KR20140123353A - Secure message transmission system, apparatus therefor and secure message processing method thereof - Google Patents
Secure message transmission system, apparatus therefor and secure message processing method thereof Download PDFInfo
- Publication number
- KR20140123353A KR20140123353A KR1020130040625A KR20130040625A KR20140123353A KR 20140123353 A KR20140123353 A KR 20140123353A KR 1020130040625 A KR1020130040625 A KR 1020130040625A KR 20130040625 A KR20130040625 A KR 20130040625A KR 20140123353 A KR20140123353 A KR 20140123353A
- Authority
- KR
- South Korea
- Prior art keywords
- message
- security
- terminal device
- secure
- service
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/12—Messaging; Mailboxes; Announcements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Databases & Information Systems (AREA)
- Computer Security & Cryptography (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The present invention relates to a security message transmission system for securely transmitting a message requiring security in a message service using an isolation environment of a terminal device in which a non-security area and a security area are physically separated, an apparatus therefor, and a secure message processing method thereof A message including specific sender information is encrypted using a key generated based on the terminal information of the receiving terminal device, and transmitted to the receiving terminal device And a secure message processing module operating in the secure area, wherein when the received message transmitted from the service device is an encrypted message, the receiving terminal device comprises: a non-secure message processing module operating in the non- , Operated by an insecure operating system A terminal device which decrypts the received message through a security message processing module of a security domain which is physically separated from the non-security area and operates independently by the security operating system, and outputs the decrypted message through the non- Lt; / RTI >
Description
[0001] The present invention relates to a message transmission service, and more particularly, to a message transmission service using a security service in a message service using an isolation environment of a terminal device in which a non-security area operated by a general operating system and a security area operated by a security operating system are physically separated To a security message transmission system for securely transmitting a required message, an apparatus therefor, and a security message processing method therefor.
2. Description of the Related Art A portable terminal device is a terminal device that supports communication functions based on mobility and has been used in a wide variety of fields due to its ease of use and portability. In recent years, such a portable terminal device has been developed in the form of a smart phone equipped with various user functions, thereby providing various convenience and enjoyment.
The smartphone enables easy access to a wide variety of applications that customers want by activating the open market. With its high performance, smartphones can handle many functions that are handled by PCs.
However, since smartphones are based on an open operating system (OS), which is a feature unique to smart phones, with the rapid expansion of the market, there are various security threats due to the use of applications through open communication networks and open markets. For example, smartphones are easily exposed to malicious codes and are vulnerable to hacking such as Lab Attack. In the case of a smartphone infected with malicious code, it may cause excessive battery consumption, excessive charging, personal information and financial information leakage due to continuous network access as well as terminal malfunction. These malicious codes are mainly managed by software through vaccines. On the other hand, in the case of a Lab Attack which corresponds to hacking to read specific information in the internal storage area of the smart phone or to refer to and change the terminal device information, the terminal device which has been subjected to the Lab Attack, Lt; / RTI >
Current security technologies for smart phones to eliminate the security risks described above have been mainly focused on software programs based on S / W and traffic control on the network. However, in the case of smart phones, user information can be easily exposed through hardware control, and conventional S / W-based security technology can not provide sufficient security. In particular, smartphone security technologies are essential for smartphone security, payment, finance, and corporate services such as jailbreak or rooting.
Particularly, recently, as a result of a rapid increase in the number of small payments and electronic commerce using a portable terminal device, information related to settlement, user authentication, etc. is transmitted through a message service such as SMS or MMS. Is often encountered.
Accordingly, security measures for securely transmitting authentication and settlement related important messages among the messages transmitted to the portable terminal device through the message service are required.
A security message transmission system for securely transmitting a message requiring security in a message service using an isolation environment of a terminal device in which a non-security area and a security area are physically separated, an apparatus therefor, and a security message processing method therefor .
In particular, the present invention confirms the sender information of a message transmitted from the source terminal device to the destination terminal device, and the message including the specific sender information is encrypted using a key generated based on the terminal information of the destination terminal device Wherein the receiving terminal device comprises a non-secure message processing module operating in the non-secured area, and a secure message processing module operating in the secure area, wherein when the received message transmitted from the service device is an encrypted message, And decrypting the received message through a security message processing module of a security domain that is physically separated from the non-security area operated by the non-security operating system and operates independently by the security operating system, and transmits the decrypted message to the non- To provide security. A security message transmission system for securely transmitting a message, an apparatus therefor, and a security message processing method thereof.
