JP2007019754A - System for specifying identification information, identification information conversion apparatus, data transfer terminal, tamper-resistant apparatus, and method for specifying identification information - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for specifying identification information, identification information conversion apparatus, tamper-resistant apparatus, and identification information specifying method which make possible to specify identification information according to a service provider, even if a plurality of identification information for every service providers are not stored in the tamper-resistant apparatus. <P>SOLUTION: An IC card 100 responds to an encryption command APDU (Application Protocol Data Unit) for requesting common identification information sent from a server 300, and returns an encryption response APDU for replying the common identification information. A POS terminal 200 adds an SP (service provider) signature and a public key certificate to the encryption response APDU, then transmits to the server 300. The server 300 specifies an individual identification information relating to the common identification information and service provider identification information, and notifies to the POS terminal 200. The POS terminal 200 performs service provision using the individual identification information. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an identification information specifying system, an identification information conversion device, a data exchange terminal, a tamper resistant device, and a tamper resistant device that identify identification information necessary for providing a service provided by a service provider to a tamper resistant device user. The present invention relates to a method for identifying identification information.

  Conventionally, notification of identification information from a tamper-resistant device to a data transmission / reception terminal is performed based on a standardization technique or the like. That is, different identification information is stored in the tamper-resistant device according to each service provider (SP), and the tamper-resistant device transmits / receives each data by controlling access to each identification information using a data key. Appropriate identification information is notified to the terminal. The data transmission / reception terminal provides a service based on the identification information.

  As a specific example, for example, an IC card corresponds to a tamper resistant device, and an IC card reader / writer corresponds to a data transfer terminal. Communication establishment and data exchange (exchange of APDU (Application Protocol Data Unit)) based on ISO7816 are performed between the IC card and the IC card reader / writer. The identification information stored in the IC card is embedded in the APDU and notified to the IC card reader / writer, so that the IC card reader / writer analyzes the APDU and obtains the identification information. When the IC card and the IC card reader / writer share the data key, the encrypted data (Secure Message) is sent and received to control access to the application, detect falsification of the exchanged data, and conceal it. , Safely notify the identification information. Also, different identification information depending on the service provider is stored in the IC card by a technique for mounting a plurality of applications such as a Java (registered trademark) card.

Patent Document 1 exists as a document describing technical contents for storing a plurality of different identification information in an IC card. Patent Document 1 discloses a technical content for providing a user with a plurality of member services using a plurality of member numbers stored in an IC card.
JP-A-10-255120 (paragraphs 0007, 0008)

However, the storage capacity of a memory provided in a tamper resistant device such as an IC card is limited, and the number of applications that can be stored in the memory, that is, the number of identification information is also limited. Therefore, it is difficult to store all of a plurality of pieces of identification information required according to the service provider in the same tamper resistant device. Moreover, even if it can be stored, the load on the tamper resistant device increases.
The present invention has been made in view of the problems as described above, and the object of the present invention is to respond to the service provider without storing a plurality of identification information for each service provider in the tamper-proof device. It is to provide an identification information specifying system, an identification information conversion device, a data transmission / reception terminal, a tamper resistant device, and an identification information specifying method that can specify the identification information.

  In order to solve the above problems, the invention described in claim 1 is an identification information specifying system including a tamper resistant device, a data transfer terminal, and an identification information converting device, wherein the tamper resistant device is stored in the own device. A common identification information management means for managing the common identification information being managed, and a communication means for transmitting the common identification information managed by the common identification information management means when receiving service provided by the service provider, The data transmission / reception terminal includes a data relay unit that relays data exchange between the tamper resistant device and the identification information conversion device, and a service for identifying the service provider in data relayed by the data relay unit Service provider identification information providing means for providing provider identification information, and the identification information conversion device includes the common identification information and the service provider. In association with other information, individual identification information management means for managing individual identification information necessary for the data transfer terminal to provide a service by the service provider to a user of the tamper resistant device; An individual for identifying individual identification information associated with the common identification information acquired from the tamper-proof device and the service provider identification information acquired from the data transfer terminal based on information managed by the individual identification information management means There is provided an identification information specifying system comprising: identification information specifying means; and communication means for notifying the data transmitting / receiving terminal of individual identification information specified by the individual identification information specifying means.

