JP2001169359A - Id smart card authentication system, issue method for authentication management document and set of sim and id smart card used for mobile terminal and portable phone - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an ID smart card authentication system used by a mobile terminal and a portable phone and to provide an issue method for authentication management document. SOLUTION: An ID smart card authentication system of this invention has an authentication key 'A' recorded in an SIM of a mobile terminal or a portable phone 11 and an authentication key 'B' recorded on an ID smart card. In the case of sending information with the SIM and ID smart card mounted on the mobile terminal or the portable phone, the authentication key 'A' read from the SIM of the mobile terminal or the portable phone and the authentication key 'B' read from the ID smart card are cryptanalyzed and data are recorded, and after a public authentication agency or a 3rd party agent 30 confirms that the both are coincident, an authentication certificate is given to received information.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a mobile terminal (P)
DA = Personal Digital Assist
nt) and ID function (key) used in mobile phones
This is the contents related to the authentication system of the attached ID smart card and the method of issuing the authentication / management document. An ID smart card authentication system refers to an authentication key related to a right, a hierarchy, and an affiliation given to an ID smart card serving as a specific authentication ID such as a company ID card, using a mobile terminal and a mobile phone, and performing public authentication. Authorization by a bureau or a third party refers to the issuance of an authentication / management document.
This is a method for issuing management documents.

[0002]

2. Description of the Related Art Digitized mobile terminals are often referred to as "SI
M "or" SIM card ", which accepts a plug-in chip card, which contains all the unique data under the user's contract,
Users are allowed to access the telephone network via the closest base station. The terminal is therefore activated and personalized only after the subscriber inserts the card. In general, access to the telephone network is only possible after the personal access code has been configured by means of the keyboard of the mobile terminal.

In recent years, a so-called double-slot terminal which inserts and uses a smart card in such a mobile terminal has appeared, and a smart card has been used in a mobile terminal (PDA) or a portable telephone terminal having such a double slot. It is going to be used to carry out certain transactions, such as withdrawing deposits, buying and selling securities, ordering purchased goods, and making reservations for transportation. The user of the mobile terminal and the mobile phone terminal is a right holder, and the user always enjoys some right, hierarchy, and attribution. Alternatively, SIM (Subs) represented by a GSM mobile phone
scriber Identification Mod
ule), and the user also enjoyed the service. By the way, originally SI
Since M uses one terminal device interchangeably, it is an object of the present invention to allow a plurality of users to detachably mount and connect different SIMs to the terminal and use the same. Therefore, this does not guarantee that the terminal user is the right holder of the transaction.

[0004] However, in the above-mentioned conventional system, the service is provided on the assumption that the SIM holder is the right holder having the right, hierarchy and attribution. However, it was not possible to determine whether or not the information transmitted from the mobile terminal or the mobile phone terminal was originally transmitted from the right holder having the right, hierarchy, and attribution. Therefore, in this case, it is difficult for a public certificate authority or a third party to authenticate the information transmitted by the information sender, and the information receiving side also specifies the information sender (user) and manages the information. Cannot be performed accurately and easily. Under such circumstances, particularly when using a smart card, there is a concern that erroneous transactions will frequently occur in the future due to the difference between the user and the transaction right holder.

[0005]

Therefore, in order to solve the above-mentioned problems, the present invention separately assigns an authentication key "B" of a smart card with an ID function that specifies a right, a hierarchy and an attribution to a mobile terminal or a mobile terminal. The authentication key “A” (for example, possessed by SIM or SAM) is collated to establish a system for ensuring that the owner of these terminals is an information sender inherently having the right, hierarchy and attribution. In addition, an attempt is made to provide an authentication certificate to the transmitted information.

