JP2008282064A - Ic card information authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an IC card information authentication system allowing authentication, even if a card type is varied on condition that a driver and application for an IC card are installed in a client terminal. <P>SOLUTION: The IC card information authentication system is provided with a function for referring a card ID or a card type transmitted from the client terminal 3 to an IC card server 2, to which an IC card reader/writer 7 is connected. By using the function for USB virtual connection, control is switched to connect the IC card reader/writer 7 connected to the IC card server 2 to the client terminal 3 for transmitting the card ID, when identity of the card ID or the card type is recognized. The client terminal 3 checks user information in the IC card for performing authentication and carries out data access to a peripheral apparatus, when the authentication shows agreement. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technique for performing authentication using an IC card when using a peripheral device from a client terminal via a network.

  Recently, IC cards are used as credit cards, ID cards such as employee ID cards, office entry / exit management, PC security measures, basic resident register cards, and speedy entry / exit in transportation. Is widely used as a train-related card. An IC card is a general term for cards incorporating an integrated circuit (IC) chip designed to perform processing and recording functions, and is broadly classified as an IC card with an external terminal having an electrical connection terminal between the IC and an external device. There are two types of contactless IC cards that communicate with electromagnetic waves without having connection terminals. There are three types of non-contact cards depending on the communication distance: a contact type (3 mm or less), a proximity type (10 cm or less), and a proximity type (70 cm or less).

  Proximity IC cards (ISO / IEC14443) have types A, B, and C that are different in radio wave output and signal interface processing, and are established in the international standard (ISO). Type A is typically a Mifare (registered trademark) card, which is popular in Europe, and type B is handled by Motorola (registered trademark) and is mainly recommended by the United States. For example, the Basic Resident Register Card uses a proximity IC card type B, which is established in an international standard and is excellent in the safety and multipurpose use of recorded data. In addition, some traffic-related types adopt Type C suitable for high-speed processing with an emphasis on processing speed. Note that Type C is a tentative name under deliberation of the standard and is not currently used, and there is Felica (registered trademark) that Sony Corporation has proposed international standardization as a type C.

  FIG. 2 shows a schematic diagram of an IC card. The card ID (ID) is identification information of the IC card, and is information that uniquely identifies the IC card. User information is information that requires security, such as personal information, and is information that is stored in a format unique to the IC card manufacturer and is encrypted. Usually, in order to access user information, it is necessary to use an application provided by an IC card manufacturer.

  In recent years, IC cards have been used in various fields. The same applies to the field of embedded devices, and an IC card is used as a means for performing personal authentication.

  As an example of such an embedded device system, a security printing system using an IC card is known. In this system, a client terminal and a print server (a printer device is connected to the print server) are communicably connected via a network, and each has an IC card reader / writer.

  The operation will be briefly described. First, the user holds the IC card over the IC card reader / writer of the client terminal and inputs the card ID. When the user operates the client terminal to instruct printing, the client terminal transmits print data and a card ID to the print server. The user moves to the installation location of the print server, holds the IC card over the IC card reader / writer of the print server, and inputs the card ID. If it is determined that the user is a valid user as a result of the verification of the card ID, the print server transfers the print data to the printer apparatus and prints out the print apparatus.

  As described above, in a system of an embedded device, a card ID is used as a key instead of user information for IC card verification.

  In addition, since there are various types of IC cards, in order to use the IC card as an authentication means, processing corresponding to each type of IC card is required. Therefore, in a system using an IC card, the card type of the IC card is selected and authentication processing corresponding to the card type is performed.

  In order to solve the low convenience when the authentication method differs depending on the IC card, the card authentication method download server stores the authentication method set for the individual authentication for each IC card issuer, A technique for downloading the stored authentication method to a terminal is known (see Patent Document 1).

