JP2004127052A - Data management system, virtual memory device, method of controlling virtual memory, ic module access device, and method of controlling access to ic module - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To virtually expand the memory of an IC module. <P>SOLUTION: IDs are stored on the IC module to form data and links for a virtual memory module. The file structure of the data storage part of the IC module has an upper limit value and is connected to the file structure of the virtual memory module. The virtual memory module connected via a network is connected to the IC module. If the data that should be stored in the IC module do not exist in the IC module when the IC module communicates with a reader/writer, the data storage part in the virtual memory module is accessed. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an IC module having a memory function for holding data and a data management system for accessing the same, and more particularly to a data management system for expanding a memory area associated with the IC module.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, various devices using a personal identification number and a password for personal identification and authentication processing have been devised and put to practical use. For example, when using a cash card or credit card at a bank or other financial institution, the user is required to enter a personal identification number or password as a means of personal identification on a cash dispenser or other financial terminal. To confirm that the user has input a correct password or password, and then perform a deposit / withdrawal operation.
[0003]
In a storage medium such as a magnetic stripe provided on one cash card, only a storage area usable only for the bank is provided. Therefore, the input of the personal identification number or the password as described above is merely an access to the single storage area, so that protection against forgery and plagiarism cannot be said to be sufficient.
[0004]
Therefore, from the viewpoint of preventing forgery and the like, a contact-type IC card having electrical contacts to a cash card, a credit card, or the like, a non-contact IC card that reads and writes data without contact via wireless data, and the like. (Hereinafter, also referred to as an “IC module”) in which the IC function is mounted has come to be used frequently. For example, an IC card reader / writer installed at a cash dispenser, an entrance of a concert hall, a ticket gate of a station, or the like can access an IC card held by a user without contact.
[0005]
The user enters the personal identification number into the IC card reader and checks the entered personal identification number with the personal identification number stored on the IC card, thereby confirming the identity between the IC card and the IC card reader / writer. Alternatively, an authentication process is performed. Then, when the identity verification or the authentication process is successful, for example, the application stored in the IC card can be used. Here, as an application held by the IC card, for example, value information such as electronic money or an electronic ticket can be cited. (The personal identification number used when accessing the IC card is particularly called a PIN (Personal Identification Number).)
[0006]
FIG. 7 schematically shows a system configuration example (prior art) using an IC module. As shown in FIG. 1, the system includes an IC module which is carried by a user and holds predetermined data in a secure state, and a reader / writer which accesses a memory space of the IC module and reads and writes data. Be composed.
[0007]
The IC module is packaged in, for example, a card type, and includes a data storage unit, a card communication control unit that performs a communication operation with a reader / writer, and a card encryption unit that performs encryption control of communication data with the reader / writer. It has a control unit.
[0008]
The reader / writer includes a reader / writer communication control unit that performs a communication operation with the IC module, and a reader / writer encryption control unit that performs encryption control of communication data with the IC module.
[0009]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units of the IC module and the reader / writer.
[0010]
A command is issued from the reader / writer communication control unit, and the IC module receives the command in the card communication control unit, performs processing such as decryption of the code in the card encryption processing unit, and stores the data in the data storage unit. Access to the data that you have. Further, the IC module generates a response in the card encryption processing unit and returns the response to the reader / writer. The transaction is completed by continuously performing such a sequence.
[0011]
Recently, along with the improvement of the miniaturization technology, an IC module having a relatively large-capacity data storage unit has appeared and spread. Since a conventional cash card or the like carries only a single storage area, that is, a single application, it is necessary to carry a plurality of IC cards corresponding to each application or purpose. On the other hand, according to such an IC module with a large-capacity memory, a plurality of applications can be stored simultaneously, so that one IC card can be used for a plurality of purposes. For example, two or more applications such as electronic money for electronic payment and electronic ticket for entering a specific concert hall are stored on one IC card, and one IC card is used for various purposes. It can be applied to various applications.
[0012]
However, IC modules have been developed for the purpose of carrying data safely, and are generally proposed to be configured in a card shape or chipped and used in small devices such as mobile phones and PDAs. Have been. That is, it is often restricted by hardware, and although the capacity is increased, the memory size of the data storage unit has an upper limit.
[0013]
[Problems to be solved by the invention]
An object of the present invention is to provide an excellent data management system capable of expanding a memory area associated with an IC module.
[0014]
A further object of the present invention is to provide an excellent data management system capable of suitably changing the version of a program for executing a transaction between an IC module and a reader / writer.