According to an embodiment of the present invention, a secure message sender management unit registers a specific sender information as a sender of a secure message according to a sender's request for using a secure message service; Receiving a message transmitted from the calling terminal device and transmitting the message to the receiving terminal device, confirming the calling party information of the message, delivering a message including the specific calling party information to the security service module, A message service unit for transmitting a message to a receiving terminal device; And a security service unit for encrypting the message delivered from the message service unit using a key generated based on the terminal information of the reception side terminal device.
Here, the security service unit may receive the terminal information from the receiving-side terminal apparatus according to the request from the receiving-side terminal apparatus, and may generate the key based on the received terminal information.
In addition, as another means for solving the above-mentioned problems, the present invention provides a communication apparatus comprising: a communication unit for sending and receiving a message; A storage unit including a message DB storing a received message received through a communication unit; And a secure message processing module that operates in a secure area, wherein the secure message processing module is physically separated from a non-security area that operates based on a non-security operating system and a security area that operates based on a security operating system, A control unit for decrypting the received message by the security message processing module of the secure area and controlling the unsecure message processing module of the non-secured area to output the decrypted message when the received message is an encrypted message; And an output unit for outputting the decrypted message according to the control of the control unit.
In a terminal device according to an exemplary embodiment of the present invention, a secure message processing module may include an MSISDN (Mobile Station International ISDN Number), an IMEI (International Mobile Equipment Identity), an IMSI (International Mobile Station Identity), a TMSI (Temporary Mobile Subscriber Identity) , MIN (Mobile Identification Number), transmits the extracted terminal information to the service device, requests a key for decrypting the security message, and decrypts the received key from the service device Lt; / RTI >
In addition, as another solution to the above-described problem, the present invention provides a method for receiving a message transmitted from a source terminal device and transmitting the message to a destination terminal device, wherein the message including the specific sender information is A service device for encrypting the encrypted message using a key generated based on terminal information of the receiving terminal device and transmitting the encrypted message to the receiving terminal device; And a secure message processing module that operates in a secure area, wherein the secure message processing module is physically separated from a non-security area that operates based on a non-security operating system and a security area that operates based on a security operating system, And a terminal device for decrypting the received message through the security message processing module of the secure area when the received message is transmitted from the service device and outputting the decrypted message through the unsecured message processing module in the non- And provides a secure message transmission system.
In addition, according to another aspect of the present invention, a service device generates a key for encrypting and decrypting a message for each receiving terminal, and providing a key to the receiving terminal; Registering the specific sender information as a security message transmission service target by the service device; The service device receiving a message from the calling terminal device; Confirming whether the service device is the sender information of the received message or specific sender information registered in the secure message transmission service; Encrypting the received message using a key assigned to the receiving terminal device when the service device is specific sender information; And transmitting the encrypted message to the receiving terminal device by the service device.
In addition, according to another aspect of the present invention, a non-secure message processing module installed in an insecure area based on a non-secure operating system checks a message received by a terminal device; If the received message is an encrypted message, transmitting the message to a security message processing module installed in a security area physically separated from the non-security area and operating based on a security operating system; Decrypting the message by the secure message processing module and transmitting the decrypted message to the non-secured message processing module; And outputting a decrypted message by the non-secured message processing module.
The secure message processing method according to an embodiment of the present invention may further include receiving a key to be used for decrypting a message generated based on the terminal information of the terminal device from the service device.
According to the present invention, among messages transmitted from a source terminal device to a destination terminal device, a message including specific sender information based on sender information is encrypted with a key generated based on the terminal information of the destination terminal device And the receiving terminal device can decrypt the encrypted message with a key generated based on the terminal information through a security area that is physically separated from the non-security area operated by a general operating system and operates based on an independent security operating system Thus, when an enterprise user transmits security-related information related to settlement, user authentication, and the like through a message service, it is possible to securely transmit the origination message of the enterprise to the reception-side terminal device.
In particular, the present invention utilizes an isolation environment of a terminal device in which a non-security area operated by a general operating system and a security area operated by a security operating system are physically separated, so that not only hacking on a network, There is an excellent effect of ensuring the safety of the required message.
