JP3857190B2 - IC card control device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an IC card control application that performs various sequence processes between an IC card and a terminal or a server, and more particularly to an IC card control application that can flexibly cope with various sequence processes. Furthermore, the present invention relates to an IC card terminal and an IC card server on which such an IC card control application is mounted.
[0002]
[Prior art]
In the IC card system, various sequence processes that are data exchange between the IC card server and the IC card are executed. For example, prior to data exchange between the IC card and the server, a mutual authentication sequence is executed. As this mutual authentication sequence, internal authentication for confirming the validity of the IC card application stored in the IC card and external authentication for confirming the validity of the IC card control application installed in the server or terminal device Is executed. Then, after a valid result is confirmed as the authentication result, a request from the IC card control application is received by the IC card application, and various sequence processes are executed.
[0003]
Various methods such as a common key cryptosystem and a public key cryptosystem are used as a mutual authentication method which is an example of sequence processing. Conventionally, encryption and signature processing are generally described directly as a program using a provided encryption library. The entire authentication processing sequence is individually implemented for each system based on the specifications of the IC card application and the security defined for the entire IC card system.
[0004]
[Problems to be solved by the invention]
With the improvement in processor performance, the speed of decryption has also increased. Accordingly, with the improvement of encryption technology, there is an increasing need to renew the challenge length and encryption type once set to ensure higher security. However, changing the challenge length once set or changing the type of encryption leads to renewal of the authentication protocol program, and there is a disadvantage that an extremely complicated change procedure is required.
[0005]
The authentication sequence process is an indispensable function for all IC cards and requires a high level of security knowledge, and is preferably provided as a package or library. However, since the IC card and the IC card application have only limited security functions and an authentication sequence is defined for each IC card or for each IC card application, the authentication sequence processing is uniformly performed on the IC card control application side. It was difficult to define or create a library. Thus, IC card control application installed in the terminal device or the server, Rukoto you to flexibly respond to each variety IC card authentication sequence is mounted or an IC card application is requested.
[0006]
Such flexible correspondence of the IC card control application is strongly demanded not only for the authentication sequence processing but also for various sequence processing. That is, in various kinds of sequence processing, since there are many requests for modifying or changing the input parameters once set, it is necessary to be able to respond flexibly to such requests.
[0007]
Accordingly, an object of the present invention is to provide an IC card control application that can flexibly cope with a change in the authentication sequence once set without changing the program.
[0008]
Furthermore, another object of the present invention is that even if the authentication sequence is different for each IC card or for each IC card application, it can be handled by a single IC card control application, and can flexibly handle various authentication sequences. An object of the present invention is to provide an IC card control application that can be used.
[0009]
[Means for Solving the Problems]
An IC card control device according to the present invention is an IC card control device that performs APDU communication with an IC card and performs sequence processing with an IC card application stored in the IC card,
A sequence identification name is stored, a command representing the execution contents of the sequence process corresponding to the sequence identification name, an input parameter defining information necessary for executing the sequence process, and an output defining the result of the sequence process The definition file where the parameters are stored for each sequence process,
A sequence control unit that reads a command, an input parameter, and an output parameter corresponding to the identification name of the sequence from the definition file, passes the command and input parameter information, and receives the output parameter information;
An internal command execution unit that receives the command and input parameter information from the sequence control unit , executes predetermined function processing using the input parameter information based on the command, creates output parameter information, and passes the information to the sequence control unit; ,
The command and input parameter information is received from the sequence control unit, a transmission APDU command is created using the input parameter information based on the command , passed to the sequence control unit, and the reception APDU command transmitted from the IC card application is received. An APDU command execution unit that receives and decodes from the sequence control unit and passes the decoded data to the sequence control unit as output parameter information ;
An APDU transmission / reception unit that receives the transmission APDU command created by the APDU command execution unit from the sequence control unit and transmits it to the IC card application, and receives the reception APDU command transmitted from the IC card application and passes it to the sequence control unit; With
The sequence controller is
After reading commands, input parameters and output parameters from the definition file,
Pass the command and input parameter information to the internal command execution unit, and create output parameter information necessary to create a transmission APDU command,
Along with the command, the output parameter information created by the internal command execution unit is passed to the APDU command execution unit as input parameter information to create a transmission APDU command. After communication with the IC card application, the IC card Decode the received APDU command sent from the application,
The internal command execution unit is caused to pass the command and the decoded data to the APDU command execution unit as input parameter information, and create output parameter information as a result of the sequence processing .
