JP2002312724A - Ic card operation management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To entrust a specified enterprise with the management/operation of a part of a memory area on a card determined beforehand. SOLUTION: A card issuer (CI) sets the enterprise entrusted as the memory area manager (SO) of the card corresponding to the memory area of a predetermined size on an IC card, and the memory area manager permits a different enterprise to utilize the memory area as the user (SP) of the memory area within the range of the memory area whose management is permitted. Thus, a utilization operation within the range of the predetermined memory area is executed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an IC card operation for outsourcing a process other than the card issuer to load or delete an application and related data in a nonvolatile memory area on a multi-application IC card. It relates to a management method and a system.

[0002]

2. Description of the Related Art In recent years, in the fields of public, financial, telecommunication, transportation, medical care, and electronic commerce on the Internet, etc., as a new information recording medium instead of a magnetic card, tamper-resistant having a large storage capacity with security security. The use of IC cards is spreading. A plurality of applications are mounted on such an IC card, so that a card user can use a plurality of services. In such a multi-application IC card,
It is necessary to mount a new application and related data in the nonvolatile memory area on the IC card or delete unnecessary applications and data. Conventionally, the card issuer manages the entire card, including the management of the memory area.However, the management and operation of the memory area must be performed by other card issuers because the management becomes extremely complicated and operation costs increase. Requests to outsource to other businesses have emerged. However, in the conventional IC card operation management system, since the authority of memory area management was not separated from the card issuer, the management and management of the memory area on the card
The operation could not be outsourced to another company.

[0003]

SUMMARY OF THE INVENTION An object of the present invention is to provide an IC card operation management system and system in which a part of management and operation of a predetermined memory area on a card is entrusted to a designated company. .

[0004]

SUMMARY OF THE INVENTION The present invention provides an IC card in which a process other than the card issuer is entrusted to load or delete an application and related data in a nonvolatile memory area on a multi-application IC card. In the operation management method, the IC card management device on the card issuer side sets the entrusted business operator as the card area manager corresponding to the memory area of a predetermined size on the IC card, and In the IC card management program on the side, the identification information of the card area manager and the size of the memory area or the position information of the memory area entrusted to the card area manager are stored as a pair, Administrator IC
The card area management device manages memory area configuration information such as the size of the memory area permitted to be managed and the remaining size of the memory area. Then, by granting the right to use the memory area to another business, the other business is set as a card area user, and is set in advance in the card business of the other business. And loading or deleting the application and related data within the range of the memory area.

Further, the present invention provides a multi-application
In an IC card operation management system that entrusts the loading or deletion of applications and related data to the nonvolatile memory area on the IC card to a business entity other than the card issuer, the card issuer's IC card management device An IC card management unit for managing issued IC card information and memory area information, and a memory area for entrusting the card area manager with the authority to load or delete applications and related data in the memory area on the IC card. And an area information setting unit for setting the size information or the position information of the memory area, wherein the IC card manages an IC card management program corresponding to what is usually called a card manager and an application from each card area user. A non-volatile memory area having a memory area to be mounted; A signature verification unit for verifying the signature of the card area manager entrusted with the management authority by the card issuer, and a permission of use of the card area user delegated the card area usage authority from the card area manager A certificate verification unit for verifying a certificate, a memory area management unit,
An external interface for accessing an external server, including a memory access management unit, wherein the memory area management unit,
The ID information of the card area manager and the area size for which management is entrusted to the card area manager are stored in pairs, and the size of the remaining area is also managed, and the IC card area management device of the card area manager is stored. A storage unit that stores the identification information of the card area manager itself, and a usage control unit that issues a usage certificate that permits the card area user to mount or delete an application in the memory area. A memory area management unit that manages configuration information for each memory area on an IC card that is entrusted and managed by the card issuer, and an IC that manages IC card information and memory area information entrusted to the card issuer A card management unit, wherein the card area use device of the card area user requests the card area manager to use the memory area of the IC card. Certificate request unit, a card area management unit that manages which application is installed in which area of which IC card, a control unit that controls the process of loading / deleting the application to / from the IC card, and loading the IC card An application management unit for managing an application is provided.