[0006]

A first aspect of the present invention for solving the above-mentioned problems is that an authentication key "A" recorded on a SIM of a mobile terminal or a mobile phone and an authentication key "A" recorded on an ID smart card are recorded. There is an authentication key "B", and when the SIM and the ID smart card are attached to the mobile terminal or the mobile phone to transmit information, the authentication key "A" and the ID read from the SIM of the mobile terminal or the mobile phone are transmitted. After decrypting the authentication key "B" read from the smart card and recording the data, and after confirming that the two correspond and match with each other by the public certificate authority or a third party,
I. An authentication certificate is added to received information.
D smart card authentication system. With such an authentication system, it is possible to prevent erroneous transactions from occurring without the user and the transaction right holder being different.

[0007] A second aspect of the present invention for solving the above-mentioned problem is that an authentication key "A" recorded on a SIM of a mobile terminal or a mobile phone and an authentication key "B" recorded on an ID smart card are provided. When the SIM and the ID smart card are attached to the mobile terminal or the mobile phone and the information is transmitted, the authentication key “A” read from the SIM of the mobile terminal or the mobile phone and the authentication key “A” read from the ID smart card are transmitted. Decrypts the authentication key "B" and records the data,
After the public certificate authority or a third party confirms that the two correspond and agree with each other, the received information is provided with an authentication certificate and transmitted or sent to the receiving right holder. Authentication and management document issuance method.
With this authentication / management document issuing method, it is possible to prevent erroneous transactions from occurring without the user and the transaction right holder being different.

A third aspect of the present invention for solving the above-mentioned problem is that there is an authentication key "A" and an authentication key "B" which correspond one-to-one with each other by a specific authentication algorithm. "A" is stored in the storage unit of the mobile terminal or mobile phone SIM, and the authentication key "B" is stored in the storage unit of the ID smart card. Since the authentication key is a SIM and an ID smart card corresponding one-to-one, it is possible to reliably prevent the difference between the user and the transaction right holder.

[0009]

DETAILED DESCRIPTION OF THE INVENTION In the present invention, a SIM or SAM
(Security Access Module. In the following and in the claims, "SIM" is a broad concept including "SAM.") An authentication key "A" that can be correctly and erroneously determined with an ID smart card as an authentication function. Set. On the other hand, the ID smart card is set with an authentication key "B" that has a one-to-one correspondence with the above-mentioned authentication key "A" and is capable of judging a match or a mismatch. After the public certificate authority or a third party authenticates the user by using the authentication keys "A" and "B", an authentication signal is transmitted from the mobile terminal or the mobile phone terminal to the other party (a right holder such as a business partner). I do. The public certificate authority or the third party is provided with an authentication management database, and the history data of the authentication certificate is managed together with the verification data of the authentication keys “A” and “B”. The authentication certificate is issued to the receiving right holder (business partner) by a document or an electronic document based on the storage data.

Hereinafter, the system of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a mobile terminal or a mobile phone used in the system of the present invention. Such a terminal 11 has a feature that one terminal device can be commonly used by a plurality of users by connecting and using the SIM 11s. SIM is
It is an IC card having a central processing unit (CPU) and storing a memory, usually a random access memory (R).
AM) or rewritable read-only memory (E
In addition to information essential for communication, such as an authentication key for accessing a communication network, a password of a SIM, a password of a SIM holder, and the like, accounting information, speed dial information, and the like are recorded in an EPROM. ing.
On the other hand, a read-only memory (ROM) stores a series of processing procedures of the CPU. Further, the SIM secures a work area in the RAM so that necessary data can be input / output via an I / O port, and the whole operation is controlled by a CPU via a system control logic.

The SIM 11s has a ground terminal and a power terminal connected to the main terminal device (mobile terminal or mobile phone) 11, thereby receiving driving power from the main terminal device, and further via the second power terminal. Then, a power supply for rewriting the read-only memory is input from the main body terminal device 11. Further, the SIM inputs an operation reference clock CLK and a reset signal RST from the main terminal device. As a result, when the operation is performed based on CLK and RST is input, the entire operation can be switched to the initial state.