[0015]
Means and Action for Solving the Problems
The present invention has been made in view of the above problems, and a first aspect thereof is a data management system for expanding a memory area attached to an IC module,
A virtual memory module including a data storage unit for storing data used on the IC module and a card encryption function control unit for performing encryption control of communication data;
A reader / writer communication control unit for accessing a memory area of the IC module, a reader / writer encryption function control unit for performing encryption control of communication data with the IC module, and a network communication control for connecting to the virtual memory module via a network And a reader / writer composed of
The reader / writer accesses and retrieves the virtual memory module when data used on the IC module is not on the IC module;
A data management system characterized by the following.
[0016]
However, the term “system” as used herein refers to a logical collection of a plurality of devices (or functional modules that realize specific functions), and each device or functional module is in a single housing. It does not matter in particular.
[0017]
The purpose of the virtual memory module is to virtually expand the memory area of the data storage unit on the IC module side, which is limited in hardware. The virtual memory module itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit of the IC module, and makes its maximum memory capacity virtually unlimited. be able to. The substance of the virtual memory module is, for example, a server machine built on a broadband network, but is not necessarily a network such as an external storage device such as a hard disk mounted on a PC on the user side, a memory module, or the like. It does not require communication.
[0018]
When transmitting an ID or the like in communication between the IC module and the reader / writer, encrypted communication based on an existing sequence in IC module communication is performed. Further, the reader / writer accesses the virtual memory module instead of the IC module, and accesses the corresponding data. Access to the virtual memory module performs encrypted communication based on an existing sequence in network communication such as TCP / IP protocol. In order to enable seamless communication between the card on which the IC module is mounted and the virtual memory module, communication between the virtual memory module and the IC module may be performed using the same protocol. For example, the identification can be performed by flowing a command packet between the card and the reader / writer over TCP / IP.
[0019]
After the ID communication with the IC module is performed, the reader / writer makes access to the actual data entity to the virtual memory module by a communication operation between high-performance servers connected by a broadband network. Transaction time can be completed in a very short time.
[0020]
An ID for identifying the data space of the module is stored in the data storage unit of the IC module, and a link to the data of the data storage unit of the virtual memory module is formed based on the ID. Further, a predetermined file structure is formed in the data storage unit, and an upper limit value is set. This upper limit value is connected to a file structure of the data storage unit on the virtual memory module side. When performing communication with the IC module, the reader / writer accesses the virtual memory module via the network if the data entity stored in the data storage unit of the IC module does not exist in the IC module. Thus, desired data can be extracted.
[0021]
A server / reader / writer module connected to the reader / writer via a network is arranged, and the server / reader / writer module controls encryption of communication data with an IC module in the server / reader / writer module. May be installed.
[0022]
In such a case, the reader / writer receives the response received from the IC module, transfers the encrypted response data as it is to the server-side reader / writer module via a network, and transmits the encrypted response data to the server-side reader / writer. -Response data can be processed by the module.
[0023]
The server-side reader / writer module is, for example, a server machine provided on a broadband network and having a function of accessing a virtual memory module. The server-side reader / writer module, when performing acquisition of data carried by the IC module, if the data entity stored in the data storage unit of the IC module exists in the IC module, the reader / writer It is possible to access the IC module via the data storage unit and retrieve it from the data storage unit. On the other hand, when the data entity stored in the data storage unit of the IC module does not exist in the IC module, the virtual memory module can be accessed via the network and retrieved from the data storage unit. . After the ID communication is performed with the IC module, the access to the actual data entity to the virtual memory module is a communication operation between high-performance servers connected by a broadband network, so that a transaction is performed. Time is completed in a very short time.
[0024]
Also, a version upgrade program for each of the reader / writer encryption processing unit of the reader / writer and / or the card encryption processing unit of the virtual memory module is prepared and transferred to the reader / writer and / or the virtual memory module. A version control module to be used may be provided on the network.
[0025]
The virtual transaction for the virtual memory module is performed by the reader / writer encryption function control unit in the reader / writer (or the reader / writer encryption function control unit in the server-side reader / writer module) and the virtual memory module. In cooperation with the card encryption control unit. The cooperative operation of performing a virtual transaction is generally implemented in a form of executing a transaction execution program in each module.
[0026]
When communication is performed between the IC module and the reader / writer, the communication is performed according to a sequence using an existing program (positioning of a communication handshake). When the communication between the reader / writer and the virtual memory module is performed thereafter, Transactions in the extended sequence in the upgraded program can be performed.