[0006] According to the IC card operation management system and system according to the present invention, it is possible to entrust a part of management and operation of a predetermined memory area on a card to a designated business operator, and to outsource the business. It is also possible to prevent a user from consuming a memory area larger than a predetermined amount.

[0007]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing the configuration of an IC card operation management system according to the present invention.

[0008] The system shown in FIG.
IC card management device 10, IC card 20, and a plurality of entrusted management companies SO (in this example, one card area management in this example) that entrusts and manages the memory area management authority on the IC card from the card issuer CI. And the memory area use authority such as loading or deleting applications and related data in the memory area on the IC card is transferred from the card area manager SO.
Multiple service providers that actually use the memory area
An SP (in this example, only one card area user SP1 is shown) and a card area using apparatus 40 are provided.

[0009] IC card management device 10 of card issuer CI
Is an IC card management unit 11 that manages information of the issued IC card 20 and memory area information, and an area information setting unit that sets the size of the memory area or the position information of the memory area for which management is entrusted to the card area manager SO. 12 and so on.

An IC card 20 is an IC card management program 21 corresponding to what is usually called a card manager.
, A memory area (service domain SD) on which applications AP1, AP2, AP3,... From the respective card area users SP1, SP2, SP3,. I have it. The IC card management program 21 includes a signature verification unit 23 for verifying the signature of the card area manager SO entrusted with the management authority by the card issuer CI, and a card issued from the card area manager SO to the card area user SP. Permit verification section 24 for verifying the area use permit, memory area management section 25, and external interface 35 for accessing external servers (IC card management apparatus 10, IC card area management apparatus 30, and area use apparatus 40).
And a memory access management unit 27. The memory area management unit 25 stores the card issuer CI in the nonvolatile memory area 22.
Area manager who entrusts the management authority of each area in
The identification information of the SO and the area size for which management is entrusted to the card area manager are stored as a pair, and the size of the remaining area is also managed.

The IC card area management device 30 of the card area manager SO1 stores a storage unit 31 for storing the identification information of the card area manager itself of this apparatus, and loads or deletes an application in the memory area of the IC card 20. Permission controller 32 that issues a license to permit the card area user SP to perform the operation, and configuration information for each memory area on the IC card that is entrusted and managed by the card issuer CI,
For example, the memory area management unit 33 that manages the size of the memory area, the objects in the memory area, for example, the configuration of the application, the size of each object, etc., and the IC card information and the memory area information entrusted to the card issuer CI. And an IC card management unit 34 for managing.

The card area use device 40 of the card area user SP1 includes a use certificate (token) requesting unit 41 for requesting the card area manager SO1 to use the memory area of the IC card 20; Card area management unit 42 for managing which application is installed in the area
And application (AP) loading on IC card 20
A control unit 43 for controlling the deletion process and an application (A for managing the application mounted on the IC card 20)
P) The management unit 44 is provided.

Next, the processing procedure of the IC card operation management system according to the present invention will be described with reference to FIG.

First, the card area manager SO who intends to make a contract with the card issuer CI, entrusted with the processing management of loading or deleting the application and data in the non-volatile memory area 32 on the IC card 20, Requests the card issuer CI to generate a memory area to be mounted, that is, a service domain SD, and sets the service domain SD and its own identification information in the memory area management unit 25 (see FIG. 1) of the IC card management program 21. Since it is necessary to have the card issuer send the SO identification information, for example, the public key of the area manager SO to the card issuer CI, an SD generation request is made. The card issuer CI receives the identification information from the area manager SO, verifies this, and if the area manager SO can confirm that it is a valid entrusted area manager, entrusts the management to the card area manager SO. Information of memory area size or memory area position
This is set in the area information setting unit 12 (FIG. 1) of the card management device 10. As a result, a management authority consignment contract between the card issuer CI and the area manager SO has been established on the system.