  According to the present invention, the identification information conversion device can store the common identification information acquired from the tamper resistant device and the service provider identification information acquired from the data transfer terminal only by storing the common identification information in the tamper resistant device. Since the individual identification information to be associated is specified and notified to the data transmission / reception terminal, the data transmission / reception terminal can provide a service by the service provider to the user of the tamper resistant apparatus using the individual identification information. As described above, since the individual identification information corresponding to the service provider can be specified without storing the plurality of identification information for each service provider in the tamper resistant device, the plurality of identification information is stored in the tamper resistant device. The burden of storing can be reduced.

According to a second aspect of the present invention, the service provider associates the common identification information stored in the tamper resistant device with the service provider identification information for identifying the service provider, and the service provider provides the tamper resistant device. Individual identification information management means for managing individual identification information necessary for providing a service to a user, and common identification information and service provision based on information managed by the individual identification information management means There is provided an identification information conversion device comprising individual identification information specifying means for specifying individual identification information associated with person identification information.
According to the present invention, the identification information conversion device can specify individual identification information corresponding to the service provider without storing a plurality of identification information for each service provider in the tamper resistant device. The burden of storing a plurality of pieces of identification information can be reduced.

The invention according to claim 3 is managed by the data key management means for managing the data key shared with the tamper resistant apparatus and the data key management means in the identification information conversion apparatus according to claim 2. Using the data key, the tamper-resistant device generates encrypted data for requesting the common identification information to the tamper-resistant device, and the data key managed by the data key management unit is used. It further comprises encryption data analysis means for obtaining common identification information of the tamper resistant device by analyzing the encrypted data acquired from the device.
According to the present invention, the identification information conversion device can encrypt and analyze data exchanged with the tamper resistant device using a data key shared with the tamper resistant device, and provide a data exchange terminal and service provision The personal identification information and personal information linked to the common identification information can be prevented from leaking to the person, and the privacy problem can be solved.

According to a fourth aspect of the present invention, in the identification information conversion device according to the second or third aspect, the service is provided based on the service provider identification information obtained from the data transmitting / receiving terminal and including the calculation result for the encrypted data. Service provider authentication means for authenticating a person is further provided.
According to this invention, it is possible to prevent the individual identification information from being illegally acquired by the identification information conversion apparatus authenticating the service provider. Furthermore, by authenticating the service provider using operations on encrypted data as random data, the burden of generating random data only for authentication and the burden of transmitting random data can be reduced. .

According to a fifth aspect of the present invention, in the identification information conversion device according to any one of the second to fourth aspects, the individual identification information managing means uses the tamper resistant device linked to the common identification information. Managing personal information of the service provider, managing service information of the service provider associated with the service provider identification information, and based on the personal information and service information managed by the individual identification information management means, Service provision availability judging means for judging service availability is further provided.
According to the present invention, since the identification number conversion device determines whether or not to provide a service, it is not necessary for the service provider to make a determination and the personal information can be hidden from the service provider. Can be protected.

  The invention according to claim 6 comprises data relay means for relaying data exchange between the tamper resistant device and the identification information conversion device, wherein the data relay means provides a service for identifying the service provider. Necessary for providing a service provided by the service provider to a user of the tamper resistant device by transmitting the identification information and the common identification information acquired from the tamper resistant device to the identification information conversion device. A data transmission / reception terminal is provided that receives the individual identification information from the identification information conversion device.

  According to this invention, the data transmission / reception terminal receives the individual identification information from the identification information conversion device by transmitting the service provider identification information and the common identification information acquired from the tamper resistant device to the identification information conversion device. Even if a plurality of individual identification information for each service provider is not stored in the tamper resistant device, the individual identification information corresponding to the service provider can be acquired, and the service is provided using the individual identification information. Can be performed.

