JP2004280668A - Application personalization method and system for issuing of multi-application card - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an application personalization method and system for writing, in issuing of an IC Card loaded with a plurality of applications, personalization data for initializing the applications without requiring much labor hour or cost. <P>SOLUTION: A meta template is selected from a plate file 20 defining the format of an application initialization command, and personalization data are read and extracted from an issuing information database 30. According to a reserved word of the meta template, an initialization command in which the personalization data are cut and buried while designating its position is formed to make the IC card 50 initialize the applications. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an application personalization (initialization) method and system for an IC card having a plurality of applications mounted thereon, and in particular, writes personalization information such as card information and personal information required for initializing an application to an IC card. The present invention relates to an application personalization method and system for issuing a multi-application card.
[0002]
[Prior art]
Since the IC card has a large storage capacity and high security, it has recently been used as a new information recording medium instead of a magnetic card in public, financial, communication, transportation, medical, and electronic commerce on the Internet. Spreading. Further, recently, a multi-application IC card system in which a plurality of applications are mounted on an IC card so that a plurality of services can be used has appeared. In such a multi-application IC card system, a card issuer needs to issue an IC card by initially installing an appropriate application from among many applications in response to a request from the card issuer, service provider, or user. There is.
[0003]
For example, in an IC card equipped with a plurality of applications, an invention is disclosed for a series of processes for obtaining individual keys necessary for using each application from a certificate authority and writing these individual keys to the IC card. I have. Specifically, the present invention has a certificate authority that manages the license of the application A issue an individual key Ka, writes the individual key Ka into a predetermined portion of the IC card, and manages the license of the application B. The certificate authority issues an individual key Kb, and after a series of processes for writing the individual key Kb to a predetermined location of the IC card, the IC card issuance process with the applications A and B in a usable state. (For example, see Patent Document 1).
[0004]
As described above, in order to write the individual keys Ka and Kb into the IC card, a program for executing the data, which is necessary for initializing an application, which is necessary to initialize the application, is required for each IC card. That is, when a plurality of applications are mounted on the IC card, an APDU (Application Protocol Data Unit) command unique to the IC card is used to write data (personalized data) for initializing each application to the IC card. It was necessary to create a program consisting of a sequence for each application, which was troublesome and costly.
[0005]
Further, in order to issue such a multi-application card, it is necessary to embed personalized data in the APDU command of the issuing program described above for each application. In general, in an IC card issuing system, in order to facilitate the handling of such personalized data, an existing database in which personalized data is stored as a series of information is temporarily converted into a database for issuing an IC card, and the database is converted into a database for issuing the IC card. , And reads the personalized data and embeds it in the APDU command.
[0006]
In this case, it is necessary to convert an existing database into a database for issuing an IC card, which is troublesome and costly. In addition, if conversion of an existing database to another database is prohibited due to security policy of an administrator or operational restrictions, there is a problem that the database cannot be transferred to a database for issuing an IC card.
[0007]
The present applicant has proposed an issuance command generation system that can support generation of various issuance commands when issuing an IC card, and an IC card issuance system that can support file formats of various card issuance machines. (Japanese Patent Application No. 2002-156962, Japanese Patent Application No. 2002-254141).
[0008]
[Patent Document 1]
JP-A-2002-7971 (paragraph [0013], FIG. 2)
[0009]
[Problems to be solved by the invention]
SUMMARY OF THE INVENTION The present invention has been made in view of the above-described problem, and has as its object to issue an issuance program for writing application initialization data to an IC card when issuing an IC card having a plurality of applications. There is provided an application personalization method and system in multi-application card issuance that does not need to be created for each application and that does not require converting an existing database into a card issuance database and that can save labor and cost. It is in.
[0010]
[Means for Solving the Problems]
The invention according to claim 1 is a card issuance management device, wherein the card issuance management device manages a multi-application IC card on which a plurality of applications are mounted, and the application performs initialization for each application. However, after the application is mounted on the IC card, a meta template that defines the format of the initialization command of the application is selected from the meta template file, and from the issuing information database that stores personalized information such as card information and personal information, A record corresponding to the IC card is selected, data to be embedded in the meta template is extracted, and the extracted data is formatted and embedded in a format specified by the meta template, and Generates a synchronize command, IC card application is characterized in that for initializing the application based on the embedded initialization command data.
[0011]
According to a preferred embodiment of the present invention, in the application personalizing method according to the first aspect of the present invention, the data shaping method specified by the meta template includes: The method includes a method of dividing and cutting out.
