JP2004152210A - Ic card - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an IC card having high security to be used continually in an energization condition. <P>SOLUTION: The IC card 1 has a timer 15 capable of performing timer interrupt and performs counting operation of the timer 15 while processing commands. The number of operating times of a command 23 to be monitored is counted, the number of operating times of the command is compared with the number of the upper limit 24 during a term of period every time the timer interrupt occurs and, when the number of times is equal to or larger than the number of the upper limit, the frequency of history 21 is increased; when the frequency of history 21 is equal to or larger than the number of times 22 exceeding the upper limit, operation of the IC card is stopped. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an IC card incorporating a technology for improving security performance and preventing unauthorized use.
[0002]
[Prior art]
IC cards can be used in many fields because they can process information with a built-in microcomputer and memory, and have a higher security performance and a larger amount of stored information than magnetic cards that store information in a magnetic stripe. Have been.
[0003]
In order to improve convenience by storing personal information in an IC card and to expand the use of the IC card in electronic settlement, it is necessary to prevent unauthorized use of the IC card, and various proposals have been made. .
[0004]
For example, there is an IC card with improved security performance. The IC card shown includes means for counting the total number of commands to be executed after the power is turned on, and means for restricting the operation when the total number exceeds a possible number. When a specific command is repeatedly added to an IC card for the purpose of stealing information, the operation of the IC card is restricted so that the cheating cannot be achieved (see Patent Document 1).
[0005]
When such an IC card is continuously attached to a mobile phone or the like and used, even if the total number of commands that can be set is limited to, for example, 1000 for encryption, the cost of the mobile phone is reduced. In such an operation, the authentication work using the IC card is performed every time, so that the number of IC cards exceeds the possible number in a short time, and there is a problem that the IC card cannot be used.
[0006]
On the other hand, if a large value exceeding, for example, 10,000 is set as the possible number of the total number of commands, the command is repeatedly input to the IC card, and the power supply terminal of the card, the electromagnetic radiation, etc. are observed. By statistically processing data, a key and an encryption algorithm are analyzed, and there is a problem that the security performance of the IC card is reduced.
[0007]
[Patent Document 1]
JP-A-10-69435 (page 3, FIG. 1)
[0008]
[Problems to be solved by the invention]
As described above, in the conventional IC card, there is a problem that the security performance is deteriorated in the case of an application that is continuously used in a state of being energized.
[0009]
The present invention has been made to solve the above problem, and has as its object to provide an IC card with high security performance.
[0010]
[Means for Solving the Problems]
In order to achieve the above object, an IC card according to the present invention includes a timer, a unit for counting the number of times a specific command is executed, and a timer interrupt to a processor when a value of the timer becomes equal to a specific value. Means, a memory for storing the number of times of execution of the specific command, the upper limit number of times during the period, the number of histories, and the number of times exceeding the upper limit, and operation limiting means for limiting the execution operation of the command, the initial after power-on In the conversion procedure, when the number of times of history is compared with the number of times exceeding the upper limit, and when the number of times of history is equal to or greater than the number of times exceeding the upper limit, the operation restricting means restricts the execution of the command, and accepts the timer interrupt. In the processing procedure, the number of executions of the specific command is compared with the upper limit number in the period, and when the number of executions of the specific command is equal to or larger than the upper limit number in the period. Increasing the number of histories, comparing the increased number of histories with the number of times exceeding the upper limit, and when the number of histories is equal to or greater than the number of times exceeding the upper limit, restricts the execution of the command by the operation restricting means. It is characterized by doing so.
[0011]
According to the IC card of the present invention having such a configuration, a command is not issued unless initialization such as power-on is performed within a predetermined time or a command is issued after a predetermined time interval. Since it is no longer accepted, it is not possible to read out information on security in the IC card by repeatedly giving a command from outside in a short time, and an IC card with high security performance can be realized.
[0012]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to FIGS.
[0013]
FIG. 1 is a block diagram showing a configuration of a main part of the IC card of the present invention. FIG. 2 and FIG. 3 are flowcharts showing the processing procedure of the IC card.