The invention according to claim 7 is the data exchange terminal according to claim 6, wherein the authentication information calculating means for generating authentication information by calculating the encrypted data relayed by the data relay means, and the authentication information Service provider identification information adding means for adding data including authentication information generated by the calculation means to the encrypted data as service provider identification information is further provided.
According to the present invention, the data transmission / reception terminal generates the authentication information by calculating the encrypted data, and adds the service provider identification information including the authentication information to the encrypted data. It becomes possible to authenticate the provider.

According to an eighth aspect of the present invention, in the data exchange terminal according to the sixth or seventh aspect, the data relay unit communicates with the identification information conversion device when the communication with the tamper resistant device is established. It is characterized by establishing.
According to the present invention, even if the identification information conversion device does not establish direct communication with the tamper resistant device, data exchange between the identification number converting device and the tamper resistant device is possible.

The invention according to claim 9 is a tamper resistant apparatus that receives services from a plurality of service providers, a common identification information management means for managing common identification information stored in the own apparatus, and a predetermined service provider Communication for transmitting the common identification information managed by the common identification information management means to the identification information conversion device for specifying the individual identification information necessary for receiving the service provision when receiving the service provision by And a tamper-proof device.
According to the present invention, if the common identification information is stored in the tamper resistant device, the identification information conversion device can specify the individual identification information from the common identification information received from the tamper resistant device. The burden of storing a plurality of individual identification information can be reduced.

  According to a tenth aspect of the present invention, in the identification information specifying method for specifying individual identification information required for providing a service by a service provider to a user of the tamper resistant device, the tamper resistant device is A common identification information transmission step for transmitting the common identification information stored in the apparatus to the data transmission / reception terminal, and the data transmission / reception terminal identifies the service provider in the common identification information transmitted in the common identification information transmission step. A data relay step for transmitting to the identification information conversion device after adding service provider identification information for the communication, and the identification information conversion device, the common identification information and the service provider identification information transmitted in the data relay step, Based on the individual identification information identifying step for identifying the individual identification information, and the identification information conversion device includes: Providing identification information specific method characterized by having the individual identification information notification step of notifying the individual identification information specified in the information specification step to the data transfer terminal.

  According to this invention, the identification information conversion device specifies the individual identification information associated with the common identification information acquired from the tamper device and the service provider identification information acquired from the data transmission / reception terminal, and notifies the data transmission / reception terminal, The data transmission / reception terminal can provide a service to the user of the tamper resistant apparatus using the notified individual identification information. In this way, even if a plurality of individual identification information for each service provider is not stored in the tamper resistant device, the individual identification information corresponding to the service provider can be specified only by storing the common identification information. The burden of storing a plurality of identification information in the tamper resistant apparatus can be reduced.

  As described above, according to the present invention, it is possible to specify individual identification information corresponding to a service provider without storing a plurality of identification information for each service provider in the tamper resistant apparatus. .

Next, the best mode for carrying out the present invention will be described with reference to the drawings. In each drawing referred to in the following description, the same reference numerals are given to the same parts as in the other drawings.
[1. Constitution]
FIG. 1 is a block diagram showing the overall configuration of an identification information specifying system according to an embodiment of the present invention. As shown in the figure, the identification information specifying system includes an IC card 100 as a tamper resistant device, a POS terminal 200 as a data transmission / reception terminal, and a server 300 as an identification information conversion device. The POS terminal 200 communicates with the IC card 100 and the server 300 to relay data exchange. The POS terminal 200 is managed by a service provider such as a credit card company or a transportation company, and is a terminal that provides various services such as payment to the IC card 100 user. The server 300 is managed by a reliable organization, and specifies identification information necessary for providing a service provided by the service provider to the user of the IC card 100. Hereinafter, the configuration of each apparatus will be described in detail.

[1.1. Configuration of IC card]
The IC card 100 includes a CPU (Central Processing Unit) that controls the whole, a read-only ROM (Read Only Memory) that stores a program and an encryption algorithm for analyzing and generating encrypted data, not shown. A configuration including a RAM (Random Access Memory) that temporarily stores data, a memory such as an EEPROM (Electronically Erasable and Programmable Read Only Memory) that stores various data, and a communication interface that controls communication with the POS terminal 200 Has been. The storage capacity of the memory is smaller than that of a general computer device, and the amount of data that can be stored is limited. The functional configuration of the IC card 100 shown in FIG. 1 is realized by these hardware and software included in the IC card 100. Hereinafter, each component will be described.

