KR101062099B1 - System and method for activation of applications stored on the card - Google Patents

Abstract

The present invention determines whether the application can be activated when it is requested to perform an application operation from a host, and if the activation is impossible, transmits an activation disable message to the host, and activates the application when an activation command is received from the host. A host for transmitting an activation authority request message to a corresponding service providing server when an activation disable message is received from the card, and transmitting an activation command to the card when activation data is received from the service providing server; When the message is received, the service providing server for transmitting the non-repudiation activation data request message to the application activation management server, the activation data request message is received from the service providing server In this case, it is configured as an application activation management server that generates an activation token and transmits activation data including the activation token to the host through the service providing server, and remotely uses the intellectual property including the application mounted on the card. (life cycle) can be managed to secure and manage intellectual property.

Card, application, active, service provider, host

Description

System and method for activating application stored card

The present invention relates to a system and a method for activating an application stored in a card. More specifically, when a request for performing an application operation is requested from a host, the card determines whether the application can be activated through the host. When the application activation management server requests the activation data, the application activation management server generates an activation token and transmits to the card through the host to activate the application stored in the card that the card activates the application. will be.

In general, smart cards are portable cards that incorporate microprocessors, memory and various applications using integrated circuit technology on a credit card sized plastic card.

These smart cards have a built-in cryptographic algorithm that enables identification, mutual authentication, encryption of I / O data, and storage of information.It provides high security, including financial settlement, program storage, public telephones, identification cards, and medical card applications. It is used in fields where portability and convenience are required.

With the development of card technology including smart cards and memory cards as described above, various applications are currently mounted on a card to provide useful services to users.

Card makers want to increase the added value of the card by mounting a variety of applications that can perform additional functions on the card, service providers that provide additional services to the user by using the applications on the card is an additional application Rather than paying the card manufacturer the fee for using the application in the card from when the loaded card is distributed to the market, the user wants to give the manufacturer from the time of using the application in the card for the first time.

However, in the past, the application cycle of the application of the card in order to generate revenue from the point of utilizing the application in all cases where the application is mounted on the card and distributed to the market or after the application is distributed to the market as needed. There was no way to manage the life cycle.

In addition, a problem arises in that a third party other than an authorized service provider randomly uses an application stored in a card.

In addition, there was a problem that unauthorized applications are copied by copying the performance request data transmitted between the host and the card.

An object of the present invention is to provide a system and method for activating an application stored in a card that can remotely manage a life cycle of an intellectual property including an application mounted on the card.

Another object of the present invention is to provide a system and method for activating an application stored in a card that can be used simultaneously by multiple authenticated service providers.

It is yet another object of the present invention to provide a system and method for activating an application stored on a card that prevents a third party who is not an authorized service provider from using the application stored on the card.

It is still another object of the present invention to provide a system and method for activating an application stored in a card which prevents an unauthorized application from copying and using operation performance request data transmitted between the host and the card.

According to an aspect of the present invention in order to achieve the above object, if it is requested to perform the application operation from the host to determine whether the application can be activated, if the activation is not possible transmits an activation disable message to the host, the activation from the host If a command is received, a card for activating the application, and if an activation disable message is received from the card, the activation authority request message is transmitted to the corresponding service providing server, and activation data is received from the service providing server when the activation data is received. A host for transmitting a command, a service provider server for transmitting a non-repudiation activation data request message to an application activation management server when an activation authority request message is received from the host; When an activation data request message is received from a server, an activation token is generated and activation of an application stored in a card including an application activation management server configured to transmit activation data including the activation token to the host through the service providing server. A system is provided.

The card may be a memory card in which one or more applications are stored.

The application operation execution request includes a session ID, a service provider ID, an application ID, and an activation token.

The card determines whether a corresponding service provider ID exists for an application requested to perform an operation, and if it exists, determines whether the application can be activated by using an activation token match.

In addition, when the card cannot be activated, the card generates a random number using a pre-stored key, encrypts the generated random number using a session key, and then encrypts the encrypted random number, a service provider ID, A non-activation message including an application ID, card identification information, and date is generated and transmitted to the host.

In addition, the card decodes the activation data included in the activation command received from the host, and determines whether the random number included in the decoded activation data corresponds to a pre-generated random number, and activates the corresponding application if it corresponds.

The host determines a corresponding service providing server by using a service provider ID in the non-activation message, and transmits an activation authority request message to the service providing server.

The application activation management server generates an activation token upon receipt of an activation data request message, stores activation token issuance history information, encrypts the activation data including the activation token, and transmits the activation data to the host through the service providing server. .

According to another aspect of the present invention, when it is requested to perform an application operation from the host, if it is impossible to activate by determining whether the corresponding application can be activated, when the activation is not transmitted to the host, when the activation command is received from the host A card for activating a corresponding application and a host for transmitting an activation data request message to an application activation management server when an activation disable message is received from the card, and transmitting an activation command to the card when activation data is received from the application activation management server. And an application activation management server that generates an activation token when an activation data request message is received from the host, and transmits activation data including the activation token to the host. A system is provided for activating an application stored on a card.

The host stores the URL of the application activation management server.