[0014]
As shown in FIG. 1, an IC card 1 according to the present embodiment includes an interface / system control circuit unit 2 and a data processing unit 3.
[0015]
The interface / system control circuit unit 2 is connected to the IC card reader / writer 4 via terminals 5 to 10, and receives power, a clock, control signals, and the like from the IC card reader / writer 4, and A desired power supply and clock are supplied to each of the internal function blocks, and various control signals are generated. Further, it has an interface function of data transmission / reception with the IC card reader / writer 4 via the I / O terminal of the terminal 5.
[0016]
The terminal 6 is a reset (/ RST) terminal, and supplies an initialization signal to the interface / system control circuit unit 2 of the IC card 1 and each internal function block.
[0017]
The terminal 7 is a ground (GND) terminal and supplies a ground potential to each functional block of the IC card 1.
[0018]
The terminal 8 is a power supply (VDD) terminal and supplies power required for circuit operation of a data processing unit and the like inside the IC card 1. The terminal 9 is a program power supply (VPP) terminal, and supplies power used when writing data to the nonvolatile memory in the IC card 1. In some recent IC cards, a program power supply used for writing data to a nonvolatile memory inside the card is generated from a power supply (VDD) and there is a case where there is no program power supply terminal.
[0019]
A terminal 10 is a clock (CLK) terminal and supplies a clock signal necessary for circuit operation inside the IC card 1 to the interface / system control circuit unit 2 and each functional block.
[0020]
The main functional blocks of the data processing unit 3 include a processor (CPU) 11, a memory (ROM) 12 for storing programs, a non-volatile memory (NV memory) 13 for storing data even after power is turned off, and an IC card 1 When power is supplied to the CPU and the apparatus is in an activated state, a volatile memory (RAM) 14 for storing work data and the like used in the program processing, a timer 15, and a data exchange between these functional blocks are provided. It comprises an address bus 16 and a data bus 17.
[0021]
The timer 15 performs a countdown operation with a signal generated based on a clock signal. When the value of the timer 15 becomes 0, the timer 15 inputs a timer interrupt signal to the CPU 11 via an interrupt signal line 18 and simultaneously outputs the NV memory 13 A countdown operation is performed again with a signal generated based on the clock signal from the value of the monitoring period 20 stored in the storage device.
[0022]
The timer 15 can start and stop the countdown operation. During the countdown operation is stopped, the timer 15 holds the value immediately before the countdown operation was stopped. At the start of the countdown operation, the countdown is started from the value set by the program in the timer 15 or the value at the time when the countdown operation is stopped.
[0023]
When the IC card 1 is mounted on the IC card reader / writer 4 and the terminals 5 to 10 are connected to the corresponding connectors of the IC card reader / writer 4, the IC card 1 is initialized. The details of the operation procedure including the initialization of the IC card 1 are defined in the JIS X 6304 (based on ISO / IEC7816-3) standard "IC card with external terminal-electric signal and transmission protocol".
[0024]
The schematic operation of the IC card 1 will be described mainly with respect to the description of the present embodiment. When the IC card 1 is mounted on the IC card reader / writer 4, the IC card reader / writer 4 performs electrical connection and activation of terminals. Power is supplied to the internal function block of the IC card 1 via the power supply terminal 8 and the ground terminal 7, and the reset terminal 6 is maintained at the ground level instructing the initialization operation of the internal circuit of the IC card 1.
[0025]
Next, a clock signal is supplied from the clock terminal 10 to a functional block of the data processing unit 3 inside the IC card 1. The signal from the reset terminal 6 is maintained at the ground level signal state until the circuit operation of the internal data processing unit 3 is stabilized, becomes an internal reset signal, stops the operation of the CPU 11, and performs various operations (not shown). The internal control circuit is initialized to prevent malfunctions of functional blocks such as the CPU 11.
[0026]
After a certain period of time, when the internal reset signal becomes the signal state of the power supply level and the reset state is released, the CPU 11 executes the program written in the ROM 12.
