KR100806186B1 - Method and mobile telecommunication terminal for initializing key of security domain in smart card - Google Patents

Abstract

A method for initializing a key of a security domain in a smart card and a mobile terminal are provided to solve a problem that a security key is exposed by a user who uses a master key used for authenticating a smart key in the process of mounting an application in a mobile terminal. A memory unit(101) includes a real time operating system, software for processing a call of a mobile terminal, and an application and a card manager, and stores a current operation mode of the mobile terminal as a status flag. A microprocessor(116) controls a general operation to allow smooth voice transmission/reception and data transmission/reception in the mobile terminal and drives the application and the card manager to control the process of providing a mobile banking service. A smart card mounting unit(114) includes a smart card storing information required for the process of using the mobile banking service.

Description

Method and Mobile Telecommunication Terminal for Initializing Key of Security Domain in Smart Card

1 is a diagram schematically showing an internal configuration of a mobile communication terminal for initializing a key of a security domain in a smart card according to an embodiment of the present invention;

2 is a diagram illustrating a WIPI platform structure applied to a mobile communication terminal for initializing a security domain key in a smart card according to an embodiment of the present invention;

3 is a diagram illustrating a process of mounting an application without exposing the security key of the application when the application is to be mounted in the mobile communication terminal according to an embodiment of the present invention;

FIG. 4 is a diagram illustrating a process of transmitting a security key of an application to a smart card through the secure channel A in the process of mounting the security key of the application shown in FIG. 3 without exposing it.

<Description of Symbols for Main Parts of Drawings>

100: key input unit 102: display unit

104: program storage unit 106: mode state storage unit

108: camera unit 110: camera module

112: camera control processor 114: smart card mounting unit

116: microprocessor 118: digital signal processing unit

120: baseband converter 122: RF signal processing unit

124: antenna 126: speaker

128: microphone 200: application

202: card manager 204: mobile standard platform

206: basic API 208: HAL

210: OEM software 212: hardware resources of the mobile communication terminal

The present invention relates to a method for initializing a security domain key in a smart card and a mobile communication terminal. More specifically, if you want to mount an application that works with the smart card mounted on the mobile terminal, the application can be loaded on the mobile terminal without exposing the security key of the application to a user who can use the smart card's master key. The present invention relates to a method for initializing a security domain key in a smart card and a mobile communication terminal.

 Information and communication technology represented by the Internet and mobile communication is changing the life patterns of modern people. The use of Internet-enabled personal computers in almost all homes, schools, and offices has made it possible to acquire information through Web sites, purchase goods through e-commerce, and exchange news via e-mail. Just a few years ago, people could only use voice communication-oriented mobile services using mobile terminals. Recently, however, a wireless internet service that can receive data communication service using the internet has appeared in a mobile communication terminal.

With the advent of wireless Internet services, mobile subscribers include mobile financial services, content providing services, and e-government services, as well as voice calling services that allow mobile subscribers to talk freely regardless of time and place. Various additional services are available. Here, the mobile financial service refers to a wireless Internet service that performs financial transactions such as wire transfer, bank transfer, and payment using a mobile communication terminal, and the content providing service downloads digital content including MP3 files and video files. It refers to a wireless Internet service that is played back by the mobile communication terminal. In addition, the e-government service refers to a wireless Internet service that can be issued a variety of civil complaints, such as resident registration, copy of family register, etc. without visiting the office.

Among these various additional services, mobile financial services are in the spotlight. In order to use a mobile financial service in a mobile communication terminal, a smart card issued by a financial institution and an application which interworks with it should be installed. Currently, mobile communication terminals manage smart cards and applications that interoperate with them in the following ways. First, a mobile communication terminal is equipped with a smart card made of hardware, and an application for controlling the mounted smart card, but is installed in the middle of the smart card and the application operating system concept software for controlling each other. Here, the software of an operating system concept that is located between a smart card and an application to control each other is defined as a 'card manager' for convenience of description. Thereafter, the mobile terminal runs the application through the card manager, transmits a command requested by the application to the smart card, and transmits the information stored in the smart card to the application.