[0027]
That is, by upgrading the version of the transaction execution program by the version management module, the program of the fixed IC module can be virtually expanded.
[0028]
Further, it becomes possible for the server to execute high additional processing that cannot be performed with the performance of the IC module.
[0029]
Also, if a service provider wants to extend the functions of an IC module only for its own service, the existing IC module can be applied as it is and the version of the program of the virtual memory module can be increased, so that a unique service can be provided. It can be realized at low cost.
[0030]
According to a second aspect of the present invention, there is provided a virtual memory device or a virtual memory control method for expanding a memory area associated with an IC module,
A data storage unit or step for storing data used on the IC module;
A card encryption function control unit or step for performing encryption control of communication data,
A virtual memory device or a method of controlling a virtual memory.
[0031]
The virtual memory is not used by a user, and has no hardware restrictions such as a card shape. Acting as a storage space, its maximum memory capacity can be virtually unlimited. The substance of the virtual memory is, for example, a server machine built on a broadband network.
[0032]
After the ID communication with the IC module is performed, the reader / writer makes access to the actual data entity to the virtual memory module by a communication operation between high-performance servers connected by a broadband network. Transaction time can be completed in a very short time.
[0033]
An ID for identifying the data space of the module is stored in the data storage unit of the IC module, and a link to the data of the data storage unit of the virtual memory module is formed based on the ID. Further, a predetermined file structure is formed in the data storage unit, and an upper limit value is set. This upper limit value is connected to a file structure of the data storage unit on the virtual memory module side. When performing communication with the IC module, the reader / writer accesses the virtual memory module via the network if the data entity stored in the data storage unit of the IC module does not exist in the IC module. Thus, desired data can be extracted.
[0034]
According to a third aspect of the present invention, there is provided an IC module access device or an access control method for an IC module for accessing an IC module whose memory area is expanded by a virtual memory module on a network,
A reader / writer communication control unit or step for accessing a memory area of the IC module; a reader / writer encryption function control unit or step for performing encryption control of communication data with the IC module; and a connection to the virtual memory module via a network Comprising a network communication control unit or step,
Accessing and extracting the virtual memory module when data used on the IC module is not on the IC module;
And a method for controlling access to an IC module access device or an IC module.
[0035]
The virtual memory is not used by a user, and has no hardware restrictions such as a card shape. Acting as a storage space, its maximum memory capacity can be virtually unlimited. The substance of the virtual memory is, for example, a server machine built on a broadband network.
[0036]
After the ID communication with the IC module is performed, the reader / writer makes access to the actual data entity to the virtual memory module by a communication operation between high-performance servers connected by a broadband network. Transaction time can be completed in a very short time.
[0037]
An ID for identifying the data space of the module is stored in the data storage unit of the IC module, and a link to the data of the data storage unit of the virtual memory module is formed based on the ID. Further, a predetermined file structure is formed in the data storage unit, and an upper limit value is set. This upper limit value is connected to a file structure of the data storage unit on the virtual memory module side. When performing communication with the IC module, the reader / writer accesses the virtual memory module via the network if the data entity stored in the data storage unit of the IC module does not exist in the IC module. Thus, desired data can be extracted.
[0038]
Further objects, features, and advantages of the present invention will become apparent from more detailed descriptions based on embodiments of the present invention described below and the accompanying drawings.
[0039]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0040]
The present invention is a system for safely managing user data using an IC module, and virtually expands the maximum memory capacity of an IC module by virtually expanding a memory area having hardware restrictions. It is assumed that.
[0041]
First embodiment:
FIG. 1 schematically shows a basic configuration of a data management system according to an embodiment of the present invention. As shown in FIG. 1, the data management system includes an IC module 100 that is carried by a user and holds predetermined data (such as value information) in a secure state, and a data space that is accessed by accessing a memory space of the IC module 100. And a virtual memory module 300 connected to the reader / writer 200 via a network.
[0042]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0043]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit.
[0044]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100, a reader / writer encryption control unit 202 that performs encryption control of communication data with the IC module, and a TCP / A network communication control unit 203 that realizes data communication via a network such as an IP is provided. The entity of the reader / writer 200 is, for example, a server machine provided on a broadband network and provided with a function of accessing the IC module 100.
[0045]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network.
