JP2001034729A - Ic card - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent the illegal change of the access right by receiving a security attribute change inhibiting command from the outside, disabling the change of a flag bit and setting the following access right attribute change of a data file so as not to be received permanently in any case. SOLUTION: An attribute change command is received, the directory of the data file is read out (S13), next, a security attribute in the directory is checked and it is discriminated whether the certification condition of update access to the data file is satisfied in a present unlocked state or not (S17). When the certification condition of update access is satisfied and an attribute change inhibiting flag is '0', the security attribute is changed (S23). When the attribute change inhibiting flag is set, a response that an attribute change is refused because of a right reason is returned to a card terminal and command processing is finished.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an EEPROM (El
ectrically Erasable and Programable Read Only Memo
The present invention relates to a security mechanism for preventing a data file access right from being illegally changed for a portable information recording medium having a nonvolatile memory such as ry) or a so-called IC card.

[0002]

2. Description of the Related Art Recently, IC cards have been widely used as portable information recording media instead of magnetic cards. In particular,
Since an IC card with a built-in CPU can incorporate not only a function as an information recording medium but also an information processing function, it is expected to be used for an information processing system requiring high security. Such an IC
Normally, even if the card becomes usable, if the predetermined authentication condition is satisfied and the right to change the file attribute is recognized, the access right attribute of the file in the IC card can be changed. I have.

[0003]

With the conventional card, even if the card becomes usable, it is possible to change the access attribute of any important file as long as necessary authentication conditions are satisfied. Therefore, after the card is issued, there is room for altering the access attribute of the file for which the attribute is set to write-protected, and falsifying important data.

For example, as a use mode suitable for an IC card, after a first issuer (usual card issuer) records basic data necessary for using the card on the card, the second issuer or the third issuer can use the card. May issue data necessary for each service and issue it to the user as a versatile card. In such a case, the conventional card leaves room for the second and third issuers to falsify already recorded data.

The present invention has been made in view of such problems, and the use phase, that is, the first issuer sets the necessary basic data in the card, and the control program of the card functions correctly. It is an object of the present invention to realize a security mechanism that does not change the access right attribute of a file at any time after the state becomes possible.

In the following description, when a file is simply referred to as a file, the DF (Dedi
cated File) and EF (Elementary File).
It means only F.

[0007]

In order to solve the above-mentioned problems, according to the present invention, the management area of each file in a nonvolatile storage unit of an IC card indicates whether or not the access right attribute of the file can be changed. A flag bit is provided and a security attribute change prohibition command is defined. When an external security attribute change prohibition command is received, the flag bit is disabled and the access right attribute change of the data file is permanently made in any case. The gist is to realize a security mechanism so that it is not accepted.

Conventionally, the file access attribute could be changed even in the use phase as long as the authentication condition was satisfied. By providing the flag bit, it is possible to prevent the access right from being changed even if the authentication condition is satisfied.

By appropriately setting the flag bit at the time of issuing the card, it is possible to cope with a case where the access attribute of the file needs to be changed after the card is issued, depending on the use of the IC card. Even in such a case, once a security attribute change prohibition command is received at a certain point in time, subsequent access attribute changes cannot be made. Since this flag bit is set for each file, it can be used flexibly.

The file management area provided with the flag bit is an area that can be accessed only by the control unit of the IC card, and cannot be accessed from outside. It is impossible for the card issuer to manipulate the flag bit after issuing the card by a method other than the security attribute change prohibition command. It is impossible at all to change the flag bit from change prohibition to changeable.

[0011] In a second aspect of the present invention, all of the files located under the folder file that has received the security attribute change prohibition command, together with the folder file, change the access right attribute to the file. The gist is to realize a security mechanism so that it is not permanently accepted in any case.

