JP2005209109A - Memory card with protection function, and its control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize a memory card with a protection function having a high security function which protects important data from unauthentic access that the creator of data does not intend, and to provide its control method. <P>SOLUTION: The memory card with the protection function and its control method comprise; an authentication condition table 31 provided with an authentication condition which is stored in a security area 30 and represents a specific physical amount, a condition value representing a value of the authentication condition or a range of this value, and authentication information indicating "permission" or "nonpermission" of mutual authentication correspondingly to the condition value; a comparison information generation part 21 for generating comparison information being the present value of the physical amount; a table comparison part 23 for comparing the comparison information with the condition value to output authentication information corresponding to the condition value as a determination result in the case of agreement between the comparison information and the condition value or to output "nonpermission" as the determination result in the case of disagreement between the comparison information and the condition value; and a controller 16 for determining and reporting "permission" or "nonpermission" of mutual authentication to the outside on the basis of the determination result. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a memory card with a protective function having an electrically rewritable nonvolatile memory and a control method thereof.

  In recent years, the market for compact and large-capacity memory cards is rapidly expanding as a storage device for recording digital content such as audio data and video data in mobile phones and mobile devices.

  By the way, digital content can be copied or downloaded without loss of quality by adopting digital encoding technology such as MPEG2 used for encoding digital video and audio and MP3 (MPEG-1 Audio Layer3) used for audio compression. can do.

  For this reason, from the viewpoint of copyright protection, a technique for protecting such digital contents from unauthorized use is regarded as important.

  Applicable only when mutual authentication is performed with the device connected to the memory card (hereinafter referred to as “connected device”) and the validity of the connected device is proved in order to solve security problems such as copyright protection. Patent Document 1 describes a method of protecting important data from unauthorized access by providing a protected area accessed by a device and storing the important data in this protected area (hereinafter referred to as “security area”). ing.

  However, the conventional memory card with a protection function has a problem that the security area can be accessed anytime and anywhere if the validity of the connected device is authenticated by mutual authentication with the connected device.

In other words, even if the data is personal data that you want to manage individually, with a memory card with a conventional protective function, you can access all connected devices that have been validated. There is a problem that even a third party unintended by a person can acquire the important data.
JP 2001-249695 A

  The present invention has been made to solve the above problems, and provides a memory card with a protection function having a high security function capable of protecting important data from unauthorized access unintended by the creator of the data, and a control method thereof. The purpose is to do.

  According to one aspect of the present invention, a security area provided in an electrically rewritable non-volatile memory, accessible by authentication software using a dedicated authentication driver, stored in the security area, and a specific area An authentication condition representing a physical quantity, a condition value representing the value of the authentication condition or a range of values, and authentication information representing “permitted” or “non-permitted” of mutual authentication by the authentication software corresponding to the condition value Comparing the authentication condition table, the comparison information generating means for generating comparison information that is the current value of the physical quantity, the comparison information acquired from the comparison information generating means and the condition value acquired from the authentication table, When the comparison information matches the condition value, the authentication information corresponding to the condition value is output as a determination result, and the comparison information is the condition value. The table comparison unit that outputs “not permitted” as a determination result, and whether or not mutual authentication by the authentication software is permitted based on the determination result received from the table comparison unit There is provided a memory card with a protection function, characterized in that it has an authentication control means for notifying to.

  According to another aspect of the present invention, there is provided a memory card with a protection function, which is provided in an electrically rewritable non-volatile memory and has a security area that can be accessed by authentication software using a dedicated authentication driver. A control method comprising: an authentication condition indicating a specific physical quantity; a condition value indicating a value or a range of values of the authentication condition; and “permitting” or “not permitting” mutual authentication by the authentication software corresponding to the condition value. A table acquisition step of acquiring an authentication condition table including authentication information indicating “permitted” from the security area, a comparison information acquisition step of acquiring comparison information that is a current value of the physical quantity from a comparison information generation unit, and the comparison information The comparison information acquired in the acquisition step and the condition value of the authentication condition table acquired in the table acquisition step When the comparison information matches the condition value, the authentication information is output as a determination result. When the comparison information does not match the condition value, “not permitted” is output as the determination result. A memory card with a protection function, comprising: an authentication condition comparison step for performing authentication; and an authentication determination step for determining whether mutual authentication by the authentication software is possible based on the determination result in the authentication condition comparison step A method is provided.