[0046]
Of course, the connection form between the IC module 100 and the reader / writer 200 is not limited to the non-contact connection, and the connection is realized by inserting the IC module 100 into the card slot on the reader / writer 200 side. Is also good.
[0047]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And a card encryption control unit 303 for performing encryption control of the communication data.
[0048]
For example, a network connection based on a predetermined communication protocol such as TCP / IP is made between the network communication control units 302 and 201 of the virtual memory module 300 and the reader / writer 200.
[0049]
The purpose of the virtual memory module 300 is to virtually expand the memory area of the data storage unit 101 on the IC module 100 side, which is limited in hardware. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 301 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the IC module 100, and effectively reduces its maximum memory capacity. It can be unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0050]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0051]
When performing communication with the IC module 100, if the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the reader / writer 200 The module 300 can be accessed and retrieved from the data storage unit 301.
[0052]
One virtual memory module may be arranged for each IC module, but the virtual memory module may be configured to provide a virtual storage space to a plurality of IC modules at the same time. Of course, one IC module may have a virtual storage space in a plurality of virtual memory modules.
[0053]
FIG. 2 shows an operation procedure for accessing an entity of data stored in the IC module 100 in the data management system.
[0054]
The communication control unit 201 of the reader / writer 200 constantly polls the IC module 100.
[0055]
When the IC module 100 is sufficiently close to the reader / writer 200, the card communication control unit 102 is activated to enable connection by electromagnetic induction, and the IC module 100 generates a response in the card encryption control unit 103, / Reply to writer 200.
[0056]
Thereafter, the mutual authentication and response procedures are performed once or more between the IC module 100 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible.
[0057]
The reader / writer 200 further reads the ID stored in the data storage unit 101 in the IC module 100 (ReadID) to obtain link information to the file structure of the data storage unit 301 of the virtual memory module 300. Can be.
[0058]
The data storage unit 101 has a predetermined file structure, and the upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0059]
When the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the reader / writer 200 accesses the virtual memory module 300 via a network to store the data. This can be taken out of the unit 301.
[0060]
That is, the reader / writer 200 uses the ID obtained from the IC module 100 to perform polling of the virtual memory module 300 via the network.
[0061]
On the other hand, the virtual memory module 300 generates a response in the card encryption control unit 303 and returns the response to the reader / writer 200. As a result of performing the mutual authentication and response procedure at least once, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible.
[0062]
Thereafter, the procedure of mutual authentication and response is performed at least once between the virtual memory module 300 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible. The reader / writer 200 can repeat the Read or Write access and its response procedure with the virtual memory module 300 an arbitrary number of times to obtain a desired data entity.
[0063]
FIG. 3 is a flowchart illustrating an operation procedure for the reader / writer 200 to access a data entity stored in the IC module 100.
[0064]
When the IC module 100 is held over the reader / writer 200, the card communication control unit 102 is activated, and a non-contact connection based on an electromagnetic induction action is established (step S1). The IC module 100 generates a response in the card encryption control unit 103 and returns the response to the reader / writer 200.
[0065]
Thereafter, the mutual authentication and response procedures are performed at least once between the IC module 100 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized (step S2), and secure data communication using encryption is enabled. Become.
[0066]
The reader / writer 200 further reads the ID stored in the data storage unit 101 in the IC module 100 (ReadID), and obtains link information to the file structure of the data storage unit 301 of the virtual memory module 300 ( Step S3).
[0067]
Next, it is determined whether value information (value) such as electronic money or an electronic ticket, or other desired data exists in the data storage unit 101 in the IC module 100 (step S4).
[0068]
Here, when the desired data is present in the data storage unit 101 in the IC module 100, the reader / writer 200 performs the Read or Write access and the response procedure thereof with the IC module 100 an arbitrary number of times. By repeating, desired data is obtained (step S5).
[0069]
The data storage unit 101 has a predetermined file structure, and the upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0070]
Therefore, if the desired data does not exist in the data storage unit 101 in the IC module 100, the reader / writer 200 connects to the virtual memory module 300 via the network by the network communication control unit 203 (step S6). The mutual authentication and the encryption key are shared by performing the procedure of the mutual authentication and the response at least once (step S7).
[0071]
Then, using the ID obtained from the IC module 100, the procedure of Read or Write access and its response is repeated an arbitrary number of times with the virtual memory module 300, and the desired data is obtained from the data storage unit 301. (Step S8).
