KR100187518B1 - Authentication apparatus of ic card terminal using dual card - Google Patents

Abstract

The present invention relates to a mutual authentication method and a device using a dual card, and more particularly, to install an internal card connection port 9 connected to the CPU 4 in the existing IC card terminal 10, 9) a stored authentication IC card 40 of the operating software for authenticating the password of the customer IC card 30 by combining an algorithm for predetermined passwords, key data for solving the passwords, and combining the password and key. ) Can be installed and detached to perform the encryption authentication procedure, which can completely guarantee the safety of data, greatly reduce the processing time due to the authentication procedure, and the customer's IC card for the customer without knowing the key at all. You can issue a built-in IC card, get an answer to your key from another system provider, and ensure the security of your password. The system is easily manageable.

Description

Mutual authentication device for IC card terminal using dual card

1 is a block diagram of a mutual authentication device of the present invention.

2 is a flowchart for explaining a mutual authentication method of an IC card terminal to which an apparatus of the present invention is applied.

* Explanation of symbols for main parts of the drawings

1: Customer card access port 2: LCD

3: key input unit 4: CPU

5: line interface unit 6: keyboard interface unit

7: ROM 8: RAM

9: Internal card access port 10: Terminal

20: host computer 30: customer IC Gide

40: authentication IC card 50: pin pad

The present invention relates to a mutual authentication device for an IC card terminal using a dual card, and more particularly, to a cryptographic algorithm, a key data for decrypting a password, and an operating software for authenticating a password of a customer IC card by combining a password and a key. The present invention relates to a mutual authentication device for an IC card terminal using a dual card, in which an IC card for authentication embedded in a chip is installed to completely guarantee the security of a key.

An IC card (smart card) is a small computer chip equipped with a CPU, etc., on a synthetic resin board having a conventional magnetic card shape, and this IC card can replace cash payment with a card without carrying cash. The data stored in the card is stored permanently as long as the card is not damaged, and is widely used as a prepaid IC card and a debit IC card.

At this time, the prepaid IC card stores the amount data corresponding to the cash through a predetermined input procedure in the CPU of the card, and when each relatively small item is purchased and paid for, the merchant card is transferred to the card at the merchant. It is configured to withdraw as much as you want from the memorized amount and keep the rest of the amount, and the debit IC card is configured to deposit the required amount (comparatively large amount) directly through the bank into the merchant account while on-line. The amount data in both cards is protected by an encrypted password to prevent others from using it easily.

Therefore, in order to pay a predetermined amount through the IC card, the card terminal must go through the procedure of releasing the password for the key recorded on the customer IC card and confirming that the password is correct.

By the way, most of the conventional card terminal is connected to a separate memory in which the encryption algorithm, the key data and the operating program is recorded to the central processing unit inside the terminal to perform the authentication procedure of the customer IC card through this memory.

If the key value is stored in an unsecured place that can be easily decrypted by the public (i.e. it is kept exposed in memory), decrypting the Security Module from the point of view of the hacker will decrypt it. The key used in the encryption can be found by attacking the hardware.

In other words, in the card terminal having the off-line system, how to store the key value is the key to determine the security of the security module.However, if a cryptographic algorithm, key data, and an operating program are recorded and used in memory as in the prior art, a hacker is used. There is no safety from.

In addition, when using the DES (Data Encryption Standard), the security based on it is extremely difficult to keep track of the key with only the ciphertext itself. In this sense, key storage is vulnerable because decryption takes place.

In addition, if hacking to find the key of the cipher is successful, the cryptographic protection cannot be obtained. Therefore, such a system uses a cipher but cannot be regarded as a cipher system.

In addition, the terminal having such a configuration does not depend on the encryption but the security is based on the structure of the security module, so the person who designed the security module can find out the key value, and the owner of the key value can not know the security module. There is a problem.

That is, since the designer adds the key value back to the owner's key value, the actual key value is not the owner's key value, but the designer can take the complete key value.

In addition, the conventional security module has a fundamentally vulnerable structure, so that the encryption is used many times to reinforce the security, as well as complex processing, so the processing speed is slow, which causes problems in practicality. In other words, the current system uses a complex and long processor that is not very helpful without cryptographic considerations to improve the weakness structure for safety. Therefore, the security itself is not improved and the processing time is long, which uses an 8-bit central processing unit. It takes more than 10 seconds (currently 25-39 seconds) when optimally programmed in each device.

In addition, safety is never increased, and in detail, it can be seen that certain types are periodically repeated.

And because security is not based on algorithms, but on structure, it is not possible to reveal the ciphers, so the key owner is dependent on the security module designer, and no other company can participate at all. have.

