KR100629448B1 - System that integrates and manages security data in wireless internet platform - Google Patents

Abstract

The present invention relates to a system for integrating and managing secure data in a wireless Internet platform.

The present invention integrates security data in a wireless Internet platform to manage a series of processes for generating, updating, and destroying security data in a process of using a wireless Internet service through a security platform built in a platform layer of a mobile communication terminal. A system for managing data by using a predetermined protocol, comprising: a ground infrastructure for exchanging data wirelessly with the mobile terminal based on a predetermined protocol, the handoff and the radio supporting management function being included in the security stored in the mobile terminal; A wireless access network which relays the wireless Internet service after performing authentication using data; A telephone exchange network operated by a mobile telecommunications operator, which provides a voice telephone or data exchange service to an unspecified number of subscribers through an exchange office, and provides security for the use of the wireless Internet service to the mobile communication terminal requesting to provide the wireless Internet service. A mobile communication network for providing policy information required for a service; And a policy management server connected to the mobile communication network to manage a security policy of a mobile communication service provider.

According to the present invention, by integrating and managing the security data required in the process of running a plurality of application software, it is effective to effectively use the hardware resources of the mobile communication terminal, and effectively protect the security data against hacking attempts have.

Mobile terminal, secure data, platform

Description

System for Managing Security Data for Use in Wireless Internet Platform

 1 is a view schematically showing a process of using a wireless Internet service using a mobile communication terminal equipped with a security platform according to an embodiment of the present invention;

2 is a view showing simply the internal configuration of a mobile communication terminal equipped with a security platform according to an embodiment of the present invention,

3 is a diagram illustrating a security platform structure that resides in a platform layer and manages security data according to an embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

100: mobile communication terminal 102: wireless access network

104: mobile communication network 106: policy management server

108: manganese interworking device 110: WAP gateway

112: internet 114: content providing server

200: program storage unit 202: platform software

204: Security platform 206: application software

208: secure data 210: key input unit

212: display unit 214: mode state storage unit

216: microprocessor 218: digital signal processing unit

220: baseband converter 222: speaker

224: microphone 226: RF signal processing unit

228: antenna 300: application layer

302: Application Software 304: Policy Agent

306: platform layer 308: security platform

310: PKCS-based library 312: Secure Storage API

314: Resource Manager 316: Hardware Layer

318: Secure Storage HAL API 320: Secure Data

322: Policy Store

The present invention relates to a system for integrating and managing secure data in a wireless Internet platform. More specifically, among the plurality of application softwares present in the application layer of the mobile communication terminal, security data is generated when there is application software linked with security data including public certificate, subscriber information, and digital rights management (DRM) document. It is about a system that integrates and manages security data in a wireless Internet platform so that a series of processes for updating, destroying, and destroying are not managed by each application software corresponding to the security data but through a security platform built at the platform layer. .

Information and communication technology represented by the Internet and mobile communication is changing the life patterns of modern people. Nearly all homes, schools and offices use Internet-enabled personal computers, allowing them to learn information through Web sites, purchase goods through e-commerce, and exchange news via e-mail. Just a few years ago, people could only use voice communication-oriented mobile services using mobile terminals. Recently, however, a wireless internet service that can receive data communication service using the internet has appeared in a mobile communication terminal.

With the advent of wireless Internet services, mobile subscribers include mobile financial services, content providing services, and e-government services, as well as voice calling services that allow mobile subscribers to talk freely regardless of time and place. Various additional services are available. Here, the mobile financial service refers to a wireless Internet service that performs financial transactions such as wire transfer, bank transfer, and payment using a mobile communication terminal, and the content providing service downloads digital content including MP3 files and video files. It refers to a wireless Internet service that is played back by the mobile communication terminal. In addition, the e-government service refers to a wireless Internet service that can be issued a variety of civil complaints, such as resident registration, copy of family register, etc. without visiting the office.