Herein, when an application is newly developed by a content provider that provides a mobile financial service, the newly developed application is mounted on a mobile communication terminal in the following manner. That is, when there is an application to be newly mounted in the mobile communication terminal, the user using the master key for authenticating the smart card performs an authentication on the application to be mounted and then mounts the mobile communication terminal. According to the conventional method, the security key, which is authentication data of the application (in other words, information required for user authentication in the process of using the mobile financial service) in the process of mounting the application in the mobile communication terminal, selects the master key that authenticates the smart card. There is a problem that can be exposed by the user to use.

In order to solve the above-mentioned problems, the present invention, if you want to mount the application to work with the smart card mounted on the mobile terminal, the mobile communication without exposing the security key of the application to the user who can use the master key of the smart card An object of the present invention is to provide a method for initializing a security domain key in a smart card that enables an application to be mounted in a terminal, and a mobile communication terminal.

Therefore, according to the first object of the present invention, if you want to mount an application that works with the smart card mounted in the mobile communication terminal, by transmitting to the smart card without exposing the security key (Security Key) included in the application A method of initializing a security domain key in a smart card, which enables the application to be securely mounted in the mobile communication terminal, the method comprising: (a) a card manager controlling the smart card and serving as an operating system for managing the application; Receiving a request to mount the application; (b) creating a new security domain; (c) determining whether the application is legitimate software; And (d) transmitting the security key to the smart card.

In addition, according to the second object of the present invention, if you want to mount an application that works with the smart card mounted on the mobile communication terminal, by transmitting to the smart card without exposing the security key (Security Key) included in the application A method of transmitting a security key of an application to a smart card that enables the application to be securely mounted on the mobile communication terminal, the method comprising: (a) a car which directly controls the smart card and serves as an operating system for managing the application; A node manager performing authentication on the application; (b) creating a secure channel, which is an encrypted communication channel between the application and the smart card; And (c) transmitting the security key included in the application to the smart card through the secure channel.

In addition, according to the third object of the present invention, when an application linked with a smart card is to be loaded, the application can be securely mounted by transmitting the security key included in the application to the smart card without exposing the security key. A mobile communication terminal for initializing a security domain key in a smart card, comprising: a real time operating system, a mobile communication terminal call processing S / W, an application, and a card manager; A memory unit which stores a current operation mode of the mobile communication terminal as a status flag; A microprocessor unit for overall control to smoothly transmit / receive data and transmit / receive data in the mobile communication terminal, and control a process of providing the mobile financial service by driving the application and the card manager; And a smart card mounting unit including an integrated chip and mounting the smart card storing information required in the process of using the mobile financial service. Provides a mobile communication terminal to initialize.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are used as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a diagram briefly illustrating an internal configuration of a mobile communication terminal for initializing a key of a security domain in a smart card according to an exemplary embodiment of the present invention.

An internal configuration of the mobile communication terminal for initializing the security domain key in the smart card according to the preferred embodiment of the present invention includes a key input unit 100, a display unit 102, a program storage unit 104, and a mode state storage unit 106. ), Camera unit 108, smart card mounting unit 114, microprocessor 116, digital signal processing unit 118, baseband conversion unit 120, RF signal processing unit 122, antenna 124, speaker ( 126, microphone 128, and the like.

Brief description of the main features of the present invention. A program newly developed by a content provider providing a mobile financial service, that is, defining a process of loading an application interoperating with a smart card mounted on the smart card mounting unit 114 of the mobile communication terminal in the program storage unit 104. There are key features to having. In the present invention, the application exchanges the security key and the master key between the smart card and each other, thereby performing authentication on the application to be mounted and not mounting the program to the program storage unit 104, that is, the security key and the mutual key. The main feature is to verify that the application to be mounted without exchanging the master key is only legitimate software and to be mounted in the program storage unit 104. In short, the present invention is characterized in that the security key of the application to be mounted is not exposed but is mounted in the program storage unit 104. Here, the security key refers to information necessary for performing authentication in the process of using the mobile financial service linked with the application, and the master key refers to information necessary for performing authentication in the process of reading information stored in the smart card.