In order to provide a plurality of services and complicated functions, a folder is defined as a container for collectively storing a plurality of files in an IC card, and a file system having a hierarchical structure is realized to store information. May be managed. In such a case, when it is more convenient to configure so that the access right attribute of the lower folder cannot be changed at the same time when the access right attribute of the folder is disabled. There is. Note that a folder is a type of file.

Further, according to a third aspect of the present invention, all the non-folder files included in the folder file that has received the security attribute change prohibition command are used together with the folder file to change the access right attribute to the file in the future. The gist of the present invention is to realize a security mechanism so as not to be permanently accepted in any case.

According to the third aspect, the effect of the security attribute change prohibition command can be limited to only non-folder files (EF defined in ISO7816-4) directly included in the folder. Such a mode is suitable for some service applications mounted on the IC card.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The embodiments according to the present invention will be described below in detail. FIG. 1 is a block diagram illustrating a state in which an IC card 10 according to the present embodiment is connected to a reader / writer device 20. In the IC card 10,
I / O interface 11, CPU 12, ROM1
3, a RAM 14, and an EEPROM 15 are built in.
The I / O interface 11 is an input / output circuit for transmitting and receiving data via the I / O line 30.
Numeral 12 exchanges data with the reader / writer device 20 through the I / O interface 11. ROM
A program to be executed by the CPU 12 is stored in the CPU 13, and the CPU 12 controls the IC card 10 based on the program. The RAM 14 is a temporary work area, and reads the contents of the EEPROM into this work area. The CPU performs data reference and data writing to this work area. EEPROM15
Is a memory in which original data to be recorded on the IC card 10 is stored.

The memories 13, 14, 1 in the IC card 10
5 are all performed via the CPU 12,
These memories cannot be directly accessed from outside. Instead, the reader / writer device 20 sends an IC
When a “command” having a predetermined format is given to the card 10, the CPU 12 interprets and executes the “command” to access the data memory 15 in the IC card 10. The result is returned to the reader / writer device 20 as a “response”.

FIG. 6 is a flowchart showing the operation of the control program for the IC card. When the card is inserted into the card terminal, the IC card is supplied with power from the card terminal, first performs a necessary initialization operation (S1), and then waits for a command from the card terminal (S3). If it is, command processing corresponding to the command is performed (S5). Then, the process returns to step S3 and waits for the next command again.

FIG. 3 is a diagram for explaining the EEPROM area 15 in more detail. The EEPROM area 15 is logically divided into a data area and a management area. The data area is an area that can be accessed from outside using a predetermined IC card command. Data is stored in a logical unit called a file and managed by a control program. On the other hand, the management area is the CPU 12 of the IC card.
Only the area accessed under the control of the control program. The management area holds management information of a file called a directory. In FIG. 3, directories corresponding to the respective files 1, 2, and 3 in the data area exist in the management area. As described above, when one file is generated in the data area, one directory for storing the management information of the file is formed in the management area.

FIG. 4 is a view for explaining the format of a directory in the management area. The directory includes attribute values such as the head address of the file, the size of the file, security attributes, file type, and check code, as well as a change prohibition flag. The security attribute stores a bit pattern indicating an unlocked state of a key that determines whether the file can be accessed. Details of this will be described later. The file type indicates whether the file is a normal data file or a file in which a password (key information) is recorded. The check code is a check code for checking whether directory information has been recorded or read without error.

FIG. 5 is a diagram showing a security management mechanism of the IC card. Hereinafter, the security management mechanism of the IC card according to the embodiment of the present invention will be described with reference to FIG.

FIG. 5A shows the unlocked state of the key at a certain point in the IC card. Although the figure shows an 8-bit bit pattern, each bit indicates the unlocked state of one specific key. If 1, the key corresponding to that bit is closed. If it is 0, it indicates that it is unlocked. Here, the key means a logical key, and if a password required by a specific key can be given to the card, the key can be opened. In this example, 8
Since it is a bit, eight keys are used. To open the key, the card is inserted into the card terminal and the card is checked for authentication, by checking some password files predetermined by the processing of the control program, or by using the application program of the card terminal. The control program checks the password entered by the user on the spot in response to the request. The result is held at a specific address in the RAM area 14 as the bit pattern of FIG. In FIG. 5, the first key, the second key, and the third key are unlocked,
It can be seen that the fourth to eighth keys remain closed.

