JP2003076611A - Memory card having security function - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a memory card capable of preventing a dishonest use by a third party having no legal authority. SOLUTION: In accordance with a command from a host equipment 1, a coding system to be selected is set in a register group 6 in a memory control circuit 5 by an I/O control circuit 4. After certification is established for reading coding key information stored in a protection region of a non-volatile memory 13, information contained in the specified coding key information is coded by the selected coding system and output to the host equipment 1.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a memory card having a security function.

[0002]

2. Description of the Related Art In recent years, electronic commerce has become active due to the development of the Internet. In such electronic commerce, it is not possible to directly confirm the other party,
Security technology is important for ensuring the safety of electronic commerce.

Public key cryptography is one of the security technologies, and IETF-X509 (Internet Engineering Task Fo) is a group that promotes standardization of public key cryptography.
rcePublic Key Infrastracture X509 Working Group)
(Hereinafter, simply referred to as PKI).

In public key cryptography, there is a concept of a pair key consisting of a public key and a private key, and a certificate authority and authentication as means for authenticating the validity of the public key. The private key is an individual responsibility. , Is supposed to be managed safely.

Conventionally, a user records and stores a secret key, which is a part of the encryption key information, in a hard disk drive of a personal computer.

[0006]

As described above, in the public key cryptosystem, it is necessary to safely manage the secret key which is a part of the cryptographic key information.
If the private key is stored and stored in the hard disk drive of the personal computer, there is a risk that the private key will be stolen by a third party.

It is also possible to store the private key in a memory card or the like, but if the private key is simply stored in the memory card, the private key can be used by a so-called "spoofer" third party. There was a problem of being lost.

The present invention has been made in view of the above circumstances, and it is an object of the present invention to provide a memory card which can be prevented from being illegally used by a third party who does not have a proper title.

[0009]

Therefore, in order to achieve the above object, a first aspect of the present invention is to provide a protected area for storing encryption key information having a public key, a private key, a certificate and a user password. A first control circuit for performing read / write control with respect to the memory, a second control circuit for performing control of a different type from the control of the first control circuit, and the first control circuit. An authentication means for performing authentication with the host device using the control circuit,
The second control circuit is used to determine whether or not the authentication by the first control circuit is normally performed, and when it is determined that the authentication is normally performed, the command from the host device is sent. And a user password corresponding to the determined encryption key information by using the first determining means for determining the encryption key information to be selected and the second control circuit based on Authentication with the user's password, and whether or not the password authentication has been normally performed is performed. If it is determined that the password authentication has been normally performed, based on a command from the host device. A second determining means for determining an encryption method and the first control circuit are used to protect the information contained in the encryption key information in the memory based on a command from the host device. Output means for extracting the information included in the extracted encryption key information according to the determined encryption method and outputting the information included in the encrypted encryption key information to the host device. A memory card, comprising:

A second aspect of the present invention is to provide a memory having a protected area for storing encryption key information having a public key, a private key, a certificate and a user password, and a user stored in the protected area. An authentication unit that performs an authentication process for reading information included in the encryption key information stored in the protected area of the memory by using a password, and from the host device when the authentication unit performs authentication. Encryption key information reading means for reading the information contained in the encryption key information specified by the command from the protected area, and an encryption for encrypting the information contained in the encryption key information read by the encryption key information reading means. A memory card including an encryption unit and an output unit that outputs information included in the encryption key information encrypted by the encryption unit to a host device. De, it is.