The data key management unit 13 manages the data key stored in the memory. This data key is shared with the server 300 and is used to control access to the common identification information and to generate and analyze encrypted data (also referred to as “secure message”).
The common identification information management unit 12 manages common identification information stored in the memory. Here, the common identification information is information for uniquely identifying the IC card 100 and is issued by the server 300. For example, the user of the IC card 100 registers a plurality of member numbers as individual identification information and the identification information (name, number, etc.) of the service provider that has issued the member number in the server 300, so that the server The common identification information is issued by 300.

  FIG. 2 shows an example of common identification information managed by the common identification information management unit 12. As shown in the figure, the common identification information is stored in a predetermined area (application) of the memory and is protected by a data key shared with the server 300. In this way, by storing the common identification information in the IC card 100 as an application protected by the data key owned only by the IC card 100 and the server 300, only the server 300 accesses the common identification information using a secure message. can do.

The encryption data generation / analysis unit 14 includes an encryption data analysis function 141 and an encryption data generation function 142. The encrypted data analysis function 141 analyzes the encrypted data (encrypted command, encrypted command APDU) received from the server 300 using the data key managed by the data key management unit 13.
When the encrypted data generation function 142 receives a request for common identification information from the server 300, the encrypted data generation function 142 encrypts the common identification information managed by the common identification information management unit 12 using the data key managed by the data key management unit 13. As a result, encrypted data (encrypted response, encrypted response APDU) for replying the common identification information to the server 300 is generated.
The communication unit 11 establishes communication based on a communication request from the POS terminal 200. In addition, when the communication unit 11 receives encrypted data for requesting common identification information from the server 300, the communication unit 11 returns encrypted data for replying the common identification information generated by the encrypted data generation function 142. To do.

[1.2. POS terminal]
Next, the configuration of the POS terminal 200 will be described. The POS terminal 200 is a communication terminal equipped with an IC card reader / writer, and includes a CPU, a memory, and a communication interface (not shown). The memory stores a public key certificate in which an identification number of the service provider is described, secret information such as a secret key corresponding to the public key, a program for generating an electronic signature, and the like. The functional configuration of the POS terminal 200 shown in FIG. 1 is realized by these hardware and software. Hereinafter, each component will be described.

  The communication unit (data relay unit) 21 relays data exchange between the IC card 100 and the server 300. Specifically, the communication unit 21 establishes communication between the IC card 100 and the POS terminal 200 by supplying power to the IC card 100 and activating it. Further, the communication unit 21 establishes communication between the POS terminal 200 and the server 300 when the communication between the IC card 100 and the POS terminal 200 is established.

  The communication unit 21 receives the individual identification information from the server 300 by transmitting the common identification information acquired from the IC card 100 and the service provider identification information managed by the terminal 200 to the server 300. Here, the individual identification information is identification information necessary for the service provider to provide the service to the user of the IC card 100, such as a membership number, for example. It is issued by each service provider in order to uniquely identify the IC card 100.

The service provider identification information is information for identifying the service provider. In the case of the public key encryption method, the service provider identification information corresponds to a public key certificate in which a service provider name is described. The timing for transmitting the service provider identification information to the server 300 may be the same as the timing for transmitting the encrypted data to the server 300, or may be the timing for establishing communication with the server 300.
When the service provider identification information is transmitted to the server 300 simultaneously with the transmission timing of the encrypted data to the server 300, the service provider identification information adding unit 22 adds the service provider identification information to the encrypted data. .

  The authentication information calculation unit 23 generates an electronic signature (hereinafter referred to as “SP signature”) of the service provider by performing calculation using secret information on the data to be subjected to signature calculation. The service provider identification information adding unit 22 adds the generated SP signature to the encrypted data as service provider identification information in addition to the public key certificate. The data to be signed may be only an encrypted response transmitted from the IC card 100 to the server 300, or may include an encrypted command transmitted from the server 300 to the IC card 100.

