KR100528975B1 - Unified key management method for smart card supporting multiple applications - Google Patents

Abstract

The present invention relates to a method for integrated key management in a smart card that supports multiple applications, which includes a smart card that supports multiple frameworks such as a Universal Subscriber Identity Module and a Global Platform. Its purpose is to efficiently store, update, and manage multiple keys that can be used in multiple applications in an environment.

In addition, the integrated key management method in a smart card supporting multiple applications provided by the present invention provides a single scheme for multiple keys that are stored, updated, and managed redundantly in each framework on a smart card that supports multiple applications. By minimizing the waste of memory inside the smart card due to the redundancy process, it provides the efficiency and convenience of key management through the unified interface.

Description

Unified key management method for smart card supporting multiple applications}

The present invention relates to a method for integrated key management in a smart card supporting multiple applications, and more particularly, to provide a unified interface for multiple keys that can be used in multiple applications on a smart card environment in which multiple frameworks are supported. The present invention relates to an integrated key management method in a smart card that supports multiple applications that are stored, updated, and managed securely and efficiently.

In general, smart cards have been recognized as a secure personal information storage medium, and shows examples of the use of many application services such as electronic money, transportation cards, and user authentication cards of mobile phones. Currently, smart cards that support multi-application using multiple applications on one card to use these various application services are becoming more popular. Due to this, a plurality of frameworks are installed, such as a framework supporting Universal Subscriber Identity Module USIM, a framework supporting Global Platform GP, and a framework supporting biometrics. It is true.

The need for a safe execution and management program for a number of application programs in the smart card has been raised, and the development and research on the card management system (Card Management System CMS) has been in progress. The framework that supports the representative card management system is a global platform, the proposed industry standard around Visa, and was developed to load, run and manage a number of applications on Java cards.

The framework supporting the card management system manages only the keys for communication channel security, data security, and message authentication that are used by itself, and another key management method is used in different frameworks, which is a universal subscriber module and a global platform. In other words, different frameworks such as biometrics support frameworks use different key management methods. The existing key management method has two problems. First, in a situation where multiple frameworks and multiple applications are mounted on a single smart card, the key used in each framework is duplicated according to the method of storing, updating, and managing each key. Management efficiency is reduced. Secondly, the key management function is duplicated and mounted in the smart card in the above manner, resulting in a waste of memory.

In order to solve the problem of key management, as shown in the Republic of Korea Patent Publication No. 1999-0077193 (October 25, 1999) to create an identifier corresponding to the key at the same time to provide only the identifier to the user and centralized management in the central authentication center Although the method has been proposed, it is not a method for a plurality of frameworks, but a method having a limitation of supporting a subscriber identity module (SIM), which is a mobile communication framework that does not consider multiple applications.

The method of the present invention is proposed to solve the above problems, and uses a plurality of security managers, card managers, key management command analyzers, PUT KEYs, and GET KEYs to manage a plurality of frameworks. It provides an integrated key management method in smart cards that supports multiple applications that can integrate, securely and efficiently store, update, and manage and prevent memory waste by using a unified interface and function.

The present invention also provides an integrated key management method in a smart card that supports multiple applications that can be actively applied even when a framework having new functions is added, that is, when a smart card function is added or expanded in the future. To provide.

The present invention proposes a method for implementing and operating a key manager in an existing smart card to achieve the above technical problem.

The present invention provides an integrated key management method in a smart card that supports multiple applications and supports a plurality of frameworks. The present invention provides a secure key and a shared key manager for efficiently storing, updating, and managing keys used in each framework. It provides an integrated key management method in a smart card that supports multiple applications, characterized by having a key storage that allows storage.

Preferably, the key manager and key store are accessed only if they have proper authority through a security manager and a card manager for securely managing the plurality of frameworks.

Preferably, the appropriate authority is given only after initializing, external authentication.

Advantageously, said key manager comprises a key management command analyzer, key storage, and key retrieval to support multiple applications for smart card support.

Preferably, the key store comprises tables of authorization identification, framework identification, key version, key type, key data.

Preferably, the access rights of the framework are determined through authorization identification.

Preferably, indicating that the key of the framework is determined through the framework classification.

Preferably, the use of the key is determined according to the framework classification, the key version, and the key type.

Preferably, the smart card for mobile communication uses a master key (K) for the universal subscriber module, an operator parameter (OPc), and a key (K1, K2, K3) for communication channel security, data security and message authentication used in a global platform. And a table for storing.

Hereinafter, the configuration and operation of an integrated key management method in a smart card supporting multiple applications of the present invention will be described in detail with reference to the accompanying drawings.

As shown in FIG. 1, the overall structure of a smart card to support multiple applications and to support a plurality of frameworks includes smart card hardware 10, a card operating system (OS) 9 for controlling hardware, different hardware and A virtual machine (8), an interpreter that treats the operating system the same, a key store (7) for secure key storage, multiple frameworks (3, 4), and securely integrated management It consists of a security manager and card manager (5), a key manager (6) and applications (1) (2) for efficiently storing, updating, and managing keys used in each framework.

FIG. 2 shows a practical application example of the configuration in a smart card on a Java virtual machine with multiple frameworks and multiple applications that can be used for real mobile communication. As shown in FIG. 1, the smart card hardware 20 and the card operating system are shown. (19), the Java virtual machine (18), a Java interpreter that allows different hardware and operating systems to be treated identically, a key store (17) for secure storage of keys, a universal subscriber identity module (13), and a global platform. It consists of a framework having a plurality of (14), a security manager and a card manager 15, a key manager 16 and a global platform application 11, a universal subscriber identity module application 12.

In the integrated key management method of the smart card supporting multiple applications provided by the present invention, as shown in FIG. 3, the access control and authorization are provided when the contents of the smart card are read or written. A security manager (Security Manager or Security Domain) 21, a card manager 22 that manages the frameworks and applications embedded in the card, and a key manager that analyzes and processes key management commands. Key management command analyzer (23), PUT KEY (24), GET KEY (25), and the actual key store to represent the authority to store or retrieve keys. Authorization Identity (26), Framework Identity (27) that distinguishes each framework in which the key is used, Key Version (28) that represents the new and old key, Consists of a set of tables consisting of the key data (Key Data) (30) each key that indicates the value of the key type (Key Type) (29), the actual key for the purpose of the framework being used.

Figure 4 shows the actual application of the configuration in the smart card that can be used for the mobile communication scheme shown in Figure 3, the security manager 31, card manager 32, key management command analyzer 33, key storage 34, the key retrieval 35 is configured in the manner as shown in Figure 3, the table 36 for storing the key K used in the universal subscriber module (USIM) access with the authority of the administrator of the USIM USIM_ADMIN to indicate that it can be done, USIM to indicate the type of the framework, version 1.0 of the key, a field indicating that the purpose of the key is a master key, and K indicating an actual key value. In the table 37 for storing the OPc, which is an encrypted value of an operator parameter used in the universal subscriber module, the key type is represented as an operator and the OPc value is stored. In addition, GP_ADMIN indicates that the tables 38, 39, and 40 for storing communication channels K1, K2, and K3, which are keys for communication channel security, message authentication, and data security used in the global platform, can be accessed with the authority of the GP administrator. , GP indicating the type of the framework, version 1.5 of the key, S-ENC for the purpose of communication channel security, S-MAC for the message authentication, and DEK for the data security. The actual key values K1, K2, and K3 are stored in.

The procedure for the integrated key management method in the smart card supporting multiple applications is summarized as shown in FIG. 5. When you start storing, retrieving, and managing keys (41), you first go through the Initialize Update process of your smart card (42), and you have access to that key through the External Authentication process (43). Determine. If there is no authority as a result of the determination, the process is immediately terminated (49). If the authority is present, the key management command analysis 44 is performed to execute a key management command according to the key version and key type of the corresponding framework. It prepares for processing, determines whether it is a storage command or a retrieval command (45), and performs the storage 46 and the retrieval 47 process of the corresponding key through the key storage 48, and finally ends the normal operation 49.

As described above, the present invention provides an effective key management method in a smart card on multiple frameworks supporting multiple applications.

By applying the method proposed in the present invention to a smart card that supports multiple applications, it is possible to minimize the waste of memory inside the smart card due to the redundant processing that is a problem, and to improve the efficiency of key management through a unified interface. You can increase it.

Therefore, the method proposed in the present invention can be utilized for the development of an integrated card having a plurality of frameworks for supporting multiple applications such as smart card for mobile communication, electronic money, traffic card, access control, etc., where security is required. Can be.

1 is a block diagram illustrating an internal structure of a smart card in which multiple applications and multiple frameworks are supported.

2 is a block diagram showing the internal structure of a smart card for mobile communication equipped with multiple applications and multiple frameworks.

3 is a block diagram of a key management function according to the present invention.

4 is a block diagram of a key management function in a smart card for mobile communication.

5 is a flowchart illustrating a method of operating a key management function of the present invention.

<Description of Symbols for Main Parts of Drawings>

1, 2, 11, 12 applications, 3, 4, 13, 14 framework

5, 15, 21 Security Manager, 6, 16 Key Manager

7, 17 key storage, 8, 18 virtual machines

9, 19 card OS, 10, 20 smart card hardware

22 Card Manager, 23 Key Management Command Analyzer

24 key storage, 25 key withdrawal

Claims (9)

In the integrated key management method in smart card that supports multiple applications and supports multiple frameworks, it is possible to securely store keys with a shared key manager for efficiently storing, updating, and managing the keys used in each framework. Integrated key management method in a smart card supporting multiple applications, characterized in that it has a key storage. The smart card of claim 1, wherein the key manager and the key repository are accessed through a security manager and a card manager to securely manage and manage the plurality of frameworks. How to manage keys. 3. The method of claim 2, wherein the appropriate authority is given only after initialisation, external authentication. The method of claim 2, wherein the key manager has a key management command analyzer, key storage, and key retrieval to perform a corresponding function. 3. The method of claim 2, wherein the keystore comprises tables of authorization identification, framework classification, key version, key type, and key data. 6. The method of claim 5, wherein the access rights of the framework are determined by authorization identification. 6. The method of claim 5, wherein indicating that the framework is a key of the corresponding framework supports multiple applications. The integrated key management method of claim 5, wherein the use of the key is determined according to the framework classification, the key version, and the key type. The smart card for mobile communication according to claim 5, wherein in the smart card for mobile communication, a master key (K) for the general subscriber module, an operator parameter (OPc), a key for communication channel security, data security and message authentication used in a global platform (K1, K2, K3 Integrated key management method in a smart card that supports multiple applications, characterized in that it comprises a table for storing.