KR100648709B1 - Portable device including smart card integrated circuit chip and method for issuing application by the device - Google Patents

Abstract

A mobile terminal having a smart card IC chip and a method for issuing an application in the same are provided to efficiently use a smart card IC chip with a large capacitance by calculating and giving an available memory capacitance of an IC chip to a user. An initial issue key module(220) generates a predetermined initial issue key, and transmits the initial issue key to a server of a partner company corresponding to the application if a predetermined application issue is requested by a user. A security module(230) decodes the application issue key through the initial issue key if the application issue key is received from the server of the partner company according to the application issue. The server of the partner company codes the application issue key through the initial issue key. The application control module(240) installs and performs the application on an IC chip through the decoded application issue key.

Description

PORTABLE DEVICE INCLUDING SMART CARD INTEGRATED CIRCUIT CHIP AND METHOD FOR ISSUING APPLICATION BY THE DEVICE}

1 is a diagram showing the overall network configuration of a mobile banking system in which a mobile banking service is performed according to an embodiment of the present invention.

2 is a block diagram showing the configuration of a portable terminal equipped with a smart card IC chip according to an embodiment of the present invention.

Figure 3 is a flow chart showing the flow of the application issuing method of the mobile terminal is installed smart card IC chip according to an embodiment of the present invention.

4 is a flowchart illustrating a method of deleting an application issued to a smart card IC chip according to an embodiment of the present invention.

<Explanation of symbols for main parts of the drawings>

200: mobile terminal 210: user interface

220: initial issued key module 230: security module

240: application control module 250: control unit

260: authentication module 270: communication module

The present invention relates to a mobile terminal equipped with a smart card IC chip for a mobile banking service and an application issuing method thereof, and more particularly, when an application issued by a predetermined affiliate is installed in the smart card IC chip. After generating an initial issuance key through a certificate issued by the certification authority of the authentication and sharing with the affiliate, and receiving the application issuance key encrypted through the initial issuance key from the affiliate and decrypted through the initial issuance key, through A mobile terminal equipped with a smart card IC chip and an application issuing method thereof, which allow affiliates to operate the application independently and stably with respect to the IC chip issuer by installing and executing the application on the IC chip. will be.

Mobile Banking is a mobile terminal with internet access, anytime, anywhere bank balance inquiry, bank transfer, deposit inquiry, exchange rate inquiry, cashier's check, transaction history inquiry, credit card (credit card) transaction, cash service, etc. It means a financial transaction service that can receive various services. Recently, with the development of mobile communication technology, mobile banking users are increasing rapidly.

Mobile banking is distinguished from telebanking in that it can be used safely with security, and distinguished from internet banking in that it can be used on the go. Types of mobile banking include smart card chip (IC chip) method which saves its financial information on smart card (IC card) embedded in mobile terminal and improves convenience and security. There are a VM (Virtual Machine) method that executes a program every time a transaction is performed, and a WAP (Wireless Application Protocol) method, which transfers a transaction text by a text message between a mobile terminal and a banking system and performs a task.

In order to use the mobile banking service, a user must install an integrated circuit (IC) chip in his or her mobile terminal. An IC chip is an integrated circuit chip. IC chips include a CPU, memory (RAM, ROM), and a microprocessor for performing separate cryptographic processing. Currently, commercially available cards with 64 megabytes of memory capacity and 32-bit CPUs are emerging, which are virtually the same as the earliest computers. Thanks to this, IC chip is able to store huge amount of information as well as high level of encryption processing, and it is used mainly as mobile banking chip because of its excellent security.

The user can use the mobile banking service by receiving the IC chip from an issuer such as a mobile communication company and installing the IC chip in his mobile terminal. In addition, a user may install a predetermined application provided by the financial institution, that is, an affiliated company, on the IC chip in order to perform mobile banking of the financial institution desired by the user.

Security is important in this mobile banking. Therefore, an application issued to an IC chip by an affiliate, such as a financial institution, should be guaranteed independence only operated by the affiliate. However, the IC chip currently used for mobile banking has a built-in master key set by the issuer (mobile communication company) that issued the IC chip. The master key can control all applications installed in the IC chip. Is implemented.

