KR102175408B1 - Digital key service method and system thereof - Google Patents

Abstract

The present invention relates to a digital key system and a method thereof. According to an embodiment of the present invention, a digital key service system comprises: a step of registering a smart terminal in a server; a digital key identifier generation and delivery step of generating, by a locking device, a digital key identifier list and transmitting the digital key identifier list to the server; a digital key certificate issuing and registering step in which the server selects one identifier from the digital key identifier list to which the smart terminal is not assigned, issues a digital key certificate, and transmits the digital key certificate to the smart terminal and the locking device; and a step of using the locking device in the smart terminal through the digital key certificate shared with each other.

Description

Digital key service method and system thereof

The present invention relates to mobile security technology, and more particularly, to a digital key service providing technology using mobile security technology and digital key control technology.

In recent years, as information and communication technology develops, efforts have been made to wirelessly control an unlock target using an application installed in a user terminal.

However, in the case of unlocking the locked device using the user terminal as described above, the security is weak, and thus the risk of theft increases and it is difficult to secure the security of the digital key during the user registration process of the digital key according to the application installation.

Therefore, there is a desperate need for a realistic and applicable digital key technology that enables the security of the digital key to be secured and prevents the possibility of theft even in case of loss.

Republic of Korea Patent Publication No. 10-2017-0078533 (published on July 7, 2017)

The present invention has been devised to solve the problem, and an object thereof is to provide a digital key service method and a system thereof in which security is enhanced based on software security elements and app protection.

A digital key service method according to an embodiment includes the steps of registering a smart terminal with a server, generating and delivering a digital key identifier in which a locking device generates a digital key identifier list and transmits the digital key identifier list to the server, and the server A digital key certificate issuance and registration step in which a digital key certificate is issued by selecting an identifier that is not assigned to a smart terminal from the list of digital key identifiers, and transmitting the digital key certificate to the smart terminal and lock device, and a digital key shared with each other. And using the locking device in the smart terminal through the certificate.

The smart terminal may be a standalone smart terminal capable of connecting to an external Internet by itself, or an interlocked smart terminal capable of connecting to an external Internet through a relay device.

The steps of registering a smart terminal in the server include pre-storing the server's public key in the smart terminal, generating a private key and public key pair to be used by the smart terminal to use the digital key and storing it in a security element, and The terminal encrypts the terminal identifier and public key with the server public key, the smart terminal transmits the encrypted terminal identifier and public key to the server, and the server decrypts the terminal identifier and public key with the server private key. It may include the step of registering the smart terminal.

The step of transmitting the encrypted terminal identifier and public key by the smart terminal to the server includes: if the smart terminal is a standalone smart terminal, directly communicating with the server to transmit the terminal identifier and public key, and the smart terminal interlocking In the case of a smart terminal, it may include transmitting the terminal identifier and public key to the relay device through short-range wireless communication, and after the relay device signs the private key with a private key, transferring the terminal identifier and the public key to the server through a communication network.

In the digital key identifier generation and delivery step, the locking device in which the digital key is not registered generates a digital key identifier list, and when communication becomes possible, the locking device signs information including the digital key identifier list with a private key. After encrypting with the server public key, the method may include transmitting information including a lock device identifier, a digital key identifier list, and a signature to the server.

The step of transmitting the information including the lock device identifier, the digital key identifier list and the signature to the server includes communication equipment in the lock device to directly communicate with the server, communicate with the server through a standalone smart terminal, or an interlocked smart terminal. The interlocked smart terminal communicates through and transmits information to the server by communicating with the server through the interlocking relay device again.

In the digital key certificate issuance and registration step, when the server receives a digital key issuance request from a smart terminal, the digital key private key certificate and digital key public key are selected by selecting an unissued digital key identifier from the stored digital key identifiers. Generating a certificate and transmitting it to the smart terminal, and the smart terminal decrypting the digital key public key certificate from the information provided from the server and storing it in the security element, and temporarily storing the digital key private key certificate as it is encrypted. Wow, when the smart terminal is able to communicate with the locking device, the smart terminal transmits the digital key private key certificate to the locking device, thereby registering the digital key private key certificate in the locking device.

