KR100518629B1 - Apparatus and method for loading keys in authentication system of ic card - Google Patents

Abstract

The present invention relates to a key loading apparatus and a method, comprising: an authentication unit for authenticating each key when an administrator key and a PPSAM key are connected; A key storage unit for storing the keys obtained from the PPSAM; Control the authentication unit and the key storage unit, create a response message for the data including the authentication key and the authentication key request message inputted from the outside, and when the PPSAM is changed, until a key input operation from the new PPSAM is completed In addition, the two keys do not collide with each other until the end of the authentication operation using the conventional PPSAM so that each operation can be performed. When all the operations using the conventional PPSAM are terminated, the keys of the conventional PPSAM are A controller which performs a function of deleting all from the key storage unit; And an I / O interface that enables connection with an administrator key card and a PPSAM key card. It includes.

Description

Apparatus and method for loading keys in authentication system of IC card}

The present invention relates to a key load device and a method thereof, and more particularly, after receiving a key card from an issuer of a primary PerSAM key card (hereinafter, referred to as "PerSAM key card"). In a system where an IC card issuer authenticates an IC card using a secondary PerSAM and PPSAM key card (hereinafter referred to as "PPSAM key card") using a key generation system based on a unique encryption algorithm. The present invention relates to a key loading device and a method of improving convenience and security in use by further comprising a key loading device according to the present invention.

The PerSAM key card is a security application module for a card issuer used to issue a personalized IC card to a user, and stores various authentication key data. On the other hand, PPSAM key card is a module used to determine the validity (authentication) of the user card issued by PerSAM, in order to load the key to the authentication S / W when operating the authentication system in S / W PPSAM mode, financial IC card Stores the key used for the transaction. The authentication system must load the keys necessary for the financial IC card task from the PPSAM key card when the software is running. The general file structure of the PPSAM key card consists of a number of key files and a read PIN. The file that stores the actual keys is a key file, and a read PIN must be submitted to read the key from this file.

Conventionally, in the IC card authentication system, as shown in FIG. 1, when the PPSAM key card generated from the key generation system 1 held by the card issuer is provided to the operating system 2, the operation is performed. If the type of the system 2 can accept the PPSAM key card directly through the I / O interface unit (e.g. Window NT series), the PPSAM key card can be provided directly to the operating system 2, but the operation If the type of system 2 cannot accept the PPSAM key card directly through the I / O interface (e.g. Unix-like), obtain the key from a separate device with an I / O interface that can be connected to the PPSAM key card. After that, it had to be converted into an executable file and stored in a separate portable storage medium.

However, the method of storing and providing a separate removable storage medium has a risk of unauthorized use by a key manager in a card authentication system requiring high security, and an error between data movement may occur due to the characteristics of the removable storage medium. If the current PPSAM card is changed or a reason for rebooting the system occurs, not only should the key loading work be re-executed but also the authentication work must be re-executed.

In addition, in the conventional IC card authentication system, when connecting the PPSAM key card, there is a problem that unnecessary work steps are generated during system design and operation due to the connection method of the PPSAM key card and the authentication system different for each financial institution, and the authentication system. There is a problem in that it is not possible to check whether or not the normal processing according to the key load operation.

In addition, the conventional IC card authentication system has a problem that it is impossible to manage and control remotely because each system is concentrated in a specific place and managed and controlled by administrators in a financial system operation.

An object of the present invention is to solve the above problems, firstly, the key load device according to the present invention obtains the key for card authentication from the PPSAM key card regardless of whether the operating system type directly accepts the PPSAM key card After saving, if a key for card authentication is requested from the operating system or the authentication system, the key can be provided immediately, and the key is stored during the operation even if the operation system or the authentication system is rebooted or a PPSAM change occurs. An object of the present invention is to provide a key load device and a method for improving the stability of an authentication system by providing a pre-stored key.

Secondly, in performing a key load operation using a PPSAM key card in an IC card authentication system, a key load device and a method for confirming whether a key load operation is executed and whether a corresponding operation is normally processed are provided.

