JP2010237772A - Memory device, memory authentication system, and memory authentication program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a memory device which can perform write and read authentication to a semiconductor memory by using an access means mounted as a standard on an external device. <P>SOLUTION: A non-contact IC card 10 is configured to accept read and write from a card processing device 20. The non-contact IC card 10 includes: a nonvolatile memory 12 which can perform the read and write of information only when the authentication of read and write by the card processing device 20 is performed; a register for data exchange 13 which can perform the read and write of first authentication information and second authentication information related to authentication; an authentication information generation part 14a for generating the first authentication information to write the generated first authentication information into the register for data exchange 13; and an authentication control part 14b for reading the second authentication information, which is written into the register for data exchange 13 from the card processing device 20, from the register for data exchange 13 to perform authentication based on the read second authentication information. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a memory device, a memory authentication system, and a memory authentication program.

  In recent years, semiconductor memories have been widely used in non-contact type IC cards, mobile phones, portable game machine media, etc., as the density and size of semiconductor memories have increased. This semiconductor memory stores data that should be protected from unauthorized access by third parties, such as IC card and mobile phone ID numbers, user personal information, and data that should be protected from unauthorized copying, such as game content. Is done. Therefore, in order to protect these data stored in the semiconductor memory from unauthorized access and unauthorized copying, the following protection methods are conventionally used.

  For example, there is a method of performing authentication between the semiconductor memory and the external device in order to prevent unauthorized access to the semiconductor memory by the external device. As this authentication method, for example, there is a challenge / response method. In this challenge / response method, when an external device that attempts to access the semiconductor memory transmits an authentication request to the semiconductor memory, the semiconductor memory transmits challenge data such as a random number to the external device. Based on the challenge data, the external device generates response data using a specific function, and transmits the generated response data to the semiconductor memory. The semiconductor memory compares the response data separately generated from the challenge data transmitted to the external device and the response data received from the external device, and authenticates the external device based on whether or not they match. As a result, only an external device having a specific function can access the semiconductor memory (see, for example, Patent Document 1).

  In addition, when data is communicated between a semiconductor memory and an external device, the data itself is encrypted using a cryptographic technique such as a public key cryptosystem, so that data can be copied or viewed by a third party. There are also used a method for preventing it, a method for prohibiting the use of illegally copied data without an electronic signature, and the like.

JP2007-183991 (paragraph 0057)

  However, in the conventional challenge / response method as described above, it is necessary to use an access means different from the access means to the memory in the normal memory system, for example, a command dedicated for authentication by the challenge / response method must be used. . Therefore, it is difficult to perform authentication using a conventional challenge / response method in a device that uses a communication standard that does not have an authentication-dedicated command, such as the NFC (Near Field Communication) standard.

  The present invention has been made in view of the above, and a memory device and a memory that can perform authentication of writing and reading with respect to a semiconductor memory by using an access unit that is mounted on an external device as a standard An object is to provide an authentication system and a memory authentication program.

  According to the memory device according to claim 1, the memory authentication system according to claim 3, or the memory authentication program according to claim 7, when the memory device is authenticated for reading and writing by an external device Only the first storage means capable of reading and writing information, and the second storage means capable of reading and writing the first authentication information and the second authentication information related to authentication, and the first storage means from the second storage means to the first Authentication is performed based on the second authentication information written in the second storage means by the external device that has read the authentication information. Accordingly, it is possible to authenticate writing and reading with respect to the memory device via the second storage means by using the access means that is mounted as standard in the external device.

  According to the memory device according to claim 2 or the memory authentication system according to claim 4, the memory device includes a first storage unit capable of reading and writing information, first authentication information related to authentication, and And a second storage means capable of reading and writing the second authentication information, and the external device writes the second authentication written in the second storage means by the memory device that has read the first authentication information from the second storage means Authenticate based on information. Therefore, it is possible to authenticate the memory device via the second storage means using the access means that is standardly mounted on the external device.

  According to the memory authentication system of claim 5, the first storage means is a nonvolatile memory, and the second storage means is a register to which a memory address outside the memory space of the nonvolatile memory is assigned. By using a means for accessing the nonvolatile memory, which is standardly mounted on the external device, it is possible to authenticate writing and reading with respect to the memory device via the register.

