TW201911134A - Sharable authentication method of multiple-in-one chip card application program that helps avoid repeated authentication actions in switching among application programs in a multiple-in-one chip card - Google Patents
Sharable authentication method of multiple-in-one chip card application program that helps avoid repeated authentication actions in switching among application programs in a multiple-in-one chip card Download PDFInfo
- Publication number
- TW201911134A TW201911134A TW106125679A TW106125679A TW201911134A TW 201911134 A TW201911134 A TW 201911134A TW 106125679 A TW106125679 A TW 106125679A TW 106125679 A TW106125679 A TW 106125679A TW 201911134 A TW201911134 A TW 201911134A
- Authority
- TW
- Taiwan
- Prior art keywords
- authentication
- application
- sharing
- authentication information
- chip card
- Prior art date
Links
Landscapes
- Storage Device Security (AREA)
Abstract
Description
本發明屬於晶片卡應用領域,特別指建立一個認證共享程式,不需複雜的流程即可達到共享認證的機制,以提供對於多卡合一的晶片卡應用程式共享認證方法。 The invention belongs to the field of wafer card application, and particularly relates to establishing a certification sharing program, which can achieve a shared authentication mechanism without complicated processes, so as to provide a method for sharing authentication of a chip card application for multiple cards.
對於晶片卡應用產品的推出時,有時會面對到新的安全規範套用而必須進行新晶片的搜尋,可能造成需要重新開發晶片卡上的程式(Applet)或者等待廠商完成新規範的認證。而且,隨著技術的提高,未來的產品將可能在晶片卡上載入多個程式,而各個程式間的認證機制可能相同並且使用相同的認證資訊。因此,若各程式都要維持一份認證狀態,那麼持卡人可能在切換程式之間感到交易過程頻繁進行認證。基於上述理由,對於未來晶片卡應用產品的推出,最好能在某種程度上避免掉晶片的重新搜尋以及改善使用者經驗。 For the introduction of chip card applications, sometimes new security specifications are applied and new chips must be searched, which may require the re-development of the applet on the chip card or waiting for the manufacturer to complete the new specification. Moreover, as technology improves, future products will likely load multiple programs on the chip card, and the authentication mechanisms between the programs may be the same and use the same authentication information. Therefore, if each program maintains a certification status, the cardholder may feel that the transaction process is frequently authenticated between switching programs. For the above reasons, it is better to avoid the re-searching of the wafer and improve the user experience to some extent for the future launch of the wafer card application.
習知專利US20040088562提供一種「智慧卡認證框架」(Authentication frarnework for smart cards),該習知專利介紹在晶片卡內設置有CAA(卡片應用程式)、APA(認證方針Applet)及ATA(認證技術Applet)。該習知專利在ATA中只包含用於認證使用的演算法,而且在與終端程式的 交易過程較為複雜(終端程式在交易過程需與CAA、APA及ATA進行指令交換),所以操作上甚為困難,不易普及。 The conventional patent US20040088562 provides an "Authentication frarnework for smart cards", which is provided with a CAA (card application), an APA (certification policy applet) and an ATA (authentication technology applet) in the wafer card. ). The conventional patent only includes an algorithm for authentication use in the ATA, and the transaction process with the terminal program is complicated (the terminal program needs to exchange instructions with the CAA, APA, and ATA in the transaction process), so the operation is Difficult and difficult to popularize.
另一習知專利EP1431862提供「安全認證的統一框架」(Uniform framework for security tokens),該專利是希望能夠解決晶片卡內程式重新下載後,能夠無需再重新進行初始化、個人化等動作,故而利用共享介面(Sharable Interface)方式將各個程式內的各種資訊全數轉存於另一個共同的程式。當各程式有機會被重新下載後,即可保證先前的資訊不需被重新由外界輸入。不過該習知專利無法在不更動晶片卡內程式之架構下提供一個各程式可存取的共同認證機制,無法提供多卡合一的晶片卡應用程式共享認證方法 Another conventional patent, EP1431862, provides a "Uniform framework for security tokens", which is intended to solve the problem of re-downloading, re-initialization, personalization, etc. after the chip card program is re-downloaded. The Sharable Interface method dumps all the information in each program to another common program. When each program has a chance to be re-downloaded, it can be guaranteed that the previous information does not need to be re-inputted. However, the conventional patent cannot provide a common authentication mechanism that can be accessed by each program without changing the program of the chip card, and cannot provide a multi-card wafer card application sharing authentication method.
由此觀之,習知技術仍然存有缺失當未解決,而亟待業界加以改進。 From this point of view, there are still some shortcomings in the prior art that are unresolved and urgently needed to be improved by the industry.