Prior to communication, the person who connects the SIM and uses the terminal is required to confirm whether the user is authorized to use the terminal or whether the SIM is suitable for the terminal. Reads the authentication key of the SIM and checks whether it is a SIM recorded in the terminal body.
The mobile terminal or mobile phone 11 in which the system of the present invention is used can carry out the above-described commercial transaction by attaching the ID smart card 11c to the slot of the terminal in addition to the SIM connection. The transaction data that can be obtained and authenticated is transmitted via the antenna 11a.

FIG. 2 is a diagram showing a procedure for issuing a SIM and an ID smart card. The SIM and the ID smart card issuer provide the SIM with the authentication key "A" /
And authentication algorithm in RAM or EE in SIM
The data is written to a storage unit such as a PROM. The authentication key “A” / and the authentication algorithm mean that the authentication key “A” may be used alone or may be accompanied by the authentication algorithm. Here, the authentication algorithm is for encrypting a signal in order to prevent the authentication key “A” from being read when transmitting the authentication key “A” to the terminal. Similarly, for the ID smart card, the authentication key “B” / and the authentication algorithm are written into a storage unit such as a RAM or an EEPROM in the chip. I
D The authentication algorithm in the smart card is also the authentication key "B"
Is to be encrypted. Further, an ID for certifying the user's right, hierarchy, and attribution may be separately recorded in the SIM and the ID smart card. However, the authentication key “A” or “B” itself is used to store these rights, hierarchy, and attribution. May be proved.

As described above, the authentication key "A" and the authentication key "B" correspond one-to-one with each other according to the specific algorithm, and the authentication key "A" is used for the mobile terminal or the mobile phone SI.
The authentication key “B” is recorded in the storage unit of the ID smart card, and these are issued as a set of the SIM and the ID smart card. The authentication key “A” and the authentication key “B” may be the same number or symbol, and may be a numerical value or the like corresponding one-to-one by any method. As described above, since the authentication key is a one-to-one correspondence between the SIM and the ID smart card, there is no difference between the user and the transaction right holder.

Furthermore, the SIM may have a random number generation function, and the authentication algorithm may use the random number. The ID smart card side may have a random number generation function, or both may have a function of generating the same random number. The SIM and the ID smart card in which the authentication key, the authentication algorithm and the ID are written are supplied as a set to the application provider. The application provider sells this to the user. It may be a case where the publisher directly sells to the user without going through the application provider.

As the authentication algorithm, various encryption systems used for encryption can be used. What is frequently used is a conventional cryptosystem, in which the encryption algorithm and the decryption algorithm are the same, and those algorithms are kept secret. This is roughly classified into a block cipher system and a stream cipher system. As the block cipher system, DES (Data Encrypt
Tion Standard) and a stream encryption system include a nonlinear feedback shift register encryption system and a random number addition encryption system. The public encryption system refers to encryption in which a decryption algorithm cannot be easily obtained from an encryption algorithm. Although there is an advantage that the encryption algorithm can be disclosed, the validity of the encryption algorithm must be guaranteed. Representative examples include the RSA encryption system and the El Gamal encryption system. The authentication algorithm of the system of the present invention can be used without being particularly limited by the encryption system.

The structure of the ID smart card is basically SI
Similar to M, the authentication key “B” and the authentication algorithm and ID of the smart card are recorded in the RAM or the EEPROM. As described above, a random number generation function can be provided, and both can have the same random number generation function. However, if a cost problem arises, a random number is generated on one of the media, and Can use a random number obtained from the other party.

FIG. 3 is a flowchart showing an example of a procedure for using a mobile terminal or a mobile phone. First, the user starts / turns on the power of the terminal (S1). Thereby, the main body terminal device 11 reads the signal encrypted by the authentication key “A” or the authentication algorithm from the RAM of the SIM (S2). In the case of an encrypted signal, it is decrypted by an algorithm in the terminal itself (correctly means decoding). The terminal determines whether the authentication key “A” matches the authentication key recorded in the terminal (or whether the authentication key is an allowable authentication key) (S3). End with an unavailable message (S
4). If the result is affirmative, the process proceeds to the next step, where a normal telephone call and communication service are started (S5). Until this step, the operation is common to ordinary terminals to which the SIM is connected.