The card determines whether a corresponding service provider ID exists for an application requested to perform an operation, and if it exists, determines whether the application can be activated by using an activation token match.

In addition, the card decodes the activation data included in the activation command received from the host, and determines whether the random number included in the decoded activation data corresponds to a pre-generated random number, and activates the corresponding application if it corresponds.

The application activation management server generates an activation token upon receipt of an activation data request message, stores activation token issuance history information, encrypts the activation data including the activation token, and transmits the activation data to the host through the service providing server. .

According to another aspect of the present invention, in a card in which at least one application is stored, when a request for performing an application operation is requested from a host, a request is made to the activation agent to check the use authority of the corresponding service provider for the application, and from the activation agent When the unusable message is received, a card manager which generates an inactivation message including an encrypted random number and transmits it to the host. When a request for the authorization of the service provider is received from the card manager, a usage management table is used. And determining whether a service provider ID and an activation token match for the corresponding application, and if not, the activation agent transmits an unusable message to the card manager.

The card further includes an application agent for managing the stored application.

An application ID, a service provider ID, and activation token information are managed in the permission management table, and the activation token information includes the presence or absence of an activation token and an expiration date.

When the card manager receives an activation command from the host, the card manager decrypts the encrypted random number included in the activation command to determine whether the card manager corresponds to a random number generated in advance. Ask.

If the service provider ID and the activation token for the corresponding application match, the activation agent transmits an application activation request message to the application agent.

According to another aspect of the present invention, in a card in which at least one application is stored, when a request for performing an application operation is requested from a host, a request is made to the activation agent to check the use authority of the corresponding service provider for the application, and from the activation agent When the unavailable message is received, the card manager which generates an inactivation message including an encrypted random number and transmits it to the host, and when the service manager checks the authority to use the service provider is requested, checks the application agent managing the application. An activation agent for requesting confirmation of the use authority of the corresponding service provider by the checked application agent; And an application agent for determining whether to match the service provider ID and the activation token with respect to the corresponding application using the table, and transmitting a disable message to the card manager through the activation agent when the determination result is not matched.

According to another aspect of the present invention, when an activation token issuing history information is stored in a database, a communication unit for communication with a host or a service providing server, and an activation data request message is received, an activation token is generated and an activation token is issued to the database. An application activation management server including an activation token generation unit for updating history information and an encryption unit for encrypting activation data including an activation token generated by the activation token generation unit and transmitting the encryption data to the host or service providing server through the communication unit. Is provided.

According to another aspect of the invention, (a) when the card is requested to perform the application operation from the host determines whether the application can be activated, and if the activation is not possible to transmit a non-activation message to the host, (b (C) activating a non-repudiation signature upon receipt of an activation authority request message from the host when the host receives an activation disable message from the host; Generating and transmitting a data request message to an application activation management server; (d) the application activation management server generates an activation token upon receipt of an activation data request message from the service providing server, and includes the generated activation token; Encrypt the activation data Transmitting the activation data received through the service providing server to the card through the service providing server, and (f) the activation data from the host. And decoding the random number included in the decoded activation data and determining whether the random number corresponds to a pre-generated random number.

The step (a) may include establishing a session between the host and the card, transmitting, by the host, an application operation execution request message including a session ID, a service provider ID, an application ID, and an activation token to the card. Determining, by the card, whether the service provider ID exists in the permission table of the application ID, and if the service provider ID exists, whether the activation token matches the activation token of the application ID table of the application ID. Determining, if the activation token does not match, determining that activation of the corresponding application is impossible, generating a random number using a pre-stored key, and encrypting the generated random number by the card, No activation, including encrypted random numbers Generating the message by transmitting to the host.

If the service provider ID does not exist in the permission table of the application ID, an activation disable message including an encrypted random number is generated and transmitted to the host.

In the step (b), the host determines the corresponding service providing server by using the service provider ID of the non-activation message, and the host identification information, service providing server identification information, service provider ID, The activation authority request message including the application ID, the encrypted random number, the card number, and the date is transmitted.

In step (d), when an activation data request message is received from the service provider server, generating an activation token and storing activation token issuance history information, the generated activation token, host identification information, and service providing server identification. Encrypting activation data including information, an application ID, a service provider ID, card identification information, and a random number, and transmitting the encrypted encryption data to the host through the service providing server.

In step (f), when encrypted activation data is received from the host, decrypting the activation data and determining whether the random number of the decrypted activation data corresponds to the random number generated in step (a). In response to the determination result, the method may include activating a corresponding application.

According to another aspect of the invention, (a) when the card is requested to perform the application operation from the host determines whether the application can be activated, and if the activation is not possible to transmit a non-activation message to the host, (b Transmitting an activation data request message to an application activation management server when the host cannot receive an activation message, and (c) the application activation management server generates an activation token upon receipt of an activation data request message from the host; Encrypting activation data including the generated activation token and transmitting the encrypted activation data to the host; (d) transmitting, by the host, activation data received through the application activation management server to the card; and (e) Cards are Bowed from the Host A method for activating an application stored in a card is provided, the method comprising: decoding the torch data, determining whether the random number included in the decoded activation data corresponds to a pre-generated random number, and activating the corresponding application if it corresponds. .