本案發明人基於在業界多年的實務經驗,經由集思廣益與對未來需求的展望,經由長期的研發與實作,終於能完成本件多卡合一的晶片卡應用程式共享認證方法。 Based on years of practical experience in the industry, the inventor of this project has finally completed the multi-card integrated chip card application sharing authentication method through long-term research and development and implementation through the brainstorming and prospects for future demand.
本發明的主要目的在於提供一種多卡合一的晶片卡應用程式共享認證方法,其建立一個認證共享程式(Applet),提供其它應用程式密碼函式的服務,並且儲存各應用程式皆能存取之共同認證資訊,對於多卡合一應用,可避免重複的相同認證程序。 The main purpose of the present invention is to provide a multi-card integrated chip card application sharing authentication method, which establishes an authentication sharing program (Applet), provides other application cryptographic functions, and can store various applications. The common certification information, for multi-card integration applications, can avoid duplicates of the same certification process.
本發明的另一目的在於提供一種多卡合一的晶片卡應用程 式共享認證方法,其透過共享介面機制,讓認證共享程式能提供密碼函式給其它應用程式使用。 Another object of the present invention is to provide a multi-card chip card application sharing authentication method, which allows a certificate sharing program to provide a cryptographic function to other applications through a sharing interface mechanism.
發明的再一目的在於提供一種多卡合一的晶片卡應用程式共享認證方法,其透過共享介面機制,透過雙向存取的開放,讓其它應用程式能夠存取共同認證資訊的狀態,而認證共享程式也能夠主動更新各應用程式所保存之共同認證資訊現有狀態。 A further object of the invention is to provide a multi-card chip card application sharing authentication method, which enables other applications to access the state of the common authentication information through the shared interface mechanism through the opening of the two-way access, and the authentication sharing The program can also actively update the existing status of the common authentication information saved by each application.
發明的下一目的在於提供一種多卡合一的晶片卡應用程式共享認證方法,其操作時不會影響各應用程式保有自己私有的認證資訊、金鑰等,可以得到更為彈性的使用。 The next object of the invention is to provide a multi-card chip card application sharing authentication method, which does not affect each application's own proprietary authentication information, keys, etc., and can be more flexibly used.
可達成前述目的的本案架構,是利用JAVA卡提供之共享介面功能,透過建立一個認證共享程式來提供晶片卡內部其它各應用程式的1)密碼函式的共享;以及2)共享認證的機制。 The framework for achieving the above purposes is to use the shared interface function provided by the JAVA card to provide 1) cryptographic sharing of other applications within the chip card by establishing an authentication sharing program; and 2) a mechanism for sharing authentication.
現行晶片卡安全規範(如FIPS、CC)的要求愈來愈嚴格,若所要求的密碼演算法無法由所在的平台(Platform)提供,則透過密碼函式的共享機制建立一個含密碼函式的認證共享程式,以避免各應用程式的開發商需要額外花費開發成本於密碼學的鑽研。 The requirements for current chip card security specifications (such as FIPS, CC) are becoming more and more strict. If the required cryptographic algorithm cannot be provided by the platform (Platform), a cryptographic function is established through the cryptographic function sharing mechanism. Certified sharing programs to avoid the need for developers of each application to spend additional development costs on cryptography.
另外,多卡合一在JAVA晶片卡上已普及,各應用程式可能會有共享認證結果的可能性,透過共享認證機制,各應用程式間若有透過共享介面來使用彼此功能時,則只需要透過共享認證機制,可免除頻繁不必要的重覆認證。 In addition, multi-card integration has become popular on JAVA chip cards, and each application may have the possibility of sharing authentication results. Through the shared authentication mechanism, if each application uses mutual functions through the shared interface, then only Through the shared authentication mechanism, frequent and unnecessary re-authentication can be eliminated.
因此,本發明多卡合一的晶片卡應用程式共享認證方法,是在JAVA晶片卡中,建立一個認證共享程式,該認證共享程式除了提供一 個空間供共同認證資訊的儲存外,也提供密碼函式的服務,以上功效的達成,是透過JAVA卡平台所賦與之共享介面機制來達成。 Therefore, the multi-integrated chip card application sharing authentication method of the present invention establishes an authentication sharing program in the JAVA chip card, and the authentication sharing program provides a password in addition to providing a space for the storage of the common authentication information. The service of the above-mentioned functions is achieved through the sharing interface mechanism assigned by the JAVA card platform.
在密碼函式的服務上,認證共享程式透過共享介面開放密碼函式供應用程式呼叫。在共同認證資訊的共享上,認證共享程式透過共享介面開放共同認證資訊的存取方式給應用程式,應用程式將儲存讀取到之共同認證資訊儲存為共同認證資訊複本,必要時也會將認證資訊狀態寫回認證共享程式。 In the cryptographic service, the authentication sharing program calls through the shared interface open cryptographic application. In the sharing of the common authentication information, the authentication sharing program opens the application for accessing the common authentication information through the sharing interface, and the application stores the shared authentication information stored and stored as a copy of the common authentication information, and if necessary, the authentication. The status of the information is written back to the authentication share program.
