JP2002169783A - User use control system, user use control method and user use control program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To read desired user information from a card-type information storage medium 1 without being conscious of the type and the specification of the card- type information storage medium 1 in a program using user information and to improve the convenience of a user and a program developer. SOLUTION: A system is provided with a user information reading means 72 converting a user information reading request command from the program into a request command which can be processed in the card-type information storage medium 1 and reading user information from the card-type information storage medium 1 by using the converted request command.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user use control system, a user use control method, and a user use control program, and more particularly to an invention for improving the convenience of a user or the like.

[0002]

2. Description of the Related Art Conventionally, each company or government office has a so-called intranet in the company, and each employee uses a user terminal connected to the company to share information, thereby improving the efficiency of each business. I am planning.

[0003] When an intranet is used as described above,
For example, in a database or the like, a technique such as user authentication is generally used to determine whether or not the accessing user may be permitted to access. If such authentication is required, each user inputs user information such as a password from the user terminal.

[0004] In order to enhance the security of such a password, the data length becomes long, and the password cannot be easily remembered by an individual and cannot be entered. Therefore, it is conceivable to use a portable information storage medium such as a smart card that has been used as a bank card, a credit card, a point card, a prepaid card, or the like.

Thus, each user stores user information in advance in the portable information storage medium and inserts the user information into a card reading device connected to the user terminal to access the information. Individual authentication can be performed without having to input user information from an input device.

However, when predetermined user information is stored in such a portable information storage medium, the possibility that the user information is read out from the portable information storage medium is completely denied. It is not possible.
Then, if the user information is obtained from the portable information storage medium, unauthorized access becomes possible.

For this reason, conventionally, a user use control system for performing personal authentication of a user using a user terminal using such a portable information storage medium, together with a program using a command according to its own standard, etc.
It is generally provided to the user.

[0008]

As described above, the portable information storage media developed as described above are provided as a set together with a program for accessing the portable information storage medium by a command according to its own standard. Therefore, the user has the following inconveniences.

A user who uses a plurality of programs developed separately carries a plurality of portable information storage media prepared for each program, and when using each program, inserts it into a user terminal. You have to replace the portable information storage medium.

In particular, in a program using such a portable information storage medium, insertion and removal of the portable information storage medium are monitored in order to prohibit the double use of the portable information storage medium by a plurality of user terminals. ing. Moreover, each program used on the user terminal uses its own portable information storage medium based on its own security conditions. Therefore, even if one user terminal is used, if the user replaces the portable information storage medium inserted in the card reading device in order to use a new program, it will be used up to that time. In most cases, the programs that were used can no longer be used. That is, the user cannot use the plurality of programs at the same time.

In order to eliminate such inconvenience for the user, it is conceivable to store user information of a plurality of programs in one portable information storage medium.

However, in the case where the user information of a plurality of programs is to be stored in one portable information storage medium, the program must be compatible with the types and standards of the plurality of portable information storage media. This causes problems such as an increase in the development load of the program developer and a prolonged development period.

According to the present invention, while storing user information in a portable information storage medium, a program that uses the user information can store desired user information from a portable information storage medium without being conscious of the type or standard of the portable information storage medium. It is an object of the present invention to obtain a user use control system, a user use control method, and a user use control program that pursue convenience of users and program developers.

[0014]

In order to solve the above-mentioned problems, a user use control system according to the present invention is incorporated in a user terminal and various types of user information are stored in a portable information storage medium using user information. A user use control system for managing execution and / or processing of a program, comprising: a portable information storage medium for storing each user information by adding a different identification number to each user information; and specifying the identification number from the program. User information reading means for converting a user information read request command into a request command that can be processed by the portable information storage medium and then performing read processing on the portable information storage medium.

If this configuration is adopted, the user information read request command output from the program is converted by the user information read means into a request command that can be processed by the portable information storage medium, and the converted request command is used. User information can be read from the portable information storage medium.

Therefore, while storing the user information in the portable information storage medium, in a program utilizing the user information, a desired information can be obtained from the portable information storage medium without being conscious of the type and standard of the portable information storage medium. User information can be read. As a result, even if the above-mentioned program is made to correspond to a plurality of portable information storage media, the program developer only needs to write one program, and there is no increase in the development load and the development period is prolonged. .

In addition, since each program can be made to correspond to a plurality of portable information storage media in this way, the user can store the user information used by the plurality of programs on one provided portable information storage medium. It can be memorized, it is possible to insert and remove the card and use multiple programs at the same time, which is very convenient.

The user use control system according to the present invention comprises a correspondence table for storing a read request command corresponding to the type of the portable information storage medium in correspondence with a user information read request command from a program. The reading means generates a request command that can be processed by the portable information storage medium based on the correspondence table.

With this configuration, the user information reading means can convert the user information reading request command output from the program into a request command corresponding to the type and standard of each portable information storage medium. In particular,
By providing the correspondence table in this way, it is possible not only to simply replace the command, but also to make a plurality of request commands correspond to one request command before conversion.

Thus, the type of request command used in each program can be set without being bound by a plurality of standard-specific command types, and used in each program while supporting a plurality of standard-specific commands. Request commands can be independently defined. As a result, an easy-to-use command can be provided to the program developer, and the development efficiency can be further improved.

In the user use control system according to the present invention, the correspondence table associates a command commonly used in the types or standards of a plurality of portable information storage media with a user information read request command from each program. A table that additionally associates a command used only in each type or standard with the commonly used command, and a determination unit that determines the type or standard of the portable information storage medium; Storage means for storing a result of the determination by the determination means, wherein the user information reading means generates a request command corresponding to the type or standard of the portable information storage medium based on the determination result.

By employing this configuration, it is possible to form a correspondence table in which, for each standard-specific request command commonly used in a plurality of portable information storage media, commands in the plurality of standards are collected. In addition, by adding a command used only in each type or standard to the commonly used command, it is possible to generate a required command for each predetermined standard.