[0027]
The ROM 12 stores an OS unit 30 for storing a basic operation program common to a program for controlling a program processing procedure of the CPU, a command processing program 31 for processing various commands to the IC card, and realizes a security function of the IC card. An encryption processing program 32 and various data (not shown) relating to the IC card are stored.
[0028]
The program execution procedure of the CPU 11 is shown in the flowchart of FIG. The first step S1 is an activation step of the IC card, in which information on the IC card 1 is output from the I / O terminal 5 to the IC card reader / writer 4 in the order defined in the above-mentioned rules.
[0029]
Next, the process proceeds to step S2 to clear the value of the number of times of execution of the command 40 stored in the RAM 14 of the IC card 1 to 0, and then proceeds to step S3 to clear the value of the number of times of history 21 stored in the NV memory 13. Is compared with the value of the number of times 22 exceeding the upper limit similarly stored in the NV memory 13. When the value of the number of histories 21 is equal to or greater than the value of the number of times 22 exceeding the upper limit, the process proceeds to an abnormality processing step S24 described later. When the value of the history count 21 is smaller than the value of the count 22 exceeding the upper limit, the process proceeds to step S <b> 4, and the timer 15 is set to the value of the monitoring period 20 stored in the NV memory 13.
[0030]
Next, the process proceeds to step S5, where the interface circuit connected to the I / O terminal 5 is set to the reception state.
[0031]
Next, the CPU 11 goes to a command waiting step S6, and checks whether the reception of the command via the I / O terminal 5 is completed or not, and checks the state of the interface / system control circuit unit 2. When the interface / system control circuit 2 has finished receiving the command via the I / O terminal 5, the process proceeds to step S7, and the CPU 11 receives the command from the interface / system control circuit unit 2. Next, proceeding to step S8, the CPU 11 permits the timer interrupt and starts the counting operation of the timer 15.
[0032]
Next, proceeding to step S9, the CPU 11 executes a processing program corresponding to the command.
[0033]
Next, proceeding to step S10, the CPU 11 compares the executed command with the monitoring command 23 registered in the NV memory 13, and if not coincident, disables the timer interrupt and stops the counting operation of the timer 15. The process proceeds to step S12. If they match, the process proceeds to step S11, in which the value of the command execution count 40 stored in the RAM 14 is increased by 1, and then the process proceeds to step S12 in which the timer interrupt is disabled and the counting operation of the timer 15 is stopped.
[0034]
Next, the process proceeds to step S13, where the CPU 11 sets response data according to the execution result of the command in the interface / system control circuit unit 2 in order to output response data to the IC card reader / writer 4, and the response data is output. When the processing is completed, the state of the interface / system control circuit unit 2 is checked.
[0035]
When the output of the response data is completed, the CPU 11 proceeds to step S5 for setting the interface circuit 2 to the command receiving state, and then proceeds to a command waiting step S6.
[0036]
In a normal use environment of an IC card, the CPU 11 is in a command receiving wait state for many hours, and furthermore, a command receiving operation and a response data transmitting operation are performed by serial communication, and therefore are sufficiently larger than a clock signal. Processing time is required.
[0037]
For this reason, if an interrupt is generated at regular intervals using a timer that counts down with a signal generated based on a clock signal, the timer must be used in order to use the number of command executions within that time interval to determine abnormal processing. Must be set to a large value, and there is a problem that the operation analysis of the IC card from the outside becomes easy. However, as in the present embodiment, control is performed so that the counting operation of the timer 15 is performed only within the processing time of the command. By doing so, the value of the monitoring period 20 set in the timer 15 can be set to a sufficiently small value if the number of command executions within the time interval of the occurrence of the timer interrupt is used as a criterion for determining abnormal processing.
[0038]
FIG. 3 is a flowchart illustrating a procedure executed by the CPU 11 when a timer interrupt occurs and the timer interrupt is permitted.