That is, the issuer (mobile communication company) may install, delete, or change the application of the affiliated company (financial institution) issued to the mobile terminal IC chip of each mobile banking user without any restriction. Therefore, a security problem is raised, and a problem that an independent mobile banking service of an affiliate is not guaranteed is raised.

Accordingly, there is a demand for the development of a smart card IC chip that allows an affiliate to supply an application to a user's mobile terminal IC chip using a mobile banking service to stably and independently issue and operate the application.

The present invention has been made to improve the prior art as described above, by installing and operating the application by encrypting and decrypting the application issuing key through a certificate issued from a predetermined certification authority, the affiliated company that issued the application IC chip It is an object of the present invention to provide a mobile terminal equipped with a smart card IC chip and an application issuing method according to the smart card IC chip capable of independently and stably operating the application without the control of the issuing company.

In addition, the present invention provides a mobile terminal equipped with a smart card IC chip and an application issuing method according to the present invention by calculating the available memory capacity of the IC chip to provide to the user, thereby enabling the user to efficiently use a large capacity smart card IC chip. It aims to provide.

In order to achieve the above object and solve the problems of the prior art, the IC chip of the smart card according to the present invention, when receiving a predetermined application issuance request from the user, generates a predetermined initial issue key (Key), An initial issuing key module for transmitting an issuing key to an affiliate server corresponding to the application; A security module for decrypting the application issuance key through the initial issuance key when receiving an application issuance key according to the application issuance from the affiliate server-the affiliate server encrypts the application issuance key through the initial issuance key Sent box; And an application control module for installing and executing the application on the IC chip through the decrypted application issuance key.

The smart card IC chip according to the present invention may be installed in a mobile terminal to perform mobile banking under the control of the mobile terminal. In addition, the smart card IC chip may be mounted on a general credit card as well as a mobile terminal and used for financial transactions of the credit card.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention;

1 is a diagram showing the overall network configuration of a mobile banking system that performs a mobile banking service according to an embodiment of the present invention.

Mobile banking system according to an embodiment of the present invention comprises a certification authority server 110, issuing company server 120, affiliate server 130, and a mobile terminal 140, each of the server and the mobile terminal The 140 may be connected to each other via the communication network 150.

The portable terminal referred to in this specification, including FIG. 1, may be a personal digital assistant (PDA), a cellular phone, a personal communication service (PCS) phone, a hand-held PC, a CDMA-2000 (1X, 3X) phone. , Wideband CDMA (WCDMA) phone, Dual Band / Dual Mode phone, Global Standard for Mobile (GSM) phone, Mobile Broadband System (MBS) phone, Satellite / Terrestrial Digital Multimedia Broadcasting (DMB) phone, At least one of a notebook, a portable game console, a PMP, or a navigation terminal is characterized in that the.

The certification authority server 110 transmits the certificate to the mobile terminal 140 performing mobile banking so that the certificate is recorded in the first security area of the IC chip of the mobile terminal 140. The certification authority server 110 is a server operated by a predetermined certification authority, and may be selected as an independent agency from the issuer and affiliate of the IC chip. For example, the certification body may be selected as a financial institution that issues a public certificate. The certificate may be implemented with a predetermined public key pair set by the certificate authority. For example, the certificate may be implemented including an authentication public key and an authentication secret key.

The issuer server 120 may transmit the issuer operation key to the portable terminal 140 to control the issuer operation key to be recorded in the third security area of the IC chip. The issuer server 120 refers to a server operated by an issuer that issues the IC chip for mobile banking of the mobile terminal 140. Accordingly, the issuer may control a series of operations of the IC chip by recording a predetermined master key capable of controlling the configuration and operation of the IC chip, that is, the issuer operation key on the IC chip. The issuer operating key may be recorded in the IC chip in advance in the process of manufacturing the IC chip.

The affiliate server 130 transmits the application issuance key to the mobile terminal 140 to control the application issuance key to be recorded in the second security area of the IC chip. The affiliate server 130 refers to a server operated by the mobile banking service affiliate. For example, when a user of the mobile terminal 140 wants to use a mobile banking service through a specific bank, an application issued by the bank must be recorded on the IC chip of the mobile terminal 140 to use the mobile banking service of the bank. It is available. Therefore, the affiliate server 130 may transmit an application issuance key for operating the application and the application to the mobile terminal 140.