In addition, the present invention exchanges predetermined authentication information (that is, information indicating that the application to be loaded is legitimate software) with the smart card through the card manager in the process of verifying whether the application to be loaded is legitimate software. The predetermined authentication information included in the application and transmitted to the smart card is defined as 'application authentication information', and the predetermined authentication information included in the smart card and transmitted to the application is defined as 'smart card authentication information'.

A mobile communication terminal according to a preferred embodiment of the present invention is a PDA (Personal Digital Assistant), cellular phone, PCS (Personal Communication Service) phone, GSM (Global System for Mobile) phone, W-CDMA (Wideband CDMA) phone, CDMA- 2000 phones, Mobile Broadband System (MBS) phones, and the like. Here, MBS phone refers to a mobile phone to be used in the fourth generation system currently being discussed.

The key input unit 100 drives an application that interworks with a smart card mounted on the smart card mounting unit 114 and a button for text input including a numeric key for inputting a number such as a phone number and the preferred embodiment of the present invention. And a special key for driving the camera unit 108 to photograph a subject. In the present invention, the user manipulates the key input unit 100 provided in the mobile communication terminal to drive an application mounted in the program storage unit 104 to use the mobile financial service.

The display unit 102 displays an operation state of the mobile communication terminal, including a power supply use state, a radio wave reception intensity, a date and time, and a mobile financial service provider interworking with a smart card.

The memory unit 101 includes an electrically erasable programmable read only memory (EEPROM), a flash memory, a random access memory (RAM), and the like, and includes a program storage unit 104 and a mode state storage unit 106. And the like.

The program storage unit 104 stores a real time operating system, a mobile communication terminal call processing software, an application and a card manager, and these software are loaded into the RAM and driven.

Here, the application refers to software that is developed / provided as a WIPI (Wireless Internet Platform for Interoperability) or a BREW application of Qualcomm as well as a card manager, and provides mobile financial services by interworking with a smart card mounted on the smart card mounting unit 114. do. In addition, the card manager is developed and provided as a BREW application of WIPI or Qualcomm, and refers to software of an operating system concept that is located in the middle of a smart card mounted on the smart card mounting unit 114 and an application. The card manager does not mount the newly developed application in the program storage unit 104 in the program storage unit 104 by using the security key of the application, but receives application authentication information from the application, After receiving the smart card authentication information to read whether they match each other, and if the readings match each other, it forms an encrypted communication channel, transmits the security key of the application to the smart card through the formed encrypted communication channel, and program the application. Control to be mounted in the storage unit 104.

The mode state storage unit 106 stores the current operation mode of the mobile communication terminal selected by the key input unit 100 as a state flag (eg, 0, 1, 2, ...). That is, the microprocessor 116 assigns a unique status flag to each mode to distinguish a standby mode, an outgoing mode, a search mode, a call mode, a general incoming mode, and a mobile financial service use mode of the mobile communication terminal. The state storage unit 106 is updated.

The camera unit 108 refers to an apparatus for generating image data including a still image and / or a moving image by photographing a subject. The camera control processor 112 controls the operation of the camera module 110 and the camera module 110. ). The camera module 110 includes an image pickup device of a Charge Coupled Device (CCD) or Complementary Metal Oxide Semiconductor (CMOS) type, and the Camera Control Processor 112 is a central processing unit. The overall operation of the controller 110, for example, the zoom function, the flash function, the still image shooting, and the video shooting function is controlled.

