JP2008181226A - Ic card - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a tamperproof IC card capable of preventing security information from being easily determined and read, even when the security information in a card is leaked. <P>SOLUTION: This IC card is provided with storage parts 204, 206 for storing prescribed data, and a means I/O for inputting and outputting data from/to the outside, and the prescribed data is stored in the storage parts after divided into a plurality of divided data. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a tamper resistant technique for an IC card.

  An IC card is a device that holds personal information that cannot be rewritten without permission, and that encrypts and decrypts data. For this reason, the data stored in the IC card is protected by the access rights for each directory and file, and is not illegally output to the outside. The IC card itself does not have a power supply, and is inserted into a reader / writer for the IC card (card reader), or if it is equipped with a wireless antenna, the power of the reader / writer is supplied by the induced current of the wireless antenna. Received supply and ready for operation. When the IC card becomes operable, it receives a command transmitted from the reader / writer and performs processing such as data transfer according to the command. Since the detailed specifications of the IC card are described in Non-Patent Document 1, detailed description thereof will be omitted.

  In this way, since an IC card has a program and important information sealed in an IC card chip, it is used for storing important information and performing cryptographic processing in the card. It was thought that the difficulty of decrypting ciphers was the same as the difficulty of decrypting cryptographic algorithms.

  However, by observing and analyzing the power consumption when the IC card is performing encryption processing, it is possible to estimate the encryption processing content and encryption key more easily than directly decrypting the encryption algorithm. There is sex. The power consumption can be checked by measuring a voltage change between the Vcc terminal and the ground terminal of the IC card using an oscilloscope. In this way, a method for extracting internal secret information by power analysis is called power analysis.

In this power analysis, since power is consumed according to the number of inverted bits (Humming weight), a proposal has been made to equalize changes in the number of inverted bits (Hamming distance) associated with changes in the program counter ( Patent Document 1). However, methods for decrypting important data such as security information are improving day by day, and if internal data is forcibly output due to abnormalities in the card's operating environment or intentional destructive attacks, security can be determined from the data structure. Information may be deciphered. For this reason, an IC card having stronger tamper resistance is required.
JP 2004-126841 A ISO7816

  It is an object of the present invention to provide an IC card having tamper resistance that prevents security information from being easily discriminated and decoded even if security information inside the card may leak.

  An invention according to an aspect of the present invention provides an IC card including a storage unit that stores predetermined data and a unit that performs input / output of data to / from the outside, wherein the predetermined data is divided into a plurality of divided data. After that, it is stored in the storage unit.

  According to the present invention, it is possible to provide an IC card having tamper resistance so that even if security information inside the card leaks, the security information cannot be easily discriminated and decoded.

Embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a schematic configuration of an IC card according to an embodiment of the present invention.
The IC card includes a card 101 and an IC card chip 102 mounted on the card 101. As shown in FIG. 1, generally, an IC card has a supply voltage terminal Vcc for supplying power to the IC card chip 102 and a IC card chip 102 at a position defined in the standard of ISO 7816 (Non-Patent Document 1). A ground terminal GND, a reset terminal RST for resetting the operation of the IC card chip 102, an input / output terminal I / O for exchanging data with the outside, and an IC card chip 102 is provided with a clock terminal CLK for inputting an operation clock, and is supplied with power from the reader / writer through these terminals to communicate with the reader / writer.

  The configuration of the IC card chip 102 is basically the same as that of a normal microcomputer. The configuration is shown in FIG. The IC card chip 102 includes a central processing unit (CPU) 201, a co-processor 202, a storage device 204, and an input / output (I / O) port 207, which are communicably connected via a data bus 203. Has been. The CPU 201 is a device that performs logical operations and arithmetic operations, and the storage device 204 is a device that stores programs and data. The input / output port 207 is a device that communicates with a reader / writer (not shown). The co-processor 202 is an apparatus that performs cryptographic processing itself or calculations necessary for cryptographic processing at high speed. For example, there are a special arithmetic device for performing a remainder operation of RSA encryption, an encryption device for performing processing of DES encryption, and the like. Some IC card processors do not have a co-processor.

  The storage device 204 includes a program storage unit 205 and a data storage unit 206. Since the program is basically not rewritten, the program storage unit 205 is composed of a ROM (Read Only Memory). In order to make the program updatable, it may be composed of an EEPROM (Electrical Erasable Programmable Read Only Memory) which is a nonvolatile memory. In this case, the EEPROM is shared with the data storage unit 206. Sometimes. The data storage unit 206 stores data that needs to be retained even when power is not supplied, such as prepaid guard balance data. Further, a RAM (Random Access Memory), which is a high-speed volatile memory that does not need to retain data even when power is not supplied, is used as a working memory (not shown).