  According to the present invention, it is possible to limit the objects that can access data in more detail, so that important data can be protected from unauthorized access unintended by the creator of the data, and a high security function can be realized. .

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a circuit block diagram illustrating a memory card with a protection function according to the first embodiment of the present invention. Here, a circuit block of the host device 12 necessary for the authentication is shown together with the memory card 11 with protection function (hereinafter referred to as “memory card 11”).

  The memory card 11 according to the first embodiment of the present invention controls connection terminals 13a to 13i connected to the host device 12, a NAND memory 14 for storing data, and authentication of the memory card 11 and access to the NAND memory 14. A processor module 15 is provided.

  The processor module 15 includes a controller 16 serving as a main control unit of the memory card 11, a ROM 17 storing a control program, a work memory, an SRAM 18 used as a buffer memory, a memory interface 19 serving as an interface with the NAND memory 14, a host It comprises an I / O interface 20 that is an interface with the device 12, a comparison information generation unit 21, a comparison information acquisition unit 22, and a table comparison unit 23.

  The memory card 11 has a CLK terminal 13a for receiving a clock signal, a CMD terminal 13b for receiving a command from the host device 12 and returning a response to the command, a DAT0 terminal 13c to a DAT3 terminal 13f for transmitting / receiving data, A total of nine terminals, a VDD terminal 13g to which power is supplied, and GND terminals 13h and 13i connected to the ground are arranged.

  The NAND memory 14 is a rewritable nonvolatile memory and is divided into two areas. That is, a user data area 29 for storing general data and a security area 30 for mainly storing confidential data.

  The user data area 29 is an area that the host device 12 can freely access except in a special case where the memory card 11 is locked.

  On the other hand, the security area 30 is an area that can be accessed when the authenticity of the host device 12 is proved by mutual authentication with the host device 12.

  The security area 30 stores an authentication condition table 31 in which conditions for selecting permission / denial of mutual authentication are stored.

  The comparison information generation unit 21 of the processor module 15 selects a current value (hereinafter referred to as “authentication condition”) for selecting mutual authentication permission or mutual authentication non-permission registered in the authentication condition table 31. "Comparison information").

  The comparison information generation unit 21 is equipped with a GPS function module used in a navigation system or a mobile phone and a time correction function module used in a radio clock, etc., and is accurate for generating comparison information. Position information and date / time information can be acquired.

  The comparison information acquisition unit 22 of the processor module 15 acquires the comparison information from the comparison information generation unit 21 and outputs it to the table comparison unit 23. The comparison information acquisition unit 22 does not accept information other than the comparison information from the comparison information generation unit 21 and does not output the comparison information to other than the table comparison unit 23. Thereby, it is physically impossible to access the comparison information from an external device other than the processor module 15, and the comparison information is prevented from being falsified.

  The table comparison unit 23 of the processor module 15 compares the authentication condition table 31 stored in the security area 30 of the NAND memory 14 with the comparison information received from the comparison information acquisition unit 22 and outputs the determination result to the controller 16. To do.

  The host device 12 that authenticates the memory card 11 includes a card interface 24 on which a plurality of memory cards 11 can be mounted, a CPU 25 that controls the host device 12, a system memory 26 that includes a RAM, and a disk storage device. 27.

  The disk storage device 27 stores an authentication driver 28, which is firmware that controls mutual authentication (details will be described later) that prove that the host device 12 is a valid device.

  Next, details of the authentication condition table 31 stored in the security area 30 will be described.

  FIG. 2 is a detailed diagram illustrating the authentication condition table 31 of the memory card 11 according to the first embodiment of the invention.

  As shown in the figure, the authentication condition table 31 includes an authentication condition that represents a specific physical quantity such as “date”, “time”, and “location”, and a condition that indicates the value or range of the physical quantity for each authentication condition. Each value and condition value includes authentication information indicating mutual authentication “permitted” or mutual authentication “not permitted”.

  For example, as shown in FIG. 2, the mutual authentication “permitted” is included in the condition value of “13: 0 to 19:00”, and the mutual authentication “ "No permission" is set as authentication information.

  When the comparison information generated by the comparison information generation unit 21 is “January 1, 2004, 14:00”, the final determination is mutual authentication “not permitted”. That is, the final determination is made on the authentication information “permitted” for each condition value by their logical product (AND).