In order to use these various wireless Internet services, the mobile communication terminal had to be equipped with application software and authentication information supporting each wireless Internet service. For example, in order to use mobile financial services and e-government services, it must be equipped with application software that can conduct financial transactions using public certificates and public certificates for user authentication, and issue and verify civil documents. In order to use the content providing service, user authentication is performed using the DRM document and the DRM document, which are allowed to legally use digital content including MP3 files, video files, and the like. Should be doing. In this process, conventionally, security data including public certificate, subscriber information, and DRM document, which is a kind of authentication information stored in a mobile communication terminal, are managed by respective application software. As described above, when the application software manages the corresponding security data, problems as described below occur.

First, there is a disadvantage that a user with an unpleasant purpose can easily steal the stored security data using a system software, debugging software, hacking software, etc. after cutting the mobile communication terminal. In addition, in the case of the public certificate of the security data is important information for performing the identification of the user in the process of using the mobile financial services, there is a problem that leads to serious financial accidents when the user is stolen by a user with a poor purpose.

In addition, there is a disadvantage in that a serious resource waste occurs in the process of running the application software because it manages the corresponding security data, rather than using the security data compatible with each application software.

In order to solve the above problems, the present invention provides a process for driving a plurality of application software by building a storage space for integrating and managing secure data in a mobile communication terminal and implementing a secure data platform for controlling the built storage space. Its purpose is to provide a system that integrates and manages secure data in a wireless Internet platform that integrates and manages required security data.

 Accordingly, according to a first object of the present invention, a series of processes of generating, updating, and destroying security data in a process of using a wireless Internet service is managed through a security platform built on a platform layer of a mobile communication terminal. A system for integrating and managing security data in a wireless internet platform, the system being a ground infrastructure that exchanges data wirelessly with the mobile communication terminal based on a predetermined protocol, and includes a handoff and wireless support management function. A wireless access network relaying the wireless Internet service after performing authentication using the security data stored in the mobile communication terminal; A telephone exchange network operated by a mobile telecommunications operator, which provides a voice telephone or data exchange service to an unspecified number of subscribers through an exchange office, and provides security for the use of the wireless Internet service to the mobile communication terminal requesting to provide the wireless Internet service. A mobile communication network for providing policy information required for a service; And a policy management server connected to the mobile communication network to manage a security policy of a mobile communication service provider.

In addition, according to a second object of the present invention, to manage a series of processes for generating, updating and destroying security data in the process of using the wireless Internet service, through a security platform built on the platform layer of the mobile communication terminal, A mobile communication terminal which integrates and manages secure data in a wireless internet platform, comprising: a button for inputting a number including a numeric key for inputting a telephone number and a key input unit for requesting to drive the application software linked with the security platform; A display unit which displays an operating state of the mobile communication terminal including a power supply state, a radio wave reception intensity, a date and a time, and displays the application software being driven; Platform software, which is a real time operating system (OS) that controls the operation of the application software, determines the work order of the application software, and controls input / output operations, mobile terminal call processing software, and mobile. A program storage unit including the application software for supporting the wireless Internet service including financial services, content providing services, and e-government services; A mode state storage unit which stores a current operation mode of the mobile communication terminal selected by the key input unit as a state flag; When the power is applied to the mobile communication terminal, the security platform mounted on the program storage unit is driven, the authentication process is performed by the driven security platform, and the wireless Internet service is provided in connection with the mobile communication network. A microprocessor unit for controlling an operation including a call waiting function and a call function of the mobile communication terminal; And a digital signal processor for coding or decoding a voice signal, functioning as an equalizer for multipath noise cancellation, and performing a sound data processing function and a decoding function for decoding the encoded wireless Internet service. The present invention provides a mobile communication terminal that integrates and manages secure data in a wireless Internet platform.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are used as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a diagram schematically illustrating a process of using a wireless Internet service using a mobile communication terminal equipped with a security platform according to an embodiment of the present invention.