[0072]
In this embodiment, when transmitting an ID or the like in communication between the IC module 100 and the reader / writer 200, encrypted communication based on an existing sequence in IC module communication is performed. The reader / writer 200 accesses the virtual memory module 300 instead of the IC module 100, and accesses the corresponding data. Access to the virtual memory module 300 performs encrypted communication based on an existing sequence in network communication such as the TCP / IP protocol.
[0073]
After the ID communication with the IC module 100 is performed, the reader / writer 200 does not allow access to the actual data entity to the virtual memory module 300 between the high-performance servers connected via the broadband network. , The transaction time is completed in a very short time (in contrast, the communication environment when using a general IC module is limited by the operating speed of the 8-bit CPU on the IC module side). And the communication band with the reader / writer is about 200 Kbps).
[0074]
Second embodiment:
FIG. 4 schematically shows a modification of the data management system shown in FIG. In the embodiment shown in FIG. 1, the reader / writer 200 having an IC module access function also has a network connection function, and the reader / writer 200 also performs an access operation to the virtual memory module 300 at the same time. It is configured. On the other hand, in the embodiment shown in FIG. 4, the reader / writer 200 does not have a network connection function, and accesses the data carried by the IC module 100 under the management of the server 400 on the network. The server 400 accesses the virtual memory module 300 via a network.
[0075]
As shown in FIG. 4, the data management system includes an IC module 100 that is carried by a user and holds predetermined data (eg, value information) in a secure state, and a data space that is accessed by accessing a memory space of the IC module 100. A reader / writer 200 that performs read / write operations of a memory, a virtual memory module 300 connected via a network, and a communication function with the reader / writer 200 are provided, and the memory space of the virtual memory module 300 is accessed to access data. And a server-side reader / writer module 400 that performs a read / write operation of.
[0076]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0077]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit.
[0078]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100 and a reader / writer encryption control unit 202 that performs encryption control of communication data with the IC module. .
[0079]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network. Of course, the connection form between the IC module 100 and the reader / writer 200 is not limited to the non-contact connection, and the connection is realized by inserting the IC module 100 into the card slot on the reader / writer 200 side. Is also good.
[0080]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And a card encryption control unit 303 for performing encryption control of the communication data.
[0081]
The purpose of the virtual memory module 300 is to virtually expand the memory area of the data storage unit 101 on the IC module 100 side, which is limited in hardware. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 301 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the IC module 100, and effectively reduces its maximum memory capacity. It can be unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0082]
The server-side reader / writer module 400 includes a reader / writer encryption control unit 401 that performs an encryption communication operation with the reader / writer, and a network communication control unit that realizes data communication via a network such as TCP / IP. 402 is provided. The entity of the server-side reader / writer module 400 is, for example, a server machine constructed on a broadband network and provided with a function of accessing the virtual memory module 300.
[0083]
For example, a network connection based on a predetermined communication protocol such as TCP / IP is performed between the network communication control units 302 and 402 of the virtual memory module 300 and the server-side reader / writer module 400.
[0084]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0085]
When the server-side reader / writer module 400 acquires the data carried by the IC module 100, the server-side reader / writer module 400 determines whether the data entity stored in the data storage unit 101 of the IC module 100 exists in the IC module 100. Can access the IC module 100 via the reader / writer 200 and retrieve it from the data storage unit 101. On the other hand, when the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the virtual memory module 300 is accessed via the network and the data storage unit 301 Can be taken out.
[0086]
Third embodiment:
According to the present invention, a virtual transaction is performed on the virtual memory module 300 to virtually expand the memory area in the IC module 100 that is restricted in hardware. The maximum memory capacity can be virtually unlimited.
[0087]
Such a virtual transaction to the virtual memory module 300 is transmitted to the reader / writer encryption control unit 202 in the reader / writer 200 (or the reader / writer encryption control unit 401 in the server-side reader / writer module 400). , In cooperation with the card encryption control unit 303 in the virtual memory module 300.
[0088]
The cooperative operation of performing a virtual transaction is generally implemented in a form of executing a transaction execution program in each module. If the transaction execution program can be upgraded, the program of the fixed IC module 100 can be virtually expanded.
[0089]
FIG. 5 schematically shows a modification of the data management system shown in FIG. In the illustrated embodiment, the version management module 500 manages a virtual transaction execution program executed in the reader / writer encryption control unit 202 in the reader / writer 200 and the card encryption control unit 303 in the virtual memory module 300. .