  Next, a method for controlling the memory card 11 having the above-described configuration will be described.

  FIG. 3 is an image diagram showing a method of using the memory card 11 according to the first embodiment of the present invention. Here, the authentication condition table 31 is stored in the memory card 11, and the host device 12 (hereinafter referred to as "host A") that sets access restrictions on the memory card 11, and the memory card 11 under the access restrictions. The host device 12 to be used (hereinafter referred to as “host B”) is shown.

  In addition, the date, time, and place where the memory card 11 is inserted into each host device 12 are shown at the top.

  First, the user purchases a new memory card 11 and inserts the memory card 11 into the host A at the office 1 at 15:43 on October 10, 2002. On the host A, the user activates software for creating the authentication condition table 31 (hereinafter referred to as “creation software”), and creates the authentication condition table 31 shown in FIG. The created authentication condition table 31 is transferred to the memory card 11 and stored in the security area 30 of the NAND memory 14.

  When the memory card 11 is used in another host B, the user activates software for mutual authentication using the authentication driver 28 (hereinafter referred to as “authentication software”), and the authentication stored by the host A. It is necessary to obtain permission for mutual authentication from the memory card 11 based on the condition table 31.

  When the host B makes an authentication request to the memory card 11, the comparison information generation unit 21 generates comparison information of the current date, time, and place, and the comparison information acquisition unit 22 outputs the comparison information to the table comparison unit 23. In response to this, the table comparison unit 23 compares the comparison information with the condition values in the authentication condition table 31 and outputs the determination result to the controller 16.

  The controller 16 finally determines mutual authentication “permitted” or mutual authentication “not permitted” based on the received determination result, and notifies the host B of it.

  2 and 3, since the date is October 30, 2002, the time is 14:00, and the location is Ome City, Tokyo, the memory card 11 permits mutual authentication with the host B.

  Next, detailed operation flows of the host A, the host B, and the memory card 11 will be described.

  FIG. 4 is a flowchart showing a setting method of the authentication condition table 31 in the memory card 11 and the host A according to the first embodiment of the present invention.

  The setting method of the authentication condition table 31 in the host A according to the first embodiment of the present invention includes a card initialization step 41, a table creation step 42, and a table transmission step 43.

  In addition, the setting method of the authentication condition table 31 in the memory card 11 according to the first embodiment of the present invention includes the table reception step 44, the table determination step 45, the table update step 46, the table storage step 47, and the standby mode setting step 48. It is configured.

  In the card initialization step 41, when the memory card 11 is inserted into the card interface 24 of the host A while the host A is turned on, or when the memory card 11 is installed, the power of the host A is turned on. Is inserted, the host A performs an initialization process to make the memory card 11 in a readable / writable state.

  Next, in the table creation step 42, the host A activates the creation software and creates the authentication condition table 31 based on the input data such as date, time, and location.

  Then, in the table transmission step 43, the host A transmits the created authentication condition table 31 to the memory card 11.

  In the table receiving step 44, the memory card 11 receives the authentication condition table 31 transmitted from the host A.

  Next, in the table determination step 45, the controller 16 of the memory card 11 confirms whether the authentication condition table 31 already exists in the NAND memory 14.

  If the authentication condition table 31 already exists in the NAND memory 14 (“YES”), the controller 16 updates the current authentication condition table 31 from the host A in a table update step 46. Replace with

  If the authentication condition table 31 does not exist in the NAND memory 14 (“NO”), the controller 16 stores the authentication condition table 31 transmitted from the host A in the security area 30 of the NAND memory 14 in the table saving step 47. Store.

  Finally, in the standby mode setting step 48, the controller 16 shifts to a standby mode for determining “permission” or “non-permission” of mutual authentication in response to the authentication request from the host device 12.

  The memory card 11 once set to the standby mode automatically shifts to the standby mode when the initialization process at the time of power-on is completed, except when the authentication condition table 31 is set again by the host A creation software. To do.

  FIG. 5 is a flowchart showing an authentication method in the memory card 11 and the host B according to the first embodiment of the present invention. Here, the memory card 11 is set to the standby mode according to the operation flow of FIG.

  The authentication method in the host B according to the first embodiment of the present invention includes an authentication request step 51, an authentication permission determination step 52, a card authentication step 53, and a card access step 54.