The steps of using the locking device in the smart terminal include: receiving a terminal identifier from the smart terminal by requesting the terminal identifier from the locking device from the smart terminal, and the locking device confirms the digital key registered as the received terminal identifier and prevents reuse. Generating an authentication request including a random value for, and then transmitting the authentication request to the smart terminal, the smart terminal decrypts the information received with the terminal private key and verifies the signature with the digital key public key, random value, command and Encrypting the information including the signature with the digital key public key and transmitting it to the locking device, the locking device decrypts the information received with the digital key private key, and after verifying the random value and signature with the terminal public key, the digital key authority is allowed. It may include performing the command as long as it does.

In each step, the sending side encrypts and transmits the data with the other's public key, the receiving side decrypts the data with its own private key, and the sending side signs the data with its own private key for authentication, and the receiving side signs the data with its own private key. Can be verified with a key.

A digital key system according to another embodiment includes a server that controls digital keys for issuance, sharing, and deletion of digital keys, and manages smart terminals and lock devices equipped with digital keys, and digital keys registered in the server. A smart terminal that uses, shares, and deletes the issued digital key, and a lock device that initially generates a digital key identifier list and delivers it to the server, and locks or unlocks the digital key issued to the smart terminal. Including, the smart terminal is a standalone smart terminal capable of connecting to an external Internet by itself, or an interlocked smart terminal capable of connecting to an external Internet through a relay device.

As described above, the present invention has an effect of providing a digital key service method and a system for enhancing security based on software security elements and app protection.

In addition, the present invention can increase security by collectively managing digital key issuance, sharing, and deletion in the server.

In addition, the present invention may support various communication interfaces as the user terminal includes a standalone smart device capable of supporting the Internet by itself or an interlocked smart device interlocking with a relay device capable of supporting the Internet.

In addition, the present invention has the effect of securing security for a digital key capable of unlocking a locked device by decrypting and storing the encrypted digital key transmitted from the server in a security area using a mobile security environment-based user terminal. There is.

In addition, in the present invention, in the communication between elements constituting a digital system, the sending side encrypts and transmits data with the other's public key, and the receiving side decrypts the data with its own private key, and the sending side has its own signature for authentication. By signing data with the private key of and verifying with the public key of the other party at the receiving end, there is an effect of reinforcing security from the relay device in the communication process of a locking device or an interlocked smart terminal requiring a relay device.

1 is a diagram showing the configuration of a digital key system according to an embodiment of the present invention;
2 is a diagram showing a logical structure of a digital key app (APP) of a smart terminal according to an embodiment of the present invention;
3 is a diagram showing an encryption procedure used in a digital key system according to an embodiment of the present invention;
4 is a diagram showing information managed by a server according to an embodiment of the present invention;
5 is a diagram showing a digital key structure according to an embodiment of the present invention;
6 is a diagram showing a process of issuing, registering and using a digital key according to an embodiment of the present invention;
7 is a diagram illustrating a process of injecting a lock device private key/public key according to an embodiment of the present invention;
8 is a diagram showing a smart terminal registration process according to an embodiment of the present invention;
9 is a diagram showing a digital key identifier generation and server delivery process according to an embodiment of the present invention;
10 is a diagram illustrating a digital key private key/public key certificate issuance/registration process according to an embodiment of the present invention;
11 is a diagram illustrating a flow of a digital key authentication method according to an embodiment of the present invention.

Since the description of the present invention is merely an embodiment for structural or functional description, the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, since the embodiments can be modified in various ways and have various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical idea.

Meanwhile, the meanings of terms described in the present invention should be understood as follows.

Terms such as "first" and "second" are used to distinguish one component from other components, and the scope of rights is not limited by these terms. For example, a first component may be referred to as a second component, and similarly, a second component may be referred to as a first component.

