KR101900710B1 - Management method of trusted application download, management server, device and system using it - Google Patents

Abstract

The present invention relates to a security application download management method, a secure application download management server, a terminal, and a management system to which the security application download management method, a service loader A service loader (SL), and a service center (SC) managing whether or not the security application download authority is delegated and processing the security application to be downloaded to the terminal when a security application download is requested from the terminal.

Description

Technical Field [0001] The present invention relates to a security application download management method, a secure application download management server, a terminal,

The present invention relates to a security application download management method, a secure application download management server, a terminal, and a management system to which the security application download management method is applied. More particularly, the present invention relates to a secure application download management method, A security application download management method for providing storage location information in which a security application is stored, a security application download management server, a terminal, and a management system to which the secure application download management method is applied.

Recently, the use of high performance portable terminals such as smart phones has been greatly increased. A smart phone is a mobile communication terminal that provides functions such as program operation, data communication and interworking with a PC, and provides advanced functions such as a PC. The smartphone provides a standardized interface and platform for application developers. In addition to being able to freely install and use various application programs desired by general users other than terminal manufacturers or mobile communication service providers, Application programs can be developed and provided.

In addition, according to the activation of the smartphone, application stores where various application programs used in smart phones are traded as applications are appeared, and general users can download desired applications to the smartphone through the application store.

Since these smartphones are supported by open platforms and various network access environments, they are more vulnerable to security threats such as malicious code infections and hacking, leakage of information, charging and terminal malfunctions.

Currently, the security technologies used in smartphones have been mainly developed based on software-based vaccine programs and traffic control technologies on the network. In the case of smartphones, however, there is a high risk that user information is easily exposed through hardware control. The security technology alone can not provide sufficient security.

In particular, a technology for ensuring the reliability of a terminal (hardware) from jail break or rooting with respect to an open platform of a smart phone, a technique for fundamentally preventing execution of malicious code, A technology for encrypting data stored in a terminal to prevent information leakage in connection with data protection, a technique for remotely controlling a terminal in case of loss, and an electronic settlement In order to secure the service, it is necessary to secure payment and safe storage of payment information.

TrustZone technology is a security technology used in systems operating in an open operating system (OS). One central processing unit (CPU) is physically separated into a non-security domain (normal domain) and a secure domain / RTI >

In addition, the security area operates as a security operating system, the application requiring security operates in a security area, the non-security area operates as an open operating system such as Android, Windows 7, etc., Non-secure applications are run in the non-secure area.

In order to apply such trust zone technology, a security application must be securely installed as a security domain. In particular, a platform to which a trust zone technology is applied, a security platform (Trusted Platform), a method of securely downloading a security application as a security domain .

Korean Registered Patent No. 10-0948812 (Mar. 15, 2010), title of the invention: security area management system and management method thereof

SUMMARY OF THE INVENTION The present invention is conceived to solve the problems described above, and it is an object of the present invention to provide a security application download management method, a security application download management server, Terminal, and management system.

According to an aspect of the present invention, a service loader (SL) for creating a data communication channel by accessing a terminal equipped with a security platform (TP; Trusted Platform) There is provided a secure application download management server including a service controller (SC) that processes a security application to be downloaded to a terminal when a security application download is requested from the terminal.

The security application download management server allocates an identification name to the security application, connects the identification name, delegation of the security application download authority, and storage location information of the security application to store the security application in the security application management list .

The security application download management server further includes a security application storage unit for downloading and storing the security application from the security application provider when the download authority for the security application is delegated.

When the download authority to the secure application is delegated, the storage location information of the secure application is the IP address of the secure application storage unit. If the download authority for the secure application is not delegated, the storage location information of the secure application is stored in the IP address Lt; / RTI >

Upon receipt of a security application download request message including an identification name of the security application from the terminal, the service management unit searches the management list to check whether or not the download authority is delegated to the security application corresponding to the identification name, The security application is downloaded to the terminal, and if the download authority is not delegated, the storage location information of the security application can be transmitted to the terminal.

The security application download management server further includes a security application update information storage unit that stores update information of the security application. When the security application included in the security application management list is updated, An update message can be transmitted to the terminal.