In this way, the card issuer CI sets the identification information sent from the area manager SO as the identification information on the IC card, and under the control of the area manager SO, the card area user SP After defining the area name of the memory area (service domain SD) in which the application is to be mounted on the IC card, in this example, the area 1 and the size of the area, or the location information of the memory area, the card issuer CI assigns these information to the SO.
Send it to the IC card along with the public key. In response, the IC card sets a service domain SD.

Under the management of the card area manager SO who is entrusted with the management and operation authority of the memory area to the card issuer CI,
The card area user SP who intends to perform the application mounting or deletion processing firstly requests the card area manager SO for the application mounting processing permission from the card area manager SO, and uses the usage identifier, for example, the application ID and the usage area size of this application. Is transmitted to the card area manager SO.

When the card area manager SO receives the license request information sent from the card area user SP,
The configuration information of each memory area on the card is confirmed by the memory area management unit 33 (FIG. 1).
When the usage area size of the application is confirmed to be within the area already managed, the license is transmitted to the card area user SP. This license includes the name of the memory area that permits the card area user SP to load the application, the usage identifier, and the signature of the card area administrator SO. In other words, this license is issued by the card area administrator SO. Proof that it was done.

The card area user SP is a card area manager.
Using the usage certificate sent from the SO, a request to use the memory area, for example, a request to download the application is sent to the IC card. On the IC card side, the signature of the card area manager SO in the license is verified by the signature verifying unit 23 (FIG. 1) using the manager identification information corresponding to the memory area name, so that the license is transmitted to the card. Area manager SO
When the memory area management unit 25 (FIG. 1) confirms the size of the remaining area, the memory area management unit 25 (FIG. 1) transmits a use permission OK signal to the card area user SP. . After that, the card area user SP assigns an area name and starts downloading the application to the IC card. When the application download process is completed on the IC card side, the IC card sends a download receipt to the card area user SP, and the card area user SP sends the download receipt to the card area manager SO. When receiving the download receipt, the card area manager SO sets the area configuration information in the memory area management unit 33 (FIG. 1), and confirms that the memory area is certainly used by the card area user SP. Then, processing such as changing the size of the remaining area is performed.

Although the procedure for deleting or changing the application by the card area user SP is omitted in FIG. 2,
This can be done as follows. First, the card area user SP sends application deletion or change permit request information to the card area manager SO, and the card area manager SO
The side refers to the area configuration information in the memory area management unit 33 (FIG. 1) and confirms that the application requested by the card area user SP can be deleted or changed. To the SP.
The license has a memory area name, a usage identifier, and a signature of the card area manager SO that permit the card area user SP to delete or change the application.

The card area user SP is a card area manager SO
A request to delete or change the application is sent to the IC card using the deletion or change permit from the IC card, and on the IC card side, the card area manager SO in the application deletion or change request information from the card area user SP sends the request. The issued delete or change permit is verified, and if it is confirmed that the permit has been issued by the card area manager SO, the application delete or change process is started. When the predetermined application is deleted or changed from the memory area of the IC card, the IC card sends a deletion or change receipt to the card area user SP. The card area user SP sends a receipt for deletion or change from the IC card to the card area manager SO. The card area manager SO manages the setting of the area configuration information by the deletion or change receipt, that is, the processing of increasing the free area due to the release by the deletion or change of the application, or the processing of setting the area size by the changed application. User memory area management unit 33 (FIG. 1)
To complete the deletion or change processing of the application.

The present invention is not limited to the above-described example, but may be modified in many ways. For example, a card area manager who is entrusted with the management and operation of the memory area by the card issuer may manage and operate the memory area with another card area administrator with the permission of the card issuer. It is also possible to transfer it. In the example described above, the card area manager SO and the card area user
Although the SP and the SP are separate providers, it is a matter of course that the card area manager SO entrusted with the management and operation of the memory area can load and delete applications.