  Further, the authentication method in the memory card 11 according to the first embodiment of the present invention includes a comparison information acquisition step 55, a table acquisition step 56, an authentication condition comparison step 57, an authentication determination step 58, an authentication rejection notification step 59, and an authentication permission notification step. 60, a host authentication step 61, and a memory access step 62.

  The host B first activates the authentication software, and then executes the initialization process of the memory card 11 in the same manner as the card initialization step 41 of the host A.

  When the initialization of the memory card 11 is completed, the host B transmits an authentication request command to the memory card 11 in order to access the security area 30 of the NAND memory 14 in the authentication request step 51.

  Then, the host B proceeds to the authentication permission determination step 52 and waits until a determination signal from the memory card 11 is received.

  On the other hand, when receiving the authentication request command from the host B, the controller 16 of the memory card 11 includes the comparison information acquisition unit 22 including the current date / time information and position information from the comparison information generation unit 21 in the comparison information acquisition step 55. Operates to obtain comparison information.

  Next, in the table acquisition step 56, the controller 16 operates so that the table comparison unit 23 acquires the authentication condition table 31 stored in the NAND memory 14.

  Subsequently, in the authentication condition comparison step 57, the table comparison unit 23 compares the comparison information acquired from the comparison information acquisition unit 22 with the condition value of the authentication condition set in the authentication condition table 31.

  When the value of the comparison information matches the condition value or falls within the range of the condition value (hereinafter referred to as “matches the condition value”), the table comparison unit 23 sets the condition value to the condition value. The corresponding authentication information is output as the determination result.

  When the determination result is received, the controller 16 selects the authentication permission notification step 60 (“OK”) or the authentication rejection notification step 59 (“NG”) based on the determination result in the authentication determination step 58.

  That is, as described above, when all the values of the comparison information match the condition value and all the pieces of authentication information are set to “permitted” (AND condition), the controller 16 Therefore, it is determined that mutual authentication is “permitted” (“OK”), and the process proceeds to the authentication permission notifying step 60.

  If the value of the comparison information does not match the condition value, or if “not permitted” is set in the authentication information of the matched condition value, the controller 16 finally makes the mutual authentication “not permitted” (“NG”). ) And the process proceeds to the authentication rejection notification step 59.

  In the authentication permission notification step 60, the controller 16 transmits a determination signal “permitted” to the host B as a final determination, and proceeds to the security access step 63.

  In the authentication rejection notification step 59, the controller 16 transmits a “not permitted” determination signal to the host B as the final determination, and ends the processing.

  In this case, the memory card 11 does not perform mutual authentication with the host B, and therefore the host B cannot access the security area 30 of the NAND memory 14.

  Further, when the host B receives a determination signal “permitted” as the final determination from the memory card 11 (“OK”) in the authentication permission determination step 52, the host B proceeds to the security access step 63 and is connected to the memory card 11. To perform mutual authentication and data access.

  Then, the host B displays a message “<authentication permitted> access to the security area 30” on the display device.

  When the determination signal “not permitted” is received from the memory card 11 (“NG”), the host B displays a message “<authentication not permitted> security area 30 inaccessible” on the display device. Immediately terminate the authentication software process.

  In the security access step 63, first, mutual authentication processing is performed in a card authentication step 53 of the host B and a host authentication step 61 of the memory card 11 by a method such as CPRM (Content Protection for Recodable Media).

  At this time, the authentication software uses the authentication driver 28 stored in the disk storage device 27 of the host B.

  Next, when the host B transmits an access command to the memory card 11 in the card access step 54, the controller 16 of the memory card 11 receives the request and accesses the NAND memory 14 in the memory access step 62, and is requested. Data sent back to host B.

  In this way, once the mutual authentication between the host B and the memory card 11 is successful, the host B does not need an extra operation until the power is turned off or the memory card 11 is removed from the host B. The NAND memory 14 can be freely accessed safely.

  According to the first embodiment, since access to important data can be limited by date, time and place, important data can be protected from unauthorized access unintended by the creator of the data, and a protection function having a high security function. An attached memory card and its control method can be realized.

  In the above-described first embodiment, the authentication condition table 31 includes the authentication condition, the condition value, and the authentication information. However, the present invention is not limited to this. In order for the user to prioritize the authentication conditions, An authentication level may be provided in the authentication condition.