Further, according to a third aspect of the present invention, a memory, a first control circuit for performing read / write control with respect to the memory, and a control of a different type from the control of the first control circuit are performed. A first control circuit for authenticating with a host device by using a second control circuit and a first control circuit for determining whether or not the authentication is normally performed.
And the second control circuit, it is determined that the authentication has been completed normally, the second control circuit performs a decryption method in accordance with a command from the host device. Determining means for determining and the first control circuit are used to decrypt the encrypted content from the host device by the determined decryption method, and correspond to the decrypted content and this content. Second judging means for judging whether or not the content is valid based on the electronic signature; and storing means for storing the decrypted content in the memory card by using the first control circuit. A memory card, comprising:

Further, a fourth aspect of the present invention is a public key,
A memory having a protected area for storing encryption key information having a private key, a certificate, and a user password, a first control circuit for performing read / write control on the memory, and control of the first control circuit Using a second control circuit that performs different control from the above and the first control circuit, authentication for authenticating with the host device is performed, and it is determined whether or not the authentication is normally performed. Means to judge, when it is judged that the authentication has been normally completed,
Selecting means for selecting encryption key information and a decryption method based on a command from a host device using the second control circuit; and the selected encryption using the second control circuit. Using the acquisition means for acquiring the secret key of the key information and the first control circuit, the encrypted content from the host device is used in accordance with the selected decryption method by using the acquired secret key. By using the decrypting means for decrypting and the first control circuit, information indicating a correspondence relationship between the decrypted content and the encryption key information used for the decryption is stored in the memory. And a storage means for storing in the memory card.

Further, a fifth aspect of the present invention is a public key,
A memory having a protected area for storing encryption key information having a private key, a certificate, and a user password, a first control circuit for performing read / write control on the memory, and control of the first control circuit Using a second control circuit that performs different control from the above and the first control circuit, authentication for authenticating with the host device is performed, and it is determined whether or not the authentication is normally performed. A second determining means for determining whether the host device is a certificate authority terminal when the authentication is determined to be normal by using the first determining means for determining and the first control circuit. And the selection means for selecting the decryption method based on the command from the certificate authority terminal using the second control circuit when the host device is determined to be the certificate authority terminal. Means and the Certification Authority According to the selected decryption method, using the receiving means for receiving the encryption key information including the public key, the private key, the certificate, and the user password encrypted from the end, and the first control circuit, A decryption unit for decrypting the received encryption key information; and a storage unit for storing the decrypted encrypted information in a protected area of the memory by using the first control circuit. A memory card, which is characterized by:

[0014]

DETAILED DESCRIPTION OF THE INVENTION A memory card according to an embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing a configuration of an SD memory card (Secure Digital Memory Card) according to an embodiment of the present invention.

As shown in the figure, S according to the present embodiment
The D memory card 2 is detachably connected to the host device 1, and has an I / O control circuit 4, a memory control circuit 5, an encryption / decryption method selection control unit 7, an encryption / decryption method storage unit 8, a processor 10, It has a RAM 11, a ROM 12 and a non-volatile memory 13.

The processor 10 is connected to the bus 9 and is R
The I / O control program 12a as firmware stored in the OM 12 is executed, and control of the I / O control circuit 4 and processing relating to the I / O control circuit 4 are performed.

The processor 10 also executes a memory control program 12b as firmware stored in the ROM 12 to control the memory control circuit 5 and perform processing related to the memory control circuit 5. The resources accessible from the processor 10 are the register groups 4a and 6 assigned to the bus 9 of the memory card, the RAM 11, the ROM 12, and the non-volatile memory 13.

The RAM 11 is connected to the bus 9 and has a function as a work memory of the processor 10, and stores various data necessary for the processing executed in the memory card.

The ROM 12 is connected to the bus 9 and stores the I / O control program 12a and the memory control program 12b as firmware as described above.

The I / O control circuit 4 is connected to the bus 3 and the bus 9 connected to the host device 1, is controlled by the processor 10 by the I / O control program 12a stored in the ROM 12, and is controlled by the memory control circuit 5. The control is different from the control performed by.

The I / O control circuit 4 has a register 4,
An I / O control command from the host device 1 is received via the bus 3, the received I / O control command is analyzed, and a command number, a command argument, etc. are registered in the register group 4a.
Save to. The processor 10 executes the I / O control program 12a by referring to the value stored in the register group 4a. In addition, this I / O control circuit 4 is S
Corresponds to the ecure Digital IO Card (SDIO) card.