1 is a block diagram illustrating a configuration of a security service transmission system according to an embodiment of the present invention.
2 is a block diagram illustrating a configuration of a terminal device according to an embodiment of the present invention.
3 is a block diagram hierarchically illustrating a message processing structure based on an isolation environment in a terminal device according to an embodiment of the present invention.
4 is a block diagram illustrating a configuration of a service apparatus for transmitting a secure message according to an embodiment of the present invention.
5 to 7 are a message flow diagram illustrating a security message processing method according to an embodiment of the present invention.
Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, detailed description of well-known functions or constructions that may obscure the subject matter of the present invention will be omitted. It should be noted that the same constituent elements are denoted by the same reference numerals as possible throughout the drawings.
1 is a block diagram illustrating a configuration of a secure message transmission system according to an embodiment of the present invention.
Referring to FIG. 1, a secure message transmission system according to an embodiment of the present invention may include a
Here, the
On the other hand, the
The
In this system, the
For this, the
At this time, the receiving-
The configuration and operation of the above-described receiving-
FIG. 2 is a block diagram showing a configuration of a terminal device according to an embodiment of the present invention, wherein the terminal device represents the
2, the receiving-
The receiving
First, the
The
The
The
The
The
In particular, the
The
The non-security area and the security area described above can be alternately driven according to the time division. The security area executes processing that requires security in response to a request from the non-security area, for example, authentication, encryption, To the non-security area. In this case, the non-security area can perform the remaining processing of the corresponding function using the returned result value.
The non-security area and the security area mean a control area physically separated from each other. For example, the non-security area and the security area may be implemented through a multi-core technology including two or more microprocessors.
The non-security area and the security area operate independently of each other. The non-security area and the security area operate alternately according to the time division, or the security area may operate according to the call of the non-security area.
The
The non-secured
The secure
Then, the non-secure
Therefore, the message can be confirmed only through the legitimate receiving-
The non-secured
3 is a block diagram hierarchically illustrating a message processing structure based on an isolation environment in a receiving-side terminal apparatus according to an embodiment of the present invention.
3, a receiving
In this case, the
The
FIG. 4 is a block diagram illustrating a configuration of a service apparatus for transmitting a secure message according to an embodiment of the present invention. Referring to FIG. 4, the configuration and operation of a
The
First, the
The
The
That is, the key for encrypting and decrypting the reception-
In addition, the
In addition, the secure message
Here, the sender requesting the secure message service may be an enterprise user using the message service in the processing of electronic commerce, user authentication, payment, and the like. Therefore, after the enterprise user receives the user authentication through the secure message
In addition, the security message
The
5 to 7, a security message processing method in a secure message transmission system according to the present invention will be described with reference to a flow diagram of a message.
FIG. 5 is a message flow diagram illustrating a security message processing method according to an embodiment of the present invention, illustrating a process of performing a security service subscription procedure for a receiving-
5, the user of the receiving
When the security
The security
The security service subscription request is transmitted to and processed by the
The
The
The
The secure
A secure message transmission procedure may be performed for the receiving-
FIG. 6 illustrates a process of transmitting a security message to a receiving
The
Upon receiving the message transmission request, the
If the sender information of the message is the specific sender information requesting the security message service, the
Accordingly, the
The
The message transmitted to the reception-
In step S240, the non-secured
If the received message is an encrypted message, the non-secure
In response to the request, the security
Then, the decrypted message is transmitted to the non-secured
The non-secure
Accordingly, only the receiving-
FIG. 7 is a message flow diagram illustrating a key management process in the secure message processing method according to the embodiment of the present invention.
7, in the receiving-
The first security message processing module 32-1 is installed in a non-security area of the receiving
A key management procedure using the first and second security message processing modules 32-1 and 32-2 will be described with reference to FIG.
Referring to FIG. 7, the first security message module 32-1 of the receiving
The second security message processing module 32-2 receiving the key management request confirms whether a key for decrypting the message exists in the secure area (S310).
If the key exists (S315), the second security message processing module 32-2 transmits the result (response) of the key management request to the first secure message processing module 32-1, , The Null value can be transmitted as the result value (S345).