Mobile communication system using a mobile communication terminal 100 equipped with a security platform according to an embodiment of the present invention is a wireless access network 102, mobile communication network 104, policy management server 106, network interworking device 108 ), The WAP gateway 110, the Internet 112, the content providing server 114, and the like.

In the following process, the security platform refers to a software module that manages security data stored in the mobile communication terminal 100. However, the security platform is mounted on the platform layer located between the hardware layer in which the hardware resources of the mobile communication terminal 100 exist and the application layer in which the application software resides. Here, the platform layer refers to a space where an operating system that manages hardware resources (eg, memory, microprocessor, etc.) of the mobile communication terminal 100 resides. In addition, the security data refers to data that can be accessed by authorized application software, and generically refers to data generated in the process of running the application software or downloaded in the process of using the wireless Internet service. For example, secure data refers to data such as public certificates, subscriber information, and DRM documents.

The mobile communication terminal 100 is connected to the mobile communication network 104 via the wireless access network 102 to provide a voice call function to perform a normal voice call wirelessly with another mobile communication terminal, It refers to a communication terminal that can use a mobile financial service, a content providing service, an e-government service, etc. in conjunction with a content providing server 114 of a content providing provider using a browser or the like.

However, in the present invention, the mobile communication terminal 100 does not directly manage the security data corresponding to each application software, but when the application software requests the security data from the security platform, the security platform transmits to the mobile communication terminal 100. The secure data is read from the provided predetermined storage space and transferred to the application software. In this process, the security platform interoperates with the policy management server 106 to provide information about update information on the security data, for example, whether an expiration date for the security data has arrived or whether it is necessary to update the security data. It will be checked periodically.

In addition, the mobile communication terminal 100 includes a wireless application protocol (WAP), which is an Internet access protocol, a Microsoft Internet Explorer (MIE) based on HTML using an HTTP protocol, and a handheld device transport protocol (HDPT). Protocol), NTT DOCOMO's i-Mode, or SK Telecom's 'NATE' to access the Internet 112 via the mobile communication network 104, and the content providing server connected to the Internet 112. (114). Among the Internet access protocols used by the mobile communication terminal 100, MIE uses a shortened version of HTML, which is abbreviated m-HTML. In the case of i-Mode, a language called compact HTML (c-HTML), which is a subset of HTML, is used. use.

That is, when the user drives the web browser provided in the mobile communication terminal 100, the mobile communication terminal 100 requests a connection to the content providing server 114 via the mobile communication network 104 (①), the connection The content providing server 114 that has received the request performs authentication using secure data stored in the mobile communication terminal 100, and after completing the authentication, provides a wireless Internet service to the mobile communication terminal 100 (②). Herein, the mobile communication terminal 100 receives update information on security data from the policy management server 106 according to a predetermined period set by the mobile communication provider (③).

The wireless access network 102 is a network termination device that is directly connected to the mobile communication terminal 100 by performing baseband signal processing, wired / wireless conversion, and transmitting / receiving a wireless signal. Each of the wireless access networks 102 is arranged in units of cells. Sends a call request and a wireless Internet service request generated by the communication terminal 100 to the mobile communication network 104 or transmits a call request of the mobile communication terminal 100 existing in a cell area under its control to the mobile communication network 104. Or, it refers to a device for performing location information registration to determine the location of the mobile communication terminal 100 existing in the cell area jurisdiction.

In addition, the wireless access network 104 relays the content providing server 114 and the mobile communication terminal 100, and allocates and releases a radio channel for the mobile communication terminal 100, and an inter-cell soft handoff for the mobile communication terminal 100. It performs soft hand off and hard hand off decisions, transcoding and vocoding, global positioning system (GPS) clock distribution, and operation and maintenance functions for the base station.