  According to the memory authentication system of the sixth aspect, the non-volatile memory includes a dummy memory to which the same memory address as that of the register is allocated, and the authentication information generation unit and the authentication request unit write the authentication information in the register. When writing, the dummy memory is also written. As a result, even when information is written to the register, the same power consumption and writing time as when writing information to the nonvolatile memory can be generated, and the first authentication is performed based on the power consumption and writing time observed from the outside. It is possible to prevent the presence or absence of execution of processing related to authentication such as information output.

It is the block diagram which showed the electrical structure of the memory authentication system functionally. It is the figure which illustrated notionally the circuit structure of the access management part. It is a flowchart of an authentication process. It is the block diagram which showed the electric structure of the non-contact IC card functionally. 2 is a diagram conceptually showing a bus configuration of a bus A. FIG. It is a timing chart of the system bus in reading from the nonvolatile memory. It is a timing chart of the system bus in writing to the nonvolatile memory. It is a flowchart of an authentication process. FIG. 9 is a block diagram functionally conceptually showing an electrical configuration of a memory authentication system according to a third embodiment. It is a flowchart of an authentication process.

  Hereinafter, embodiments of a memory device, a memory authentication system, and a memory authentication program according to the present invention will be described in detail with reference to the accompanying drawings.

  First, [I] the specific contents of each embodiment will be described sequentially, and then [II] modifications to each embodiment will be described. However, the present invention is not limited to each embodiment. The application target of the memory device, the memory authentication system, and the memory authentication program is arbitrary. For example, the memory device according to the present invention is applied to a memory device such as a contactless IC card, a portable information terminal, and a medium for a portable game machine. can do. The memory authentication system according to the present invention includes a non-contact IC card, a portable information terminal, a portable game machine medium, or the like as a memory device, and a card processing device, a terminal information processing device as an external device corresponding to the memory device. Or a memory authentication system including a portable game machine or the like. In the following embodiments, a case will be described in which a non-contact IC card is used as a memory device and a card processing device and a card processing system are used as external devices.

[I] Specific contents of each embodiment First, specific contents of each embodiment will be described.

[Embodiment 1]
First, the first embodiment will be described. In this form, authentication of reading and writing by an external device with respect to the memory device is performed.

(Constitution)
First, the configuration of the memory authentication system will be described. FIG. 1 is a functional block diagram showing the electrical configuration of the memory authentication system. As shown in FIG. 1, the memory authentication system 1 includes a non-contact IC card 10, a card processing device 20, and a card processing system 30.

(Configuration-Non-contact IC card)
The non-contact IC card 10 is a memory device that receives and reads data from the card processing device 20, and includes a communication unit 11, a nonvolatile memory 12, a data exchange register 13, and a control unit 14 via a system bus 15. It is configured to be communicable.

  The communication unit 11 is a communication unit that performs non-contact communication of information with the card processing device 20. The communication unit 11 is configured as a known RF front end, for example.

  The non-volatile memory 12 is a memory that can read information by a read command and write information by a write command to the card processing device 20 only when authentication with the card processing device 20 is performed. This corresponds to the first storage means in the claims. For example, an EEPROM (Electrically Erasable and Programmable Read Only Memory) is used as the nonvolatile memory 12. In the first embodiment, it is assumed that the nonvolatile memory 12 is mapped from addresses 0x00 to 0xEF.

  The data exchange register 13 is a register that can read and write information related to authentication by a read and write command similar to the command for the nonvolatile memory 12, and corresponds to the second storage means in the claims. As the data exchange register 13, a known register using a circuit element such as a flip-flop is used. In the first embodiment, the data exchange register 13 is mapped to addresses 0xF0 to 0xFF different from the addresses of the nonvolatile memory 12.