[1.3. server]
Next, the configuration of the server 300 will be described. The server 300 includes a CPU, a storage device including a ROM, a RAM, and a hard disk, an IC card reader / writer, and a communication interface (not shown). The storage device stores a program for specifying individual identification information and various data. The functional configuration of the server 300 illustrated in FIG. 1 is realized by these software and hardware included in the server 300. Hereinafter, each component will be described.

The communication unit 31 establishes communication with the POS terminal 200 based on the request from the POS terminal 200.
The data key management unit 32 manages a data key used for generation and analysis of encrypted data. With this data key, it is possible to access the common identification information stored in a predetermined area (application) of the IC card 100.
The individual identification information management unit 33 manages the individual identification information in association with the common identification information and the service provider identification information. Further, the individual identification information management unit 33 manages the personal information of the user of the IC card 100 storing the common identification information in association with the common identification information, and associates it with the service provider identification information. Manage service provider service information.

  FIG. 3 shows an example of information managed by the individual identification information management unit 33. In the example shown in the figure, age is managed as personal information. In addition to age, personal information includes, for example, address, gender, company, affiliation, income, payment information, and the like. As the service information, for example, age-restricted products, women-only sites, area-limited contents, high-priced product target services, and the like exist as shown in FIG.

The individual identification information specifying unit 34 refers to the individual identification information management unit 33 on the basis of the common identification information acquired from the IC card 100 and the service provider identification information acquired from the POS terminal 200. Identify.
The encryption data generation / analysis unit 35 includes an encryption data generation function 351 and an encryption data analysis function 352. Based on the data key managed by the data key management unit 32, the encrypted data generation function 351 generates encrypted data (encrypted command, encrypted command APDU) for requesting common identification information from the IC card 100. ) Is generated. The encryption data analysis function 352 analyzes the encrypted data (encrypted response, encrypted response APDU) received from the IC card 100 to obtain common identification information.

  The service provider authentication unit 36 authenticates the service provider using the service provider identification information given to the encrypted data received from the IC card 100 via the POS terminal 200. For example, when using the public key encryption method, the service provider authentication unit 36 authenticates the service provider by verifying the SP signature using the SP signature and public key certificate attached to the encrypted data. To do.

  The service provision availability determination unit 37 determines whether the service provider can provide a service to the user based on the personal information and service information of the user managed by the individual identification information management unit 33. For example, personal information “age” and service information “age-restricted products”, personal information “gender” and service information “women-only site” Personal information “address”, service information “regional limited content”, personal information “company, affiliation, income (credit)” and service information “service for high-priced products” can be considered.

[2. Operation]
Next, with reference to FIG. 4, an operation example when specifying individual identification information in the identification information specifying system according to the embodiment of the present invention will be described. In this operation example, it is assumed that the service provision is determined using the age of the member as personal information.
First, when communication between the IC card 100 and the POS terminal 200 is established (step S1), the communication unit 21 of the POS terminal 200 establishes communication with the server 300 (step S2). As a result, the server 300 can communicate with the IC card 100 via the POS terminal 200 without establishing direct communication with the IC card 100.
Next, the communication unit 21 of the POS terminal 200 transmits a message for requesting a membership number as individual identification information to the server 300 (step S3).

  When the communication unit 31 of the server 300 receives a message from the POS terminal 200, the encryption data generation function 351 of the encryption data generation / analysis unit 35 receives a command APDU for requesting common identification information stored in the IC card 100. The command APDU is generated and encrypted using the data key managed by the data key management unit 32. The communication unit 31 transmits the encrypted command APDU (hereinafter referred to as “encrypted command APDU”) to the IC card 100 via the POS terminal 200 (step S4).