The memory control circuit 5 has a register group 6, receives a memory control command from the host device 1 via the bus 3, analyzes the received memory control command, and outputs a command number, a command argument, etc. Register group 6
Save to. The processor 10 refers to the value stored in the register group 6 and executes the memory control program 12b. Further, the register group 6 stores status information indicating the result of authentication and information indicating the encryption / decryption method to be selected. The memory control circuit 5 corresponds to an SD memory card defined by SDA.

The encryption / decryption method selection control unit 7 stores a plurality of data stored in the encryption / decryption method storage unit 8 based on the information indicating the encryption / decryption method stored in the register group 6 of the memory control circuit 7. One encryption / decryption method is selected from the encryption / decryption methods.

The encryption / decryption method storage unit 8 stores a plurality of types of encryption / decryption methods 8a and 8b. Note that here, it is assumed that the plurality of types of encryption / decryption methods 8a and 8b are realized by hardware, but they may be realized by software.

The nonvolatile memory 13 is connected to the bus 9 and has a plurality of pieces of encryption key information 14a and 14b. These pieces of encryption key information 14a and 14b are stored in the nonvolatile memory 13.
Retained in the protected area of.

Each of the encryption key information 14a and 14b has a public key, a secret key, a certificate of the public key and a user password, respectively, which comply with the international standard ITU-T Recommendation X.509. ing. In addition, although the case where the number of pieces of encryption key information is two has been described in the present embodiment, the number of pieces of encryption key information is not limited to two and may be more.

FIG. 2 is a diagram showing the inside of the non-volatile memory 13. As shown in the figure, it has a protection area 21, a normal area 22 and a system area 23. Protected area 21
Stores a plurality of pieces of encryption key information, as described above. Further, a plurality of contents 1 to n are recorded in the normal area 22, and a key correspondence table showing a correspondence relationship between the contents and the encryption key information is stored in the system area 23.

<Public Key Protection Function> Next, as an application example of the SD memory card according to the embodiment of the present invention, a case where the public key is output to the host device will be described. FIG. 4 is a flowchart for explaining the operation when the public key is output to the host device.

First, the host device 1 uses the memory control circuit 5 to perform the authentication process defined by SDA (S
1) Confirm the mutual safety of the host device 1 and the SD memory card 2.

Next, it is determined whether or not the authentication is successful (S2). When it is determined in S2 that the authentication is successful, the memory control circuit 5 stores status information indicating that the authentication has been normally completed in the register group 6 of the memory control circuit 5.

If it is determined in S2 that the authentication has been completed normally, then the key to be selected is selected through the I / O control circuit 4 based on the command from the host device 1 ( S3). Here, the encryption key information 14a
The public key and certificate shall be selected. It should be noted that the I / O control circuit 4 determines whether or not the authentication is normally completed.
The I / O control program 12a for controlling the control is performed by referring to the status information stored in the register group 6 of the memory control circuit 5.

Next, a user password is input from the host device 1, and it is determined by the I / O control program 12a whether or not password verification has been established (S5). Specifically, this password verification is performed by I /
By the O control program 18, the user password stored in the selected encryption key information is compared with the input user password, and if they match, the password collation is established.

Further, the I / O control program 12a stores, in the RAM 11, information indicating that both the authentication and the password collation are established when the password collation is established. When both authentication and password verification are established, reading / writing of the protected area 21 of the nonvolatile memory 13 becomes possible.

Next, the command from the host device 1 is received and the encryption method is selected (S6). This encryption method is selected based on the command received through the I / O control circuit 4 by the I / O control program 12a specifying the encryption method specified by the command in the register group 6 of the memory control circuit 5.
It is performed by setting to.

