JP2004127053A - Data management system, reader/writer device, and virtual memory device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve the data access speed in the extension of a memory area attached to an IC module by use of a virtual memory module connected via a network or the like. <P>SOLUTION: When the virtual memory module operated as server type is used, a cache of access is accumulated in an existing IC module. A cache control part is provided in a reader/writer or the virtual memory module, and data are cached for transaction in a data accumulation part in the IC module, whereby a high-speed transaction can be realized. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an IC module having a memory function for holding data, a data management system for accessing the IC module, a reader / writer device, and a virtual memory device, and in particular, to expanding a memory area associated with the IC module. The present invention relates to a data management system, a reader / writer device, and a virtual memory device.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, various devices using a personal identification number and a password for personal identification and authentication processing have been devised and put to practical use. For example, when using a cash card or credit card at a bank or other financial institution, the user is required to enter a personal identification number or password as a means of personal identification on a cash dispenser or other financial terminal. To confirm that the user has input a correct password or password, and then perform a deposit / withdrawal operation.
[0003]
In a storage medium such as a magnetic stripe provided on one cash card, only a storage area usable only for the bank is provided. Therefore, the input of the personal identification number or the password as described above is merely an access to the single storage area, so that protection against forgery and plagiarism cannot be said to be sufficient.
[0004]
Therefore, from the viewpoint of preventing forgery and the like, a contact-type IC card having electrical contacts to a cash card, a credit card, or the like, a non-contact IC card that reads and writes data without contact via wireless data, and the like. (Hereinafter, also referred to as an “IC module”) in which the IC function is mounted has come to be used frequently. For example, an IC card reader / writer installed at a cash dispenser, an entrance of a concert hall, a ticket gate of a station, or the like can access an IC card held by a user without contact.
[0005]
The user enters the personal identification number into the IC card reader and checks the entered personal identification number with the personal identification number stored on the IC card, thereby confirming the identity between the IC card and the IC card reader / writer. Alternatively, an authentication process is performed. Then, when the identity verification or the authentication process is successful, for example, the application stored in the IC card can be used. Here, as an application held by the IC card, for example, value information such as electronic money or an electronic ticket can be cited. (The personal identification number used when accessing the IC card is particularly called a PIN (Personal Identification Number).)
[0006]
FIG. 10 schematically shows a system configuration example (prior art) using an IC module. As shown in FIG. 1, the system includes an IC module which is carried by a user and holds predetermined data in a secure state, and a reader / writer which accesses a memory space of the IC module and reads and writes data. Be composed.
[0007]
The IC module is packaged in, for example, a card type, and includes a data storage unit, a card communication control unit that performs a communication operation with a reader / writer, and a card encryption unit that performs encryption control of communication data with the reader / writer. It has a control unit.
[0008]
The reader / writer includes a reader / writer communication control unit that performs a communication operation with the IC module, and a reader / writer encryption control unit that performs encryption control of communication data with the IC module.
[0009]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units of the IC module and the reader / writer.
[0010]
A command is issued from the reader / writer communication control unit, and the IC module receives the command in the card communication control unit, performs processing such as decryption of the code in the card encryption processing unit, and stores the data in the data storage unit. Access to the data that you have. Further, the IC module generates a response in the card encryption processing unit and returns the response to the reader / writer. The transaction is completed by continuously performing such a sequence.
[0011]
Recently, along with the improvement of the miniaturization technology, an IC module having a relatively large-capacity data storage unit has appeared and spread. Since a conventional cash card or the like carries only a single storage area, that is, a single application, it is necessary to carry a plurality of IC cards corresponding to each application or purpose. On the other hand, according to such an IC module with a large-capacity memory, a plurality of applications can be stored simultaneously, so that one IC card can be used for a plurality of purposes. For example, two or more applications such as electronic money for electronic payment, a ticket, and an electronic ticket for entering a specific concert hall are stored on one IC card, and one IC card is stored. The card can be applied to various uses.
[0012]
However, IC modules are developed for the purpose of carrying data safely. Generally, IC modules are configured in the form of a card or chipped and used in small devices such as mobile phones and PDAs. It is a target. That is, it is often restricted by hardware, and although the capacity is increased, the memory size of the data storage unit has an upper limit.
[0013]
For example, a method of installing a virtual memory module outside the IC module (for example, on a network) for the purpose of virtually expanding the memory area of the data storage unit on the IC module side which is restricted in hardware, The present inventors have devised.
[0014]
The virtual memory module itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit is configured using a large-capacity storage device such as a hard disk device, and operates as a virtual storage space of the data storage unit of the IC module. The substance of the virtual memory module is, for example, a server machine built on a broadband network.
[0015]
In such a case, by performing a virtual transaction on the virtual memory module, the memory area in the IC module having hardware restrictions is virtually expanded, and the maximum memory capacity of the IC module is effectively reduced. It can be unlimited.
[0016]
However, when data is stored in a virtual memory module connected via a network, there is a possibility that the response time may be considerably increased depending on the bandwidth of the network. For example, in an application for converting a ticket into an electronic ticket, since an immediate response is expected, it is difficult to apply the virtual memory module as it is.