The security application download management server further includes a key management unit for generating and managing a root public key. The key management unit generates a root certificate using the root public key and provides the generated root certificate to the terminal, An authentication procedure can be performed.

According to another aspect of the present invention, a security application download management server generates a data communication channel with a security application download management server, transmits a security application download request message including an identification name of a security application to a security application download management server through a communication channel, There is provided a terminal equipped with a security platform (TP) including a management agent for downloading a security application from a download management server and installing the security application in a security area.

According to another aspect of the present invention, there is provided a security platform for creating a data communication channel, transmitting a security application download request message including an identification name of the security application through a communication channel, downloading the security application, And a security application download management server that manages whether a security application download delegation authority is requested and downloads a secure application from the terminal when the secure application is downloaded to the terminal using a communication channel, A secure application download management system is provided.

The security application download management server includes a service loader (SL) for creating a data communication channel by connecting with a terminal, and managing whether the security application download authority is delegated, and when a secure application download is requested from the terminal, And a service controller (SC) that processes the downloaded data to be downloaded.

The security application download management server allocates an identification name of the security application, connects the identification name, whether the download authority is delegated to the security application, and the storage location information of the security application, and stores it in the security application management list .

The security application download management server may further include a security application storage unit for downloading and storing the security application from the security application provider when the download authority for the security application is delegated.

According to another aspect of the present invention, there is provided a method for managing a security application, comprising the steps of: (a) assigning an identification name of a security application in a security application download management server; registering an identification name, (B) establishing a communication channel between a terminal equipped with a security platform (TP) and a security application download management server, (c) transmitting a secure application download request message including an identification name of the secure application from the terminal And (d) the security application download management server confirms whether or not the download authority is delegated to the security application corresponding to the security application corresponding to the identified security application name, and downloads the security application directly to the terminal when the download authority is delegatedAnd, if download authorization is not delegated is provided a security application download management method comprising the step of transmitting the stored location information of the secure application to the device.

The secure application download management method includes the steps of: (e) after the step (d), inquiring the terminal whether the download of the secure application or the storage location information transmission of the secure application is completed; and (f) And terminating the established communication channel.

The security application download management method includes the steps of: when update information of a security application registered with an identification name is received at a secure application download management server after step (a), storing update information and transmitting location information storing update information to the terminal .

According to another aspect of the present invention, there is provided a security application download management method comprising the steps of: (a) receiving a download right of a security application from a secure application providing server in a secure application download management server and downloading a secure application; Registering an identification name for the security application to which the download authority is not delegated, registering the identification name, whether the download authority is delegated, and the storage location information of the security application in the management list, and (c) And receiving and updating the update information from the security application providing server when updated.

The step (c) includes the steps of: (c-1) forming a communication channel between a terminal equipped with a secure platform (TP) and a secure application download management server; (c-2) And (c-3) receiving a security application download request message including the security application download ID from the secure application download management server, and (c-3) The security application is downloaded directly to the terminal, and if the download authority is not delegated, the storage location information of the security application is transmitted to the terminal.

According to another aspect of the present invention, there is provided a method for managing security applications, the method comprising: assigning an identification name of a security application; registering an identification name and security application download delegation authority and storage location information of the security application in a management list; The security application is delegated to the security application corresponding to the identification name of the security application, and if the download authority is delegated, the security application is directly downloaded. If the download authority is not delegated A secure application download management method including the step of transmitting storage location information of a secure application is provided as a recording medium readable by a program and readable by an electronic device.

According to the present invention, the security application download management server is authorized to download the security application from the security application providing server and can download the security application directly to the terminal, and the security application can be collectively managed.

Also, even when the security application download management server is not delegated with the download authority from the secure application providing server, the secure application download management server generates a certificate when the secure application is downloaded to the terminal, thereby enabling the secure application to be downloaded securely have.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a configuration diagram showing an embodiment of a security application download management server according to an aspect of the present invention; FIG.
BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a security platform,
3 is a configuration diagram illustrating an embodiment of a security application download management system according to another aspect of the present invention.
4 is a configuration diagram showing another embodiment of a security application download management system according to another aspect of the present invention;
5 is a view showing an embodiment of the management list stored in the management list storage unit of the security application download management server of the present invention.
FIG. 6 is a flowchart showing an embodiment of a security application download management method according to another aspect of the present invention. FIG.
FIG. 7 is a flowchart illustrating a method for managing security application download when a security application is updated according to another aspect of the present invention. FIG.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that it is not intended to be limited to the particular embodiments of the invention but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

Embodiments of a secure application download management method, a secure application download management server, a terminal, and a management system according to the present invention will be described in detail with reference to the accompanying drawings. In the following description with reference to the accompanying drawings, the same or corresponding components will be denoted by the same reference numerals, and redundant description thereof will be omitted.

