JP5819714B2 - Mobile terminal and information protection method - Google Patents

Description

  The present invention relates to a mobile terminal and an information protection method.

  In recent years, the functions of mobile phones have remarkably advanced, and they are used not only for mere telephone and mail functions but also for various purposes. For example, it may be used as a portable storage medium in which information related to business is stored in a mobile phone and the information is used outside the office. However, when information related to business is stored in a mobile phone, there is a possibility that the information may be misused or viewed by a third party due to theft or loss. For such abuse by third parties, it is possible to set a password on the mobile phone, and when using some functions, you may be asked to enter the password. The password to be used is about four digits, and there is a possibility that it will be broken by trying the brute force formula.

  For this reason, further devices for improving the security of mobile phones are demanded. For example, Patent Document 1 discloses identification information acquired from a nonvolatile memory provided in a mobile phone and an IC card mounted on the mobile phone. A method has been proposed in which identification information stored in a (USIM card) is collated in a server that is communicably connected to a mobile phone to determine whether the mobile phone can be used. By doing so, Patent Document 1 restricts the use of a mobile phone when a different IC card is attached, and increases the security of the mobile phone.

JP 2007-323568 A

  However, in the method proposed in Patent Document 1, when the mobile phone cannot communicate with the server, it is not possible to determine whether or not the mobile phone can be used. You won't be able to use your mobile phone.

  For this reason, in recent years, attention has been focused on services such as remote lock, which makes it impossible to use a mobile phone remotely. This remote lock makes it impossible to use the mobile phone if it is sent to the mobile phone, so if the mobile phone is lost, it may be used by a third party other than the owner. Can be prevented.

  However, such a remote lock can be used only when the mobile phone is communicable, and the person who finds the mobile phone removes the IC card from the mobile terminal or moves the mobile phone to an incommunicable area or the like. If the mobile terminal is in a communication disabled state, it cannot be used. In such a case, the malicious finder may try to identify the password as a brute force.

  The present invention has been made in view of such a problem, and while being able to be used appropriately by the owner of the mobile terminal, the mobile terminal and the information that can maintain security firmly in the event of theft or loss It aims to provide a protection method.

  A portable terminal according to the present invention includes a storage unit, a certificate storage unit that stores an electronic certificate including an encryption key, an encryption unit that encrypts information stored in the storage unit with the encryption key, Card mounting means for mounting an IC card having a memory for storing identification information for identifying a user of the mobile terminal; mounting determination means for determining whether an IC card is mounted in the card mounting means; Revocation control means for revoking the electronic certificate stored in the certificate storage means when the determination means that the determination that the IC card is not attached continues for a predetermined time.

  The portable terminal includes a storage medium mounting unit for mounting an external storage medium, and the encryption unit includes information stored in the external storage medium mounted on the storage medium mounting unit, and the card mounting unit. It is preferable that information different from the identification information stored in the IC card attached to the card is encrypted with the encryption key.

  In the portable terminal, the certificate storage unit stores the electronic certificate in association with the identification information, and the attachment determination unit includes the identification information stored in the IC card. It is preferable to determine that an IC card is mounted when the identification information associated with the document matches.

  An information protection method according to the present invention is an information protection method in which a mobile terminal protects information stored in the mobile terminal, and the mobile terminal stores a storage unit and an electronic certificate including an encryption key. A certificate storage unit for performing the operation, a card mounting unit for mounting an IC card including a memory for storing identification information for identifying a user of the portable terminal, and the information stored in the storage unit is encrypted with the encryption key. The information protection method includes: an attachment determination step for determining whether an IC card is attached to the card attachment means; and an IC card is not attached in the attachment determination step. A revocation control step of revoking the electronic certificate stored in the certificate storage means when the determination continues for a predetermined time.

  According to the present invention, the owner of the mobile terminal can appropriately use it, while maintaining security firmly in case of theft or loss.

It is a block diagram which shows the function structure of the portable terminal which concerns on this embodiment. It is a flowchart which shows the flow of the process performed in a portable terminal.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram illustrating a functional configuration of the mobile terminal 1 according to the present embodiment.
The mobile terminal 1 is, for example, a mobile phone, and includes an operation unit 11, a display unit 12, a first mounting unit 13 as a card mounting unit, a second mounting unit 14 as a storage medium mounting unit, and a communication unit 15. A storage unit 16 and a virtual OS execution unit 17. In addition, although illustration is abbreviate | omitted, the portable terminal 1 shall be provided with the function provided in the conventional mobile telephone, such as a camera, a microphone, and a speaker.

The operation unit 11 includes buttons and the like, and accepts an input operation from the user of the mobile terminal 1.
The display unit 12 includes a display device such as a liquid crystal display (LCD) or an organic EL (Organic ElectroLuminescence), and performs display related to the function of the mobile terminal 1.
In addition, you may make it comprise the operation part 11 and the display part 12 with a touchscreen display.