  A method for protecting important data such as security information stored in the IC card configured as described above will be described. In the present embodiment, the protection method of security information stored in the IC card is changed from the conventional method, so that even when security information is leaked, it cannot be easily discriminated and deciphered. Specifically, it is as follows.

(1) First method
The security information is divided into predetermined units, and some calculation is performed between the divided security information, and the calculation result is stored in the data storage unit 206 as security information.
Specifically, for example, when the security information is 128 bits, the security information is divided into 64 bits (2), 32 bits (4), or 16 bits (8), An operation (logical operation such as exclusive OR (XOR) or algebraic operation) is performed between the security information after division (hereinafter referred to as “data after division”), and the operation result is used as security information in the data storage unit 206. To store. As described above, various methods can be applied to the division unit, the number of divisions, and the calculation method.
Thereby, even if security information is leaked, the tamper resistance is improved because the security information cannot be decrypted as it is.

(2) Second method
The security information and other information (for example, random numbers and other data strings) are calculated (the calculation content is the same as in the first method), and the calculation result is stored in the data storage unit 206. In this case, other information may be stored in another area of the data storage unit 206, or a dedicated area may be provided in another part of the IC card chip 102 and stored in that area. good. Further, it is preferable that the random number is changed at each time of security verification.

(3) Third method
The security information is divided into predetermined units and distributed and stored in the data storage unit 206. In this case, only important information (for example, PIN information) may be divided into several parts and distributed and stored in the data storage unit 206. The security information dividing method is the same as the first method. Further, the data storage unit 206 may have only one area.

(4) Fourth method
The security information is divided into predetermined units, and for example, the program storage unit 205 or an information control unit (not shown) stores the number of divisions and the offset information of each storage position of the divided data, and the divided data is converted into the offset information. And stored in the data storage unit 206. In the case of reading, the data after division may be read from the offset information and restored.

(5) Fifth method
The security information is divided into predetermined units and the data storage unit 206 is logically divided into several parts, and the security information divided together with the error detection / correction information is distributed and stored in a plurality of logically divided areas. .

(6) Sixth method
When collating the security information input from the outside with the internal security information, the unit and order of collation are made different for each collation. Here, the collating unit can be arbitrarily changed, for example, 4 bits or 8 bits. The collating order may be collated from the MSB (most significant bit), collated from the LSB (least significant bit), or collated from an intermediate bit. Both may be applied alone or in combination.

  In the above, in the first to fifth methods, since the security information is divided and stored, even if the information stored in the data storage unit 206 is leaked to the outside in the order in which it was stored, the data Does not make sense as. Therefore, since the information cannot be decrypted unless it is output by a regular output method, it is possible to provide an improved IC card having tamper resistance such that security information cannot be easily discriminated and decrypted.

  Further, in the sixth method, since the unit and order for collating the security information are changed for each collation, the security information cannot be easily deciphered even when attacked from the outside. Accordingly, it is possible to provide an improved IC card having tamper resistance that prevents security information from being easily identified and decoded.

  The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the invention at the stage of implementation. For example, the first to sixth methods described above are described as independent methods, but can be applied in appropriate combination. For example, the divided data may be processed by combining the first and second methods and further distributed and stored, or the divided data may be calculated by combining the first and sixth methods. The security information may be collated by the sixth method after storing and decrypting the security information at the time of collation. Further, the above embodiments include inventions at various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements.

  In addition, for example, even if some structural requirements are deleted from all the structural requirements shown in each embodiment, the problem described in the column of the problem to be solved by the invention can be solved, and the effect described in the effect of the invention Can be obtained as an invention.

It is a figure which shows schematic structure of the IC card which concerns on one Embodiment of this invention. 1 is a block diagram showing a schematic configuration of an IC card chip 102. FIG.

Explanation of symbols

Vcc ... supply voltage terminal GND ... ground terminal RST ... reset terminal I / O ... input / output terminal CLK ... clock terminal 101 ... card 102 ... chip for IC card 201 ... central processing unit (CPU)
202 ... Co-processor 203 ... Data bus 204 ... Storage device 205 ... Program storage unit 206 ... Data storage unit 207 ... I / O port

Claims (6)

In an IC card comprising a storage unit for storing predetermined data and means for inputting / outputting data to / from the outside,
The predetermined data is divided into a plurality of divided data and then stored in the storage unit. 2. The IC card according to claim 1, wherein the divided data is stored in the storage unit after a predetermined calculation is performed on the divided data. The IC card according to claim 1, wherein the divided data is stored in the storage unit after performing a predetermined calculation with data other than the divided data. 2. The IC card according to claim 1, wherein the divided data is distributed and stored in the storage unit. 2. The IC card according to claim 1, wherein error correction information is added to the divided data. In an IC card comprising a storage unit for storing predetermined data and means for inputting / outputting data to / from the outside,
An IC card characterized in that the unit and order of collation are changed for each collation when collating the validity of the predetermined data.

Images