When a component is referred to as being "connected" to another component, it should be understood that although it may be directly connected to the other component, another component may exist in the middle. On the other hand, when it is mentioned that a certain component is "directly connected" to another component, it should be understood that no other component exists in the middle. On the other hand, other expressions describing the relationship between the constituent elements, that is, "between" and "just between" or "neighboring to" and "directly neighboring to" should be interpreted as well.

Singular expressions are to be understood as including plural expressions unless the context clearly indicates otherwise, and terms such as "comprises" or "have" refer to specified features, numbers, steps, actions, components, parts, or It is to be understood that it is intended to designate that a combination exists and does not preclude the presence or addition of one or more other features or numbers, steps, actions, components, parts, or combinations thereof.

In each step, the identification code (for example, a, b, c, etc.) is used for convenience of explanation, and the identification code does not describe the order of each step, and each step has a specific sequence clearly in context. Unless otherwise stated, it may occur differently from the stated order. That is, each of the steps may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the field to which the present invention belongs, unless otherwise defined. Terms defined in a commonly used dictionary should be interpreted as having the meaning of the related technology in context, and cannot be interpreted as having an ideal or excessively formal meaning unless explicitly defined in the present invention.

Hereinafter, embodiments of the present specification will be described with reference to the accompanying drawings. It will be described in detail focusing on the parts necessary to understand the operation and operation according to the present specification. In describing the embodiments of the present specification, descriptions of technical contents that are well known in the technical field to which the present specification pertains and are not directly related to the present specification will be omitted. This is to more clearly convey the gist of the present specification by omitting unnecessary description.

In addition, in describing the constituent elements of the present specification, different reference numerals may be assigned to constituent elements of the same name according to the drawings, and the same reference numerals may be denoted even in different drawings. However, even in such a case, it does not mean that the corresponding component has different functions according to the embodiment, or that it has the same function in different embodiments, and the function of each component is the corresponding embodiment. It should be determined based on the description of each component in

1 is a diagram showing the configuration of a digital key system according to an embodiment of the present invention.

Referring to FIG. 1, the digital key system 1 includes a server 2, a user terminal 3 and a lock device 6, and the user terminal 3 It includes a smart terminal 4, and may further include a relay device (5). The smart terminal 4 may be a mobile smart watch or the like. The relay device 5 may be a mobile communication terminal such as a smart phone capable of Internet.

The digital key service provided by the digital key system 1 is a digital key that can unlock the locking device 6 in a digital key method inside the user terminal 3 including the smart terminal 4. It is provided with, and refers to a service that issues, deletes, uses, and shares digital keys. The digital key system (1) seeks to enhance security based on software security elements (SE) and app protection.

The server 2 provides a basis for issuing, sharing, and remotely deleting digital keys of the user terminal 3 and the locking device 6. To this end, the server 2 manages the user (member), manages the user terminal 3 possessed by the user, manages the identifier/public key of the user terminal 3, and manages the owner of the locking device 6 (for example, , In the case of vehicles, check by the Ministry of Land, Infrastructure and Transport), the identification/private key/public key management of the locking device 6, digital key information management, digital key certificate generation/distribution, etc.

The user terminal 3 registers with the server 2 to securely receive a digital key. In addition, it has the function of using, sharing and deleting the issued digital key, and protects important information and logic through security elements. The user terminal 3 transmits the digital key received from the server 2 to the locking device 6 through communication with the locking device 6 (for example, NFC: Near Field Communication)/BLE: Bluetooth Low Energy). You can register. The user terminal 3 itself can also receive a digital key public key certificate from the server 2 and use the digital key through authentication.

The user terminal 3 generates a terminal private key/public key and stores it in the security element. Further, it relays communication between the server 2 and the locking device 6, and requests the server 2 to share a digital key. The smart terminal 4 may communicate with the locking device 6 through short-range communication such as NFC/BLE/UWB.