  The first mounting unit 13 mounts the IC card 2. The IC card 2 is, for example, a SIM (Subscriber Identity Module) card or a USIM (Universal Subscriber Identity Module) card, and includes a memory that stores identification information for identifying a user of the mobile terminal. The portable terminal 1 can perform communication such as a telephone call and an e-mail on condition that the IC card 2 is attached to the first attachment unit 13.

The second mounting unit 14 mounts an external storage medium 3 such as a memory card.
The communication unit 15 performs wireless communication with external devices such as a base station and other portable terminals. The communication unit 15 performs communication related to, for example, telephone calls and mails.

  The storage unit 16 includes a memory or the like, and includes a first storage area 161 as a storage unit and a second storage area 162 as a certificate storage unit.

  The first storage area 161 stores various information acquired by the user of the mobile terminal 1 in addition to the system information of the mobile terminal 1 and various applications for performing telephone calls, mails, and the like executed on the mobile terminal 1. The first storage area 161 stores a password used in a virtual OS execution unit 17 described later. Here, the password stored in the first storage area 161 is requested when a predetermined function of the mobile terminal 1 is used. The predetermined function can be arbitrarily set, and may be all functions of the mobile terminal 1, and browse various information stored in the first storage area 161 among the functions of the mobile terminal 1. It may be a function to do. In this regard, in the present embodiment, the password is requested at the timing when the power of the mobile terminal 1 is turned on.

  The second storage area 162 stores the electronic certificate. This electronic certificate includes an encryption key. The encryption key is a so-called secret key, and is used when information stored in the first storage area 161 is encrypted or decrypted. The encryption key is not limited to the secret key, and may be a key corresponding to a public key cryptosystem in which the encryption key and the decryption key are different.

The second storage area 162 stores an electronic certificate and identification information stored in a predetermined IC card in association with each other. The predetermined IC card is, for example, an IC card associated with the contractor of the mobile terminal 1.
In addition, the electronic certificate according to the present embodiment is issued by, for example, a business operator who distributes the mobile terminal 1 to the user, and is stored in the second storage area 162 before the mobile terminal 1 is distributed to the user. Also, the association between the electronic certificate and the predetermined identification information according to the present embodiment is performed in advance by the operator.

  The virtual OS execution unit 17 is a control unit that comprehensively controls functions related to the mobile terminal 1 and includes a CPU (Central Processing Unit) and the like. The virtual OS execution unit 17 functions as a hypervisor, and executes a plurality of different OSs (Operation Systems) in parallel.

  As shown in FIG. 1, the virtual OS execution unit 17 includes a mounting determination unit 171 as a mounting determination unit, a revocation control unit 172 as a revocation control unit, an execution unit 173, an encryption unit 174, and a decryption unit. 175.

  The mounting determination unit 171 determines whether or not the IC card 2 is mounted in the first mounting unit 13 when the electronic certificate stored in the second storage area 162 is available (not revoked). judge. Here, the mounting determination unit 171 associates the identification information stored in the memory of the IC card 2 mounted in the first mounting unit 13 with the electronic certificate stored in the second storage area 162. It may be determined that the IC card 2 is attached only when it matches the identification information. That is, the attachment determination unit 171 determines that the IC card 2 is attached to the first attachment unit 13 when the IC card 2 corresponding to the owner of the mobile terminal 1 is attached, and corresponds to the owner. When the IC card 2 other than the IC card 2 to be installed is attached, it is determined that the IC card 2 is not attached to the first attachment unit 13.

  The revocation control unit 172 monitors the determination result by the mounting determination unit 171 and determines whether or not the determination that the IC card 2 is not mounted has continued for a predetermined time. When the revocation control unit 172 determines that the determination that the IC card 2 is not attached has continued for a predetermined time, the revocation control unit 172 revokes the electronic certificate stored in the second storage area 162, Unusable. It should be noted that when the electronic certificate is unusable, the encryption key included in the electronic certificate cannot be referred to.

  The predetermined time is, for example, 1 hour to 240 hours. When only a predetermined IC card can be used for this predetermined time (in the case of a so-called SIM lock state), the virtual OS execution unit 17 sets the first time (for example, 1 hour) to the predetermined IC card. When other than the above can be used (in the so-called SIM unlock state), the second time longer than the first time (for example, 24 hours) may be set.

Further, the revocation control unit 172 revokes the electronic certificate stored in the second storage area 162 in response to receiving information for revoking the electronic certificate from the external device via the communication unit 15. In this case, the electronic certificate is revoked without requiring an operation by the operation unit 11.
The revocation control unit 172 may display on the display unit 12 that the electronic certificate has been revoked.