  The control unit 14 is a control unit that performs control related to authentication between the contactless card and the card processing device 20, and includes, for example, an analog circuit, a digital circuit, and various programs that operate on the circuit. Conceptually, it includes an authentication information generation unit 14a, an authentication control unit 14b, and an access management unit 14c. The authentication information generation unit 14 a is authentication information generation means for generating first authentication information related to authentication and writing the generated first authentication information into the data exchange register 13. This “first authentication information” corresponds to challenge data in the conventional challenge / response method. The authentication control unit 14b reads the second authentication information related to authentication written from the card processing device 20 to the data exchange register 13 from the data exchange register 13, and performs authentication based on the read second authentication information. Authentication control means to perform. This “second authentication information” corresponds to response data in the conventional challenge / response method. The access management unit 14 c is an access management unit that manages access from the card processing device 20 to the nonvolatile memory 12 and the data exchange register 13 based on the authentication result. FIG. 2 is a diagram conceptually illustrating the circuit configuration of the access management unit 14c. As shown in FIG. 2, the access management unit 14c includes a comparator 14d, a first AND gate 14e, and a second AND gate 14f. For example, when the access management unit 14c manages writing to the nonvolatile memory 12, the comparator 14d receives the input of the address of the nonvolatile memory 12 and the address to be written from the card processing device 20, and the comparison result (For example, “1” when both match, “0” when they do not match) is output. The first AND gate 14e has an output flag from the comparator 14d and an authenticated flag corresponding to the authentication result by the authentication control unit 14b (for example, “1” when authenticated, “0” when authentication is denied). ) And. The output value from the first AND gate 14e and the write control signal (for example, “1” when there is a write request) are input to the second AND gate 14f. Alternatively, when the access management unit 14 c manages reading from the nonvolatile memory 12, the comparator 14 d receives an input of the address of the nonvolatile memory 12 and the address to be read from the card processing device 20. . The output value from the first AND gate 14e and the read control signal are input to the second AND gate 14f.

(Configuration-Card processing device)
Returning to FIG. 1, the card processing device 20 is an external device that reads and writes information from and to the contactless IC card 10, and includes a communication power supply unit 21, a network interface (hereinafter “network IF”) 22, and a control unit 23. Are communicably connected via a system bus 24.

  The communication power supply unit 21 is a communication power supply unit that performs information communication with the non-contact IC card 10 and supplies power to the non-contact IC card 10 by a known method such as electromagnetic induction.

  The network IF 22 is a communication control interface for the card processing device 20 to communicate with the card processing system 30 via the network 2. The network IF 22 is configured as a network board, for example (the same applies to a network IF 31 described later).

  The control unit 23 is a control unit that controls each unit of the card processing device 20, and includes a CPU and various programs that are interpreted and executed on the CPU (control programs such as an OS, programs that define various processing procedures, and the like. ), And an internal memory for storing required programs and required data (the same applies to the control unit 32 described later).

(Configuration-card processing system)
The card processing system 30 is configured such that a network IF 31 and a control unit 32 are communicably connected via a system bus 33.

  The network IF 31 is a communication control interface for the card processing system 30 to communicate with the card processing apparatus 20 via the network 2.

  The control unit 32 is a control unit that controls each unit of the card processing system 30, and includes an authentication request unit 32a in terms of functional concept. The authentication request unit 32a reads the first authentication information from the data exchange register 13 via the communication power supply unit 21 of the card processing device 20, generates the second authentication information based on the read first authentication information, Authentication request means for writing the generated second authentication information into the data exchange register 13 via the communication power supply unit 21 of the card processing device 20.

(processing)
Next, an authentication process performed in the memory authentication system 1 shown in FIG. 1 will be described. FIG. 3 is a flowchart of the authentication process. This authentication process is started, for example, when an access request is made from the card processing device 20 to the control unit 14 of the non-contact IC card 10 via the communication unit 11.

  When the authentication process is activated, the authentication information generation unit 14a of the non-contact IC card 10 generates first authentication information (SA1). For example, the authentication information generation unit 14a generates a pseudo random number as the first authentication information. This pseudo-random number is obtained, for example, by encrypting variable information stored in the non-volatile memory 12 (for example, deposit balance information stored in a cash card) using a fixed random number generation key. It is done.

  Subsequently, the authentication information generation unit 14a writes the first authentication information generated in SA1 to the data exchange register 13 and transfers it to the authentication control unit 14b (SA2).

  Next, the control unit 23 of the card processing device 20 reads the first authentication information stored in the addresses 0xF0 to 0xFF corresponding to the data exchange register 13 through the communication power supply unit 21 using a read command, The read first authentication information is transferred to the card processing system 30 via the network IF 22 (SA3).

  The authentication request unit 32a of the card processing system 30 converts the first authentication information transferred from the card processing device 20 into second authentication information, and transfers the second authentication information to the card processing device 20 via the network IF 31. (SA4). For example, the authentication request unit 32a encrypts the first authentication information into the second authentication information using the authentication key stored in the card processing system 30 as an encryption key. For example, it is possible to perform encryption using the function F that performs encryption using an AES (Advanced Encryption Standard) encryption algorithm as second authentication information = F (first authentication information, encryption key).