FIG. 5B shows details of security attributes in the directory. The security attribute is represented by a set of three bit patterns indicating the unlocked state of the key that permits the read, write, and update operations on the file. Note that a bit pattern indicating an unlocked state that permits access is also referred to as authentication condition information. In the case of FIG. 5, read access is granted if the first key is unlocked. Write access is granted if the first and third keys are open.

When a request to access a certain file is received, the control program first compares the current unlocked bit pattern of the key with the unlocked bit pattern of the key that permits the access request. Determines whether an access request is allowed. In the case of FIG. 5, read and write access are permitted, but update access is not permitted.

The basics of the security management mechanism have been described above. Once the unlocked state that allows update access is created once, even after the card is issued, the authentication condition information for write / update access is rewritten to allow access to the file in the future. Can be set so that writing / updating can be easily performed anywhere. To prevent this, an attribute change prohibition flag is set in the directory. If the attribute change prohibition flag is set to 1, the security attribute of the file cannot be changed even if the update access authentication condition is satisfied.

FIG. 2 is a flowchart showing a command processing flow when an attribute change command is received in order to explain the function of the attribute change prohibition flag. When the attribute change command is received, the directory of the file is read out (S13). Next, the security attribute in the directory is checked, and it is determined whether or not the current unlocked state satisfies the authentication condition for update access of the file (S17). If the authentication condition for the update access is satisfied, it is checked in step S19 whether the attribute change prohibition flag is set. If the flag is 0, it means that the security attribute can be changed, and the security attribute is changed (S23). As a result, a response indicating that the attribute change has been normally performed as requested is returned to the card terminal, and the command processing is terminated (S29). If the attribute change prohibition flag is set, or if the authentication condition for update access is not satisfied, the process jumps to step 29 without performing step 23, and indicates that the attribute change has been rejected for an appropriate reason. A response is returned to the card terminal, and the command processing ends.

If this attribute prohibition flag is used properly,
In the case of issuing as a multipurpose card, the first issuer sets the access right attribute change prohibition flag of the file storing the monetary information to 1, and the access attribute of the monetary information file is changed in any case thereafter. Because it cannot be changed, high security can be maintained. In addition, by setting the access right attribute change prohibition flag of another file to 0, the convenience in issuing the file by the conventional technique is not impaired.

FIG. 7 is a flowchart showing the operation when the IC card receives the security attribute change prohibition command. When the IC card receives the security attribute change prohibition command, it first reads the directory of the file (S31). Next, the security attribute in the directory is checked to determine whether the current unlocked state satisfies the authentication condition for update access to the file (S37). If the authentication condition for update access is satisfied, the attribute change prohibition flag is set to 1 in step S43.
Set to. As a result, a response to the effect that the prohibited command has been normally performed as requested is returned to the card terminal, and the command processing is terminated (S53). If the authentication condition for update access is not satisfied in step S37, the process jumps to step S53, returns a response to the effect that the attribute change prohibition setting has been rejected for an appropriate reason to the card terminal, and ends the command processing.

FIG. 7 shows a flow in the case of an IC card in which the security attribute change prohibition command is controlled completely independently for each file. In the case of an IC card of a type in which a folder file is provided and files can be managed hierarchically. Is
As shown in FIG. 8, when a folder file is set by the security attribute change prohibition command, the operation when the security attribute change prohibition command is received may be determined so that all files located under the folder are affected. it can. Both are the steps of S47, that is,
"Set the change prohibition flag of the directory of the file included in the folder to 1; if there is a folder file in them, also set the change prohibition flag of the directory of the file included therein to 1." Others are the same except for the difference.

