JP2008033549A - Portable electronic device, ic card, and important data concealment method for portable electronic device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a portable electronic device that disables access to important data such as key data in application software set in a temporarily disabled state even if the disabled application software is operated by malfunction, unauthorized access or the like. <P>SOLUTION: The portable electronic device, such as an IC card, which is loaded with at least one kind of application software and is provided with the function of setting the application software in a temporarily disabled state (application block state), converts confidential important data in the application software into data different from the original data when the application software is set in the temporarily disabled state. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention includes at least one or more applications, and has a function of temporarily setting the application to an unusable state (application block), and performs processing corresponding to a command input from the outside. The present invention relates to a portable electronic device such as an IC card that executes and outputs the processing result to the outside, and an IC card.

  Further, the present invention prevents the highly sensitive important data including the key data for personal authentication in the application from being used as the original important data when the portable electronic device is set to the application block state. The present invention relates to a method for concealing important data of a portable electronic device.

  Recently, an IC card that has attracted attention is a plastic IC module having a non-volatile memory that can be written and rewritten, a control element such as a CPU for managing and controlling the non-volatile memory, and a communication means for communicating with the outside. It is structured to be housed inside an IC card body composed of a plate or the like.

  This type of IC card is used in various fields such as security control, entry / exit management, credit, mobile phone, and electronic commerce. IC cards are used in systems that require security, especially because the internal data is highly confidential. Conversely, if the confidentiality of the IC card is lowered, the security of the system can be lowered, but the IC card is subjected to all kinds of attacks.

The IC card and applications installed in the IC card have a function for protecting against attacks from the outside. For example, a method of temporarily disabling an application (application block) is known (for example, see Patent Document 1).
JP 2003-76968 A

  In general, in order to execute an application, identity verification (person authentication) is performed in advance based on an application user's personal identification number or the like, or mutual authentication is performed with a terminal device that is a communication partner of an IC card. If it is a legitimate user and a legitimate terminal device (system), verification and authentication can be successful.

  On the other hand, if verification or authentication fails continuously, it is determined that the application is illegally used, and the application is set in the application block. When the application block is set, execution of the application is restricted, and even an IC card cannot be used in some cases.

  However, in recent years, even if an application is blocked and its function is restricted, it is becoming possible to relax the restriction from the outside, or forcibly release the restriction in the worst case. Then, even if the application is blocked, the application can be executed.

  In this case, for example, even if the user's personal identification number is continuously wrong, it can be tried any number of times, so that it can be tried until the correct personal identification number is obtained. As a result, a secret number or the like, which is important data with high confidentiality inside the application, is leaked to the outside, and the security of the IC card is significantly lowered.

  Therefore, when the application is temporarily set to an unusable state, the present invention can provide important data such as key data in the application even if the unusable application operates due to malfunction or unauthorized access. It is an object of the present invention to provide a portable electronic device that cannot be accessed, an IC card, and an important data concealing method for the portable electronic device.

  The portable electronic device of the present invention has at least one or more applications, and the application is temporarily used in the portable electronic device having a function of temporarily setting the application to an unusable state. Responsive to being set to the disabled state, it is provided with means for converting sensitive highly important data in the application into data different from the original data by a predetermined conversion method. .

  Further, the IC card of the present invention is configured by mounting at least one application and storing an IC module having a function of temporarily setting the application in an unusable state in the IC card body. In such an IC card, the IC module responds to the application being temporarily set in an unusable state, and the sensitive data in the application is originally converted by a predetermined conversion method. A means for converting the data into data different from the above data is provided.

  Further, the important data concealment method for a portable electronic device according to the present invention is a portable electronic device having a function of installing at least one application and temporarily setting the application to an unusable state. In the important data concealment method, when an application is temporarily disabled, the sensitive confidential data in the application is converted into data different from the original data by a specific conversion method set in advance. Therefore, it cannot be used as original important data.

  According to the present invention, when an application is temporarily set in an unusable state, even if the unusable application operates due to malfunction or unauthorized access, important data such as key data in the application Can provide an important data concealment method for portable electronic devices, IC cards and portable electronic devices that cannot be accessed.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 schematically shows a hardware configuration of an IC card as an example of a portable electronic device according to the present embodiment. This IC card includes a central processing unit (CPU) 11 for overall management and control, a ROM (read only memory) 12 in which a control program for the CPU 11 and the like are stored, and a RAM (random memory) as a working memory. Access memory 13, communication unit (UART) 14 for communicating with a host device (such as a card reader / writer), non-volatile memory (NV (EEPROM)) 15 for storing various data and applications, and assisting calculations A coprocessor (Co-Processor) 16 is configured, and these are integrated into an IC module (reference numeral 17) and housed (embedded) in the IC card body.