[0010]
In the present invention, a program necessary for executing various sequence processes is separated from data used for the sequence processes. Then, a definition file is provided, and a command indicating the execution contents of the sequence process, an input parameter that defines information necessary for executing the sequence process, and an output parameter that defines the result of the sequence process are stored in the definition file. Furthermore, in the present invention, a sequence control unit is provided to control data transfer between the internal command execution unit and the APDU command execution unit. As a result, once various parameters necessary for sequence processing are set, even if it becomes necessary to modify or modify the parameters or part of them, it is only necessary to modify the contents of the definition file without changing the program. Advantages that can be accommodated are achieved.
[0011]
Furthermore, since the present invention has a definition file defined for each IC card application to be processed, even if the parameters, data, or commands required for sequence processing differ for each IC card application, a single IC is used. The card control application can be used flexibly. Further, since a definition file defined for each sequence process to be executed can be provided, even if the sequence process needs to be added or changed, only the definition file can be added or modified.
[0012]
Furthermore, a program for executing commands in a variety of sequence process since the internal command execution unit and the APDU command execution unit has each definition file, corresponding only with DN sequence, command, input parameters and output parameters The amount of information stored in the definition file can be reduced.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 1 is a diagram showing an example of the entire configuration of an IC card system according to the present invention. The IC card 1 performs data communication with the server 3 via the IC card terminal 2. An IC card 1 of this example is an IC card of a multi-application system, and stores N IC card applications 1 to N downloaded from the same or different service provider servers. The IC card terminal 2 has an IC card terminal application, the server 3 has an IC card control application, and the authentication sequence and data communication between the server 3 and the IC card 1 are controlled by the IC card mounted on the server 3. This is done under application control. The present invention can be applied not only when the IC card control application is installed in the server but also when installed in the IC card terminal 2.
[0014]
FIG. 2 is a diagram showing a configuration of an example of an IC card control application according to the present invention. The IC card control application includes a main processing unit 10 that performs overall control such as identification of sequence processing to be executed when various sequence processing is executed with the IC card application stored in the IC card. Moreover, it has the sequence process part 11 which processes about various sequences. The sequence processing unit 11 can correspond to a plurality of various sequences by a single sequence processing unit 11 , or the sequence processing unit 11 can be provided for each sequence. The sequence processing unit 11 includes a sequence control unit 12 and a definition file 13. The sequence control unit 12 controls processing in the sequence processing, for example, reading and transferring information stored in the definition file 13. The definition file 13 has output parameter information indicating the identification name of the processing sequence, input parameter information necessary for executing the sequence processing, sequence processing procedure, and processing result for each type of sequence processing and for each type of IC card application. Further, the IC card control application executes predetermined function processing according to the input parameter information and sequence processing procedure described in the definition file 13 and creates output parameter information described in the definition file 13. 14, defined based on the input parameter information described in the file 13 along with creating a transmission APDU command, the APDU command execution unit 15 decodes the received APDU command sent from the IC card application and send APDU command IC card, An APDU transmission / reception unit 16 is provided which transmits to the application and receives an APDU command transmitted from the IC card application.