In the flow of FIG. 8, when the file that receives the security attribute change prohibition command is a folder file, the effect of receiving the command affects all lower-level files by relaying the lower-level folder files. I do. Apart from this, it is possible to realize the security mechanism of the IC card so that the effect of receiving the security attribute change prohibition command does not affect the lower folder files (and therefore does not affect the files located therebelow). It is possible. FIG. 9 shows an operation flow when such a security attribute change prohibition command of the IC card is received. In FIG. 9, step S47 of FIG.
Has been replaced by In S48, if the file that receives the security attribute change prohibition command is a folder file, the change prohibition flag is set to 1 only for files that are directly included in the file and are not folders. Whether a file is a folder file or not is identified by referring to the directory information of the file.

As described above, there are three types of implementation modes due to the difference in operation flow when a security attribute change prohibition command is received. In the above description, the description has been made with reference to FIGS. 3 and 4 on the assumption that the directory information is provided equally to all the files.
As an embodiment different from the above, only the folder file has the directory information having the configuration shown in FIG. 4, and the non-folder file has its own information without the change prohibition flag or both the change prohibition flag and the security attribute. It is also possible to realize a form in which the attribute value in the directory of the folder (parent folder) is used instead. That is, in this case, the security attribute change prohibition command is issued for the folder file. Then, the distinction between FIG. 7 and FIG. 9 disappears. S47 in FIG. 8 should be read as "set the change prohibition flags of the directories of all the lower-level folder files to 1". When a file that is not a folder receives a security attribute change command (in this case, the file has unique security attribute information), the step of S19 in FIG. 2 is to check the attribute change prohibition flag of the parent folder. Yes ".

[0031]

As described above, according to the security management mechanism of the present invention, it is possible to realize a security mechanism that does not change the access right attribute of the file at any time after the utilization phase.

According to this security mechanism, for example,
As a multi-purpose IC card, it is possible to prevent tampering of card data, which is a concern when a service provider other than the first card issuer makes settings related to services.
Also, even if key data (such as a password) is leaked, it is unlikely that the security attributes will be illegally changed and used illegally, and an IC card with extremely high security can be realized.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an IC card 10 according to an embodiment;
FIG. 2 is a block diagram showing a state where the writer device 20 is connected.

FIG. 2 illustrates the function of an attribute change prohibition flag.
It is the flowchart which showed the command processing flow at the time of receiving an attribute change command.

FIG. 3 is a diagram for explaining an EEPROM area 15 in more detail;

FIG. 4 is a diagram illustrating a format of a directory in a management area.

FIG. 5 is a diagram showing a security management mechanism of an IC card.

FIG. 6 is a flowchart showing the operation of a control program for an IC card.

FIG.

FIG.

FIG. 9 is a flowchart showing an operation of the IC card when a security attribute change prohibition command is received.

[Explanation of symbols]

 Reference Signs List 10 IC card 11 I / O interface 12 CPU 13 ROM 14 RAM 15 EEPROM 20 Reader / writer device 30 IO line

Claims (3)

[Claims] An IC that has a nonvolatile data storage unit and a control unit that writes or reads information to or from the storage unit, and that exchanges information with an externally connected device according to a predetermined protocol. In the card, a flag bit indicating whether or not the access right attribute of the file can be changed is provided in a management area of each file in the storage unit, and when a security attribute change prohibition command is externally received, the flag bit is changed. An IC card characterized in that it cannot be changed and that any subsequent change in the access right attribute of the file can not be accepted permanently in any case. 2. The IC card according to claim 1, wherein
All files located under the folder file that has received the security attribute change prohibition command, together with the folder file, can be permanently prevented from permanently changing any subsequent access right attribute change to the file. IC card. 3. The IC card according to claim 1, wherein
All non-folder files included in the folder file that has received the security attribute change prohibition command, together with the folder file, can be permanently prevented from permanently accepting subsequent access right attribute changes to the file. IC card.