KR20060130312A - A method and system thereof for delivery of issuer's key to a smart card chip issued by multi-institutions - Google Patents

Abstract

A method and a system for transferring a key to a smart card chip commonly issued from multi-institutions are provided to enable each institution to install a smart card key to the smart card chip in a desired time when the institutions offer multiple services to a single smart card in cooperation. Each issuance institution(100) manages issuance and the service of a smart card application program. A pre-issuance center(200) issues the smart card application program under management of a pre-issuance institution before the smart card(610) is send to a customer. A post-issuance center(300) manages post issuance business by adding the new smart card service after the smart card is sent to the customer. A CA(Certificate Authority) server(400) issues and manages a certificate based on a unique public key of the customer's smart card. The smart card is provided to a mobile terminal(600) in a SIM(Subscriber Identity Module) type in a wireless environment and is provided to the mobile terminal in a card type through a smart card reader(710) connected to a PC(700) in a wired environment.

Description

A method and system for delivery of issuer's key to a smart card chip issued by multi-institutions}

1 is a system configuration diagram for delivering a key of the issuing authority in the issuance of a multi-institution multiple service smart card according to the present invention,

Figure 2 is a flow chart for issuing authority key in the chip program issuing procedure according to the present invention.

<Description of the symbols for the main parts of the drawings>

100: issuer

110: issuer key

200: line issuing center

300: after issuing center

400: Certificate Authority

410: CA database

500: wired and wireless communication network

600: mobile terminal

610: smart card

611: smart card chip program

612: key pair (public key / secret key)

620: certificate

700: PC

710: smart card reader

The present invention relates to a method for securely transferring a key of each institution to a smart card when several organizations jointly issue a smart card.

The smart card is originally provided with a plurality of chip applications installed to the customer. In recent years, the post-issuance function has been provided so that customers can use the smart card to delete or add some services to configure the services mounted on their smart card.

In general, one agency provided services by distributing various services on one smart card. In other words, it is a multi-service type provided by a single institution. Issuance is always handled by one organization, even if the services on one smart card take the form of alliance with other organizations.

The issuance of such a single agency-multiple service is due to the security problem for smart cards. Smart cards are a medium with a high level of security, and the key to security is key management. The key of the smart card allows only authorized persons to access the smart card and the chip application. Before the smart card is delivered to the customer, the key is issued to the smart card by a rigorous procedure in a secured issuing center. The key of the issued smart card is shared and managed by both the issuer and the smart card chip. When the information that requires security is required, the key is the key of the smart card.

However, a number of institutions that are exclusively issued to a single smart card are issued in partnership. If a customer selects and adds a service provided by any agency after acquiring the smart card, it is impossible to transmit encrypted information. Information can be secured only by requesting the coordinator for the use of the smart card key to the management authority of the service installed in the card. In reality, it is difficult for multiple organizations to share smart card keys. Moreover, the situation is even more disadvantageous for organizations that wish to participate in the alliance model after the start of the business.

Even if a number of institutions cooperate with one smart card to provide multiple services, each institution wants to manage and manage its own smart card key system, so it is difficult to cope with the market need for multi-organization / multiple services.

The present invention relates to a method for installing its smart card key at a time desired by each institution in providing multiple services to a single smart card in cooperation with a plurality of organizations.

The application of the smart card may be rearranged by a number of methods and procedures, such as pre-issuance and post-issuance. When the set of possible applications for any smart card product is A, B, C, D, A and B can be installed at the issuing center before being delivered to the customer. This is called advance issuance. The smart card will be delivered to the customer and will use service subsets A and B. Subsequently, suppose a customer wants to use a portfolio consisting of elements A, B, C, and D by adding services C and D for some reason. It is practically impossible for a customer to visit the issuing center to load the service subsets C and D. In general, wired / wireless communication networks are used, and encryption / decryption of issuance information is an important requirement. In particular, financial services are essential.

If the service sets A, B, C, and D are all issued by a single entity, there is no problem in pre / post issuance, but the financial company A is in charge of the service subsets A and B, and the telecommunications company is the service subset C and D. In case of affiliated smart card products, it is difficult for the telecommunications company to encrypt the issued information with its own security system for services C and D issued after being delivered to customers.

Moreover, when the partnership is expanded and the securities company wants to provide the service E, the security management of the total sets A, B, C, D, and E of each service subject brings serious problems. The disease will not be satisfied with the need to use A and E's smart card keys, and A and A also have the burden of exposing their security system to the bottle. As a result, the provision of a flexible form of multi-institutional / multiple services smart card products is hampered.

It is an object of the present invention to provide a method for maintaining a security system of independent information for each institution without being bound by various issuance forms such as pre / post issuance in providing smart card products of multiple institutions-multiple services. Is in.