Next, when the terminal user inserts the ID smart card into the terminal slot and transmits transaction information,
An inquiry is made as to whether there is information that requires authentication (S7).
If there is no authentication information, the normal call / communication service is terminated (S8). If there is authentication information, the terminal reads and decrypts the authentication key "B" or its encrypted signal from the ID smart card (S9), and reads the SIM authentication key "A" read earlier and the ID smart card authentication key. It is determined whether "B" matches or corresponds (S10). If the results do not match, a message indicating that communication is not possible is displayed and communication is terminated (S11). If the result is a match, it is further confirmed whether or not the ID (right, hierarchy, belonging) matches (S12). If the result is negative, a message indicating that communication is not possible is displayed and the communication is terminated (S13). If the result matches, the service of the call and communication specified by the ID is started (S14). Is continued (S15).

FIG. 4 is a flowchart showing an example of a process after the service is completed. After the service ends, the collation data between the authentication key “A” and the authentication key “B” is updated. That is, a new collation record (date and time of collation, authentication key number, etc.) is performed on the collation record data of the authentication key "A" and the authentication key "B" (S16). Further, the record (connection date, time, fee, etc.) in the RAM of the SIM is updated (S17). Furthermore, the update is recorded in the authentication database (D / B) of the public certificate authority or the third party by communicating via the terminal (S1).
8). The terminal inquires of the public certificate authority or a third party that the communication and the update have been completed (S19). If the result is affirmative, the ID smart card is removed from the main terminal (S20), and the communication service is terminated (S21). If the result is negative, the process returns to S16 to repeat the same procedure.

[0021]

[Embodiment] (Example of operation of inter-company ordering system and authentication management in certificate authority) FIG. 5 is a diagram showing an example of operation of a public ordering system between companies. An ordering system is assumed between a purchasing department of a specific position (hierarchy) and a company (attribution) having a right to order materials and a company A which is a right holder. The public certificate authority or the third party organization 30 can also manage the receiving right, entrustment history, and receiving authentication specifying the same company ID (right, hierarchy, belonging) as the order receiving side. Further, it is possible to issue a document 33 for authentication and management as needed. The system user sets the mobile terminal or mobile phone 11
The IM 11s and the smart card with ID function 11c are attached to transmit necessary information. The terminal checks and confirms that the user and the transaction right holder are the same using the authentication key, and then transmits the information from the antenna 11a of the terminal,
The information is transmitted to a public certificate authority or a third party organization 30 via the base station 15. The public certificate authority or the third party organization is provided with an authentication database 31 and an electronic document database 32 for authenticating the received information and transmitting it as an electronic document to the right holder or sending it as a document 33. The transmitted electronic document and the like are sequentially accumulated in the electronic document D / B.

The information received by the public certificate authority or the third party is used in step S10 of the above flowchart because it is confirmed that the authentication key "A" matches the authentication key "B". There is no discrepancy between the party and the transaction right holder, but the public certificate authority or a third party confirms that the authenticated key has been registered and that it has not expired. Confirmation is performed based on authentication D / B, and based on this, authentication certification and transmission of electronic documents, etc.,
Send it out. The authenticated information is transmitted to the receiving right holder 40 with an authentication certificate. The authentication certificate is on an electronic document, and may be a specific symbol and an authentication number.
Further, when outputting on paper, a specific mark may be indicated. Company A, which is the receiving right holder 40, has a material database 41 and an electronic document database 42, stores received documents, and delivers ordered goods to the orderer in comparison with the material D / B.