另外,應用程式也透過共享介面開放存取方式供認證共享程式即時更新自己所儲存的共同認證資訊複本,以確保各應用程式在共同認證資訊的狀態維持一致性。應用程式也能夠不使用認證共享程式內的共同認證資訊,只使用自己本身定義之認證資訊。 In addition, the application also uses the shared interface open access method for the authentication sharing program to instantly update the copy of the common authentication information stored by the application to ensure that the application maintains consistency in the state of the common authentication information. The application can also use the authentication information defined by itself without using the common authentication information in the authentication sharing program.
711-716、721-722、731-733‧‧‧步驟 711-716, 721-722, 731-733‧‧‧ steps
1‧‧‧應用程式 1‧‧‧Application
11‧‧‧共同認證資訊複本 11‧‧‧ Co-certification information copy
111‧‧‧認證資訊種類及編號 111‧‧‧Certified information type and number
112‧‧‧認證狀態 112‧‧‧Certification status
113‧‧‧認證資訊生命週期 113‧‧‧Certified Information Life Cycle
114‧‧‧解鎖資訊種類及編號 114‧‧‧Unlock information type and number
15‧‧‧非揮發性記憶體 15‧‧‧Non-volatile memory
16‧‧‧揮發性記憶體 16‧‧‧ volatile memory
2‧‧‧認證共享程式 2‧‧‧Authorized sharing program
21‧‧‧共同認證資訊 21‧‧‧Common certification information
211‧‧‧認證資訊種類及編號 211‧‧‧Certified information type and number
212‧‧‧認證狀態 212‧‧‧Certification status
213‧‧‧認證資訊生命週期 213‧‧‧Certified Information Life Cycle
214‧‧‧解鎖資訊種類及編號 214‧‧‧Unlock information type and number
215‧‧‧可存取之應用程式ID 215‧‧‧Accessible application ID
216‧‧‧認證狀態 216‧‧‧Certification status
25‧‧‧非揮發性記憶體 25‧‧‧ Non-volatile memory
26‧‧‧揮發性記憶體 26‧‧‧ volatile memory
22‧‧‧密碼函式 22‧‧‧Cryptographic
3‧‧‧JAVA卡平台 3‧‧‧JAVA card platform
31‧‧‧共享介面 31‧‧‧Shared interface
圖1為本發明的在JAVA晶片卡內之架構示意圖;圖2為本發明的認證共享程式之共同認證資訊示意圖;圖3為本發明的共同認證資訊複本示意圖;圖4為本發明的認證資訊生命週期之內容示意圖;圖5為本發明的詳細架構圖;圖6為本發明的應用程式透過共享介面呼叫認證共享程式的示意圖;圖7為本發明的應用程式進行共同認證資訊同步的流程圖;圖8為本發明的認證共享程式進行共同認證資訊同步的流程圖;以及 圖9為本發明的應用程式進行共同認證資訊認證的流程圖。 1 is a schematic diagram of the architecture of the JAVA chip card in the present invention; FIG. 2 is a schematic diagram of the common authentication information of the authentication sharing program of the present invention; FIG. 3 is a schematic diagram of the common authentication information replica of the present invention; FIG. 5 is a detailed structural diagram of the present invention; FIG. 6 is a schematic diagram of an application sharing authentication program through a shared interface according to the present invention; FIG. 7 is a flowchart of a common authentication information synchronization of an application of the present invention. FIG. 8 is a flowchart of the common authentication information synchronization performed by the authentication sharing program of the present invention; and FIG. 9 is a flowchart of the mutual authentication information authentication performed by the application of the present invention.
以下將描述具體之實施例以說明本發明之實施態樣,惟其並非用以限制本發明所欲保護之範疇。 The specific embodiments are described below to illustrate the embodiments of the invention, but are not intended to limit the scope of the invention.
請參閱圖1所示,本發明在JAVA晶片卡中,建立一個認證共享程式2,該認證共享程式2除了提供一個空間作為共同認證資訊21的儲存外,也提供密碼函式22的服務。 Referring to FIG. 1, the present invention establishes an authentication sharing program 2 in a JAVA chip card. In addition to providing a space for storing the common authentication information 21, the authentication sharing program 2 also provides a service of the cryptographic function 22.