The smart card mounting unit 114 is composed of an integrated chip, and includes a smart card that stores information necessary for the process of using a mobile financial service. The smart card includes a master key necessary for performing authentication in the process of reading stored information, and smart card authentication information for verifying whether an application mounted on the program storage unit 104 is valid software.

The microprocessor 116 controls the overall operation of voice transmission / reception and data transmission / reception in the mobile communication terminal. In addition, the microprocessor 116 drives an application and a card manager to control a process of providing a mobile financial service.

The digital signal processor 118 functions as an equalizer for coding or decoding an audio signal and removing multipath noise, and processes audio data and video data downloaded in the process of using the wireless Internet. A digital signal processing processor that performs a decoding function. In addition, the digital signal processor 118 exchanges speech data with the baseband converter 120 and receives digital data RX DATA from the baseband converter 120.

The baseband converter 120 converts a signal transmitted / received between the digital signal processor 118, the RF signal processor 122, the speaker 126, and the microphone 128 into a baseband band signal, and converts the digital analog signal into a digital analog signal. Performs functions such as digital to analog conversion and analog to digital conversion. The baseband converter 120 transmits the transmission data TXIQ to the RF signal processor 122, and controls the power of the RF signal processor 122 or automatically controls the gain thereof. The RF signal processor 122 receives the received signal RFIQ.

The RF signal processor 122 demodulates and amplifies an RF signal received from the antenna 124, modulates a transmission signal applied from the baseband converter 120, and transmits the modulated signal to the propagation space. The speaker 126 outputs sound data transmitted from the baseband converter 120 as an audible sound, and the microphone 128 converts a user's voice input into an electrical signal.

2 is a diagram illustrating a WIPI platform structure applied to a mobile communication terminal for initializing a key of a security domain in a smart card according to an exemplary embodiment of the present invention.

The WIPI platform structure applied to the mobile terminal for initializing the security domain key in the smart card according to the preferred embodiment of the present invention is the application 200, the card manager 202, the mobile standard platform 204, the OEM software 210 ) And hardware resources 212 of the mobile communication terminal.

The application 200 refers to software required to use a mobile financial service, and functions to interwork with a content providing server that provides a mobile financial service, and is secured through the card manager 202 in the process of being mounted in the program storage unit 104. It does not expose the key, but has a function to control whether it is loaded after verifying whether it is legitimate software.

The application 200 uses the application authentication information to verify whether the application 200 mounted on the program storage unit 104 is a legitimate software. Here, the application authentication information refers to APCert (Application Provider Certificate, hereinafter referred to as "APCert") that is authentication information that proves that the application 200 has been developed by a legitimate content provider. The application authentication information includes an IPD (Issuer Privilege Data, hereinafter referred to as an 'IPD') indicating that the user is authorized to read information stored in the smart card in association with the smart card. Here, the IPD is also included in the smart card. Therefore, in the present invention, the card manager 202 receives the application authentication information in the process of mounting the application 200 in the program storage unit 104, and receives the smart card authentication information from the smart card to compare with each other whether the match In the verification process, the IPD is used to verify the mutual matching. In other words, if the IPD included in the application and the IPD included in the smart card match, the application to be loaded is recognized as legitimate software.

The card manager 202 controls the smart card included in the hardware resource 212 of the mobile communication terminal, mounts the application 200 to be linked with the smart card in the program storage unit 104, deletes the application ( The software for managing the operation of the 200). The card manager 202 controls the process of verifying whether the application authentication information included in the application 200 and the smart card authentication information included in the smart card are compared and matched with each other.

The mobile standard platform 204 includes a basic API 206, a HAL 208, and the like, and monitors the usage of hardware resources 212 of the mobile communication terminal and executes the application 200. It refers to software that controls the use of the hardware resources 212 and supports the application 200 to run and use the mobile financial service regardless of the type of real-time processing operating system installed in the mobile communication terminal.