  The control unit 23 of the card processing device 20 corresponds to the data exchange register 13 by using the write-only command for the second authentication information transferred from the card processing system 30 via the network IF 31 using the communication power supply unit 21. Write from address 0xF0 to 0xFF (SA5).

  The authentication control unit 14b of the non-contact IC card 10 reads the second authentication information written in the data exchange register 13 (SA6). Then, using the authentication key stored in the contactless IC card 10 as an encryption key, the read second authentication information is decrypted into the first authentication information (SA7).

  Subsequently, the authentication control unit 14b compares the first authentication information decrypted in SA7 with the first authentication information transferred from the authentication information generation unit 14a in SA2, and determines whether or not they match. (SA8). As a result, when it is determined that the two match (SA8, Yes), the authentication control unit 14b determines that the access by the card processing device 20 is valid, and authenticates the reading and writing by the card processing device 20 to the nonvolatile memory 12. Perform (SA9). In this case, the access management unit 14c enables reading and writing of information from the card processing device 20 to the nonvolatile memory 12.

  For example, when the authentication control unit 14b authenticates reading and writing in SA9, “1” is input to the first AND gate 14e as the authenticated flag shown in FIG. If the address to be written input from the card processing device 20 matches the address of the nonvolatile memory 12, “1” is input from the comparator 14d to the first AND gate 14e. In this case, “1” is input from the first AND gate 14e to the second AND gate 14f. Accordingly, when “1” is input as the write control signal to the second AND gate 14f, the write control signal “1” is output from the second AND gate 14f, and information is written to the address to be written.

  On the other hand, when it is determined that the first authentication information decrypted in SA7 and the first authentication information transferred from the authentication information generation unit 14a in SA2 do not match (SA8, No), the authentication control unit 14b performs card processing. The access by the device 20 is illegal, and the read / write authentication by the card processing device 20 with respect to the nonvolatile memory 12 is rejected (SA10). In this case, the access management unit 14 c disables reading and writing of information from the card processing device 20 to the nonvolatile memory 12.

  For example, when the authentication control unit 14b rejects the read / write authentication in SA10, “0” is input to the first AND gate 14e as the authenticated flag shown in FIG. If the address to be written input from the card processing device 20 matches the address of the nonvolatile memory 12, “1” is input from the comparator 14d to the first AND gate 14e. In this case, “0” is input from the first AND gate 14e to the second AND gate 14f. Therefore, even if “1” is input as the write control signal to the second AND gate 14f, the write control signal “0” is output from the second AND gate 14f, so that information is written to the address to be written. It will never be.

  After the process of SA9 or SA10, the non-contact IC card 10, the card processing device 20, and the card processing system 30 end the authentication process.

[Embodiment 2]
Next, a second embodiment will be described. In this form, when the first authentication information and the second authentication information are written into the data exchange register 13, they are also written into a dummy memory to which the same memory address as the register is assigned. The configuration of the second embodiment is substantially the same as the configuration of the first embodiment unless otherwise specified. The configuration substantially the same as the configuration of the first embodiment is the same as that used in the first embodiment. The same reference numerals and / or names are attached as necessary, and the description thereof is omitted.

(Configuration-Non-contact IC card)
First, the configuration of the non-contact IC card 10 will be described. FIG. 4 is a block diagram conceptually showing the electrical configuration of the non-contact IC card 10. As shown in FIG. 4, the communication unit 11 according to the second embodiment includes a clock generation unit 11a. The clock generation unit 11a outputs a clock signal having a constant period.

  The nonvolatile memory 12 includes a memory cell 12a and a charge pump 12b. The memory cell 12a is a storage element that stores information. The charge pump 12b is a booster circuit for generating a write voltage necessary for writing information to the memory cell 12a. The charge pump 12b is configured by combining a capacitor and a switch, for example.

  The nonvolatile memory 12 according to the second embodiment includes a dummy memory 12c to which the same address as the data exchange register 13 is assigned.

  The control unit 14 includes a counter 14g in addition to the authentication information generation unit 14a, the authentication control unit 14b, and the access management unit 14c in the first embodiment. The counter 14g counts the clock signal output from the clock generation unit 11a, and outputs a latch signal when the counter overflows beyond a preset maximum value. As the counter 14g, for example, a programmable counter using a shift register or the like can be used.