本發明功效的達成,是透過JAVA卡平台3所賦與之共享介面(Sharable Interface)31機制來成;在該密碼函式22的服務上,該認證共享程式2透過該共享介面31開放該密碼函式22供應用程式1呼叫;在該共同認證資訊21的共享上,該認證共享程式2透過該共享介面31開放該共同認證資訊21的存取方式給該應用程式1,該應用程式1將儲存讀取到之該共同認證資訊21儲存為共同認證資訊複本11,必要時也會將認證資訊狀態寫回該認證共享程式2。 The effect of the present invention is achieved by the sharing interface (Sharable Interface) 31 assigned by the JAVA card platform 3; in the service of the cryptographic function 22, the authentication sharing program 2 opens the password through the sharing interface 31. The function 22 is called by the application 1; on the sharing of the common authentication information 21, the authentication sharing program 2 opens the access mode of the common authentication information 21 to the application 1 through the sharing interface 31, and the application 1 will The common authentication information 21 stored and stored is stored as a common authentication information replica 11 and, if necessary, the authentication information status is also written back to the authentication sharing program 2.
另外,該應用程式1也透過該共享介面31開放存取方式供該認證共享程式2即時更新自己所儲存的該共同認證資訊複本11,以確保各應用程式1在該共同認證資訊複本11的狀態維持一致性;該應用程式1也能夠不使用該認證共享程式2內的該共同認證資訊21,只使用自己本身定義之認證資訊。 In addition, the application 1 also uses the shared interface 31 to open the access mode for the authentication sharing program 2 to instantly update the shared authentication information replica 11 stored by the authentication sharing program 2 to ensure that each application 1 is in the state of the common authentication information replica 11 The consistency is maintained; the application 1 can also use the common authentication information 21 in the authentication sharing program 2, and only use the authentication information defined by itself.
進一步根據圖1說明本發明之架構示意圖,係包括如下三個組件: The schematic diagram of the architecture of the present invention is further illustrated in accordance with FIG. 1, which includes the following three components:
a)JAVA卡(JAVA Card)平台3 a) JAVA Card (JAVA Card) platform 3
為多卡合一的晶片卡平台,該JAVA卡平台3讓安裝在晶片卡上之應用程式可使用該平台提供的服務,進而開發出更多的應用服務;該JAVA卡平台3亦提供該共享介面31機制,供不同應用程式之間相互使用開放的服務; For the multi-card integrated chip card platform, the JAVA card platform 3 allows the application installed on the chip card to use the services provided by the platform to develop more application services; the JAVA card platform 3 also provides the sharing. Interface 31 mechanism for open services between different applications;
b)應用程式1 b) Application 1
基於JAVA卡平台3而開發出的應用程式(Applet)1,提供持卡人多樣的應用服務,在使用共享認證機制時,於應用程式內維護所需的該共同認證資訊複本11;當該應用程式1被啟動時,應與該認證共享程式2同步該共同認證資訊21,此後參考自身所維護的該共同認證資訊複本11即可(該應用程式1必須透過該共享介面31開放該共同認證資訊複本11的存取給該認證共享程式2,該認證共享程式2會在該共同認證資訊21被其它該應用程式1變更時,自動透過該共享介面31更新該應用程式1內的該共同認證資訊複本11); An application (Applet) 1 developed based on the JAVA card platform 3 provides cardholders with various application services, and maintains the common authentication information replica 11 in the application when the shared authentication mechanism is used; when the application When the program 1 is started, the common authentication information 21 should be synchronized with the authentication sharing program 2, and then the common authentication information replica 11 maintained by itself can be referred to (the application 1 must open the common authentication information through the sharing interface 31). The access of the replica 11 is given to the authentication sharing program 2, and the authentication sharing program 2 automatically updates the common authentication information in the application 1 through the sharing interface 31 when the common authentication information 21 is changed by the other application 1. Duplicate 11);
c)認證共享程式2 c) Authentication sharing program 2
是在JAVA卡平台3上的一個程式,實作了該密碼函式22並且提供了該共同認證資訊21的儲存;透過該共享介面31機制,提供該密碼函式22及該共同認證資訊21的存取給該應用程式1;當該共同認證資訊21被變更時,該認證共享程式2會主動更新各個應用程式1內所存的該共同認證資訊複本11。 Is a program on the JAVA card platform 3, the cryptographic function 22 is implemented and the storage of the common authentication information 21 is provided; and the cryptographic function 22 and the common authentication information 21 are provided through the sharing interface 31 mechanism. The application 1 is accessed; when the common authentication information 21 is changed, the authentication sharing program 2 actively updates the common authentication information replica 11 stored in each application 1.