1 is a configuration diagram illustrating an embodiment of a security application download management server according to an aspect of the present invention.

1, the secure application download management server 100 includes a service loader (SL) 110, a service controller (SC) 120, a management list A security application storage unit 140, a security application update information storage unit 150, and a key management unit 160. The security application update information storage unit 150,

The service loader unit 110 connects with a terminal equipped with a security platform (TP) to create a data communication channel. The service loader unit 110 is an access point of the security application download management server 100 and generates a data communication channel in cooperation with the management agent of the terminal.

The service management unit 120 manages whether or not the security application download authority is delegated and processes the security application to be downloaded to the terminal when the security application download is requested from the terminal.

The management list storage unit 130 allocates an identification name to the security application, connects the identification name, delegation of security application download authority, and storage location information of the security application and stores it in the security application management list.

5 is a view showing an embodiment of a management list stored in the management list storage unit of the security application download management server of the present invention.

As shown in FIG. 5, an embodiment of the management list includes an identification name (Ap Name) of a security application, storage location information (IP) of a security application, and deligate .

The name of the security application (Ap Name) may be described as the name of the security application providing server or the security application provider.

The storage location information of the security application in the management list can be stored in the security application storage unit when the download authority to the security application is delegated. If the download authority for the security application is not delegated, The address can be stored.

The secure application storage unit 140 may download and store the secure application from the secure application providing server when the download authority for the secure application is delegated to the secure application download management server 100. [

Delegation of download authority to the security application download management server 100 is performed by the security application provider or the security application providing server. When downloading the security application from the terminal, the security application download management server 100 downloads the security application from the secure application providing server and stores the downloaded security application in the secure application storage unit 140 Download.

When receiving a security application download request message including an identification name (Ap Name) of the security application from the terminal, the service management unit 120 searches the management list (refer to FIG. 5) to download the security application corresponding to the identification name If the download authority is delegated after confirming the delegation, the security application can be directly downloaded to the terminal, and if the download authority is not delegated, the storage location information of the security application can be transmitted to the terminal.

The security application update information storage unit 150 stores the security application update information. When the security application included in the security application management list is updated or information about the security application update is received, the security application update information storage unit 150 stores the security application update information in the security application update information storage unit 150 Update information is stored.

When the security application update information is stored in the security application update information storage unit 150, a security application update message including location information of the security application update information storage unit 150 may be transmitted to the terminal.

The service loader unit 110 is connected to the key management unit 160. The key management unit 160 generates a root public key when a security application is provided to the terminal, generates a root certificate using the root public key, To perform the authentication procedure when downloading and installing the security application.

The key management unit 160 not only notifies the security application download management server of downloading a security application stored in the secure application storage unit 140 that has been delegated download authority but also transmits a security application to which the download authority is not delegated through the service loader unit 110 The root public key can be generated and provided to the terminal.

Accordingly, the terminal receives both the certificate provided from the security application providing server and the certificate provided from the secure application download management server and performs the authentication procedure, so that the terminal can securely provide the security application to the terminal.

2 is a block diagram illustrating an exemplary embodiment of a terminal equipped with a security platform according to another aspect of the present invention.

2, a terminal 200 equipped with a security platform (TP) is physically separated into a security area and a non-security area, so that an operating system of a non-security area and an operating system of a security area It is a terminal which is driven differently.

The terminal 200 equipped with the security platform includes a management agent 210, a security area 220, a non-security area 230, and a monitor 240.

The management agent 210 creates a data communication channel with the security application download management server 100 and transmits a secure application download request message including the identification name of the secure application to the secure application download management server 100 through the communication channel Downloads the security application from the security application download management server, and installs the security application in the security area.