The mobile communication network 104 is a telephone exchange network operated by a mobile communication service provider and means a set of communication facilities that provide voice telephone or data exchange service to an unspecified number of subscribers through an exchange office, and is a CDMA-2000 service, a WCDMA service, and a mobile Internet. Provide a service and the like to the mobile communication terminal 100. The mobile communication network 104 performs basic and additional service processing, incoming and outgoing call processing of subscribers, location registration and handoff procedure processing, interworking with other networks, and subscription and release of wireless Internet services. The mobile communication network 104 of the IS-95 A / B / C system includes an Interconnection Network Subsystem (INS) that performs distributed call processing, a Central Control Subsystem (CCS) that performs centralization of operation and maintenance, and mobile communication. Includes a subsystem such as a Location Registration Subsystem (LRS) that performs the storage and management of information about subscribers. In addition, the mobile communication network 104 for the third and fourth generation may include an Asynchronous Transfer Mode (ATM) switch (not shown). The ATM switch increases the transmission rate and the efficiency of line use by packet transmission per cell. .

The policy management server 106 refers to a combination of hardware connected to the mobile communication network 104 to manage security policies of the mobile communication service provider and software installed and executed thereon. That is, the policy management server 106 determines whether or not to update the security data mounted on the mobile communication terminal 100 and informs, and when the updated security data exists, the function to download to the mobile communication terminal 100, platform It resides in a layer and performs a function including providing a security platform for managing security data of the mobile communication terminal 100.

Inter-working function (IWF) 108 provides an interface for data exchange between a wireless communication system and a wired communication system, and converts protocols, signals, and data into a form suitable for each network. In general, the manganese interworking device 108 connects the mobile communication network 104 and the Internet 112.

The WAP gateway 110 refers to hardware for relaying packet data wirelessly between the mobile communication terminal 100 and the content providing server 114 via the mobile communication network 104. The WAP gateway 110 performs a process such as communication code conversion or protocol conversion between the mobile communication network 104 and the Internet 112 in order to quickly retrieve and display information on the Internet 112. Perform a function of interconnecting 112; That is, the WAP gateway 110 converts the WAP protocol and the Internet TCP / IP (Transmission Control Protocol / Internet Protocol) protocol. Therefore, a Hyper Text Transfer Protocol (HTTP) protocol is used between the content providing server 114 and the WAP gateway 110 connected to the Internet 112, and a WAP protocol is provided between the mobile communication terminal 100 and the WAP gateway 110. Transmission and reception of data is performed by using a. The WAP gateway 110 converts a website address (URL) request from the mobile communication network 104 into an HTTP request according to the WAP protocol and then, from the content providing server 114 according to the HTTP protocol through the Internet 112, the website. Ask for an address.

In addition, the WAP gateway 110 converts the content of the HTML format received from the content providing server 114 to a binary code so that the mobile communication terminal 100 can recognize and transfer the content to the mobile communication terminal 100. do. Since the data passing through the WAP gateway 110 is converted into a binary code, there is an advantage that the amount of data is reduced and the burden on transmission to the mobile communication network 104 is reduced.

As described above, the WAP is a general term for a communication protocol that enables the Internet 112 to be used using a wireless communication terminal such as a mobile communication terminal 100 or a personal information terminal. In order to solve the communication speed problem of the relatively slow wireless communication, the WAP is converted into a text code on the Internet 112 and transmitted to the wireless communication terminal. In addition, since the WAP is designed considering the contents and the wireless communication terminal to use the WAP from the model design, the user can use the Internet 112 only with the wireless terminal.

The Internet 112 refers to a communication network that provides a connection path so that the mobile communication terminal 100 can transmit and receive packet data after connecting to the content providing server 114 via the mobile communication network 104.

The content providing server 114 is interworked with the Internet 112, and when a communication channel is allocated between the WAP gateway 110 and the mobile communication terminal 100, the content providing server 114 passes through the WAP gateway 108 to the mobile communication terminal 100. It refers to a combination of hardware that provides wireless Internet services, including mobile financial services, content providing services, e-government services, and software installed on them.