本發明在該共同認證資訊21的共享上,該認證共享程式2的管理者可進行該共同認證資訊21之變更,例如新增一筆認證資訊或者修 改認證資訊內容;該應用程式1的管理者可進行認證資訊種類及編號111的新增及修改用以指定要參考的該共同認證資訊21。 In the sharing of the common authentication information 21, the administrator of the authentication sharing program 2 can perform the change of the common authentication information 21, for example, adding a new authentication information or modifying the authentication information content; the administrator of the application 1 can The addition and modification of the authentication information type and number 111 are performed to specify the common authentication information 21 to be referred to.
在該應用程式1進行該共同認證資訊21的同步上,當該應用程式1被啟動時,首先透過該共享介面31呼叫該認證共享程式2的API來要求讀取指定的該共同認證資訊21;若該認證共享程式2判斷該應用程式1可讀取指定之該共同認證資訊21,則回傳該指定該共同認證資訊21部份內容,否則回傳錯誤訊息。 When the application 1 performs the synchronization of the common authentication information 21, when the application 1 is started, first calling the API of the authentication sharing program 2 through the sharing interface 31 to request to read the specified common authentication information 21; If the authentication sharing program 2 determines that the application 1 can read the specified common authentication information 21, then the partial content of the specified common authentication information 21 is returned, otherwise the error message is returned.
在該認證共享程式2進行該共同認證資訊21的同步上,當該共同認證資訊21內容有異動,該認證共享程式2從該共同認證資訊21中取得各個可讀取該資訊的應用程式1,並透過該共享介面31呼叫該應用程式1的API來要求變更儲存在該應用程式1內之該共同認證資訊複本11。 When the authentication sharing program 2 performs synchronization of the common authentication information 21, when the content of the common authentication information 21 is changed, the authentication sharing program 2 obtains, from the common authentication information 21, each application 1 that can read the information. And calling the API of the application 1 through the sharing interface 31 to request to change the common authentication information replica 11 stored in the application 1.
請配合圖3所示,在該應用程式1進行該共同認證資訊21的驗證上,當該應用程式1取得持卡人之認證資訊需要進行認證時,該應用程式1首先依據所指定的該認證資訊種類及編號111來檢視相對應的該認證狀態112以確認持卡人是否已通過認證;若已通過認證,則應用程式1繼續提供服務;若尚未通過認證,該應用程式1透過該共享介面3呼叫該認證共享程式2的API來要求執行認證資訊的驗證(交付認證資訊供該認證共享程式2進行);若該認證共享程式2判斷該應用程式1可執行指定的該共同認證資訊21之驗證,則回傳該認證資訊的驗證結果,否則回傳錯誤訊息。 Please cooperate with FIG. 3, in the verification of the common authentication information 21 by the application 1, when the application 1 obtains the cardholder's authentication information and needs to be authenticated, the application 1 firstly according to the specified authentication. The information type and number 111 is used to check the corresponding authentication status 112 to confirm whether the cardholder has passed the authentication; if the authentication has passed, the application 1 continues to provide the service; if the authentication has not been passed, the application 1 passes the sharing interface. 3 calling the API of the authentication sharing program 2 to request verification of the authentication information (delivering the authentication information for the authentication sharing program 2); if the authentication sharing program 2 determines that the application 1 can execute the specified common authentication information 21 If the verification is performed, the verification result of the authentication information is returned, otherwise the error message is returned.
請參閱圖2所示是本發明一例中認證該共享程式2之該共同認證資訊21示意圖;該共同認證資訊21內含多筆用於認證使用之金鑰或 PIN碼,每一筆都是認證資訊種類及編號211、認證資訊內容212、認證資訊生命週期213、解鎖資訊種類及編號214、可存取之應用程式ID 215及認證狀態216所組成;其中除了該認證狀態216是儲存在揮發性記憶體26外,其餘皆儲存於非揮發性記憶體25;儲存在該揮發性記憶體26之內容,在晶片卡被重置後將被清除;該認證資訊種類及編號211用以記載認證資訊為何種金鑰或PIN碼以及編號;該認證資訊內容212為該認證資訊之金鑰值或PIN碼值;該認證資訊生命週期213則是記載該筆認證資訊是否存在、鎖定或正常以及次數的資訊;該解鎖資訊種類及編號214用以記載解鎖該認證資訊之金鑰種類及編號;該可存取之應用程式ID 215記載那些該應用程式1可存取該筆認證資訊;該認證狀態216則表示目前持卡人是否已通過該筆認證資訊;其中,該認證資訊種類及編號211是各筆認證資訊的唯一識別碼;儲存在該非揮發性記憶體25之內容,是在該認證共享程式2進行個人化或其它動作時被寫入或修改。 Please refer to FIG. 2, which is a schematic diagram of the common authentication information 21 for authenticating the shared program 2 in an example of the present invention; the common authentication information 21 includes a plurality of keys or PIN codes for authentication, each of which is authentication information. The category and number 211, the authentication information content 212, the authentication information life cycle 213, the unlocking information type and number 214, the accessible application ID 215, and the authentication status 216; wherein the authentication status 216 is stored in the volatile memory The body 26 is stored in the non-volatile memory 25; the contents stored in the volatile memory 26 are cleared after the wafer card is reset; the authentication information type and number 211 is used to record the authentication information. a key or a PIN code and a number; the authentication information content 212 is a key value or a PIN code value of the authentication information; the authentication information life cycle 213 is information indicating whether the authentication information exists, locked or normal, and the number of times The unlocking information type and number 214 is used to record the type and number of keys for unlocking the authentication information; the accessible application ID 215 records those applications 1 Accessing the authentication information; the authentication status 216 indicates whether the current cardholder has passed the authentication information; wherein the authentication information type and number 211 is a unique identification code of each authentication information; stored in the non-volatile memory The content of the body 25 is written or modified when the authentication sharing program 2 performs personalization or other actions.