Further, since commands of a plurality of types and standards are grouped for each commonly used standard-specific request command, the data amount of the correspondence table can be reduced by that amount, and users and programs can be reduced. It is possible to achieve both improvement of the convenience of the developer and reduction of the data size of the correspondence table.

The user use control system according to the present invention includes storage means for storing a list of programs which output a user information read request command, and wherein the determination means determines whether or not the portable information storage medium can be accessed. Is periodically monitored, and when the access becomes impossible, each program is stopped based on the list.

With this configuration, user information used in a plurality of programs is stored in one portable information storage medium to improve user convenience, and access is made by removing the portable information storage medium. If it becomes impossible, a plurality of executed programs can be forcibly stopped, so that the same security as that of the conventional portable information storage medium can be secured.

Furthermore, even when a plurality of programs are used at the same time, since each program does not need to monitor the portable information storage medium, the system memory used for executing the programs is wasted. There is no end.

The user use control system of the present invention is a user use control system that is incorporated in a user terminal and manages execution and / or processing of various programs using user information stored in a portable information storage medium. Storage means for storing a list of programs that use the user information; and periodically monitoring whether or not the portable information storage medium can be accessed. Determination means for stopping each program based on the determination.

If this configuration is adopted, user information to be used in a plurality of programs is stored in one portable information storage medium to improve the convenience of the user, and access is made by removing the portable information storage medium. If it becomes impossible, a plurality of executed programs can be forcibly stopped, so that the same security as that of the conventional portable information storage medium can be secured.

Further, even when a plurality of programs are used at the same time, since each program does not need to monitor the portable information storage medium, the system memory used for executing the programs is wasted. There is no end.

According to the user use control method of the present invention, various types of user information used by a user terminal are stored in a portable information storage medium, and a read request command for the user information output from a program executed on the user terminal is provided. Into a request command that can be processed by the portable information storage medium,
Further, the user information is read from the portable information storage medium using the converted request command.

If this method is adopted, the user information read request command output from the program is converted by the user information read means into a request command that can be processed by the portable information storage medium, and the converted request command is used. User information can be read from the portable information storage medium.

Therefore, while storing the user information in the portable information storage medium, in a program using the user information, a desired information can be obtained from the portable information storage medium without being conscious of the type and standard of the portable information storage medium. User information can be read. As a result, even if the above-mentioned program is made to correspond to a plurality of portable information storage media, the program developer only needs to write one program, and there is no increase in the development load and the development period is prolonged. .

In addition, since each program can be made to correspond to a plurality of portable information storage media in this way, the user can store user information used by a plurality of programs in one portable information storage medium provided for each program. It can be memorized, it is possible to insert and remove the card and use multiple programs at the same time, which is very convenient.

According to the user use control method of the present invention, a list of programs utilizing user information stored in a portable information storage medium is stored in a storage means, and whether or not the portable information storage medium can be accessed is determined. Is periodically monitored, and if the access becomes impossible, each program is stopped based on the list.

If this method is adopted, user information used in a plurality of programs is stored in one portable information storage medium to improve the convenience of the user, and access is made by removing the portable information storage medium. If it becomes impossible, a plurality of executed programs can be forcibly stopped, so that the same security as that of the conventional portable information storage medium can be secured.

Furthermore, even when a plurality of programs are used at the same time, it is not necessary for each program to monitor the portable information storage medium, so that the system memory used for executing the programs is wasted. There is no end.

The user use control program of the present invention is a user use control program which is installed on a user terminal and reads various user information used by the user terminal from a portable information storage medium, and is executed on the user terminal. Converting the user information read request command output from the program into a request command that can be processed by the portable information storage medium; and reading the user information from the portable information storage medium using the converted request command. Performing a process.

With this configuration, the user information read request command output from the program is converted by the user information read means into a request command that can be processed by the portable information storage medium, and the converted request command is used. User information can be read from the portable information storage medium.

Therefore, while the user information is stored in the portable information storage medium, the program using the user information can store the desired information from the portable information storage medium without being conscious of the type or standard of the portable information storage medium. User information can be read. As a result, even if the above-mentioned program is made to correspond to a plurality of portable information storage media, the program developer only needs to write one program, and there is no increase in the development load and the development period is prolonged. .

Moreover, since each program can be made to correspond to a plurality of portable information storage media, the user can store user information used by the plurality of programs in one portable information storage medium provided for each program. It can be memorized, it is possible to insert and remove the card and use multiple programs at the same time, which is very convenient.

The user use control program of the present invention is a user use control program which is installed in a user terminal and reads various user information used by the user terminal from the portable information storage medium, and is stored in the portable information storage medium. Storing a list of programs using the user information in the storage means, and periodically monitoring whether or not the portable information storage medium can be accessed. Stopping each program based on the program.

If this configuration is adopted, user information used in a plurality of programs is stored in one portable information storage medium to improve user convenience, and access is made by removing the portable information storage medium. If it becomes impossible, a plurality of executed programs can be forcibly stopped, so that the same security as that of the conventional portable information storage medium can be secured.

Further, even when a plurality of programs are used at the same time, since each program does not need to monitor the portable information storage medium, the system memory used for executing the programs is wasted. There is no end.

[0044]

DESCRIPTION OF THE PREFERRED EMBODIMENTS A user use control system and a user use control program according to an embodiment of the present invention will be described with reference to the drawings. In addition, various programs such as a user use control program are generally provided to each user on a computer-readable recording medium on which the program is recorded. The description will be made assuming that the program recorded on the medium is already installed in the program storage unit 15 of the user use control system.

FIG. 1 is a system configuration diagram showing an example of a user use control system according to the first embodiment of the present invention.