The execution unit 173 functions on the first virtual OS as shown in FIG.
When a predetermined function (power on) of the mobile terminal 1 is requested via the operation unit 11, the execution unit 173 displays a password input screen on the display unit 12 and accepts the password input. When the password is input, the execution unit 173 checks whether the password stored in the first storage area 161 matches the input password. The execution unit 173 executes a predetermined function requested by the user when the passwords match.

Further, the execution unit 173 controls an encryption unit 174 and a decryption unit 175 described later, and encrypts or decrypts information stored in the first storage area 161, the IC card 2, or the external storage medium 3.
Note that the execution unit 173 may cause the encryption unit 174 to encrypt the file when the file type is a predetermined type (for example, a document file, an image file, or the like).

The encryption unit 174 functions on the second virtual OS as shown in FIG.
In response to a command from the execution unit 173, the encryption unit 174 converts the information stored in the first storage area 161, the IC card 2, or the external storage medium 3 into an electronic certificate stored in the second storage area 162. Encrypt with the encryption key included in the certificate.

The decryption unit 175 functions on the second virtual OS as shown in FIG.
The decryption unit 175 stores the encrypted information stored in the first storage area 161, the IC card 2, or the external storage medium 3 in the second storage area 162 in response to a command from the execution unit 173. Decrypt with the encryption key included in the current electronic certificate.

Here, when the digital certificate stored in the second storage area 162 is usable, the decryption unit 175 can decrypt the encrypted information using the digital certificate. On the other hand, when the electronic certificate stored in the second storage area 162 is not usable, the decryption unit 175 cannot use the electronic certificate. It cannot be decrypted. In the present embodiment, when the IC card 2 has not been attached to the first attachment unit 13 for a predetermined time or longer, the electronic certificate stored in the second storage area 162 is revoked. The read data cannot be decrypted.
Thereby, even if the finder removes the IC card 2 from the first mounting portion 13 to prevent remote lock when the portable terminal 1 is lost, various information stored in the portable terminal 1 is decrypted. It can be made impossible, and security can be improved. At this time, even when the IC card 2 other than the owner of the mobile terminal 1 is attached to the first attachment unit 13, the attachment determination unit 171 determines that the IC card 2 is not attached. Can be made stronger.
Note that when the data read by the decryption unit 175 cannot be decrypted, the virtual OS execution unit 17 may display on the display unit 12 that the decryption cannot be performed.

Next, a process flow in the mobile terminal 1 will be described.
FIG. 2 is a flowchart showing a flow of processing executed in the mobile terminal 1. It is assumed that the electronic certificate stored in the second storage area 162 can be used at the start of this flowchart.

  In step S1, the virtual OS execution unit 17 (revocation control unit 172) monitors the determination result by the mounting determination unit 171, and determines whether the determination that the IC card 2 is not mounted has continued for a predetermined time. . The virtual OS execution unit 17 (revocation control unit 172) moves the process to step S2 if this determination is YES, and moves the process to step S3 if this determination is NO.

  In step S2, the virtual OS execution unit 17 (revocation control unit 172) revokes the electronic certificate stored in the second storage area 162, making the electronic certificate unusable. When this process ends, the virtual OS execution unit 17 (revocation control unit 172) ends this flowchart.

  In step S <b> 3, the virtual OS execution unit 17 (execution unit 173) displays a password input screen on the display unit 12 and accepts input of a password via the operation unit 11.

  In step S4, the virtual OS execution unit 17 (execution unit 173) determines whether or not the password stored in the first storage area 161 matches the input password when the password is input in step S3. To determine. The virtual OS execution unit 17 (execution unit 173) moves the process to step S5 when this determination is YES, and moves the process to step S1 when this determination is NO.

  In step S5, the virtual OS execution unit 17 (execution unit 173) determines whether to store information using the first storage area 161, the IC card 2, or the external storage medium 3 as a storage destination (that is, via the operation unit 11). Whether or not an information storage request has been received from the user is determined. The virtual OS execution unit 17 (execution unit 173) moves the process to step S6 when this determination is YES, and moves the process to step S7 when this determination is NO.

  In step S6, the virtual OS execution unit 17 (execution unit 173) causes the encryption unit 174 to encrypt the information to be stored, and stores the encrypted information in the designated storage destination.

  In step S7, the virtual OS execution unit 17 (execution unit 173) reads out or uses information from the first storage area 161, the IC card 2, or the external storage medium 3 (that is, via the operation unit 11). Whether or not an information read request is received from the user. The virtual OS execution unit 17 (execution unit 173) moves the process to step S8 if this determination is YES, and moves the process to step S9 if this determination is NO.

  In step S8, when the information to be read is encrypted, the virtual OS execution unit 17 (execution unit 173) causes the decryption unit 175 to decrypt the information and reads the decrypted information. use.