[0012]
According to a third aspect of the present invention, in the application personalizing method according to the first aspect, the initialization command of the application is defined in a meta template so that personalization information necessary for the application is appropriately embedded in a data portion of the initialization command of the application. The card issuance management device transmits the generated application initialization command to the card manager of the IC card, and the card manager interprets the received initialization command and transmits data as personalization information of the data section in the card manager. The data is stored in an area, and the application acquires the data from the area in the card manager as needed.
[0013]
The invention of claim 4 is an application personalization system including a plurality of applications, the applications including a multi-application IC card for performing initialization for each application, and a card issuance management device for managing the IC card. , A meta-template file storing a meta-template defining the format of an application initialization command, and an issuance information database storing personalization information such as card information and personal information. After the application is installed in the meta template, a function to select a meta template from the meta template file and a record corresponding to the IC card from the issuing information database are selected and embedded in the meta template. And a function of shaping and embedding the extracted data in a format specified by the meta template to generate an application initialization command. It is characterized in that the application is initialized based on the obtained data.
[0014]
According to a preferred embodiment of the present invention, in the application personalizing system according to the fourth aspect, in the method of shaping data specified by the meta template, the start position is the n-th byte of the original data, and the data of a predetermined number of bytes from the position is set. The method includes a method of dividing and cutting out.
[0015]
According to a sixth aspect of the present invention, in the application personalization system according to the fourth aspect, the initialization command of the application is defined in a meta template so that personalization information necessary for the application is appropriately embedded in a data portion of the initialization command of the application. The card issuance management device has a function of transmitting the generated application initialization command to the IC card, the IC card has a card manager, and the card manager interprets the received initialization command and Data as personalization information is stored in an area in the card manager, and an IC card application acquires the data from the area in the card manager as necessary.
[0016]
BEST MODE FOR CARRYING OUT THE INVENTION
First, an outline of a series of operations until a multi-application IC card is issued will be described with reference to FIG.
[0017]
An application personalization system for issuing a multi-application card according to an embodiment of the present invention includes a card issuing management device 10, a meta template file 20, an issuing information database 30, a card issuing machine 40, and an IC card 50. In this system, the card issuance management device 10 generates a command for issuing the IC card 50 by using a meta template file 20 storing a meta template defining the format of the command for issuance. The template is read out to create an issuance template, and a record corresponding to the IC card 50 is selected from the issuance information database 30 storing personalized data such as card information and personal information, and necessary data is extracted. Create data for publication. Then, an issuance command is created from the issuance template and the issuance data, transmitted to the card issuance machine 40, and an APDU command is transmitted and received between the card issuance machine 40 and the IC card 50, thereby issuing the IC card 50. I do.
[0018]
The card issuance management device 10 includes a meta template interpreting unit 11, an issuance template creating unit 12, an issuance data obtaining unit 13, an issuance data cutout unit 14, and an issuance command creating unit 15. The meta template interpreter 11 reads the application meta template and the card issuance meta template required for issuing the IC card 50 from the meta template file 20, and analyzes the reserved words embedded in these APDU commands. The issuance template creation unit 12 takes in the application meta template and the card issuance meta template from the meta template interpretation unit 11 and combines these templates to create an issuance template. The issuance template includes a reserved word indicating that the sequence of the issuance command necessary for issuance of the IC card is replaced with the issuance data, and the APDU commands are described in the execution order.
[0019]
The issuance data acquisition unit 13 reads out data necessary for issuance of the IC card 50 from the issuance information database 30, and associates the data with the issuance data item name of the APDU command analyzed by the meta template interpretation unit 11. . The issuance data cutout unit 14 cuts out data necessary for issuance of the IC card 50 and creates issuance data. This issuance data is data that differs for each IC card, and is data to be embedded in the issuance command.
[0020]
The issuance command creation unit 15 takes in the issuance template and the issuance data described above, performs data conversion according to a predetermined conversion rule, and creates an issuance command. That is, the command for issuing is created by shaping and embedding the data extracted from the information for issuance database 30 into the format specified by the format specified by the template for issuance. Specifically, the data specified by the reserved word is appropriately converted in accordance with a predetermined conversion rule specified by the reserved word in the issuance template, thereby performing processing such as embedding data at a predetermined location. Further, the created issuance command is subjected to file conversion for the card issuing machine 40 to create an issuance file and transmitted to the card issuing machine 40.
[0021]
The meta template file 20 defines a template for creating an APDU command to be executed when the IC card 50 is issued in a command order including a reserved word, and includes a plurality of application meta templates existing for each application and an IC card The information necessary for issuing the 50 is defined, and is composed of a single card issuing meta template common to all IC cards. Note that the issuance data acquisition unit 13 reads out only the templates necessary for issuing the IC card 50 from the plurality of application templates.