A user use control system according to the present invention comprises a card type information recording medium 1 as a portable information storage medium such as a smart card, and a user terminal provided with a card reading device 2 into and from which the card type information recording medium 1 is inserted and removed. 3, a network 4 connected to the user terminal 3, and databases 5 and 6 connected to the network 4 and holding various data. These databases 5,
Numeral 6 stores, for example, open data such as a homepage, or closed data such as confidential business information to which only some users are allowed to access. In particular, when the data is closed data, the user authentication is performed when the user terminal 3 accesses the data.

The network 4 is connected to the Internet 7 as an open network, an intranet 9 connected to the Internet 7 via a firewall 8 and connected to one database 5, and connected to the Internet 7 via a firewall 10. And an intranet 11 to which the other database 6 and the user terminal 3 are connected. Each of the firewalls 8 and 10 is generally connected to the Internet 7.
When there is an access request from, processing such as user authentication is performed, and access to the intranet 7 is permitted if the user is qualified.

The user terminal 3 mainly executes a central processing unit (CPU: Central Processing) for executing various arithmetic processing and control processing based on programs.
(Unit) 12, a system memory 13 used by the central processing unit 12 when executing a program, a timer 14 for performing a timer interrupt to the central processing unit 12 at a time set by the central processing unit 12, A storage device 17 including a program storage unit 15 for storing and a data storage unit (storage unit) 16 for storing various data used when executing the program, and a system bus 18 for interconnecting these.
And.

In the user terminal 3, a peripheral device interface (peripheral device I / F) 19 is further connected to the system bus 18, and further, the input device 20, the display device and the display device are connected to the peripheral device interface 19. 2
1, various peripheral devices such as a printing device 22, a communication device 23, and a card reading device 2 are connected. The communication device 23 is directly connected to the intranet 11.

FIG. 2 is a circuit block diagram showing an example of the card type information storage medium 1 in the user use control system of FIG.

The card type information storage medium 1 includes a central processing unit (CPU) 24 for executing various arithmetic processing and control processing based on a program, and a system memory used by the central processing unit 24 for executing the program. 25,
A card memory 28 including a program storage unit 26 for storing the program and a data storage unit 27 for storing various data used when executing the program;
A system bus 29 for interconnecting them. The central processing unit 24 has a card I / F directly connected to the card reading device 2 when a card is inserted.
The unit 30 is connected. In this embodiment,
Although a contact-type smart card inserted into the card reading device 2 is described as an example, a non-contact-type smart card has the same convenience as long as it is a portable information storage medium.

The program storage unit 26 has a data input / output control program 31, a standard command execution program 3,
2, encryption program 33, other central processing unit 24
Is stored. Note that the encryption program 33 may be executed by the central processing unit 24 as described above. However, in order to further improve security, a special program specialized in encryption is provided separately from the central processing unit 24. A cryptographic processing device that performs arithmetic processing by means of simple arithmetic logic may be separately provided, and the encryption and decryption processing may be performed here.

The data input / output control program 31 establishes a session transmitted from the central processing unit 12 of the user terminal 3 to the card I / F unit 30 through the system bus 18, the peripheral device I / F unit 19, and the card reading device 2. It is read into the system memory 25 based on the request and executed by the central processing unit 24. The central processing unit 24 that executes the data input / output control program 31
Receives a command for each standard from the central processing unit 12 of the user terminal 3, and further responds to the central processing unit 12 with a result of execution of the command for each standard. After this response, the execution is terminated and the session is released.

The standard command execution program 32 is read into the system memory 25 in response to the reception of the standard-specific command, and executed by the central processing unit 24.
The central processing unit 24 that executes the standard command execution program 32 executes a standard-specific command, and executes, for example, a process of reading predetermined data from the data storage unit 27 by executing the command.

The encryption program 33 is read into the system memory 25 when performing the encryption or decryption processing, and is executed by the central processing unit 24. As a result, various types of user information can be encrypted and stored in the data storage unit 27, and can be decrypted and used by the user terminal 3.

Incidentally, the card type information storage medium 1 includes:
As described as a standard command execution program rather than a command execution program, there are many standards depending on the application and the like. For example, there are standards established by banks to provide their services, standards established by credit companies to provide their services, and standards established by government agencies to provide their services. In addition, companies and companies that provide security in Internet networks have also established their own standards. In this way, each company can provide a more secure user information management service by establishing its own standard.

Therefore, in various application programs utilizing these services, commands (standard-specific commands) that are different for each standard are usually transmitted to the card-type information storage medium 1, whereby predetermined user information is transmitted. Must get.

The data storage unit 27 stores the card identification number 3
4 together with the network login information 35, the database login information 36, the client login information 37, the electronic money information 38, the user identification information 39, the user terminal login information 40, the dial-up information 41, and the other user terminals 3 and the like. Various types of user information are stored.

The card identification number 34 is a unique number corresponding to a card vendor that provides the card type information recording medium 1 and a type of card in the vendor. Thereby, the type of the card-type information recording medium 1 and the corresponding standard can be determined.

FIG. 3 is an explanatory diagram showing an example of data mapping of the data storage section 27 in the card type information storage medium 1 of FIG.

The data storage unit 27 includes a management area 42 for one master file and a management area 43 for a plurality of dedicated files set from the head position. Each of the management areas 42 and 43 is set as a continuous area on the data storage unit 27.

In the management area 42 of the master file, a master file 44 (a part enclosed by [] starting with “MF tag number” in the management area 42 in FIG. 3) is stored at the head position thereof, and subsequently, One or a plurality of elementary files 45 (in FIG.
2) (a portion enclosed by [] starting with “EF tag number”) is stored.

In the management area 43 of each dedicated file, a dedicated file 46 (starting with “DF tag number” in the management area 43 in FIG.
) Is stored, followed by one or more elementary files 47 (the part enclosed by [] starting with “EF tag number” in the management area 43 in FIG. 3). ing. The user information is stored in a data field of the elementary file 47 stored in the management area 43 of the dedicated file, as described later.