[0039]
A generally known interrupt branching procedure performed by the CPU when an allowed interrupt occurs (for example, the state of the CPU when an interrupt is accepted, that is, the program execution address information and status information are stored in the stack area). The procedure for setting interrupts to disabled, etc.) and the procedure for returning from interrupts (for example, returning the saved CPU state information to the CPU and setting the interrupts to enabled) are performed as a series of processing procedures according to the hardware system specifications. Detailed steps are not shown because they are performed.
[0040]
First, when a timer interrupt occurs and the interrupt is accepted, step S20, which is an interrupt branch procedure, is executed. Next, the process proceeds to step S21, in which the value of the command execution count 40 stored in the memory 14 is compared with the value of the upper limit count 24 in the period stored in the NV memory 13.
[0041]
In step S21, when the value of the command execution count 40 is smaller than the value of the in-period upper limit count 24, the process proceeds to step S25 in which the value of the command execution count 40 is cleared to 0, and then, in step S26 of the interrupt return procedure. To end the interrupt processing program and return to the processing step at the time when the interrupt occurred.
[0042]
In step S21, when the value of the command execution count 40 is equal to or greater than the value of the period upper limit count 24, the process proceeds to step S22, and the value of the history count 21 stored in the NV memory 13 is increased by one.
[0043]
Next, the process proceeds to step S23, in which the value of the number of times of history 21 is compared with the value of the number of times 22 exceeding the upper limit.
[0044]
In step S23, when the value of the history count 21 is smaller than the value of the count 22 exceeding the upper limit, the process proceeds to step S25, the value of the command execution count 40 is cleared to 0, and then, in step S26 of the interrupt return procedure. To end the interrupt processing program and return to the processing step at the time when the interrupt occurred.
[0045]
In step S23, when the value of the number of times of history 21 is equal to or greater than the value of the number of times 22 exceeding the upper limit, the process proceeds to an abnormality processing step S24 described later.
[0046]
When the interrupt control is performed as described above, the timer that performs the count operation during the processing of the command generates an interrupt at an interval of the monitoring period. When the execution count of the command specified by the command to be monitored when the timer interrupt occurs exceeds the upper limit within the period, and the number of histories that exceeded the upper limit exceeds the set upper limit or more Then, the abnormality processing step is executed.
[0047]
This is because security-related monitoring commands such as commands using the IC card encryption processing program are repeatedly executed within a certain period of time that does not occur in the normal use range. This is because it can be determined that the operation has been performed.
[0048]
As the abnormal processing step S24, various processing procedures can be considered depending on the security level of the IC card. For example, a command at the same address is repeatedly executed to receive a command from the IC card reader / writer 4 or to send a response data. May not be transmitted.
[0049]
Since the IC card that executes the abnormality processing step does not change the number of histories stored in the NV memory and the number of times exceeding the upper limit even if the IC card is reset by turning on the power to the IC card or a reset signal or the like. In the step of comparing the number of histories with the number of times exceeding the upper limit, the process branches to an abnormality processing step, and a necessary operation analysis can be performed by various external observations without execution of an IC card encryption processing program or the like. Can not.
[0050]
Even if the power supply to the IC card is repeatedly turned off and turned on so that the abnormality processing step is not executed, the value of the monitoring time of the timer is unknown. , It takes a very long time to work, and analysis is difficult.
[0051]
The present invention is not limited to the above-described embodiment, and it goes without saying that various modifications can be made without departing from the spirit of the invention.
[0052]
For example, the timer 15 may perform a count-down operation from a value set by a program, instead of causing the CPU 11 to generate a timer interrupt when the timer 15 performs a count-down operation from a value set by a program and becomes 0. Further, a carry signal generated when the count value exceeds the maximum value that can be displayed by the timer 15 may be input to the CPU 11 as a timer interrupt via the interrupt signal line 18. A circuit for determining that all bits are 0 becomes unnecessary, and the timer 15 can be realized with a small number of circuits, and a small-sized IC card with high security performance can be provided.