[0017]
[Problems to be solved by the invention]
An object of the present invention is to provide an excellent data management system, a reader / writer device, and a virtual memory device that can expand a memory area associated with an IC module.
[0018]
A further object of the present invention is to provide an excellent data management system, reader / writer device, which can expand a memory area attached to an IC module by using a virtual memory module connected via a network or the like. Another object of the present invention is to provide a virtual memory device.
[0019]
A further object of the present invention is to provide an improved memory access speed when a memory area associated with an IC module is expanded by using a virtual memory module connected via a network or the like. An object of the present invention is to provide a data management system, a reader / writer device, and a virtual memory device.
[0020]
Means and Action for Solving the Problems
The present invention has been made in consideration of the above problems, and is a data management system for expanding a memory area attached to an IC module,
A virtual memory module including a data storage unit for storing data used by a user of the IC module and a card encryption control unit for performing encryption control of communication data;
A reader / writer communication controller for accessing a memory area of the IC module, a reader / writer encryption controller for performing encryption control of communication data with the IC module, and a network communication controller for connecting to the virtual memory module via a network And a reader / writer comprising a cache writing unit for writing data used at a predetermined frequency or more on the IC module on the IC module.
[0021]
However, the term “system” as used herein refers to a logical collection of a plurality of devices (or functional modules that realize specific functions), and each device or functional module is in a single housing. It does not matter in particular.
[0022]
The purpose of the virtual memory module is to virtually expand the memory area of the data storage unit on the IC module side, which is limited in hardware. The virtual memory module itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit of the IC module, and makes its maximum memory capacity virtually unlimited. be able to. The substance of the virtual memory module is, for example, a server machine built on a broadband network.
[0023]
When transmitting an ID or the like in communication between the IC module and the reader / writer, encrypted communication based on an existing sequence in IC module communication is performed. Further, the reader / writer accesses the virtual memory module instead of the IC module, and accesses the corresponding data. Access to the virtual memory module performs encrypted communication based on an existing sequence in network communication such as TCP / IP protocol.
[0024]
Also, according to the data management system of the present invention, when using a virtual memory module operated as a server type, by storing an access cache in an existing IC module, the cached desired It is possible to speed up access to data.
[0025]
Here, the reader / writer may request the virtual memory module to reflect the cache in response to rewriting the data cached on the IC module. In addition, the virtual memory module may further include a cache reflection unit that rewrites corresponding data in the data storage unit in response to a cache reflection request.
[0026]
In such a case, when the reader / writer confirms that the data in the IC module has been updated, the reader / writer subsequently starts accessing the virtual memory module and reports the updated state in the IC module to the virtual memory module. -The consistency of cache data can be ensured by reflecting the same data in the module.
[0027]
Further, at least one of the reader / writer, the virtual memory module, and the IC module may include a cache selection user interface for a user to specify data to be cached. In such a case, the cache writing unit may write the data selected via the cache selection user interface from the virtual memory module to the IC module.
[0028]
The user of the IC module can select frequently used value information, such as specific electronic money or electronic ticket, and carry it on the IC module. Therefore, by caching frequently used data in a user-driven manner, desired data can be used without connecting to the virtual memory module, thereby realizing a high-speed transaction.
[0029]
A server-side reader / writer module connected to the reader / writer via a network; and a cache writing unit for writing data used at a predetermined frequency or more on the IC module on the IC module. The server-side reader / writer module may be provided with a reader / writer encryption processing unit that performs encryption control of communication data with the IC module.
[0030]
In such a case, the reader / writer receives the response received from the IC module, transfers the encrypted response data as it is to the server-side reader / writer module via a network, and transmits the encrypted response data to the server-side reader / writer. -Response data can be processed by the module.
[0031]
The server-side reader / writer module is, for example, a server machine provided on a broadband network and having a function of accessing a virtual memory module. When the server-side reader / writer module obtains data carried by the IC module, the reader / writer module reads the data if the data entity stored in the data storage unit of the IC module is cached in the IC module. By accessing the IC module via the / writer, the IC module can be retrieved from the data storage unit. On the other hand, when the data entity stored in the data storage unit of the IC module is not cached in the IC module, accessing the virtual memory module via the network and extracting it from the data storage unit Can be. After the ID communication is performed with the IC module, the access to the actual data entity to the virtual memory module is a communication operation between high-performance servers connected by a broadband network, so that a transaction is performed. Time is completed in a very short time.
[0032]
Further objects, features, and advantages of the present invention will become apparent from more detailed descriptions based on embodiments of the present invention described below and the accompanying drawings.
[0033]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0034]
The present invention provides a method of installing a virtual memory module outside an IC module (for example, on a network) for the purpose of virtually expanding a memory area of a data storage unit on an IC module side that has hardware restrictions. Is adopted.
[0035]
The virtual memory module itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit is configured using a large-capacity storage device such as a hard disk device, and operates as a virtual storage space of the data storage unit of the IC module. The substance of the virtual memory module is, for example, a server machine built on a broadband network. Therefore, by performing a virtual transaction on the virtual memory module, the memory area in the IC module having hardware restrictions is virtually expanded, and the maximum memory capacity of the IC module is virtually unlimited. It can be.