The basic API 206 refers to software used to communicate with system software such as a real-time processing operating system or a database management system while the application 200 according to an embodiment of the present invention is running. The base API 206 is implemented to call a function that provides a connection to a particular subroutine of a real-time processing operating system mounted on the mobile terminal for execution of the application 200 and the card manager 202.

HAL (Handset Adaptation Layer) 208 refers to a software that supports the specifications of the platform for the terminal manufacturer, and interface between the hardware resources 212 of the mobile communication terminal and the real-time processing operating system. That is, the HAL 208 provides an environment in which the application 200 and the card manager 202 can run in a mobile communication terminal having a different hardware configuration for each manufacturer.

The OEM software 210 performs basic voice call processing functions, lower layer data communication functions, text message transmission and reception functions, and mobile terminal management functions. The OEM software 210 controls the application 200 and the card manager 202. After passing from the mobile standard platform 204, the mobile financial service is controlled. Here, the OEM software 210 has been ported to SVD, which is a CDMA Rel.A standard, in order to implement the application 200 and the card manager 202 to be able to operate smoothly in a mobile communication terminal.

The hardware resource 212 of the mobile communication terminal is a smart card mounted in the key input unit 100, the display unit 102, the program storage unit 104, the microprocessor 114, and the smart card mounting unit 114 of the mobile communication terminal. Means a set of electronic / mechanical devices such as. Here, the smart card is CARCert (CA Root Certificate), which is authentication information for generating a key for authentication in the process of interworking with a content providing server that provides a mobile financial service, and a smart card distributed by an institution that distributes a smart card. It contains smart card authentication information to verify that it is legitimate. Here, the smart card authentication information means CHCert (Card Holder Certificate), and includes an IPD.

The following table shows information included in the application authentication information and smart card authentication information.

As shown in Table 1, the application authentication information and the smart card authentication information are allocated 2 bytes for the 'Certificate Format', which is a data field indicating the format of the authentication information, and the 'Certificate' is a data field indicating the serial number of the authentication information. 4 bytes are allocated for Serial Number, and 20 bytes are allocated for 'Issuer Public Key Hash Value', which is a data field for keys used in application authentication information and smart card authentication information. 1 byte is allocated for 'Subject Public Key Algorithm Identifer', a data field that indicates that the authentication information is applying a public key based algorithm, and application authentication information and smart card authentication information are transferred from the public key based algorithm to the public key module. 'Subject Public Key Algorithm Modu' data field le is assigned to N component (N means integer value), and 1 or 3 bytes are allocated to 'Subject Public Key', a data field that informs public key modulus in public key based algorithm. 20 bytes are allocated to the 'Subject Public Key Hash Value', which is a data field indicating the hash value of the public key, and a data field for verifying whether the application linked with the smart card is valid. In other words, the application authentication information and 2 bytes are allocated for 'Issuer Privilege Data', a data field that verifies whether the smart card credentials match each other, and 'Extension', a data field that can be defined by extending application authentication information and smart card authentication information. N bytes are allocated for the application authentication information and smart card authentication information. Therefore, N bytes are allocated to 'Signature', a data field that informs the signature value of all data.

Here, as described above, the numerical value of the byte unit allocated to each field is merely an example for easy description, but is not limited thereto.

3 is a diagram illustrating a process of mounting an application without exposing the security key of the application when the application is to be mounted in the mobile communication terminal according to the preferred embodiment of the present invention.

When the application 200 newly developed by the content development provider is to be mounted on the mobile communication terminal, the security domain to be resided in the card manager 202 is selected in the state of being mounted on the mobile communication terminal (S300). Here, the security domain refers to a virtual space that is encrypted and protected while the application 200 mounted on the mobile communication terminal interworks with the card manager 202.