  The system bus 15 includes a bus A15a and a bus B15b. FIG. 5 is a diagram conceptually showing the bus configuration of the bus A15a. The bus configuration of the bus B15b is the same as that of the bus A15a. As shown in FIG. 5, the bus A 15a includes a data bus 15c, an address bus 15d, and a control bus 15e. The data bus 15c is a bus for transferring data, and has an 8-bit bus width from D0 to D7, for example, as shown in FIG. The address bus 15d is a bus for transferring addresses, and has an 8-bit bus width from A0 to A7, for example, as shown in FIG. The control bus 15e is a bus for transferring control information of peripheral devices such as the nonvolatile memory 12 and the data exchange register 13. As this control information, a chip enable signal (CE) that is an activation signal of the peripheral device, an output enable signal (OE) that is a read instruction signal to the peripheral device, and a write that is a write instruction signal to the peripheral device An enable signal (WE) is included. In the following description, these signals are output in negative logic (TRUE when the signal is at a low level, FALSE when the signal is at a high level).

  In addition, a signal obtained by inverting a signal flowing through the bus A15a by a known inverter (not shown) is always supplied to the bus B15b. As a result, the power consumption of the entire system bus 15 is kept constant regardless of the contents of signals flowing through the bus A 15a and the bus B 15b, the signal output source and output destination addresses, the command used, and the like.

(Operation)
Next, information reading and writing operations in the contactless IC card 10 will be described. FIG. 6 is a timing chart of the system bus 15 in reading from the nonvolatile memory 12, and FIG. 7 is a timing chart of the system bus 15 in writing to the nonvolatile memory 12.

(Operation-Reading information from nonvolatile memory)
As shown in FIG. 6, when reading information from the nonvolatile memory 12, the control unit 14 activates the nonvolatile memory 12 to be read, so that the chip enable signal for the nonvolatile memory 12 is set to a low level. (T1). Subsequently, the address to be read is output to the address bus 15d (t2), and the output enable signal for the nonvolatile memory 12 is set to the low level (t3).

  When the chip enable signal is at a low level and the output enable signal is at a low level, the non-volatile memory 12 acquires the address to be read from the address bus 15d at the fall of the next clock (t4), Information stored corresponding to the address is output to the data bus 15c at the fall of the next clock (t5). The information output to the data bus 15c is acquired by the control unit 14.

(Operation-Write information to nonvolatile memory)
As shown in FIG. 7, when writing information to the nonvolatile memory 12, the control unit 14 activates the nonvolatile memory 12 to be written, and therefore lowers the chip enable signal for the nonvolatile memory 12. The level is set (t6). Subsequently, the write target address is output to the address bus 15d, and the write target information is output to the data bus 15c (t7). Thereafter, the write enable signal for the nonvolatile memory 12 is set to a low level (t8).

  When the chip enable signal is at a low level, the nonvolatile memory 12 acquires the address to be written from the address bus 15d at the falling edge of the next clock and the write target signal at the falling edge of the next clock. Information is acquired from the data bus 15c (t9). Then, a write voltage is generated by operating the charge pump 12b at the fall of the next clock, and the acquired information is written into the memory cell 12a (t10).

  It should be noted that since it is necessary to accumulate sufficient charges in order to write to the memory cell 12a, a time on the order of 1 millisecond is generally required. The charge accumulation time is measured using, for example, a counter 14g.

(Operation-Reading information from data exchange register)
Reading information from the data exchange register 13 is the same as reading information from the nonvolatile memory 12. That is, after the chip enable signal for the data exchange register 13 is set to a low level, the address to be read is output to the address bus 15d, and the output enable signal for the data exchange register 13 is set to a low level. The information is read from the data exchange register 13.

(Operation-Write information to data exchange register)
When writing information to the data exchange register 13, the control unit 14 sets the chip enable signal for the data exchange register 13 to a low level, then outputs the address to be written to the address bus 15d and writes the address to be written. Is output to the data bus 15c, and the write enable signal for the data exchange register 13 is set to a low level.

When the chip enable signal is at a low level, the data exchange register 13 acquires the address to be written from the address bus 15d at the falling edge of the next clock when the write enable signal is at a low level, and Is obtained from the data bus 15 c and written to the data exchange register 13. In the case of writing to the data exchange register 13, unlike the writing to the memory cell 12a, it is not necessary to generate a high voltage and the writing itself is high speed. Thus, writing is completed for a very short time. For example, the time for writing to the EEPROM (strictly, erasing + writing) varies depending on the cell structure of the EEPROM and the writing process, but is approximately several ms, while writing to the data exchange register 13 is as follows: Assuming a case where the reception carrier (fc = 13.56 MHz) is divided by 4 to be a bus clock and writing is performed at 4 clocks (states), 4 × 4 / (13.56 × 10 ⁻⁶ ) ≈1. 18 μs.