After transmitting the application issuance key, the affiliate server 130 may control the application issuance key to be encrypted through the certificate. For example, the application issuance key may be controlled to be encrypted with the authentication public key of the certificate. In addition, the affiliate server 130 may receive the certificate from the certification authority server 110 and encrypt the application issuing key transmitted to the mobile terminal 140 with the certificate to maintain the encrypted application issuing key.

Thereafter, the affiliate server 130 may transmit the application to the mobile terminal 140 and control the transmitted application to be recorded in the second security area of the IC chip. That is, the application issuing key and the application is recorded in a second security area which is separate from the third security area in which the issuing company operating key is recorded, thereby preventing the issuer operation key from being controlled. Can be.

In other words, in order for the issuer operation key to control the application, the application security key is recorded in the second security area to control the application. In addition, since the application issuing key is encrypted with the certificate, the application issuing key must be decrypted with an authentication secret key included in the certificate. Since the certificate is a concept independent of the issuing company operating key, the issuer operating key Cannot decrypt the application issuance key.

Therefore, the application recorded in the second security zone is operated under the control of the encrypted application issuance key without being controlled by the issuer operation key, thereby ensuring independence of the affiliate server 130 in its operation. Can be.

The communication network 150 may support a connection between the certification authority server 110, the issuer server 120, the affiliate server 130, and the mobile terminal 140. For the above operation, the communication network 150 is implemented as a mobile communication network supporting at least one of code division multiple access (CDMA), WCDMA, ALL IP, GSM, GPRS, and all existing mobile communication related access methods. Can be. In addition, the communication network 150 may be implemented by a wired Internet or a wireless Internet, or may include all communication networks that can be serviced in the future, such as a portable Internet and VoIP.

2 is a block diagram showing the configuration of a portable terminal device equipped with a smart card IC chip according to an embodiment of the present invention.

The mobile terminal 200 according to an embodiment of the present invention includes a user interface 210, an initial issuance key module 220, a security module 230, an application control module 240, a controller 250, and an authentication module 260. ), And a communication module 270.

The smart card IC chip may include an initial issue key module 220, a security module 230, an authentication module 260, and an application control module 240. However, in the present specification, for the convenience of description, the configuration of the smart card IC chip and the configuration of the portable terminal 200 will be mixed.

The user interface 210 receives a request for issuing a predetermined application from the user of the portable terminal 200. The application means an application of an affiliate for a mobile banking service. The user interface 210 may include a keypad unit including one or more keypads, a display module, a touch screen module, or a voice recognition module.

When the initial issue key module 220 receives an application issue request from the user through the user interface 210, the initial issue key module 220 generates a predetermined initial issue key and associates the generated initial issue key with the application. Send to server. The initial issue key module 220 may generate the initial issue key using a predetermined algorithm or function. In addition, the initial issue key module 220 may transmit the initial issue key to the affiliate server through the communication module 270 under the control of the controller 250.

The initial issue key module 220 may generate the initial issue key to include an authentication public key and an authentication secret key. The authentication public key may be used when encrypting a predetermined key, and the authentication secret key may be used when decrypting the encrypted key.

The authentication module 260 is received from a predetermined certification authority server and maintained by the mobile terminal 200. The certification authority server may be implemented in the same concept as the certification authority server described with reference to FIG. 1. The initial issue key module 220 may generate the initial issue key with reference to the certificate. The affiliate server may also receive and maintain the certificate from the certification authority server.

The affiliate server may encrypt an application issuance key according to the application issuance using the initial issuance key received from the mobile terminal 200. That is, the affiliate server may encrypt the application issuance key using the authentication public key included in the initial issuance key and transmit the encrypted application key to the mobile terminal 200.

When receiving the application issuance key from the affiliate server, the security module 230 decrypts the application issuance key through the initial issuance key. In this case, since the initial issue key is shared between the mobile terminal 200 and the affiliate server, the security module 230 may decrypt the encrypted application issue key using the initial issue key. That is, the security module 230 may decrypt the application issuing key through the authentication secret key included in the initial issuing key.