[0090]
As shown in FIG. 5, the data management system includes an IC module 100 that is carried by a user and holds predetermined data (eg, value information) in a secure state, and a data space that is accessed by accessing a memory space of the IC module 100. , A reader / writer 200 that performs a read / write operation, a virtual memory module 300 connected via a network, and a version management module 500 that manages a program for executing a virtual transaction for the virtual memory module 300.
[0091]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0092]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit.
[0093]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100, a reader / writer encryption control unit 202 that performs encryption control of communication data with the IC module, and a TCP / A network communication control unit 203 that realizes data communication via a network such as an IP is provided. The entity of the reader / writer 200 is, for example, a server machine provided on a broadband network and provided with a function of accessing the IC module 100.
[0094]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network.
[0095]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And a card encryption control unit 303 for performing encryption control of the communication data.
[0096]
For example, a network connection based on a predetermined communication protocol such as TCP / IP is made between the network communication control units 302 and 201 of the virtual memory module 300 and the reader / writer 200.
[0097]
The purpose of the virtual memory module 300 is to virtually expand the memory area of the data storage unit 101 on the IC module 100 side, which is limited in hardware. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 301 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the IC module 100, and effectively reduces its maximum memory capacity. It can be unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0098]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0099]
When performing communication with the IC module 100, if the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the reader / writer 200 The module 300 can be accessed and retrieved from the data storage unit 301.
[0100]
The version management module 500 includes a network communication control unit 501 for connecting to the reader / writer 200 via a network, control of encrypted communication with the reader / writer 200, and an extension program of a virtual transaction execution program for the reader / writer 200. A reader / writer encryption control and extension program generation unit 502, a network communication control unit 503 for connecting to the virtual memory module 300 via a network, control of encryption communication with the virtual memory module 300, and virtual memory It comprises a virtual memory module cryptographic control and extension program generation unit 504 that generates an extension program of the virtual transaction execution program for the module 300.
[0101]
Such a version management module is installed on the network, and a version upgrade program for each of the reader / writer encryption control unit 202 and the card encryption control unit 303 is generated and stored, and the reader / writer 200 or the virtual memory is stored at an appropriate timing. -Transfer to module 300.
[0102]
When communication is performed between the IC module 100 and the reader / writer 200, the communication is performed according to a sequence using an existing program (positioning of communication handshake), and the subsequent communication between the reader / writer 200 and the virtual memory module 300 is performed. At the time of the exchange, a transaction is executed by the extended sequence in the upgraded program.
[0103]
Therefore, even if the version of the IC module 100 is not changed, the extended sequence can be performed in the communication between the reader / writer 200 and the virtual memory module 300 after acquiring the ID from the IC module 100. It becomes. That is, it is possible to provide substantially the same effect as when the version of the program of the IC module 100 is upgraded.
[0104]
In addition, a server can perform high-load processing that cannot be performed with the performance of the IC module 100.
[0105]
When a service provider wants to extend the functions of the IC module 100 only for his / her own service, the existing IC module 100 is applied as it is, and the version of the program of the virtual memory module is increased, so that a unique version is provided. The service can be realized at low cost. On the other hand, developing a unique IC module requires a very high cost.
[0106]
Fourth embodiment:
The cooperative operation of performing a virtual transaction on the virtual memory module is generally implemented in a form of executing a transaction execution program in each module. If the transaction execution program can be upgraded, the program of the fixed IC module 100 can be virtually expanded.
[0107]
FIG. 6 schematically shows a modification of the data management system shown in FIG. In the illustrated embodiment, the reader / writer 200 does not have a network connection function, performs an access operation to data carried by the IC module 100 under the control of the server 400 on the network, and accesses the virtual memory module 300. Access is performed by the server 400 via a network. Further, the version management module 500 manages the virtual transaction execution program executed in the reader / writer encryption control unit 202 in the reader / writer 200 and the card encryption control unit 303 in the virtual memory module 300.
[0108]
As shown in FIG. 4, the data management system includes an IC module 100 that is carried by a user and holds predetermined data (eg, value information) in a secure state, and a data space that is accessed by accessing a memory space of the IC module 100. A reader / writer 200 that performs read / write operations, a virtual memory module 300 connected via a network, and a communication function with the reader / writer 200 and accesses the memory space of the virtual memory module 300 to access data. And a version management module 500 for managing a program for executing a virtual transaction with respect to the virtual memory module 300.
[0109]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0110]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit.
[0111]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100 and a reader / writer encryption control unit 202 that performs encryption control of communication data with the IC module. .