  FIG. 6 is an image diagram showing another authentication condition table 31 in the memory card 11 according to the first embodiment of the present invention.

  As shown in the figure, an authentication level “3” is set for the authentication condition “date”, an authentication level “2” is set for the authentication condition “time”, and an authentication level “1” is set for the authentication condition “location”. "Is set.

  Here, for example, if the level is set to “2 or higher” in the security area 30 of the memory card 11 by the creation software, the authentication condition “date” and the authentication condition “time” are compared, and the authentication condition “ No “location” comparison is made.

  By setting the authentication level, it is possible to limit the objects that are permitted to perform mutual authentication as needed without changing the authentication condition table 31.

  In FIG. 6, the authentication level is set for all the condition values, but it is not always necessary to set the authentication level. If not set, the default is to compare at all levels.

  An authentication scoring method may be used instead of the authentication level.

  FIG. 7 is an image diagram showing another authentication condition table 31 in the memory card 11 according to the first embodiment of the present invention.

  As shown in the figure, an authentication score is set for each condition value of the authentication condition, and when receiving an authentication request from the host B, the controller 16 matches the comparison information acquired by the comparison information acquisition unit 22. The certification score of certification conditions is added sequentially.

  The authentication total score is set in advance in the memory card 11, and the controller 16 finally permits mutual authentication only when the total authentication score is equal to or greater than the total authentication score.

  For example, the authentication total score is set to “5 points” in advance in the memory card 11, the comparison date “Date” is October 27, 2002, “Time” is 10:00, and “Location” is Ome City, Tokyo. Assuming there is an authentication score of “date” and an authentication score of “time” of “4”, the total of the authentication scores is 5 at this point, and the authentication conditions “location” are not compared with each other. Authentication is “permitted”.

  Similar to the above-described setting of the authentication level, by setting the authentication score as described above, it is possible to limit the objects for which mutual authentication is permitted as necessary.

  The configuration of the memory card 11 with protection function (hereinafter referred to as “memory card 11”) according to the second embodiment of the present invention is the same as that of the first embodiment, and therefore, FIG. The difference from the first embodiment is that an essential condition item is provided in the authentication condition table 31, and if the condition value is not met, the memory card 11 is physically placed in the LOCK state.

  In the LOCK state, when the comparison information does not match the condition value of the essential condition item, the controller 16 rejects the mutual authentication and ignores all commands that access the security area 30, thereby causing the security area 30. Access to is prohibited.

  FIG. 8 is an image diagram showing the authentication condition table 31 in the memory card 11 according to the second embodiment of the present invention.

  The authentication condition table 31 in the memory card 11 according to the second embodiment of the present invention includes an authentication condition indicating a specific physical quantity such as “date”, “time”, “location”, and the value or value of the physical quantity for each authentication condition. It comprises a condition value indicating a range, authentication information indicating mutual authentication “permitted” or mutual authentication “non-permitted” for each condition value, and essential conditions that define the physical LOCK state of the memory card 11.

  Since the authentication condition, the condition value, and the authentication information are the same as those in the first embodiment, description thereof is omitted.

  Indispensable conditions are conditions that must be satisfied in order to permit mutual authentication. That is, when this item is set to “True” and the comparison information does not match the condition value, the memory card 11 is physically in the LOCK state.

  Conversely, when this item is “False”, the controller 16 of the memory card 11 performs the same determination operation as in the first embodiment.

  Next, a method for controlling the memory card 11 having the authentication condition table described above will be described.

  FIG. 9 is a flowchart showing a method for controlling the memory card 11 according to the second embodiment of the present invention. Here, as in FIG. 4 of the first embodiment, the authentication method in the memory card 11 and the host B is shown.

  Since the setting method of the authentication condition table 31 of the memory card 11 in the host A is the same as that in the first embodiment, refer to FIG. The difference from the first embodiment is that, in the table creation step 42, as shown in FIG. 8, the essential condition “True” is set in the condition value “office 1” of the authentication condition “location”, and the other condition values are set. The essential condition is “False”.

  Further, since the method of using the memory card 11 according to the second embodiment of the present invention is the same as that of the first embodiment, refer to FIG.

  The authentication method in the host B according to the second embodiment of the present invention includes an authentication request step 71, an authentication permission determination step 72, a card authentication step 73, and a card access step 74.

  Further, the authentication method in the memory card 11 according to the second embodiment of the present invention includes a comparison information acquisition step 75, a table acquisition step 76, an essential condition comparison step 77, an essential condition determination step 78, an access lock step 79, and an authentication condition comparison step. 80, an authentication determination step 81, an authentication rejection notification step 82, an authentication permission notification step 83, a host authentication step 84, and a memory access step 85.

  Since the operation steps other than the essential condition comparison step 77, the essential condition determination step 78, and the access lock step 79 are the same as those in the first embodiment, detailed description thereof will be omitted.

  In the essential condition comparison step 77, the table comparison unit 23 compares the comparison information acquired by the comparison information acquisition unit 22 with the condition value of the authentication condition table 31 whose essential condition is “True”, and the comparison result and the essential condition are compared. The value “True” is transmitted to the controller 16 as a determination result.

  In the essential condition determination step 78, if the comparison result is “permitted” (“OK”), the controller 16 that has received the determination result performs authentication in order to compare condition values other than the essential condition as in the first embodiment. Control proceeds to the condition comparison step 80.

  If the comparison result is “not permitted” (“NG”), the controller 16 proceeds to the access lock step 79 in order to place the memory card 11 in the LOCK state.

  In the access lock step 79, the controller 16 shifts to a state in which all commands for accessing the security area 30 of the NAND memory 14 are ignored, and the memory card 11 enters the LOCK state. Thereafter, the authentication software immediately ends its operation.

  When the controller 16 enters this state, the memory card 11 cannot be accessed until it is released by the host A creation software.

  For example, in FIG. 3, since the host B is “location: Ome City, Tokyo”, it does not match the essential conditions of the authentication condition table 31. For this reason, the controller 16 of the memory card 11 locks the security area 30. Thereafter, even if the location of the host B is moved to “Office 1”, the security area 30 of the memory card 11 cannot be accessed.

  In the case of such mutual authentication “not permitted” due to the LOCK state, the authentication software of the host B outputs a message “<Card LOCK> Unable to access security area 30” on the display screen.

  To release the LOCK state of the memory card 11, it is necessary to start the creation software on the host A and perform an unlock operation on the creation software.

  According to the second embodiment, in addition to the effects described in the first embodiment, the memory card 11 is in the LOCK state when the essential condition is not satisfied, and the LOCK is generated unless the creation software of the host A that created the data is used. Since the state cannot be released, it is possible to realize a memory card with a protection function having higher security and its control method.

  For example, even when the memory card 11 is obtained by a third party that is not intended by the creator of the data due to loss of the memory card 11 or the like, the risk of reading stored important data is greatly reduced.

  In the above description of the first and second embodiments, the authentication conditions in the authentication condition table 31 are date, time, and place. However, the present invention is not limited to this, and other physical quantities such as, for example, The amount of light, volume, speed, atmospheric pressure, and other weather information may be used.

  In the description of the first embodiment and the second embodiment described above, the authentication information in the authentication condition table 31 is set to “permitted” or “not permitted”. However, the present invention is not limited to this. In addition, “area permission” that enables access to a specific area in the security area, “file permission” that enables access to a specific file on the memory card, and the like may be set.

1 is a circuit block diagram showing a memory card with a protection function according to Embodiment 1 of the present invention. 3 is a detailed view showing an authentication condition table of a memory card with a protection function according to Embodiment 1 of the present invention. FIG. 1 is an image diagram showing a method for using a memory card with a protection function according to Embodiment 1 of the present invention. FIG. 3 is a flowchart showing a method for setting an authentication condition table in the memory card with protection function and the host device according to the first embodiment of the present invention. 1 is a flowchart showing an authentication method in a memory card with a protection function and a host device according to Embodiment 1 of the present invention. The image figure which shows another authentication condition table in the memory card with a protection function concerning Example 1 of this invention. The image figure which shows another authentication condition table in the memory card with a protection function concerning Example 1 of this invention. The image figure which shows the authentication condition table in the memory card with a protection function concerning Example 2 of this invention. FIG. 6 is a flowchart showing an authentication method in a memory card with a protection function and a host device according to Embodiment 2 of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 Memory card 12 Host apparatus 13a-13i Connection terminal 14 NAND memory 15 Processor module 16 Controller 17 ROM
18 SRAM
19 Memory Interface 20 I / O Interface 21 Comparison Information Generation Unit 22 Comparison Information Acquisition Unit 23 Table Comparison Unit 24 Card Interface 25 CPU
26 System memory 27 Disk storage device 28 Authentication driver 29 User data area 30 Security area 31 Authentication condition table 41 Card initialization step 42 Table creation step 43 Table transmission step 44 Table reception step 45 Table determination step 46 Table update step 47 Table storage Step 48 Standby mode setting step 51, 71 Authentication request step 52, 72 Authentication permission determination step 53, 73 Card authentication step 54, 74 Card access step 55, 75 Comparison information acquisition step 56, 76 Table acquisition step 57, 80 Authentication condition comparison Steps 58 and 81 Authentication determination steps 59 and 82 Authentication rejection notification steps 60 and 83 Authentication permission notification steps 61 and 84 Host authentication steps 62 and 85 Memories Required Seth step 63 security access step 77 essential condition comparison step 78 conditional step 79 access lock step

Claims (5)

A security area provided in an electrically rewritable non-volatile memory and accessible by authentication software using a dedicated authentication driver;
“Authentication” or “Permit” for mutual authentication by the authentication software corresponding to the authentication condition stored in the security area and indicating a specific physical quantity, the condition value indicating the value or range of the authentication condition, and the condition value An authentication condition table with authentication information representing "not permitted";
Comparison information generating means for generating comparison information which is a current value of the physical quantity;
The comparison information acquired from the comparison information generating means is compared with the condition value acquired from the authentication table, and the authentication information corresponding to the condition value is determined when the comparison information matches the condition value. A table comparison unit that outputs as a result and outputs “not permitted” as a determination result when the comparison information does not match the condition value;
A memory card with a protection function, comprising authentication control means for determining whether mutual authentication by the authentication software is possible based on the determination result received from the table comparison means and notifying the outside. The authentication condition table is:
An authentication level representing a weight of the authentication condition corresponding to the authentication condition;
The table comparison means includes
Along with the determination result, the authentication level is further output as another determination result,
The authentication control means includes
When the other determination result received from the table comparison unit is equal to or greater than a predetermined value, whether to perform mutual authentication by the authentication software is determined based on the determination result received from the table comparison unit. The memory card with a protection function according to claim 1, wherein notification is made to the outside. The authentication condition table is:
Further comprising an authentication score representing the weight of the condition value corresponding to the condition value;
The table comparison means includes
Along with the determination result, the authentication score is further output as another determination result,
The authentication control means includes
When the determination result received from the table comparison means is “permitted”, the other determination results received from the table comparison means are sequentially added, and immediately when the sum exceeds a predetermined value, The memory card with a protection function according to claim 1, wherein mutual authentication by the authentication software is permitted. The authentication condition table is:
Further, an indispensable condition for setting “True” or “False” corresponding to the condition value is provided,
The table comparison means includes
Along with the determination result, further output the essential condition as another determination result,
The authentication control means includes
When the other determination result received from the table comparison unit is “True” and the determination result received from the table comparison unit is “non-permitted”, the nonvolatile memory from the authentication software immediately 2. The memory card with a protection function according to claim 1, wherein the memory card is in a state in which an access request command to the memory is not accepted. A method for controlling a memory card with a protection function, which is provided in an electrically rewritable non-volatile memory and has a security area accessible by authentication software using a dedicated authentication driver,
An authentication condition that represents a specific physical quantity, a condition value that represents the value of the authentication condition or a range of values, and authentication information that represents “permitted” or “not permitted” for mutual authentication by the authentication software corresponding to the condition value A table acquisition step of acquiring an authentication condition table from the security area;
A comparison information acquisition step of acquiring comparison information that is a current value of the physical quantity from a comparison information generation unit;
The comparison information acquired in the comparison information acquisition step is compared with the condition value of the authentication condition table acquired in the table acquisition step, and the authentication information is changed when the comparison information matches the condition value. An authentication condition comparison step that outputs as a determination result, and outputs “not permitted” as a determination result when the comparison information does not match the condition value;
A method for controlling a memory card with a protection function, comprising: an authentication determination step for determining whether or not mutual authentication by the authentication software is possible based on the determination result in the authentication condition comparison step.

Images