The application control module 240 may install and execute the application on the smart card IC chip through the decrypted application issue key. That is, the application control module 240 may control the operation of the application such as installation, execution, or deletion of the application installed in the smart card IC chip under the control of the controller 250.

The application control module 240 may calculate the available memory capacity of the smart card IC chip. That is, it is possible to calculate how much memory capacity that can issue another application among the total capacity of the IC chip. The calculated available memory capacity may be provided to the user through the user interface 210 of the mobile terminal 200. Thus, the user can more effectively use the smart card IC chip according to the displayed available memory capacity.

The communication module 270 may receive a certificate from a certification authority server through a predetermined communication network, receive an application and an application issuance key from an affiliate server, and receive an issuer operation key from an issuing server. In addition, the communication module 270 may be implemented to communicate with each server to transmit and receive various data and control signals. For the above operation, the communication module 270 is connected to the Public Switched Telephone Network (PSTN) as well as to the Code Division Multiple Access (CDMA), WCDMA, ALL IP, GSM, GPRS, and all existing mobile communications. It can support one or more of the access methods, and can be implemented to support one or more of the call control protocols for VoIP call connections such as H.323, Message Gateway Control Protocol (MGCP), Session Initiation Protocol (SIP), or Megaco. Can be. In addition, the communication module 190 may include one or more short range communication modules according to respective short range communication protocols such as Bluetooth, Zigbee, infrared communication (IrDA), or WLAN (IEEE802.11b).

In addition, when the security module 230 is requested to delete the issued application from a predetermined external server through the communication module 270, the security module 230 requests the external server to transmit an initial issued key corresponding to the application. That is, the transmission of the initial issued key may be requested to the external server for authentication of the right to delete the application.

When receiving a predetermined key from the external server, the security module 230 determines whether the received key is the same as the initial issued key. If it is determined that the key is the same as the initial issued key, the security module 230 may authenticate deletion of the application, and the application control module 240 may delete the application.

The external server includes a server of an issuer that issues a smart card IC chip according to the present invention. That is, an application issued to the smart card IC chip may not be deleted or operated at the request of the issuer server. Therefore, the affiliate who issued the application to the smart card IC chip according to the present invention can operate the application independently without the control of the issuer.

3 is a flowchart illustrating a flow of an application issuing method of a mobile terminal in which a smart card IC chip is installed according to an embodiment of the present invention.

When the mobile terminal in which the smart card IC chip is installed according to an embodiment of the present invention receives a request for issuing a predetermined application from the user (step 311), the portable terminal generates an initial issue key in response to the request (step 312). ). The mobile terminal transmits the generated initial issued key to the affiliate server corresponding to the application (step 313). At this time, the affiliate server encrypts the application issuance key according to the application issuance using the initial issuance key and transmits it to the mobile terminal.

The portable terminal receives the encrypted application issuance key from the affiliate server (step 314). The portable terminal decrypts the encrypted application issuing key using the initial issuing key (step 315). Thereafter, the portable terminal installs and executes the application on the IC chip using the decrypted application issue key (step 316).

4 is a flowchart illustrating a method of deleting an application issued to a smart card IC chip according to an embodiment of the present invention.

In the smart card IC chip according to an embodiment of the present invention, a predetermined application may be issued and executed. At this time, when the mobile terminal having the smart card IC chip installed is requested to delete the application from an external server (step 411), the mobile terminal requests the external server to transmit an initial issued key corresponding to the application. (Step 412).

When receiving a predetermined key from the external server, the portable terminal determines whether the received key is the same as the initial issued key (step 413). If the received key in step 413 is not the same as the initial issued key, the portable terminal may determine that the application cannot be deleted and notify the external server (step 414).

If the received key is the same as the initial issued key in step 413, the portable terminal authenticates the deletion of the application (step 415) and deletes the application from the smart card IC chip.

The portable terminal then calculates the available memory capacity of the smart card IC chip (step 416) and displays it to the user (step 417), whereby the user can more efficiently issue the application of the smart card IC chip. You can make it available.

The application issuing method of the smart card IC chip according to the present invention can be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. The medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, or the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While specific embodiments of the present invention have been described so far, various modifications are possible without departing from the scope of the present invention.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims below, but also by the equivalents of the claims.