[0053]
The timer 15 is not configured to count from a value set by a program, but is configured to operate as a designated n-bit counter. Each time a signal generated based on a clock is input as 2 n times, A timer interrupt may be generated. By doing so, the timer 15 can be realized with a small number of circuits, and a small-sized IC card with high security performance can be provided.
[0054]
In addition, if a power supply used for writing data to the nonvolatile memory is internally generated and the power supply from the program power supply terminal is not used, it is possible to avoid writing the history count and the like to the nonvolatile memory by power supply control. Such illegal acts can be prevented, and the security performance of the IC card can be improved.
[0055]
In addition, if a clock generation circuit is incorporated in the IC card so that the processing speed of the data processing unit does not depend on the clock from the clock terminal, the clock frequency applied to the clock terminal can be reduced to reduce the internal operation of the IC card. It becomes difficult to analyze the IC card, and the security performance of the IC card can be improved.
[0056]
【The invention's effect】
According to the present invention, an IC card with high security can be realized.
[Brief description of the drawings]
FIG. 1 is a block diagram of an IC card according to an embodiment of the present invention.
FIG. 2 is a flowchart showing a processing procedure of the IC card according to the embodiment of the present invention.
FIG. 3 is a flowchart showing a timer interrupt processing procedure of the IC card according to the embodiment of the present invention;
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 IC card 2 Interface / system control circuit part 3 Data processing part 4 IC card reader / writer 5 I / O terminal 6 Reset terminal 7 Ground terminal 8 Power supply terminal 9 Program power supply terminal 10 Clock terminal 11 Processor 12 Reading memory (ROM)
13 Non-volatile memory (NV memory)
14 Volatile memory (RAM)
15 Timer 16 Address bus 17 Data bus 18 Timer interrupt signal line 20 Monitoring period 21 Number of times of history 22 Number of times exceeding upper limit 23 Commands to monitor 24 Upper limit number of times within period 30 OS program 31 Command processing program 32 Encryption processing program 40 Number of times of command execution

Claims (8)

A timer,
Means for counting the number of executions of a specific command;
Means for interrupting the processor with a timer when the value of the timer becomes equal to a specific value;
A memory for storing the number of times of execution of the specific command, the upper limit number within a period, the number of histories, and the number of times exceeding the upper limit,
Operation restriction means for restricting a command execution operation,
In the initialization procedure after power-on, when the number of histories is compared with the number of times exceeding the upper limit, and when the number of histories is equal to or greater than the number of times exceeding the upper limit, the operation restricting means restricts the execution operation of the command, In the step of receiving and processing the timer interrupt, the number of times of execution of the specific command is compared with the upper limit number within the period, and when the number of executions of the specific command is equal to or greater than the upper limit number within the period, the history count is By comparing the increased number of histories with the number of times exceeding the upper limit, when the number of histories is equal to or greater than the number of times exceeding the upper limit, the operation restricting means limits the command execution operation. An IC card, characterized in that: 2. The IC card according to claim 1, wherein the timer performs a counting operation by a signal based on an input signal of a clock terminal. 3. The IC card according to claim 1, wherein the timer holds a value immediately before the counting operation is stopped during the counting operation is stopped. Means for setting the value of the monitoring period as an initial value in the timer, and a memory for storing the value of the monitoring period, and when the value of the timer becomes a specific value in the counting operation, the value of the monitoring period is changed. 4. The IC card according to claim 1, further comprising means for setting a timer. The IC card according to any one of claims 1 to 4, wherein the timer is controlled so as to perform a count operation at a time during which a command process is executed. The IC card according to any one of claims 1 to 5, further comprising a memory configured to store a monitoring command that specifies the specific command. 7. A device according to claim 1, further comprising means for externally setting at least one of the upper limit number within the period, the number of histories, the number exceeding the upper limit, the monitoring period, and a memory for storing a command to be monitored. Item 2. The IC card according to item 1. The IC according to any one of claims 1 to 7, wherein the number of times the specific command is executed, the maximum number of times in a period, the number of histories, and the number of times exceeding the upper limit exist for each specific command. card.

Images