JP2002312737A - Time information acquisition method and expiration time processing method by ic card - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a time information acquisition method for acquiring reliable time information without putting large burdens on an IC card and an expiration time processing method for deciding the expiration time of the various kinds of certification information and right information by using the acquired time information. SOLUTION: The IC card authenticates a time server and acquires and stores the time information issued by a proper time server in response to a time information acquisition start command from a user. By using the time information stored in the IC card, the expiration time of the various kinds of the certification information and the right information are decided.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for acquiring reliable time information from an external device in an IC card, and a method for validating expiration dates of various certification information and right information using the acquired time information. Things.

[0002]

2. Description of the Related Art In recent years, in the fields of finance, telecommunications, transportation, public services, medical care, and the like, as a new information recording medium replacing magnetic cards, I has a large storage capacity that is secure in security.
2. Description of the Related Art An IC card system that uses a C card, mounts a plurality of applications on the card, and provides a plurality of services has appeared. In addition, there have been applications in which a desired application can be downloaded as needed. In such an IC card system, certificate information and authority information having an expiration date such as certificates and tokens of various applications are presented from the IC card operation server to the IC card. However, the IC card has a power supply inside. Because there is no clock inside, it is not possible to know when the current time is, and it is not possible to determine the expiration date of various certification information and right information. If the expiration date is not determined by the IC card, the unauthorized certificate decrypted during that time may be considered valid, and the expiration date by the IC card is determined by the certification information and rights such as certificates and tokens. This is a process required to determine the validity of information.
It is very important for card security.

As a means for solving this problem, there is a method of obtaining and determining reliable time information when certification information / right information is presented on an IC card. However, the determination of the reliability of the time information requires signal processing such as signature analysis and decryption, and it is burdensome to execute this determination every time with an IC card. If the IC card cannot acquire the time information by the method described above due to the signal processing capability of the IC card, it becomes necessary to manage the revocation list of the expired external information in the IC card. Holding the revocation list imposes a heavy burden on the limited memory resources of the IC card.

[0004]

SUMMARY OF THE INVENTION An object of the present invention is to provide an IC
It is an object of the present invention to provide a time information acquiring method for acquiring reliable time information without imposing a heavy burden on a card, and an expiration date processing method for judging the expiration date of various certification information and right information using the acquired time information.

[0005]

According to a time information acquisition method of the present invention, an IC card authenticates a time server in response to a time information acquisition start command from an IC card terminal, and a valid time server issues a command. It is characterized by acquiring and accumulating time information. The expiration date processing method according to the present invention is characterized in that the expiration dates of various certification information and right information are determined using time information acquired from a valid time server and stored in an IC card.

[0006]

According to the present invention, instead of the IC card acquiring time information from the time server each time the certification information / right information is presented, the IC card responds to a time information acquisition start command from the IC card terminal (user). For example, once a month or several times a year,
Since the time server is authenticated and the time information is obtained from the valid time server, the burden of the reliability determination of the time information in the IC card is greatly reduced. In addition, since the reliable time information obtained from the outside is stored in the IC card, when the certification information / right information of the expiration date before the stored time is presented, it can be determined to be invalid. .

[0007]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described with reference to the drawings with reference to embodiments. FIG. 1 shows a configuration of a system for implementing a time information acquisition method and an expiration date processing method of the present invention for acquiring time information from a trusted time server. The acquisition of the time information is started when the user sends a time acquisition start command to the IC card 1 and the time server 2 from an IC card terminal (not shown). In order to obtain reliable time information, the IC card must first confirm whether the time server 2 of the communication partner is reliable and valid. As a method of confirming the validity, there are a method using a common key method and a method using a public key method.

In the method using the common key system, the time server 2 encrypts the time information generated by the time processing unit 23 with the common key in the encryption processing unit 22 and transmits the encrypted time information from the communication processing unit 21 to the IC card 1. In the IC card 1, the encrypted time information is received by the communication processing unit 11, and is decrypted by the time information verification unit 12 using the common key. If the time information can be obtained as a result of the compounding, the time information is valid, and the time information is stored and set in the storage unit 13.
In order to enhance the verification performance, it is also effective to encrypt verification information together with the time information.
In the common key method, the common key must be strictly protected from leaking to the time server and the IC card.

[0009] The method using the public key method includes a method for obtaining and setting reliable time information by one-side authentication and a method for obtaining and setting reliable time information by mutual authentication. In the case of one-side authentication, the IC card generates a challenge (random number) from the time information verification unit 12 and transmits the challenge (random number) from the communication processing unit 11 to the time server 2. The time server 2 generates a signed time information by encrypting the challenge (random number) received by the communication processing unit 21 and the time information generated by the time processing unit 23 with the secret key of the time server 2 in the encryption processing unit 22. , From the communication processing unit 21 to the IC card 1. IC
The card 1 verifies the time information with the signature received by the communication processing unit 11 by decrypting the time information with the public key of the time server 2 in the time information verification unit 12. If the signature is correct, that is, the decrypted random number and the challenge Only when the random numbers match, the obtained time information is stored in the storage unit 13 as valid. This authentication process includes a Get Challenge command specified by the ISO and an external authentication (Extern
al Authenticate) command.

In the method of performing mutual authentication between the IC card and the time server, an internal authentication (Internal authenticate) command is used in addition to the GetChallenge command and the External Authenticate command, and the IC card and the time server are used. And encrypts the random number with each secret key, sends the encrypted random number to the other party, and decrypts with each public key for verification. As a method of mutual authentication, SSL may be used, or any method using a unique mutual authentication command may be used. In the case of mutual authentication, the time information is stored in the IC card in a mutually authenticated state.

If the authentication command and the time information storage command are different commands and the time server authentication and the time information storage setting are not performed at the same time, a third party may set an incorrect time on the IC card after the authentication is completed. Can be set. When it is necessary to prevent such impropriety, a common key used when setting time information can be set in the course of the authentication process, and the time information can be encrypted and transmitted with this common key.

The IC card 1 includes an IC card operation server 3
When certification information / right information having an expiration date such as a certificate or a token is presented from the communication processing unit 31, the expiration date determination unit 14 compares the time information stored in the storage unit 13 with the expiration date. The expiration date is determined.

[0013]

According to the present invention, the IC card does not acquire the time information from the time server every time the certification information / right information is presented, but authenticates the time server once a month or several times a year, for example, to authenticate the time server. Since time information is obtained from a simple time server,
The burden of determining the reliability of the time information on the IC card is greatly reduced. In addition, since the reliable time information obtained from the outside is stored and set in the IC card, when proof information / right information of the expiration date before the set time is presented, it can be determined that the information is invalid. . This eliminates the need to manage a revocation list of certificates or tokens having an expiration date before the storage set time determined to be invalid. Also, if security requirements are not strict or if time information can be updated at the appropriate frequency,
It can be operated without having a revocation list itself.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a system for implementing a time information acquisition method and an expiration date processing method of the present invention for acquiring time information from a trusted time server.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 IC card 11 communication processing unit 12 time information verification unit 13 storage unit 14 expiration date determination unit 2 time server 21 communication processing unit 22 encryption processing unit 23 time processing unit 3 IC card operation server 31 communication processing unit

 ──────────────────────────────────────────────────続 き The continuation of the front page F term (reference) 2C005 MA40 SA05 5B035 AA15 BB09 BC00 CA11

Claims (4)

[Claims] An IC card authenticates a time server in response to a time information acquisition start command from an IC card terminal, and acquires and accumulates time information issued by a valid time server. Time information acquisition method by card. 2. An IC card authenticates a time server in response to a time information acquisition start command from an IC card terminal, acquires and accumulates time information issued by a valid time server, and stores the accumulated time information. A validity period processing method for determining the validity period of various types of certification information and right information. 3. An IC card comprising: means for authenticating a time server in response to a time information acquisition start command from an IC card terminal; and means for acquiring and accumulating time information issued by a valid time server. A time information acquisition system using an IC card. A means for authenticating the time server in response to a time information acquisition start command from the IC card terminal; a means for acquiring and accumulating time information issued by a valid time server; Means for judging the expiration date of various certification information and right information using the obtained time information.