2 is a diagram schematically showing an internal configuration of a mobile communication terminal equipped with a security platform according to an embodiment of the present invention.

An internal configuration of a mobile communication terminal equipped with a security platform according to an exemplary embodiment of the present invention includes a program storage unit 200, a key input unit 210, a display unit 212, a mode state storage unit 214, and a microprocessor ( 216, a digital signal processor 218, a baseband converter 220, a speaker 222, a microphone 224, an RF signal processor 226, an antenna 228, and the like.

In the process to be described later, the security data is authentication information for authenticating whether a wireless communication service including a mobile financial service, a content providing service, and an e-government service can be legally used using a mobile communication terminal. It refers to data in electronic form including Identification Number, Electronic Serial Number (ESN), Personal Security Key, Authorized Certificate, Digital Rights Management (DRM) document, and various civil documents issued during the use of e-government services. .

In addition, the present invention monitors, encrypts, decrypts, and deletes the security data 208 generated by various application software 206 by the security platform 204 mounted on the mobile communication terminal. That is, in the present invention, the security platform 204 resides in the platform software 202 included in the platform layer at the time when the mobile communication terminal is driven to encrypt the security data 208 generated by the application software 206. After the program is stored in the program storage unit 200, and the application software 206 generates an event requiring the security data 208, the program storage unit 200 decrypts the security data 208 to the corresponding application software ( 206).

In addition, the mobile communication terminal according to an embodiment of the present invention is a PDA (Personal Digital Assistant), cellular phone, PCS (Personal Communication Service) phone, GSM (Global System for Mobile) phone, W-CDMA (Wideband CDMA) phone, CDMA-2000 phone, Mobile Broadband System (MBS) phone and the like. Here, MBS phone refers to a mobile phone to be used in the fourth generation system currently being discussed.

The program storage unit 200 is composed of EEPROM (Electrically Erasable), Flash Memory, Random Access Memory (RAM), and the like, and is mounted on an internal circuit board (not shown) of a mobile communication terminal. The program storage unit 200 is a platform software that is a real-time processing OS (Real Time Operating System) for driving the operation of the mobile communication terminal (Booting), determine the work order of the application software 206, and controls the input and output operations ( 202, a security platform 204 for generating, updating, and destroying the security data 208 required by the application software 206, mobile communication terminal call processing software, mobile financial services, Application software 206 for supporting a wireless Internet service including content providing service, e-government service, and the like is mounted, and these software are loaded and driven into RAM. The EEPROM stores NAM (Number Assignment Module) parameters and other data for storage, such as phone numbers, names, SMS messages, and when the mobile terminal is initialized, transmits location information including NAM parameters to the wireless access network. Register location information of the mobile communication terminal.

Here, the security platform 204 resides in the platform software 202 at the time when the mobile communication terminal is driven, monitors the security data 208 generated by the application software 206, encrypts and decrypts the security data, Delete, etc. The security platform 204 encrypts the security data 208 using a key generation application program interface (API) that generates an encryption key using an identification number unique to the mobile communication terminal in the process of encrypting the security data 208. The encrypted security data 208 is stored in the program storage 200.

The key input unit 210 includes a number key for inputting a number such as a telephone number, a button for inputting a character and a menu selection button, and a special key for easily accessing the wireless Internet. In addition, the key input unit 210 includes a function of manually driving the security platform 204 mounted in the program storage unit 200. The display unit 212 displays an operation state of the mobile communication terminal, including a state of use of power, reception strength of radio waves, and a date and time.