The user terminal 3 may include a smart terminal 4 and may include a smart terminal 4 and a relay device 5. In this case, the smart terminal 4 may be a standalone smart terminal or an interlocked smart terminal. The standalone smart terminal has a mobile communication module and can connect to the external Internet by itself. In contrast, the interlocked smart terminal is capable of short-range communication only, and an external Internet connection is possible using the relay device 5.

The locking device 6 is a device that actually performs locking and unlocking with a digital key issued to the user terminal 3. The locking device 6 has a unique identifier (VIN, etc. in the case of a vehicle) for each locking device. The locking device 6 can store the private/public key of the locking device 6 in a hardware secure storage. The locking device 6 initially generates a list of digital key identifiers, transfers them to the server 2, and obtains and stores the digital keys through relay of the user terminal 3. The locking device 6 may perform authentication for function use through NFC/BLE communication at the request of the user terminal 3.

Explaining the communication process between elements, communication (for user authentication and security) is performed between the server <-> relay device/standalone smart terminal/relay device through a communication network (telephone network). Relay device/smart terminal/relay device <-> NFC/BLE communication is performed between locking devices, but UWB is used when distance restrictions are required for BLE communication. Relay devices <-> Interlocked smart terminals use BLE or a communication method provided by the manufacturer.

2 is a diagram showing a logical structure of a digital key app (APP) of a smart terminal according to an embodiment of the present invention.

Referring to FIG. 2, the digital key app of a smart terminal logically includes a UI layer, a UI controller layer, a business layer, an internet interface layer, a short-range communication interface layer, a security interface layer, and a security layer. Business Layer, Internet Interface Layer, and Near Field Communication Interface Layer are classes, and each module is objectified, so it can be reused for each app. The ecurity Interface Layer provides an interface between APP and TA (Secure Channel). The Security Layer operates in the SE environment and provides important data (eg, digital key) management and security logic functions (eg, authentication data generation, verification, encryption/decryption, etc.).

3 is a diagram illustrating an encryption procedure used in a digital key system according to an embodiment of the present invention.

1 and 3, each element constituting the digital key system 1 has an identifier (defined as UUID, etc.), and each has its own private key/public key pair.

The asymmetric key algorithm can be used for mutual secret communication and authentication between the server 2, the user terminal (relay device/smart terminal) 3, the locking device 6, and the digital key. Representative asymmetric key algorithms include RSA and ECC, and a previously agreed algorithm can be used.

Between the communicating elements (A, B), the other party's identifier/public key must be owned. The process of obtaining the identifier/public key of the partner element to be communicated with differs for each element, and will be described later. Element A encrypts data with the public key of element B when communicating with element B, and transmits it, and the receiving side (element B) decrypts the data with its own private key.

Element A signs for authentication with its own private key, and the receiving side (element B) verifies with the public key of the other party (element A). This procedure is to ensure stability by preventing the relay device from stealing or manipulating the corresponding information in the communication process of a locking device or an interlocked smart terminal that requires a relay device in the communication process.

4 is a diagram illustrating information managed by a server according to an embodiment of the present invention.

1 and 4, the server 2 manages user (member) information, user terminal information, lock device information, and digital key information. User (member) information includes identifiers, owned terminals, user information, and the like. The user terminal information includes identifier, public key, and digital key information. The lock device information includes owner, identifier, public key, and digital key information. The digital key information includes identifiers, public keys, interlocking lock devices, interlocking user terminals, usage rights, and expiration date information. When the server 2 transmits the digital key to the user terminal 3 or the locking device 6, the server 2 may generate and transmit a certificate as digital key information.

5 is a diagram showing a digital key structure according to an embodiment of the present invention.

In more detail, (a) of FIG. 5 shows the structure of a digital key private key certificate, and (b) shows the structure of a digital key public key certificate.