The first security message processing module 32-1 checks the result of the received key management request, and if it is null, the first security message processing module 32-1 terminates the process (S350).
If it is determined in step S310 that the key does not exist in step S315, the second secure message processing module 32-2 extracts the terminal information of the receiving
In response to the key issuance request, the
The second security message processing module 32-2 may transmit the hash value of the key to the resultant value of the key management request (S345).
The first security message processing module 32-1 checks the key management result value of the second security message processing module 32-2, and if the result value is not Null value (S350) The
Through the above-described processing, the receiving-
The security message processing method according to the present invention can be implemented in software form readable by various computer means and recorded in a computer readable recording medium. Here, the recording medium may include program commands, data files, data structures, and the like, alone or in combination. Program instructions to be recorded on a recording medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. For example, the recording medium may be an optical recording medium such as a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, a compact disk read only memory (CD-ROM), a digital video disk (DVD) Includes a hardware device that is specially configured to store and execute program instructions such as a magneto-optical medium such as a floppy disk and a ROM, a random access memory (RAM), a flash memory, do. Examples of program instructions may include machine language code such as those generated by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like. Such a hardware device may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.
While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, It will be apparent to those skilled in the art. Furthermore, although specific terms are used in this specification and the drawings, they are used in a generic sense only to facilitate the description of the invention and to facilitate understanding of the invention, and are not intended to limit the scope of the invention.
According to the present invention, among messages transmitted from a source terminal device to a destination terminal device, a message including specific sender information based on sender information is encrypted with a key generated based on the terminal information of the destination terminal device The receiving terminal device can decrypt the encrypted message with a key generated based on the terminal information through a security area that is physically separated from the non-security area operated by a general operating system and operates based on an independent security operating system Thus, when an enterprise user transmits security-related information related to settlement, user authentication, and the like through a message service, it is possible to securely transmit the origination message of the enterprise to the reception-side terminal device.
In particular, the present invention utilizes an isolation environment of a terminal device in which a non-security area operated by a general operating system and a security area operated by a security operating system are physically separated, so that not only hacking on a network, There is an excellent effect of ensuring the safety of the required message.
100:
100b: receiving-side terminal apparatus 200: service apparatus
210: message service unit 220: security service unit
300: Network
Claims (8)
Receiving the message transmitted from the calling terminal device and transmitting the message to the receiving terminal device, confirming the calling party information of the message, delivering the message including the specific calling party information to the security service module, A message service unit for transmitting the message to the receiving terminal device; And
And a security service unit for encrypting the message delivered from the message service unit using a key generated based on the terminal information of the receiving terminal device.
Receives the terminal information from the receiving terminal device, and generates the key based on the received terminal information.
A storage unit including a message DB for storing a received message received through the communication unit;
A secure message processing module that physically separates a non-security area operating on a non-security operating system and a security area operating on a security operating system, the secure message processing module operating in the non-security area, and the secure message processing module operating in the secure area Wherein the security message processing module of the secure area decrypts the received message when the received message is an encrypted message, and controls the non-secured message processing module of the non-secured area to output the decrypted message;
And an output unit for outputting the decrypted message under the control of the control unit.
Terminal information including at least one of an MSISDN (Mobile Station International ISDN Number), an International Mobile Equipment Identity (IMEI), an International Mobile Station Identity (IMSI), a Temporary Mobile Subscriber Identity (TMSI), and a Mobile Identification Number (MIN) And transmits the extracted terminal information to the service device, requests a key for decrypting the secure message, and receives a key for decrypting the received message from the service device.
A secure message processing module that physically separates a non-security area operating on a non-security operating system and a security area operating on a security operating system, the secure message processing module operating in the non-security area, and the secure message processing module operating in the secure area Decrypts the received message through the security message processing module of the secure area if the received message is an encrypted message, and outputs the decrypted message through the non-secured message processing module in the non-secured area A secure message transmission system comprising a terminal device.
The service device registering specific sender information as a subject of a secure message transmission service;
The service device receiving a message from a calling terminal device;
Confirming that the service device is the specific sender information registered in the secure message transmission service;
Encrypting the received message using the key assigned to the receiving terminal device when the service device is the specific sender information; And
And the service device transmitting the encrypted message to the receiving terminal device.