  Furthermore, when writing information to the data exchange register 13, the control unit 14 also sets the chip enable signal to the non-volatile memory 12 at a low level. As a result, information is also written to the dummy memory 12c having the same address as the data exchange register 13 to be written. Along with this, the operation of the charge pump 12b for writing to the nonvolatile memory 12 occurs, and the same power consumption and writing time as the information writing to the nonvolatile memory 12 described above occur.

(processing)
Next, an authentication process performed in the memory authentication system 1 according to the second embodiment will be described. FIG. 8 is a flowchart of the authentication process. Note that the processing from SB3 to SB12 of the authentication processing in the second embodiment is the same as SA1 to SA10 of the authentication processing in the first embodiment, and thus the description thereof is omitted.

  When the authentication process is activated, the authentication information generation unit 14a sets a maximum value for the counter 14g to output a latch signal (SB1). This maximum value is generated as a pseudo random number, for example.

  Subsequently, the authentication information generation unit 14a determines whether or not a latch signal is input from the counter 14g (SB2). If no latch signal is input (SB2, No), the authentication information generation unit 14a waits until the latch signal is input. To do. And when it determines with the latch signal having been input (SB2, Yes), the authentication information production | generation part 14a produces | generates 1st authentication information (SB3).

  As a result, the time required for the first authentication information to be generated after the access request is made from the card processing device 20 to the control unit 14 of the non-contact IC card 10 via the communication unit 11 is the time required for the authentication process. Each time it is executed, it changes randomly according to the maximum value of the counter 14g.

[Embodiment 3]
Next, Embodiment 3 will be described. In this form, the memory device is authenticated. The configuration of the third embodiment is substantially the same as the configuration of the first embodiment unless otherwise specified. The configuration substantially the same as the configuration of the first embodiment is the same as that used in the first embodiment. The same reference numerals and / or names are attached as necessary, and the description thereof is omitted.

(Constitution)
First, the configuration of the memory authentication system 1 will be described. FIG. 9 is a block diagram functionally conceptually showing the electrical configuration of the memory authentication system 1 according to the third embodiment.

(Configuration-Non-contact IC card)
In the third embodiment, the control unit 14 of the non-contact IC card 10 includes an authentication request unit 14h instead of the authentication information generation unit 14a and the authentication control unit 14b in the control unit 14 of the first embodiment. The authentication request unit 14h reads the first authentication information written from the card processing device 20 from the data exchange register 13, generates second authentication information based on the read first authentication information, and generates the generated first authentication information. (2) Authentication request means for writing authentication information into the data exchange register 13.

(Configuration-card processing system)
In the third embodiment, the control unit 32 of the card processing system 30 includes an authentication information generation unit 32b and an authentication control unit 32c instead of the authentication request unit 32a in the control unit 32 of the first embodiment. The authentication information generation unit 32 b is authentication information generation means for generating first authentication information and writing the generated first authentication information to the data exchange register 13 via the card processing device 20. The authentication control unit 32c reads the second authentication information written by the authentication request unit 14h from the data exchange register 13 via the card processing device 20, and performs authentication control based on the read second authentication information. Means.

(processing)
Next, an authentication process performed in the memory authentication system 1 shown in FIG. 9 will be described. FIG. 10 is a flowchart of the authentication process. This authentication process is activated, for example, when an access request is made from the non-contact IC card 10 to the control unit 23 of the card processing device 20 via the communication power supply unit 21.

  When the authentication processing is activated, the authentication information generation unit 32b of the card processing system 30 generates first authentication information, transfers it to the authentication control unit 32c, and transfers it to the card processing device 20 via the network IF 31 (SC1). For example, the authentication information generation unit 32b generates a pseudo random number as the first authentication information. This pseudo-random number is obtained, for example, by encrypting variable information such as date, using a fixed random number generation key.

  Subsequently, the control unit 23 of the card processing device 20 transfers the first authentication information transferred in SC1 from the address 0xF0 to 0xFF corresponding to the data exchange register 13 using a write-only command via the communication power supply unit 21. Write (SC2).