1 and 5, a digital key is a certificate (data structure) containing authentication information for use of a function of a locking device. The digital key may be classified into a digital key public key certificate transmitted to the user terminal 3 and a digital key private key certificate transmitted to the locking device 6.

5A, the digital key private key certificate includes a digital key identifier (UUID, etc.), a digital key private key, an identifier/public key of a user terminal (relay device/smart terminal) permitted to use a digital key, It includes permission to use (for example, whether the vehicle is allowed to open or close the door, whether or not to allow starting, etc.), expiration date (start date/end date), server public key signature, and individual required data (optional).

5B, the digital key public key certificate includes a digital key identifier (UUID, etc.), a digital key public key, an identifier/public key of a user terminal (relay device/smart terminal) permitted to use a digital key, It includes permission to use (for example, whether the vehicle is allowed to open or close the door, whether or not to allow starting, etc.), expiration date (start date/end date), server public key signature, and individual required data (optional).

6 is a diagram illustrating a process of issuing, registering, and using a digital key according to an embodiment of the present invention.

Referring to FIG. 6, in a preliminary step, the production line injects 610 a private key/public key into the locking device 6, and processes the user as a member.

Subsequently, the smart terminal 4 transmits the terminal information to the server 2 through a communication network (relay of a previously registered relay device in the case of an interlocked smart terminal), and the server 2 registers the smart terminal 4 ( 620).

Subsequently, the digital key identifier list is generated by the locking device 6, and if there is a relay device 5 or a communication network in the locking device 6, the digital key identifier list is transmitted to the server 2 using the communication network. Do (630).

When a request for issuing a digital key from a member enters the server 2, the server 2 checks whether the lock device is owned, and selects an identifier to which the smart terminal 4 is not assigned from the list of digital key identifiers. Issue and deliver key/public key certificates respectively. At this time, the smart terminal 4 receives the digital key public key certificate from the server 2 and stores it in the security element SE. The locking device 6 receives and registers a digital key private key certificate through a relay of the relay device 5 or a communication network in the locking device 6 (640).

Then, the smart terminal 4 uses the locking device 6 through the digital key certificate shared with each other (650).

7 is a diagram illustrating a process of injecting a lock device private key/public key according to an embodiment of the present invention.

In more detail, (a) of FIG. 7 is a view showing injection in the production stage, and (b) is a view showing injection through a relay device. The injection of the private key/public key of the locking device 6 uses one of two methods: injection at the production stage and injection through a relay device.

Referring to FIG. 7A, the injection in the lock device production step is that the production line 7 injects the identifier/private key/public key into the lock device 6 in the production step. Similarly, the production line 7 stores the same information (identifier/private key/public key) in the DB of the server 2.

Referring to Figure 7 (b), according to the injection process through a relay device (smart phone, key injection device, etc.), in the production stage, the production line 7 is locked devices 6-1, ??, 6 -n), inject the common private key/public key for key injection. There is only one common key for the same type of locking device. At this time, the server public key can also be injected for verification.

The server 2 generates a lock device private key/public key, encrypts it with a common public key, signs it with the server private key, and delivers it to a predetermined lock device (eg, 6-n). The server 2 may transmit the private key/public key of the locking device to the locking device 6-n by using the relay device 8. The locking device 6-n may decrypt the private key/public key of the locking device with a common private key, verify it with the server public key, and then store it. The relay device 8 may be a smart phone, a key injection device, or the like.

8 is a diagram showing a smart terminal registration process according to an embodiment of the present invention.

Referring to FIG. 8, in order to use the digital key in the smart terminal 4, information of the smart terminal 4 must be registered in the server 2 first. The process of registering the smart terminal 4 is classified according to whether the smart terminal 4 is a standalone smart terminal 4-1 or an interlocked smart terminal 4-2.