[0015]
Next, the definition file 13 provided in the sequence processing unit 11 will be described. As an example, FIG. 3 shows a definition file used when an internal authentication sequence is executed between the IC card application 1 stored in the IC card and the control application. The definition file contains the identification name of the sequence to be executed (in this example, the internal authentication sequence), input parameter information necessary for executing the sequence process (in this example, [input parameter definition]), and an output indicating the processing result It has parameter information (in this example, [output parameter definition]) and sequence processing procedure (in this example, [sequence definition], [process 1], [process 2], and [process 3]). In [Process 1 to 3], “command type” indicates the type of command to be read, and in this example, an internal command or an APDU command is read, and the command name indicates the command to be executed or the content of the process. Thus, in the [process 1], the internal command is read, using the input parameter information in the internal command execution portion 14 Cha Nji generation is performed. In the Process 2], APDU commands are read, the generation of transmission APDU in APDU command executing section 15, APDU received in APDU transceiver 16, received by the APDU command execution portion 15 In [Process 3], the internal command is read and verified by the internal command execution unit 14 .
[0016]
In addition, once various parameters such as input parameters and output parameters are set, and a higher level of security is desired, it is only necessary to add or change the processing contents of various parameters or commands described in the definition file. can do.
[0017]
FIG. 4 shows a modified example of the definition file used for the authentication sequence process.
[0018]
Next, the processing procedure of the internal authentication sequence will be described with reference to FIG. When the IC card 1 is attached to the IC card terminal 2, the IC card application to be processed by the IC card terminal application is specified and transmitted to the IC card control application. The main processing unit 10 requests the sequence processing unit 11 to execute internal authentication processing. The sequence control unit 12 of the sequence processing unit 11 searches the definition file 13 and finds the authentication sequence definition file of the IC card application that is the target of the authentication sequence process. The contents of the definition file shown in FIG. 3 are read by the sequence control unit 12 and an internal authentication sequence is executed under the control of the sequence control unit 12 . First, the input parameter 1 = challenge length is transferred to the internal command execution unit 14, and a challenge is generated and transferred to the sequence control unit 12. (Process 1)
[0019]
Next, the generated challenge is transferred to the APDU command execution unit 15, converted into an APDU byte string, and a transmission APDU is generated. The transmission APDU is transferred to the sequence control unit 12 and transferred from the sequence control unit 12 to the APDU transmission / reception unit 16. This transmission APDU is transferred to the IC card application 1 and signature data is created by the IC card application 1. This signature data is returned to the APDU transmission / reception unit 16 and transferred to the APDU command execution unit 15. The APDU command execution unit 15 decodes the received signature data of the APDU byte sequence, converts it into a processing code, and transfers it to the sequence control unit 12 . (Process 2)
[0020]
The sequence control unit 12 transfers the signature data sent from the IC card to the internal command execution unit 14 together with the input parameter = public key. The internal command execution unit 14 verifies the received signature data using the public key. When the IC card application is a valid IC card application, the output parameter = Result is transferred to the sequence control unit 12 as a processing result. (Process 3)
[0021]
The internal authentication sequence is completed by the series of processes 1 to 3 described above, and the process proceeds to the next sequence process.
[0022]
FIG. 6 shows a modified example of the procedure of the internal authentication sequence. This example is an application example in a system in which the sequence control unit 12 is not allowed to access the APDU transmission / reception unit 16 . In this example, the main processing unit 10 can access the sequence processing unit 11 and the APDU transmission / reception unit 16 that can execute the internal authentication processing. In the case of such a system configuration, the sequence processing unit 11 must once terminate the processing and return the transmission APDU to the main processing unit 10 in order to transmit the APDU during the sequence processing. For this purpose, it is necessary to keep the state of how far the sequence processing has progressed inside the sequence processing unit 11 .
Therefore, in this example, when the main processing unit 10 requests the sequence processing unit 11 to perform the internal authentication process, the session ID is passed in addition to the necessary parameters. The sequence processing unit 11 performs processing halfway according to the description of the authentication sequence definition file, stores the session ID together with the state, ends the processing, and returns the transmission APDU and the session ID to the main processing unit 10 . The main processing unit 10 transmits / receives APDU by the APDU transmission / reception unit 16 and transmits the received APDU to the sequence processing unit 11 together with the session ID. The sequence processing unit 11 searches the previously saved state from the session ID, and performs subsequent processing of the sequence.