Next, the public key and certificate selected in S3 are encrypted according to the encryption method selected in S6 (S7). This encryption is performed by the memory control circuit 5
Is carried out using. Specifically, the encryption / decryption method selection control unit 7 stores a plurality of types of encryption / decryption stored in the storage unit 8 according to information indicating the selected encryption method stored in the register group 6 of the memory control circuit 5. Method 1
Choose one. The memory control program 12b encrypts the selected public key and certificate according to the selected encryption / decryption method. Then, the memory control circuit 4 outputs the encrypted public key and certificate to the host device 1 (S
8).

If the authentication is not established in S2 and the password collation is not established in S5, a response indicating an abnormality is output to the host device 1.

The initialization of the encryption / decryption method is SDA.
The memory control program 12b is used when the security mechanism defined by 1. is used, and the I / O control program 12a is used otherwise, for example, when DCTP or RAS is used.

Therefore, according to the memory card of the present embodiment, since the encryption key information is stored in the protected area of the non-volatile memory 13, the encryption key information can be safely stored, and the third party can It is possible to prevent illegally copying the encryption key information.

In addition to the authentication, the encryption key information stored in the protected area can be accessed only after the user password authentication has been performed. Therefore, an unauthorized person who obtains the memory card can "spoof". Thus, it is possible to prevent illegal use of the memory card.

<Memory Card Permitting Writing Only Digitally Signed Content> Next, as an application example of the SD memory card according to the embodiment of the present invention, it is possible to write only the content to which the electronic signature is correctly attached. A possible SD memory card will be described.

FIG. 5 and FIG. 6 are flowcharts for explaining the writing of the digitally signed content in the memory card.

First, the host device 1 performs the authentication process defined by SDA through the memory control circuit 5 (S2).
1) Confirm the mutual safety of the host device 1 and the SD memory card 2. When the authentication is normally completed, the memory control circuit 5 stores the status information indicating that the authentication is normally completed in the register group 6 of the memory control circuit 5.

Next, it is judged whether or not the authentication is successful (S22). Note that the I / O control program 12a for controlling the I / O control circuit 4 determines whether or not the authentication is normally completed by the register group 6 of the memory control circuit 5.
This is done by referring to the status information stored in.

If it is determined in S22 that the authentication is successful, based on the command from the host device,
A decryption method is selected (S23). This decoding method is selected based on the command received through the I / O control circuit 4 by the I / O control program 12a specifying the decoding method designated by the command in the register group 6 of the memory control circuit 5.
It is performed by setting to.

Next, the encrypted electronic signature transmitted from the host device 1 is received through the memory control circuit 5, and the memory control program 12b decrypts it according to the decryption method selected in S23 (S24). Then, the encrypted content transmitted from the host device 1 is received through the memory control circuit 5, and the memory control program 12b decrypts it according to the decryption method selected in S23 (S25).

Next, the consistency of the electronic signature and the content is judged (S26). When the determination of the integrity of the electronic signature and the content is valid, the RAM 11 stores information indicating that the electronic signature and the content have the integrity. In addition, when the consistency is not obtained, the information is not stored in the RAM 11. If it is determined in S26 that the consistency is achieved, the content is stored in the nonvolatile memory 13 by the memory control program 12b (S27).

Next, from the host device 1 to the I / O control circuit 4
Through this, it is determined whether or not there is a request for confirmation of the content writing result (S28). If it is determined in S28 that there is a confirmation request, the RAM1
Information indicating that the contents and the electronic signature stored in 1 are consistent is transmitted to the host device 1 (S29).

If it is determined in S22 that the authentication has not been established, and if it is determined in S26 that the electronic signature and the content are inconsistent, an abnormal status is returned to the host device 1.

Therefore, according to the memory card of the present embodiment, it is possible to guarantee the other party to write the content by the electronic signature.

<Writing Content Using Public Key Cryptography> Next, as an application example of the SD memory card according to the embodiment of the present invention, a case of storing the content encrypted with the public key in the memory card will be described. To do.

FIGS. 7 and 8 are flowcharts for explaining how to store the content encrypted with the public key in the memory card.