The management agent 210 acts as a connection point between the terminal 200 and the security application download management server 100 and functions as a security area when requesting and downloading a security application.

3 is a configuration diagram illustrating an embodiment of a security application download management system according to another aspect of the present invention.

3, the security application download management system includes a security application download management server 100, a terminal 200 equipped with a security platform, and a security application providing server 300, do.

The security application download management server 100 manages whether or not to delegate security application download authority and performs a function of downloading a security application to the terminal 200 by using a communication channel when a security application download is requested from the terminal 200 .

The security application download management server 100 manages whether or not to delegate security application download authority (SL) to the terminal 100 to create a data communication channel, And a service controller (SC) 120 for processing a process of downloading a security application to the terminal 200 when an application download is requested.

The security application download management server 100 assigns an identification name of the security application, connects the identification name, whether the download authority is delegated to the security application, and the storage location information of the security application, and stores it in the security application management list And may further include a storage unit.

The security application download management server 100 may further include a security application storage unit for downloading and storing the security application from the security application provider or the security application providing server when the download authority for the security application is delegated

A terminal 200 equipped with a Trusted Platform (TP) includes a management agent 210. The management agent 210 creates a data communication channel and transmits the data including the identification name of the security application Transmits a security application download request message, downloads a security application, and plays a general role of downloading a security application to be installed in the security area.

The configuration of the security application download management server 100 and the terminal 200 equipped with the security platform has been described in detail with reference to FIGS. 1 and 2, and thus a detailed description thereof will be omitted.

The security application download providing server 300 collects security applications from a plurality of application supply servers (suppliers) and manages them as one server, uploads the security application to the server, downloads a security application stored in the server It manages security applications.

4 is a configuration diagram illustrating another embodiment of a security application download management system according to another aspect of the present invention.

According to the present embodiment, the security application download management system includes a security application download management server 100, a terminal 200 equipped with a security platform, a plurality of security application providing servers 300a and 300b, an application development server 400, And a non-secured application download server 500.

In the terminal 200 equipped with the security platform, the security area and the non-security area are separated, the security application is stored in the security area, and the non-security application is stored in the non-security area.

Accordingly, the security application download management system according to the present embodiment may include a security application download management server 100 and a non-security application download server 500 ).

The path for uploading or downloading the security application to the security application download management server 100 is indicated by "T", and the path for uploading or downloading the non-security application to the non-security application download providing server 500 is " A ".

6 is a flowchart illustrating an exemplary method of managing download of a secure application according to another aspect of the present invention.

6, the security application download management server registers a management list (S610), and forms a communication channel between the secure application download management server and the terminal (S620).

 The security application download management server registers the management list in operation S610, and assigns an identification name of the security application, and displays the list of the identification name, whether the security application download authority is authorized, and the storage location information of the security application.

Upon receipt of the security application download request message from the terminal (S630), the security application download management server determines whether the download authority for the security application requested to be downloaded has been delegated (S640).

If it is determined that the download authority is delegated, the secure application download management server downloads the secure application directly from the secure application download management server (S650). If the download permission is not delegated, the secure application download management server transmits the storage location information of the secure application to the terminal (S660).

Secure Application Download If the data communication between the management server and the terminal is completed, the transmission completion is confirmed (S670) and the data communication channel is terminated.

When the data communication between the management server and the terminal is completed, the confirmation of the transmission completion (S670) can be confirmed by receiving the transmission completion message from the terminal by inquiring of the terminal whether the security application downloading or storage location information transmission of the security application is completed have.

When the security application download management server receives the update information of the security application in which the identification name is registered in the management list, it stores the update information and transmits the location information in which the update information is stored to the terminal.

7 is a flowchart illustrating a security application download management method when a security application is updated according to another aspect of the present invention.

First, according to the present embodiment, the security application download management server is entrusted with the download authority of the security application from the security application providing server and downloads and stores the security application.

7, the security application download management server allocates an identification name to the security application to which the download authority is delegated from the security application providing server and the security application to which the download authority is not delegated, The download authority is delegated and the storage location information of the security application is registered in the management list (S710).

When the security application registered in the management list is updated, the update information is received from the security application providing server and stored (S720). The update information is stored and the storage location information storing the update information is transmitted to the terminal (S730).