Third, the present invention provides a key load device and method capable of managing and controlling the environment setting of a key load device in a remote location by being connected to an operating system or an authentication system using a wired or wireless network.

The present invention for achieving the above object is, first, relates to a key load device, the authentication unit for authenticating the normality of each key when the administrator key and the PPSAM key is connected; A key storage unit for storing the keys obtained from the PPSAM; Control the authentication unit and the key storage unit, create a response message for the data including the authentication key and the authentication key request message inputted from the outside, and when the PPSAM is changed, until a key input operation from the new PPSAM is completed In addition, the two keys do not collide with each other until the end of the authentication operation using the conventional PPSAM so that each operation can be performed. When all the operations using the conventional PPSAM are terminated, the keys of the conventional PPSAM are A controller which performs a function of deleting all from the key storage unit; And an I / O interface that enables connection with an administrator key card and a PPSAM key card. It includes.

Preferably, an encryption unit for encrypting and decrypting data transmitted and received to the outside with a unique encryption algorithm; It characterized in that it further comprises.

On the other hand, the present invention relates to a key loading method of the IC authentication system, (a) after the control unit of the key loading device receives the insertion signal from the manager card and the PPSAM card from the I / O interface unit, the I / O interface unit Receiving an administrator password and a PPSAM password from the server; (b) the control unit determining whether administrator authentication according to step (a) is normally performed; (c) the control unit receiving a key from the I / O interface unit and storing it in a key storage unit when the determination result of step (b) is performed normally; (d) the control unit receiving a transmission request signal for a key loaded from an IC card authentication system; (e) the control unit transmitting the loaded PPSAM key to the IC card authentication system; And (f) if abnormally performed as a result of the determination in step (b), the controller determines whether the number of input errors for the administrator password and the PPSAM password received from the I / O interface unit has exceeded a predetermined number of times. If not exceeding, returning the control unit to the step (a); It includes.

Preferably, the control unit uses information to correct when there is a change in communication port from an input unit, information for setting a communication port used when communicating with an IC card authentication system, and communication used when loading a key into the IC card authentication system. Receiving and storing at least one of a port and information for correcting when the Internet address space of the IC card authentication system changes to the Internet address space of the IC card authentication system (S2); It characterized in that it further comprises.

Also preferably, after the step (c), the controller determines whether the operation history inquiry request signal is received from the input unit, and when the operation history inquiry request signal is received, the controller is configured to indicate the key load state. Outputting a user interface through an output unit; It characterized in that it further comprises.

Also preferably, after step (e), (g) the control unit receiving a transmission message for the PPSAM key transmitted from the IC card authentication system; (h) determining, by the controller, whether the PPSAM key is normally transmitted using the transmission message; (i) outputting a message indicating that the transmitted key is abnormally transmitted through the output unit, when the transmission is abnormally transmitted as a result of the determination of step (h); (j) the control unit determining whether to retransmit the key, and if retransmitting, returning to the step (e); And (k) outputting a message indicating that the transmitted key is normally transmitted through the output unit, when the transmission is normally performed as a result of the determination of step (h). It characterized in that it further comprises.

Hereinafter, with reference to the accompanying drawings will be described in detail the present invention.

First of all, with respect to the conventional key loading method, it is possible to refer to a document that has been published so that those skilled in the art can easily obtain it. Therefore, in the following description, it should be noted that description of parts other than necessary may be omitted so as not to distract from the gist of the present invention.

The configuration of the IC card authentication system according to the present invention will be described with reference to FIGS. 2 and 3 as follows.

As shown in FIG. 2, the system to which the present invention is applied includes a primary PerSAM issuing authority server 100, a key generation system 200, a key load device 300, an IC card authentication system 400, and an issuing system ( 500).

The primary PerSAM issuer server 100 issues a primary PerSAM key card and delivers it to the key generation system 200. A representative institution is a financial settlement agency.

In addition, the key generation system 200 is a system for generating each key value of PPSAM for use in the PerSAM and authentication system for issuing the IC card safely, the primary PerSAM issuing server ( 100), receives a PerSAM key card capable of recording various keys from the primary PerSAM issuing authority server 100, and additionally receives keys from each of the two or more key generators 210. A primary PerSAM key card and a corresponding PPSAM key card are generated.

