JP2006243871A - Method, system and program for managing ic card data - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable application to a general IC card and enhance the versatility of a program for generating an APDU command. <P>SOLUTION: A card data storage means 14 transmits a set of data identifiers to a card data management means 18. The card data storage means 14 acquires card data corresponding to the transmitted set of data identifiers from a card data management means 18. The card data storage means 14 acquires a set of command parameters corresponding to the set of data identifiers from a command parameter return means 12. A command generation/analysis means 13 generates a storage command sequence using the acquired set of command parameters and card data, and an IC card communication means 11 transmits the storage command sequence to the IC card 4. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an IC card data management method, an IC card data management system, and an IC card data management program in which an IC card management server manages card data of an IC card.

  An IC card management server that communicates with an IC card via an IC card reader and manages card data of the IC card performs communication with the IC card using an APDU command. The APDU command is a message composed of a byte string depending on the specifications of the IC card or the AP in the IC card. The IC card management server must create an APDU command according to the purpose of communication with the IC card and the card data to be used. Further, when accessing card data in an IC card from the IC card management server, different APDU commands must be generated depending on the data storage position in the IC card. However, when a program for generating an APDU command for each purpose is created in this way, there is a problem that the program for generating an APDU command is modified every time the specification is changed, and the versatility is lowered.

  Further, all or part of the card data managed in the IC card is managed by the IC card management server, but the card data storage method on the IC card management server is different from the card data storage method in the IC card. Therefore, it is difficult to associate the card data on the IC card management server with the card data on the IC card.

  For this reason, in the prior art, for APDU command generation, parameters are received and an APDU command is generated (Patent Document 1), or an APDU command is generated based on an APDU command generation script defined in a file (Patent Document 1). 2) has been carried out.

  As a method for simplifying access from the IC card management server to the card data in the IC card, accessing the card data in the IC card by SQL from the IC card management server is performed (Patent Document 3). In this case, since both the card data on the IC card management server and the card data in the IC card can be accessed by SQL, the problem that the association is difficult is solved.

JP 2000-347869 A Japanese Patent Laid-Open No. 2004-30055 JP 2004-206277 A

  However, in the above-described prior art related to APDU generation, information on where to store certain card data in the IC card needs to be given as a parameter, but a method for giving the information is not shown.

  In addition, when accessing the card data in the IC card by SQL from the IC card management server, it is necessary that the IC card OS has a function corresponding to the access by SQL, and other IC card OS is provided. It cannot be applied to general IC cards.

  The present invention has been made to solve the above-described problems, and can be applied to a general IC card, and the IC card data management method, IC card data management, and the versatility of a program for generating an APDU command are high. An object is to provide a system and an IC card data management program.

  To achieve this object, in the present invention, an IC card data management system in which an IC card management server storing card data is connected to an IC card terminal via a network, and an IC card reader is connected to the IC card terminal. In the IC card data management method using the IC card, the IC card management server manages the data identifier set for specifying the card data in association with the command parameter set of the command used for communication with the IC card. The card management server acquires the command parameter set based on the data identifier set, and the IC card management server generates a command sequence based on at least the command parameter set.

  In this case, the card data is acquired by the IC card management server based on the set of data identifiers, and the card data is transferred to the IC card by the IC card management server based on the command parameter set and the card data. A stored command sequence to be stored may be generated.

  Further, the IC card management server generates an acquisition command sequence for acquiring card data corresponding to the data identifier from the IC card based on the command parameter set, and the IC card management server acquires the command data from the IC card. The card data may be stored in association with the set of data identifiers.

  In these cases, the set of command parameters may include data type information indicating the data type of the card data.

  In these cases, the IC card is a file-type IC card, and the set of command parameters includes a directory identifier indicating a position where the card data is stored in the IC card, and a file of the card data stored in the IC card. And at least one of the file identifier, the record number of the file.

  When the IC card is a multi-application IC card, the set of command parameters may include an application identifier that identifies an application stored in the IC card.

  Also, in an IC card data management system in which an IC card management server storing card data is connected to an IC card terminal via a network, and an IC card reader is connected to the IC card terminal, the IC card management server is connected to the card. A set of data identifiers for specifying data and a set of command parameters for commands used for communication with the IC card are associated with each other, and the IC card management server determines the set of command parameters based on the set of data identifiers. Then, the IC card management server generates a command sequence based on at least the command parameter set.