  Next, the authentication request unit 14h of the contactless IC card 10 reads the first authentication information written in the data exchange register 13 (SC3), and encrypts the authentication key stored in the contactless IC card 10. The key is converted into second authentication information (SC4). Then, the authentication request unit 14h writes the converted second authentication information to the data exchange register 13 (SC5).

  The control unit 23 of the card processing device 20 reads the second authentication information stored in the addresses 0xF0 to 0xFF corresponding to the data exchange register 13 using the read command via the communication power supply unit 21, and reads the read The second authentication information is transferred to the card processing system 30 via the network IF 22 (SC6). The authentication control unit 32c of the card processing system 30 decrypts the read second authentication information into the first authentication information using the authentication key stored in the card processing system 30 as an encryption key (SC7).

  Subsequently, the authentication control unit 32c compares the first authentication information decrypted in SC7 with the first authentication information transferred from the authentication information generation unit 32b in SC2, and determines whether or not they match. (SC8). As a result, when it is determined that the two match (SC8, Yes), the authentication control unit 32c authenticates the noncontact IC card 10 assuming that the access by the noncontact IC card 10 is valid (SC9).

  On the other hand, if it is determined that the first authentication information decrypted in SC7 and the first authentication information transferred from the authentication information generation unit 32b in SC2 do not match (SC8, No), the authentication control unit 32c The access by the IC card 10 is illegal, and the authentication of the non-contact IC card 10 is rejected (SC10).

  After the process of SC9 or SC10, the non-contact IC card 10, the card processing device 20, and the card processing system 30 end the authentication process.

[II] Modifications to Each Embodiment While each embodiment according to the present invention has been described above, the specific configuration and means of the present invention are the same as the technical idea of each invention described in the claims. Modifications and improvements can be arbitrarily made within the range. Hereinafter, such a modification will be described.

(Modification-Mutual authentication)
The first embodiment and the third embodiment described above may be combined to perform mutual authentication between the non-contact IC card 10 and the card processing system 30. For example, the authentication information generation unit, the authentication control unit, and the authentication request unit are provided in both the control unit 14 of the non-contact IC card 10 and the control unit 32 of the card processing system 30, and the authentication process described in the first embodiment. And the authentication process described in the third embodiment. As a result, the non-contact IC card 10 can be used only when the read / write authentication by the card processing system 30 for the non-contact IC card 10 and the authentication of the non-contact IC card 10 for accessing the card processing system 30 are performed together. The controller 14 and the card processing system 30 can be mutually accessible.

(Modification-Authentication information generation unit)
In the control unit 14 of the non-contact IC card 10 of each embodiment described above, an element that consumes more power than the authentication control unit 14b, the authentication information generation unit 14a, or the authentication request unit 14h is mounted. The power may be operated so as to constantly change. Thereby, when the power consumption of the non-contact IC card 10 is measured from the outside, it is possible to prevent the presence or absence of execution of processing related to authentication such as the output of the first authentication information from the power consumption.

(Modification-Data exchange register)
In each of the embodiments described above, a fixed address (0xF0 to 0xFF) is assigned to the data exchange register 13, but a different address may be assigned to the data exchange register 13 of each contactless card 10. Examples of such different address assignment methods include the following two methods. The first method is a method of writing a different address for each card or lot for each contactless IC card 10 at the time of manufacture or issue as the address of the data exchange register 13. The second method is a method of giving a different address for each session in the same non-contact IC card 10 as the address of the data exchange register 13, and as the first authentication information every time power is received by electromagnetic induction or the like. This is a method of using a pseudo-random number to be used or a part thereof as a new address. When the address is set by such two methods, when the address is designated from the outside of the non-contact IC card 10, the data exchange register 13 is accessed based on the address, Communication with higher secrecy can be performed.

  Alternatively, the address of the data exchange register 13 may be changed for each communication session between the non-contact IC card 10 and the card processing device 20. For example, for each communication session, the address of the data exchange register 13 is updated using a random number generated using a known random number generation means, and the updated address of the data exchange register 13 is updated to the data exchange register 13. When the authentication information generating unit 14a, the authentication control unit 14b, and the card processing device 20 perform writing to and reading from the data exchange register 13, separately stored in an address storage register provided in the non-contact IC card 10. The address of the data exchange register 13 stored in the address storage register may be referred to.