[0022]
The issuance information database 30 is an existing database in which information required by an application, such as card information, personal information such as a user name, and security information such as key data, is stored as a series of data.
[0023]
The card issuing machine 40 receives the issuance file including the card issuance command from the card issuance management device 10 and issues the IC card 50 by transmitting and receiving an APDU command to and from the IC card 50.
[0024]
The IC card 50 includes a card manager 51 that manages the entire card, and an application storage unit 52 that has application storage areas 52-1 to n in which individual applications AP1 to n are stored. The applications 52-1 to 52-1n of the IC card 50 receive the APDU command directly from the card issuing machine 40 and initialize the applications. As shown in FIG. 1, the card manager 51 is provided with personalization areas 51-1 to n in which personalization data different for each application is stored, and the card manager 51 receives an APDU command from the card issuing machine 40 and initializes the card. The command may be interpreted and the personalized data of the data section may be stored in the personalized areas 51-1 to n, and the applications 52-1 to n may acquire and initialize the data as needed. For example, when the AP 1 is activated, the personalized data stored in the personalized area 51-1 for the AP 1 can be acquired and the application can be initialized at the time of execution or when necessary.
[0025]
As described above, a series of operations up to the issuance of the IC card 50 has been described. However, the feature of the present invention is that the application personalization system described above allows the existing issuance information database 30 to be used when the IC card 50 is issued. The personalization data is directly read out, and the IC card 50 initializes the application based on the personalization data. That is, the present invention selects a meta template from the meta template file 20, selects personalized data from the issuance information database 30, designates the position of the personalized data, divides and cuts out the embedded data, and embeds it in the meta template. An initialization command is created to cause the IC card 50 to initialize an application.
[0026]
Next, an application personalization method and system for issuing a multi-application card according to an embodiment of the present invention will be described in detail with reference to FIG. The numbers of the configuration of the application personalization system shown in FIG. 2 are the same as those of the configuration shown in FIG. The card issuing meta template of the meta template file 20, the card issuing machine 40, and the application storage unit 52 of the IC card 50 are omitted for simplicity.
[0027]
The issuance information database 30 is a database in which, for example, personal information of the inhabitants owned and managed by local governments of municipalities is stored, and the user name is "suzuki", the user ID is "ABCD123", and the PIN code is Is stored, such as "01020304", where the first four digits of the user ID represent the company code and the last three digits represent the employee number.
[0028]
When issuing the IC card 50 for the user "suzuki" using the issuance information database 30 as the original information, the AP 1 of the IC card 50 connects the user ID and the user name as personalized information, and the AP 2 sets the personalized information. A description will be given of a case where connection of an employee number and a PIN code is required as personalization information, and data in which the AP 3 has a TLV structure of a user ID and a user name is required as personalization information. In addition, the AP 1 initializes by the initialization command of the AP 1, and the personalization stored in the personalization areas 51-2 and 51-3 in the card manager 51 by the initialization command provided by the card manager 51 for the AP 2 and the AP 3. Initialization is performed by a method of acquiring data from the card manager 51.
[0029]
The meta template file 20 stores an application meta template that defines the format of an application initialization command. This application meta template needs to be prepared in advance for issuing the IC card 50. The meta template includes a reserved word indicating a method of embedding different data for each user. The reserved word indicates target data and a method of shaping the data. In the case of this example, an initialization command of AP1 is described in the meta template of AP1, and an initialization command of the card manager 51 is described in meta templates of AP2 and AP3.
[0030]
FIG. 3 shows an example of the meta template of AP1 to AP3 stored in the meta template file 20 shown in FIG. In FIG. 3, “$ DATA” is a reserved word indicating substitution of personal information. Here, “$ UID” indicates a user code, “$ UNNAME” indicates a user name, and “$ PIN” indicates a PIN code converted into a byte code. Here, it is assumed that it is converted into an ASCII code. “$ DATA (SnBm)” is a reserved word indicating that m bytes are cut out from the n th byte of the personal information DATA and substituted. Here, the last three digits of the user ID are cut out and substituted by “$ UID ($ S5B3)”. “#Lc” and “#L” are reserved words for substituting the length of the immediately following data.
[0031]
When the data of "suzuki" is applied to these meta templates, the commands shown in FIG. 4 are generated. This corresponds to the command created by the issuing command creating unit 15 shown in FIG. The initialization command of AP1 is transmitted to AP1 and processed by AP1. The initialization command for AP2 and AP3 is transmitted to the card manager 51, and “31 32 33... 03 04” is stored in the personalization area 51-2 for AP2 in the card manager 51, and “31 32 33... 01 07 41 42... 4B 49 "is stored. The AP2 and AP3 acquire the data at the time of execution of each application and perform personalization.