According to another aspect of the present invention, in the method for activating the application requested from the host the card is stored in the application, (a) determining whether the application can be activated when it is requested to perform the application operation from the host, (b) if it is determined in step (a) that the application is not activated, generating and encrypting a random number, and transmitting a non-activation message including the encrypted random number to the host, (c) from the host Decoding activation data when activation data is received, and determining whether the random number included in the decoded activation data corresponds to the random number generated in step (b), and activating the corresponding application if it corresponds. Activation of applications stored on the card This method is provided for.

In step (a), establishing a session with the host, and when an application operation execution request message including a session ID, a service provider ID, an application ID, and an activation token is received from the host, use of the application ID Determining whether the service provider ID exists in an authorization table; and if the service provider ID exists, determining whether the activation token matches an activation token of the usage table of the application ID; If the activation token does not match, determining that the activation of the application is impossible.

According to another aspect of the present invention, in the method for issuing an activation token by the application activation management server, when the activation data request message is received from the host or service providing server, generates an activation token, and stores the activation token issuance history information. And an activation token issuing method for activating an application stored in the card, wherein the activation data including the generated activation token is encrypted and transmitted to the host or service providing server.

According to another aspect of the present invention, a computer-readable recording medium for activating an application stored in the card, (a) determining whether the application can be activated when the application operation is requested from the host; Function, (b) generating and encrypting a random number if the application is impossible to activate as a result of the determination of step (a), and transmitting a non-activation message including the encrypted random number to the host; and (c) the Decode the activation data when the activation data is received from the host, determine whether the random number included in the decoded activation data corresponds to the random number generated in step (b), and if so, activate the application. Computer with recorded program for execution The readable medium is provided.

According to another aspect of the present invention, a computer-readable recording medium for issuing an activation token for activating an application, and generates an activation token when an activation data request message is received from a host or service providing server. A computer readable recording medium having recorded thereon a program for executing a function of storing activation token issuance history information and encrypting activation data including the generated activation token and transmitting the encrypted activation data to the host or service providing server is provided. do.

As described above, according to the present invention, it is possible to remotely manage the life cycle of the intellectual property including the application mounted on the card, thereby enabling activation of the application stored in the card that can safely protect and manage the intellectual property. A system and method can be provided.

In addition, it is possible to provide a system and method for activating an application stored in a card that can be used by multiple authorized service providers simultaneously.

In addition, it is possible to provide a system and method for activating an application stored in a card that can prevent various attack attempts of a third party in transmission of important data.

It is also possible to provide a system and method for activation of an application stored on a card that prohibits a third party other than an authorized service provider from using the application stored on the card.

The foregoing and other objects, features, and advantages of the present invention will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: FIG.

1 is a diagram illustrating a system for activating an application stored in a card according to an embodiment of the present invention.

Referring to FIG. 1, a system for activating an application stored in a card requests to perform an operation of an application stored in the card 100 by establishing a session with the card 100 and the card 100 in which at least one application is stored. Host 110, the service providing server (120a, 120b, ..., 120n, hereinafter referred to as 120), and the application activation management server 130.

When the card 100 is requested to perform an application operation from the host 110, the card 100 determines whether the corresponding application can be activated, and if the activation is not possible, transmits an activation disable message to the host 110 and from the host 110. Activates the application when an activation command is received. In this case, the application operation execution request includes a session ID, a service provider ID, an application ID, an activation token, and the like.

The card 100 is a card in which one or more applications are stored, and may refer to a memory card or a smart card, and each application stored in the card 100 is mapped with an application ID, a service provider ID, and an activation token.

Therefore, the card 100 determines whether a corresponding service provider ID exists for the application requested to perform an operation, and if the present determination result exists, the card 100 determines whether the application can be activated using the matching token.

Through the service provider ID and activation token matching process, multiple authenticated service providers can simultaneously use an application mounted on the card 100.

When the card 100 cannot be activated, the card 100 generates a random number before transmitting an activation disable message to prevent reuse of activation data transmitted from the application activation management server 130.

Then, the card 100 encrypts the random number, generates an activation disable message including the encrypted random number, a service provider ID, an application ID, card identification information, and a date, and transmits the message to the host 110. do.

When the card 100 receives the activation data thereafter, the card 100 verifies whether the random number transmitted by the card 100 exists in the activation data to determine whether the data is copied. This can prevent other unauthorized applications or service providers from requesting activation by copying activation data.

When the host 110 receives an inactivation message from the card 100, the host 110 determines the corresponding service provision server 120 using the service provider ID in the inactivation message, and the determined service provision server 120 is determined. Send a request for activation permission to the server. The activation authority request message includes host identification information, service providing server identification information, a service provider ID, an application ID, an encrypted random number, a card number, a date, and the like.

Then, the host 110 transmits an activation command to the card 100 when activation data is received from the service providing server 130. Here, the activation command includes a service provider ID, an application ID, an encrypted random number, an activation token, and the like.

In addition, when the host 110 requests the card 100 to perform an application operation to prevent a third party who is not an authorized service provider from using an application in the card, the host 110 includes a service provider ID and an activation token. An application operation execution request message is transmitted. Then, the card 100 allows a specific algorithm to access the corresponding application using whether the service provider ID and the activation token match each other.