The data mapping method of the data storage unit 27 will be further described with reference to FIG.

In this embodiment, as shown in FIG. 4A, the data storage unit 27 classifies and manages a management area 42 for one master file and a management area 43 for a plurality of dedicated files. Is done.

The management area 42 of the master file is set as an area including the head position of the data storage unit 27, and the management area 43 of each dedicated file is one address space that continues the other areas. Are defined for each predetermined data size. For example, in a case where single sign-in (for example, all programs of the user terminal 3 can be used by one ID) is to be realized in all of the plurality of user terminals 3, the management area of each dedicated file 43,
The number of the user terminals 3 for inserting and removing the card-type information storage medium 1 may be provided. In FIG. 4, single sign-in can be realized in eight user terminals 3.

In the master file management area 42, a master file ([M in FIG. 4A)
F]. ) 44 is stored, followed by various elementary files (denoted as [EF]) 45. Management area 4 for each dedicated file
3 has a dedicated file ([D
F]), and various elementary files (noted [EF]) 47 are stored next to it.

The master file [MF] 44 is shown in FIG.
As shown in (B), it is composed of a tag field, a size field, and a data field. In the tag field of the master file [MF] 44, a specific tag number predetermined based on the standard of the card type information storage medium 1 or the like is assigned. Master file [M
In the data field of [F] 44, for example, the names (tag field values) of all the dedicated files [DF] 46 provided in the card type information storage medium 1 are stored. The size field stores a value corresponding to the size of the data field, such as the number of bytes and the number of bits.

As shown in FIG. 4C, the dedicated file [DF] 46 includes a tag field, a size field, and a data field. The tag fields of the dedicated file [DF] 46 are assigned unique tag numbers having different values.
This value is different from the tag number in the tag field of the master file 44. The data field of the dedicated file [DF] 46 stores, for example, a password required to access the elementary file [EF] 47 in the management area 43 of the dedicated file.

Elementary file [EF] 45, 47
Is composed of a tag field, a size field, and a data field, as shown in FIG. The tag fields of the elementary files [EF] 45 and 47 are assigned unique tag numbers with different values. This value is different from the value of the tag number of the master file 44 and the value of the tag number of the dedicated file 46, and is a unique value for each user information. When a plurality of pieces of user information are used in one program, a unique value is set for each piece of user information.

The elementary file [EF] 4
When the data fields 5 and 47 are stored in the management area 43 of the dedicated file, the user information itself or an encrypted one is stored.
When stored in the management area 42 of the master file, data for managing the entire card, such as a card identification number, is stored as it is or after being encrypted.

As described above, in the card type information storage medium 1 of this embodiment, each user information and card identification number are
Each is associated with a unique tag number and managed as a separate file (elementary file [EF] 47). Each file (elementary file [EF] 47) includes a plurality of application AP programs 49, 50,
51 (see FIG. 5) or for each user terminal 3 and 1
It is classified into an area where the access is controlled by one password (the management area 43 of the dedicated file).

In order to read out predetermined user information from the card type information storage medium 1 on which such data mapping is performed, first, the user information is basically stored in the central processing unit 24. The management area 43 of the dedicated file is specified. Next, the password stored in the dedicated file [DF] 46 is collated. After the passwords match, the elementary file [ EF] 47
Is selected, and the user information is read from the data field of the elementary file 47.

FIG. 5 is an explanatory diagram showing an example of the configuration of the program storage section 15 in the user use control system of FIG.

The program storage unit 15 of the storage device 17 includes an operating system program (OS program) 48 as a program installed from a recording medium (not shown), and a central processing unit under the management of the OS program 48. Communication application program (communication application A)
P program) 49, client application program (client application AP program) 5
0, an electronic transaction application program (electronic transaction application program) 51, a single sign-in application program (single sign-in application program) 52, and other application programs executed by the central processing unit 12.

The OS program 48 includes a system resource monitoring control program 53, a program exclusion control program 54, an inter-program communication program 55, and other programs for executing various application programs on the user terminal.

System resource monitoring control program 53
Are first read into the system memory 13 when the power to the user terminal 3 is turned on, and are executed by the central processing unit 12. The central processing unit 12 (corresponding to the system resource monitoring control means 56 in FIG. 6) that executes the system resource monitoring control program 53 mainly includes the timer 14, the peripheral devices 20, 21, 22, 23, 2
And the like, and manages data and commands from the timer 14, the peripheral devices 20, 21, 22, 2
It is used to input and output data to and from 3 and 2.

In particular, when accessing the card type information storage medium 1, the central processing unit 12 executing the system resource monitoring control program 53 establishes a session with the card type information storage medium 1 every time, Above, the command is transmitted to the card type information storage medium 1, and the response data is received from the card type information storage medium 1. After receiving the response, the central processing unit 12 executing the system resource monitoring control program 53 releases the session. By establishing and releasing a session each time the card-type information storage medium 1 is accessed in this manner, a plurality of application programs (AP programs) individually and directly access one card-type information storage medium 1. It is possible to do.

Currently, the command transmission procedure for such a card-type information storage medium 1 is based on ISO7816-
3 and other data communication standards (protocols).

The program exclusive control program 54 is first read into the system memory 13 when the power to the user terminal 3 is turned on, and is executed by the central processing unit 12. The central processing unit 12 that executes the program exclusion control program 54 mainly reads a predetermined program into the system memory 13 in response to the interrupt or the like, and executes a process between a plurality of programs read on the system memory 13. The execution schedule is managed by time sharing, etc., and each program is stored in the central processing unit 1.
2 is executed.

The system resource monitoring control program 53 and the program exclusive control program 54
Are scheduled to be executed periodically by the central processing unit 12.