In addition, as shown in FIG. 3, the key load device 300 may include an authentication unit 310 for authenticating whether the keys are normal when the manager key and the PPSAM key are connected, and uniquely transmit and receive data to and from the outside. An encryption unit 320 for encrypting / decrypting with an encryption algorithm, a key storage unit 330 for storing keys obtained from PPSAM, and the authentication unit, encryption unit, and key storage unit In addition, a response message is prepared for data including an authentication key inputted from the outside and a full authentication key request message, and when the PPSAM is changed, until the key input operation from the new PPSAM is completed, and the authentication operation using the conventional PPSAM. The two keys do not collide with each other until the end of the time, and all the tasks can be performed. The keys of the conventional PPSAM include a control unit 340 for performing a function of deleting all from the key storage unit 330, an input unit 350 including a mouse and a keyboard, a monitor, a speaker, a printer, a communication port, and the like. It includes an output device 360 including, and an I / O interface unit 370 that can connect the administrator key card and the PPSAM key card, and is a computer device capable of communicating including a general operating system, such as a personal computer such as a desktop computer and a laptop. Although set to a computer, the present invention is not limited thereto.

In addition, the IC card authentication system 400 is a validity of the mobile / financial IC card transaction transmitted from a wireless or wired user terminal 420 including a mobile phone, ATM and a teller terminal in a state connected to a separate financial institution HOST server It is a system that validates and generates a signature for a transaction.

The key generation system 200 is generally divided into a Windows series and a Unix-based system. Depending on the financial institution, the key generation system 200 may configure a system using only the Windows-based system, the Unix-based system, or any other family. The two series may coexist due to the reason.

The Unix-based IC card authentication system set as an embodiment of the present invention obtains authentication data (KeyLoad.ini file, etc.) obtained from a connection of a terminal having a PPSAM or a PPSAM key card through an offline operation by an administrator. As a system, a separate key loading storage unit is provided, and when an authentication request is received from an IC card issued using the secondary PerSAM key card, an authentication key obtained from the key loading storage unit and a key of the IC card are stored. It determines whether it matches and transmits it to a separate HOST server. In the present embodiment, the IC card authentication system 300 is set as a UNIX-based system, but the present invention is not limited thereto.

The issuing system 500 performs a function of issuing a personalized card for each card user by using a secondary PerSAM key card with a paired value from the IC card authentication system 300 using a PPSAM key card.

In addition, although not shown, each of the components according to an embodiment of the present invention, in particular, between the IC card authentication system 300 and the key load device 400 is set to be connected by a local area network (LAN) However, the present invention is not limited thereto, and it is also possible to use various types of wired and wireless networks.

Referring to Figures 4 to 8 the overall flow of the key loading method to the IC card authentication system according to an embodiment of the present invention using the system as follows.

4 is a flowchart illustrating a method for loading a key into the IC card authentication system according to the present invention, FIG. 5 is an embodiment for setting a key load environment according to the present invention, and FIG. 6 is for administrator authentication according to the present invention. 7 is an embodiment for indicating a key load state according to the present invention, and FIG. 8 is an embodiment for key transmission and transmission result display according to the present invention.

The control unit 340 of the key load device 300 transmits a user interface for setting a key load environment according to the present invention as shown in FIG. 5 to the output unit 360, and then uses the input unit 350 to use the same. Receive and store information for key load configuration from the server (S2).

In the present embodiment, the user interface for setting the key load is a 'COM port setting unit' for modifying when there is a change in the serial port, for setting a communication port used when communicating with the IC card authentication system 400. 'Port setting unit when the authentication server is executed', the communication port used to load the key into the IC card authentication system 400 and the IP address of the IC card authentication system 400 as the IP address of the IC card authentication system 400. Although it includes a 'Key sending IP / PORT setting unit' for correcting when the address changes, the present invention is not limited to the above-described conversion setting items.