In order to achieve the above object, the present invention provides a plurality of issuing institutions 100 for issuing a smart card application program; A key 110 for securely transferring the issuing information of each issuer 100; Line issuing center 200 for installing the smart card application before delivering to the user; Issuing center 300 after the user is responsible for installing a new application while using the smart card delivery; Certificate Authority (CA) server 400 for generating a certificate requested by a user having a smart card and managing the certificate; A CA database 410 for storing and managing a CA's certificate; A wired / wireless communication network 500 for post-issue processing with a user's smart card; A mobile terminal 600 for a wireless communication network user; PC 700 and smart card reader 710 for wired communication network users; The mobile terminal is provided in the form of a SIM module, the PC is characterized in that it comprises a smart card 610 provided in the form of a card to be inserted into the reader.

In order to achieve the object of the present invention, the smart card 610 is a unique public key and private key 612; A certificate 620 generated in a CA that recognizes the validity of the smart card public key; And a smart card chip program 611 installed in the smart card.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 shows the overall system configuration for delivering a key 110 of the issuing authority 100 according to the present invention when a plurality of issuers jointly issue a plurality of smart card services. A plurality of issuing organizations 100 for issuing one smart card 610 will determine a smart card chip program 611 to be issued in advance and a smart card chip program 611 to be issued later. The pre-issued smart card chip program 611 is installed in the smart card 610 under the management of the issuing authority 100 to participate in the pre-issuance procedure in the pre-issuance center 200 equipped with a security facility. Thereafter, the smart card 610 is delivered to the user. The smart card 610 may be used in a fixed environment such as the PC 700, or may be installed and serviced in the mobile terminal 600.

The issuing institution 100 to install the smart card chip program 611 by the issuing procedure after the issuing in conjunction with the issuing center 300. Since the issuing information and the issuing company key must be transmitted after being encrypted, it is necessary to form a security section between both ends of the issuing authority 100 and the smart card 610. To this end, the smart card generates and stores the key pair 612 in the pre-issuance step. The key pair 612 is composed of a public key and a secret key used to prove that the smart card user is a unique customer.

In the issuing procedure, the key 110 and the issuing information of the issuing authority 100 are encrypted and transmitted with a unique public key of the smart card requesting issuance. The CA 400 generates a certificate 620 for the smart card public key of the customer and manages the CA database 410 so that the issuing authority 100 may authenticate the smart card public key of the customer requesting for issuance.

After the key 110 of the issuing organization 100 encrypted with the public key of the smart card 610 of the customer who applied for issuance and the issuing information are transmitted in a secure state between the end and decrypted only with the private key of the smart card 110. can do. The key 110 and the issuing information of the issuing authority 100 securely delivered are installed in the smart card 610 to provide a new service to the customer. The onboard smart card chip program 611 already has the key 110 of the issuing organization 100, so that it is possible to form a secure channel with the issuing organization 100 and to safely perform transactions such as transaction processing and service update. can do.

Preferably, the procedure for pre-issuing and post-issuing the smart card chip application program 611 proposed in the present invention will be described in detail with reference to FIG. 2.

2 shows a procedure in which a plurality of issuing agencies 100 cooperate in a joint manner to enable pre / post issuance in an exclusive security system. The line issuing center 200 is equipped with a line issuing smart card chip program (611). The line issuing center 200 is provided with a security facility and is managed by the issuing organization 100 participating in the line issuing, it is possible to securely issue the key 110 of the issuing authority to the smart card (610). In addition, the line issuing center 200 requires that each smart card 600 generates its own public key-based key pair 612 for the future issuance in the future (①). The smart card 610, which is issued in advance (②) and the key pair 612 is generated (③), is delivered to the customer.

The new chip program 611 needs to be installed in the smart card 610, whether at the request of the customer or at the request of the new issuer 100 wishing to participate in the partnership. In order for the customer to issue a post-issuance installation request (4) for the new chip program 611, a unique public key and a certificate 620 of the smart card 610 possessed by the customer are required. After the customer requests via the issuance center 300 or directly requests the CA (400) to generate a certificate (620) (⑤). The generated certificate 620 is stored in the CA database 410 for management purposes (6) and provided to the requesting entity (7). The certificate 620 does not necessarily need to be stored in the smart card 610 because the information is not required for security. After the issuance center 300 stores and manages and may be used when a customer request is requested, or may be brought to the CA 400 whenever necessary. There are many types of smart cards 610, and in some cases it is difficult to process the certificate in terms of memory capacity and information processing speed.