The inter-program communication program 55 is a program for controlling the transfer of data and commands between a plurality of programs, and is executed by the central processing unit 12 when data or commands are output from a certain program. Things.

The communication application AP program 49 includes a user information acquisition program 57 and a user information tag number list 58. The communication application AP program 49 is read into the system memory 13 in response to an interrupt request from the input device 20, and the like. Is executed. The central processing unit 12 executing the communication application AP program 49 establishes a virtual line of a predetermined band on the network 4 using the communication device 21.

The user information tag number list 58 is a list in which user information and [EF] tag numbers are associated with all user information used in the communication application AP program 49.

The user information acquisition program 57 is read into the system memory 13 as appropriate, for example, at the time of login authentication to the network 4 and the databases 5 and 6 with the execution of the communication application AP program 49 and executed by the central processing unit 12. Is what is done. The central processing unit 12 (corresponding to the user information acquisition means 59 in FIG. 6) that executes the user information acquisition program 57 corresponds to the user information required by the communication application AP program 49 [EF].
The tag number is obtained from the user information tag number list 58,
This [EF] common read access command specifying the tag number is transmitted to the single sign-in AP
The processing to be passed to the program 52 is performed.

The client application AP program 5
Numeral 0 is a program for executing various data processing and the like using data on the databases 5 and 6, and is read into the system memory 13 in response to an interrupt request from the input device 20 and the like. 12 is executed. In addition, electronic trading application AP
The program 51 is a program for receiving various products and services provided and sold on the network 4 using electronic money (electronic token), and receives a system request in response to an interrupt request from the input device 20. It is read into the memory 13 and executed by the central processing unit 12. And these applied AP programs 5
0 and 51, a user information acquisition program 57 for acquiring various types of user information from the card-type information storage medium 1.
And a user information tag number list 58 storing [EF] tag numbers used by the user information acquisition program 57 to acquire each piece of user information. The user information is read and used as appropriate.

The [EF] tag number of each user information registered in each user information tag number list 58 is different from each other for each user information as described above. Is a number that is commonly set by the other users. Further, the same user information may be used in a plurality of application AP programs, or may be used a plurality of times in the same application AP program.

Single sign-in AP program 52
Are read into the system memory 13 by receiving user information acquisition requests (such as the common read access command specifying the [EF] tag number) from the various application programs 49, 50, and 51. Apparatus 1
2 is executed. In addition, the single sign-in AP program 52 is used by the user to input a password once, and the plurality of application AP programs 4
To enable the use of 9, 50, and 51, a common command exclusion control program 60, a common command conversion program 61, a password cache program 62, a card insertion / removal monitoring program 63, a card type determination program 64, a card identification number tag number Data 65, single sign-in tag number data 66, card identification number list by standard 67, command correspondence table (correspondence table) 68
And so on.

The card identification number list 67 for each standard is provided by each card vendor and the like in order to determine the type of the card-type information storage medium 1 and the standard of the standard-specific command executable on the card-type information storage medium 1. This is a list in which the type and the standard are associated with each provided card identification number. Thus, it is possible to determine from which vendor the card type information storage medium 1 inserted in the card reading device 2 is supplied based on the card identification number.

The card identification number tag number data 65 is data of the [EF] tag number associated with the card identification number. This card identification number tag number is
In this service, a predetermined unique number is used irrespective of the card vendor, the type and the standard.

Single sign-in tag number data 66
Is specified by a vendor or a company that provides these services in order to perform authentication in units of a plurality of application AP programs 49, 50, and 51 or in units of user terminals [E
F] Tag number data.

The command correspondence table 68 is a table in which each common command is associated with a standard-specific command in each standard. Thus, if the standard of the card-type information storage medium 1 can be specified, a standard-specific command to be transmitted to the card-type information storage medium 1 can be specified based on the common command.

The card insertion / removal monitoring program 63 is read into the system memory 13 when the single sign-in AP program 52 is started, and thereafter is periodically executed by the central processing unit 12 in response to a timer interrupt or as a thread. It is. The central processing unit 12 (corresponding to the card insertion / removal monitoring means 69 as the determination means in FIG. 6) that executes the card insertion / removal monitoring program 63 periodically monitors, for example, a card insertion detection flag or the like in the card reading device 2, and firstly Card type information storage medium 1
When the insertion is detected, an activation notification to the card type determination program 64 is output.

When the card type information storage medium 1 is removed, it is registered in all the programs 60, 61, 62, 63, 64 constituting the single sign-in AP program 52 and an execution AP list 75 (see FIG. 6) described later. A stop notification (callback) is sent to all of the application programs that have been
In the P program 52, all data stored in the system memory 13 and the data storage unit 16 are deleted.

Thus, the system memory 13 is redundantly and redundantly used, for example, when a plurality of user information acquisition programs 57,..., 57 are individually monitored for insertion / removal of the card type information storage medium 1. The execution of a plurality of applied AP programs can be stopped according to the operation of removing the card-type information storage medium 1 without wasting.

The card type discrimination program 64 is read into the system memory 13 in response to the activation notification from the card insertion / removal monitoring program 63, and is executed by the central processing unit 12. The central processing unit 12 (corresponding to the card type judging means 70 as the judging means in FIG. 6) executing the card type judging program 64 designates the card identification number tag number data 65 to read and access the card type information storage medium 1. Then, the obtained card identification number is compared with the standardized card identification number list 67, and the card type information storage medium 1 inserted in the card reading device 2 is compared.
The type and the standard. The determination result is used as the card type data 71 (see FIG. 6) in the data storage unit 16.
To memorize.

