JP2014175758A - Ic card and processing method thereof - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an IC card whose security is enhanced.SOLUTION: An IC card which performs preset processing in accordance with a command transmitted from an external device, includes: a first nonvolatile memory in which rewriting of stored data is impossible; a second nonvolatile memory in which writing is possible only once; and an arithmetic processing unit, wherein the first nonvolatile memory stores a first memory encryption key which is made secret by a developer, as first key generation data, the second nonvolatile memory stores a second memory encryption key which is made secret by an issuer, as second key generation data, and the arithmetic processing unit includes an encryption key calculation unit for, in accordance with the command transmitted from the external device, calculating an encryption key that is data for use in at least one of encryption, decryption, and card authentication by performing calculation on the first key generation data and the second key generation data using a preset algorithm.

Description

  The present invention relates to an IC card, and more particularly to an IC card that can enhance the security of the IC card.

  2. Description of the Related Art Conventionally, in addition to ROM, an IC card including an EEPROM capable of rewriting data is known (see, for example, Patent Document 1). This type of IC card includes a plurality of authentication keys in a ROM, an EEPROM, or the like. When an authentication command is received from an external device, the authentication key specified by the authentication command is authenticated. If the authentication is successful, the IC card changes from a locked state (for example, a state where data cannot be written / read) to an unlocked state (for example, a state where data can be written / read).

JP 2008-243017 A

  By the way, as a method for improving the security of the IC card, there is a method of setting an upper limit value for the number of authentication attempts. In this method, the upper limit of the number of trials is stored in advance in the EEPROM of the IC card. Further, the number of authentication trials actually performed is measured by a counter circuit, and the measured value is stored in the EEPROM. Then, when the count value reaches the upper limit of the number of trials, the IC card is programmed in advance so that no further authentication can be performed.

  However, an attack method that forcibly changes the program counter and forcibly dumps the key value or confidential data in the memory by executing a function for reading the EEPROM mounted on the card OS, thereby analyzing the key value. There is.

For example, a card vendor or a contractor, that is, an OS developer, knows the encryption algorithm and encryption key for implementing the handling of numerical values and confidential data stored in the EEPROM. Therefore, when the EEPROM is dumped by the OS developer during card operation, the decryption is easy and the key value and confidential data are exposed.

Further, in the prior art, there is a method of protecting confidential information even in the case of an EEPROM dump by an internal criminals by making the unique information of the medium or the key value of the encryption key a random number, but the information in the EEPROM memory Since each card is different from each other, for example, in order to ensure that the card issuer has successfully issued the card, for example, it is necessary to confirm that the hash value and CRC value of the data in the memory match, but the problem that it is not possible was there. Further, when the card quality evaluator evaluates the quality, the information in the EEPROM memory is different one by one, so there is a limit to the scope of guarantee.

  Therefore, the present invention has been made in view of such circumstances, and an object thereof is to provide an IC card that can improve security. More specifically, an OS mechanism that counters the above attack is proposed, and the purpose is to provide a mechanism that prevents analysis of confidential data from a memory dump even if an internal crime is committed by an OS developer or card issuer. Yes.

  In order to solve the above problems, an IC card according to an aspect of the present invention is an IC card that performs a preset process in accordance with a command transmitted from an external device, and at least the stored data cannot be rewritten. A first nonvolatile memory, a second nonvolatile memory in which stored data can be written only once, and an arithmetic processing unit are provided, and the first nonvolatile memory is developed as first key generation data A first memory encryption key concealed by a person, the second nonvolatile memory stores a second memory encryption key concealed by an issuer as second key generation data, and the arithmetic processing unit includes: In accordance with a command transmitted from the external device, the first key generation data and the second key generation data are calculated by a preset algorithm to perform encryption, decryption, and card authentication. Of an IC card characterized by comprising the encryption key calculation unit that calculates an encryption key which is data for use in at least one.

  2. The IC card according to claim 1, wherein the arithmetic processing unit further includes a life cycle management unit and manages a life cycle state of the IC card.

Further, in the IC card processing method for performing the processing set in advance according to the command transmitted from the external device in the above IC card, the step of checking the life cycle, the issuer transmitted from the external device concealing The command accepting unit accepts a command for setting two memory encryption keys, the second memory encryption key writing unit writes the second memory encryption key into the memory, and the life cycle is rewritten. A step of calculating a first memory encryption key to be concealed and a second memory encryption key to be concealed by an issuer to calculate an encryption key, a step of writing to the EEPROM by using the encryption key,
An IC card processing method characterized by comprising:

  According to one aspect of the present invention, the OS developer sets the key value with a command from the issuer at the time of issuance in the OTP area, instead of using the value set on the ROM as it is as the memory encryption key. And use the value XORed with that value. Further, according to one aspect, not only the key value but also an encryption algorithm may be designated. Further, a mechanism in which the cryptographic algorithm is automatically set on the card OS side based on the XORed value may be used.