It is checked whether the application 200 mounted on the mobile communication terminal is software linked with the mobile financial service (S302), and the mounted application 200 generates a security domain that will reside through the card manager 202 ( S304)

After step S304, the card manager 202 verifies whether the software is legitimate for the application 200 to be loaded, and receives the smart card authentication information from the smart card, and the application authentication information from the application 200. Is received (S306). The card manager 202 reads whether the smart card authentication information and the IPD included in the application authentication information coincide with each other, and generates a secure channel A which is an encrypted communication channel when the read result coincides with each other (S308).

The card manager 202 transmits the security key included in the application 200 to the smart card through the generated secure channel A (S310). After step S310, the card manager 202 closes the secure channel A and generates a secure channel B, which is a newly encrypted communication channel, using the security key of the application 200 (S312). The card manager 202 resides in the smart card via the newly created secure channel B, and performs public key authentication using a public key based algorithm (S314).

FIG. 4 is a diagram illustrating a process of transmitting a security key of an application to a smart card through the secure channel A in the process of mounting the security key of the application shown in FIG. 3 without exposing it.

If you want to mount the application 200 to provide a mobile financial services in conjunction with the smart card mounted on the mobile communication terminal, the application 200 to be loaded with software that has a warm purpose, for example debugging software, hacking software, etc. It is verified whether the application 200 to be mounted using the application authentication information and the smart card authentication information whether or not the legitimate software. Here, in the related art, the master key included in the smart card is used because it does not form a separate encrypted communication channel and verifies whether the application 200 to be mounted is legitimate software using the master key included in the smart card. There was a problem that the user can read the security key included in the application (200).

However, in the present invention, in the process of mounting the application 200 in the mobile communication terminal using the application authentication information to verify whether the right software, create a separate encrypted communication channel, the application through the generated encrypted communication channel Since the security key of 200 is transmitted to the smart card, a user who uses the master key of the smart card may solve the problem of reading the security key included in the application 200. Here, the encrypted communication channel means secure channel A shown in FIG. 3.

The application 200 requests to read smart card authentication information to the smart card through the card manager 202 (S400). The card manager 202 reads CHCert, which is smart card authentication information, from the smart card and transmits it to the application 200 (S402). Here, the purpose of reading the CHCert, which is the smart card authentication information, is to compare the IPD included in the application authentication information with the IPD included in the smart card authentication information and compare them.

After step S402, the application 200 transmits APCert, which is application authentication information, through the card manager 202 (S404). The card manager 202 compares the application authentication information and the smart card authentication information transmitted between the application 200 and the smart card with each other and reads whether the application 200 to be mounted is legitimate software (S406).

After step S406, the card manager 202 generates secure channel A, which is an encrypted communication channel (S408), and transmits the security key of the application 200 to the smart card through the generated secure channel A (S410).

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

As described above, according to the present invention, when a mobile communication terminal is used to mount a newly developed application in the process of using a mobile financial service, the mobile communication terminal can be safely stored without exposing the security key included in the newly developed application. There is an effect that can be transferred to the smart card mounted on.

Claims (13)