請參閱圖3所示是本發明一例中該應用程式1之該共同認證資訊複本11示意圖;該共同認證資訊複本11內含多筆用於認證使用之金鑰或PIN碼,每一筆都是認證資訊種類及編號111、認證狀態112、認證資訊生命週期113及解鎖資訊種類及編號114所組成;其中除了該認證資訊種類及編號111是儲存在非揮發性記憶體15,其餘皆儲存於揮發性記憶體16;儲存在該揮發性記憶體16之內容,在晶片卡被重置後將被清除;該認證資訊種類及編號111用以記載認證資訊為何種金鑰或PIN碼及編號,該內容是在該應用程式1進行個人化或其它動作時被寫入或修改;該認證狀態112則表示目前持卡人是否已通過該筆認證資訊;該認證資訊生命週期113則 是記載該筆認證資訊是否存在、鎖定或正常以及次數的資訊;該解鎖資訊種類及編號114用以記載解鎖該認證資訊之金鑰種類及編號;其中,該認證資訊種類及編號111是各筆認證資訊的唯一識別碼。 Please refer to FIG. 3, which is a schematic diagram of the common authentication information replica 11 of the application 1 in an example of the present invention; the common authentication information replica 11 includes a plurality of keys or PIN codes for authentication, each of which is authenticated. The information type and number 111, the authentication status 112, the authentication information life cycle 113, and the unlocking information type and number 114 are composed; wherein the authentication information type and number 111 are stored in the non-volatile memory 15, and the rest are stored in the volatile The memory 16 is stored in the volatile memory 16 and is cleared after the wafer card is reset. The authentication information type and number 111 is used to record the key or PIN code and number of the authentication information. Is written or modified when the application 1 performs personalization or other actions; the authentication status 112 indicates whether the current cardholder has passed the authentication information; the authentication information life cycle 113 records the authentication information. Whether the information is present, locked or normal, and the number of times; the unlocking information type and number 114 is used to record the type and number of the key for unlocking the authentication information; Certification information types and number 111 is a unique identifier for each pen authentication information.
請參閱圖4所示是認證資訊生命週期113及213之內容,內容記載該筆認證資訊是否存在、鎖定或正常,以及認證失敗次數等資訊;當已達最多失敗次數,該認證共享程式2將修改該認證資訊生命週期213,並且透過該共享介面31更新在其它該應用程式1內的該認證資訊生命週期113。 Please refer to FIG. 4, which is the content of the authentication information life cycle 113 and 213. The content records whether the authentication information exists, is locked or normal, and the number of authentication failures; when the maximum number of failures has been reached, the authentication sharing program 2 will The authentication information life cycle 213 is modified, and the authentication information life cycle 113 in the other application 1 is updated through the sharing interface 31.
請參閱圖5所示是本發明之詳細架構圖;該應用程式1透過該共享介面31開放該共同認證資訊複本11之存取權供該認證共享程式2修改該認證狀態112、該認證資訊生命週期113及該解鎖資訊種類及編號114;該認證共享程式2透過該共享介面31開放該共同認證資訊21之存取權供該應用程式1讀取該認證狀態212、該認證資訊生命週期213及該解鎖資訊種類及編號214,該開放認證資訊內容213比對供該應用程式1將自持卡人取得之認證資訊進行驗證。 Please refer to FIG. 5 , which is a detailed structural diagram of the present invention. The application 1 opens the access rights of the common authentication information replica 11 through the sharing interface 31 for the authentication sharing program 2 to modify the authentication state 112 and the authentication information life. a period 113 and the unlocking information type and number 114; the authentication sharing program 2 opens the access right of the common authentication information 21 through the sharing interface 31 for the application 1 to read the authentication status 212, the authentication information life cycle 213, and The unlocking information type and number 214, the open authentication information content 213 is compared with the authentication information obtained by the application 1 for the self-sustaining card holder.