[0036]
Further, according to the present invention, when using a virtual memory module operated as a server type, by storing a cache of data in an existing IC module, access to cached desired data is prevented. It is possible to increase the speed.
[0037]
First embodiment:
FIG. 1 schematically shows a basic configuration of a data management system according to an embodiment of the present invention. As shown in FIG. 1, the data management system includes an IC module 100 that is carried by a user and holds predetermined data (such as value information) in a secure state, and a data space that is accessed by accessing a memory space of the IC module 100. And a virtual memory module 300 connected to the reader / writer 200 via a network.
[0038]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0039]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit. In the present embodiment, the data storage unit 101 is used as a cache and serves as a temporary storage location for frequently accessed data (such as value information).
[0040]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100, a reader / writer encryption control unit 202 that performs encryption control of communication data with the IC module, and a TCP / A network communication control unit 203 that realizes data communication via a network such as an IP, and a cache writing unit 204 that writes data to be cached in the data storage unit 101 of the IC module 100 are provided. The entity of the reader / writer 200 is, for example, a server machine provided on a broadband network and provided with a function of accessing the IC module 100.
[0041]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network.
[0042]
Of course, the connection form between the IC module 100 and the reader / writer 200 is not limited to the non-contact connection, and the connection is realized by inserting the IC module 100 into the card slot on the reader / writer 200 side. Is also good.
[0043]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And an operation for reflecting the updated state of the cache data in the data storage unit 101 of the IC module 100 on the same data in the data storage unit 301. A cache reflection unit 304 is provided.
[0044]
For example, a network connection based on a predetermined communication protocol such as TCP / IP is made between the network communication control units 302 and 201 of the virtual memory module 300 and the reader / writer 200.
[0045]
The purpose of the virtual memory module 300 is to virtually expand a memory area for holding data (value information such as electronic money and an electronic ticket) by the IC module 100 having hardware restrictions. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 303 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the terminal 100 as an IC module, and has the maximum memory capacity. Can be virtually unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0046]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0047]
When the reader / writer 200 performs communication with the IC module 100, if the data entity stored in the data storage unit 101 of the IC module 100 is not cached in the IC module 100, the reader / writer 200 The virtual memory module 300 can be accessed and retrieved from the data storage unit 301.
[0048]
One virtual memory module may be arranged for each IC module, but the virtual memory module may be configured to provide a virtual storage space to a plurality of IC modules at the same time. Of course, one IC module may have a virtual storage space in a plurality of virtual memory modules.
[0049]
When the data storage unit 101 in the IC module 100 is used as a cache, the cache writing unit 204 of the reader / writer 200 checks the memory space in the IC module 100 and has a margin for caching data. If there is, acquire its ID. Then, of the data to be cached, data corresponding to the ID is obtained from the virtual memory module, and the data is stored in the data storage unit 101 in the IC module 100.
[0050]
Here, a cache selection user interface (not shown) for the user to specify data to be cached may be provided. The user can select frequently used value information, such as specific electronic money or electronic ticket, and carry it on the IC module 100. In such a case, by caching frequently used data by driving the user, desired data can be used without connecting to the virtual memory module 300, so that a high-speed transaction is realized. The layout of such a cache selection user interface is not particularly limited. For example, the cache selection user interface may be mounted on any of the IC module 100, the reader / writer 200, and the virtual memory module 300.
[0051]
FIG. 2 is a flowchart illustrating a processing procedure for the reader / writer 200 to realize a high-speed transaction using data cached on the IC module 100.
[0052]
When the IC module 100 is held over the reader / writer 200, the card communication control unit 102 is activated, and a non-contact connection based on an electromagnetic induction action is established (step S1). The IC module 100 generates a response in the card encryption control unit 103 and returns the response to the reader / writer 200.
[0053]
Thereafter, the mutual authentication and response procedures are performed at least once between the IC module 100 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized (step S2), and secure data communication using encryption is enabled. Become.
[0054]
When using the data storage unit 101 in the IC module 100 as a cache, the cache writing unit 204 of the reader / writer 200 checks the memory space in the IC module 100 (Step S3).
[0055]
If the cache already exists in the data storage unit 101 in the IC module 100, a direct write operation is performed on the cache (step S4). Therefore, data can be updated without connecting to the virtual memory module 300 on the network, so that the transaction can be speeded up.
[0056]
When the data cached in the IC module 100 is updated in this manner, subsequently, in order to secure the consistency of the cache data, the cache A reflection request is issued (step S5), and the updated state in the IC module 100 is transmitted to the cache reflection unit 304 as cache information (step S6).
[0057]
When using the data cached in this way, the user holds his / her IC module 100 over the reader / writer 200 to perform a non-contact connection. Then, the reader / writer 200 checks whether or not data exists in the IC module 100, and confirms that the data exists in the data storage unit 101, executes a transaction, and executes a transaction in the data storage unit 101. Update data.
[0058]
Further, when the reader / writer 200 confirms that the data in the IC module 100 has been updated, the reader / writer 200 subsequently starts accessing the virtual memory module 300 to display the updated state in the IC module 100 as a virtual state. The consistency of the cache data is ensured by reflecting the same data in the memory module 300.
[0059]
FIG. 3 shows, in the form of a flowchart, a processing procedure for reflecting an updated state in the IC module 100 to the same data on the virtual memory module 300 side.