When an application interoperating with a smart card mounted in a mobile communication terminal is to be loaded, the application may be safely installed in the mobile communication terminal by transmitting the security key included in the application to the smart card without exposing the security key. In the smart card to initialize the security domain key, (a) receiving a request for mounting the application from a card manager controlling the smart card and serving as an operating system for managing the application; (b) creating a new security domain; (c) determining whether the application is legitimate software; And (d) transmitting the security key to the smart card Method of initializing the key of the security domain in a smart card comprising a. The method of claim 1, wherein step (b) (b1) creating the security domain as an encrypted virtual space in which the application can reside in the card manager, an encrypted virtual area that is protected separately from other applications interoperating with the smart card; And (b2) mapping the application to be mounted in the generated security domain; Method of initializing the key of the security domain in a smart card comprising a. The method of claim 1, wherein step (c) (c1) receiving smart card authentication information from the smart card; (c2) receiving application authentication information from the application; (c3) comparing the smart card authentication information and the application authentication information with each other and reading whether they match; And (c4) generating an encrypted communication channel when comparing the smart card authentication information with the application authentication information and matching each other; Method of initializing the key of the security domain in a smart card comprising a. The method of claim 1, wherein after step (d) (e) transmitting the security key of the application to the smart card over an encrypted communication channel; And (f) residing a DAP on the smart card and performing public key authentication using a public key based algorithm Method of initializing the key of the security domain in a smart card comprising a. When an application interoperating with a smart card mounted in a mobile communication terminal is to be loaded, the application may be safely installed in the mobile communication terminal by transmitting the security key included in the application to the smart card without exposing the security key. In a method for transmitting a security key of an application to a smart card, (a) directly controlling the smart card and authenticating the application by a card manager which serves as an operating system for managing the application; (b) creating a secure channel, which is an encrypted communication channel between the application and the smart card; And (c) transmitting the security key included in the application to the smart card through the secure channel; Method of transmitting the security key of the application to a smart card comprising a. The method of claim 5, wherein step (a) (a1) receiving smart card authentication information which is included in the smart card and is authentication information issued by an authentication authority that distributes the smart card; (a2) receiving application authentication information as authentication information issued by a content provider that has developed the application; And (a3) comparing the smart card authentication information with the IPD (Issuer Privilege Data, hereinafter referred to as 'IPD') included in the application authentication information, and checking whether or not the application to be loaded is legitimate software. Steps to figure out Method of transmitting the security key of the application to a smart card comprising a. The method of claim 5, wherein The application authentication information means APCert (Application Provider Certificate), which is authentication information proving that the application has been developed by a legitimate content provider, and the smart card authentication information distributes the smart card. It means CHCert (Card Holder Certificate) which is authentication information that proves that the smart card is distributed by the authority, and the application authentication information and the smart card authentication information includes an IPD having the same value How to send an application's security key to a smart card. The method of claim 5, wherein The application authentication information and the smart card authentication information include a 'Certificate Format' field, a 'Certificate Serial Number' field, an 'Issuer Public Key Hash Value' field, a 'Subject Public Key Algorithm Identifer' field, and a 'Subject Public Key Algorithm Module Component'. Field, 'Subject Public Key' field, 'Subject Public Key Hash Value' field, 'Issuer Privilege Data' field, 'Extension' field, and 'Signature' field are assigned. How to transfer. If you want to load an application that works with the smart card, the security domain key in the smart card, so that the application can be securely mounted by transmitting to the smart card without exposing the security key included in the application (Security Key) In the mobile communication terminal to initialize the, A memory unit including a real time operating system, a mobile communication terminal call processing S / W, an application and a card manager, and storing a current operation mode of the mobile communication terminal as a status flag; A microprocessor unit for overall control to smoothly transmit / receive data and transmit / receive data in the mobile communication terminal, and control a process of providing the mobile financial service by driving the application and the card manager; And Smart card mounting unit consisting of an integrated chip, the smart card that stores the information required in the process of using the mobile financial service Mobile terminal for initializing the security domain key in the smart card comprising a. The method of claim 9, The card manager determines whether the application is legitimate software, and manages a security domain formed between the smart card and the application, and initializes the security domain key in the smart card. The method of claim 9, The application is a smart card, characterized in that the software includes a security key to enable the use of mobile financial services, and application authentication information, which is authentication information required to verify whether or not the legitimate software in the process of being loaded into the program storage unit. The mobile terminal for initializing the security domain key. The method of claim 9, The application authentication information includes at least one of authentication information for verifying that the application is properly developed by a content provider and authentication information for verifying that the application is legitimate software in the process of interworking with the smart card. The mobile terminal for initializing the security domain key in the smart card. The method of claim 9, The mobile terminal establishes an encrypted communication channel after performing authentication using application authentication information in the process of mounting the application to the program storage unit, and stores the security key of the application through the encrypted communication channel. Mobile communication terminal for initializing the security domain key in the smart card, characterized in that the transmission to the smart card.

Images