The host 110 may refer to a mobile communication terminal such as a PCS or a PDA or a wired communication terminal such as a computer.

When the service provider server 120 receives the activation authority request message from the host 110, the service provider server 120 generates an activation data request message with a non-repudiation signature and transmits it to the application activation management server 130. The service provider server 120 refers to a server that provides a service. In the case of mobile communication, the service provider server 120 may refer to a SKT server, a KTF server, or an LGT server.

The activation data request message includes host identification information, service provider ID, application ID, encrypted random number, card number, date, non-repudiation signature, and the like.

The application activation management server 130 generates an activation token when an activation data request message is received from the service providing server 120, and generates activation data including the activation token through the service providing server 120. Send to host 110.

That is, the application activation management server 130 generates an activation token according to the receipt of the activation data request message, stores activation token issuance history information, encrypts the activation data including the activation token, and the service providing server 120. Is transmitted to the host 110 through. Here, the activation data includes service providing server identification information, host identification information, card identification information, service provider ID, application ID, random number encrypted, and activation token.

The activation token issuance history information includes an issue date, an issue service provider ID, an issue application ID, an activation token data, and card identification information.

2 is a diagram illustrating a system for activating an application stored in a card according to another embodiment of the present invention.

Referring to FIG. 2, a system for activating an application stored in a card requests to perform an operation of an application stored in the card 100 by establishing a session with the card 100 and the card 100 in which at least one application is stored. Host 110, the application activation management server 130 is included.

The host 110 transmits an activation data request message to an application activation management server 130 when an activation disable message is received from the card 100, and when activation data is received from the application activation management server 130. The activation command is sent to the card 100. The host 110 stores the URL of the application activation management server 130.

The application activation management server 130 generates an activation token when an activation data request message is received from the host 110, and transmits activation data including the activation token to the host 110.

Since the card 100, the host 110, and the application activation management server 130 are the same as in FIG. 1, a detailed description thereof will be omitted.

3 is a block diagram schematically illustrating an internal configuration of a card for determining whether an application is activated according to the present invention, and FIG. 4 is a view illustrating a permission management table according to the present invention.

Referring to FIG. 3, the card 100 includes at least one or more applications 108 provided by a card issuer or service provider, one or more application agents 106 for managing each application 108, and an activation agent ( 104, a card manager 102.

The application 108 may include everything related to intellectual property, such as multimedia content.

When the card manager 102 is requested to perform an application operation from the host, the card manager 102 requests the activation agent 104 to check the use authority of the corresponding service provider for the corresponding application, and receives an unavailability message from the activation agent 104. In this case, a non-activation message including an encrypted random number is generated and transmitted to the host. The service authority check request of the corresponding service provider includes a service provider ID, an application ID, an activation token, and the like.

In addition, when the card manager 102 receives an activation command from the host, the card manager 102 decrypts the encrypted random number included in the activation command to determine whether the card manager 102 corresponds to a random number generated in advance. The agent 106 is requested to activate the corresponding application.

When the activation agent 104 receives a request for checking the permission of the service provider from the card manager 102, the activation agent 104 determines whether a service provider ID and an activation token for the corresponding application are matched using a permission management table. And if it is not matched with the result of the determination, transmits an unavailable message to the card manager 102.

Referring to FIG. 4 for the permission management table, an application ID, a service provider ID having permission to use a corresponding application, activation token information, and the like are registered in the permission management table. Here, the activation token information includes the existence of the activation token and the validity period of use of the activation token for each service provider.

The usage permission management table not only sets a right to use an application in a card but also manages a usage right for the corresponding application for each service provider.

The usage management table is managed by the activation agent 104.

In addition, the activation agent 104 transmits an application activation request message to the application agent 106 when the service provider ID and the activation token for the corresponding application match.

Then, the application agent 106 activates the corresponding application.

According to another embodiment of the present invention, the application agent 106 may manage the permission management table.

In this case, the activation agent 104 checks the application agent 106 that manages the application when the card manager 102 requests the service provider usage right confirmation, and corresponds to the checked application agent 106. Request to check the service provider's permission.

Then, the application agent 106 determines whether a service provider ID and an activation token for the corresponding application are matched using a usage management table, and if the match is not found, the card through the activation agent 104. The manager 102 transmits an unavailable message.

In addition, the application agent 106 operates the corresponding application when the service provider ID and the activation token for the corresponding application match.

5 is a block diagram schematically showing the configuration of the application activation management server according to the present invention, Figure 6 is a view showing the configuration of the database shown in FIG.

Referring to FIG. 5, the application activation management server 130 activates a database 132 in which activation token issuance history information is stored, a communication unit 134 for communication with a host or a service providing server, and an activation data request message. An activation token generation unit 136 for generating a token and updating activation token issuance history information in the database 132 and encrypting activation data including an activation token generated in the activation token generation unit 136, the communication unit ( An encryption unit 138 is transmitted to the host or service providing server through 134.

Referring to FIG. 6 for activation token issuance history information stored in the database 132, the activation token issuance history information stored in the database 132 may include an issue date, an issue service provider ID, an issue application ID, and an activation token data. , Card identification information.