[0023]
The IC card control application according to the present invention can be used by being stored in a recording medium such as a CD-ROM. Therefore, the IC card authentication method according to the present invention can be implemented simply by mounting the recording medium storing the IC card control application of the present invention on the IC card terminal 2 or the server 3 .
[0024]
The present invention is not limited to the above-described embodiments, and various modifications and changes can be made. For example, in the above-described embodiment, the internal authentication sequence has been described, but the present invention can also be applied to various authentication sequences such as an external authentication sequence for confirming the validity of the IC card control application.
[0025]
【The invention's effect】
As described above, according to the present invention, when the authentication sequence is renewed, it is possible to cope with only the addition of the library to the command execution unit and the change of the authentication sequence definition file, and there is an advantage that no program modification is required. Is achieved.
In addition, the authentication sequence processing unit can be provided as a library that can handle various authentication sequence processes. Furthermore, the IF of the APDU generation / decryption unit can be defined in the authentication sequence definition file, and any IC card control application can be supported. Further, by changing the contents of the authentication sequence definition file, it is possible to cope with various authentication sequences corresponding to various security protocols of IC card functions and IC card applications.
[Brief description of the drawings]
FIG. 1 is a diagram showing an overall configuration of an IC card system according to the present invention.
FIG. 2 is a diagram showing an example of an IC card control application according to the present invention.
FIG. 3 is a diagram showing an example of a definition file according to the present invention.
FIG. 4 is a diagram showing a modified example of the definition file according to the present invention.
FIG. 5 is a diagram showing a procedure of an internal authentication sequence using the IC card control application shown in FIG.
FIG. 6 is a diagram showing a modified example of the procedure of the internal authentication sequence.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 IC card 2 IC card terminal 3 Server 10 Main processing part 11 Sequence processing part 12 Sequence control part 13 Definition file 14 Internal command execution part 15 APDU command execution part 16 APDU transmission / reception part

Claims (8)

An IC card control device that performs APDU communication with an IC card and performs sequence processing with an IC card application stored in the IC card,
A sequence identification name is stored, a command representing the execution contents of the sequence process corresponding to the sequence identification name, an input parameter defining information necessary for executing the sequence process, and an output defining the result of the sequence process The definition file where the parameters are stored for each sequence process,
A sequence control unit that reads a command, an input parameter, and an output parameter corresponding to the identification name of the sequence from the definition file, passes the command and input parameter information, and receives the output parameter information;
An internal command execution unit that receives the command and input parameter information from the sequence control unit , executes predetermined function processing using the input parameter information based on the command, creates output parameter information, and passes the information to the sequence control unit; ,
The command and input parameter information is received from the sequence control unit, a transmission APDU command is created using the input parameter information based on the command , passed to the sequence control unit, and the reception APDU command transmitted from the IC card application is received. An APDU command execution unit that receives and decodes from the sequence control unit and passes the decoded data to the sequence control unit as output parameter information ;
An APDU transmission / reception unit that receives the transmission APDU command created by the APDU command execution unit from the sequence control unit and transmits it to the IC card application, and receives the reception APDU command transmitted from the IC card application and passes it to the sequence control unit; With
The sequence controller is
After reading commands, input parameters and output parameters from the definition file,
Pass the command and input parameter information to the internal command execution unit, and create output parameter information necessary to create a transmission APDU command,
Along with the command, the output parameter information created by the internal command execution unit is passed to the APDU command execution unit as input parameter information to create a transmission APDU command. After communication with the IC card application, the IC card Decode the received APDU command sent from the application,
Wherein the internal command execution unit, along with the command, pass the data obtained by decoding the APDU command execution unit as the information of the input parameters, IC card control unit, characterized in that to create the information of the output parameter is the result of sequence processing.   2. The IC card control apparatus according to claim 1, wherein the definition file includes information for specifying a function process executed by an internal command execution unit. The IC card is a multi-application IC card in which a plurality of IC card applications are stored,