  In order to realize such a method, it is necessary to make the address given to the non-contact IC card 10 and the address held by the card processing device 20 coincide with each other. It is possible to always hold the same address by changing.

(Modification-About distribution and integration)
Further, each of the electrical components described above is functionally conceptual and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each part is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed / integrated in arbitrary units according to various loads and usage conditions. Can be configured. For example, the card processing device 20 and the card processing system 30 may be integrated with each other.

DESCRIPTION OF SYMBOLS 1 Memory authentication system 2 Network 10 Non-contact IC card 11 Communication part 11a Clock generation part 12 Non-volatile memory 12a Memory cell 12b Charge pump 12c Dummy memory 13 Data exchange register 14, 23, 32 Control part 14a, 32b Authentication information generation part 14b, 32c Authentication control unit 14c Access management unit 14d Comparator 14e First AND gate 14f Second AND gate 14g Counter 14h, 32a Authentication request unit 15, 24, 33 System bus 15a Bus A
15b Bus B
15c Data bus 15d Address bus 15e Control bus 20 Card processing device 21 Communication power supply unit 22, 31 Network IF
30 Card processing system

Claims (7)

A memory device that receives and reads from an external device,
First storage means capable of reading and writing information only when read and write authentication is performed by the external device;
Second storage means capable of reading and writing the first authentication information and the second authentication information related to the authentication;
Authentication information generating means for generating the first authentication information and writing the generated first authentication information into the second storage means;
Authentication control means for reading the second authentication information written in the second storage means from the external device from the second storage means, and performing the authentication based on the read second authentication information;
A memory device comprising: A memory device that receives and reads from an external device,
First storage means capable of reading and writing information;
Second storage means capable of reading and writing first authentication information and second authentication information related to authentication of the memory device by the external device;
The first authentication information written from the external device is read from the second storage means, second authentication information is generated based on the read first authentication information, and the generated second authentication information is An authentication requesting means for writing to the second storage means;
A memory device comprising: A memory authentication system comprising a memory device and an external device that reads and writes information to and from the memory device, and performs authentication of reading and writing by the external device with respect to the memory device,
The memory device includes:
First storage means capable of reading and writing information only when the authentication is performed;
Second storage means capable of reading and writing the first authentication information and the second authentication information related to the authentication;
Authentication information generating means for generating the first authentication information and writing the generated first authentication information into the second storage means;
Authentication control means for reading out the second authentication information written in the second storage means from the external device from the second storage means, and performing the authentication based on the read second authentication information,
The external device is
Reading the first authentication information from the second storage means, generating second authentication information based on the read first authentication information, and writing the generated second authentication information to the second storage means; Providing an authentication request means;
A memory authentication system. A memory authentication system comprising a memory device and an external device for reading and writing information to and from the memory device, and authenticating the memory device,
The memory device includes:
First storage means capable of reading and writing information;
Second storage means capable of reading and writing the first authentication information and the second authentication information related to the authentication;
The first authentication information written from the external device is read from the second storage means, second authentication information is generated based on the read first authentication information, and the generated second authentication information is An authentication requesting means for writing to the second storage means;
The external device is
Authentication information generating means for generating the first authentication information and writing the generated first authentication information into the second storage means;
Authentication control means for reading out the second authentication information written by the authentication request means from the second storage means and performing the authentication based on the read second authentication information;
A memory authentication system. The first storage means
Non-volatile memory,
The second storage means
A register assigned a memory address outside the memory space of the non-volatile memory;
The memory authentication system according to claim 3 or 4, characterized by the above-mentioned. The nonvolatile memory is
Including a dummy memory assigned the same memory address as the register;
The authentication information generating means
When writing the first authentication information into the register, the first authentication information is written into the dummy memory;
The authentication request means includes
When writing the second authentication information into the register, writing the second authentication information into the dummy memory;
The memory authentication system according to claim 5. A memory authentication program to be executed by a computer as a memory device that receives and writes from an external device,
In the computer,
A first storage step of reading and writing information to and from the first storage means provided in the memory device only when the reading and writing are authenticated by the external device;
A second storage step of reading and writing the first authentication information and the second authentication information related to the authentication with respect to the second storage means provided in the memory device;
Generating the first authentication information and writing the generated first authentication information into the second storage means; and
An authentication control step of reading from the second storage means the second authentication information written to the second storage means from the external device, and performing the authentication based on the read second authentication information;
A memory authentication program characterized in that

Images