According to a mobile terminal equipped with a smart card IC chip of the present invention and an application issuing method according thereto, the application is issued by encrypting and decrypting an application issuing key using a certificate issued from a predetermined certification authority, and installing and operating the application. It is possible to obtain an effect that an affiliate can operate the application independently and stably without being controlled by the issuer who issued the IC chip.

Further, according to the portable terminal equipped with the smart card IC chip of the present invention and the application issuing method according thereto, by calculating the available memory capacity of the IC chip and providing it to the user, the user can efficiently use the large capacity smart card IC chip You can get the effect.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above-described embodiments, which can be variously modified and modified by those skilled in the art to which the present invention pertains. Modifications are possible. Accordingly, the spirit of the present invention should be understood only by the claims set forth below, and all equivalent or equivalent modifications thereof will belong to the scope of the present invention.

Claims (13)

In a mobile terminal, An initial issuing key module for generating a predetermined initial issuing key and transmitting the initial issuing key to an affiliate server corresponding to the application when a user is requested to issue a predetermined application; A security module for decrypting the application issuance key through the initial issuance key when receiving an application issuance key according to the application issuance from the affiliate server-the affiliate server encrypts the application issuance key through the initial issuance key Sent box; And An application control module for installing and executing the application on the IC chip through the decrypted application issuing key A mobile terminal equipped with a smart card IC chip, characterized in that it comprises a. The method of claim 1, The initial issued key includes an authentication public key and an authentication secret key, The affiliate server encrypts the application issuance key with the authentication public key, And the security module decrypts the application issuance key with the authentication secret key. The method of claim 1, Authentication module for holding a certificate received from a predetermined certification authority server More, And the initial issue key module generates the initial issue key with reference to the certificate. The method of claim 1, When the security module is requested to delete the issued application from a predetermined external server, the security module requests transmission of the initial issued key to the external server, and when the key received from the external server is the same as the initial issued key, A portable terminal equipped with a smart card IC chip, characterized in that the deletion of the application is authenticated. The method of claim 4, wherein The external server is a mobile terminal equipped with a smart card IC chip, characterized in that it comprises a server of the issuer that issued the IC chip. The method of claim 1, The application control module calculates the available memory capacity of the IC chip, and displays the available memory capacity to the user through the display means of the terminal on which the smart card IC chip is mounted. Mobile terminal. The method of claim 1, The portable terminal includes a personal digital assistant (PDA), a cellular phone, a personal communication service (PCS) phone, a hand-held PC, a CDMA-2000 (1X, 3X) phone, a WCDMA (Wideband CDMA) phone, dual Dual Band / Dual Mode phones, Global Standard for Mobile (GSM) phones, Mobile Broadband System (MBS) phones, satellite / terrestrial Digital Multimedia Broadcasting (DMB) phones, laptops, handheld game consoles, PMPs, or navigation A portable terminal equipped with a smart card IC chip, characterized in that any one of the terminals. In the application issuing method of a mobile terminal equipped with a smart card IC chip, Generating a predetermined initial issuance key when receiving a request for issuing a predetermined application from a user; Transmitting the initial issued key to an affiliate server corresponding to the application; Receiving an application issuance key from the affiliate server, the application issuing key encrypted through the initial issuing key; Decrypting the application issuing key through the initial issuing key; And Installing and executing the application on the IC chip through the decrypted application issuing key; Application issuing method comprising a. The method of claim 8, The step of generating the initial issued key, Receiving and maintaining a certificate from a predetermined certification authority server; And Generating an authentication public key and an authentication secret key by referring to the certificate Application issuing method comprising a. The method of claim 9, The affiliate server encrypts the application issuance key through the authentication public key, And decrypting the application issuance key through the initial issuance key, decrypts the application issuance key through the authentication secret key. The method of claim 8, Receiving a request for deleting the issued application from a predetermined external server; Requesting transmission of the initial issued key to the external server; Receiving a predetermined key from the external server; And Authenticating deletion of the application when the received key is the same as the initial issued key Application issuing method characterized in that it further comprises. The method of claim 8, Calculating available memory capacity of the IC chip; And Displaying the available memory capacity to a user through display means of a terminal equipped with the smart card IC chip; Application issuing method characterized in that it further comprises. A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 8 to 12.

Images