[0060]
When a cache reflection request is received from the cache writing unit 204 of the reader / writer 200 (step S11), subsequently, a status updated in the IC module 100 is received as cache information (step S12).
[0061]
Then, the cache reflection unit 304 checks whether or not the changed state of the cache on the IC module 100 side has already been reflected on the same data stored in the data storage unit 301 in the virtual memory module 300 (step). S13).
[0062]
Here, if the same data stored in the data storage unit 301 has not yet reflected the updated state of the cache, the cache reflection unit 304 performs a cache reflection operation on the data storage unit 301 (step S14).
[0063]
Such a cache reflection operation is performed independently of a process in which the user holds the IC module 100 over the reader / writer 200 to use the cache data, and thus does not impair the speeding up of the transaction.
[0064]
FIGS. 4 and 5 show operations performed between the IC module 100, the reader / writer 200, and the virtual memory module 300 for causing the data storage unit 101 of the IC module 100 to cache data and realize a high-speed transaction. 4 shows a sequence. FIG. 4 shows the cache accumulation sequence, and FIG. 5 shows the cache reflection sequence.
[0065]
In the cache accumulation sequence, the communication control unit 201 of the reader / writer 200 constantly polls the IC module 100. When the IC module 100 is sufficiently close to the reader / writer 200, the card communication control unit 102 is activated. The connection by the electromagnetic induction operation becomes possible, and the IC module 100 generates a response in the card encryption control unit 103 and returns the response to the reader / writer 200.
[0066]
Thereafter, the mutual authentication and response procedures are performed once or more between the IC module 100 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible.
[0067]
The reader / writer 200 further reads the ID stored in the data storage unit 101 in the IC module 100 (ReadID) to obtain link information to the file structure of the data storage unit 301 of the virtual memory module 300. Can be.
[0068]
The data storage unit 101 has a predetermined file structure, and the upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0069]
When the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the reader / writer 200 accesses the virtual memory module 300 via a network to store the data. This can be taken out of the unit 301.
[0070]
That is, the reader / writer 200 uses the ID obtained from the IC module 100 to perform polling of the virtual memory module 300 via the network.
[0071]
On the other hand, the virtual memory module 300 generates a response in the card encryption control unit 303 and returns the response to the reader / writer 200. As a result of performing the mutual authentication and response procedure at least once, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible.
[0072]
Thereafter, the procedure of mutual authentication and response is performed at least once between the virtual memory module 300 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible. The reader / writer 200 can repeat the procedure of Write access and its response with the virtual memory module 300 an arbitrary number of times in order to acquire a desired data entity.
[0073]
After that, the IC module 100 is brought close enough to the reader / writer 200. The communication control unit 201 of the reader / writer 200 constantly polls the IC module 100, the card communication control unit 102 is activated to enable connection by electromagnetic induction, and the IC module 100 transmits a response to the card encryption control unit 103. And responds to the reader / writer 200.
[0074]
Next, the mutual authentication and response procedures are performed one or more times between the IC module 100 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible. Then, the cache writing unit 204 performs an operation of writing desired data to the data storage unit 101.
[0075]
On the other hand, in the cache reflection sequence, first, the user selects data to be cached via the cache selection user interface on the reader / writer 200. However, the arrangement of the cache selection user interface is arbitrary, and may be arranged not in the reader / writer 200 but in the IC module 100 or the virtual memory module 300.
[0076]
The communication control unit 201 of the reader / writer 200 constantly polls the IC module 100.
[0077]
When the IC module 100 is sufficiently close to the reader / writer 200, the card communication control unit 102 is activated to enable connection by electromagnetic induction, and the IC module 100 generates a response in the card encryption control unit 103, / Reply to writer 200.
[0078]
Thereafter, the mutual authentication and response procedures are performed once or more between the IC module 100 and the reader / writer 200, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible.
[0079]
Then, the cache writing unit 204 checks the memory space in the IC module 100, and if the cache already exists in the data storage unit 101 in the IC module 100, performs a write operation directly on the cache.
[0080]
The reader / writer 200 further reads the ID stored in the data storage unit 101 in the IC module 100 (ReadID), and reads the ID that is link information to the file structure of the data storage unit 301 of the virtual memory module 300. Get.
[0081]
Next, the reader / writer 200 performs polling of the virtual memory module 300 via the network using the ID obtained from the IC module 100.
[0082]
In response to this polling, the virtual memory module 300 generates a response in the card encryption control unit 303 and returns it to the reader / writer 200. As a result of performing the mutual authentication and response procedure at least once, mutual authentication and sharing of the encryption key are realized, and secure data communication using encryption becomes possible.
[0083]
Then, the cache writing unit 204 in the reader / writer 200 issues a cache reflection request to the cache reflection unit 304 of the virtual memory module 300 to secure the consistency of the cache data, and The status updated in the IC module 100 is transmitted to the cache reflection unit 304.
[0084]
The cache reflection unit 304 checks whether the changed state of the cache in the IC module 100 has already been reflected in the same data stored in the data storage unit 301 in the virtual memory module 300. Here, if the same data stored in the data storage unit 301 has not yet reflected the updated state of the cache, the cache reflection unit 304 performs a cache reflection operation on the data storage unit 301.