JP 2004-291585 A

  However, in the method described in Patent Document 1, the card authentication method download server stores the authentication method set for the individual authentication for each card issuer and downloads the stored authentication method to the terminal. Therefore, it is necessary to install and execute a program for executing the authentication method on the terminal side, or to operate the terminal, which is not convenient for the user.

  Moreover, when collating user information with the system of an embedded apparatus, there existed the following problems. First, since the format of user information differs depending on the card manufacturer and card type, it is difficult to support a plurality of IC cards. That is, in order to support a plurality of IC cards, it is necessary to support the specifications of each IC card, but this increases the burden of development. On the other hand, if only a specific IC card is supported, the versatility of the embedded device is lost. In addition, as another point of view, it is not desirable from the viewpoint of security for IC card manufacturers to widely disclose user information specifications to third parties.

  In addition, since various kinds of personal information can be recorded in the user information, there is a demand for recording the usage history of the embedded device in the user information even in the embedded device system. However, this case also has the same problem as described above.

  In addition, there is a card type that is changed every time a card ID that can be acquired from an IC card is read, such as type B. In a conventional embedded device system, simply reading the card ID in the IC card In some cases, it could not be verified.

  Further, since the card ID is not added by the user but is a unique number, the card ID is not familiar to the user. For this reason, the registration of the card ID to the embedded device system is time-consuming and complicated.

  The present invention has been made in view of the above problems, and uses an IC card reader / writer connected to an IC card server using a USB virtual connection in the same manner as a USB device in which a client terminal is connected to a local interface. By using it, the user information in the IC card can be analyzed at the client terminal. Thus, by installing the IC card R / W driver and the IC card application in the client terminal, an IC card information authentication system is provided that enables authentication even if the card types (types A, B, and C) are different. .

That is, the IC card information authentication system of the present invention comprises an IC card server and a client terminal connected via a network, the IC card server includes a first IC card reader / writer, and the client terminal An IC card information authentication system including an IC card reader / writer,
A) The IC card server
(1) card information registration means for storing the IC card information received from the client terminal and the identification information of the client terminal as a record in the card registration information table;
(2) first IC card information acquisition means for acquiring IC card information via the first IC card reader / writer;
(3) Search means for searching a corresponding record corresponding to the IC card information acquired by the first IC card information acquisition means from the card registration information table;
(4) Data received from the first IC card reader / writer is converted into a data format that can be communicated with the network, and data received from the network is converted into a data format that can be communicated with the first IC card reader / writer. A first data conversion means that enables communication between the first IC card reader / writer and the client terminal through the network by converting;
(5) having control switching means for switching the control right of the first IC card reader / writer between the IC card server and the client terminal;
B) The client terminal
(6) second IC card information acquisition means for acquiring IC card information via the second IC card reader / writer;
(7) card information transmitting means for transmitting the IC card information acquired by the second IC card information acquiring means to the IC card server;
(8) IC card control means for controlling the first IC card reader / writer and the second IC card reader / writer,
(9) The data issued by the IC card control means is converted into a data format that can be communicated with the network, and the data received from the network is converted into a data format that can be communicated with the IC card control unit. The first IC card reader / writer and the client terminal are configured to include second data conversion means that enables communication through the network.

  In the IC card information authentication system of the present invention, the IC card information includes information on either a card ID or a card type.

  In the IC card information authentication system of the present invention, the IC card control means includes the IC card acquired by the first IC card reader / writer connected to the client terminal, and the second connected to the IC card server. At least one of reading, writing, and verification is performed on the IC card acquired by the IC card reader / writer.

  In the IC card information authentication system of the present invention, when the card type of the IC card is a type in which the card ID does not change every time the IC card is read (for example, card type A or C), the search means includes the card type and the card. Both IDs are collated and the corresponding record is specified. Then, the first data conversion means performs USB virtual connection to the client terminal of the specified record.