The mode state storage unit 214 stores the current operation mode of the mobile communication terminal selected by the key input unit 210 as a state flag (eg, 0, 1, 2,...). That is, the microprocessor 216 allocates the mode state storage unit 214 by assigning a unique state flag for each mode to distinguish the standby mode, the originating mode, the incoming mode, the search mode, the call mode, and the like of the mobile communication terminal. Update

The microprocessor 216 controls the overall operation of the mobile communication terminal with reference to the state flag stored in the mode state storage unit 214. That is, the microprocessor 216 drives the security platform 204 mounted in the program storage unit 200 when power is applied to the mobile communication terminal, and calls the mobile communication terminal according to the driven security platform 204. Operations including the standby function, call function, wireless Internet service use, and the like are controlled, and various application software 206 mounted in the program storage unit 200 is driven.

Further, in the present invention, the microprocessor 216 controls the security platform 204 to manage the security data 208 used in various application software 206. That is, microprocessor 216 runs platform software 202, resides in secure platform 204 in driven platform software 202, and for application software 206 that wishes to use secure data 208. It performs authentication and prevents access to security data 208 by unauthorized system software, debugging software, hacking software, and the like. In addition, the microprocessor 216 controls the encryption using the key generation API when storing the security data 208 in the program storage unit 200.

The digital signal processor (DSP) 218 is a digital signal processor that codes or decodes a voice signal, functions as an equalizer for multipath noise removal, and performs an acoustic data processing function. In addition, the digital signal processor 218 exchanges speech data with the baseband converter 220 and receives digital data RX DATA from the baseband converter 220.

The baseband converter 220 converts a signal transmitted / received between the RF signal processor 226 and the digital signal processor 218, the speaker 222, and the microphone 224 into a signal of a baseband band, and converts a digital-analog signal. It performs functions such as (DAC: Digital to Analog Conversion) and Analog to Digital Conversion (ADC). The baseband converter 220 transmits the transmission data TXIQ to the RF signal processor 226, and controls the power of the RF signal processor 226 or automatically controls its gain (AGC). In addition, the RF signal processor 226 receives the received signal RXIQ.

The RF signal processor 226 demodulates and amplifies the RF signal received from the antenna 228, modulates a transmission signal applied from the baseband converter 220, and transmits the modulated signal to the propagation space. The speaker 222 outputs sound data transmitted from the baseband converter 220 as an audible sound, and the microphone 224 converts a user's voice input into an electrical signal.

3 is a diagram illustrating a security platform structure that resides in a platform layer and manages security data according to an embodiment of the present invention.

The security platform structure, which resides in the platform layer and manages the security data according to the preferred embodiment of the present invention, includes an application layer 300, a platform layer 306, a hardware layer 316, and the like.

The application layer 300 manages the policy information of the mobile communication service provider required for authentication in the process of using the application software 302 and the wireless Internet service required to execute the wireless Internet service provided from the plurality of content providing servers 114. Policy agent 304 and the like. Here, the policy agent 304 refers to a software module that performs authentication required to open a data channel between the mobile communication terminal 100 and the mobile communication network 104.

The policy agent 304 periodically sends and receives a beacon signal with the mobile communication network 104 to determine the update cycle of the security data 320, and to download the updated security data 320 and the security platform 308. Function and so on.

The platform layer 306 loads the application software 302 into the platform software, and includes a security platform 308 for integrating and managing the security data 320 required in the process of running the loaded application software 302. .

The security platform 308 controls the use of hardware resources of the mobile communication terminal 100 in the process of executing the application software 302, and various application software regardless of the type of real-time processing operating system installed in the mobile communication terminal 100. A software module that supports 302 to be executed and ported.

The security platform 308 is a software module that controls operations such as generating, updating, and destroying the security data 320 while the application software 302 is running. The PKCS-based library 310 and the secure storage API ( 312) and resource manager 314 and the like.

Public-Key Cryptography System (PKCS) based library 310 refers to a software module made up of a series of informal standard protocols used within the industry to achieve secure information exchange on the Internet 112. Here, the PKCS standard ranges from PKCS # 1 to PKCS # 15.