  In step S <b> 9, the virtual OS execution unit 17 (execution unit 173) determines whether an end operation of the mobile terminal 1 has been received. If this determination is YES, the virtual OS execution unit 17 (execution unit 173) turns off the mobile terminal 1 and ends this flowchart. If this determination is NO, the virtual OS execution unit 17 (execution unit 173) moves the process to step S5.

As described above, according to the present embodiment, the mobile terminal 1 determines whether or not the IC card 2 is mounted on the first mounting unit 13 by the mounting determination unit 171, and the mounting determination unit 171 by the revocation control unit 172. When the determination that the IC card 2 is not attached is continued for a predetermined time, the electronic certificate stored in the second storage area 162 is revoked.
By doing so, the electronic certificate stored in the second storage area 162 can be revoked even if the IC card 2 is removed by the finder when the portable terminal 1 is stolen or lost. Therefore, the portable terminal 1 maintains the security even in the case of theft or loss, in a state where the encrypted information stored in the first storage area 161 cannot be decrypted with the encryption key included in the electronic certificate. be able to.

  Further, the portable terminal 1 stores the information stored in the external storage medium 3 attached to the second attachment unit 14 and the IC card 2 attached to the first attachment unit 13 by the encryption unit 174. The information different from the identification information is encrypted with the encryption key. Therefore, information stored in the external storage medium 3 and the IC card 2 can also be encrypted to enhance security.

  The second storage area 162 stores an electronic certificate in association with predetermined identification information, and the attachment determination unit 171 associates the identification information stored in the IC card 2 with the electronic certificate. It is determined that the IC card 2 is attached when it matches the predetermined identification information. Therefore, it is possible to prevent the mobile terminal 1 from operating by mounting an IC card other than the IC card associated in advance.

  The embodiment of the present invention has been described above, but the present invention is not limited to the present embodiment, and modifications, improvements, and the like within the scope that can achieve the object of the present invention are included in the present invention.

  The association between the electronic certificate and the predetermined identification information according to the present embodiment is performed in advance by the business operator, but is not limited thereto. For example, the virtual OS execution unit 17 may associate the identification information stored in the IC card first attached to the first attachment unit 13 with the electronic certificate. In this way, the association between the IC card of the owner who uses the portable terminal 1 and the electronic certificate can be easily performed.

DESCRIPTION OF SYMBOLS 1 Portable terminal 2 IC card 3 External storage medium 11 Operation part 12 Display part 13 1st attachment part 14 2nd attachment part 15 Communication part 16 Storage part 161 1st storage area 162 2nd storage area 17 Virtual OS execution part 171 Attachment determination Unit 172 revocation control unit 173 execution unit 174 encryption unit 175 decryption unit

Claims (4)

Storage means;
An electronic certificate including an encryption key and a certificate storage that stores the electronic certificate in association with predetermined identification information stored in a memory provided in advance in an IC card associated with a contractor of a mobile terminal Means,
Encryption means for encrypting information stored in the storage means with the encryption key;
Card mounting means for mounting an IC card including a memory for storing identification information for identifying a user of the mobile terminal;
A mounting determination unit that determines whether or not an IC card including a memory that stores identification information for identifying a user of the mobile terminal is mounted in the card mounting unit;
When the determination that the IC card having the memory for storing the identification information for identifying the user of the portable terminal is not mounted by the mounting determination unit continues for a predetermined time, it is stored in the certificate storage unit. Revocation control means for revoking digital certificates;
A mobile terminal comprising: A storage medium mounting means for mounting an external storage medium;
The encryption means includes information stored in an external storage medium attached to the storage medium attachment means and information different from the identification information stored in the IC card attached to the card attachment means. Encrypt with the encryption key,
The mobile terminal according to claim 1. It said mounting determination means, the identification information stored in the IC card mounted in the card mounting means, the predetermined identification information correlated with the electronic certificate stored in the certificate storage unit It is determined that the IC card is installed only when it matches
The portable terminal according to claim 1 or 2. A portable terminal is an information protection method for protecting information stored in the portable terminal,
The portable terminal is
Storage means;
An electronic certificate including an encryption key and a certificate storage that stores the electronic certificate in association with predetermined identification information stored in a memory provided in advance in an IC card associated with a contractor of a mobile terminal Means,
Card mounting means for mounting an IC card including a memory for storing identification information for identifying a user of the mobile terminal;
Encryption means for encrypting information stored in the storage means with the encryption key,
The information protection method includes:
A mounting determination step for determining whether or not an IC card including a memory for storing identification information for identifying a user of the mobile terminal is mounted in the card mounting means;
In the mounting determination step, when it is determined that an IC card having a memory for storing identification information for identifying the user of the portable terminal is not mounted for a predetermined time, it is stored in the certificate storage means. A revocation control step for revoking an electronic certificate;
Information protection methods.

Images