  In the IC card information authentication system according to the present invention, when the card type of the IC card is a type in which the card ID changes every time the IC card is read (for example, card type B), the search means supports the matching of the card type. Identify the record. When there are a plurality of records of the same card type in the card registration information table, one of them is selected and specified. Then, the first data conversion means performs USB virtual connection to the client terminal of the specified record.

  In the IC card information authentication system of the present invention, when the card type of the IC card is a type in which the card ID changes every time the IC card is read (for example, card type B), when the USB virtual connection is disconnected, The search means searches the card registration information table again, and selects and specifies the record of the same card type. Then, the first data conversion means performs USB virtual connection to the client terminal of the newly specified record.

  When the card type of the IC card is B, it is characterized in that it is changed every time an acquirable card ID is read. In the case of such a card type, since the card ID is changed every time an acquirable card ID is read out, authentication cannot be performed only with the card ID. Therefore, the IC card server sequentially controls the IC card reader / writer connected to the IC card server to all client terminals that have transmitted the card type B IC card information using the USB virtual connection function. Switch connection.

  In the IC card information authentication system of the present invention, when the card type of the IC card is a type in which the card ID changes every time the IC card is read (for example, card type B), the search is performed when the USB virtual connection is disconnected. The means determines whether or not the record of the disconnected client terminal has been deleted. If the record has not been deleted, the means searches the card registration information table and selects and specifies a record of the same card type. Then, the first data conversion means performs USB virtual connection to the client terminal of the newly specified record.

  The client terminal confirms the user information in the IC card. If they match, the client terminal requests the IC server to delete the corresponding record in the card registration information table, deletes the record, and then the IC card reader. Cut the writer. That is, when the IC card reader / writer disconnection request is received from the client terminal, if the record in the card registration information table is not deleted, the client terminal confirms the user information in the IC card, and does not match. As another example, another record corresponding to the card type is searched from the card registration information table.

  In the IC card information authentication system of the present invention, the IC card control means of the client terminal stores user information of the IC card acquired by the second IC card reader / writer, and the first IC card reader / writer. It collates with the user information of the IC card acquired in (1).

  In the IC card information authentication system of the present invention, when a peripheral device is connected to the IC card server and valid authentication is obtained by collating user information by USB virtual connection, the client device and the peripheral device are connected. Send or receive data with.

  In the IC card information authentication system of the present invention, when a peripheral device is connected to the network and valid authentication is obtained by collating user information by USB virtual connection, data is transmitted between the client terminal and the peripheral device. Send or receive.

  Here, peripheral devices are used to include not only peripheral devices connected to computers such as printers and scanners, but also control devices for entrance / exit gates, factory automation devices, and robot control devices. These peripheral devices are connected to the IC card server, directly connected to the network, or connected to other peripheral device servers connected by the network.

  In the IC card information authentication system of the present invention, the second data conversion means of the client terminal performs a USB virtual connection disconnection process after the IC card control means writes the peripheral device information to the IC card.

  With the above configuration, information for peripheral devices can be recorded on the IC card. Here, the peripheral device information is information related to the use of the peripheral device such as the time when the peripheral device is accessed, the occupation time, the name and identification number of the peripheral device. The recorded peripheral device information can be used for personal records, billing information, and the like.