The secure storage API 312 controls the operation of reading the security data 320 from the hardware layer 316 in conjunction with a system software such as a real time processing operating system or a database management system while the application software 302 is running. Means a software module. That is, the secure storage API 312 calls a function that provides a connection to a specific subroutine of the real-time processing operating system mounted in the mobile communication terminal 100 for reading the secure data 320 mounted in the hardware layer 316. Is implemented.

The resource manager 314 refers to a software module that monitors hardware resource usage of the mobile communication terminal 100 and controls hardware resource usage of the mobile communication terminal 100 in the process of executing the application software 302. That is, the resource manager 314 performs basic voice call processing functions, lower layer data communication functions, text message transmission and reception functions, and mobile terminal management functions, and transmits the security data 320 from the application software 302. After the control right is passed, the content control server 114 controls to play the content provided.

The hardware layer 316 refers to a set of electronic / mechanical devices such as the program storage unit 200, the key input unit 210, the display unit 212, and the microprocessor 216 of the mobile communication terminal 100. Storage HAL API 318, a plurality of secure data 320, policy store 322, and the like.

The secure storage HAL (Handset Adaptation Layer) API 318 supports a standard for a platform for a terminal manufacturer and refers to a software module that interfaces between hardware resources of the mobile communication terminal 100 and a real-time processing operating system. That is, the secure storage HAL API 318 integrates the security data 320 in the mobile communication terminal 100 having different hardware configurations for each manufacturer and stores the secure data 320 in the hardware layer 316, and the secure data stored in the hardware layer 316. Provide an environment for reading 320.

The security data 320 refers to various types of data requiring security generated in the process of running the application software 302. In other words, the security data 320 may include a mobile identification number (MIN), an electronic serial number (ESN), It refers to an electronic form of data that includes a personal security key, a public certificate, a digital rights management (DRM) document, various civil affairs documents issued during the use of e-government services, and PKCS-based keys.

The policy store 322 refers to a storage space that stores the policy information received from the policy agent 304.

The process of the security platform 308 reading the secure data 320 while the application software 302 is driven will be described below. Here, it is assumed that the application software 1 and the application software 2 are the application software 302 that reads the security data 320 in association with the PKCS-based library 310.

First, when the application software 302 is run, the security platform 308 requests a command for reading, generating, updating, or destroying the secure data 320. That is, when the user runs the application software 1 in the mobile communication terminal 100, the application software 1 generates a read command in the form of an electrical signal requesting the read of the secure data 320 required to drive the secure platform 308. To the security platform 308. The security platform 308 receiving the read command interworkes with the PKCS-based library 310 to obtain PKCS key information corresponding to the read command. The security platform 308 passes the PKCS key information to the secure storage HAL API 318, the secure storage HAL API 318 retrieves the secure data 320 corresponding to the read command in the hardware layer 316, and the PKCS The decryption operation is performed on the security data 320 retrieved from the hardware layer 316 using the PKCS key received from the base library 310, and the security data 320 that has been decrypted is transferred to the application software 1. .

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

As described above, according to the present invention, by integrating and managing the security data required in the process of running a plurality of application software, the efficient use of the hardware resources of the mobile communication terminal, and effectively protects the security data against hacking attempts It can work.

Claims (10)