The card issuing company 20 has an issuance management database 21 and an ID management database 22. ID information (rights, hierarchy, and attribution) on the card user is provided, stored in the ID management database 22, and sequentially updated. Is done. These SIM management number and ID card ID
The information on issuance, update, and revocation regarding (rights, hierarchy, attribution) is transmitted to a public certificate authority or a third party organization 30, and is used to construct an authentication database. SIM management number, ID
Issuance, update, and revocation information on the ID (right, hierarchy, belonging) of the card, ID collation OK information, and credit card settlement information as necessary are also transmitted to the receiving right holder 40. The receiving right holder can request the card issuing company to check the ID information.

[0024]

As described above, according to the system and method of the present invention, by providing an authentication key to a SIM connected to a mobile phone or a terminal used by a user as a receiving device, an ID is usually obtained. After collation with the ID smart card provided with the function, it becomes possible for the public certificate authority or third party to transmit information that can be authenticated. It is possible to avoid inconsistency with the transaction right holder, and it is possible to perform transaction without error. Further, according to the set of the SIM and the ID smart card of the present invention, it is possible to reliably prevent the difference between the user and the transaction right holder.

[Brief description of the drawings]

FIG. 1 is a diagram showing a mobile terminal or a mobile phone used in the system of the present invention.

FIG. 2 is a diagram showing a procedure for issuing a SIM and an ID smart card.

FIG. 3 is a flowchart illustrating an example of a procedure for using a mobile terminal or a mobile phone.

FIG. 4 is a flowchart illustrating an example of a process after a service ends.

FIG. 5 is a diagram showing an operation example of a public ordering system between companies.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 11 Terminal device 11a Antenna 11c ID smart card 11s SIM 15 Base station 20 Issuing company 21 Issuance management database 22 ID management database 30 Public certification authority or third party organization 31 Authentication database 32 Electronic document database 40 Receiving right holder 41 Material database 42 Electronic document database

Claims (5)

[Claims] An authentication key “A” recorded on a SIM of a mobile terminal or a mobile phone and an authentication key “B” recorded on an ID smart card are provided, and the SIM and the ID smart card are stored in the mobile terminal or the mobile phone. When sending information by attaching it to the mobile terminal or mobile phone SIM
Decrypts the authentication key "A" read out from the ID and the authentication key "B" read out from the ID smart card, records the data, and publicly verifies that the two correspond and match each other. An ID smart card authentication system, wherein an authentication certificate is given to received information after confirmation by a bureau or a third party organization. 2. The authentication key “A” and the authentication key “B” correspond to each other one-to-one by a specific authentication algorithm, and the authentication algorithm is recorded on the SIM and the ID smart card together with the authentication key. 2. The ID smart card authentication system according to claim 1, wherein: 3. An authentication key “A” recorded in a SIM of a mobile terminal or a mobile phone and an authentication key “B” recorded in an ID smart card, and the SIM and the ID smart card are stored in the mobile terminal or the mobile phone. When sending information by attaching it to the mobile terminal or mobile phone SIM
Decrypts the authentication key "A" read out from the ID and the authentication key "B" read out from the ID smart card, records the data, and publicly verifies that the two correspond and match each other. A method for issuing an authentication / management document, characterized in that after confirmation by a bureau or a third party organization, an authentication certificate is added to the received information and transmitted or sent to the right holder. 4. The authentication key “A” and the authentication key “B” correspond to each other one-to-one by a specific authentication algorithm, and the authentication algorithm is recorded on the SIM and the ID smart card together with the authentication key. 4. The method for issuing an authentication / management document according to claim 3, wherein: 5. A method according to claim 1, wherein one of the authentication methods is mutually exclusive.
There is an authentication key “A” and an authentication key “B” corresponding one-to-one,
The authentication key “A” is stored in a storage unit of a mobile terminal or a mobile phone SIM, and the authentication key “B” is stored in a storage unit of an ID smart card.
D Smart card set.