An IC card information authentication system according to the present invention includes an IC card server and a client terminal connected via a network. The IC card server includes a first IC card reader / writer and peripheral devices, and the client terminal includes a second terminal. An IC card information authentication system comprising an IC card reader / writer,
A) The IC card server
(1) card information registration means for storing the IC card information received from the client terminal and the identification information of the client terminal as a record in the card registration information table;
(2) first IC card information acquisition means for acquiring IC card information via the first IC card reader / writer;
(3) Search means for searching a corresponding record corresponding to the IC card information acquired by the first IC card information acquisition means from the card registration information table;
(4) Data received from the first IC card reader / writer or the peripheral device is converted into a data format that can be communicated with the network, and the data received from the network is converted to the first IC card reader / writer or the peripheral device. A first data conversion unit that enables communication between the first IC card reader / writer and the peripheral device and the client terminal through the network by converting the data into a data format that can be communicated with the device;
(5) having control switching means for switching the control right of the first IC card reader / writer and the peripheral device between the IC card server and the client terminal;
B) The client terminal
(6) second IC card information acquisition means for acquiring IC card information via the second IC card reader / writer;
(7) card information transmitting means for transmitting the IC card information acquired by the second IC card information acquiring means to the IC card server;
(8) IC card control means for controlling the first IC card reader / writer and the second IC card reader / writer,
(9) Peripheral device control means for controlling the peripheral device;
(10) The data issued by the IC card control means or the peripheral device control means is converted into a data format that can be communicated with the network, and the data received from the network is converted to the IC card control means or the peripheral device control means. A second data conversion unit that enables communication between the first IC card reader / writer and the client terminal through the network by converting the data into a communicable data format;
It is set as the structure which has.

  In the IC card information authentication system according to the present invention, the IC card reader / writer connected to the IC card server can be controlled and accessed from the IC card application of the client terminal via the USB virtual connection to access the user information of the IC card. Even if the IC card server does not have a function of accessing user information, it is possible to perform authentication using the user information.

  Also, in the IC card information authentication system of the present invention, all access to user information of the IC card can be performed from the IC card application of the client terminal regardless of the type of the IC card. There is an effect that there is no need to add customization corresponding to each. Thereby, the IC card server itself can have versatility that can be applied to any IC card.

  Further, the IC card information authentication system of the present invention has an effect that it can cope with an IC card of a type in which the card ID changes every time the IC card is read.

  Hereinafter, a processing flow and the like of an embodiment of the present invention will be described in detail with reference to the drawings. However, the scope of the present invention is not limited to the following examples and illustrated examples, and many changes and modifications can be made.

FIG. 1 is a functional block diagram of the IC card information authentication system according to the first embodiment.
As shown in FIG. 1, in an IC card information authentication system 1, a client terminal 3 and an IC card server 2 are connected by a network 4 such as a LAN. An IC card reader / writer (IC card R / W) 5 is connected to the client terminal 3 with a USB cable. An IC card reader / writer (IC card R / W) 7 is connected to the IC card server 2 with a USB cable. The IC card server 2 and the printer device are connected by an IEEE 1284 printer I / F. The printer I / F may be other than IEEE 1284.

First, functional blocks of the client terminal 3 will be described.
The client terminal 3 is a general personal computer, and is assumed to operate Windows (registered trademark) as an operating system (not shown). The present invention can also be applied to other operating systems.

The print application (print application) 31 is, for example, document creation software or spreadsheet software, and issues a print instruction for data to be printed.
The printer driver 32 converts the data to be printed into a format such as PDL (Page Description Language) that can be interpreted by the printer device 6 and generates print data.
The port monitor 33 stores the IP address of the IC card server 2 and performs print data transmission processing and IC card information (IC card ID, card type) transmission processing. The port monitor 33 can be provided with a plurality of ports, and by selecting these ports, it is possible to select a destination to which print data and IC card information are output.

  The IC card application (IC card application) 34 is an application for accessing the IC card via the IC card reader / writer 5. The IC card application 34 can perform processing such as reading, writing, and collation for the user information of the IC card. The IC card application 34 can also access the IC card input to the IC card reader / writer 7 via the USB virtual connection. The IC card R / W driver 35 is a driver for controlling the IC card reader / writer 5 and the IC card reader / writer 7.

The USB upper driver 36 is a part of the USB driver stack and is a driver that provides a USB common function to the upper driver. Specifically, USB. SYS and USBHUB. SYS or the like.
The host controller driver 37 is a driver that exists in a lower layer of the USB driver stack and directly operates the host controller. Specifically, UHCI. SYS and OHCI. SYS or the like. The host controller is hardware for controlling the USB device, and UHCI and OHCI exist.