By such processing, the key value and encryption algorithm are determined based on the value set by the OS developer and the value set by the issuer, so that the internal criminal such as the OS developer or issuer dumps the memory. Can keep sensitive data. Also, since the EEPROM memory is always the same for a single issue scenario, the issuer's integrity is guaranteed if the issuer can check that the hash value and CRT value in the memory are the same as the confirmation of the issue content. It becomes possible.

Furthermore, since the security level of memory encryption can be operated on the command side at the time of issuance, it is possible to specify whether the security is present or not, the key value is a random number, and the encryption algorithm is specified / automatically determined according to the card application It has the effect.

It is an example of the block diagram which shows the structural example of the IC card based on this invention. It is a flowchart which shows the procedure at the time of issuing. It is a flowchart which shows the procedure at the time of issue confirmation. It is a flowchart which shows the procedure at the time of operation.

Embodiments of the present invention will be described below with reference to the drawings. Note that, in each drawing described below, parts having the same configuration are denoted by the same reference numerals, and repeated description thereof is omitted.
<First Embodiment>
(Constitution)

  FIG. 1 is a block diagram showing a configuration example of an IC card 100 according to the first embodiment of the present invention.

  This IC card 100 is a card that performs a preset (ie, predetermined) process in accordance with a command transmitted from an external device. As shown in FIG. 1, the IC card 100 includes, for example, a ROM (Read Only Memory) 10 in which stored data cannot be rewritten, and an OTP (One Time Programmable) in which stored data can be rewritten only once. ROM 20, EEPROM (Electrically Erasable Programmable ROM) 30 capable of rewriting stored data a plurality of times, RAM (Random Access Memory) 40, and CPU (Central Processing Unit) 50.

  The ROM 10 has a first nonvolatile memory (a first memory encryption key storage unit 11 for storing a first memory encryption key for storing stored data that cannot be rewritten) as a functional unit. The first memory encryption key value is represented by a hexadecimal number, for example.

  The OTP-ROM 20 has a second memory encryption key storage unit 21 for storing a second memory encryption key value as a functional unit. Here, the second memory encryption key value is represented by a hexadecimal number, for example. This OTP area is an area in which a value can be written only once, and the second memory encryption key value and the first memory encryption key value are encrypted by using, for example, an XOR value as a key value. Determine the algorithm.

  The CPU 50 is a part that performs processing such as computation, and as its functional units, a command receiving unit, a first memory encryption key reading unit, a second memory encryption key writing unit, and an encryption key calculating unit A memory encryption unit, an EEPROM writing unit, and a life cycle management unit.

  The EEPROM 30 is an area that can be rewritten a plurality of times, and contains information such as general data / key information and confidential data. This area also has a life cycle storage unit for storing the life cycle state.

  The command receiving unit 51 receives a command received by the IC card 100 from an external device via an input / output port (not shown).

The first memory encryption key reading unit is a part for reading the key of the first nonvolatile memory in which stored data cannot be rewritten. Here, it is a part for reading the encryption key on the developer side of the IC card 100, for example.

The second memory encryption key writing unit is a part for reading a key of the second nonvolatile memory in which stored data can be written only once. Here, it is a portion for writing an arbitrary key value determined in advance on the issuer side of the IC card 100, for example.

The encryption key calculation unit is a part that calculates, for example, an exclusive OR (XOR) value of the first memory encryption key and the second memory encryption key.

The memory encryption unit is a part that XORs the first memory encryption key and the second memory encryption key to determine an encryption algorithm (for example, T-DES, AES128 bit, etc.).

The EEPROM writing unit is a part for writing general data / key information / confidential data, a life cycle, and the like to a rewritable EEPROM.

The life cycle management unit is a part that manages the current state of the IC card 100 (during issuance, operation, etc.).
(procedure)

  Next, a procedure for “issue” authentication in the IC card 100 shown in FIG. 1 will be described.

  FIG. 2 is a flowchart showing the procedure of “issue” in the IC card 100. Here, it is assumed that the initial value of the second memory encryption key value stored in the second memory encryption key storage unit 21 of the OTP-ROM 20 is set to ALL0x00.