[0022]

As described above, according to the present invention,
The operation of a part of the memory area on the predetermined card can be entrusted to the specified business operator, and the unreasonable consumption of the memory area by the entrusted business operator can be prevented.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of an IC card operation management system according to the present invention.

FIG. 2 is a diagram showing a processing procedure of an IC card operation management system according to the present invention.

[Explanation of symbols]

 CI card issuer SO card area manager SP card area user 10 Card issuer's IC card management device 11 IC card management section 12 Area information setting section 20 IC card 21 IC card management program 22 Non-volatile memory area 23 Business operator identification Unit 24 permit verification unit 25 memory area management unit 26 external interface 27 memory access management unit 30 IC card area management device of card area manager 31 administrator identification information 32 use permission control unit 33 memory area management unit 34 IC card management unit 40 card area user's area use device 41 use permission request unit 42 card area management unit 43 application loading / deletion control unit 44 application management unit

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 2C005 MA20 MA33 MB05 MB08 SA03 SA22 5B035 AA13 BB09 CA29 5B058 CA23 KA08 KA31 YA01 5B076 BA05 BB06 EB02

Claims (3)

[Claims] 1. An IC card operation management system in which loading or deleting of an application and related data in a nonvolatile memory area on a multi-application IC card is entrusted to a business entity other than the card issuer. In the IC card management device on the side, the contractor is set as the card area manager corresponding to the memory area of a predetermined size on the IC card, and the IC card management program on the IC card side The ID information of the card area manager and the size or the position information of the memory area entrusted to the card area manager are stored as a pair, and the IC card area management device of the card area manager is stored. The memory area configuration information such as the size of the memory area permitted to be managed and the remaining size of the memory area is managed by the card area manager. By granting the right to use the memory area to another operator within the range of the entrusted memory area, the other operator is set as a card area user, and the card area of the other operator is set. An IC card operation management method, wherein a use device performs loading or deletion processing of an application and related data within a predetermined memory area. 2. The card area manager entrusted with management of the card area by the card issuer sets another business as a card area manager, and gives the card business to the other business. 2. The IC card operation management system according to claim 1, wherein management of the memory area entrusted by the issuer is entrusted. 3. An IC card operation management system that entrusts the loading or deletion of an application and related data to a nonvolatile memory area on a multi-application IC card to a business entity other than the card issuer. The IC card management device manages the information of the issued IC card and the memory area information, and the card area manager loads or deletes the application and related data in the memory area on the IC card. An area information setting unit for setting the size of the memory area or the position information of the memory area to which management authority is entrusted, wherein the IC card is an IC card management program corresponding to what is usually called a card manager; Non-volatile memory area having a memory area for loading applications from area users The IC card management program verifies a signature of the card area manager entrusted with management authority by the card issuer, and a card area use authority from the card area manager. A license verifying unit for verifying the use license of the delegated card area user, a memory area managing unit, an external interface for accessing an external server, and a memory access managing unit, wherein the memory area managing unit includes: Along with storing the identification information of the card area manager and the area size for which management is entrusted to the card area manager,
The IC card area management device of the card area manager also manages the size of the remaining area, and the storage unit that stores the identification information of the card area manager itself, and the loading or deletion of the application in the memory area is performed. A use permission control unit for issuing a use permit for a card area user, a memory area management unit for managing configuration information for each memory area on an IC card managed by being entrusted to the card issuer, An IC card management unit that manages IC card information and memory area information entrusted to the issuer, wherein the card area user's card area using device is configured to
A license request unit for requesting the card area manager to use the memory area of the card, a card area management unit for managing which application of which IC card is installed in which area, An IC card operation management system, comprising: a control unit that controls application loading / deletion processing; and an application management unit that manages applications loaded on an IC card.