The first object of the present invention is to record an encryption algorithm, key data and an operation program on an IC card having excellent data security and to embed it in a terminal so that the authentication procedure of a customer IC card can be performed by this built-in IC card. The purpose of the present invention is to provide a mutual authentication device for an IC card terminal using a dual card, which can ensure the perfect safety of the device.

A second object of the present invention is to provide an IC card terminal using a dual card that can greatly reduce the processing time due to the authentication process by allowing the authentication procedure between the customer IC card and the authentication IC card to be in an optimal state. It is to provide a mutual authentication device.

The third object of the present invention is to remove the security module and put all the authentication keys on the authentication IC card, which is the built-in IC card, so that the designer can issue the customer IC card and the built-in IC card without knowing the key at all. It is to provide a mutual authentication device of the IC card terminal using.

It is a fourth object of the present invention to provide a mutual authentication apparatus for an IC card terminal using a dual card, in which a system owner can receive an answer from another system provider without being dependent on the designer of the system.

The fifth object of the present invention is to provide a mutual authentication device for an IC card terminal using a dual card that can be guaranteed the security of the password as it is through the cryptographic authentication procedure through a random number between the internal IC card and the customer IC card There is.

A sixth object of the present invention is to provide a mutual authentication device for an IC card terminal using a dual card that can easily manage the system because all the management is possible only if the built-in IC card when managing the system well.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

As shown in FIG. 1, the apparatus of the present invention controls the customer card connection port 1 and the CPU 4 so that data communication with the CPU 4 is made when the customer IC card 30 is selectively coupled. A liquid crystal display unit 2 for receiving various types of information including a payment amount and the like, and a key input unit including various function keys including numeric keys and selectively operated by a user to generate a predetermined key signal ( 3) and a keyboard interface unit 6 for inputting the output signal of the pin pad 50, which is separately formed for the cardholder to input a password, to the CPU 4, and the predetermined provided by the ROM 7; Including a CPU (4) for performing overall control of the system through the program, a line interface unit (5) for data communication with the bank host computer 20 via the telephone line, and the operating program of the systemIn the terminal 10, an IC card terminal 10 having a ROM 7 in which various data are stored and a RAM 8 in which predetermined data is temporarily stored during system operation and then output as needed. A built-in card access port 9 connected to the CPU 4 is provided, wherein the built-in card access port 9 combines an algorithm for predetermined passwords, key data for solving the passwords, and a combination of the password and the key. It is characterized in that the authentication IC card 40 in which operating software for authenticating the password of the IC card 30 is stored is detachably installed.

2 is a flowchart of a mutual authentication method of an IC card terminal to which the apparatus of the present invention is applied. When the customer IC card 30 is coupled to the customer card connection port 1 of the terminal, the CPU 4 recognizes this. The first step of generating a random number generation request signal to the customer IC card 30, and generates a random number from the customer IC card in response to the random number generation request is received by the CPU (4) for the authentication IC card ( A second step of transmitting the random number to the CPU 4 by encrypting the random numbers with a predetermined key in the authentication IC card 40 having received the random number, and the customer IC card ( A fourth step of receiving a random number in an encrypted state through the CPU 4 and decrypting it with a key in itself, and then detecting whether the released random number is the same as the random number transmitted by the first person; and If the detected result is the same random number Itaconic Song, acknowledge receipt and the random number are different, comprises a fifth step of ever reject the execution of all the commands including the data transmitting and receiving.

Referring to the operation and effect of the device of the present invention configured as described above are as follows.

First, an authentication IC card 40 in which an algorithm for a predetermined password, key data for decrypting the password, and operating software for authenticating the password of the customer IC card 30 by combining the password and the key are stored. Is connected to the internal card connection port 9 installed in the card terminal 10, the authentication IC card 40 and the CPU (4) are interconnected to enter a state capable of inputting and outputting data.

In this state, the system operator of the merchant stores the customer's IC card 30 in which various data are stored in the chip, including a password, an encryption key, and an amount of money, in order to receive a payment for a predetermined item from the customer. When plugged into the customer card connection port 1 installed separately from the connection port 9, the CPU 4 recognizes this and generates a random number generation request signal to the customer IC card 30.

Therefore, the customer IC card 30 generates a predetermined random number to the CPU 4 in response to the random number generation request signal, and the CPU 4 receiving this random number again generates this random number for the authentication IC card. 40 will be sent.

In addition, in the authentication IC card 40 performing the same function as the existing security module, the above-mentioned random number is encrypted with the key value stored in the self, and the IC card 30 is returned to the customer IC card 30 through the CPU 4 again. Send it out.

In this way, in the customer IC card 30 that receives the encrypted random number from the authentication IC card 40, the password in the random number is solved by using a key of its own. It is determined whether it is the same as the random number sent by).

As a result, if the random number released is the same as the random number sent by the initial self, it is recognized as a legitimate IC card and the I / O of various data including the amount data is approved.