The USB virtual driver 38 is a driver that transmits and receives USB commands via the network control unit 39, and details thereof will be described later.
The network control unit 39 controls the network I / F and transmits / receives data via the network 4.

Next, functional blocks of the IC card server 2 will be described.
The IC card R / W driver 22 is a driver for controlling the IC card reader / writer 7.
The USB upper driver 23 is a part of the USB driver stack, and provides a USB common function to the upper driver.
The host controller driver 21 is a driver that exists in a lower layer of the USB driver stack and directly operates the host controller.

The print server function unit 28 transmits the print data received from the client terminal 3 to the printer device 6.
The network control unit 25 controls the network I / F and transmits / receives data via the network 4.
The control switching unit 27 switches the control of the host controller driver 21 between the USB upper driver 23 and the USB virtual driver 26 in accordance with an instruction from the card information management unit 24.

  Further, as shown in FIG. 3, the card information management unit 24 includes a card registration information table 2a, a card information registration unit 2b, a card information acquisition unit 2c, a search unit 2d, a control switching unit 2e, and a registration information deletion unit 2f. Consists of

The card information registration means 2b registers the card ID and card type received from the client terminal and the IP address of the client terminal as a record in the card registration information table 2a.
The card information acquisition means 2 c acquires the card ID and card type of the IC card via the IC card reader / writer 7.
When the card type is A or C, the search unit 2d searches the card registration information table for a record that matches the card ID and card type acquired by the card information acquisition unit 2c. When the card type is B (which changes every time the card ID is read), the card registration information table 2a is searched for a record that matches only the card type.

The control switching unit 2e searches for the control of the host controller driver 21 in the control switching unit 27 when there is a record whose card type and card ID match in the card registration information table 2a as a result of searching when the card type is A or C. Instruct switching. As a result of searching for a matching record when the card type is B, if there is a record that matches only the card type, the control switching unit 27 is instructed to switch control of the host controller driver 21.
When the registration information deleting unit 2f receives a request for deleting a record in the card registration information table 2a from the client terminal 3, the registration information deleting unit 2f deletes the corresponding record.

  FIG. 4 shows a card registration information table 2a. As illustrated, in the card registration information table 2a, a card type, a card ID, and an IP address of a client terminal are registered as records. In FIG. 4, card type: C, card ID: www, and client terminal IP address: 192.168.10.10. Are registered as the first record. Although the IP address is used as the identification information of the client terminal, information identifying the client terminal such as a host name can be used in addition to this.

  The USB virtual driver will be described with reference to FIG. The USB virtual driver is for realizing remote control of a USB device via a network. In the first and second embodiments, the IC card reader / writer connected to the IC card server as the USB device to be controlled corresponds to the IC card server. In the third embodiment, the USB device to be controlled is connected to the IC card server. An IC card reader / writer and a printer device are equivalent.

  First, the USB virtual driver 38 is registered in the USB driver stack of the client terminal 3. The USB virtual driver 38 behaves as a virtual host controller driver for the USB host driver 36.

  Similarly, the IC card server 2 also has a USB virtual driver 26 in the USB driver stack. The USB virtual driver 26 behaves as a virtual USB upper driver for the host controller driver 21.

Hereinafter, the operation of the USB virtual driver will be described.
When the USB upper driver 36 of the client terminal 3 issues a USB command (URB), the USB virtual driver 38 acquires it, generates data to be transmitted to the network based on the information of the USB command, and stores it in the queue. Then, the data is sequentially taken out from the queue, encapsulated in an IP packet, and transmitted to the IC card server 2 on the network.

  The encapsulated data is transmitted to the IC card server 2 via the network 4. When the USB virtual driver 26 of the IC card server 2 receives the encapsulated data, the USB virtual driver 26 releases the encapsulation and acquires the internal data. Then, the USB command is reconstructed from the acquired data and given to the USB host controller driver 21. The USB host controller driver 21 gives a USB command to the USB device (IC card reader / writer 7).