When the manager card and the PPSAM card are inserted into the I / O interface unit 370, the control unit 340 uses the output unit 360 for administrator authentication according to an embodiment of the present invention shown in FIG. 6. After transmitting the user interface, the administrator password and the PPSAM password are received from the I / O interface unit 370 using the same (S4).

According to another embodiment of the present invention illustrated in FIG. 6, the user interface for administrator authentication includes a text box for inputting an administrator password and a text box for displaying a status of a management card. The PPSAM key load unit includes a text box for inputting a PPSAM password and a text box for displaying a PPSAM card status, but the present invention is not limited thereto.

The controller 340 determines whether the administrator authentication is normally performed by the step S4 (S6).

As a result of the determination in step S6, if normally performed, the controller 340 receives a key from the I / O interface unit 370 and stores the key in the key storage unit (S8).

The control unit 340 determines whether the operation progress inquiry request signal has been received from the input unit 350 (S10).

As a result of the determination in step S10, when the operation progress inquiry request signal is received, the controller 340 may include a user interface for indicating a key load state according to the present invention as illustrated in FIG. 7. 360 through the (S12).

As shown in FIG. 7, the user interface for indicating a key load state according to the present invention includes a text box for indicating an administrator key load state and a text box for indicating a PPSAM key load state.

The control unit 340 receives a transmission request signal for a key loaded from the IC card authentication system 400 (S14).

The control unit 340 outputs the user interface for displaying the key transmission and the transmission result according to the present invention shown in FIG. 8 to the output unit 360, and displays the key transmission and transmission result from the input unit 350. Upon receiving the 'send key' button selection signal of the user interface for transmitting, the loaded PPSAM key is transmitted to the IC card authentication system 400 (S16).

The user interface for key transmission and transmission result display according to the present invention shown in FIG. 8 includes a 'send key' button, a 'close' button and a text box for displaying the result. It is not limited to.

The control unit 340 receives the transmission message for the PPSAM key transmitted from the IC card authentication system 400 (S18).

The control unit 340 determines whether the PPSAM key is normally transmitted using the transmission message (S20).

As a result of the determination in step S20, if abnormally transmitted, the control unit 340 outputs a message indicating that the transmitted key was abnormally transmitted using a user interface for displaying the key and the transmission result. Output through (S22).

The control unit 340 determines whether the key is retransmitted, and if it is retransmitted, returns to step S16, and if it is not retransmitted, terminates the system for loading the key into the IC card authentication system according to the present invention (S24). ).

As a result of the determination in step S20, if normally transmitted, the controller 340 transmits a message indicating that the transmitted key is normally transmitted using the user interface for displaying the key and the transmission result through the output unit 360. Output it (S26).

As a result of the determination in step S10, when the operation progress inquiry request signal is not received, the controller 340 executes the procedure to step S14.

As a result of the determination in step S6, when abnormally performed, the controller 340 determines whether the number of input errors for the administrator password and the PPSAM password received from the I / O interface unit 370 exceeds a predetermined number of times. If not determined, if not exceeded, the control unit 340 returns to step S4, and if exceeded, the control unit 340 is for loading a key into the IC card authentication system according to an embodiment of the present invention. End the system (S28).

The present invention can be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, which may be implemented in the form of a carrier wave such as transmission via wired or wireless network. . The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

According to the present invention as described above, first, regardless of whether the type of the IC card authentication system directly accepts the PPSAM key card, the key load device according to the present invention acquires and stores a key for card authentication from the PPSAM key card. When a key for authentication of the card is requested from the IC card authentication system, the key can be provided immediately, and even if a reason such as a reboot of the IC card authentication system or a PPSAM replacement occurs, the key previously stored in the key storage unit is performed. By providing the IC card, the stability of the IC card authentication system can be improved.

Second, in performing the key load operation using the PPSAM key card in the IC card authentication system, it is possible to check the state of performing the key load operation and whether the corresponding operation is normally processed.

Third, by connecting to the IC card authentication system using a wired or wireless network, it is also possible to manage and control the environment setting of the key load device even at a remote location.

1 is a conceptual diagram relating to a key load in a conventional IC card authentication system.

2 is an exemplary view of an IC card authentication system according to the present invention.