The issuing date refers to the date of issuing the activation token, and the issuing service provider ID is a service provider ID requesting an activation token, an issuing application ID is an application ID to be activated, and the activation token data is specific data for each application and service provider.

The session key used by the encryption unit 138 to encrypt the activation data is the same key as the session key stored in the card. Therefore, the activation data encrypted by the encryption unit 138 is decrypted using the session key in the card.

7 is a flowchart illustrating a method of activating an application stored in a card according to an embodiment of the present invention.

Referring to FIG. 7, in a state in which a session between a card and a host is established (S700), the host transmits an application operation execution request message to the card (S702).

That is, when the session is established by the card and the host performing a login process, a session ID is generated.

Then, the host transmits an application operation execution request message including the generated session ID, an application ID to be activated, a service provider ID, and an activation token to the card.

After performing the operation S702, the card determines whether the application corresponding to the application ID included in the application operation execution request message can be activated (S704). That is, the card determines whether the application can be activated by checking the use authority of the service provider corresponding to the service provider ID for the application.

In other words, the card determines whether the service provider ID exists in the permission table of the application ID, and if the service provider ID exists, the activation token corresponds to an activation token of the permission table of the application ID. Determine if a match is found.

As a result of the determination, if the activation token is matched, it is determined that the corresponding application can be activated.

If it is determined in S704 that the corresponding application can be activated, the card activates the corresponding application to perform a function (S706).

If it is determined in S704 that the application cannot be activated, the card generates a random number using a predetermined algorithm and encrypts the generated random number using a session key (S708).

Thereafter, the card generates an activation disable message including the encrypted random number, a service provider ID, an application ID, card identification information, and a date and transmits the generated message to the host (S710).

Then, the host determines the corresponding service providing server using the service provider ID and transmits an activation authority request message to the determined service providing server (S712). The activation authority request message includes host identification information, service providing server identification information, a service provider ID, an application ID, an encrypted random number, a card number, a date, and the like.

When the S712 is performed, the service providing server signs a non-repudiation signature on the activation authority request message (S714), generates an activation data request message with the non-repudiation signature, and transmits the generated activation data request message to the application activation management server (S716).

Then, the application activation management server generates an activation token (S718), encrypts the activation data including the generated activation token and transmits it to the host through the service providing server (S720, S722).

That is, the application activation management server generates an activation token and stores activation token issuance history information. Then, the application activation management server encrypts the activation data including the generated activation token, host identification information, service provision server identification information, application ID, service provider ID, card identification information, and a random number to provide the service provision server. Send to the host via.

When the S722 is performed, the host transmits an activation command including the encrypted activation data to the card (S724), and the card decrypts the activation data (S726). The activation command is a command for activating an application corresponding to an application ID included in the activation data.

At this time, the card decrypts the activation data using the session key used for the random number encryption in S708.

Then, the card determines whether the random number included in the decoded activation data corresponds to the random number generated in S708 (S728).

If the random number corresponds to the determination result of S728, the card activates the corresponding application (S730).

If the random number does not correspond to the determination result of S728, the card transmits an activation disable message to the host (S732).

When the card cannot be activated, the card generates a random number before transmitting an activation deactivation message to prevent reuse of activation data transmitted from the application activation management server, and encrypts the generated random number. Send to the activation management server.

Thereafter, when the card receives the activation data, it is determined whether the random number transmitted by the card exists in the activation data to determine whether the data is copied. This can prevent other unauthorized applications or service providers from requesting activation by copying activation data.

Therefore, if the random number included in the activation data does not correspond, it is determined that another unauthorized application or another service provider has requested activation by copying the activation data and transmits an activation disable message.

By the above process, multiple authorized service providers can simultaneously use the application mounted on the card.

8 is a flowchart illustrating a method of activating an application stored in a card according to another embodiment of the present invention.

Referring to FIG. 8, in a state in which a session between a card and a host is established (S800), the host transmits an application operation execution request message to the card (S802).

Then, the card determines whether the application corresponding to the application ID included in the application operation execution request message can be activated (S804).

If it is determined that activation of the corresponding application is possible, the card activates the corresponding application to perform a function (S806).

If it is determined in S804 that the corresponding application cannot be activated, the card generates a random number using a predetermined algorithm and encrypts the generated random number using a session key (S808).

Thereafter, the card generates an activation disable message including the encrypted random number, a service provider ID, an application ID, card identification information, and a date and transmits the message to the host (S810).

Then, the host generates an activation data request message and transmits it to the application activation management server (S812).

Then, the application activation management server generates an activation token (S814), encrypts the activation data including the generated activation token and transmits it to the host (S816).

The host transmits an activation command including the encrypted activation data to the card (S818), and the card decrypts the activation data (S820).

Then, the card determines whether the random number included in the decoded activation data corresponds to the random number generated in S808 (S822).

If the random number corresponds to the determination result of S822, the card activates the corresponding application (S824). If not, the card transmits an activation disable message to the host (S826).

9 is a flowchart illustrating a method in which a card activates an application requested by a host according to an embodiment of the present invention.