The common command conversion program 61 is read into the system memory 13 based on the output of the common command from the user information acquisition program 57, and executed by the central processing unit 12. The central processing unit 12 executing the common command conversion program 61 (corresponding to a common command conversion unit 72 as a user information reading unit in the figure) determines a standard to convert the common command using the card type data 71, The standard-specific command is generated (extracted) from the command correspondence table 68 using the standard and the common command.
As a result of this processing, the command correspondence table 68
May be one or a plurality of standard commands arranged in a predetermined order.

The central processing unit 12 executing the common command conversion program 61 transmits the extracted standard-specific command to the system resource monitoring control program 53 by inter-program communication. It is transmitted to the central processing unit 24 of the type information storage medium 1. Further, the central processing unit 12 executing the common command conversion program 61 transmits the user information received from the system resource monitoring control program 53 to predetermined application AP programs 49, 50, and 5, respectively.
Notify 1

The common command exclusive control program 60
It is read into the system memory 13 together with the common command conversion program 61 and executed by the central processing unit 12. Central processing unit 12 that executes the common command exclusion control program 60 (corresponding to the common command exclusion control means 73 as the request exclusion control means in FIG. 6)
Are a plurality of user information acquisition programs 57,.
7 is stored in the data storage unit 16 as the common command FIFO 74, and is executed from the previously input common command, and when the execution of the common command is completed, the next common command is sequentially and exclusively executed. It is.

The central processing unit 12 executing the common command exclusion control program 60 receives all common application programs 4 which have received the common command and have not completed the processing.
The list of 9, 50, and 51 is stored in the data storage unit 16 as the execution AP list 75.

The password cache program 62 is
When the common command conversion program 61 and the common command exclusion control program 60 are first executed, the system memory 13 is stored based on the fact that the cache password 76 (see FIG. 6) is not stored in the data storage unit 16.
And is executed by the central processing unit 12. The central processing unit 12 (corresponding to the password cache unit 77 as a password input unit in FIG. 6) that executes the password cache program 62 causes the display device 21 to display a window or the like for inputting a password for single sign-in. Is acquired, and the acquired character string is stored in the data storage unit 16 as the cache password 76.

Here, the significance of the command interpreter processing of the common command by the common command conversion program 61 using the command correspondence table 68 will be described in detail.

As described above, the vendor of each card-type information storage medium 1 controls the reading and writing of data from and to the data storage unit 27 using its own command system in order to ensure security and the like. . In particular, for security and authentication related vendors,
We dare to build our own command system to ensure high security and authentication. Therefore, conventionally, when the user information acquisition program 57 is developed, the application A
For each standard used in the P program, a program for acquiring user information in each procedure must be created separately. That is, one application A
In order to make the P program compatible with the card-type information storage medium 1 based on a plurality of standards, it is necessary to develop programs for acquiring user information by the number of the standards.

In order to avoid this problem, in this embodiment, a command correspondence table 68 is provided. In each application program, a common command is output from the user information acquisition program 57, and the common command is converted into a standard-specific command by the common command conversion program 61.

Thus, each application program can support a plurality of standards only by developing one program described by a common command. There is no need to be conscious of the standard of the information storage medium 1 at all, and development becomes extremely easy.

Further, in the present embodiment, efforts are made to create the command correspondence table 68 itself.

If no special countermeasures are taken, a common command is defined in this way, and if the command is interpreted using the command correspondence table 68, the command correspondence table 68 Each time, the standard-specific commands of all the standards must be individually associated with each other, and a command list having an enormous data size is required.

However, the card type information storage medium 1
Are used mainly for personal authentication and security, as represented by the above-mentioned smart card. The standard-specific commands provided by each vendor for this purpose include, for example, the above-mentioned dedicated file. In order to access the management area 43, a standard-specific command that is originally unnecessary is often adopted. In addition, those commands that are not required by the standard are often used only as a set with the basic commands.

That is, the standard-specific commands in the card-type information storage medium 1 include basic standard-specific commands originally required for accessing data (standard-specific commands that can be commonly used in a plurality of standards). In addition to the above, there are special standard-specific commands unique to each standard (standard-specific commands that can be used only in specific standards).

In this embodiment, in consideration of the specialty of the standardized commands in the card type information storage medium 1, only the basic standardized commands are supported in the basic command list directly corresponding to each common command. The special standard-specific commands unique to the above-described standard are provided in a command correspondence table 68 in which an additional command set is appropriately added to the basic command list based on the card type data. In addition, the card type data is used to determine whether to generate a standard-specific command to which a special standard-specific command unique to this standard is added.

Thus, the command correspondence table having a smaller total data amount than the command correspondence table in the case where a command list including a special standard command and a command list not including the special standard command are provided for each standard command. 68 can be described. As a result, both simplification of the development of the user information acquisition program 57 and reduction of the data amount of the command correspondence table 68 can be achieved.

Next, the operation of such a user use control system will be described.

When the power of the user terminal 3 is turned on, the central processing unit 12 confirms that the system memory 13 and the like are normal, and then stores the OS program 48 stored in the program storage unit 15 into the system memory 13. And execute it. This allows various peripheral devices 2
0, 21, 22, 23, and 2 are managed by the central processing unit 12.

The system resource monitoring control program 53 and the program exclusion control program 54 of the OS program 48 execute the timer 1
4 or periodically at predetermined time intervals. Thus, the central processing unit 12 manages interrupt requests from the peripheral devices 20, 21, 22, 23, 2 and data input / output to / from the peripheral devices 20, 21, 22, 23, 2, while managing various applications. The program can be executed by time sharing.

After the initial setting of the user terminal 3 by the OS program 48 is performed, for example, first, in response to the user's operation on the input device 20, for example,
When a start request for the communication application AP program 49 is input to the central processing unit 12, the central processing unit 12
Stores the applied AP program 49 in the program storage unit 1
5 is read into the system memory 13 and executed.

The communication application AP program 49
Then, in order to obtain network login information and database login information from the card-type information storage medium 1,
The user information acquisition program 57 is activated.