Here, as described in <Public key protection function>, the provider that provides the content is
Content shall be encrypted using the public key output from the memory card. At this time, the provider is responsible for verifying the validity of the public key based on the PKI.

First, the host device 1 uses the memory control circuit 5 to perform the authentication process defined by SDA (S
31) Confirm the mutual safety of the host device 1 and the SD memory card 2.

Next, it is determined whether or not the authentication is successful (S32). When it is determined in S32 that the authentication is successful, the memory control circuit 5 stores status information indicating that the authentication has been normally completed in the register group 6 of the memory control circuit 5. On the other hand, in S32,
When it is determined that the authentication has not been established, a response indicating that there is an abnormality is output to the host device 1.

When the authentication is successful, the host device 1
The encryption key information is selected through the I / O control circuit 4 (S3
3). Next, based on the command from the host device 1,
The encryption key information key to be selected is selected through the I / O control circuit 4 (S33). Here, the encryption key information 14a
Shall be selected. It should be noted that the I / O control program 12a for controlling the I / O control circuit 4 determines whether or not the authentication is normally completed by the memory control circuit 5
The status information stored in the register group 6 of FIG.

Further, in the description of this embodiment, as described in <Public key protection function>, it is premised that the content is encrypted using the public key output from the memory card. Password authentication has already been performed, and after the authentication is established, access to the protected area becomes possible.

Next, the command from the host device 1 is received and the decoding method is selected (S34). The selection of the decoding method is performed by the I / O control program 12a setting the decoding method designated by the command in the register group 6 of the memory control circuit 5 based on the command received through the I / O control circuit 4. Be done.

Next, the secret key of the selected encryption key information is I
The / O control program is extracted (S35), and the extracted secret key is used for initializing the decryption method selected in S34 (S36).

Thereafter, the content encrypted with the public key is received from the host device 1 (S37), the received content is decrypted according to the decryption method selected using the secret key, and the nonvolatile memory is used. It is stored in the normal area 22 of 13 (S38). Specifically, the encryption / decryption method stored in the storage unit 8 is selected according to the encryption / decryption method set in the register group 5 of the memory control circuit 5, and the content is selected according to the selected encryption / decryption method. Is decrypted. The memory control program 12b decrypts the content and stores the content in the nonvolatile memory 13.

Subsequently, as shown in FIGS. 2 and 3, information indicating the relationship between the written contents and the used encryption key information is written as a key correspondence table 23a in the system area 23 (S39).

Therefore, according to the memory card of the present embodiment, the public key encryption technique can be used for content protection.

<Storing Encryption Key Information in Memory Card by Certification Authority> Next, the Electronic Commerce Demonstration Promotion Council (ECO
A case where the certificate authority in S) generates a pair key and uses a memory card as a secure medium for holding the pair key will be described.

Here, it is assumed that the certification authority permitted to perform the specific certification work has the respective facilities of the certification server and the certification authority terminal under its responsibility. The means for holding the key issued by the certificate authority terminal will be described below.

FIG. 9 is a flow chart for explaining the operation of the certificate authority terminal storing the key information in the memory.

As shown in the figure, the host device 1 uses the memory control circuit 5 to perform the authentication process specified by SDA (S41), and confirms the safety between the host device 1 and the SD memory card 2 with each other.

Next, it is determined whether or not the authentication is successful (S42). When it is determined in S42 that the authentication has been established, the memory control circuit 5 stores status information indicating that the authentication has been normally completed in the register group 6 of the memory control circuit 5. On the other hand, in S32,
When it is determined that the authentication has not been established, a response indicating that there is an abnormality is output to the host device 1.

When it is determined in S42 that the authentication has been established, it is next determined whether or not the other party of the authentication is the CA terminal (S43). If it is determined in S43 that the authentication partner is not the certificate authority terminal,
A response indicating that there is an abnormality is output to the host device 1.