  In the non-volatile memory 15, for example, as shown in FIG. 2, information related to the application is stored in a file structure. That is, as shown in FIG. 2, the highest file is a master file (MF: Master File) 21, and an application file (DF: Dedicated File) 22 is provided as a folder set for each application under it. Under the control, data files (EF: Elementary File) 23, 24, and 25 used for storing data actually used by the application are provided.

  The data file 23 stores key data for personal authentication that is important data with high confidentiality, for example, a secret key that is a four-digit password, and the data file 24 also has important data with high confidentiality. It is assumed that the application data and the like are stored, and the data file 25 stores an encryption key for encrypting the secret key in the data file 23.

In this embodiment, it is assumed that the following operating conditions exist in the application.
1) The secret key is collated, and it can be executed only when it is successful.

    2) If the collation failure is repeated three times, the application block is set, and thereafter, application selection and collation cannot be performed.

FIG. 3 shows a general process flow up to the application block due to the collation failure in the above 2), and the process flow will be described below.
First, an application is selected from the reader / writer side (corresponding to the circled number “1” in FIG. 3). After that, when the secret key is collated with incorrect data (first time), a response indicating a collation failure is sent to the reader / writer. respond. In this case, the application flag of the application remains “normal” (corresponding to the circled number “2” in FIG. 3).

  Next, when the secret key is collated again with incorrect data (second time), a response indicating a collation failure is returned to the reader / writer. Also in this case, the application flag of the application remains “normal” (corresponding to the circled number “3” in FIG. 3).

  Next, when the password is verified again with the wrong data (third time), a response indicating a verification failure is returned to the reader / writer. In this case, the application flag of the application is set to “abnormal” (corresponding to the circled number “4” in FIG. 3). That is, the application is set in the application block.

  Next, when the password is collated again with incorrect data (fourth time), a response indicating that the application is blocked is returned to the reader / writer. In this case, the application flag of the application remains “abnormal” and the command is not executed (corresponding to the circled number “5” in FIG. 3).

  As described above, if the third collation fails, the application responds with a response indicating that the application is blocked in the subsequent processing, and normal processing cannot be performed. In the case of the conventional application so far, if the third collation fails, the application flag, which is a variable inside the application, is set to “abnormal”, and thereafter, this flag is confirmed at the beginning of the command processing. If “abnormal”, the command processing is not performed and a response indicating that the application is blocked is returned.

  However, in recent tamper-resistant technologies, it is not impossible to perform only the application flag confirmation processing part. In that case, even if the application flag is “abnormal”, the processing is not performed, and thus the processing is continued as in the case where the application flag is “normal” and the command is executed. By repeating this process, it is also possible to confirm the password by confirming all patterns of the four-digit password that is the password.

  Therefore, in the present invention, the secret key is converted or replaced with data different from the original data immediately after the third verification failure of the secret key, which will be described below with reference to FIG.

(A) First method (see FIG. 4 (a))
In the first method, the secret key is converted into data different from the original data by a reversible conversion method, and cannot be used. For example, if the encryption key is an ASCII format decimal image and is “1234 (0x3133334)”, when it is converted by 0xFFFFFFFF and XOR, it becomes “0xCEDCCCCB”, which is not a decimal number and cannot be used.

  In this way, when an application enters the application block state, the important data including the secret key in the application is converted into data different from the original data by a specific conversion method. Cannot be used as data.

(B) Second method (see FIG. 4B)
In the second method, the secret key is moved to another location, and an unusable value is set in the location where the secret key is originally stored. For example, if the secret key is an ASCII format decimal image and it is “0x3133334”, “0x3133334” is moved to a specific area with a different address, and “0xFFFFFFFF” is set in the secret key area. To do.

  As described above, when the application enters the application block state, important data such as a secret key in the application is stored in a location different from the originally stored location, and the important data is stored in the originally stored location. By storing different data, even if accessed by any chance, it cannot be used as original important data.

(C) Third method (see FIG. 4 (c))
In the third method, the value of the pointer indicating the position of the personal identification key is converted to a value different from the original value by a reversible conversion method, and the pointer cannot be used. For example, if the secret key exists at the address “0xAABB” and “0xAABB” is set to the pointer value indicating the location of the secret key, the pointer value becomes “0x5544” when converted by 0xFF and XOR. It is set at a position where the secret key does not exist, or in some cases an access abnormality position, and cannot be used.

  In this way, when the application enters the application block state, the pointer value for indicating the position of the important data including the secret key in the application is converted into a value different from the original value by a specific conversion method. An attempt to access important data cannot be used as the original important data because the pointer value is not set correctly.

(D) Fourth method (see FIG. 4 (d))
In the fourth method, the pointer value indicating the position of the personal identification key is moved to another location, and an unusable value is set in the location where the pointer value is originally stored. For example, when the secret key exists at the address “0xAABB” and “0xAABB” is set as the pointer value indicating the location of the secret key, “0xAABB” is moved to a specific area and “0xFFFF” is designated as the pointer value. Is set to a position where the original secret key does not exist, or in some cases, an access abnormal position, and cannot be used.

  As described above, when the application enters the application block state, the pointer value for indicating the position of the important data including the secret key in the application is stored in a location different from the originally stored location. If a value different from the original pointer value is stored in the stored location, even if an attempt is made to access the important data, the pointer value is not set correctly and cannot be used as the original important data.

(E) Fifth method (see FIG. 4 (e))
In the fifth method, the encryption key of the encryption key encrypted in advance is changed to be unusable. For example, encrypt important data such as a secret key in advance with an encryption key set for each application. If you use important data such as a secret key, decrypt it with that encryption key. When using, if the encryption key is changed to a value different from the original value, all important data including the secret key cannot be decrypted and cannot be used.

  In this way, when the application enters the application block state, important data including the encryption key encrypted in advance in the application is changed in the encrypted encryption key (different from the encrypted encryption key). Therefore, the data cannot be decrypted correctly and cannot be used as the original important data even if accessed.

Hereinafter, representatively, (a) the first method, (d) the fourth method, and (e) the fifth method will be specifically described with reference to FIG.
First, (a) the first method will be described with reference to FIG. 3, immediately after the third matching failure, the application flag that is an internal variable of the application is set to “abnormal”, and the secret key is rewritten with a value XORed with 0xFFFFFFFF (0xCEDCCCCB). . In this state, when the password is verified after the next command, if the application is normal, the application flag is judged, and since it is “abnormal”, it responds with a response indicating that the application is blocked. . However, even if the application flag determination process is not performed, the password cannot be verified because the secret key is different from the original data.

  Next, (d) the fourth method will be described with reference to FIG. With the circled number “4” in FIG. 3, immediately after the third verification failure, the application flag which is a variable inside the application is set to “abnormal”, and the pointer value indicating the position of the secret key is set to the value of the pointer value. Write to the save area. Then, “0xFFFF” is set as the pointer value. Since this “0xFFFF” is a pointer that causes an access error (an area to which nothing is assigned) even when accessed next time, it cannot be verified.

  In this state, when the password is verified after the next command, if the application is normal, the application flag is judged, and since it is “abnormal”, it responds with a response indicating that the application is blocked. . However, even if the application flag determination process is not performed, if the pointer value is referenced to access the secret key and the pointer value is accessed, the secret key cannot be accessed and it is impossible to verify due to an abnormal access. It becomes possible.

  Next, (e) the fifth method will be described with reference to FIG. The secret key is set by encrypting it with an encryption key (stored in the data file 25) set in advance for each application. Then, immediately after the third matching failure with the circled number “4” in FIG. 3, the application flag that is a variable inside the application is set to “abnormal”, and the encryption key is changed to a value different from the original value. .

  In this state, when the password is verified after the next command, if the application is normal, the application flag is judged, and since it is “abnormal”, it responds with a response indicating that the application is blocked. . However, even if the application flag determination process is not performed, different values are obtained when the encryption key is decrypted with the encryption key, so that correct verification becomes impossible.

  In addition, if all the important data in the application is encrypted with this encryption key, if this encryption key is changed, all the important data cannot be decrypted correctly at the same time. Will be decoded and incorrect data.

  In the above-described embodiment, the case where the present invention is applied to an IC card as a portable electronic device has been described. However, the present invention is not limited to this, and for example, a portable terminal device called PDA, a cellular phone, etc. However, it is not limited to the card type, and may be a booklet type, a block type, or a tag type.

1 is a block diagram schematically showing a hardware configuration of an IC card as an example of a portable electronic device according to an embodiment of the present invention. The block diagram which shows typically the file structure in a non-volatile memory. The figure which shows the flow of the general process to the application block by the collation failure of a PIN key. The figure which shows the mode of the change of the secret key before and behind an application block.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 11 ... CPU, 12 ... ROM, 13 ... RAM, 14 ... Communication unit (UART), 15 ... Non-volatile memory (NV (EEPROM)), 16 ... Coprocessor (Co-Pro), 17 ... IC module.

Claims (17)

In a portable electronic device equipped with at least one application and having a function of temporarily setting the application to an unusable state,
In response to the application being temporarily set in an unusable state, it is provided with means for converting important confidential data in the application into data different from the original data by a predetermined conversion method. A portable electronic device characterized by that. In a portable electronic device equipped with at least one application and having a function of temporarily setting the application to an unusable state,
Responds to the application being temporarily disabled, moves sensitive sensitive data in the application to a different location from where it is originally stored, and stores important data A portable electronic device comprising means for storing data different from the important data at a place where the data is stored. In a portable electronic device equipped with at least one application and having a function of temporarily setting the application to an unusable state,
In response to the application being temporarily set to an unusable state, a pointer value for pointing to the storage location of sensitive sensitive data in the application is set to the original value by a predetermined conversion method. A portable electronic device comprising means for converting the value into a different value. In a portable electronic device equipped with at least one application and having a function of temporarily setting the application to an unusable state,
In response to the application being temporarily disabled, the pointer value that points to the sensitive data storage location within the application is moved to a different location from where it was originally stored. A portable electronic device characterized by comprising means for storing a value different from the pointer value at a place where the pointer value is originally stored. In a portable electronic device equipped with at least one application and having a function of temporarily setting the application to an unusable state,
In response to the application being temporarily set in an unusable state, it is encrypted with the key data for encryption in the application in advance and used after being decrypted with the key data. A portable electronic device comprising means for changing the key data of important data with high confidentiality to data different from the original data.   The portable electronic device according to claim 1, wherein the important data with high confidentiality includes at least key data for personal authentication.   The portable electronic device according to claim 1, wherein the specific conversion method is a reversible conversion method. In an IC card configured to store an IC module having at least one application and having a function of temporarily setting the application in an unusable state in the IC card body,
The IC module responds to the application being temporarily set in an unusable state, and converts the highly sensitive important data in the application to data different from the original data by a predetermined conversion method. An IC card comprising means for converting. In an IC card configured to store an IC module having at least one application and having a function of temporarily setting the application in an unusable state in the IC card body,
In response to the application being temporarily set to an unusable state, the IC module moves sensitive and important data in the application to a location different from where it is originally stored, and An IC card characterized by comprising means for storing data different from the important data at a place where the important data is originally stored. In an IC card configured to store an IC module having at least one application and having a function of temporarily setting the application in an unusable state in the IC card body,
In response to the application being temporarily set in an unusable state, the IC module performs a predetermined conversion of a pointer value for pointing to a storage location of sensitive confidential data in the application. An IC card comprising means for converting to a value different from an original value depending on a method. In an IC card configured to store an IC module having at least one application and having a function of temporarily setting the application in an unusable state in the IC card body,
In response to the application being temporarily set in an unusable state, the IC module is a place where a pointer value for pointing to a storage position of highly confidential important data in the application is originally stored. An IC card comprising means for moving to a different place and storing a value different from the pointer value at a place where the pointer value is originally stored. In an IC card configured to store an IC module having at least one application and having a function of temporarily setting the application in an unusable state in the IC card body,
The IC module responds to the fact that the application is temporarily set in an unusable state, and is encrypted with the key data for encryption in the application and decrypted with the key data when used. An IC card comprising means for changing the key data of important data with high confidentiality that is used later to data different from the original data. In an important data concealment method for a portable electronic device having at least one application and a function of temporarily setting the application to an unusable state,
When an application is temporarily set to an unusable state, the original important data is converted by converting the highly sensitive important data in the application into data different from the original data by a predetermined conversion method. A method for concealing important data of a portable electronic device, characterized in that it cannot be used as a portable electronic device. In an important data concealment method for a portable electronic device having at least one application and a function of temporarily setting the application to an unusable state,
When an application is temporarily disabled, sensitive and sensitive data in the application is moved to a different location from where it was originally stored, and originally important data is stored An important data concealment method for a portable electronic device, characterized in that data different from the important data is stored in the place so that it cannot be used as original important data. In an important data concealment method for a portable electronic device having at least one application and a function of temporarily setting the application to an unusable state,
When an application is temporarily disabled, a pointer value that points to the storage location of sensitive confidential data in the application is different from the original value by a specific conversion method that has been determined in advance. A method of concealing important data of a portable electronic device, wherein the important data cannot be used as original important data by converting to In an important data concealment method for a portable electronic device having at least one application and a function of temporarily setting the application to an unusable state,
When the application is temporarily set to an unusable state, the pointer value for pointing to the storage location of sensitive and important data in the application is moved to a location different from the location where it is originally stored, and A method of concealing important data in a portable electronic device, wherein a value different from the pointer value is stored in a place where the pointer value is originally stored so that it cannot be used as original important data. In an important data concealment method for a portable electronic device having at least one application and a function of temporarily setting the application to an unusable state,
When sensitive and important data in the application is encrypted in advance with encryption key data, and the application is temporarily set to an unusable state, the encryption key data in the application is An important data concealment method for a portable electronic device, wherein the important data cannot be used as original important data even if the important data is decrypted with the key data by changing to data different from the data.

Images