  In the first step of FIG. 2, it is confirmed that a life cycle has not been issued for a card that does not contain information in the EEPROM. At this time, if it is “issued”, the processing is interrupted, and if it is “not issued”, the process proceeds to the next step. Next, the command receiving unit receives a “second memory encryption key” setting command transmitted from the external device by the issuer. Next, the second memory encryption key is written into the memory by the second memory encryption key writing unit, and the life cycle is rewritten to “Issuing”.

Next, the first memory encryption key stored in the ROM is read, and the encryption key calculation unit calculates the first and second memory encryption keys to calculate the encryption key. Thus, the issue command is received. When information such as key data and confidential data is written to the EEPROM, it is encrypted and stored by using this encryption key.

By performing the above steps, the issuing operation is completed.

Next, a procedure for authentication at the time of “issue confirmation” in the IC card 100 will be described.

First, after the operation is started, the issuer enters an issue confirmation command (issue verification data) and receives this issue confirmation command (issue verification data) to confirm that the current life cycle is being issued. At this time, if the life cycle is not being issued, the process is interrupted, and if it is being issued, issue verification data is calculated from the issue state in the card. As an example of the process at this time, there is a process for calculating a hash value from data of ROM, OTP-ROM, or EEPROM.

As a result, it is confirmed that the issue verification data received from the command matches the issue verification data calculated in the card. At this time, if the issue verification data does not match, the processing is interrupted, and if the data matches here, the life cycle is rewritten during operation.

Thereby, the IC card 100 is shipped. Thereafter, personal information such as consumers is written on the IC card.

Next, a procedure of “during operation” in the IC card 100 will be described.

Here, first, it is confirmed that the life cycle state is in operation for the IC card 100 in which each personal information is written. If the life cycle is not in operation, the processing is interrupted. On the other hand, when the life cycle is in operation, the first memory encryption key set by the developer is read, and further the second memory encryption key set by the issuer is read. The first and second memory encryption keys are calculated to calculate the encryption key. As a result, various operations such as processing of the operation command and reading of information written in the EEPROM can be performed.

Note that when the encrypted key data and confidential data on the EEPROM are accessed, they are decrypted with the “encryption key”.

In the present invention, since the IC card is issued and operated according to such a procedure, the key value and the encryption algorithm are determined by the value set by the OS developer and the value set by the issuer. Even if an insider such as an issuer dumps memory, confidential data can be retained. Also, since the EEPROM memory is always the same for a single issue scenario, the issuer's integrity is guaranteed if the issuer can check that the hash value and CRT value in the memory are the same as the confirmation of the issue content. It becomes possible.

  The present invention is not limited to the embodiments described above. A design change or the like may be added to each embodiment based on the knowledge of a person skilled in the art, and an aspect in which such a change or the like is added is also included in the scope of the present invention.

  As a matter of course, the field of use of the present invention is not limited to the IC card, but can be applied to personal authentication media and other products related to security.

10 ROM
11 First memory encryption key storage unit 20 OTP-ROM
21 Second memory encryption key storage unit 30 EEPROM
31 General data / key information / confidential data storage unit 32 Life cycle storage unit 40 RAM
50 CPU
51 Command receiving part
52 Second Memory Encryption Key Writing Unit 53 First Memory Encryption Key Reading Unit 54 Encryption Key Calculation Unit 55 Memory Encryption Unit 56 EEPROM Writing Unit 57 Life Cycle Management Unit 100 IC Card

Claims (3)

An IC card that performs a preset process according to a command transmitted from an external device,
Comprising at least a first nonvolatile memory in which stored data cannot be rewritten, a second nonvolatile memory in which stored data can be written only once, and an arithmetic processing unit;
The first nonvolatile memory stores a first memory encryption key concealed by a developer as first key generation data,
The second non-volatile memory stores a second memory encryption key concealed by the issuer as second key generation data,
The arithmetic processing unit calculates the first key generation data and the second key generation data with a preset algorithm in accordance with a command transmitted from the external device, and performs encryption, decryption, and card processing. An IC card comprising an encryption key calculation unit for calculating an encryption key which is data used for at least one of authentication.   The IC card according to claim 1, wherein the arithmetic processing unit further includes a life cycle management unit, and manages a life cycle state of the IC card. In an IC card processing method for performing a preset process according to a command transmitted from an external device,
The process of checking the lifecycle,
The command accepting unit accepts a second memory encryption key setting command sent from an external device and concealed by the issuer, and the second memory encryption key writing unit writes the second memory encryption key into the memory, Rewriting process,
An encryption key calculation unit calculating a first memory encryption key concealed by a developer and a second memory encryption key concealed by an issuer to calculate an encryption key;
Writing to the EEPROM by using the encryption key;
An IC card processing method comprising the steps of:

Images