The central processing unit 12 that executes the user information acquisition program 57 sends the user information tag number list 5
8 to obtain the [EF] tag number corresponding to the network login information and the database login information, and to exclude the common user information read command for reading the user information corresponding to the [EF] tag number from the common command. Delivered to the control program 60 by inter-program notification.

The central processing unit 12 executing the common command exclusive control program 60 registers the communication application AP program 49 in the execution AP list 75 and transfers the common user information read command to the common command conversion program 61.

Also, the password cache program 6
2 is executed by the central processing unit 12, and as a result, the character string input by the user using the input device 20 or the like is stored in the data storage unit 16 as the cache password 76. In the data storage unit 16, it is preferable that the character string be encrypted and stored.

The central processing unit 12 executing the common command conversion program 61 uses the card type data 71 and the command correspondence table 68 to execute the above-mentioned common user information read command and the equivalent processing thereof on the card type information storage medium 1.
A command for each standard for instructing the central processing unit 24 is generated and transferred to the system resource monitoring control program 53.

The standard-specific command generated here is, for example, the management area 43 of the dedicated file using the single sign-in tag number data 66 in the central processing unit 2.
4 and the management area 43
And the elementary file 47 for storing the [EF] tag number in the central processing unit 24.
, A command according to a reading standard for reading data from the data field of the selected elementary file 47, and a command according to a transmission standard for transmitting the read data.

System resource monitoring control program 53
The central processing unit 12 for executing the data input / output control program 31 through the path from the system bus 18 to the card I / F unit 30
A session is established with the central processing unit 24 based on the PC / SC protocol or the like, and commands for each standard are transmitted. When the central processing unit 24 of the card-type information storage medium 1 receives each standard-specific command, it executes the standard command execution program 32.

Central processing unit 2 for card type information storage medium 1
4 receives all the above-mentioned standard-specific commands and sequentially executes the commands in the order of reception. As a result, in the card-type information storage medium 1, processing of an appropriate standard-specific command conforming to each standard is executed, and the central processing unit 12 of the user terminal 3.
Is [E] regardless of the type of the card-type information storage medium 1.
F] Network login information and database login information associated with the tag number can be obtained from the card-type information storage medium 1.

The user information obtained from the card type information storage medium 1 is transmitted from the central processing unit 12 operating based on the common command conversion program 61 to the communication application AP.
The central processing unit 12, which is passed to the user information acquisition program 57 of the program 49 and executes the communication application AP program 49, establishes a virtual line for the intranets 9, 11 by transmitting network login information from the communication device 21. Also, by transmitting database login information from the communication device 21, it is possible to read and write data in the databases 5 and 6.

After the communication application AP program 49 accesses the card type information storage medium 1 as described above, if the client application AP program 50 acquires the client login information by using the user information acquisition program 57, the single application Since the sign-in password is stored in the data storage unit 16 as the cache password 76, the password cache program 62
Is not invoked.

Similarly, the electronic trading application AP program 51
When the user acquires the electronic money information using the user information acquisition program 57, the password for single sign-in is stored in the data storage unit 16 with the cache password 7
6, the password cache program 62 is not started.

When a new common command is received while the common command conversion program 61 is operating, the central processing unit 1 that executes the common command exclusion control program 60
2 sequentially stores the common command in the common command FIFO 74 and, when the execution of the previously input common command ends, sequentially passes the next common command to the common command conversion program 61.

As described above, a plurality of applied AP programs 4
The user information used in 9, 50 and 51 is stored in the management area 43 of the dedicated file managed by one password, and the password input by the user is cached in the data storage unit 16 until the use is completed. By doing so, the user can use the application programs 49, 50, and 51 by inputting the password once. Thereby, a single sign-in service can be provided to the user.

The above-mentioned plurality of application AP programs 49 and 5
The concept of the access to the card-type information storage medium 1 by 0, 51 is as shown in FIG. The user information read request from each application AP program is transmitted in order from the upper means in the figure to the lower means, and the response of the user information to the request is sent from the lower means in the figure to the upper means in order. Sent.

The above embodiment is a preferred embodiment of the present invention, but various changes can be made without departing from the gist of the present invention. For example, in the above-described embodiment, the case where the user directly uses the user terminal 3 has been described. It is provided at a user terminal used by a clerk, an entrance to a building, or the like, and can be suitably used also as a user terminal for managing entry and exit of a user to the building.

Further, in this embodiment, the management area 43 of the dedicated file provided in the card type information storage medium 1 is provided by the number of the user terminals 3 into and out of which the storage medium 1 is inserted. , The user information used in the application program for accessing highly confidential data, etc., is used for other information used on the same user terminal 3. Even if there is an application AP program, it may be managed in a dedicated file management area 43 different from that, and a password may be separately input. In this case, the management area 4 for the dedicated file provided in the card type information storage medium 1
The number 3 is greater than the number of user terminals 3 into which it is inserted and removed. Conversely, it goes without saying that a plurality of user terminals 3 may be set to use the management area 43 of one dedicated file.

Further, in this embodiment, the first application A
The user use control program 57 is started when the P program 49 is started, and at this timing, a password for accessing the management area 43 of the dedicated file used by the user terminal 3 is input. May be entered at the time of activation. In this case, a single sign-in service for each user terminal 3 is provided instead of a single sign-in service for a plurality of application AP programs 49, 50, and 51.

Further, in this embodiment, the card type information storage medium 1 has been described as an example of the portable information storage medium, but the SPO standardized by ISO7816 has been described.
M (self-programmable one-ch
Even a portable telephone terminal incorporating an IC chip of an ip microcomputer type or the like can use other small and removable memory devices in the same manner.

[0134]

According to the present invention, while storing user information in a portable information storage medium, a program utilizing the user information can be used without being aware of the type and standard of the portable information storage medium. Thus, it is possible to obtain a user use control system, a user use control method, and a user use control program that pursue convenience for users and program developers.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing an example of a user use control system according to a first embodiment of the present invention.