3. The IC card control apparatus according to claim 1, wherein the definition file stores a sequence identification name, a command, an input parameter, and an output parameter for each IC card application. In the definition file , an input parameter defining a challenge length and an output parameter defining a challenge are stored for a command for generating a challenge executed by the internal command execution unit, and executed by the APDU command execution unit. An input parameter that defines a challenge and an output parameter that defines signature data for a command for creating a transmission APDU command from the challenge and decoding signature data included in the received APDU command after communication with the IC card application to but is stored, and et al, the commands for the verification of the signature data to be executed by an internal command execution unit, the input parameters that define a public key and signature data, and output parameters that define the verification results are stored In case,
The sequence controller is
After reading commands, input parameters and output parameters from the definition file ,
Passing the challenge length as command and input parameter information for generating a challenge to the internal command execution unit , creating a challenge, receiving the challenge from the internal command execution unit as output parameter information,
In the APDU command execution unit,
A command for creating a transmission APDU command from the challenge, and a challenge as input parameter information, causing a transmission APDU command to be created,
After communication with the IC card application, the signature data included in the received APDU command is decoded, and the signature data is received from the APDU command execution unit as output parameter information.
The internal command execution unit, a command for verifying the signature data passes the public key and the signature data as information of the input parameters, to verify the signature data using the public key, an internal command verification result information output parameters The IC card control device according to claim 1, wherein the IC card control device receives the information from an execution unit . An IC card control device that performs APDU communication with an IC card and performs a sequence process with an IC card application stored in the IC card stores a sequence identification name, and A definition file in which a command representing the execution content of the sequence process corresponding to the identification name, an input parameter defining information necessary for executing the sequence process, and an output parameter defining the result of the sequence process are stored for each sequence process; In the case of comprising a sequence processing unit, an internal command execution unit, an APDU command execution unit, and an APDU transmission / reception unit,
In a computer constituting the IC card control device,
A process in which the sequence control unit reads a command, an input parameter, and an output parameter corresponding to the identification name of the sequence from the definition file, and passes the command and input parameter information;
The internal command execution unit receives command and input parameter information from the sequence processing unit, executes predetermined function processing using the input parameter information based on the command, and outputs output parameters necessary for creating a transmission APDU command. Processing to create information and pass it to the sequence control unit;
The APDU command execution unit receives the output parameter information created by the internal command execution unit together with the command from the sequence processing unit as input parameter information, and creates a transmission APDU command using the input parameter information based on the command. The transmission APDU command is passed to the sequence control unit, and after communication with the IC application card by the APDU transmission / reception unit, the reception APDU command transmitted from the IC card application is received from the sequence control unit, decoded, and decoded data Process to pass to the sequence controller as output parameter information,
The internal command execution unit receives data decoded by the APDU command execution unit together with the command from the sequence processing unit as input parameter information, executes predetermined function processing using the input parameter information based on the command, An IC card control program for generating output parameter information as a result of processing and executing processing for passing to a sequence control unit .   A recording medium on which the IC card control program according to claim 5 is recorded. An IC card terminal that performs APDU communication with an IC card and performs sequence processing with an IC card application stored in the IC card,
An IC card terminal comprising the definition file according to any one of claims 1 to 4, an internal command execution unit, an APDU command execution unit, an APDU transmission / reception unit, and a sequence control unit. Under a communication system including an IC card, an IC card terminal, and an IC card server, communication with the IC card is performed using an APDU via the IC card terminal, and an IC card application stored in the IC card. IC card server that performs sequence processing between
An IC card server comprising the definition file according to any one of claims 1 to 4, an internal command execution unit, an APDU command execution unit, an APDU transmission / reception unit, and a sequence control unit.

Images