The public key of the server 2 is pre-stored in a secure application (Trusted Application: TA, hereinafter referred to as'TA') inside the dedicated app of the smart terminal 4 (810). The smart terminal 4 logs in through a dedicated app, generates a private key/public key pair to be used for digital key use in the dedicated app, and stores it in the security element SE (820). TA corresponds to a security area that cannot be directly accessed from the general area, and performs user personal information, decryption of authentication information, OTP and QR code generation, authentication information verification, etc.

Subsequently, in the TA of the smart terminal 4, the identifier/public key of the smart terminal 4 is encrypted with the public key of the server 2 and transmitted (830). The types of data transmission to the server 2 may be classified according to the type of smart terminal. Since the standalone smart terminal 4-1 can independently authenticate and communicate with users through a communication network, it communicates with the server 2 directly through the communication network authentication of the server 2 to provide the identifier/public key of the smart terminal 4 It transmits (830). In contrast, the interlocked smart terminal 4-2 signs the identifier/public key of the smart terminal 4 by signing with a private key in the TA in the relay device (for example, a smart phone registered in the user account) 8 It is transmitted to the server 2 (840).

The server 2 decrypts the identifier/public key of the smart terminal 4 with the server private key and registers the smart terminal 4 (850). When the server 2 communicates with the interlocked smart terminal 4-2, the signature of the relay device 8 is verified to register the smart terminal 4-2. The server 2 stores the information of the smart terminal 4 and links it to a user account.

9 is a diagram illustrating a digital key identifier generation and server delivery process according to an embodiment of the present invention.

Referring to FIG. 9, the purpose of this procedure is: a) the server 2 can properly verify the locking device 6, and b) the locking device 6 is issued and stored later. This is to ensure that the digital key to be issued has been delivered to the correct issuer. If the identifier of the digital key to be injected by the server 2 is not in the list of identifiers in the lock device 6, it can be confirmed that the delivery target is wrong or a malicious attempt to arbitrarily inject the digital key into the lock device.

The locking device 6 in the state in which the digital key is not registered initially generates a digital key identifier list, and when communication becomes possible, the information including the digital key identifier list is signed with a private key and encrypted with a server public key (910).

There are three types of cases where the locking device 6 and the server 2 can communicate, namely, 1) communication with the server is possible due to the presence of communication equipment in the locking device, and 2) communication with the server through a standalone smart terminal. In the case of 3) communication through an interlocked smart terminal, the interlocked smart terminal may communicate with the server through an interlocking relay device again.

Subsequently, the locking device 6 transmits information including a locking device identifier, a list of digital key identifiers, and a signature to the server 2 (920). The server 2 decrypts the received information and verifies the signature, and then stores and manages a list of digital key identifiers existing in the locking device 6 (930). If stored normally, the server 2 responds to the processing result to the locking device 6 (940).

10 is a diagram illustrating a digital key private key/public key certificate issuance/registration process according to an embodiment of the present invention.

The digital key certificate issuance/registration process starts with registration case 1: a request from the lock device owner (1010) and registration case 2: a case where the lock device owner shares the digital key with others (1020). Determination of whether the locked device is the owner or not depends on the policy of the individual service provider. For vehicles, it is necessary to check the Ministry of Land, Infrastructure and Transport.

When a digital key issuance request is received from the smart terminal 4, the server 2 selects a digital key identifier for which a digital key has not yet been issued (not issued) from among the digital key identifiers stored in the previous step, and uses the digital key identifier. The digital key private key/public key certificate is generated and then transmitted to the smart terminal 4 (1030).

The smart terminal 4 decrypts the digital key public key certificate among the information provided from the server 2 and stores it in the security element SE. Then, the digital key private key certificate is temporarily stored in the encrypted state in the smart terminal 4 (1040).

Subsequently, when the smart terminal 4 reaches a point in time when NFC tag or BLE communication with the locking device 6 becomes possible, the smart terminal 4 transmits the digital key private key certificate to the locking device 6 (1050). , The digital key private key certificate is registered in the locking device 6 (1060).

11 is a diagram illustrating a flow of a digital key authentication method according to an embodiment of the present invention.

