in FIG. 2 is an example in the case of the first personalization, the script control unit 15 determines that it is the first personalization.

  The script control unit 15 of the control unit 12 requests the script from the storage unit 16 (step S108), and reads the script from the storage unit 16 (step S109). Here, the script read by the script control unit 15 from the storage unit 16 is, for example, a personalization script defined by a command sequence as shown in FIG. In the example shown in FIG. 4, five commands 1 to 5 are defined in the script.

  The script control unit 15 of the control unit 12 requests personalization information, which is information necessary for personalization, from the user information DB 17 (step S110), and acquires personalization information from the user information DB 17 (step S111).

  The script control unit 15 of the control unit 12 interprets the first personalization script read in step S109 and generates a plurality of personalization APDU commands. In the case of a command sequence as shown in FIG. 4, the script control unit 15 generates five APDU commands (step S112).

  The control unit 12 passes the APDU command to the command transmission / reception unit 11 (step S113). The command transmission / reception unit 11 transmits an APDU command to the mediation application 21 of the communication terminal 20 (step S114). The mediation application 21 passes the APDU command to the secure device 22 (step S115).

  The secure device 22 executes processing instructed by the APDU command, and passes the APDU response to the mediation application 21 (step S116). The mediation application 21 transmits an APDU response to the command transmission / reception unit 11 of the server 10 (step S117). The command transmission / reception unit 11 passes the APDU response to the control unit 12 (step S118).

  The server 10 and the communication terminal 20 repeat the processes in steps S113 to S118 for the number of APDU commands defined in the command sequence. For example, when the number of APDU commands is five, the server 10 and the communication terminal 20 repeat the processing of steps S113 to S118 five times.

  When the control unit 12 receives an APDU response to the last APDU command defined in the command sequence, it passes a process completion notification to the command transmission / reception unit 11 (step S119). The command transmission / reception unit 11 transmits a processing completion notification to the mediation application 21 of the communication terminal 20 (step S120). The mediation application 21 passes a process completion notification to the secure device 22 (step S121).

  In the description of the sequence diagram of FIG. 2, in step S112, the script control unit 15 generates five APDU commands at once, and the server 10 and the communication terminal 20 perform steps S113 to S118 by the number of APDU commands. In step S112, the script control unit 15 generates only one APDU command, and the server 10 and the communication terminal 20 perform the processes in steps S108 to S118 for the number of APDU commands. It may be repeated.

  Next, the operation of the secure device management system 100 when retrying will be described with reference to the sequence diagram of FIG.

  Steps S201 to S206 are the same as steps S101 to S106 in FIG.

  The script control unit 15 of the control unit 12 determines whether the requested personalization is the first execution or a retry based on the information acquired from the user information DB 17 (step S207). Since the sequence diagram shown in FIG. 3 is an example in the case of a retry, the script control unit 15 determines that the requested personalization is a retry.

  The script control unit 15 of the control unit 12 interprets the script read in step S204 and generates an APDU command for confirming the personalized state of the secure device 22 (step S208).

  The control unit 12 passes an APDU command for confirming the personalized state of the secure device 22 to the command transmission / reception unit 11 (step S209). The command transmission / reception unit 11 transmits the APDU command to the mediation application 21 of the communication terminal 20 (step S210). The mediation application 21 passes the APDU command to the secure device 22 (step S211).

  The secure device 22 executes processing instructed by the APDU command, and passes an APDU response including information indicating the personalized state of the secure device 22 to the mediation application 21 (step S212). The mediation application 21 transmits the APDU response to the command transmission / reception unit 11 of the server 10 (step S213). The command transmission / reception unit 11 passes the APDU response to the control unit 12 (step S214).

  The script control unit 15 of the control unit 12 determines which recovery type to select based on the information indicating the personalized state included in the APDU response received from the secure device 22 (step S215).

  Here, an example of how the script control unit 15 selects the recovery type will be described with reference to FIG. In the example shown in FIG. 5, when the command sequence for personalization includes the processing of commands 1 to 5, the script control unit 15 receives up to which command is executed as information indicating the personalized state, An example of selecting a recovery type based on the information will be shown. For example, when all the commands 1 to 5 are not executed, the script control unit 15 selects the recovery type 1. Further, when the command 1 is executed and the commands 2 to 5 are not executed, the script control unit 15 selects the recovery type 2.

  In the example illustrated in FIG. 5, there are six recovery types, recovery types 1 to 6. This is shown in FIG. Each recovery type defines a process according to each personalized state. For example, in the case of the recovery type 2, since the command 1 is executed and the commands 2 to 5 are not executed, a processing sequence for executing the commands 2 to 5 is defined.

  The script control unit 15 of the control unit 12 requests the recovery type script selected in step S215 from the storage unit 16 (step S216), and reads the script from the storage unit 16 (step S217).