[0112]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network.
[0113]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And a card encryption control unit 303 for performing encryption control of the communication data.
[0114]
The purpose of the virtual memory module 300 is to virtually expand the memory area of the data storage unit 101 on the IC module 100 side, which is limited in hardware. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 301 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the IC module 100, and effectively reduces its maximum memory capacity. It can be unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0115]
The server-side reader / writer 400 includes a reader / writer encryption control unit 401 that performs an encryption communication operation with the reader / writer, and a network communication control unit 402 that realizes data communication via a network such as TCP / IP. Have. The entity of the reader / writer 200 is, for example, a server machine provided on a broadband network and provided with a function of accessing the virtual memory module 300.
[0116]
For example, a network connection is made between the virtual memory module 300 and the network communication control units 302 and 402 of the server-side reader / writer 400 based on a predetermined communication protocol such as TCP / IP.
[0117]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0118]
When the server-side reader / writer module 400 acquires the data carried by the IC module 100, the server-side reader / writer module 400 determines whether the data entity stored in the data storage unit 101 of the IC module 100 exists in the IC module 100. Can access the IC module 100 via the reader / writer 200 and retrieve it from the data storage unit 101. On the other hand, when the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the virtual memory module 300 is accessed via the network and the data storage unit 301 Can be taken out.
[0119]
The version management module 500 includes a network communication control unit 501 for connecting to the reader / writer 200 via a network, control of encrypted communication with the reader / writer 200, and an extension program of a virtual transaction execution program for the reader / writer 200. A reader / writer encryption control and extension program generation unit 502, a network communication control unit 503 for connecting to the virtual memory module 300 via a network, control of encryption communication with the virtual memory module 300, and virtual memory It comprises a virtual memory module cryptographic control and extension program generation unit 504 that generates an extension program of the virtual transaction execution program for the module 300.
[0120]
Such a version management module is installed on the network, and a version upgrade program for each of the reader / writer encryption control unit 202 and the card encryption control unit 303 is generated and stored, and the reader / writer 200 or the virtual memory is stored at an appropriate timing. -Transfer to module 300.
[0121]
When communication is performed between the IC module 100 and the reader / writer 200, the communication is performed according to a sequence using an existing program (positioning of communication handshake), and the subsequent communication between the reader / writer 200 and the virtual memory module 300 is performed. At the time of the exchange, a transaction is executed by the extended sequence in the upgraded program.
[0122]
Therefore, even if the version of the IC module 100 is not changed, the extended sequence can be performed in the communication between the reader / writer 200 and the virtual memory module 300 after acquiring the ID from the IC module 100. It becomes. That is, it is possible to provide substantially the same effect as when the version of the program of the IC module 100 is upgraded.
[0123]
In addition, a server can perform high-load processing that cannot be performed with the performance of the IC module 100.
[0124]
When a service provider wants to extend the functions of the IC module 100 only for his / her own service, the existing IC module 100 is applied as it is, and the version of the program of the virtual memory module is increased, so that a unique version is provided. The service can be realized at low cost.
[0125]
[Supplement]
The present invention has been described in detail with reference to the specific embodiments. However, it is obvious that those skilled in the art can modify or substitute the embodiment without departing from the scope of the present invention. That is, the present invention has been disclosed by way of example, and the contents described in this specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims described at the beginning should be considered.
[0126]
【The invention's effect】
As described above in detail, according to the present invention, by virtually expanding the memory area of the data storage unit which is limited in hardware, the maximum memory capacity of the data storage unit of the IC module is virtually unlimited. can do.
[0127]
Further, according to the present invention, it is possible to virtually extend a program of a fixed IC module by making it possible to upgrade a program for executing a virtual transaction.
[Brief description of the drawings]
FIG. 1 is a diagram schematically showing a basic configuration of a data management system according to an embodiment of the present invention.
FIG. 2 is a sequence diagram showing an operation procedure for accessing an entity of data stored by the IC module 100 in the data management system according to the embodiment of the present invention.
FIG. 3 is a flowchart showing an operation procedure for a reader / writer 200 to access a data entity stored in an IC module 100;
FIG. 4 is a diagram schematically showing a modification of the data management system shown in FIG. 1;
FIG. 5 is a diagram schematically showing a modification of the data management system shown in FIG. 1;
FIG. 6 is a diagram schematically showing a modification of the data management system shown in FIG. 4;
FIG. 7 is a diagram schematically illustrating a system configuration example (prior art) using an IC module.