Referring to FIG. 9, when the card manager is requested to perform an application operation from the host (S900), the card manager requests confirmation of the use authority of the corresponding service provider for the corresponding application (S902). The service authority check request of the corresponding service provider includes a service provider ID, an application ID, an activation token, and the like.

When S902 is performed, the activation agent determines whether the service provider ID exists in the permission table of the application ID (S904).

As a result of the determination, when the service provider ID exists, the activation agent determines whether the activation token matches the activation token of the usage permission table of the application ID (S906).

If the activation token is matched as a result of the determination, the activation agent requests the application activation from the corresponding application agent (S908), and the application agent operates the corresponding application (S910). That is, when the activation token is matched, the activation agent determines an application agent managing the application ID and transmits an application activation request message to the determined application agent.

If the activation token does not match as a result of the determination of S906, the activation agent transmits an unusable message to the card manager (S912).

Then, the card manager generates a random number using a predetermined algorithm (S914), and encrypts the generated random number using a session key (S916).

Thereafter, the card manager generates an activation disable message including the encrypted random number, a service provider ID, an application ID, card identification information, and a date and transmits the message to the host (S918, S920).

10 is a flowchart illustrating a method of activating an application requested by a host according to another embodiment of the present invention.

Referring to FIG. 10, when the card manager is requested to perform an application operation from the host (S1000), the card manager requests the activation agent to confirm the use authority of the corresponding service provider for the corresponding application (S1002). The service authority check request of the corresponding service provider includes a service provider ID, an application ID, an activation token, and the like.

Then, the activation agent checks the application agent managing the application ID (S1004), and requests the confirmed application agent to check the usage rights of the corresponding service provider for the corresponding application (S1006).

Then, the application agent determines whether the service provider ID exists in the permission table of the application ID (S1008).

As a result of the determination, when the service provider ID exists, the application agent determines whether the activation token matches the activation token of the usage permission table of the application ID (S1010).

If the determination result is that the activation token is matched, the application agent operates the corresponding application (S1012).

If the activation token is not matched as a result of the determination of S1010, the application agent transmits an unusable message to the card manager (S1014).

Then, the card manager generates a random number using a predetermined algorithm (S1016), and encrypts the generated random number using a session key (S1018).

Thereafter, the card manager generates an activation disable message including the encrypted random number, a service provider ID, an application ID, card identification information, and a date and transmits the message to the host (S1020 and S1022).

11 is a flowchart illustrating a method for issuing an activation token by an application activation management server according to the present invention.

Referring to FIG. 11, when an activation data request message is received from a host or a service providing server (S1100), the application activation management server generates an activation token corresponding to an application ID and a service provider ID included in the message (S1102). . That is, the application management server generates an activation token for granting the service provider permission to use the application.

Then, the application activation management server maps the generated activation token with the application ID and the service provider ID to store activation token issuance history information (S1104). At this time, the application activation management server stores the expiration date together with the issue date of the activation token.

After performing the operation S1104, the application management server encrypts the activation data including the generated activation token and transmits the encrypted activation data to the host or service providing server (S1106, S1108).

The application management server encrypts the activation data using a prestored session key, where the session key is the same key as the session key on the card.

As such, those skilled in the art will appreciate that the present invention can be implemented in other specific forms without changing the technical spirit or essential features thereof. Therefore, the above-described embodiments are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

As described above, a system and method for activating an application stored in a card according to the present invention remotely manages a life cycle of an intellectual property including an application mounted on a card, and authenticates an application mounted on the card. It allows multiple service providers to use it at the same time, making it suitable for technologies that can prevent piracy of applications on the card.

1 is a diagram illustrating a system for activating an application stored in a card according to an embodiment of the present invention.

2 is a diagram illustrating a system for activating an application stored in a card according to another embodiment of the present invention.

Figure 3 is a block diagram schematically showing the internal configuration of the card for determining whether to activate the application according to the present invention.

4 is a diagram illustrating a license management table according to the present invention;

5 is a block diagram schematically showing the configuration of an application activation management server according to the present invention.

FIG. 6 is a diagram showing the configuration of the database shown in FIG. 5; FIG.

7 is a flowchart illustrating a method of activating an application stored in a card according to an embodiment of the present invention.

8 is a flowchart illustrating a method of activating an application stored in a card according to an embodiment of the present invention.

9 is a flow chart illustrating a method for a card to activate an application requested by a host according to one embodiment of the invention.

10 is a flow chart illustrating a method for a card to activate an application requested by a host according to another embodiment of the present invention.

11 is a flowchart illustrating a method for issuing an activation token by an application activation management server according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100: card 102: card manager

104: activation agent 106: application agent

108: application 110: host

120: service providing server 130: application activation management server

132: activation token issuance history information DB 134: communication unit

136: activation token generation unit 138: encryption unit

Claims (41)