However, if the key of the encrypted random number is not the first random number sent by the user, the person who does not know the password may purchase another item using another IC card by rejecting all commands including the input / output of the data. You can prevent it.

That is, the encryption algorithm, the key data and the operating software are recorded, and the authentication procedure of the customer IC card 30 is performed through the terminal built-in authentication IC card 40, which is very good in its storage, so that the key is completely protected from the hacker. You can do it.

In other words, the secure key storage provided by the IC card (authenticated IC card) eliminates the risk of key management.In addition, the IC card has a hardware system that is securely protected from external attacks. Cryptographic and mathematical guarantees can be obtained from inappropriate key submissions.

In addition, from the point of view of the legitimate key holder, the authentication process can be performed by using the secure key only once or twice without using the key several times, so that the optimal authentication procedure can be performed and the processing time can be greatly reduced.

In addition, since all authentication keys are placed on the authentication IC card 40 without using the security module as in the related art, safety is transferred from the designer's line to the internal card issuer, and the customer's IC is not known at all. In addition to issuing IC cards for issuing and authenticating cards, the system owner is not dependent on the designer of the system and can therefore be provided with answers to the keys from other system providers.

In addition, since the cryptographic authentication procedure is performed through random numbers in the authentication IC card 40 and the customer IC card 30, the security of the password can be guaranteed as it is, and only the built-in IC card needs to be well managed during system management. The cost can be reduced.

However, when the IC card for authentication is separately installed as described above and the legitimacy of the customer IC card is determined, the production cost of the product is higher than when the memory is used.

Therefore, the present invention is relatively expensive and is preferably applied to a terminal installed in an affiliated store having a large transaction amount or a large transaction amount.

On the other hand, if the customer IC card 30 is authenticated by the terminal itself through the authentication procedure described above, the operator of the terminal 10 is to enter the amount to be paid through the key input unit 3, the amount of the liquid crystal display unit It is displayed in (2).

Subsequently, when the card holder checks the amount displayed on the liquid crystal display unit 2 and inputs a password according to his or her card through the key input unit 3 or the pin pad 60, the password and the amount are encrypted and the CPU ( 4) is entered.

Therefore, the CPU 4 judges whether the password matches the password stored in the customer IC card 30, and if there is a match, stores the predetermined input procedure or the like in the customer IC card 30. The desired amount of money is extracted from the amount of money data, and input into the data capture unit (not shown) in the CPU 4 (in the case of a prepaid IC card), and the remaining amount of money is stored in the customer IC card.

Therefore, the holder of the customer IC card 30 can continue to purchase other things, etc., without cash, using the remaining balance, wherein the data capture unit in the CPU 4 and the customer's card number, purchase amount, etc. that day After storing the same various transaction information, it is connected with the bank's host computer 20 through the line interface unit 5 and performs settlement at the same time.

In other words, every time a card inquiry is made to the host computer of the bank despite the small amount of goods, the communication cost and time are unnecessarily high. Therefore, the self-credit level of the IC card used as the electronic wallet can be increased. Once you have determined and performed a transaction, you can batch process it at night off-line.

Of course, in the case of a debit IC card, the required amount (comparatively large amount) is directly deposited to the merchant account through the bank's host computer 20 after verifying the password in the on-line state.

As described above, according to the present invention, since the authentication process is performed using an IC card having excellent data safety instead of the first memory, the security of data can be completely guaranteed, and the processing time due to the authentication process is greatly reduced. Third, the designer can issue customer IC card and internal IC card without knowing the key. Fourth, the system owner can get the answer from another system provider without being dependent on the designer. The security of passwords can be guaranteed, and the sixth system can be easily managed.

Claims (1)

When the customer IC card 30 is selectively coupled, the customer card connection port 1 enables data communication with the CPU 4, and various types of information including the payment amount under the control of the CPU 4, including letters and numbers. A liquid crystal display (2) for displaying a key, a key input section (3) having various function keys including a numeric key and selectively operated by a user to generate a predetermined key signal, and allowing a cardholder to input a password or the like CPU to perform the overall control function of the system through the keyboard interface unit 6 for inputting the output signal of the pin pad 50 formed separately by the CPU 4 to the CPU 4 and a predetermined program provided from the ROM 7. (4), a line interface unit 5 for data communication with the bank's host computer 20 via a telephone line, a ROM 7 for storing various data including an operating program of the system, and a system luck In the IC card terminal 10 having a RAM 8 in which predetermined data is temporarily stored and then output as needed, the internal card connection port 9 connected to the CPU 4 in the terminal 10. In the internal card access port (9), an algorithm for predetermined passwords, key data for solving the passwords, and an operation for authenticating the password of the customer IC card 30 by combining the password and the key. A mutual authentication device for an IC card terminal using a dual card, characterized in that the authentication IC card (40) in which software is stored is detachably installed.