請參閱圖6所示,在該密碼函式22的共享下,該應用程式1透過該共享介面31呼叫該認證共享程式2的密碼函式;該應用程式1將計算資訊傳送給該認證共享程式2,待該認證共享程式2計算完畢後的結果再傳回該應用程式1。 Referring to FIG. 6, under the sharing of the cryptographic function 22, the application 1 calls the cryptographic function of the authentication sharing program 2 through the sharing interface 31; the application 1 transmits the computing information to the authentication sharing program. 2. After the calculation of the authentication sharing program 2 is completed, the result is transmitted back to the application 1.
請參閱圖7所示是該應用程式1進行該共同認證資訊21同步的流程;在步驟711,當該應用程式1被啟動時,該應用程式1依據認證資訊種類及編號211透過該共享介面31向該認證共享程式2要求讀取相對 應的認證狀態216、該認證資訊生命週期213及該解鎖資訊種類及編號214;在步驟712,該認證共享程式2確認該應用程式1之ID是否存在於該可存取之應用程式ID 215列表中:在步驟713,若該認證共享程式2判定該應用程式1可讀取指定之該共同認證資訊21則回傳該認證狀態216、該認證資訊生命週期213及該解鎖資訊種類及編號214,否則回傳錯誤訊息;若該應用程式1成功收到資訊,則將它們儲成為該認證狀態112、該認證資訊生命週期113及該解鎖資訊種類及編號114供執行階段參考使用。 Please refer to FIG. 7 for the process of synchronizing the common authentication information 21 by the application 1. In step 711, when the application 1 is started, the application 1 transmits the shared interface 31 according to the authentication information type and number 211. The authentication sharing program 2 is required to read the corresponding authentication status 216, the authentication information life cycle 213, and the unlocking information type and number 214; in step 712, the authentication sharing program 2 confirms whether the ID of the application 1 exists. In the list of accessible application IDs 215, in step 713, if the authentication sharing program 2 determines that the application 1 can read the specified common authentication information 21, the authentication status 216 is returned, and the authentication information life cycle is 213 and the unlocking information type and number 214, otherwise the error message is returned; if the application 1 successfully receives the information, it is stored as the authentication status 112, the authentication information life cycle 113, and the unlocking information type and number 114. Used for reference during the execution phase.
請參閱圖8所示是該認證共享程式2進行該共同認證資訊21同步的流程;在步驟721,當一筆該共同認證資訊21有被異動時,該認證共享程式2依據該筆該共同認證資訊21內之該可存取之應用程式ID 215逐一向符合該ID的該應用程式1進行該共同認證資訊21的同步(步驟722);在步驟722,該認證共享程式2透過該共享介面31向該應用程式1要求修改相對應的該認證狀態112、該認證資訊生命週期113及該解鎖資訊種類及編號114。 Referring to FIG. 8 , the authentication sharing program 2 performs the synchronization of the common authentication information 21; in step 721, when the common authentication information 21 is changed, the authentication sharing program 2 according to the common authentication information. The accessible application ID 215 in 21 performs synchronization of the common authentication information 21 to the application 1 conforming to the ID (step 722); in step 722, the authentication sharing program 2 transmits through the sharing interface 31 The application 1 requires modification of the corresponding authentication status 112, the authentication information life cycle 113, and the unlocking information type and number 114.
請參閱圖9所示是該應用程式1進行該共同認證資訊21認證的流程;在步驟731,該應用程式1在提供服務前若需某筆該共同認證資訊21被驗證,先檢視儲存於內部的該筆該認證資訊之狀態112、該認證資訊生命週期113等資訊以判斷是否可直接提供服務而無需進行再次驗證;若需要執行驗證,該應用程式1取得持卡人之認證資訊後透過該共享介面31向該認證共享程式2要求驗證相對應的該共同認證資訊21(使用該認證資訊種類及編號111來指定);在步驟732該認證共享程式2確認該應用程式1之ID是否存在於該可存取之應用程式ID 215列表中(即可要求該筆該共同 認證資訊21的驗證);在步驟733,若該認證共享程式2判定該應用程式1可要求驗證指定之該共同認證資訊21則進行該傳入認證資訊之比對,並將比對結果回傳該應用程式1,同時該認證共享程式2執行該共同認證資訊21同步的流程。 Referring to FIG. 9 , the application 1 performs the process of authenticating the common authentication information 21; in step 731, if the application 1 needs to verify a certain common authentication information 21 before providing the service, the first view is stored internally. The information such as the status of the authentication information 112, the authentication information life cycle 113, and the like to determine whether the service can be directly provided without re-authentication; if verification is required, the application 1 obtains the cardholder's authentication information and then transmits the information. The sharing interface 31 requests the authentication sharing program 2 to verify the corresponding common authentication information 21 (designated using the authentication information type and number 111); in step 732, the authentication sharing program 2 confirms whether the ID of the application 1 exists. In the list of accessible application IDs 215 (ie, the verification of the common authentication information 21 may be requested); in step 733, if the authentication sharing program 2 determines that the application 1 can request verification of the specified common authentication information 21, the comparison of the incoming authentication information is performed, and the comparison result is returned to the application 1, and the authentication sharing program 2 executes the common authentication information 21 Process.