A card for determining whether to activate the corresponding application when the application operation is requested from the host, and if the activation is not possible, transmitting a non-activation message to the host, and activating the corresponding application when an activation command is received from the host; A host for transmitting an activation authority request message to a corresponding service providing server when an activation disable message is received from the card, and transmitting an activation command to the card when activation data is received from the service providing server; A service providing server for transmitting an activation data request message with a non-repudiation signature to an application activation management server when an activation authority request message is received from the host; and An application activation management server generating an activation token when an activation data request message is received from the service providing server, and transmitting activation data including the activation token to the host through the service providing server; System for activation of the application stored in the card comprising a. The method of claim 1, And the card is a memory card in which one or more applications are stored. The method of claim 1, The application operation execution request includes a session ID, a service provider ID, an application ID, and an activation token. The method of claim 1, The card determines whether a corresponding service provider ID exists for an application requested to perform an operation, and if it exists, determining whether the application can be activated based on whether an activation token is matched. System for activation of applications. The method of claim 1, If the card cannot be activated, the card generates a random number using a prestored key, encrypts the generated random number using a session key, and then encrypts the encrypted random number, a service provider ID, and an application ID. And generating a non-activation message including card identification information and a date, and transmitting the generated non-activation message to the host. The method of claim 1, The card decodes the activation data included in the activation command received from the host, and determines whether the random number included in the decoded activation data corresponds to a pre-generated random number, and if so, activates the corresponding application. System for activation of applications stored on the card. The method of claim 1, The activation command includes a service provider ID, an application ID, a random number encrypted, and an activation token. The method of claim 1, The activation data includes service providing server identification information, host identification information, card identification information, service provider ID, application ID, random number encrypted, activation token. The method of claim 1, The host determines a corresponding service providing server by using a service provider ID in the non-activation message, and transmits an activation authority request message to the service providing server. The method of claim 1, The activation authority request message includes a host identification information, a service providing server identification information, a service provider ID, an application ID, an encrypted random number, a card number, and a date. The method of claim 1, The activation data request message includes a host identification information, a service provider ID, an application ID, an encrypted random number, a card number, a date, and a non-repudiation signature. The method of claim 1, The application activation management server generates an activation token upon receipt of an activation data request message, stores activation token issuance history information, encrypts activation data including the activation token, and transmits the activation data to the host through the service providing server. System for activation of the application stored in the card, characterized in that. The method of claim 12, The activation token issuance history information includes the issue date, service provider ID, application ID, activation token data, card number, the system for activation of the application stored in the card. A card for determining whether to activate the corresponding application when it is requested to perform an application operation from a host, and if the activation is not possible, transmitting a non-activation message to the host and activating the corresponding application when an activation command is received from the host; A host transmitting an activation data request message to an application activation management server when an activation disable message is received from the card, and transmitting an activation command to the card when activation data is received from the application activation management server; and An application activation management server that generates an activation token when an activation data request message is received from the host and transmits activation data including the activation token to the host; System for activation of the application stored in the card comprising a. The method of claim 14, And the URL of the application activation management server is stored in the host. A card in which at least one application is stored, When the host is requested to perform an application operation, it requests the activation agent to check the usage rights of the corresponding service provider for the corresponding application, and when the disable message is received from the activation agent, generates an inactivation message including an encrypted random number. A card manager for transmitting to the host; and When a request for checking the use authority of the corresponding service provider is received from the card manager, it is determined whether a service provider ID and an activation token for the corresponding application are matched using a use management table. An activating agent for sending an unavailable message to the manager; Card containing. The method of claim 16, The card further comprises an application agent for managing the stored application. The method of claim 16, The service permission check request of the service provider comprises a service provider ID, application ID, activation token. The method of claim 16 And the license management table is managed by the activation agent. The method of claim 16 An application ID, a service provider ID, and activation token information are managed in the permission management table, and the activation token information includes an existence of an activation token and a validity period. The method of claim 16 When the card manager receives an activation command from the host, the card manager decrypts the encrypted random number included in the activation command to determine whether the card manager corresponds to a random number generated in advance. Card characterized in that for requesting. The method of claim 16 And the activation agent transmits an application activation request message to the application agent when the service provider ID and the activation token for the corresponding application match. A card in which at least one application is stored, When the host is requested to perform an application operation, it requests the activation agent to check the usage rights of the corresponding service provider for the corresponding application, and when the disable message is received from the activation agent, generates an inactivation message including an encrypted random number. A card manager for transmitting to the host; An activation agent for checking an application agent managing a corresponding application and requesting the confirmed application agent to check a usage right of the corresponding service provider when a service provider usage right confirmation is requested from the card manager; and When the service agent use authority check is requested from the activation agent, it is determined whether a service provider ID and an activation token for the corresponding application are matched using a usage management management table. An application agent for transmitting an unavailable message to the card manager; Card containing. 24. The method of claim 23, The license management table for each application is managed by the corresponding application agent. 24. The method of claim 23, When the card manager receives an activation command from the host, the card manager decrypts the encrypted random number included in the activation command to determine whether the card manager corresponds to a random number generated in advance. Card characterized in that for requesting. 