[Explanation of symbols]
100 ... IC module
101: Data storage unit
102: Card communication control unit
103: Card encryption control unit
200 ... Reader / writer
201: reader / writer communication control unit
202: Reader / writer encryption control unit
203: Network communication control unit
300: virtual memory module
301: Data storage unit
302: Network communication control unit
303: Card encryption control unit
400: Server-side reader / writer module
401 ... Reader / writer encryption control unit
402: Network communication control unit
500 Version control module
501: Network communication control unit
502: Reader / writer encryption control and extension program generation unit
503: Network communication control unit
504: Virtual memory module encryption control and extension program generation unit

Claims (17)

A data management system for expanding a memory area attached to an IC module,
A virtual memory module including a data storage unit for storing data used on the IC module and a card encryption function control unit for performing encryption control of communication data;
A reader / writer communication control unit for accessing a memory area of the IC module, a reader / writer encryption function control unit for performing encryption control of communication data with the IC module, and a network communication control for connecting to the virtual memory module via a network And a reader / writer composed of
The reader / writer accesses and retrieves the virtual memory module when data used on the IC module is not on the IC module;
A data management system, characterized in that: The IC module stores an ID linked to data on the virtual memory module.
The data management system according to claim 1, wherein: An upper limit is set for the file structure of the memory area of the IC module, and the upper limit is connected to the file structure of the virtual memory module.
The data management system according to claim 1, wherein: Place a server-side reader / writer module connected via a network,
The server-side reader / writer module is provided with a reader / writer encryption processing unit that performs encryption control of communication data with the IC module,
The reader / writer receives the response received from the IC module, transfers the encrypted response data as it is to the server-side reader / writer module via a network, and returns the response to the server-side reader / writer module. Processing data,
The data management system according to claim 1, wherein: Prepare a version upgrade program for each of the reader / writer encryption processing unit of the reader / writer and / or the card encryption processing unit of the virtual memory module, and transfer the version to the reader / writer and / or the virtual memory module. Place the management module on the network,
The data management system according to claim 1, wherein: A virtual memory device for expanding a memory area associated with an IC module,
A data storage unit for storing data used on the IC module;
A card encryption function control unit for performing encryption control of communication data;
A virtual memory device comprising: The IC module stores an ID linked to data on the virtual memory module.
7. The virtual memory device according to claim 6, wherein: An upper limit is set for the file structure of the memory area of the IC module, and the upper limit is connected to the file structure of the virtual memory module.
7. The virtual memory device according to claim 6, wherein: A virtual memory control method for expanding a memory area associated with an IC module,
A data storage step of storing data used on the IC module;
A card encryption function control step of performing encryption control of communication data;
A method for controlling a virtual memory, comprising: The IC module stores an ID linked to data on the virtual memory module.
The method of controlling a virtual memory according to claim 9, wherein: An upper limit is set for the file structure of the memory area of the IC module, and the upper limit is connected to the file structure of the virtual memory module.
The method of controlling a virtual memory according to claim 9, wherein: An IC module access device for accessing an IC module whose memory area has been expanded by a virtual memory module on a network,
A reader / writer communication control unit for accessing a memory area of the IC module, a reader / writer encryption function control unit for performing encryption control of communication data with the IC module, and a network communication control for connecting to the virtual memory module via a network Department,
Accessing and extracting the virtual memory module when data used on the IC module is not on the IC module;
An IC module access device comprising: The IC module stores an ID linked to data on the virtual memory module.
The IC module access device according to claim 12, wherein: An upper limit is set for the file structure of the memory area of the IC module, and the file structure is connected to the file structure of the virtual memory module.
The IC module access device according to claim 12, wherein: An access control method for an IC module that accesses an IC module whose memory area is expanded by a virtual memory module on a network,
Reader / writer communication control step for accessing a memory area of an IC module, reader / writer encryption function control step for performing encryption control of communication data with the IC module, and network communication control for connecting to the virtual memory module via a network Consists of steps,
Accessing and extracting the virtual memory module when data used on the IC module is not on the IC module;
A method for controlling access to an IC module, comprising: The IC module stores an ID linked to data on the virtual memory module.
The method for controlling access to an IC module according to claim 15, wherein: An upper limit is set for the file structure of the memory area of the IC module, and the file structure is connected to the file structure of the virtual memory module.
The method for controlling access to an IC module according to claim 15, wherein:

Images