The step of storing the update information and storing the update location information to the terminal (S730) includes: forming a communication channel between the terminal and the security application download management server, Upon receipt of the download request message, the security application download management server confirms whether or not the download right is delegated to the security application corresponding to the identified security application name. If download authorization is delegated, the security application download server directly downloads the security application to the terminal And transmits the storage location information of the security application to the terminal when the download authority is not delegated.

According to another aspect of the present invention, there is provided a method for managing security applications, the method comprising: assigning an identification name of a security application; registering an identification name and security application download delegation authority and storage location information of the security application in a management list; The security application is delegated to the security application corresponding to the identification name of the security application, and if the download authority is delegated, the security application is directly downloaded. If the download authority is not delegated A secure application download management method including the step of transmitting storage location information of a secure application may be provided as a recording medium in which a program is recorded and which is readable in an electronic apparatus.

The security application download management method can be created by a program, and the codes and code segments constituting the program can be easily deduced by programmers in the field.

Also, the program of the security application download management method may be stored in an information storage medium (Readable Medium) that can be read by the electronic device, read and executed by the electronic device, and may perform or relay the security application download by delegating the security application to the terminal.

The present invention can be applied to a recording medium on which an application program is recorded, an apparatus for executing an application program, a security application download management server, a terminal, and a management system in the field of managing security application download in a security domain.

100: Security application download management server
110: Service loader unit (SL) 120: Service management unit (SC)
130: Management list storage unit 140: Security application storage unit
150: Security application update information storage unit 160: Key management unit
200: Terminal with security platform
210: Management Agent 220: Security Area
230: Non-security area 240: Monitor
300, 300a, 300b: a security application providing server
400: Application Development Server
500: Non-security application download server

Claims (18)