  The communication unit 11 of the IC card 100 receives the encrypted command APDU from the server 300 via the POS terminal 200. The encryption data analysis function 141 of the encryption data generation / analysis unit 14 analyzes the encryption command APDU and recognizes that common identification information is requested. Then, the encryption data generation function 142 generates a response APDU for returning the common identification information. Specifically, using the data key managed by the data key management unit 13, the common identification information managed by the common identification information management unit 12 is accessed, and the encrypted data generation function 142 receives the common identification information. A response APDU including is generated. Further, the encrypted data generation function 142 encrypts the response APDU using the data key. The communication unit 11 returns an encrypted response APDU (hereinafter referred to as “encrypted response APDU”) (step S5).

When the communication unit 21 of the POS terminal 200 receives the encrypted response APDU from the IC card 100, the authentication information calculation unit 23 uses the private key corresponding to the public key certificate of the service provider to the encrypted response APDU. The SP signature is generated by performing the calculation.
The service provider identification information adding unit 22 adds the SP signature and the public key certificate to the encrypted response APDU.

The communication unit 21 transmits the encrypted response APDU to which the SP signature and the public key certificate are assigned to the server 300 (Step S7).
When the communication unit 31 of the server 300 receives the encrypted response APDU with the SP signature and the public key certificate from the POS terminal 200, the service provider authentication unit 36 provides the service using the SP signature and the public key certificate. Authenticate the person. The encryption data analysis function 352 of the encryption data generation / analysis unit 35 decrypts the encrypted response APDU to obtain common identification information. Here, it is determined that the authentication of the common identification information has succeeded due to the successful decryption (step S8).

The individual identification information specifying unit 34 refers to the individual identification information management unit 33 and specifies the member number associated with the common identification information obtained by decrypting the received encrypted data and the received service provider identification information. To do. Further, the age of the member is confirmed based on the personal information associated with the common identification information (step S9).
The service provision availability determination unit 37 determines whether the service can be provided to the member based on the age of the member and the service information associated with the service provider identification information (step S10).

  The communication unit 31 notifies the POS terminal 200 of the membership number and the determination result by the service provision availability determination unit 37 (step S11), and ends the communication with the POS terminal 200 (step S12). The POS terminal 200 ends the communication with the IC card 100 when the communication with the server 300 ends (step S13). The POS terminal 200 provides a service using the notified individual identification information (step S14).

  In this way, in consideration of the limitation of the storage capacity of the memory provided in the IC card 100, the common identification information is only stored in the IC card 100, and the server 300 obtains the common identification information and service obtained from the IC card 100. The individual identification information is specified based on the provider identification information, and the specified individual identification information is notified to the POS terminal 200. For this reason, it is not necessary to store a plurality of individual identification information in the memory of the IC card 100, and the burden of storing a lot of data can be reduced.

  Further, by encrypting the common identification information and exchanging data, it is possible to reduce the risk that the service provider illegally collects the common identification information. Furthermore, by storing the common identification information protected by the data key owned only by the server 300 and the IC card 100 in the IC card 100, only the server 300 uses the secure message to store the common identification information stored in the IC card 100. Since the identification information can be acquired, the risk that the common identification information is illegally accessed can be reduced.

  In addition, since the server 300 manages personal information of the user of the IC card 100 and determines whether or not to provide a service to the user of the IC card 100 on behalf of the POS terminal 200, the personal information is stored in the POS terminal 200 (service provider). ) Can be concealed, and user privacy can be protected. Furthermore, since the server 300 authenticates the service provider, it is possible to reduce a risk that the individual identification information is illegally collected. Also, by making encrypted data into a signature object when generating an SP signature, the server 300 can reduce the burden of generating random data only for authentication and the burden of transmitting random data to the POS terminal 200. it can.

[3. Modified example]
Although the embodiments of the present invention have been described above, the present invention is not limited to such embodiments, and various modifications can be made within the scope of the technical idea. As modifications, for example, the following can be considered.
(1) In the above-described embodiment, the service provider identification information is given to the server 300 by giving the service provider identification information to the encrypted data exchanged between the IC card 100 and the server 300. However, the method of notifying the service provider identification information to the server 300 is not limited to this. For example, the service provider identification information is previously sent from the POS terminal 200 to the server 300 such as when communication is established. You may make it notify. Further, when establishing communication, the POS terminal 200 may authenticate the server 300, or the server 300 may authenticate the POS terminal 200 and the service provider.