[0085]
As described above, according to the present embodiment, when using a virtual memory module operated as a server type, by accumulating an access cache in an existing IC module, access to cached data can be performed at high speed. It is possible to make.
[0086]
FIG. 6 schematically shows an image in which the IC module 100 is used as a temporary storage location of data frequently used by a user, that is, a cache.
[0087]
In the example shown in the figure, data A, data B, and data C such as value information belonging to a user of the IC module 100 are stored in a virtual memory module 300 which is a server on a network. When the user frequently uses the data B, the data B is written to the IC module 100 via the reader / writer 200.
[0088]
Thereafter, when the connection between the reader / writer 200 and the IC module 100 is established and the data B is used, a high-speed transaction is realized by directly performing a read / write operation on the IC module 100. Thereafter, the communication state of the cache is written by the reader / writer 200 to the same data on the virtual memory module 300 via the network, and the coherency of the cache is maintained.
[0089]
Of course, the frequency of use of each data by the user may change over time. For example, if the data C is used more frequently than the data B after a certain point in time, the data B is swapped out of the IC module 100 according to a user selection or automatically. , Data C may be swapped into the IC module 100.
[0090]
Second embodiment:
FIG. 7 schematically shows a modification of the data management system shown in FIG. In the embodiment shown in FIG. 1, the reader / writer 200 having an IC module access function also has a network connection function, and the reader / writer 200 also performs an access operation to the virtual memory module 300 at the same time. It is configured. On the other hand, in the embodiment shown in FIG. 7, the reader / writer 200 does not have a network connection function, and accesses the data carried by the IC module 100 under the management of the server 400 on the network. The server 400 accesses the virtual memory module 300 via a network.
[0091]
As shown in FIG. 7, the data management system includes an IC module 100 that is carried by a user and holds predetermined data (eg, value information) in a secure state, and a data space that is accessed by accessing a memory space of the IC module 100. A reader / writer 200 that performs read / write operations of a memory, a virtual memory module 300 connected via a network, and a communication function with the reader / writer 200 are provided, and the memory space of the virtual memory module 300 is accessed to access data. And a server-side reader / writer module 400 that performs a read / write operation of.
[0092]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0093]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit. In the present embodiment, the data storage unit 101 is used as a cache and serves as a temporary storage location for frequently accessed data (such as value information).
[0094]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100, and a network communication control unit 203 that performs a data transmission operation via a network.
[0095]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network. Of course, the connection form between the IC module 100 and the reader / writer 200 is not limited to the non-contact connection, and the connection is realized by inserting the IC module 100 into the card slot on the reader / writer 200 side. Is also good.
[0096]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And an operation for reflecting the updated state of the cache data in the data storage unit 101 of the IC module 100 on the same data in the data storage unit 301. A cache reflection unit 304 is provided.
[0097]
The purpose of the virtual memory module 300 is to virtually expand the memory area of the data storage unit 101 on the IC module 100 side, which is limited in hardware. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 301 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the IC module 100, and effectively reduces its maximum memory capacity. It can be unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0098]
The server-side reader / writer module 400 includes a reader / writer encryption control unit 401 that performs an encryption communication operation with the reader / writer, and a network communication control unit that realizes data communication via a network such as TCP / IP. 402, and a cache writing unit 403 for writing data to be cached in the data storage unit 101 of the IC module 100. The entity of the reader / writer 200 is, for example, a server machine provided on a broadband network and provided with a function of accessing the virtual memory module 300.
[0099]
For example, a network connection based on a predetermined communication protocol such as TCP / IP is performed between the network communication control units 302 and 402 of the virtual memory module 300 and the server-side reader / writer module 400.
[0100]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0101]
When the server-side reader / writer module 400 acquires data carried by the IC module 100, the data entity stored in the data storage unit 101 of the IC module 100 is cached in the IC module 100. In this case, it is possible to access the IC module 100 via the reader / writer 200 and take it out from the data storage unit 101. On the other hand, if the data entity stored in the data storage unit 101 of the IC module 100 is not cached in the IC module 100, the virtual memory module 300 is accessed via the network and the data storage unit 301 is accessed. You can take this out of
[0102]
When the data storage unit 101 in the IC module 100 is used as a cache, the cache writing unit 403 of the server-side reader / writer module 400 checks the memory space in the IC module 100 and caches data. If there is enough time to do so, the ID is acquired. Then, of the data to be cached, data corresponding to the ID is obtained from the virtual memory module, and the data is stored in the data storage unit 101 in the IC module 100.
[0103]
Here, a cache selection user interface (not shown) for the user to specify data to be cached may be provided. The user can select frequently used value information, such as specific electronic money or electronic ticket, and carry it on the IC module 100. In such a case, frequently used data is cached by the user and can be used without being connected to the virtual memory module 300, so that a high-speed transaction is realized. The layout of such a cache selection user interface is not particularly limited. For example, the cache selection user interface may be mounted on any of the IC module 100, the reader / writer 200, the virtual memory module 300, and the server-side reader / writer module 400.