If it is determined in S43 that the other terminal is the certificate authority terminal, then the decoding method is selected based on the command from the host device 1 (S4).
4). The selection of the decoding method is performed by the I / O control program 12a setting the decoding method designated by the command in the register group 6 of the memory control circuit 5 based on the command received through the I / O control circuit 4. Be done.

Next, the encrypted encryption key information (user password, public key, private key and certificate) is received through the memory control circuit 5 (S45), and the received encryption key information is selected. Decrypt according to the decryption method (S
46). This decoding is performed using the memory control circuit 5. Specifically, the encryption / decryption method selection control unit 7
Selects one of a plurality of types of encryption / decryption methods stored in the storage unit 8 according to the information indicating the selected decryption method stored in the register group 6 of the memory control circuit 5.

The memory control program 12b decrypts the encryption key information according to the selected encryption / decryption method.
Then, the decrypted encryption key information is stored in the protected area 21 of the nonvolatile memory 13 (S47).

Therefore, according to the memory card of the present embodiment, since the encryption key information is stored in the protected area 21 of the non-volatile memory 13 after the certification authority terminal is certified, a third party can obtain the memory card illegally. Even in the case of doing so, it is possible to prevent fraudulent acts due to impersonation.

The invention of the present application is not limited to the above-described embodiments, and can be variously modified at the stage of implementation without departing from the scope of the invention. In addition, the respective embodiments may be combined as appropriate as much as possible, in which case the combined effects can be obtained. Furthermore, the above-described embodiments include inventions at various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. For example, when the invention is extracted by omitting some of the constituent elements shown in the embodiment, when omitting the extracted invention, the omitted portions are appropriately supplemented by well-known and common techniques. It is something that will be done.

[0074]

As described above in detail, according to the present invention,
It is possible to provide a memory card that can prevent unauthorized use by a third party without a valid title.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of an SD memory card (Secure Digital Memory Card) according to an embodiment of the present invention.

FIG. 2 is a diagram showing the inside of a nonvolatile memory 13.

FIG. 3 is a diagram showing a key correspondence table.

FIG. 4 is a flowchart for explaining an operation when a public key is output to a host device.

FIG. 5 is a flowchart for explaining writing of digitally signed content to a memory card.

FIG. 6 is a flowchart for explaining writing of digitally signed content to a memory card.

FIG. 7 is a flowchart for explaining storage of content encrypted with a public key in a memory card.

FIG. 8 is a flowchart for explaining storage of content encrypted with a public key in a memory card.

FIG. 9 is a flowchart for explaining the operation of the certificate authority terminal storing key information in the memory.

[Explanation of symbols]

1 ... Host device, 2 ... SD memory card, 3 ... bus, 4 ... I / O control circuit, 4a ... register group, 5 ... Memory control circuit, 6 ... Register group, 7 ... Encryption / decryption method selection control unit, 8 ... storage section, 8a, 8b ... encryption / decryption method, 10 ... Processor, 11 ... RAM, 12 ... ROM, 12a ... I / O control program, 12b ... a memory control program, 13 ... Nonvolatile memory, 14a, 14b ... Encryption key information, 21 ... Protected area, 22 ... Normal area, 23 ... System area.

Claims (12)