The post-issue request (⑧) of the customer is processed by the post-issuance center 300 and submits the certificate of the smart card possessed by the customer to the issuer 100 (⑨). The issuing authority 100 generates the issuing information for the requested customer, encrypts the content with the issuing authority's key 110, and then discloses the issuing authority's key 110 included in the customer's certificate 620. After encrypting with a key and forwarded to the issuing center 300 (⑩). In the end-to-end security system, the issue information and the issuer key 110 are securely transmitted to the smart card 610 (⑪) and installed in the smart card 610 (⑫).

As described above, the present invention proposes a method for enabling multiple services by participating in a plurality of issuers in one smart card product. Even if the composition of the issuing organization participating in the alliance model changes after the product is released, the security problem does not occur in the subsequent issuance to the existing smart card.

Each issuer can maintain its own key management system and will not be subject to or interfere with other issuers. In addition, customers will receive a variety of services from different issuers even if the smart card is not replaced.

Institutions that provided services such as credit cards and memberships were able to provide high quality smart card products to customers and relieve the issuance costs due to the issuance of smart cards.

Claims (9)

In the smart card issuer key delivery system that provides multiple services of multiple institutions, A plurality of issuing institutions 100 for issuing and servicing smart card applications; A pre-issuance center 200 for issuing a smart card application under the management of each issuer 100 before the smart card is delivered to the customer in the issuing facility equipped with a security facility; Issuing center 300 after the customer is responsible for the post-issuance task for the addition of a new smart card service after the smart card is delivered; Certificate Authority (CA) server 400 for issuing and managing certificates based on the unique public key of the smart card possessed by the customer; A wired / wireless communication network 500 for providing a communication environment in a wired environment such as a wireless mobile terminal 600 such as a mobile phone or a portable Internet terminal and a PC 700; In a wireless environment, the mobile terminal 600 is provided in the form of a SIM, and in the wired environment, the issue is characterized in that the PC 700 has a smart card 600 used in the form of a card via the smart card reader 710. Authority Key (110) Delivery System. The method of claim 1, wherein the smart card 610, A key pair 612 composed of a public key and a private key unique to each smart card; Certificate 620 that recognizes the validity of the unique public key for each smart card; Issuing authority key delivery system characterized in that it comprises a smart card chip program (611) that is installed in the smart card through a pre-issue or post-issue process. The method of claim 1, wherein the CA 400, A function of generating a certificate based on a public key of a smart card possessed by a customer; Issuer key delivery system, characterized in that the function of storing and managing the generated certificate in the CA database (410). The method of claim 1, the issuing authority 100, Verifying validity of certificate 620; Extracting the public key of the customer from the certificate 620; Encrypting the issuing information with the issuing authority key 110; The issuing authority key delivery system, characterized in that it has a function to encrypt the public key of the customer. The post-issuance center 300 of claim 1, It is responsible for the relay between the issuing authority 100 and the CA 400 and the customer's smart card 610 as a subject that proceeds to issue new and requested by the customer; Storing and managing a customer's certificate as needed; Issuing authority key delivery system characterized in that it has a function for generating a public key / secret key of the smart card. The method of claim 1, wherein the line issuing center 200, A function of installing the smart card chip program 611 in compliance with the security system under the management of the issuing authority 100 before the smart card is delivered to the customer; Issuing authority key delivery system comprising an issuing procedure for requesting a smart card to generate a smart card unique public and private key. In the system for issuing multiple agencies-multiple services after each issuer with its own security system, (1) issuing a pre-issuing chip program in the line issuing center 200; (2) generating a public key / secret key of the smart card in the line issuing center 200; (3) installing a pre-issued chip program in the smart card 610; (4) generating and storing the public key / secret key in the smart card 610; (5) the customer requesting a certificate 620 for the public key of the smart card; (6) after the issuing center 300 relays the certificate 620 generation request to the CA (400); (7) storing the generated certificate 620 in the database 410 by the CA 400; (8) CA 400 passes the certificate to the issuing center 300; (9) managing the certificate after the issuing center 300; (10) the customer requesting post-issuance to add a new service to the smart card; (11) after the issuing center 300 submits the client's certificate 620 to the issuing authority 100 to request post-issuance; (12) the issuing authority 100 transferring the issuing authority key 110 encrypted with the issuing authority key 110 and the issuing authority key 110 encrypted with the public key of the customer to the issuing center 300; (13) after the issuing center 300 issuing the issuer key 110 and the issuing information to the smart card 610 of the customer; (14) the issuer key transfer comprising the step of installing the issuer key 110 and the issue information received from the issuer 100 on the chip by the customer's smart card 610 and then completing the issue. Way. In step (2), the request for generating a public key / secret key of the smart card is not only performed at the pre-issuing center 200, but also a request for generating a public key / secret key for the smart card at the later issuing center. can do. In the step (9), after issuing center 300 can store and manage the customer's certificate (620) generated by the self, depending on the situation to obtain the certificate 620 or smart card by requesting a CA May request a certificate 620.

Images