When the received message is an encrypted message, transmitting the message to a security message processing module installed in a security area physically separated from the non-security area and operating based on a security operating system;
Decrypting the message by the secure message processing module and transmitting the decrypted message to the non-secured message processing module; And
And the non-secured message processing module outputting the decrypted message.
Further comprising the step of the security message processing module receiving a key to be used for decrypting the message generated based on the terminal information of the terminal device from the service device.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
KR1020130040625A KR20140123353A (en) | 2013-04-12 | 2013-04-12 | Secure message transmission system, apparatus therefor and secure message processing method thereof |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
KR1020130040625A KR20140123353A (en) | 2013-04-12 | 2013-04-12 | Secure message transmission system, apparatus therefor and secure message processing method thereof |
Publications (1)
Publication Number | Publication Date |
---|---|
KR20140123353A true KR20140123353A (en) | 2014-10-22 |
Family
ID=51994089
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
KR1020130040625A KR20140123353A (en) | 2013-04-12 | 2013-04-12 | Secure message transmission system, apparatus therefor and secure message processing method thereof |
Country Status (1)
Country | Link |
---|---|
KR (1) | KR20140123353A (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2017034378A1 (en) * | 2015-08-26 | 2017-03-02 | 주식회사 포제 | Information security device and information security method using accessibility |
KR20180003089A (en) * | 2016-06-30 | 2018-01-09 | (주)에이티솔루션즈 | Method for Providing Server type One Time Password by using Secure Operating System |
US10187359B2 (en) | 2015-02-12 | 2019-01-22 | Samsung Electronics Co., Ltd. | Secure message transmission apparatus and processing method thereof |
-
2013
- 2013-04-12 KR KR1020130040625A patent/KR20140123353A/en not_active Application Discontinuation
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10187359B2 (en) | 2015-02-12 | 2019-01-22 | Samsung Electronics Co., Ltd. | Secure message transmission apparatus and processing method thereof |
WO2017034378A1 (en) * | 2015-08-26 | 2017-03-02 | 주식회사 포제 | Information security device and information security method using accessibility |
KR20180003089A (en) * | 2016-06-30 | 2018-01-09 | (주)에이티솔루션즈 | Method for Providing Server type One Time Password by using Secure Operating System |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Melamed | An active man-in-the-middle attack on bluetooth smart devices | |
Wang et al. | Smartphone security challenges | |
US9344882B2 (en) | Apparatus and methods for preventing information disclosure | |
EP2798777B1 (en) | Method and system for distributed off-line logon using one-time passwords | |
WO2015180691A1 (en) | Key agreement method and device for verification information | |
CN102761870B (en) | Terminal authentication and service authentication method, system and terminal | |
CN113821835B (en) | Key management method, key management device and computing equipment | |
CN204360381U (en) | mobile device | |
US10021562B2 (en) | Mobile trusted module (MTM)-based short message service security system and method thereof | |
WO2017147890A1 (en) | Verification code short message display method and mobile terminal | |
CN113553572B (en) | Resource information acquisition method, device, computer equipment and storage medium | |
Hufstetler et al. | Nfc unlock: Secure two-factor computer authentication using nfc | |
US20160330239A1 (en) | Hacking prevention system for mobile terminal and method therefor | |
US10985921B1 (en) | Systems and methods for out-of-band authenticity verification of mobile applications | |
CN113821821B (en) | Security architecture system, cryptographic operation method of security architecture system and computing device | |
KR20140123353A (en) | Secure message transmission system, apparatus therefor and secure message processing method thereof | |
CN106453398B (en) | A kind of data encryption system and method | |
US9854444B2 (en) | Apparatus and methods for preventing information disclosure | |
KR101329789B1 (en) | Encryption Method of Database of Mobile Communication Device | |
Igor et al. | Security Software Green Head for Mobile Devices Providing Comprehensive Protection from Malware and Illegal Activities of Cyber Criminals. | |
CN108769989B (en) | Wireless network connection method, wireless access device and equipment | |
CN102393886A (en) | Safety control method of mobile terminal, device and system | |
KR101357367B1 (en) | Method and system for managing authentication information using SE | |
Talreja et al. | Sectrans: Enhacing user privacy on android platform | |
CN102780812A (en) | Method and system for achieving safe input by using mobile terminal |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WITN | Withdrawal due to no request for examination |