  The same applies to the reverse control. The USB virtual driver 26 of the IC card server 2 encapsulates the USB command given from the host controller driver 21 in the IP packet and transmits it to the client terminal 3 on the network.

  The encapsulated data is transmitted to the client terminal 3 via the network 4. The USB virtual driver 38 of the client terminal 3 receives the encapsulated data, releases the encapsulation, acquires the internal data, reconfigures the USB command from the data, and gives it to the USB upper driver 36.

  FIG. 5 shows a format diagram of the encapsulated data. The encapsulated data is a format for network communication, and has a MAC header, an IP header, a TCP header, and a Tunneling header. The MAC header, the IP header, and the TCP header are configurations used in network communication using the conventional TCP / IP protocol. The Tunneling header has a configuration for USB virtual connection, and stores information for reconfiguring the USB command. The data portion corresponds to a USB command. In the USB virtual connection, a protocol other than TCP / IP may be used as a protocol for communicating with the network.

  Since the USB virtual driver does not make the USB host driver aware of the existence of the network, the client terminal treats the USB device connected to the IC card server on the network as if it were its own local device. Can be controlled. As a result, the USB device connected to the IC card server from the client terminal can be used through the network.

  Next, the hardware configuration of the client terminal is shown in FIG. The client terminal includes a CPU that controls its operation, a RAM (Random Access Memory) that temporarily stores programs and data that the CPU refers to at the time of execution, and a ROM (Read Only) that stores predetermined programs executed by the CPU. Memory), a hard disk as auxiliary storage means for storing an operating system and various programs, an input device such as a keyboard and a mouse, a display device such as a display, and a communication with an IC card server via a network such as a LAN. A network I / F for connecting to the IC card reader and a USB I / F for connecting to an IC card reader / writer.

  Next, the hardware configuration of the IC card server is shown in FIG. The IC card server is connected to a CPU for controlling its operation, a ROM and a RAM for storing programs and data, a network I / F for communicating with a client terminal via a network such as a LAN, and an IC card reader / writer. A USB / IF, a display / sound output unit such as an LED / buzzer, and a printer I / F for connecting to a printer.

  Next, a data flow between the client terminal and the IC card server in the IC card information authentication system according to the first embodiment will be described with reference to FIG. The numbers in parentheses in the figure correspond to the column numbers in parentheses in the following description.

  First, as a system premise, the IC card server is in a state where it can recognize and control an IC card reader / writer connected locally to the IC card server. The client terminal is in a state where it can recognize and control the IC card reader / writer connected locally to the client terminal.

As an example, the processing flow for printing from a print application of a client terminal will be described below with reference to FIGS.
(1) The user operates the print application 31 of the client terminal 3 to instruct printing of data to be printed. In response to this, the client terminal 3 generates print data, stores it in a spool area (not shown), and acquires the card ID, card type, and user information of the IC card input to the IC card reader / writer 5. ,Remember. Then, the card ID and the card type are transmitted to the IC card server 2.

(2) The IC card server 2 receives the card ID and card type of the IC card. Then, the card ID, the card type, and the IP address of the transmission source client terminal are registered as records in the card registration information table 2a.

(3) The user goes to the installation location of the IC card server 2 and places the IC card on the IC card reader / writer 7 connected to the IC card server 2.
(4) The IC card server 2 acquires the card ID and card type of the IC card via the IC card reader / writer 7.

(5) When the acquired card type is A or C, the IC card server 2 searches the card registration information table 2a. And it is collated whether the record in which card ID and card type correspond is registered.
(6) When there is a matching record, the IC card server 2 disconnects the IC card R / W driver 22 in the IC card server 2 and performs USB virtual connection with the client terminal 3. As a result, the IC card reader / writer 7 connected to the IC card server 2 can be controlled from the client terminal 3.