Referring to FIG. 11, since the registered digital key contains the identifier/public key information of the smart terminal 4, the smart terminal can be verified by the locking device 6. When the locking device 6 requests authentication to the smart terminal 4, it is possible to prevent reuse of the authentication value including a random value. When the smart terminal 4 is verified in the locking device 6, it will be able to execute the command as long as the digital key authority allows.

For example, as shown in FIG. 11, the locking device 6 requests a terminal identifier 1110 from the smart terminal 4, and the smart terminal 4 transmits the terminal identifier to the locking device 6 (1120). Subsequently, the locking device 6 checks the digital key registered as the corresponding terminal identifier, and generates an authentication request including a random value for preventing reuse (1130). Subsequently, the locking device 6 transmits 1140 an authentication request including a random value, a digital key identifier and a signature to the smart terminal 4, and the smart terminal 4 decrypts the information received with the terminal private key and After verifying the signature with the public key (1150), information including a random value, a command, and a signature is encrypted with a digital key public key and then transmitted to the locking device 6 (1160). The locking device 6 decrypts the information received with the digital key private key, verifies the random value and signature with the terminal public key, and then executes the command as long as the digital key authority permits (1170).

In the above, although the present invention has been described with reference to several examples, the present invention is not necessarily limited to these embodiments, even though it has been described that all components constituting the embodiments of the present invention are combined into one or operated in combination. That is, within the scope of the object of the present invention, all the constituent elements may be selectively combined and operated in one or more. In addition, although all the components may be implemented as one independent hardware, a program module that performs some or all functions combined in one or a plurality of hardware by selectively combining some or all of the components. It may be implemented as a computer program having Codes and code segments constituting the computer program may be easily inferred by those skilled in the art. Such a computer program is stored in a computer-readable storage medium, and is read and executed by a computer, thereby implementing an embodiment of the present invention. The computer program storage medium may include a semiconductor recording medium, a magnetic recording medium, an optical recording medium, a carrier wave medium, and the like.

In addition, terms such as "include", "consist of" or "have" described above mean that the corresponding component may be present unless otherwise stated, excluding other components Rather, it should be interpreted as being able to further include other components.

The embodiments described above are examples, and those of ordinary skill in the technical field to which the present specification belongs will be able to make various modifications and variations without departing from the essential characteristics of the present specification. Accordingly, the embodiments disclosed in the present specification are not intended to limit the technical idea of the present specification, but to describe, and the scope of the technical idea of the present specification is not limited by these exemplary embodiments. The scope of protection of the present specification should be interpreted by the claims below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present specification.

Digital key system: 1
Server: 2
User terminal: 3
Smart terminal: 4
Repeater: 5
Lock device: 6

Claims (10)