[Claims] 1. A memory having a protected area for storing encryption key information having a public key, a private key, a certificate, and a user password, and a first control circuit for performing read / write control on the memory. By using a second control circuit that performs control of a different type from the control of the first control circuit and the first control circuit,
Using the authentication means for authenticating with the host device and the second control circuit, it is judged whether or not the authentication by the first control circuit is normally performed, and the authentication is normally performed. If it is determined that the encryption key information is selected, the encryption key information is determined by using the first determination unit that determines the encryption key information to be selected based on the command from the host device, and the second control circuit. The user password corresponding to the information is authenticated with the password of the user of the memory card, and it is determined whether the password authentication has been normally performed. It is determined that the password authentication has been normally performed. in case of,
A second determination unit that determines an encryption method based on a command from the host device, and the first control circuit is used to include the encryption key information based on a command from the host device. Information to be extracted from the protected area of the memory, the information included in the extracted encryption key information is encrypted according to the determined encryption method, and the information included in the encrypted encryption key information is converted to the host device. A memory card, comprising: an output unit for outputting to a memory card. 2. A memory having a protected area for storing a public key, a private key, a certificate, and encryption key information having a user password, and a user password stored in the protected area for use in the memory. An authentication unit that performs an authentication process for reading information included in the encryption key information stored in the protected area, and encryption key information specified by a command from the host device when the authentication unit performs authentication. Encryption key information reading means for reading the information contained in the encrypted area from the protected area, encryption means for encrypting the information contained in the encryption key information read by the encryption key information reading means, and the encryption means. A memory card, comprising: an output unit that outputs information included in the encrypted encryption key information to a host device. 3. The authenticating section determines an authenticating means for authenticating with the host device, and judges whether the authentication is normally performed, and when it is judged that the authentication is normally performed, A first deciding means for deciding the encryption key information to be selected based on a command from the host device, a password corresponding to the decided encryption key information, and a password of the user of the memory card are authenticated. A second determining means for determining whether or not the password authentication is normally performed and determining whether or not the password authentication is normally performed, wherein the password authentication is normally performed. 3. The memory card according to claim 2, wherein the encryption key information can be read out if determined. 4. The encryption means is included in encryption method determination means for determining an encryption method based on a command from a host device, and encryption key information read by the encryption key information reading means. 3. The memory card according to claim 2, further comprising means for encrypting information according to the encryption method determined by the encryption method determining means. 5. A memory having a protected area for storing encryption key information having a public key, a private key, a certificate and a user password, and a first control circuit for performing read / write control on the memory. A method of outputting encryption key information for a memory card, comprising: a second control circuit that performs control of a type different from the control of the first control circuit, wherein a host device is provided using the first control circuit. Authentication is performed by using the second control circuit, it is determined whether the authentication by the first control circuit is normally performed, and when it is determined that the authentication is normally performed, Information included in the encryption key information to be selected is determined based on a command from the host device, and the user password corresponding to the determined encryption key information is determined using the second control circuit. Authentication with the password of the user of the memory card is performed, it is determined whether or not the password authentication is normally performed, and when it is determined that the password authentication is normally performed,
An encryption method is determined based on a command from the host device, and the first control circuit is used to include the encryption key information of the determined selection target based on the command from the host device. The information included in the extracted encryption key information is encrypted according to the determined encryption method, and the information included in the encrypted encryption key information is output to the host device. A method for outputting encryption key information of a memory card, which is characterized in that 6. A method of outputting encryption key information in a memory card having a memory having a protection area for storing encryption key information having a public key, a private key, a certificate and a user password, wherein the usage stored in the protection area is used. The user password is used to perform an authentication process for reading the information contained in the encryption key information stored in the protected area of the memory, and when the authentication is performed, it is specified by a command from the host device. Information included in the encrypted encryption key information is read from the protected area, the information included in the read encryption key information is encrypted, and the information included in the encrypted encryption key information is output to the host device. A method for outputting encryption key information in a memory card, comprising: 7. A memory, a first control circuit for performing read / write control on the memory, a second control circuit for performing control of a type different from the control of the first control circuit, The first control circuit is used to authenticate with the host device to determine whether the authentication has been normally performed, and the second control circuit is used to perform the authentication. If it is determined that the host device has been normally terminated, the second control circuit uses the determining means for determining the decoding method according to the command from the host device and the first control circuit, and the host device Whether the encrypted content from is decrypted by the determined decryption method, and whether the content is valid based on the decrypted content and the electronic signature corresponding to the decrypted content. The second to determine