A service loader (SL) for establishing a data communication channel by connecting to a terminal equipped with a secure platform (TP);
A service controller (SC) managing whether or not the security application download authority is authorized and downloading the security application from the terminal to download the security application to the terminal;
A management list storage unit for assigning an identification name to the security application, connecting the identification name, delegating the security application download authority, and storage location information of the security application and storing the security application in a security application management list; And
And a key management unit for generating and managing a root public key,
The key management unit,
Generates a first certificate using the root public key and provides the first certificate to the terminal,
The terminal comprises:
Wherein the authentication server performs the authentication procedure based on the first certificate provided from the key management unit and the second certificate provided from the secure application providing server.
delete ◈ Claim 3 is abandoned due to the registration fee. The method according to claim 1,
And a security application storage unit for downloading and storing the security application from the security application providing server when a download right for the security application is delegated.
◈ Claim 4 is abandoned due to the registration fee. The method of claim 3,
The storage location information of the security application is an IP address of the security application storage unit when the download authority for the security application is delegated, Is an IP address of an application providing server.
◈ Claim 5 is abandoned due to the registration fee. The method according to claim 1,
Upon receipt of the security application download request message including the identification name of the security application from the terminal, the service management unit searches the management list to check whether the security application corresponding to the identification name is authorized to download, Wherein the secure application download management server downloads the security application to the terminal when the authority is delegated and transmits the storage location information of the secure application to the terminal when the download authority is not delegated.
◈ Claim 6 is abandoned due to the registration fee. The method according to claim 1,
And a security application update information storage unit for storing update information of the security application. When the security application included in the security application management list is updated, a security application update message including location information of the security application update information storage unit And transmits the secure application download management server to the terminal.
delete Security area; And
The security application download management server transmits a security application download request message including an identification name of the security application to the security application download management server through the communication channel, And a management agent downloading the application and installing the application in the secure area,
Wherein the management agent comprises:
Performing an authentication procedure based on a first certificate generated using a luck public key managed by the secure application download management server transmitted from the secure application download management server and a second certificate provided from the secure application provision server A terminal equipped with a security platform (TP) (Trusted Platform).
◈ Claim 9 is abandoned upon payment of registration fee. A secure platform (TP) for transmitting a security application download request message including an identification name of the security application through the communication channel, downloading the security application and installing the secure application in a security area Terminal; And
And a secure application download management server managing whether or not the security application download authority is authorized and downloading the secure application from the terminal when the secure application download request is made,
The security application download management server includes:
A management list storage unit for assigning an identification name to the security application, connecting the identification name, delegating the security application download authority, and storage location information of the security application and storing the security application in a security application management list; And
Generating and managing a root public key, generating a first certificate using the root public key, and providing the first certificate to the terminal,
The terminal comprises:
Wherein the authentication process is performed based on the first certificate provided from the key management unit and the second certificate provided from the security application providing server.
◈ Claim 10 is abandoned due to the registration fee. 10. The method of claim 9,
The security application download management server includes:
A service loader (SL) connected to the terminal to generate a data communication channel; And
And a service controller (SC) managing whether or not the security application download authority is authorized and processing the security application to be downloaded to the terminal when a security application download is requested from the terminal. system.
delete ◈ Claim 12 is abandoned due to registration fee. 10. The method of claim 9,
Wherein the security application download management server further includes a security application storage unit for downloading and storing the security application from the security application provider when the download authority for the security application is delegated.
◈ Claim 13 is abandoned due to registration fee. (a) assigning an identification name of a security application by a security application download management server, registering the identification name, delegating security application download authority, and storing location information of the security application in a management list;
(b) forming a communication channel between the secure application download management server and the secure application download management server by a terminal equipped with a secure platform (TP);
(c) receiving, by the secure application download management server, a secure application download request message including an identification name of the secure application from the terminal;
(d) checking whether the security application corresponding to the security application corresponding to the transmitted security application has been delegated download authority by the security application download management server, and downloading the security application directly to the terminal And transmitting storage location information of the secure application to the terminal if the download authority is not delegated to the terminal; And
(g) generating and managing a root public key by the security application download management server, and generating a first certificate using the root public key and providing the first certificate to the terminal,
The terminal comprises:
Wherein the authentication process is performed based on the first certificate provided from the key management unit and the second certificate provided from the security application providing server.
◈ Claim 14 is abandoned due to registration fee. 14. The method of claim 13,
After the step (d)
(e) inquiring to the terminal whether the secure application downloading or storage location information transmission of the secure application is completed; And
(f) terminating the communication channel formed with the terminal, at the security application download management server.
◈ Claim 15 is abandoned due to registration fee. 15. The method of claim 14,
After the step (a), when the security application download management server receives the update information of the security application in which the distinguished name is registered, the update information is stored, and the location information storing the update information is transmitted to the terminal The method comprising the steps of:
◈ Claim 16 is abandoned due to registration fee. (a) downloading the security application by the management server, downloading the security application from the security application providing server in response to the download authority of the security application;
(b) assigning an identification name to the security application to which the download authority is delegated and the security application to which the download authority is not delegated by the security application download management server, Registering storage location information in a management list;
(c) receiving and storing update information from the secure application providing server when the secure application registered in the management list is updated by the secure application download management server;
(d) receiving, by the security application download management server, a security application download request message including an identification name of the security application from a terminal, whether a download right for a security application corresponding to an identification name of the security application is delegated Downloading the security application directly to the terminal when the download authority is delegated and transmitting storage location information of the secure application to the terminal when the download authority is not delegated; And
(e) generating and managing a root public key by the secure application download management server by the secure application download management server, and generating and providing a first certificate using the root public key to the terminal ≪ / RTI &
The terminal comprises:
Wherein the authentication process is performed based on the first certificate provided from the key management unit and the second certificate provided from the security application providing server.
delete ◈ Claim 18 is abandoned due to registration fee. Assigning an identification name of the security application by the security application download management server, registering the identification name, delegating the security application download authority, and storing location information of the security application in a management list;
When receiving a security application download request message including an identification name of the security application transmitted from a terminal equipped with a security platform (TP) by the security application download management server, Downloading the security application directly if the download authority is delegated; and transmitting the storage location information of the secure application to the terminal if the download authority is not delegated to the terminal; And
Generating and managing a root public key by the security application download management server, and generating and providing a first certificate using the root public key to the terminal,
The terminal comprises:
A security application download management method for executing a secure application download management method for performing an authentication procedure based on a first certificate provided from a key management unit and a second certificate provided from a secure application providing server.

Images