Integrating and managing security data in the wireless Internet platform, which manages a series of processes for generating, updating, and destroying security data in the process of using the wireless Internet service through a security platform built on the platform layer of the mobile communication terminal. In the system, A ground infrastructure that exchanges data with the mobile terminal wirelessly based on a predetermined protocol, and includes a handoff and wireless support management function, and performs authentication using the security data stored in the mobile terminal. A wireless access network for relaying the wireless internet service afterwards; A telephone exchange network operated by a mobile telecommunications operator, which provides a voice telephone or data exchange service to an unspecified number of subscribers through an exchange office, and provides security for the use of the wireless Internet service to the mobile communication terminal requesting to provide the wireless Internet service. A mobile communication network for providing policy information required for a service; And A policy management server connected to the mobile communication network to manage a security policy of a mobile communication provider System for integrating and managing security data in a wireless Internet platform comprising a. The method of claim 1, The security data is data that can be accessed by the application software, and the authentication certificate required to use the service in the process of using the mobile financial service of the wireless Internet service, subscriber information required to use the wireless Internet service, MP3, video and A system for integrating and managing security data in a wireless Internet platform, characterized in that it comprises a DRM document issued by a content provider in using a content providing service provided with the same content. The method of claim 1, The policy management server determines whether to update the security data and notifies the mobile communication terminal, a function of reading whether the security data is a request for use of the mobile communication network by a legitimate user using the security data, and the mobile communication terminal A system for integrating and managing security data in a wireless internet platform, comprising: providing a security platform that resides in a platform layer of the platform and manages the security data. The method of claim 1, The mobile communication terminal requests the security data through the security platform, transfers the requested security data to the application software, and if there is the security data generated by the application software, PKCS (Public-Key). Cryptography System) is a system that integrates and manages secure data in a wireless Internet platform, characterized in that the terminal after storing the encryption process. Integrating and managing security data in the wireless Internet platform, which manages a series of processes for generating, updating, and destroying security data in the process of using the wireless Internet service through a security platform built on the platform layer of the mobile communication terminal. In the mobile communication terminal, A key input unit for requesting to drive the application software linked with the security platform and a button for text input including a numeric key for inputting a telephone number; A display unit which displays an operating state of the mobile communication terminal including a power supply state, a radio wave reception intensity, a date and a time, and displays the application software being driven; Platform software, which is a real time operating system (OS) that controls the operation of the application software, determines the work order of the application software, and controls input / output operations, mobile terminal call processing software, and mobile. A program storage unit including the application software for supporting the wireless Internet service including financial services, content providing services, and e-government services; A mode state storage unit which stores a current operation mode of the mobile communication terminal selected by the key input unit as a state flag; When the power is applied to the mobile communication terminal, the security platform mounted on the program storage unit is driven, the authentication process is performed by the driven security platform, and the wireless Internet service is provided in connection with the mobile communication network. A microprocessor unit for controlling an operation including a call waiting function and a call function of the mobile communication terminal; And A digital signal processor that codes or decodes a voice signal and functions as an equalizer for multipath noise cancellation, and performs a sound data processing function and a decoding function for decoding the encoded wireless Internet service. Mobile communication terminal to integrate and manage the security data in the wireless Internet platform comprising a. The method of claim 5, The security platform resides in the platform software when the mobile terminal is driven, encrypts the security data generated by the application software based on a Public-Key Cryptography System (PKCS), and stores the data in the program storage unit. When the application software generates an event requiring the security data, the program storage unit decrypts the security data and transfers the security data to the corresponding application software. Mobile terminal managed by. The method of claim 5, The security platform uses the security data to port the application layer on which the application software for executing the wireless Internet service is loaded, the platform layer for driving the platform software, and the hardware layer for managing resources of the mobile communication terminal. A mobile communication terminal for integrating and managing security data in a wireless internet platform characterized in that the porting). The method of claim 7, wherein The application layer manages policy information of a mobile communication service provider required for authentication in the process of using the application software and the wireless Internet service required to reproduce the wireless Internet service provided by a plurality of content providing servers in the mobile communication terminal. A mobile terminal for integrating and managing security data in a wireless Internet platform, characterized in that it comprises a policy agent. The method of claim 7, wherein The platform layer controls the hardware resources of the mobile communication terminal to call the subroutine of the platform software in the process of running the platform software, which is an operating system for driving the application software, and the application software to integrate and manage the security data. A mobile communication terminal that integrates and manages secure data in a wireless Internet platform, comprising a secure storage API (Application Programming Interface). The method of claim 7, wherein The hardware layer refers to a collection of electronic and mechanical devices, and includes a secure storage HAL (Handset Adaptation Layer) API, a plurality of security data, and a policy store. Communication terminal.

Images