上列詳細說明係針對本發明之可行實施例之具體說明,惟該實施例並非用以限制本發明之專利範圍,凡未脫離本發明技藝精神所為之等效實施或變更,均應包含於本案之專利範圍中。 The detailed description of the preferred embodiments of the present invention is not intended to limit the scope of the present invention, and the equivalent implementations or modifications of the present invention should be included in the present invention. In the scope of patents.
Claims (5)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW106125679A TWI632508B (en) | 2017-07-31 | 2017-07-31 | Multi-card integrated chip card application sharing authentication method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW106125679A TWI632508B (en) | 2017-07-31 | 2017-07-31 | Multi-card integrated chip card application sharing authentication method |
Publications (2)
Publication Number | Publication Date |
---|---|
TWI632508B TWI632508B (en) | 2018-08-11 |
TW201911134A true TW201911134A (en) | 2019-03-16 |
Family
ID=63959683
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
TW106125679A TWI632508B (en) | 2017-07-31 | 2017-07-31 | Multi-card integrated chip card application sharing authentication method |
Country Status (1)
Country | Link |
---|---|
TW (1) | TWI632508B (en) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TWI707247B (en) * | 2018-12-28 | 2020-10-11 | 中華電信股份有限公司 | Data security system and operation method thereof |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
NO321850B1 (en) * | 2004-06-25 | 2006-07-10 | Buypass As | Procedure for generating and verifying an electronic signature |
TWI410873B (en) * | 2009-12-03 | 2013-10-01 | Chunghwa Telecom Co Ltd | Secure access module (SAM card) authentication method |
CN101917216A (en) * | 2010-08-25 | 2010-12-15 | 罗正棣 | System and method for realizing safe mobile application by adopting Bluetooth intelligent card |
CN103514050B (en) * | 2012-06-19 | 2016-12-21 | 蔡毓芬 | Formula method of calling and running gear |
-
2017
- 2017-07-31 TW TW106125679A patent/TWI632508B/en active
Also Published As
Publication number | Publication date |
---|---|
TWI632508B (en) | 2018-08-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CA3053316C (en) | Method for providing simplified account registration service and user authentication service, and authentication server using same | |
JP6430449B2 (en) | Policy-based techniques for managing access control | |
EP3627373B1 (en) | Cryptologic self-executing blockchain export commitment | |
US8464069B2 (en) | Secure data access methods and apparatus | |
JP5595636B2 (en) | Communication between secure information storage device and at least one third party, corresponding entity, information storage device, and method and system for third party | |
KR20190104401A (en) | System access using a mobile device | |
CN107408192A (en) | Protect memory | |
CN101196974A (en) | Method and system for auto-configuratoin of software application program | |
EP3031001A1 (en) | Secure data storage | |
CA3176858A1 (en) | Data processing method and system | |
US20210226949A1 (en) | Multi-node authentication method and apparatus based on block chain | |
CN107145531B (en) | Distributed file system and user management method of distributed file system | |
CN110334531A (en) | Management method, host node, system, storage medium and the device of virtual machine key | |
JP2021089657A (en) | Authentication approving system and method for approving authentication | |
TWI632508B (en) | Multi-card integrated chip card application sharing authentication method | |
CN115062330B (en) | TPM-based intelligent password key password application interface implementation method | |
US9760704B2 (en) | Security apparatus session sharing | |
CN112968772B (en) | Cross-chain decoupling method and system for block chain data | |
US8387125B2 (en) | Device, system and method of performing an administrative operation on a security token | |
CN109284622A (en) | Contact person information processing method, device and storage medium | |
US11341265B1 (en) | Function-call interceptor framework for managing access to on-device content deemed sensitive by the user | |
WO2016173116A1 (en) | Method and device for accessing storage data | |
WO2023178724A1 (en) | Anti-piracy method and system for smart doorbell, smart doorbell and computer-readable storage medium | |
CN109684860A (en) | A kind of data ciphering method and device based on business relations | |
CN116757857B (en) | Block chain-based business insurance data management method, system, terminal and storage medium |