[0104]
On the other hand, when using the data cached in this way, the user holds his / her IC module 100 over the reader / writer 200 to perform a non-contact connection. At this time, the server-side reader / writer module 400 checks via the reader / writer 200 whether or not data exists in the IC module 100, and confirms that the data exists in the data storage unit 101. To update the data in the data storage unit 101.
[0105]
Further, upon confirming that the data in the IC module 100 has been updated, the server-side reader / writer module 400 subsequently starts accessing the virtual memory module 300 and updates the data in the IC module 100. The state is reflected on the same data in the virtual memory module 300 to ensure the consistency of the cache data.
[0106]
Third embodiment:
FIG. 8 schematically shows another modification of the data management system shown in FIG.
[0107]
As described above, according to each embodiment of the present invention, when a virtual memory module operated as a server type is used, an access cache is stored in an existing IC module, so that the cache is cached. It is possible to speed up access to the data.
[0108]
In the embodiment shown in FIG. 8, a cache selection user interface 205 for a user to specify data to be cached is provided in the reader / writer 200. Therefore, the user can select frequently used value information such as specific electronic money or electronic ticket and carry it on the IC module 100 in advance. In such a case, frequently used data is cached by the user and can be used without being connected to the virtual memory module 300, so that a high-speed transaction is realized.
[0109]
As shown in FIG. 8, the data management system includes an IC module 100 that is carried by a user and holds predetermined data (such as value information) in a secure state, and a data space that is accessed by accessing a memory space of the IC module 100. And a virtual memory module 300 connected to the reader / writer 200 via a network.
[0110]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0111]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit. In the present embodiment, the data storage unit 101 is used as a cache and serves as a temporary storage location for frequently accessed data (such as value information).
[0112]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100, a reader / writer encryption control unit 202 that performs encryption control of communication data with the IC module, and a TCP / A network communication control unit 203 for realizing data communication via a network such as an IP; a cache writing unit 204 for writing data to be cached in the data storage unit 101 of the IC module 100; A cache selection user interface 205 for the user to specify is provided. The entity of the reader / writer 200 is, for example, a server machine provided on a broadband network and provided with a function of accessing the IC module 100.
[0113]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network.
[0114]
Of course, the connection form between the IC module 100 and the reader / writer 200 is not limited to the non-contact connection, and the connection is realized by inserting the IC module 100 into the card slot on the reader / writer 200 side. Is also good.
[0115]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And an operation for reflecting the updated state of the cache data in the data storage unit 101 of the IC module 100 on the same data in the data storage unit 301. A cache reflection unit 304 is provided.
[0116]
For example, a network connection based on a predetermined communication protocol such as TCP / IP is made between the network communication control units 302 and 201 of the virtual memory module 300 and the reader / writer 200.
[0117]
The purpose of the virtual memory module 300 is to virtually expand a memory area for holding data (value information such as electronic money and an electronic ticket) by the IC module 100 having hardware restrictions. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 301 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the IC module 100, and effectively reduces its maximum memory capacity. It can be unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0118]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0119]
When performing communication with the IC module 100, if the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the reader / writer 200 The module 300 can be accessed and retrieved from the data storage unit 301.
[0120]
One virtual memory module may be arranged for each IC module, but the virtual memory module may be configured to provide a virtual storage space to a plurality of IC modules at the same time. Of course, one IC module may have a virtual storage space in a plurality of virtual memory modules.
[0121]
When the data storage unit 101 in the IC module 100 is used as a cache, first, the user selects data to be cached via the cache selection user interface 205 on the reader / writer 200. Then, the cache writing unit 204 of the reader / writer 200 checks the memory space in the IC module 100, and if there is room to cache the data selected by the user, acquires the ID. Then, of the data to be cached, data corresponding to the ID is obtained from the virtual memory module, and the data is stored in the data storage unit 101 in the IC module 100.
[0122]
The user can select frequently used value information, such as specific electronic money or electronic ticket, and carry it on the IC module 100. In such a case, frequently used data is cached by the user and can be used without being connected to the virtual memory module 300, so that a high-speed transaction is realized.
[0123]
On the other hand, when using the cached data, the user holds his / her IC module 100 over the reader / writer 200 to perform a non-contact connection. Then, the reader / writer 200 checks whether or not data exists in the IC module 100, and confirms that the data exists in the data storage unit 101, executes a transaction, and executes a transaction in the data storage unit 101. Update data.
[0124]
Further, when the reader / writer 200 confirms that the data in the IC module 100 has been updated, the reader / writer 200 subsequently starts accessing the virtual memory module 300 to display the updated state in the IC module 100 as a virtual state. The consistency of the cache data is ensured by reflecting the same data in the memory module 300.
[0125]
Fourth embodiment:
FIG. 9 schematically shows another modification of the data management system shown in FIG. In the embodiment shown in FIG. 8, the cache selection user interface is mounted on the reader / writer 200, whereas in the embodiment shown in FIG. 9, it is provided on the virtual memory module 300.
[0126]
As shown in FIG. 9, this data management system includes an IC module 100 that is carried by a user and holds predetermined data (eg, value information) in a secure state, The reader / writer 200 that performs the read / write operation of the above is composed of a virtual memory module 300 connected via a network.