FIG. 5 shows a modification of the operation when specifying individual identification information in the identification information specifying system. In this modification, the service provider identification information is notified from the POS terminal 200 to the server 300 when communication is established, and authentication is performed.
Specifically, as shown in the figure, when communication between the IC card 100 and the POS terminal 200 is established (step S1), communication between the POS terminal 200 and the server 300 is established. (Step S <b> 21), the server 300 transmits random data (challenge code) to the POS terminal 200. The POS terminal 200 performs a signature operation on the random data, generates a response for notifying the service provider identification information, and sends it back to the server 300. The server 300 authenticates the service provider based on the received response (step S22). The POS terminal 200 also authenticates the server 300 in the same procedure as the server 300 (step S23).

When the server 300 receives a message for requesting a membership number from the POS terminal 200 (step S3), the server 300 transmits a command APDU for requesting common identification information to the IC card 100 via the POS terminal 200. (Step S4 ′).
The IC card 100 returns a response APDU that answers the common identification information (step S5 ′). The POS terminal 200 transfers the received response APDU to the server 300 without adding service provider identification information (step S7 ′).

Since the authentication of the service provider has already been completed in step S22, the server 300 only performs authentication of the common identification information (step S8 ′). Here, the authentication of the common identification information is performed based on, for example, APDU (ISO7816-4).
The processing procedure after step S9 is the same as the processing procedure after step S9 shown in FIG.
In such a procedure for transmitting and authenticating the service provider identification information in advance, it is necessary to generate random data for authentication, so that the processing load is higher than the procedure shown in FIG.

(2) In the above-described embodiment, the server 300 has been described as issuing the common identification information. However, the present invention is not limited to this. For example, the manufacturing number of the IC card 100 may be used as the common identification information. Good.
If it is necessary to conceal the common identification information from the POS terminal 200 (service provider) or an unauthorized third party from the viewpoint of privacy protection, the common ID is issued by the server 300 as a reliable organization. It is preferable that the common identification information is protected by a data key or encrypted and transmitted / received as information.

(3) In the above-described embodiment, the case of the correspondence relationship of service provider: service: POS terminal = 1: 1: 1 has been described. However, service provider: service: POS terminal = N: N: 1. In some cases (N is an integer; for example, when the POS terminal 200 is shared by a plurality of service providers (credit card companies)), a mechanism for selecting a specific service provider from a plurality of service providers is provided. By providing, the present invention can be applied.

(4) In addition to the IC card 100, the tamper resistant device may be a UIM (User Identity Module) mounted on a mobile phone or a wireless IC tag. In addition to the POS terminal 200, the data transfer device may be an ATM (Automatic Teller Machine) or an automatic ticket gate.

  INDUSTRIAL APPLICABILITY The present invention is used in any service industry that needs to safely provide services from a plurality of service providers to users of tamper resistant devices while using tamper resistant devices with limited memory storage capacity. be able to.

It is a block diagram which shows the whole structure of the identification information specific system which concerns on embodiment of this invention. It is a figure which shows an example of the common identification information which the common identification information management part which concerns on the embodiment manages. It is a figure which shows an example of the information which the separate identification information management part which concerns on the embodiment manages. It is a sequence diagram which shows the operation example in the identification information specific system which concerns on the embodiment. It is a sequence diagram which shows the operation example in the identification information specific system which concerns on a modification.

Explanation of symbols

100 IC card 11 communication unit 12 common identification information management unit 13 data key management unit 14 encrypted data generation / analysis unit 141 encrypted data analysis function 142 encrypted data generation function 200 POS terminal 21 communication unit (data relay unit)
22 Service Provider Identification Information Adding Unit 23 Authentication Information Calculation Unit 300 Server 31 Communication Unit 32 Data Key Management Unit 33 Individual Identification Information Management Unit 34 Individual Identification Information Identification Unit 35 Encrypted Data Generation / Analysis Unit 351 Encrypted Data Generation Function 352 Encrypted Data Analysis function 36 Service provider authentication unit 37 Service provision availability determination unit

Claims (10)

An identification information specifying system including a tamper resistant device, a data transfer terminal, and an identification information conversion device,
The tamper resistant device is
Common identification information management means for managing common identification information stored in the own device;
Communication means for transmitting common identification information managed by the common identification information management means when receiving a service provided by a service provider;
The data transfer terminal is
Data relay means for relaying data exchange between the tamper resistant device and the identification information converting device;
Service provider identification information giving means for giving service provider identification information for identifying the service provider to data relayed by the data relay means;
The identification information conversion device includes:
In association with the common identification information and the service provider identification information, individual identification information required for the data transfer terminal to provide a service by the service provider to a user of the tamper resistant device Individual identification information management means to be managed;
An individual for identifying individual identification information associated with the common identification information acquired from the tamper resistant device and the service provider identification information acquired from the data transfer terminal based on information managed by the individual identification information management means An identification information specifying means;
A communication means for notifying the data transmission / reception terminal of the individual identification information specified by the individual identification information specifying means. The service provider provides a service to the user of the tamper resistant device in association with the common identification information stored in the tamper resistant device and the service provider identification information for identifying the service provider. Individual identification information management means for managing the individual identification information required to
Identification information comprising: individual identification information specifying means for specifying individual identification information associated with common identification information and service provider identification information based on information managed by the individual identification information management means Conversion device. Data key management means for managing a data key shared with the tamper resistant device;
Using the data key managed by the data key management means, encrypted data generation means for generating encrypted data for requesting common identification information to the tamper resistant device;
And further comprising encrypted data analysis means for obtaining the common identification information of the tamper resistant apparatus by analyzing the encrypted data acquired from the tamper resistant apparatus using the data key managed by the data key managing means. The identification information conversion apparatus according to claim 2. The service provider authentication means for authenticating the service provider based on the service provider identification information including the calculation result for the encrypted data acquired from the data transmitting / receiving terminal is further provided. The identification information conversion device described in 1. The individual identification information management means includes
Managing personal information of users of the tamper resistant device linked to the common identification information, managing service information of service providers linked to the service provider identification information,
5. The service provision availability determination unit that further determines whether or not to provide a service based on the personal information and service information managed by the individual identification information management unit. 5. The identification information conversion device according to item. Data relay means for relaying data exchange between the tamper resistant device and the identification information conversion device,
The data relay means includes
By transmitting the service provider identification information for identifying the service provider and the common identification information acquired from the tamper resistant device to the identification information converting device, the service is provided to the user of the tamper resistant device. A data transmission / reception terminal, wherein individual identification information necessary for providing a service by a provider is received from the identification information conversion device. Authentication information calculation means for generating authentication information by calculating encrypted data relayed by the data relay means;
The service provider identification information adding means for adding data including the authentication information generated by the authentication information calculation means to the encrypted data as service provider identification information. Data exchange terminal. The data relay means includes
8. The data exchange terminal according to claim 6, wherein communication with the identification information conversion device is established when communication with the tamper resistant device is established. In tamper resistant devices that receive services from multiple service providers,
Common identification information management means for managing the common identification information stored in its own device;
When receiving a service provided by a predetermined service provider, the common identification information managed by the common identification information managing means is used as an identification information conversion device that identifies individual identification information necessary for receiving the service provision. A tamper resistant device comprising: a communication means for transmitting to the tamper resistant device. In an identification information specifying method for specifying individual identification information necessary for providing a service provided by a service provider to a tamper resistant device user,
The tamper resistant device transmits a common identification information stored in its own device to the data exchange terminal, a common identification information transmission step,
A data relay step in which the data transfer terminal adds service provider identification information for identifying a service provider to the common identification information transmitted in the common identification information transmission step, and transmits the service provider identification information to the identification information conversion device. When,
The identification information converting step, wherein the identification information conversion device specifies the individual identification information based on the common identification information and the service provider identification information transmitted in the data relay step;
The identification information specifying method comprising: an individual identification information notifying step in which the identification information converting apparatus notifies the data exchange terminal of the individual identification information specified in the individual identification information specifying step.

Images