  The script control unit 15 of the control unit 12 requests the necessary personalization information from the user information DB 17 based on the definition of the selected recovery type script (step S218), and acquires the personalization information from the user information DB 17. (Step S219).

  The script control unit 15 of the control unit 12 interprets the personalization script read in step S217 and generates a plurality of personalization APDU commands (step S220).

  Steps S221 to S229 are the same as steps S113 to S121 in FIG.

In the description of the sequence diagram of FIG. 3, it is determined whether the personalization is the first personalization or the retry, and the process of checking the personalized state (steps S208 to S214) is executed only in the case of the retry. , Determination of whether it is the first personalization or retry, that is, the process of steps S205 to S207 is omitted, and the process of always confirming the personalized state regardless of whether it is the first personalization or retry (step The processing logic may be simplified by executing S208 to S214).

  In the description of the sequence diagram of FIG. 3, in step S220, the script control unit 15 generates a plurality of APDU commands at once, and the server 10 and the communication terminal 20 perform steps S221 to S226 as many as the number of APDU commands. In step S220, the script control unit 15 generates only one APDU command, and the server 10 and the communication terminal 20 perform the processing in steps S216 to S226 for the number of APDU commands. It may be repeated.

  Subsequently, for example, when communication interruption occurs while repeating step S113 to step S118 of the sequence diagram of FIG. 2, or while repeating step S221 to step S226 of the sequence diagram of FIG. A case where communication disconnection occurs will be described.

  In such a case, even if the predetermined time has elapsed, the control unit 12 of the server 10 does not receive an APDU response to the APDU command, and thus processes that an error has occurred. When the process is interrupted, the user of the communication terminal 20 requests personalization from the communication terminal 20 again.

  In the present embodiment, since the control unit 12 of the server 10 checks the personalized state of the secure device 22 and selects an appropriate recovery type, the retry process can be executed correctly. At this time, even if the server is not a server at the time of interruption, the personalized state of the secure device 22 is confirmed and an appropriate recovery type is selected, so that the retry process can be executed correctly.

  As described above, according to the present embodiment, the command sequence for determining the recovery type according to the personalized state by checking the personalized state of the secure device is defined in the script. In addition, even if there are a plurality of servers, any server can continue processing efficiently and correctly.

  Further, in the case of the first personalization, the personalization can be performed without performing the confirmation of the state of the secure device, thereby reducing the process for the first personalization.

  Although the present invention has been described based on the drawings and examples, it should be noted that those skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these variations and modifications are included in the scope of the present invention.

  For example, in the above embodiment, the case where the secure device 22 is included in the communication terminal 20 has been described as an example. However, the embodiment is not limited to this form of secure device, and an IC card or the like is used as the secure device. Even in this case, the present invention is applicable.

DESCRIPTION OF SYMBOLS 10 Server 11 Command transmission / reception part 12 Control part 13 Business process control part 14 Operation management part 15 Script control part 16 Storage part 17 User information DB
20 Communication Terminal 21 Mediation Application 22 Secure Device 30 Network 100 Secure Device Management System

Claims (4)

A secure device management system in which a server and a communication terminal communicate via a network,
The communication terminal is
A secure device storing at least one application;
An intermediary application that controls communication between the secure device and the server;
The server
A command transceiver for communicating with the communication terminal;
A storage unit for storing a script defining a command sequence of the secure device;
A control unit that generates an APDU command based on the script and transmits the APDU command to the secure device;
The script responds to a personalization request to the secure device.
A first command sequence for confirming a personalized state of the secure device and determining a recovery type according to the personalized state;
A secure device management system defining a second command sequence for executing personalization according to the recovery type.   The secure device management system according to claim 1, wherein the control unit determines whether or not the personalization request is an initial personalization request in response to a personalization request to the secure device, and is the initial personalization request. In this case, the secure device management system executes personalization of the secure device without executing the first and second command sequences. A secure device management method in a secure device management system in which a server and a communication terminal communicate via a network,
In response to a personalization request to a secure device provided in the communication terminal,
The server is based on a command sequence defined by a script stored in a storage unit included in the server,
Confirming the personalized state of the secure device and determining a recovery type according to the personalized state;
Performing a personalization according to the recovery type. A server that communicates with a communication terminal via a network,
A command transceiver for communicating with the communication terminal;
A storage unit for storing a script that defines a command sequence of a secure device included in the communication terminal;
A control unit that generates an APDU command based on the script and transmits the APDU command to the secure device;
The script responds to a personalization request to the secure device.
A first command sequence for confirming a personalized state of the secure device and determining a recovery type according to the personalized state;
A server defining a second command sequence for executing personalization according to the recovery type.

Images