[0127]
The IC module 100 includes a data storage unit 101, a card communication control unit 102 that performs a communication operation with the reader / writer 200, and a card encryption control unit 103 that performs encryption control of communication data with the reader / writer 200. ing.
[0128]
The IC module 100 is configured in a card shape, for example, or formed into a chip and is built in a small device such as a mobile phone or a PDA. The data storage unit 101 is a semiconductor memory, and its storage capacity has an upper limit. In the present embodiment, the data storage unit 101 is used as a cache and serves as a temporary storage location for frequently accessed data (such as value information).
[0129]
The reader / writer 200 includes a reader / writer communication control unit 201 that performs a communication operation with the IC module 100, a reader / writer encryption control unit 202 that performs encryption control of communication data with the IC module, and a TCP / A network communication control unit 203 that realizes data communication via a network such as an IP, and a cache writing unit 204 that writes data to be cached in the data storage unit 101 of the IC module 100 are provided. The entity of the reader / writer 200 is, for example, a server machine provided on a broadband network and provided with a function of accessing the IC module 100.
[0130]
For example, non-contact connection based on the principle of electromagnetic induction is performed between the communication control units 102 and 201 of the IC module 100 and the reader / writer 200. The card communication control unit 103 changes the load between its own antennas (not shown) according to the response signal to the interrogation signal from the reader / writer 200, thereby performing amplitude modulation on the signal appearing in the receiving circuit of the reader / writer 200. Communication is performed over the network.
[0131]
Of course, the connection form between the IC module 100 and the reader / writer 200 is not limited to the non-contact connection, and the connection is realized by inserting the IC module 100 into the card slot on the reader / writer 200 side. Is also good.
[0132]
The virtual memory module 300 includes a data storage unit 301 that provides a virtual memory space for an IC module, a network communication control unit 302 that performs a communication operation with the reader / writer 200, a reader / writer 200, And an operation for reflecting the updated state of the cache data in the data storage unit 101 of the IC module 100 on the same data in the data storage unit 301. A cache reflection unit 304 and a cache selection user interface 305 for a user to specify data to be cached are provided.
[0133]
For example, a network connection based on a predetermined communication protocol such as TCP / IP is made between the network communication control units 302 and 201 of the virtual memory module 300 and the reader / writer 200.
[0134]
The purpose of the virtual memory module 300 is to virtually expand a memory area for holding data (value information such as electronic money and an electronic ticket) by the IC module 100 having hardware restrictions. The virtual memory module 300 itself is not used by the user and is not restricted by hardware such as a card shape. Therefore, the data storage unit 301 is configured using a large-capacity storage device such as a hard disk device, operates as a virtual storage space of the data storage unit 101 of the IC module 100, and effectively reduces its maximum memory capacity. It can be unlimited. The entity of the virtual memory module 300 is, for example, a server machine built on a broadband network.
[0135]
An ID for identifying the data space of the module is stored in the data storage unit 101 of the IC module 100, and a link to the data of the data storage unit of the virtual memory module 300 is formed based on the ID. . In the data storage unit 101, a predetermined file structure is configured, and an upper limit value is set. The upper limit of the data storage unit 101 is connected to the file structure of the data storage unit 301 on the virtual memory module 300 side.
[0136]
When performing communication with the IC module 100, if the data entity stored in the data storage unit 101 of the IC module 100 does not exist in the IC module 100, the reader / writer 200 The module 300 can be accessed and retrieved from the data storage unit 301.
[0137]
One virtual memory module may be arranged for each IC module, but the virtual memory module may be configured to provide a virtual storage space to a plurality of IC modules at the same time. Of course, one IC module may have a virtual storage space in a plurality of virtual memory modules.
[0138]
When the data storage unit 101 in the IC module 100 is used as a cache, the user first selects data to be cached via the cache selection user interface 205 on the virtual memory module 300. Then, the cache writing unit 204 of the reader / writer 200 checks the memory space in the IC module 100, and if there is room to cache the data selected by the user, acquires the ID. Then, of the data to be cached, data corresponding to the ID is obtained from the virtual memory module, and the data is stored in the data storage unit 101 in the IC module 100.
[0139]
The user can select frequently used value information, such as specific electronic money or electronic ticket, and carry it on the IC module 100. In such a case, frequently used data is cached by the user and can be used without being connected to the virtual memory module 300, so that a high-speed transaction is realized.
[0140]
On the other hand, when using the cached data, the user holds his / her IC module 100 over the reader / writer 200 to perform a non-contact connection. Then, the reader / writer 200 checks whether or not data exists in the IC module 100, and confirms that the data exists in the data storage unit 101, executes a transaction, and executes a transaction in the data storage unit 101. Update data.
[0141]
Further, when the reader / writer 200 confirms that the data in the IC module 100 has been updated, the reader / writer 200 subsequently starts accessing the virtual memory module 300 to display the updated state in the IC module 100 as a virtual state. The consistency of the cache data is ensured by reflecting the same data in the memory module 300.
[0142]
[Supplement]
The present invention has been described in detail with reference to the specific embodiments. However, it is obvious that those skilled in the art can modify or substitute the embodiment without departing from the scope of the present invention. That is, the present invention has been disclosed by way of example, and the contents described in this specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims described at the beginning should be considered.