Registering the smart watch with the server;
A digital key identifier generating and transmitting step of generating a digital key identifier list by the locking device and transmitting the digital key identifier list to a server;
Issuing and registering a digital key certificate in which the server selects one identifier to which a smart watch is not assigned from a list of digital key identifiers, issues a digital key certificate, and transmits the digital key certificate to the smart watch and the lock device; And
Including; using a locking device in a smart watch through a digital key certificate shared with each other,
Digital key certificate issuance and registration steps
When the server receives a digital key issuance request from the smart watch, it selects an unissued digital key identifier from the stored digital key identifiers, generates a digital key private key certificate and a digital key public key certificate with the selected digital key identifier, and sends it to the smart watch. Step to do;
Decrypting the digital key public key certificate from among the information provided by the server and storing the digital key private key certificate in a secure element, and temporarily storing the digital key private key certificate as it is encrypted; And
Registering the digital key private key certificate in the locking device by transmitting the digital key private key certificate to the locking device when the smart watch is able to communicate with the locking device;
Including,
As the smart key registration and authentication method are defined as standalone and interlocked, if the smartwatch can connect to the external Internet on its own, it operates as a standalone smartwatch, and if it is not possible to connect to the external Internet by itself, the smart phone as a relay device is used. A digital key service method, characterized in that it operates as an interlocked smart watch that is connected to the external Internet through.
delete The method of claim 1, wherein registering the smart watch with the server
Pre-storing the public key of the server in the smart watch;
Generating a private key and a public key pair to be used by the smart watch to use the digital key and storing it in a secure element;
Encrypting, by the smart watch, the identifier and public key of the watch with the server public key;
Transmitting, by the smart watch, the encrypted watch identifier and public key to the server; And
Decrypting the identifier and public key of the watch with the server private key, and registering the smart watch;
Digital key service method comprising a.
The method of claim 3, wherein the step of transmitting the encrypted watch identifier and public key by the smart watch to the server
If the smart watch is a standalone smart watch, transmitting an identifier and a public key of the watch by directly communicating with the server; And
If the smart watch is an interlocked smart watch, transferring the watch's identifier and public key to the smart phone through short-range wireless communication, and after the smart phone signs with the private key, transferring the watch's identifier and public key to a server through a communication network;
Digital key service method comprising a.
The method of claim 1, wherein the step of generating and delivering a digital key identifier
Generating a digital key identifier list by a locking device in which the digital key is not registered; And
When the communication is enabled, the locking device signs the information including the digital key identifier list with a private key, encrypts the information including the server public key, and transmits the information including the lock device identifier, the digital key identifier list and the signature to the server;
Digital key service method comprising a.
The method of claim 5, wherein transmitting the information to the server
The communication device in the lock device communicates directly with the server, communicates with the server through a stand-alone smart watch, or communicates through an interlocked smart watch, and the interlocked smart watch communicates with the server through a re-interlocked smart phone. Digital key service method, characterized in that transmitting to the server.
delete The method of claim 1, wherein using the lock device in the smart watch
Receiving, by the locking device, a watch identifier from the smart watch by requesting a watch identifier from the smart watch;
Generating an authentication request including a random value for preventing reuse by checking the digital key registered as the received watch identifier by the locking device, and transmitting the authentication request to the smart watch;
Decrypting, by the smart watch, the information received with the watch private key, verifying the signature with the digital key public key, encrypting information including random values, commands and signatures with the digital key public key, and transmitting the information to the locking device; And
Decrypting, by the locking device, the information received with the digital key private key, verifying the random value and signature with the watch public key, and then executing a command as long as the digital key authority permits;
Digital key service method comprising a.
The method of claim 1,
In each step, the sending side encrypts and transmits the data with the other's public key, the receiving side decrypts the data with its own private key, and the sending side signs the data with its own private key for authentication, and the receiving side signs the data with its own private key. Digital key service method, characterized in that the verification with a key.
A server for controlling digital keys for issuing, sharing, and deleting digital keys, and managing smart watches and lock devices equipped with digital keys;
A smart watch that registers in a server to obtain a digital key and uses, shares and deletes the issued digital key; And
Including; a locking device that initially generates a list of digital key identifiers, delivers them to the server, and locks or unlocks the digital key issued to the smart watch.
As the smart key registration and authentication method are defined as standalone and interlocked, if the smartwatch can connect to the external Internet on its own, it operates as a standalone smartwatch, and if it is not possible to connect to the external Internet by itself, the smart phone as a relay device is used. It operates as an interlocked smart watch connected to the external Internet through
For the issuance and registration of digital key certificates, when the server receives a digital key issuance request from a smart watch, the digital key private key certificate and digital key public key are selected by selecting an unissued digital key identifier from the stored digital key identifiers. Generate a certificate and send it to the smart watch,
Among the information provided by the server, the smart watch decrypts the digital key public key certificate and stores it in a secure element, and temporarily stores the digital key private key certificate as it is encrypted.
A digital key system, characterized in that the digital key private key certificate is registered in the locking device by transmitting the digital key private key certificate to the locking device when the smart watch is able to communicate with the locking device.

Images