[0032]
In the application personalization method and system according to the embodiment of the present invention, as a reserved word having a function of dividing data, a reserved word SnBm for extracting data from the head to the m-th byte as a start position for extracting the nth byte from the beginning is used. However, the present invention is not limited to this. For example, data of m-byte length may be cut out from the n-th leading byte as the cut-out start position. In short, any reserved word having a function of freely dividing and cutting out necessary data from a series of data may be used.
[0033]
【The invention's effect】
As described above, according to the application personalization method and system of the present invention, the personalization data of the application is formatted and embedded in the format specified by the meta template, the application initialization command is generated, and the application is initialized. I did it. For this reason, it is not necessary to create a program for issuing an application for initializing each application, and by preparing data for initializing one application and dividing the data into a plurality of data as needed, the initializing of the application Commands can be created automatically.
[0034]
Also, an initialization command is created by directly reading personalized data from an existing database in which a plurality of personalized data for each application is stored as a series of data. Therefore, there is no need to convert an existing database into a card issuing database. For example, if restrictions on the handling of an existing database are imposed, such as the conversion of an existing database to another database is prohibited due to security policies of the administrator or operational restrictions, This is particularly effective because the database can be used directly. As described above, it is possible to save labor and cost for creating a program for each application and converting a database.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram showing an application personalization system for issuing a multi-application card according to an embodiment of the present invention.
FIG. 2 is an explanatory diagram showing an example of processing contents in the application personalization system of FIG. 1;
FIG. 3 is a diagram illustrating an example of a meta template stored in a meta template file of FIG. 2;
FIG. 4 is a diagram illustrating an example of an initialization command generated by an issuance command generation unit in FIG. 2;
[Explanation of symbols]
REFERENCE SIGNS LIST 10 card issuance management device 11 meta template interpreting unit 12 issuance template creation unit 13 issuance data acquisition unit 14 issuance data cutout unit 15 issuance command creation unit 20 meta template file 30 issuance information database 40 card issuance machine 50 IC card 51 Card Manager 51-1 to n Personalization Area for Application 52 Application Storage Unit 52-1 to n Application Storage Area

Claims (6)

A card issuance management device manages a multi-application IC card on which a plurality of applications are mounted, and in the application personalization method in which the application performs initialization for each application, the card issuance management device stores the application in the IC card. After installation, select a meta template that defines the format of the initialization command of the application from the meta template file. From the issuance information database that stores personalized information such as card information and personal information, create a record corresponding to the IC card. Select and extract data to be embedded in the meta template, format and extract the extracted data in the format specified by the meta template, and generate an application initialization command. And, the application personalization process IC card application is, in the card issuance multi-application, characterized in that for initializing the application based on the embedded initialization command data. 2. The application personalization method according to claim 1, wherein the data shaping method specified by the meta template includes a method of setting the n-th byte of the original data as a start position and dividing the data into a predetermined number of bytes from the position. An application personalization method, comprising: The application personalization method according to claim 1, wherein the initialization command of the application is defined in a meta template so that personalization information necessary for the application is appropriately embedded in a data portion of the initialization command of the application, and the card issuance management device includes: The generated application initialization command is transmitted to the card manager of the IC card, and the card manager interprets the received initialization command and stores data as personalization information of the data part in an area in the card manager. Acquiring the data from an area in a card manager as needed. In an application personalization system including a plurality of applications, the application including a multi-application IC card for performing initialization of each application for each application, and a card issue management device for managing the IC card, an application initialization command A meta-template file storing a meta-template defining the format of the card, and an issuance information database storing personalization information such as card information and personal information. After the card issuance management device has installed the application on the IC card, A function of selecting a meta template from the meta template file, and selecting a record corresponding to the IC card from the issuance information database and extracting data to be embedded in the meta template And a function of formatting and embedding the extracted data in a format specified by the meta template to generate an application initialization command. The application of the IC card performs the processing based on the data embedded in the initialization command. An application personalizing system for issuing a multi-application card, wherein the application is initialized by performing initialization. 5. The application personalization system according to claim 4, wherein the method of shaping the data specified by the meta template includes a method of setting the n-th byte of the original data as a start position and dividing the data into a predetermined number of bytes from the position. An application personalization system, characterized in that: 5. The application personalization system according to claim 4, wherein the initialization command of the application is defined in a meta template so that personalization information necessary for the application is appropriately embedded in a data portion of the initialization command of the application. The IC card has a function of transmitting the generated application initialization command to the IC card. The IC card has a card manager, and the card manager interprets the received initialization command and stores the data as personalization information in the data section on the card. An application personalization system stored in an area in a manager, wherein an IC card application acquires the data from the area in the card manager as needed.

Images