[0143]
【The invention's effect】
As described above in detail, according to the present invention, an excellent data management system capable of expanding a memory area associated with an IC module using a virtual memory module connected via a network or the like. , A reader / writer device, and a virtual memory device.
[0144]
Further, according to the present invention, it is possible to improve a data access speed when a memory area attached to an IC module is expanded using a virtual memory module connected via a network or the like. A data management system, a reader / writer device, and a virtual memory device.
[0145]
According to the present invention, a high-speed transaction can be realized by providing a cache control unit in a reader / writer or a virtual memory module and causing a data storage unit in the IC module to cache data for a transaction. Further, it is also possible to make the data to be cached exchangeable so that the user can select the data to be cached.
[Brief description of the drawings]
FIG. 1 is a diagram schematically showing a basic configuration of a data management system according to an embodiment of the present invention.
FIG. 2 is a flowchart showing a processing procedure for a reader / writer 200 to realize a high-speed transaction using data cached on an IC module 100.
FIG. 3 is a flowchart showing a processing procedure for reflecting a state updated in the IC module 100 to the same data on the virtual memory module 300 side.
FIG. 4 shows an operation sequence executed among the IC module 100, the reader / writer 200, and the virtual memory module 300 for realizing a high-speed transaction by caching data in the data storage unit 101 of the IC module 100. FIG.
5 shows an operation sequence executed between the IC module 100, the reader / writer 200, and the virtual memory module 300 for realizing a high-speed transaction by caching data in the data storage unit 101 of the IC module 100. FIG. FIG.
FIG. 6 is a diagram schematically illustrating an image in which the IC module 100 is used as a cache of data frequently used by a user.
FIG. 7 is a diagram schematically showing a modification of the data management system shown in FIG. 1;
FIG. 8 is a diagram schematically showing a modification of the data management system shown in FIG. 1;
FIG. 9 is a diagram schematically showing a modified example of the data management system shown in FIG. 8;
FIG. 10 is a diagram schematically illustrating a system configuration example (prior art) using an IC module.
[Explanation of Signs] 100 IC Module
101: Data storage unit
102: Card communication control unit
103: Card encryption processing unit
200 ... Reader / writer
201: reader / writer communication control unit
202: Reader / writer encryption processing unit
203: Network communication control unit
204: cache writing unit
205: Cache selection user interface
300: virtual memory module
301: Data storage unit
302: Network communication control unit
303: Card encryption processing unit
304: Cache reflection unit
305: Cache selection user interface
400: Server-side reader / writer module
401 ... Reader / writer encryption control unit
402: Network communication control unit
403: Cache writing unit

Claims (9)

A data management system for expanding a memory area attached to an IC module,
A virtual memory module including a data storage unit for storing data used by a user of the IC module and a card encryption control unit for performing encryption control of communication data;
A reader / writer communication controller for accessing a memory area of the IC module, a reader / writer encryption controller for performing encryption control of communication data with the IC module, and a network communication controller for connecting to the virtual memory module via a network And a reader / writer comprising a cache writing unit for writing data used at a predetermined frequency or more on the IC module on the IC module. The reader / writer, in response to rewriting the data cached on the IC module, requests the virtual memory module to reflect the cache,
The virtual memory module further includes a cache reflection unit that rewrites corresponding data of the data storage unit in response to a cache reflection request,
The data management system according to claim 1, wherein: At least one of the reader / writer, the virtual memory module, or the IC module includes a cache selection user interface for a user to specify data to be cached,
The cache writing unit writes data selected via the cache selection user interface from the virtual memory module to the IC module.
The data management system according to claim 1, wherein: Place a server-side reader / writer module connected via a network,
A reader / writer encryption processing unit for performing encryption control of communication data with the IC module in the server-side reader / writer module; and a cache write for writing data used at a predetermined frequency or more on the IC module to the IC module. Department,
The reader / writer receives the response received from the IC module, transfers the encrypted response data as it is to the server-side reader / writer module via a network, and returns the response to the server-side reader / writer module. Processing data,
The data management system according to claim 1, wherein: A reader / writer device for accessing an IC module having an expanded memory area,
A reader / writer communication control unit for accessing a memory area of the IC module;
A reader / writer encryption control unit for performing encryption control of communication data with the IC module;
A network communication control unit connected to a virtual memory module for expanding a memory area of the IC module via a network;
A cache writing unit that writes data used at a predetermined frequency or more on the IC module on the IC module;
A reader / writer device comprising: In response to the cache writer rewriting the data cached on the IC module, requesting the virtual memory module to reflect the cache;
The reader / writer device according to claim 5, wherein: A cache selection user interface for a user to specify data to be cached,
The cache writing unit writes data selected via the cache selection user interface from the virtual memory module to the IC module.
The reader / writer device according to claim 5, wherein: A virtual memory device for expanding a memory area associated with an IC module,
A data storage unit for storing data used on the IC module;
A card encryption control unit for performing encryption control of communication data;
Cache reflection means for updating the content of the same data in the data storage unit in response to the update of the data used on the IC module;
A virtual memory device comprising: Further comprising a cache selection user interface for the user to specify data to be cached,
9. The virtual memory device according to claim 8, wherein:

Images