  An IC card management server is connected to the IC card terminal via a network, an IC card reader is connected to the IC card terminal, and the IC card management server specifies a set of data identifiers for specifying the card data and the IC card. As an IC card management program for executing an IC card data management method using an IC card data management system that manages a set of command parameters of commands used for communication in association with each other, the IC card management server has the data identifier A program for executing a procedure for acquiring the command parameter set based on the set, and a procedure for generating a command sequence based on at least the command parameter set is used.

  Since the IC card data management method, IC card data management system, and IC card data management program according to the present invention do not use SQL, they can be applied to general IC cards, and command parameters specific to IC cards. Therefore, the program for generating APDU commands is highly versatile.

  FIG. 1 is a diagram showing a configuration of an IC card data management system according to the present invention, that is, an IC card data management system for implementing an IC card data management method according to the present invention. As shown in the figure, an IC card management server (computer) 1 is connected to an IC card terminal 2 via a network NW, and the IC card terminal 2 communicates with an IC card 4 inserted in an IC card reader 3. The IC card terminal 2 has a communication means 21 that mediates communication between the IC card management server 1 and the IC card 4. The IC card management server 1 has card data storage means 16 for managing all or part of card data managed in the IC card 4. Further, the IC card management server 1 has command parameter information storage means 17, and the command parameter information storage means 17 is used for communication with a set of data identifiers for specifying card data on the card data storage means 16 and the IC card 4. A command parameter set of a command to be used, that is, a command parameter set necessary for storing and acquiring card data in the IC card 4 is managed in association with each other.

  The IC card management server 1 includes an IC card communication unit 11, a command parameter return unit 12, a command generation / analysis unit 13, a card data storage unit 14, a card data acquisition unit 15, and a card data management unit 18. Then, the IC card communication means 11 and the IC card 4 via the communication means 21 of the IC card terminal 2 and a command sequence, that is, a storage command sequence for storing the card data stored in the card data storage means 16 in the IC card 4 and the IC An acquisition command sequence for acquiring card data corresponding to the data identifier from the card 4 is transmitted and received. Further, the command parameter return means 12 receives the data identifier set and acquires the command parameter set corresponding to the data identifier set from the command parameter information storage means 17. The command generation / analysis unit 13 generates a command sequence to be transmitted to the IC card 4 based on the set of command parameters, and transmits the command sequence to the IC card 4 by the IC card communication unit 11. Parse the response command. The card data storage unit 14 receives a set of data identifiers, acquires card data corresponding to the set of data identifiers from the card data storage unit 16, and stores the card data in the IC card 4. The card data acquisition unit 15 receives a set of data identifiers, acquires card data corresponding to the set of data identifiers from the IC card 4, and stores the card data in the card data storage unit 16. The card data management means 18 manages card data stored in the card data storage means 16.

  FIG. 2 is a diagram showing an example of card data managed by the IC card management server 1 and the IC card 4, respectively. The IC card 4 stores information necessary for executing the IC card service in a nonvolatile memory. In this example, the IC card 4 is loaded with three applications having application identifiers “112233345456678789900”, “112233454565677889999”, and “6789012345678890345”. In the application with the application identifier “11223345456567789900”, the card data “200” is managed in the file with the file identifier “0001”, and the card data “100” is managed in the file with the file identifier “0002”.

  The video point storage command sequence is a command sequence for accessing the file with the file identifier “0002” from the IC card management server 1 and storing (updating) the card data. This stored command sequence is composed of a plurality of APDU commands (byte strings transmitted to the IC card 4). “00A4040A0A11223334556767889900” is an APDU command (SELECT FILE command) for selecting an application with an application identifier “112223345456567789900”. “00A4020C020002” is an APDU command (SELECT FILE command) for selecting the file with the file identifier “0002”. “00DC010040164” is an APDU command (UPDATE RECORD command) for updating the first record of the record type file with data “64” (0x64 = 100). Thus, in order for the IC card management server 1 to update the card data in the IC card 4, it is necessary to be aware of the stored command sequence, not the card data storage form in the IC card 4. In FIG. 2, a set of data identifiers that the IC card management server 1 identifies card data is a “data identification name” and a unique “card ID” for each IC card 4. With regard to card data whose “data identification name” is “video point”, “air ticket point”, and “user PIN”, the card data can be specified by “data identification name” and “card ID”. The card data whose “data identification name” is “expiration date” is common to all card IDs, and therefore, the card data can be specified only by “data identification name”. For example, when the “data identification name” is “expiration date”, the “card ID” is set to “NULL”. In the present invention, the card data of the data identification name “video point” managed by the IC card management server 1 corresponds to the card data of the file identifier “0002” of the application identifier “1122345456567789900” managed in the IC card 4. Is managed on the IC card management server 1.

  FIG. 3 is a diagram showing an example of command parameter information of card data corresponding to FIG. As shown in the figure, the set of data identifiers is SID1 and SID2. The command parameter groups CP1 to CP4 are managed by a DB file or the like. SID1 indicates a data identification name on the IC card management server 1. SID2 indicates which card ID is the card data for the IC card 4. CP 1 indicates an application identifier of an application stored in the IC card 4. CP2 indicates the type of file of card data stored in the IC card 4. CP3 indicates an identifier of a file of card data stored in the IC card 4. CP4 indicates the data type of the card data. That is, CP4 “INT” indicates that the card data is a numerical type. CP4 “SJIS” indicates that the card data is of a character type. Therefore, in the case of the card data “100” and CP4 “INT”, it indicates that the card data “100” is treated as a numerical value and converted to 0x64 in the APDU command. Further, in the case of card data “100” and CP4 “SJIS”, it indicates that the card data “100” is treated as a character and converted to 0x31030 in the APDU command. As described above, by including the data type information in the command parameter set, the card data on the IC card management server 1 can be converted into the data type of the card data on the IC card 4. When the command parameter return unit 12 receives the data identifier sets SID1 and SID2, the command parameter return unit 12 searches the corresponding command parameter sets CP1 to CP4.

  Further, in the case shown in FIG. 3, if the IC card 4 is a file type IC card, CP1 indicates a directory identifier indicating a position where the card data is stored in the IC card 4. CP2 indicates the file type of card data stored in the IC card 4. CP3 indicates an identifier of a file of card data stored in the IC card 4. CP4 indicates the data type of the card data. In the case shown in FIG. 3, the record number of the file of card data stored in the IC card 4 is not included in the parameter, and the record number is fixed at “1”.

  Further, in the case shown in FIG. 3, if the IC card 4 is a multi-application IC card, CP1 indicates an application identifier for identifying an application stored in the IC card 4. CP2 to CP4 are parameters necessary for generating an application storage command sequence and an acquisition command sequence in the IC card 4. In this example, the first SELECT FILE is a command for selecting an application, and the second SELECT FILE is a command for an application selected by the third UPDATE RECORD.

  FIG. 4 is a diagram showing another example of command parameter information of card data corresponding to FIG. As shown in the figure, the sets of data identifiers are SID1 to SID4. Command parameter sets are CP1 to CP4. In the case shown in FIG. 4, the IC card management server 1 manages card data in a DB / file or the like of the card data storage means 16, and information specifying the storage location on the DB / file is included in a set of data identifiers. include. That is, SID1 indicates a method for managing card data on the IC card management server 1. When the card data is managed in the DB, the data identifier other than SID1 is a DB table name, a search key set, a column name, and the like. In the case shown in FIG. 4, SID2 and SID3 are DB search key pairs, and SID4 is a column name. If the card data is managed in a file, the data identifier other than SID1 is the directory name of the file, the file name, the data identification name that identifies the card data defined in the file, and the card data in the file. And so on. In the example shown in FIG. 4, SID3 is a file name, and SID4 is a data identification name in the file. CP1 to CP4 are the same as those shown in FIG. 3, but in the case shown in FIG. 4, command parameter information is managed by a plurality of tables. Thus, command parameters may be managed by a plurality of tables that define partial correspondences between data identifiers and command parameters. Upon receiving the data identifier sets SID1 to SID4, the command parameter return means 12 searches for the corresponding CP1 (application identifier) from SID3, and from SID3 and SID4 to CP2 to CP4 (file type, file identifier, card (Data type of data) is retrieved, and command parameter sets CP1 to CP4 are returned.

  With reference to FIG. 5, description will be given of a card data storing process in the IC card 4 when the card data and command parameter information are those shown in FIG. 4, that is, an IC card data management method according to the present invention. First, when the card data storage means 14 receives a set of data identifiers SID1 “DB”, SID2 “FFFF”, SID3 “AP1”, and SID4 “Video”, the card data storage means 14 sends a data identifier to the card data management means 18. The card data storage means 14 acquires the card data SData “100” corresponding to the transmitted data identifier sets SID1 to SID4 from the card data management means 18. Next, the card data storage means 14 transmits the data identifier sets SID1 to SID4 to the command parameter return means 12, and the card data storage means 14 sends the command parameters corresponding to the data identifier sets SID1 to SID4 from the command parameter return means 12. Set CP1 “112233345456678789900”, CP2 “record”, CP3 “0002”, and CP4 “INT”. Next, the card data storage means 14 instructs the command generation / analysis means 13 to generate a stored command sequence using the command parameter sets CP1 to CP4 and the card data “100” as parameters. Next, the command generating / analyzing unit 13 generates a stored command sequence using the command parameter sets CP1 to CP4 and the card data “100” as parameters, and the IC card communication unit 11 transmits the stored command sequence to the IC card 4. Further, the command generation / analysis means 13 confirms that the response command from the IC card 4 is normal (that it is 9000).

  In this way, the card data stored on the IC card management server 1 by the card data storage means 14 can be reflected on the IC card 4 simply by giving the data identifier sets SID1 to SID4. This function can be used, for example, when initial information for the IC card 4 is stored on the IC card management server 1 and initial card data is written to the IC card 4. Further, the card data can be backed up on the IC card management server 1 and used when the card data on the IC card 4 is updated using the card data.

  In this case, as an IC card data management program, the procedure for obtaining the card data SData “100” corresponding to the data identifier sets SID1 to SID4 in the IC card management server 1 and the command parameters corresponding to the data identifier sets SID1 to SID4 A procedure for obtaining a set of command parameters CP1 to CP4, a procedure for generating a stored command sequence using the command parameter sets CP1 to CP4 and the card data “100” as parameters, a procedure for transmitting the stored command sequence to the IC card 4, Use a command that executes a procedure to confirm that the response command is normal.

  Next, a process for acquiring card data from the IC card 4 when the card data and command parameter information are those shown in FIG. 4, that is, the IC card data management method according to the present invention will be described with reference to FIG. First, when the card data acquisition means 15 receives a set of data identifiers SID1 “DB”, SID2 “FFFF”, SID3 “AP1”, SID4 “Video”, the card data acquisition means 15 sends a data identifier to the command parameter return means 12. The card data acquisition means 15 transmits a set of command parameters corresponding to the transmitted data identifier sets SID1 to SID4 CP1 “11223434556767889900”, CP2 “record”, CP3 “0002”, CP4 “INT”. Is obtained from the command parameter return means 12. Next, the card data acquisition means 15 instructs the command generation / analysis means 13 to generate an acquisition command sequence using the command parameter sets CP1 to CP4 as parameters. Next, the command generation / analysis unit 13 generates an acquisition command sequence based on the command parameter sets CP1 to CP4, and transmits the acquisition command sequence to the IC card 4 by the IC card communication unit 11. The command generation / analysis means 13 analyzes the response command from the IC card 4 and extracts the card data “100”. Next, the card data acquisition means 15 receives the card data “100” from the command generation / analysis means 13, and the card data acquisition means 15 sets the set of data identifiers stored in the card data storage means 16 by the card data management means 18. The card data corresponding to SID1 to SID4 is updated to “100”.

  In this way, the card data stored on the IC card 4 by the card data acquisition means 15 can be stored in the card data storage means 16 of the IC card management server 1 simply by giving the data identifier sets SID1 to SID4. This function can be used, for example, when the card data on the IC card 4 is backed up on the IC card management server 1.

  In this case, as an IC card data management program, the IC card management server 1 acquires the command parameter sets CP1 to CP4 corresponding to the data identifier sets SID1 to SID4, and the command parameter sets CP1 to CP4 as parameters. A procedure for generating a command sequence, a procedure for transmitting an acquisition command sequence to the IC card 4, a procedure for analyzing a response command from the IC card 4 and extracting card data, and card data corresponding to the data identifier sets SID1 to SID4 Use the one that causes the update procedure to be executed.

  The command generation / analysis means 13 described with reference to FIGS. 5 and 6 is realized as a known technique. However, in order to clarify the whole of the present invention, an example of implementation of the command generation / analysis means 13 will be described below. explain. In an example of implementation of the command generation / analysis means 13, an APDU command format definition as shown in FIG. 7 is held in a file or program. When receiving the command generation request, the command generation / analysis means 13 selects the corresponding command format definition from the input parameters. In the case of the command parameter set CP1 “112233345456678789900”, CP2 “record”, CP3 “0002”, CP4 “INT”, command type “storage”, and card data “100”, CP2 “record” is stored from CP2 and command type. A command generation sequence is selected. Also, with CP4 “INT”, DATA “100” is regarded as a numerical value and converted to 0x64. “112233445556778789900”, “0002”, and “64” are assigned to CP1, CP3, and DATA of the selected sequence, respectively, to generate a stored command sequence. Similarly, in the case of the command type “acquisition”, the acquisition command generation sequence is acquired. However, in the case of the acquisition command generation sequence, the response command is analyzed after the response command is received. For the analysis of the response command, the acquisition command analysis sequence is selected according to CP2 and the command type. When the command parameter set CP1 “11223434556767889900”, CP2 “record”, CP3 “0002”, CP4 “INT”, and command type “acquire” and the response command from the IC card 4 is “900064”, the CP2 “record” The acquisition command analysis sequence is selected. Since the value corresponding to DATA is “64”, 0x64 is acquired. Also, CP4 “INT” converts 0x64 into a numerical value and returns DATA “100”.

  When the command is generated and analyzed in this way, the card data in the IC card 4 stored with the same set of command parameters is the same as the card data in the acquired IC card 4.

  Since such an IC card data management method, IC card data management system, and IC card data management program do not use SQL, they can be applied to a general IC card 4. Further, a process for updating the card data on the IC card 4 with the card data on the IC card management server 1 and a process for acquiring the card data on the IC card 4 on the IC card management server 1 are performed. Since it can be performed based on the above set of card data identifiers and can communicate with the IC card 4 without being aware of the command parameters specific to the IC card 4, the versatility of the program for generating the APDU command Is expensive. Further, when the card data specification is changed, it is possible to cope with the change by simply changing the command parameter information.

It is a figure which shows the structure of the IC card data management system which concerns on this invention. It is a figure which shows the example of the card data each managed with an IC card management server and an IC card. It is a figure which shows the example of the command parameter information of the card data corresponding to FIG. It is a figure which shows another example of the command parameter information of the card data corresponding to FIG. It is explanatory drawing of the storing process of the card data to an IC card. It is explanatory drawing of the acquisition process of the card data from an IC card. It is a figure which shows an APDU command format definition.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... IC card management server 2 ... IC card terminal 3 ... IC card reader 4 ... IC card

Claims (8)

In an IC card data management method using an IC card data management system in which an IC card management server in which card data is stored is connected to an IC card terminal via a network, and an IC card reader is connected to the IC card terminal.
The IC card management server associates and manages a set of data identifiers for specifying the card data and a set of command parameters for commands used for communication with the IC card,
Based on the data identifier set by the IC card management server, the command parameter set is acquired,
An IC card data management method, wherein the IC card management server generates a command sequence based on at least the set of command parameters. The card data is acquired based on the set of data identifiers by the IC card management server,
2. The IC card data management method according to claim 1, wherein the IC card management server generates a storage command sequence for storing the card data in the IC card based on the command parameter set and the card data. . Generating an acquisition command sequence for acquiring card data corresponding to the data identifier from the IC card based on the set of command parameters by the IC card management server;
2. The IC card data management method according to claim 1, wherein the card data acquired from the IC card by the IC card management server is stored in association with the set of data identifiers.   4. The IC card data management method according to claim 1, wherein the set of command parameters includes data type information indicating a data type of the card data.   The IC card is a file type IC card, and the set of command parameters includes a directory identifier indicating a position where the card data is stored in the IC card, a file type of the card data stored in the IC card, 5. The IC card data management method according to claim 1, further comprising at least one of a file identifier and a record number of the file.   5. The IC card according to claim 1, wherein the IC card is a multi-application IC card, and the set of command parameters includes an application identifier for identifying an application stored in the IC card. The IC card data management method described. In an IC card data management system in which an IC card management server storing card data is connected to an IC card terminal via a network, and an IC card reader is connected to the IC card terminal.
The IC card management server associates and manages a set of data identifiers for specifying the card data and a set of command parameters for commands used for communication with the IC card,
The IC card management server acquires the command parameter set based on the data identifier set,
An IC card data management system, wherein the IC card management server generates a command sequence based on at least the set of command parameters. An IC card management server is connected to the IC card terminal via a network, an IC card reader is connected to the IC card terminal, and the IC card management server communicates a set of data identifiers specifying the card data with the IC card. In an IC card management program for executing an IC card data management method using an IC card data management system that manages a set of command parameters associated with a command to be used,
In the IC card management server,
A procedure for obtaining the set of command parameters based on the set of data identifiers;
An IC card data management program for executing a procedure for generating a command sequence based on at least the set of command parameters.

Images