And a storage unit that stores the decrypted content in the memory card by using the first control circuit. 8. A memory, a first control circuit for performing read / write control on the memory, and a second control circuit for performing control of a different type from the control of the first control circuit. In the content recording method for a memory card, the first control circuit is used to authenticate with a host device, and it is determined whether the authentication is normally performed, and it is determined that the authentication is normally completed. Then, the second control circuit is used to determine the decryption method according to the command from the host device, and the first control circuit is used to perform the encryption from the host device. The content is decrypted by the determined decryption method, and whether the content is valid or not is determined based on the decrypted content and the electronic signature corresponding to this content. A method of recording contents in a memory card, characterized by storing the decrypted contents in the memory card using the first control circuit. 9. A memory having a protected area for storing encryption key information having a public key, a private key, a certificate, and a user password, and a first control circuit for performing read / write control on the memory. A second control circuit that performs control of a different type from the control of the first control circuit and the first control circuit are used to perform authentication for authenticating with a host device. Means for determining whether or not the authentication has been normally performed, and encryption key information based on a command from the host device using the second control circuit when it is determined that the authentication has been normally completed. And a selecting means for selecting a decryption method, an obtaining means for obtaining the secret key of the selected encryption key information by using the second control circuit, and the first control circuit, Selected decryption Decryption means for decrypting the encrypted content from the host device using the obtained private key according to the method, and the decryption using the first control circuit. A memory card, comprising: storage means for storing information indicating a correspondence relationship between content and encryption key information used for the decryption in the memory. 10. A memory having a protected area for storing encryption key information having a public key, a private key, a certificate and a user password, and a first control circuit for performing read / write control on the memory. A content recording method for a memory card, comprising: a second control circuit that performs control of a type different from the control of the first control circuit, wherein the first control circuit performs authentication with a host device, It is determined whether or not the authentication is normally performed, and when it is determined that the authentication is normally completed, the second control circuit causes the encryption key information and the decryption based on the command from the host device. A method is selected, the second control circuit obtains the secret key of the selected encryption key information, and the first control circuit selects the decryption method. According to the formula, the encrypted content from the host device is decrypted by using the obtained private key, and information indicating the correspondence between the decrypted content and the encryption key information used for the decryption is displayed. A content recording method in a memory card, characterized by storing in the memory. 11. A memory having a protected area for storing encryption key information having a public key, a private key, a certificate, and a user password, and a first control circuit for performing read / write control on the memory. A second control circuit that performs control of a different type from the control of the first control circuit and the first control circuit are used to perform authentication for authenticating with a host device. The host device is a certificate authority terminal when it is determined that the authentication is normal by using the first determining means for determining whether the authentication is normally performed and the first control circuit. If it is determined that the host device is a certificate authority terminal and a second determining means for determining whether or not the second control circuit is used, based on a command from the certificate authority terminal, Select the decoding method Selecting means, receiving means for receiving encrypted key information including an encrypted public key, secret key, certificate and user password from the certificate authority terminal; and using the first control circuit, the selecting means The decryption means for decrypting the received encryption key information according to the decrypted decryption method and the first control circuit are used to store the decrypted encrypted information in the protected area of the memory. A memory card comprising storage means. 12. A memory having a protected area for storing encryption key information having a public key, a private key, a certificate and a user password, and a first control circuit for controlling reading / writing of the memory. A method of storing encryption key information in a memory card, comprising: a second control circuit that performs a control different from the control of the first control circuit by using a host device using the first control circuit. Authentication for performing authentication is performed, and it is determined whether the authentication is normally performed. When it is determined that the authentication is normal, it is determined whether the host device is a certificate authority terminal. If it is determined that the host device is a certificate authority terminal, a decryption method is selected based on a command from the certificate authority terminal, and the encrypted publication from the certificate authority terminal is performed. Receiving the encryption key information including a secret key, a certificate and a user password, decrypting the received encryption key information according to the selected decryption method, and decrypting the decrypted encryption information in the memory. A method of storing encryption key information in a memory card, characterized by storing in a protected area.