24. The method of claim 23, And the application agent operates the application when the service provider ID and the activation token for the application match. A database storing activation token issuance history information; A communication unit for communicating with a host or service providing server; An activation token generator for generating an activation token and updating activation token issuance history information in the database when an activation data request message is received; and An encryption unit for encrypting activation data including an activation token generated by the activation token generator and transmitting the encrypted encryption data to the host or service providing server through the communication unit; Application activation management server comprising a. (a) determining whether the application can be activated when a card is requested to perform an application operation from a host, and if the card cannot be activated, transmitting a non-activation message to the host; (b) if the host receives an activation disable message, transmitting an activation authority request message to a corresponding service providing server; (c) generating, by the service providing server, an activation data request message having a non-repudiation signature upon receipt of an activation authority request message from a host, and transmitting the activation data request message to an application activation management server; (d) the application activation management server generates an activation token upon receipt of an activation data request message from the service providing server, encrypts the activation data including the generated activation token, and sends it to the host through the service providing server. Transmitting; (e) the host transmitting activation data received through the service providing server to the card; and (f) the card decrypting activation data from the host, determining whether the random number included in the decrypted activation data corresponds to a pre-generated random number, and activating a corresponding application if the card corresponds; Method for activating the application stored in the card comprising a. The method of claim 28, In step (a), Establishing a session between the host and a card; Sending, by the host, an application operation execution request message including a session ID, a service provider ID, an application ID, and an activation token to the card; Determining, by the card, whether the service provider ID exists in the permission table of the application ID; Determining that the activation token matches the activation token of the application permission table of the application ID when the service provider ID exists as a result of the determination; If it is determined that the activation token does not match, determining that activation of the corresponding application is impossible and generating a random number using a pre-stored key; and And encrypting, by the card, the generated random number, and generating an inactivation message including the encrypted random number to the host. 2. The method of claim 28, If the service provider ID does not exist in the permission table of the application ID, generating a non-activation message including an encrypted random number and transmitting to the host. The method of claim 28, And activating the corresponding application when the activation token is matched. The method of claim 28, In the step (b), the host determines the corresponding service providing server by using the service provider ID of the non-activation message, and the host identification information, service providing server identification information, service provider ID, A method for activating an application stored in a card, characterized by transmitting an activation authority request message including an application ID, an encrypted random number, a card number, and a date. The method of claim 28, In step (d), Generating an activation token and storing activation token issuance history information when an activation data request message is received from the service provider server; Encrypting activation data including the generated activation token, host identification information, service providing server identification information, application ID, service provider ID, card identification information, and a random number, and transmitting the encrypted encryption data to the host through the service providing server; Method for activating the application stored in the card comprising a. The method of claim 28, Step (f), Decrypting the activation data when encrypted activation data is received from the host; Determining whether the random number of the decoded activation data corresponds to the random number generated in step (a); and Activating an application stored in the card, if the determination result corresponds. (a) determining whether the application can be activated when a card is requested to perform an application operation from a host, and if the card cannot be activated, transmitting a non-activation message to the host; (b) the host transmitting an activation data request message to an application activation management server when an activation disable message is received; (c) generating, by the application activation management server, an activation token in response to receiving an activation data request message from the host, encrypting activation data including the generated activation token and transmitting the encrypted activation data to the host; (d) the host transmitting activation data received through the application activation management server to the card; and (e) the card decrypting activation data from the host, determining whether the random number included in the decrypted activation data corresponds to a pre-generated random number, and activating a corresponding application if the card corresponds; Method for activating the application stored in the card comprising a. A method in which a card in which an application is stored activates an application requested from a host, the method comprising: (a) determining, by the card manager, whether the application can be activated through an activation agent when an application operation is requested from the host; (b) the card manager generating and encrypting a random number when the application cannot be activated as a result of the determination of step (a), and transmitting an unactivation message including the encrypted random number to the host; And (c) when activation data is received from the host, the card manager decrypts the activation data through the activation agent, and the random number included in the decrypted activation data corresponds to the random number generated in step (b). Determining whether it is activated and activating the corresponding application if it is appropriate; Method for activating the application stored in the card comprising a. The method of claim 36, The method for activating the application stored in the card further comprising the step of activating the application when the determination of the step (a) possible activation of the application. The method of claim 36, In step (a), Establishing a session with the host; When an application operation execution request message including a session ID, a service provider ID, an application ID, and an activation token is received from the host, determining whether the service provider ID exists in a permission table of the application ID; Determining that the activation token matches the activation token of the application permission table of the application ID when the service provider ID exists as a result of the determination; And determining that the activation of the corresponding application is impossible if the activation token is not matched as a result of the determination. In the method for the application activation management server issuing an activation token, Generating an activation token when the activation data request message is received from the host or the service providing server, and storing activation token issuance history information; Encrypting activation data including the generated activation token and transmitting the encrypted activation data to the host or service providing server; Activation token issuing method for activation of the application stored in the card comprising a. 40. The method of claim 39, The activation data is encrypted using a pre-stored session key, the session key is an activation token issuing method for activation of the application stored in the card, characterized in that the same key. A recording medium on which a program for activating an application stored on a card is recorded. (a) determining, by the card manager, whether the application can be activated through an activation agent when it is requested to perform an application operation from a host; (b) the card manager generating and encrypting a random number when the application cannot be activated as a result of the determination of step (a), and transmitting an unactivation message including the encrypted random number to the host; And (c) when activation data is received from the host, the card manager decrypts the activation data through the activation agent, and the random number included in the decrypted activation data corresponds to the random number generated in step (b). Determining whether it is activated and activating the corresponding application if it is appropriate; The recording medium on which a program for executing the program is recorded.

Images