FIG. 2 is a circuit block diagram showing an example of a card type information storage medium in the user use control system of FIG.

FIG. 3 is an explanatory diagram showing an example of data mapping of a data storage unit in the card type information storage medium of FIG. 2;

4 is an explanatory diagram of a data mapping method in a data storage unit shown in FIG.

FIG. 5 is an explanatory diagram showing a configuration example of a program storage unit in the user use control system of FIG. 1;

FIG. 6 is a conceptual diagram showing access to a card-type information storage medium by a plurality of application AP programs in the user use control system of FIG.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 Card-type information recording medium (portable information storage medium) 2 Card reading device 3 User terminal 4 Net network 5, 6 Database 7 Internet 8, 10 Firewall 9, 11 Intranet 12 Central processing unit (CPU) 13 System memory 14 Timer 15 Program Storage unit 16 Data storage unit (storage means) 17 Storage device 18 System bus 19 Peripheral device interface unit (Peripheral device I / F unit) 20 Input device 21 Display device 22 Printing device 23 Communication device 24 Central processing unit (CPU) 25 System Memory 26 Program storage unit 27 Data storage unit 28 Card memory 29 System bus 30 Card I / F unit 31 Data input / output control program 32 Standard command execution program 33 Encryption program 4 Card identification number 35 Network login information 36 Database login information 37 Client login information 38 Electronic money information 39 User identification information 40 User terminal login information 41 Dial-up information 42 Master file management area 43 Dedicated file management area 44 Master file 45 , 47 Elementary file 46 Dedicated file 48 Operating system program (OS program) 49 Communication application program (communication application program) 50 Client application program (client application program) 51 Electronic trading application program (electronic trading application program) Program) 52 Single sign-in application program (Single sign-in AP program) 53 System resource monitoring control program 54 Program exclusion control program 55 Inter-program communication program 56 System resource monitoring control means 57 User information acquisition program 58 User information tag number list 60 Common command exclusion control program 61 Common command conversion Program 62 Password cache program 63 Card insertion / removal monitoring program 64 Card type discrimination program 65 Card identification number tag number data 66 Single sign-in tag number data 67 Card identification number list by standard 68 Command correspondence table (correspondence table) 69 Card insertion / removal monitoring means ( Determination means) 70 card type determination means (determination means) 71 card type data 72 common command conversion means (user information reading means) ) 73 Common Commands exclusive control unit (request exclusive control means) 74 common command FIFO 75 execute AP list (a list of programs) 76 cache passwords 77 bus word cache means (password input means)

Continued on the front page F term (reference) 5B035 AA06 AA13 BB09 BC00 CA29 5B058 CA23 CA25 KA02 KA04 YA20 5B076 FB01 5B085 AE02 AE03 AE11 AE12 BC02 BE01 5J104 AA07 KA01 NA35 NA36 NA38 NA41 PA07

Claims (9)

[Claims] 1. A user use control system which is incorporated in a user terminal and manages execution and / or processing of various programs using user information stored in a portable information storage medium. And a portable information storage medium that stores the same by adding different identification numbers to each other, and a user information read request command that specifies the identification number from the program is converted into a request command that can be processed by the portable information storage medium. A user information reading means for performing a reading process on the portable information storage medium. 2. A correspondence table for storing a read request command corresponding to a type of the portable information storage medium in correspondence with a user information read request command from a program, wherein the user information read means includes a corresponding table. 2. The user use control system according to claim 1, wherein a request command that can be processed by the portable information storage medium is generated based on the command. 3. The correspondence table associates a command commonly used in a plurality of types or standards of portable information storage media with a user information read request command from each program, and only in each type or standard. A table that additionally associates a command to be used with the commonly used command, a determination unit that determines a type or a standard of the portable information storage medium, and a determination result by the determination unit. 3. The user according to claim 2, further comprising storage means for storing, wherein the user information reading means generates a request command corresponding to a type or a standard of the portable information storage medium based on the determination result. Use control system. 4. A storage unit for storing a list of programs that output a user information read request command, wherein the determination unit periodically monitors whether or not the portable information storage medium is accessible. 3. The user use control system according to claim 2, wherein when the access becomes impossible, each program is stopped based on the list. 5. A user use control system which is incorporated in a user terminal and manages execution and / or processing of various programs using user information stored in a portable information storage medium, wherein the user information is stored in a user terminal. A storage unit for storing a list of programs to be used, and periodically monitoring whether or not the portable information storage medium can be accessed, and stopping each program based on the list when the access becomes impossible. A user use control system, comprising: a determination unit. 6. A portable information storage medium storing various types of user information used by a user terminal, and transmitting the user information read request command output from a program executed on the user terminal to the portable information storage medium. A user use control method comprising: converting a request command into a request command that can be processed by a user; and performing a process of reading user information from the portable information storage medium using the converted request command. 7. A storage device stores a list of programs using user information stored in a portable information storage medium, and periodically monitors whether or not the portable information storage medium can be accessed. A user use control method, wherein when the access becomes impossible, each program is stopped based on the list. 8. A user use control program which is installed in a user terminal and reads various types of user information used by the user terminal from a portable information storage medium, wherein the user output from the program executed on the user terminal Converting an information read request command into a request command that can be processed by the portable information storage medium, and performing user information read processing from the portable information storage medium using the converted request command. User use control program to be provided. 9. A user use control program which is installed in a user terminal and reads various user information used by the user terminal from a portable information storage medium, wherein the user use control program uses the user information stored in the portable information storage medium. Storing a list of programs in a storage means; periodically monitoring whether or not the portable information storage medium is accessible; and stopping the respective programs based on the list when the access becomes impossible. A user use control program comprising: