JP2003067686A - Authentication method, authentication system and reader-writer system for ic card and ic card used in them - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make readable only required information among various kinds of stored information thereby unifying cards regarding an authentication method for authenticating an IC card when receiving a service of a prescribed organ by using the IC card, an authentication system and a reader-writer system for the IC card and the IC card. SOLUTION: A main key specifying an owner, an access code cipher and a sub key group as intrinsic information of the owner are individually stored in the IC card and at least the main key, the access code cipher, the sub key group for each owner and the information regarding card by the owner are held on the side of an authentication server system 12. Then, in the authentication server system 12 and the reader-writer system (client terminal 13 and a reader-writer 14) of a prescribed service organ, only required sub keys are read from the IC card 15.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an IC card authentication method, an authentication system, a reader / writer system, and an IC card for authenticating the IC card when the service of a predetermined institution is received using the IC card.

[0002]

2. Description of the Related Art In recent years, IC cards have been equipped with a chip module to achieve multi-functionality and multi-purpose, and the field of use thereof has been expanding. When the owner receives the service of a predetermined institution using such an IC card, he / she presents the IC card, and the predetermined institution stored in the IC card is read by the service institution side to obtain the proper IC card, possession. It is common to provide the service after confirming that the person is a person. On the other hand, since the IC card has multiple functions, it is possible to store and unify information corresponding to each service institution and each purpose, but information that is unnecessary in the institution is also disclosed. Therefore, it is desired that only essential information can be presented.

Conventionally, the multifunctional IC card as described above has a non-volatile property because a CPU, an input / output interface circuit, a memory (ROM, RAM, non-volatile memory), a connection terminal, etc. are formed in a chip module to be mounted. Information (identification information, etc.) about the owner is stored in the memory. Further, depending on the type of IC card, there is also known one in which an authentication program is stored in a memory and a coprocessor is provided. Then, when the IC card is used, it is set in the reader / writer system, and at least the identification information of the holder stored in the memory is read to authenticate the IC card and the holder, and the IC card is authentic. Whether or not is determined.

[0004]

However, in order to enable multi-purpose use as a multifunctional IC card,
When various kinds of information about the owner are stored in the memory for unification, all the information stored in the memory of the IC card is in a readable state, so even unnecessary information can be read for authentication. However, there is a problem that the privacy of the owner cannot be sufficiently protected.

Therefore, the present invention has been made in view of the above problems, and an IC card authentication method and authentication in which only necessary information of various kinds of information stored in an IC card can be read so as to unify the card. An object is to provide a system, a reader / writer system, and an IC card.

[0006]

In order to solve the above-mentioned problems, according to the invention of claim 1, a first key for identifying a holder and a holder associated with the first key are provided in an IC card. The unique access information and the second key group as a predetermined number of unique information about the owner are stored at least individually, and the first key read by a predetermined service institution in which the IC card is used. , Which performs predetermined authentication based on the second key, and holds at least the same first key, access information, second key group and card use information by the holder as described above for each holder. A method for authenticating an IC card in an authentication system, comprising: identification information for identifying the service institution from the predetermined service institution; and the first key read from the IC card. A step of receiving, a step of authenticating whether or not the access is legitimate based on the received identification information of the service institution, and based on the received first key when the access from the service institution is legitimate Read the access information peculiar to the holder associated with the held first key and hold the key information specifying the second key type related to the access information and the service institution to the service institution. Receiving a second key corresponding to the key information transmitted after the step of transmitting and collating the access information transmitted from the authentication system with the access information read from the IC card from the service institution side. Steps,
Based on the predetermined number of received second keys, the card use related information corresponding to the held second key of the holder is read to perform card use authentication, and the authentication result is sent to the service institution. And a step of transmitting.

According to the second aspect of the invention, the IC card has a first key for identifying the holder, access information unique to the holder associated with the first key, and a predetermined number of unique keys for the holder. A second key group as information is stored at least individually, while at the authentication system side, at least the same first key, access information, for each holder,
A method for authenticating an IC card in a service institution in which the IC card is used, when the second key group and the information about the card use by the holder are held and the card use is authenticated. Transmitting identification information identifying the ID and the first key read from the IC card to the authentication system; and transmitting the authentication system based on the identification information of the service institution in the authentication system. 1
Receiving the access information unique to the owner associated with the key and the key information specifying the second key type related to the service institution, the received access information and the access information read from the IC card. And transmitting a second key corresponding to the key information received when the two match, from the IC card to the authentication system, and a predetermined number of second keys from the authentication system side. Receiving a result of card use authentication based on the card use related information corresponding to the second key of the owner, which is read based on
It is configured to include.

According to the third aspect of the present invention, the IC card has a first key for identifying the holder, access information unique to the holder associated with the first key, and a predetermined number of unique keys for the holder. An IC that stores at least the second key group as information at least individually and performs predetermined authentication based on the first key and the second key read by a predetermined service organization in which the IC card is used. A card authentication system, which holds at least a first key, access information, a second key group, and information related to card use by the holder for each holder, and the predetermined service. A connection authentication unit that receives identification information identifying the service institution in the access request from the institution and authenticates the access permission, and the I sent from the service institution. The first key read from the card is received, the holding means inquires for access information unique to the holder associated with the first key, and the second information related to the access information and the service institution. Key inquiry means for transmitting the key information specifying the key type to the service institution, and the access information transmitted from the service institution side after collating the transmitted access information with the access information read from the IC card. The second key corresponding to the key information is received, and the card use authentication is performed by collating with the card use related information corresponding to the second key of the holder held by the holding means, and the authentication result is obtained. And a collating means for transmitting to the service institution.

According to another aspect of the invention, the IC card has a first key for identifying the holder, access information unique to the holder associated with the first key, and a predetermined number of unique keys for the holder. A second key group as information is stored at least individually, while at the authentication system side, at least the same first key, access information, for each holder,
A reader / writer system of a service organization in which the IC card is used when the information about the second key group and the card use by the holder is held and the card use is authenticated, and is stored in the IC card. A reader / writer that reads out the first key, the access information, and the second key that are sequentially read, identification information that identifies the service institution, the first key read from the IC card, and later Transmission for transmitting a predetermined number of second keys read from the IC card to the authentication system based on key information for selecting a desired second key from the second key group from the authentication system Sent after authentication of access based on the identification information of the service organization in the authentication system and the data creation means Receiving a key information identifying the second key types associated with the first person possessing specific associated key access information and the service engine,
The access information is collated with the access information read from the IC card, and when they match, the second key corresponding to the key information is read from the IC card and transmitted to the authentication system by the transmission data creating means. A predetermined number of second means from the verification means and the authentication system side.
Display means for receiving and displaying the result of the card use authentication based on the card use related information corresponding to the second key of the owner, which is read based on the key.

According to the invention of claim 5, the authentication method of the IC card according to claim 1 or 2 or the IC according to claim 3
An IC card used in a card authentication system or a reader / writer system according to claim 4, wherein the data input / output unit exchanges data with the reader / writer system, and at least a first holder identifying unit. , A memory in which a holder-specific access information associated with the first key and a second key group as a predetermined number of unique information relating to the holder are individually stored, and the data entry. It is configured to have a control means for controlling the output means and a processing means for controlling the reading and writing of data to and from the memory.

As described above, in the authentication system, the reader / writer system of a predetermined service institution, and the IC card, the first key for identifying the owner on the IC card and the owner-specific key associated with the first key. Second as access information and a predetermined number of unique information about the owner
Key group is stored at least separately, while at least the same first key for each holder, access information, second key group and information about card use by the holder are stored on the authentication system side. Retained.

Then, the reader / writer system transmits the identification information of the service institution and the first key read from the IC card to the authentication system, and the authentication system reads the corresponding access information held by the first key. Sent to the reader / writer system together with the key information,
Access information and IC received by the reader / writer system
The access information read from the card is collated, and when they match, a predetermined number of second keys based on the key information are read and transmitted to the authentication system, and the authentication system uses the corresponding second key based on the corresponding card use related information. Is read to perform card authentication, and is transmitted to the reader / writer system.

As a result, in the authentication system, the reader / writer system of the predetermined service organization, and the IC card, the information necessary for the second key group among various information stored in the IC card is required. It is possible to read only the information and to make unnecessary information unreadable. By this, it becomes possible to unify various information in the IC card in consideration of privacy protection. Is.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION Preferred embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows an overall explanatory view of an IC card authentication method according to the present invention. In FIG. 1 (A),
An authentication server system 12 is connected to a computer network 11 such as the Internet or an intranet, and a predetermined number of client terminals 13 (13A to 13N) in each service organization are connected. Each client terminal 13 (13A to 13N) is equipped with a reader / writer 14 (14A to 14N) and has an IC card 15
Data is exchanged with (15A to 15N). The client terminal 13 (13A to 13N) and the reader / writer system 14 (14A to 14N) constitute each reader / writer system (details will be described with reference to FIG. 4). It should be noted that each client terminal 13 and the authentication server system 12 may be integrated into a system without interposing the computer network 11.

The IC card 15 (15A to 15N)
4, the details of which will be described with reference to FIG. 4, a main key that is a first key that identifies the holder, an access code encryption that is access information unique to the holder associated with the main key, and the holder. A certain number of unique information (for example,
Second as each certification number of each service organization)
A predetermined number of subkeys, which is a key group of, are stored at least individually. Here, the IC card used in the present invention does not necessarily need to have a CPU as a processing unit, but in the present embodiment, it is shown as having a processing unit (CPU) as a multifunctional and multipurpose IC card. is there.
Further, the IC card used in the present invention can be roughly classified into a contact type and a non-contact type according to the usage form and the communication form, but any type can be applied.

The authentication server system 12 will be described in detail with reference to FIG. 2, but the IC card 15 for each holder.
In addition to holding the same information as the information (main key etc.) stored in, the database (DB), etc., which is a holding means for holding the information regarding the card use of the holder concerned in relation to the sub key. Also, the holding means D
B or the like holds key information indicating which subkey each service institution requires, for example, as an institution table.

Therefore, a flow chart of an IC card authentication method with the overall configuration of FIG. 1A is shown in FIG. 1B. First, a predetermined reader / writer system (client terminals 13 (13A to 13N), In the reader / writer 14 (14A to 14N), the IC card 15 (15A to 15N) of the target user who is the IC card holder
Then, the main key is read, and the ID, which is the identification information of the main key and the reader / writer system, is transmitted to the authentication server system 12 (step (S) 1).

In the authentication server system 12, the access code encryption of the target user is read from the DB 25 based on the received main key and the ID of the reader / writer system of the target client terminal 13, and the service type to which the target client terminal 13 belongs. The sub-key type information corresponding to is read and transmitted to the target reader / writer system (S2). Target client terminal 1
In 3, the access code cipher received from the authentication server system 12 is collated with the access code cipher read from the IC card 15, the subkey corresponding to the key information received when the two match, and the authentication server system 12 concerned is read. (S3). Then, in the authentication server system 12, based on the received subkey,
The information about the card use added as the related information to the subkey of the target user is read, and the IC card 1
Whether the IC card 15 can be used, ie, whether the IC card 15 can be used, is transmitted to the target client terminal 13 (S4).

As described above, the information stored in the IC card 15 used is only the key information of the subkey required by the client terminal 13 from the authentication server system 12, and the irrelevant information is read. Never be. That is, by reading only the necessary information, it is possible to make unnecessary information unreadable, and it is possible to unify various information in the IC card in consideration of privacy protection.

Next, FIG. 2 shows a block diagram of an example of the authentication server system according to the present invention. In FIG. 2, the authentication server system 12 is, for example, an interface 21, a connection authentication means 22, a net connection means 23, a DB management means 24, a DB 25, a transmission data creation means 26, a key inquiry means 27, a collation means 28 and data. The updating means 29 is provided. It should be noted that control means for controlling the entire system 12 is not shown. Also, the connection authentication means 22, the net connection means 23, the DB management means 2
4, DB 25, transmission data creating means 26, key inquiring means 27 and collating means 28 are not shown in the memory (RA.
M) is a functional element constructed by a program developed on.

The interface 21 inputs / outputs data via the computer network 11 at least with the client terminal 13 based on a predetermined protocol. The connection authentication means 22 authenticates whether or not the target client terminal 13 of the access request is a legitimate access based on the identification information (ID, password). The net connection means 23 is for causing the authentication server system 12 to establish a connection state after authentication that the target client terminal 13 of the access request is authentic. The DB management means 24 manages access to the DB 25 and prevents data alteration due to unauthorized access. Further, the transmission data creating means 26 creates data to be sent to the target client terminal 13 in, for example, a file format, and sends the data via the net connecting means 23.

The key inquiry means 27 receives the main key read from the target IC card 15 sent from the client terminal 13 of the target service institution, and stores it in the DB.
From 25, the access code encryption, which is the access information unique to the holder associated with the main key, is inquired, and the key information specifying the access code encryption and the subkey type related to the service organization of the client terminal 13 is provided to the client terminal. 13 to send. The matching means 28 is the client terminal 13 of the target service organization.
Access code encryption and subkey from, that is, the access code encryption transmitted above and the target IC card 15
The sub-key corresponding to the key information transmitted after the verification with the read access code is received, and the card use related information corresponding to the sub-key of the owner (target user) stored in DB25 is read and verified. Card authentication is performed by using the
To send.

The data updating means 29 is a target user (holder of the IC card 15) held in the DB 25.
It is executed to update or add information regarding the above, and the data is updated or added after the access request is made to the DB management means 24. Then, as described above, the DB 25 holds at least the same information as the information (main key etc.) stored in the IC card 15 for each holder, and at the same time, holds the information of the holder related to the subkey. Holds information about card usage. In addition, key information indicating which subkey each service institution requires is held as, for example, an institution table.

Here, FIG. 3 shows an explanatory diagram of data in a database (DB) included in the authentication server system of FIG. In FIG. 3, the DB 25 holds at least a user folder and an institution table. The user folder holds information about the holders (target users) of all IC cards 15, and is classified into, for example, a large classification, a middle classification, and a small classification, and the information of the individual users is stored in the lowest layer as respective files. Is stored as. For example, access code encryption corresponding to the main key, subkey 01,
02, 03 ... And related information corresponding to these are stored.

As the sub-key, for example, the sub-key 01 is identification information given by a predetermined financial institution, the sub-key 02 is a number such as a driver's license, and the sub-key 03 is identification information given by a predetermined administrative body (for example, tax payment). As described above, the identification information individually assigned is stored for each layer or area assigned to each key. The related information is, for example, information in the case where the entire IC card specified by the main key has expired, and information in the case where the service institution corresponding to each subkey cannot use the information. It may be updated or added, and if there is no problem, nothing may be added or a flag may be used.
The sub-keys are assigned in advance according to each service organization described later.

The information of each user stored in such a user folder is the same as the information stored in the memory of the IC card 15 possessed by the user except the related information. Change to the information of the target user,
If there is any addition, the contents of the memory of the IC card 15 should be changed or added in the same manner.

Further, the institution table stored in the DB 25 is, for example, the type of subkey (subkey 01, 02, 03 ...) Corresponding to the type of service (category 1, 2, 3, ...) Of the service institution. ) Key information is held in a table. For example, category 1 is a subkey 01 of a predetermined financial institution, category 2 is a subkey 03 of a predetermined medical institution, category 3 is a subkey 04 of a predetermined administrative institution, and the like.

Next, FIG. 4 shows a block diagram of a reader / writer system and an IC card block according to the present invention. FIG. 4A shows a reader / writer system (client terminal 1
3 and the reader / writer 14) block diagram, FIG.
(B) is a block diagram of the IC card 15. Figure 4
In (A), the reader / writer system includes a reader / writer 14, an interface 31, a processing unit 32, and a transmission data creating unit 3 which the client terminal 13 appropriately includes.
3, a collation unit 34, and a display unit 35. The processing means 32, the transmission data creating means 33, and the collating means 34 are functional elements constructed by a program loaded on a memory (RAM (not shown)).

The reader / writer 14 is an IC card 15
The main key, the access code encryption, and the predetermined subkey stored in the IC card 15 are read at least sequentially, regardless of whether they are contacted or non-contacted, and the predetermined data is read by a command from the client terminal 13. Also, writing for updating and adding predetermined data is performed. The interface 31 provided in the client terminal 13 inputs / outputs data via the computer network 11 at least based on a protocol defined with the authentication server system 12. The processing means 32 integrally controls the client terminal 13.

Further, the transmission data creating means 33 uses the ID for identifying the service organization and the target IC card 15
The main server read by the authentication server system 1 and a predetermined number of subkeys read by the IC card 15 based on the key information for selecting a desired subkey from the subkey group from the authentication server system 12 later.
For example, a file format is created and transmitted via the computer network 11.

The matching means 34 is a target service organization (client terminal 1) in the authentication server system 12.
3) Access code encryption and key information transmitted after access authentication based on the ID or the like, that is, key code identifying the owner-specific access code encryption associated with the main key and the type of subkey associated with the service institution. Received, the access code encryption and the target I
The access code encryption read from the C card 15 is collated, and when they match, the subkey corresponding to the key information is read from the IC card 15 and transmitted to the authentication server system 12 by the transmission data creating means 33. Then, the display means 35 displays the authentication result from the authentication server system 12 side, that is, the result of the card use authentication based on the card use related information corresponding to the subkey of the holder, which is read based on the predetermined number of subkeys. Is received and displayed.

Further, in FIG. 4B, the IC card 1
Reference numeral 5 appropriately includes a data input / output unit 41, a processing unit 42, and a memory 43. The data input / output unit 41 exchanges data for reading and writing with the reader / writer 14 of the reader / writer system. Processing means 42
Is a functional element constructed by a program (a program stored in advance in a ROM (not shown) of the memory 43) developed on the memory (RAM (not shown)) 43 and controls the processing of the IC card 15.

The memory 43 is the RA (not shown).
In addition to M and ROM, a rewritable data storage area (for example, a non-volatile memory) is associated with at least a main key for identifying the owner, which is held in the DB 25 of the authentication server system 12, and the main key. Access code encryption unique to the owner and a subkey group (subkey 0
1, 02, 03 ...) are stored in the form of layers and regions that are individually accessed.

Therefore, FIG. 5 shows a processing flowchart in the reader / writer system of FIG. 5, in the reader / writer system of the client terminal 13, first, the main key for identifying the owner is read from the memory 43 of the target user IC card 15 set in the reader / writer 14 (S11). At this time, the IC
In order to confirm the authenticity of the card 15, the owner (user) may input a password or the like. Then, the main key read by the transmission data creating means 33 and the ID (password) of the service institution in the system are created as transmission data and transmitted to the authentication server system 12 (S12).

After that, the access code of the target user and the key information of the sub-key type belonging to the corresponding institution category are received from the authentication server system 12 (S13), and the collating means 34 sends the access code encryption to the IC card 15.
Further, the access code encryption read is compared with the access code encryption received from the authentication server system 12 (S14). Result of collation (S1
5) If they do not match, S11 to S14 are repeated a predetermined number of times (for example, three times) (S16), and if they still do not match, the card is not read and the display means 35 displays and the process ends (S17).

On the other hand, if they match in S15, the corresponding subkey is read from the memory 43 of the IC card 15 of the target user based on the subkey type of the received key information (S18), and sent by the transmission data creating means 33. The credit is caused to process the data and transmitted to the authentication server system 12 (S19). Then, from the authentication server system 12,
The authentication result is received (S20), and the authentication result is displayed on the display means 35 (S21).

Next, FIG. 6 shows a flowchart of the authentication processing in the authentication server system of FIG. 6, in the authentication server system 12, the main key stored in the memory 43 of the target user IC card 15 and the service institution (reader of the client terminal 13) are first sent from the reader / writer system of the client terminal 13 of the access request. The ID (password) of the writer system) is received (S31). Therefore, the connection authentication means 22
In step S32, it is authenticated whether the access from the reader / writer system is illegal, and if it is illegal (S3).
3), the fact that the IDs do not match is transmitted to the client terminal 13 (reader / writer system) and the processing ends (S34).

On the other hand, if the access is not unauthorized (S3
3), the net connection means 23 is the client terminal 13
Then, the collating means 28 reads the access code code from the information on the target user IC card 15 in the user folder of the DB 25 and reads the related information based on the acquired main key. It is determined whether the IC card 15 is valid (S35). If the IC card 15 is not valid (S36), the transmission data creating means 26 indicates that the IC card 15 has expired.
The data processing in step S37 transmits the data to the client terminal 13 (reader / writer system) and ends the processing (S37).

On the other hand, if it is valid (S36), the key inquiring means 27 causes the service institution (client terminal 1
DB2 based on the ID of the reader / writer system 3)
The institution table is identified from the institution table 5 and the corresponding subkey type key information is read (S38), and the read access code encryption and key information are processed by the transmission data creating means 26 by the service institution (the client terminal 13). To the reader / writer system (S3)
9).

After that, when a predetermined number of subkeys of the target user according to the key information of the subkey type are received from the client terminal 13 (reader / writer system) (S4).
0), the collating means 28 reads a predetermined number of subkeys of the target user according to the subkey type from the user folder of DB25, collates with the received subkey (S41), and if they match (S42), from the user folder of DB25. The relevant information of the target user corresponding to the subkey is read (S43).

Then, according to the read related information, whether the use permission of the target user IC card 15 is right or not is authenticated, and the authentication result is subjected to data processing by the transmission data creating means 26 and then the client terminal 13 (reader / writer system). (S44). On the other hand, if the subkeys do not match in S42, the fact that the subkeys do not match is transmitted to the client terminal 13 (reader / writer system) after data processing by the transmission data creating means 26 (S45).

As described above, the information of the predetermined number of subkeys stored in the IC card 15 used is only the key information of the subkeys required by the client terminal 13 from the authentication server system 12, Since there is no information that cannot be read, only the necessary subkeys can be read, and unnecessary subkeys can be made unreadable, and various types of information are integrated in the IC card 15 in consideration of privacy protection. Can be executed.

Next, FIG. 7 shows a processing flowchart of data updating and the like in the authentication server system of FIG. 7, in the authentication server system 12, when an access request for data update or addition is received from a predetermined client terminal 13 (S51), the identification information of the ID (password) is requested to the access terminal 13. The transmission data creating means 26 creates a file to be transmitted and transmits it (S52). When the ID (password) is received from the access terminal 13, the connection authentication means 22 authenticates whether the access is proper based on the ID or the like (S5).
3).

As a result of the authentication (S53), if the access is not the proper access, the fact that the IDs do not match is transmitted to the access terminal 13 and the processing is terminated (S55). On the other hand, if the access is normal (S54), the transmission data creating means 26 creates a file requesting the target user to be updated or added and the data content, and sends the file to the access terminal 13 (S56). Then, from the target access terminal 13,
When the update or additional data corresponding to the target user is received (S57), the data updating unit 29 updates or adds data to the DB 25 in the memory area corresponding to the target user (S58), and notifies the update. It is transmitted to the access terminal 13 (S59).

In the access terminal 13, the contents of the data in the memory 43 of the IC card 15 of the target user are appropriately stored in the DB by the reader / writer system.
In order to make it the same as 25, it is updated or added.

[0046]

As described above, according to the present invention, the first key for identifying the holder on the IC card, the access information unique to the holder associated with the first key, and the holder. And a second key group as a predetermined number of unique information items are stored at least individually, while at the authentication system side, at least the same first key, access information, and second key group for each holder are stored. And information relating to card use by the holder, and particularly the second key group among various information stored in the IC card in the authentication system, the reader / writer system of a predetermined service organization, and the IC card. On the other hand, by reading only the necessary information, it is possible to make unnecessary information unreadable, and in an IC card in consideration of privacy protection. It is capable to occupy not perform a centralization of various information.

[Brief description of drawings]

FIG. 1 is an overall explanatory diagram of an IC card authentication method according to the present invention.

FIG. 2 is a block configuration diagram of an example of an authentication server system according to the present invention.

3 is an explanatory diagram of data in a database (DB) included in the authentication server system of FIG.

FIG. 4 is a reader / writer system and an IC according to the present invention.
It is a card block block diagram.

5 is a processing flowchart in the reader / writer system of FIG.

6 is a flowchart of an authentication process in the authentication server system of FIG.

7 is a processing flowchart of data update and the like in the authentication server system of FIG.

[Explanation of symbols]

11 computer network 12 Authentication server system 13 Client terminal 14 Reader / Writer 15 IC card 21,31 interface 22 Connection authentication means 23 Internet connection means 24 Database (DB) management means 25 Database (DB) 26, 33 transmission data creating means 27 Key inquiry means 28 Verification means 29 Data updating means 32, 42 processing means 34 Verification means 35 display means 41 Data input / output means 43 memory

─────────────────────────────────────────────────── ─── Continued Front Page (51) Int.Cl. ⁷ Identification Code FI Theme Coat (Reference) H04L 9/00 673A

Claims (5)

[Claims] 1. An IC card has a first key for identifying a holder, access information unique to the holder associated with the first key, and a second key as a predetermined number of unique information about the holder. Key group is stored at least individually, and predetermined authentication is performed based on the first key and the second key read by a predetermined service institution that uses the IC card. A method for authenticating an IC card in an authentication system that holds the same first key, access information, second key group, and information regarding card use by the holder for each person as described above, wherein: A step of receiving identification information for identifying the service institution and the first key read from the IC card; When the step of authenticating whether legitimate access have access from the service engine is a regular,
Based on the received first key, the holder-specific access information associated with the held first key is read out, and the second key type related to the access information and the service organization is read. Transmitting the specified key information to the service institution, the key information transmitted from the service institution after collating the access information transmitted from the authentication system with the access information read from the IC card. A step of receiving a corresponding second key, and reading the card use related information corresponding to the second key held by the holder, based on the received predetermined number of second keys Authenticating for use and transmitting the authentication result to the service organization. 2. An IC card having a first key for identifying a holder, access information unique to the holder associated with the first key, and a second key as a predetermined number of unique information relating to the holder. Key group is stored at least separately, while at least the same first key for each holder, access information, second key group and information about card use by the holder are stored on the authentication system side. A method for authenticating an IC card in a service organization using the IC card when the card is held and authentication is performed, the identification information identifying the service organization, and the IC
A step of transmitting the first key read from a card to the authentication system, and a holder associated with the first key, which is transmitted after authentication of access based on identification information of the service institution in the authentication system The step of receiving the unique access information and the key information specifying the second key type related to the service institution, the received access information and the access information read from the IC card are collated, and when they match, A step of reading a second key corresponding to the received key information from the IC card and transmitting it to the authentication system, and the owner of the key read based on a predetermined number of second keys from the authentication system side. Step of receiving the result of the card use authentication by the card use related information corresponding to the second key of IC card authentication method, which comprises a, the. 3. An IC card has a first key for identifying the holder, access information unique to the holder associated with the first key, and a second key as a predetermined number of unique information about the holder. In the authentication system of the IC card, the key group of is at least individually stored, and the predetermined authentication is performed based on the first key and the second key read by a predetermined service organization in which the IC card is used. A holding means for holding at least the same first key, access information, second key group, and information regarding card use by the holder as described above for each holder; and an access request from the predetermined service institution. A connection authentication unit that receives identification information that identifies the service institution and authenticates the access permission, and read from the IC card sent from the service institution. Received the first key, the holding means inquires about the holder-specific access information associated with the first key, and the second key type related to the access information and the service institution. Key inquiring means for transmitting the key information specifying the key information to the service institution, and the key information transmitted after the access information transmitted from the service institution side is collated with the access information read from the IC card. Is received, the card use authentication is performed by collating with the card use related information corresponding to the second key of the holder held by the holding means, and the authentication result is obtained by the service. An IC card authentication system comprising: a collating unit to be transmitted to an institution. 4. An IC card has a first key for identifying a holder, access information unique to the holder associated with the first key, and a second key as a predetermined number of unique information about the holder. Key group is stored at least separately, while at least the same first key for each holder, access information, second key group and information about card use by the holder are stored on the authentication system side. A reader / writer system of a service organization in which the IC card is used when the card is held and authentication is performed, the first key, the access information, and the second information stored in the IC card. A reader / writer that reads the key at least sequentially, identification information that identifies the service organization, and the IC
The first key read from the card and a predetermined number of the first keys read from the IC card based on the key information for selecting a desired second key from the second key group from the authentication system later. Transmission data creating means for transmitting the second key to the authentication system, and the owner-specific associated with the first key transmitted after authentication of access based on the identification information of the service institution in the authentication system Access information and the key information specifying the second key type related to the service institution are received, the access information is collated with the access information read from the IC card, and when they match, the corresponding key information is dealt with. Collating means for reading the second key from the IC card and transmitting it to the authentication system from the transmission data creating means And a result of the card use authentication by the card use related information corresponding to the second key of the holder read based on a predetermined number of second keys from the authentication system side is received and displayed. A reader / writer system, comprising: 5. An IC card authentication method according to claim 1 or 2, an IC card authentication system according to claim 3, or an IC card used in a reader / writer system according to claim 4, wherein: Data input / output means for exchanging data with the reader / writer system, at least a first key for identifying a holder, and the first key
Owner-specific access information associated with the key of
A memory in which a second key group as a predetermined number of unique information relating to the owner is individually stored; processing means for controlling the data input / output means and for reading / writing data from / to the memory; An IC card having: