JP2006338311A - Computer system for processing device loaded with multiple applications, device and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an IC card system comprising a multi-application IC card and a host computer, and allowing the host computer to perform processing on the basis of dependency relation between applications. <P>SOLUTION: A security domain 12 of the multi-application IC card 10 has application attribute management information 120 showing the dependency relation of an object of the application 13, and manages execution of a command such as additional loading/deletion of the application 13. The application attribute management information 120 is transmitted to the host computer 20 as a response of a SELECT command 110 of a card manager 11. The host computer 20 generates a script of the command transmitted to the IC card 10 in reference to the application attribute management information 120, and processes the IC card 10. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a device on which an IC chip capable of mounting a plurality of applications in a rewritable memory, and a computer system using the device, and more specifically, based on a dependency relationship between applications mounted on the device. Technology for processing devices.

  A multi-application IC card on which an IC chip that can be installed in a rewritable nonvolatile memory is mounted, particularly a multi-application IC card having an intermediate language translation function represented by JAVA (registered trademark). In order to effectively use hardware resources (for example, EEPROM), program codes and data are often shared among a plurality of applications.

  If a program code or data is shared among a plurality of applications in a multi-application IC card, security regarding access between applications may become weak. For this reason, the applicant of the present invention, in Patent Document 1, each application mounted on the multi-application IC card has shared management information including application management information, access management information, authentication management information, etc. An IC card that can increase security for access to the Internet is provided.

  However, the sharing management information in Patent Document 1 is information for the multi-application IC card itself to manage access between applications, and the host computer that processes the IC card cannot use this sharing management information. There was a problem.

For example, when the application A uses the program code of the application B, if the application B is deleted, the application A does not operate normally. Therefore, a technique such as Patent Document 1 is used, and it is prohibited to delete only the application B. May be. In this case, when the application B is deleted, the application A must be deleted at the same time. However, since the host computer does not know the dependency relationship between the applications, the application A cannot be deleted immediately together with the application B. .
JP 2002-73196 A

  In view of the above problems, the present invention provides a device in which an IC chip that can be mounted on a rewritable non-volatile memory, preferably a multi-application IC card, in a computer system using a host computer, An object of the present invention is to provide a computer system capable of performing processing of the device based on the dependency relationship between applications installed in the device, a device used in the computer system, and a program incorporated in the host computer. And

  A first invention for solving the above-described problem is a device in which an IC chip that can be mounted on a rewritable nonvolatile memory in which a plurality of applications are mounted, and the device includes a dependency relationship between the mounted applications. Application attribute management information is stored, and the device refers to the application attribute management information and management information transmission means for transmitting the application attribute management information to the external terminal device in accordance with an instruction from the external terminal device. Determination means for determining execution of a command that affects the dependency relationship, and updating the application attribute management information based on a processing content of the command when executing the command that affects the dependency relationship. It is characterized by.

  According to the device described in the first invention, the device stores the application management information, and includes the management information transmitting unit that transmits the application management information to the external terminal device, thereby using the device. The application management information can be transmitted to the external terminal device, and in addition, the device includes the determination unit, so that the device can manage execution of a command that affects the dependency relationship. It is possible to increase security when executing a command that affects the dependency.

  Furthermore, according to a second aspect, in the device according to the first aspect, the application attribute management information included in the device includes information on mutual use of objects included in each of the mounted applications. Features.

  Further, according to a third invention, in the device according to the first invention or the second invention, the command determined by the determination means includes a command for additionally mounting the application on the device, and the determination means Updates the application attribute management information based on information transmitted from the external terminal device and indicating a dependency relationship between the other applications when executing a process of additionally mounting the application on the device It is characterized by doing.

  Further, according to a fourth invention, in the device according to any one of the first to third inventions, the command managed by the determination means includes a command for deleting the application from the device, The determination unit updates the application attribute management information based on the application to be deleted when executing the process of deleting the application from the device.

  According to the device of the second to fourth aspects of the invention, the application attribute management information includes information on the mutual use of objects included in each of the installed applications, so that the application is stored in the device. When executing a command to be additionally installed or a command for deleting the application from the device, the processing efficiency of these commands can be improved, and adverse effects (for example, malfunction) due to the execution of these commands can be prevented. .

  Furthermore, a fifth invention is the device according to any one of the first to fourth inventions, wherein at least when the device succeeds in the authentication of the external terminal device, the management information transmitting means The application attribute management information is transmitted to the external terminal device.

  According to the fifth invention, the application attribute management information can be transmitted only to the external terminal device authorized in advance, and misuse of the application attribute management information can be prevented.

  Further, a sixth invention is a device according to any one of the first to fifth inventions, wherein the device is an IC card on which a multi-application IC chip is mounted.

  Here, the IC card means a credit card size IC card, a SIM card built in a mobile phone, and the communication interface of the IC card is a contact type, a non-contact type, or a contact / non-contact type. Either type may be used. For example, the present invention can be applied to a mobile phone system by using an IC card as a SIM card.

  Furthermore, a seventh invention is a computer system using the device according to any one of the first invention to the sixth invention and a host computer, wherein the host computer sends the application attribute management information from the device. Management information acquisition means for acquiring information, and device processing for generating a script of a command to be transmitted to the device according to the application attribute management information acquired by the management information acquisition means, and processing the device using the generated script And a computer system.

  Further, an eighth invention is the computer system according to the seventh invention, wherein one of the commands transmitted to the device according to the application attribute management information acquired by the management information acquisition means of the host computer is The computer system is a command for adding an application to the device.

  Further, a ninth invention is the computer system according to the seventh or eighth invention, wherein the computer attribute information is transmitted to the device according to the application attribute management information acquired by the management information acquisition means of the host computer. One of the commands is a computer system that deletes an application from the device.

  According to any of the seventh to ninth inventions, the host computer can use the application management information, so that, for example, a process of additionally mounting an application on the device or an application is deleted from the device When performing processing, the computer does not send a useless command to the device, and the processing efficiency of the device can be improved.

  The tenth invention is a computer program for causing a computer to function as management information acquisition means and device processing means provided in a host computer constituting the computer system according to the seventh to tenth inventions. is there.

  According to the present invention described above, in a computer system using a device, preferably a multi-application IC card, on which an IC chip that can be mounted on a rewritable nonvolatile memory in which a plurality of applications are mounted, a host computer is mounted on this device. In addition, it is possible to provide a computer system capable of performing processing of this device, a device used in this computer system, and a program incorporated in the host computer based on the dependency relationship between the applications.

  From here, an IC card system which is a computer system according to the present invention and a multi-application IC card used in the IC card system will be described in detail with reference to the drawings. FIG. 1 is a diagram for explaining the configuration of an IC card system. As shown in FIG. 1, an IC card system according to the present invention includes a multi-application IC card 10 (hereinafter abbreviated as an IC card) that is a device of the present invention, and a card reader (not shown). The host computer 20 is in data communication with the IC card 10.

  FIG. 2 is a block diagram of the IC card system of FIG. First, the IC card 10 will be described with reference to FIG. As shown in FIG. 2, the IC card 10 has an intermediate language virtual machine 14 as software and a card manager 11 (hereinafter referred to as CM) having a card issuer security domain 12 as a program operating on the intermediate language virtual machine 14. : Card Manager) and a plurality of applications 13 are installed.

  The intermediate language virtual machine 14 is a program that has a function of interpreting an intermediate language and serves as an execution environment of the application 13 or the like. The program code of the intermediate language virtual machine 14 is stored in a nonvolatile memory (for example, the IC card 10). ROM). As intermediate language virtual machines 14 for IC cards, JAVA (registered trademark) and MULTIS (registered trademark) are well known.

  The application 13 operating on the intermediate language virtual machine 14 is a program written in an intermediate language corresponding to the intermediate language virtual machine 14 and designed for a specific use. The program code of the application 13 is stored in a rewritable nonvolatile memory (for example, EEPROM) of the IC card 10.

  The CM 11 is a program that acts as an agent of the issuer of the IC card 10 in the IC card 10 and has the security domain 12 of the issuer of the IC card 10. The CM 11 has an IC IC in addition to the function of the security domain 12 described later. A function of authenticating the owner of the card 10 is provided. The program code of the CM 11 is described in an intermediate language corresponding to the intermediate language virtual machine 14, and is preferably mounted in a nonvolatile memory (for example, ROM) of the IC card 10.

  The security domain 12 included in the CM 11 has a function of securely adding an application 13 to the IC card 10 and a function of securely deleting the application 13 mounted on the IC card 10. The security domain 12 has a public key for securely mounting / deleting the application 13, and verifies the digital signature of the application 13 when the application 13 is additionally mounted / deleted. Only when the verification of the digital signature is successful, the security domain 12 additionally installs / deletes the application 13.

  In addition, in order to prevent the IC card 10 from malfunctioning after the application 13 is additionally installed / deleted, the security domain 12 adds the above-described functions to the objects of each application 13 installed in the IC card 10. When the application attribute management information 120 describing at least the dependency relationship is stored and the application 13 is additionally mounted / deleted, the application attribute management information 120 is referred to, and execution of the additional mounting / deletion of the application 13 is managed.

  The security domain 12 updates the application attribute management information 120 according to the contents of the additional installation / deletion of the application 13 on the IC card 10 every time the application 13 is additionally installed / deleted on the IC card 10.

  FIG. 3 is a diagram for explaining object dependency between applications 13 mounted on the IC card 10. In FIG. 3, three applications A to C are stored in the security domain 12 (in FIG. 3, no sign is added to each application). Each of the applications A to C has a plurality of objects 130. In FIG. 3, as the sharing of the objects 130, the application A refers to the object 130 of the application B, and the application B refers to the object 130 of the application C. ing.

  In FIG. 3, considering that application B is deleted, application A refers to application B. Therefore, when application B is deleted, application A does not operate normally. Therefore, application B cannot be deleted alone, and when application B is deleted, application A must also be deleted. Similarly, application C cannot be deleted alone, and when application C is deleted, application A and application B must be deleted. Note that application A is not referenced by other applications B and C, and application A can be deleted alone.

  FIG. 4 is a diagram showing an example of the application attribute management information 120 showing the dependency relationship of the application 13 described in FIG. 3. In this embodiment, the security domain 12 stores the application attribute management information 120 in the matrix 120a. Manage with. In this matrix 120a, the dependency of the application 13 is indicated by the row of the matrix 120a, and “1” in each column means that the application 13 in that row refers to the application 13 in that column. “0” means that the application 13 in the row does not refer to the application 13 in the column. In FIG. 4, the application attribute management information 120 indicates that application A refers to application B and application B refers to application C.

  In the security domain 12, when the application 13 is additionally mounted on the IC card 10, the CM newly generates a row and a column corresponding to the application 13 additionally mounted on the IC card 10 in the matrix 120a of FIG. Information corresponding to the row of the application attribute management information 120 is transmitted from the issuing device (for example, the host computer 20), and the security domain 12 writes the received information on the new row. When deleting the application 13 from the IC card 10, the row and column corresponding to the application 13 to be deleted from the IC card 10 are deleted from the matrix 120a in FIG.

  If the host computer does not know the dependency relationship between the applications 13 as described above, the host computer 20 deletes the application 13 by thinking and error, and therefore deletes the application 13 that originally does not need to be deleted. there is a possibility. Even if the host computer 20 knows the dependency at the time of issuing the IC card 10, if the application 13 is added after the IC card 10 is issued, the dependency at the time of issuing the IC card 10 has no meaning.

  Therefore, in order for the host computer 20 to use the application attribute management information 120, the CM 11 of the IC card 10 includes management information transmission means for transmitting the application attribute management information 120 to the host computer 20. This management information transmitting means is realized by a command for processing a command APDU (Application Protocol Data Unit) transmitted from the host computer 20, and in the present embodiment, the management information transmitting means is a SELECT command 110 for selecting the security domain 12 or the application 13. It has been realized.

  When the CM 11 receives a SELECT command APDU for selecting the security domain 12 from the host computer 20, the CM 11 executes an execution result of the SELECT command 110 and an application of the security domain 12 when the SELECT command 110 is normally executed. A response APDU including the attribute management information 120 is transmitted to the host computer 20. Note that the management information transmitting means described above can also be realized by a read command (for example, a READ command).

  From here, the host computer 20 shown in FIG. 2 will be described. The host computer 20 transmits a SELECT command APDU for selecting the security domain 12 to the IC card 10 and acquires the application attribute management information 120 from the IC card 10, and the application acquired by the management information acquisition unit 21 Based on the attribute management information 120, a script of a command to be transmitted to the IC card 10 is generated, and IC card processing means 22 for processing the IC card 10 using the generated script is provided.

  The host computer 20 acquires the application attribute management information 120 using the management information acquisition unit 21, and the IC card processing unit 22 refers to the acquired application attribute management information 120 and creates a script of a command to be transmitted to the IC card 10. The IC card 10 is processed using the generated script.

  When the application 13 is additionally mounted on the IC card 10, the application attribute management information 120 is referred to. When the application 13 referred to by the additionally mounted application 13 is not mounted, the referenced application 13 is also additionally mounted. To do. When deleting the application 13 from the IC card 10, the application attribute management information 120 is referred to and the application 13 that refers to the application 13 to be deleted is also deleted.

  For example, when deleting the application B in FIG. 3, the management information acquisition unit 21 of the host computer 20 transmits a SELECT command APDU and acquires the application attribute management information 120 of the security domain 12. Then, the IC card processing means 22 extracts all the applications 13 that depend on the application B from the acquired application attribute management information 120 (here, application A), and a command script for deleting the application A together with the application B , And delete application B and application A from the IC card 10.

The figure explaining the IC card system which concerns on this invention. 1 is a block diagram of an IC card system. The figure explaining sharing of the object between applications. The figure explaining application attribute management information.

Explanation of symbols

10 IC card 11 card manager 110 SELECT command 12 security domain 120 application attribute management information 13 application 130 object 14 intermediate language virtual machine 20 host computer 21 management information acquisition means 22 IC card processing means

Claims (10)

  In a device on which an IC chip capable of mounting a plurality of applications in a rewritable nonvolatile memory is mounted, the device stores application attribute management information including dependency between the mounted applications, and the device In accordance with an instruction from the external terminal device, a management information transmitting unit that transmits the application attribute management information to the external terminal device, and a command that affects the dependency relationship by referring to the application attribute management information. A device comprising: a determination unit that determines and updates the application attribute management information in accordance with an execution content of the command when the command is determined and executed.   The device according to claim 1, wherein the application attribute management information included in the device includes information on mutual use of objects included in each of the installed applications.   The device according to claim 1 or 2, wherein the command determined by the determination unit includes a command for additionally mounting the application on the device, and the determination unit additionally mounts the application on the device. And a device for updating the application attribute management information based on information transmitted from the external terminal device and indicating a dependency relationship between the other applications.   The device according to any one of claims 1 to 3, wherein the command managed by the determination unit includes a command for deleting the application from the device, and the determination unit includes the application from the device. A device that updates the application attribute management information based on the application to be deleted when executing the deletion process.   5. The device according to claim 1, wherein the management information transmitting unit transmits the application attribute management information to the external terminal device only when the device succeeds in authentication of the external terminal device. A device characterized by transmitting to.   6. The device according to claim 1, wherein the device is an IC card on which a multi-application IC chip is mounted.   7. A computer system using the device according to claim 1 and a host computer, wherein the host computer acquires management information acquisition means for acquiring the application attribute management information from the device, and the management information acquisition A computer system comprising: device processing means for generating a script of a command to be transmitted to the device according to the application attribute management information acquired by the means, and processing the device using the generated script .   8. The computer system according to claim 7, wherein one of the commands transmitted to the device according to the application attribute management information acquired by the management information acquisition unit of the host computer additionally mounts an application on the device. A computer system characterized by being a command.   9. The computer system according to claim 7, wherein one of commands sent to the device in accordance with the application attribute management information acquired by the management information acquisition unit of the host computer is an application from the device. A computer system characterized by being a command for deleting a file. A computer program for causing a computer to function as management information acquisition means and device processing means provided in a host computer constituting the computer system according to claim 7.

Images