3 is a block diagram of a key loading device according to the present invention;

4 is a flowchart of a key loading method into an IC card authentication system according to the present invention;

5 is a user interface for key loading device configuration in accordance with the present invention.

6 is a user interface for administrator authentication in accordance with the present invention.

7 is a user interface for representing a key load state in accordance with the present invention.

8 is a user interface for key transmission and transmission result display in accordance with the present invention.

Claims (6)

In the key load device that the primary PerSAM issuing authority server, the key generation system, the IC card authentication system, and the issuing system are interconnected through an information communication network, the IC card authentication system and the information communication network, An authentication unit 310 for authenticating each key if the manager key and the PPSAM key are connected; A key storage unit 330 for storing the keys obtained from the PPSAM; Regardless of whether the IC card authentication system directly accepts the PPSAM key card, when the authentication key is requested from the authentication system, the authentication is performed so that a card authentication key for immediately providing the authentication system is obtained from the PPSAM card and stored in the key storage unit. Control the secondary and key storage units, create a response message for the data including the authentication key and the authentication key request message input from the outside, until the key input operation from the new PPSAM is completed if the PPSAM is changed, and The two keys do not collide with each other until the end of the authentication operation using the conventional PPSAM, and each operation can be performed. When the operation using the conventional PPSAM is terminated, the keys of the conventional PPSAM are the keys. A controller 340 performing a function of deleting all from the storage; And An I / O interface unit 370 that enables connection with an administrator key card and a PPSAM key card; Key loading device comprising a. The method of claim 1, An encryption unit 320 for encrypting and decrypting data transmitted and received with the outside using a unique encryption algorithm; Key loading device further comprising. A method of loading a key using a system in which a primary PerSAM issuer server, a key generation system, an IC card authentication system, and an issuing system are interconnected through an information communication network, and a key load device is connected to the IC card authentication system through an information communication network. To (a) receiving a manager password and a PPSAM password from the I / O interface unit after the controller of the key load device receives the insertion signal of the manager card and the PPSAM card from the I / O interface unit (S4); (b) the control unit determining whether manager authentication according to the step (a) is normally performed (S6); (c) As a result of the determination in step (b), if normally performed, the controller of the key load device receives the PPSAM key from the PPSAM card inserted into the I / O interface of the key load device, and thus the key of the key load device. Storing in the storage unit (S8); (d) receiving, by the controller, a transmission request signal for a key loaded from the IC card authentication system, regardless of the type of the IC card authentication system for directly accepting the PPSAM key card (S14); (e) transmitting (S16) the loaded PPSAM key to the IC card authentication system; And (f) If the determination result of step (b) is abnormally performed, the controller determines whether the number of input errors for the administrator password and the PPSAM password received from the I / O interface unit has exceeded a predetermined number of times. If not exceeded, returning to the control unit (a) step (S28); Key loading method comprising a. The method of claim 3, wherein Information for correcting when there is a change in a communication port from an input unit, information for setting a communication port used when communicating with an IC card authentication system, and a communication port used when loading a key into the IC card authentication system; Receiving and storing at least one of information for correcting when the Internet address space of the IC card authentication system changes to the Internet address space of the IC card authentication system (S2); Key loading method further comprising. The method of claim 3, wherein After step (c), The control unit determines whether the work path inquiry request signal has been received from the input unit (S10), and when the work path inquiry request signal is received, the controller outputs a user interface for indicating a key load state through an output unit. Step S12; Key loading method further comprising. The method of claim 3, wherein After step (e), (g) receiving, by the controller, a transmission message for the PPSAM key transmitted from the IC card authentication system (S18); (h) determining, by the controller, whether the PPSAM key is normally transmitted using the transmission message (S20); (i) if it is abnormally transmitted, the control unit outputs a message indicating that the transmitted key is abnormally transmitted through the output unit (S22); (j) when the control unit determines whether to retransmit the key and retransmits, returning to step (e) (S24); And (k) if it is normally transmitted as a result of the determination in step (h), outputting a message indicating that the transmitted key is normally transmitted through the output unit (S26); Key loading method further comprising.