  In the process (5), when the acquired card type is B, the card ID is not verified, and the USB virtual connection is performed to the client terminal 3 of the record with the matching card type.

(7) When the USB virtual connection is established, the IC card application 34 of the client terminal 3 controls the IC card reader / writer 7 connected to the IC card server 2 and collates user information in the IC card.
(8) When valid authentication is obtained by collating user information, peripheral device information such as print information is written in the user information in the IC card as required for information recording such as billing and access history.
(9) When the processing to the IC card is completed, the USB virtual connection is disconnected.
(10) The IC card server 2 starts controlling the IC card reader / writer 7 again.
(11) The port monitor 33 of the client terminal 3 receives the print data from the spool area and transmits it to the IC card server 2 because the legitimate authentication is obtained by collating the user information.
The IC card server 2 transmits the received print data to the printer device 6. The printer device 6 prints out the print data.

  The transmission of print data by the port monitor 33 may be performed before the USB virtual connection is disconnected. That is, the user information collation is completed, the print data is transmitted from the port monitor 33 of the client terminal 3, the peripheral device information is written in the user information, and the USB virtual connection is disconnected. You may do it.

  Next, details of the operation of the IC card server 2 will be described with reference to the flowcharts of FIGS. 1 and 9 to 12.

FIG. 9 is an operation flowchart of the IC card server according to the IC card information registration.
First, the IC card reader / writer 7 is connected to the USB I / F of the IC card server 2 (step S901). Then, the USB plug and play mechanism operates, the IC card R / W driver 22 is registered, and the IC card reader / writer 7 can be used (control function ON) (step S902). At this stage, the card ID and the card type read from the IC card reader / writer 7 are managed by the card information management through the control of the host controller driver 21, USB upper driver 23, and IC card R / W driver 22 of the IC card server 2. It is transmitted to the part 24.

  The IC card server 2 waits for a card ID and a card type to be sent from the client terminal 3 on the network (step S903). When the card ID and the card type are received from the client terminal 3 (step S903), the card ID, the card type, and the IP address of the transmission source client terminal are registered as a record in the card registration information table 2a (step S904). When registration is completed, the process returns to the card ID and card type reception waiting state.

  A registration process of the card ID, the card type, and the IP address of the transmission source client terminal in step S904 will be described. The received card ID and card type are passed to the card information management unit 24 via the network control unit 25. The card information registration unit 2b of the card information management unit 24 registers the card ID and the card type as a record in the card registration information table 2a together with the IP address of the transmission source client terminal.

  10, FIG. 11, and FIG. 12 are operational flows for IC card verification, USB virtual connection establishment and its disconnection processing.

The operation flow up to the card type determination is shown in FIG.
First, the user moves to a place where the IC card server 2 is located and places the IC card on the IC card reader / writer 7. Thereby, the processing of the IC card server 2 is started. The IC card server 2 determines whether or not a record is registered in the card registration information table 2a (step S1001). If registered, the card ID and card type of the IC card are acquired from the IC card reader / writer 7 (step S1002). It is determined whether the card ID and the card type have been acquired (step S1003). If acquisition is successful, it is determined whether the card type corresponds to A or C (step S1004). If the card type is A or C, the flow continues to the flow of FIG. Otherwise (the card type is B), the flow continues to the flow of FIG.

The process when the card type is A or C will be described with reference to FIG.
The search means 2d of the IC card server checks whether the card ID and the card type acquired from the IC card reader / writer 7 match the first record registered in the card registration information table 2a (step S1101). If they do not match, it is determined whether there is a next record (step S1102). If there is a next record, the next record is confirmed (step S1103), and it is checked whether the card ID and the card type match (step S1101). In step S1102, if there is no next record, the process ends.

  If there is a record that matches the card ID and card type acquired from the IC card reader / writer in step S1101, the control of the IC card reader / writer 2 is turned OFF (step S1104).

  Processing for turning off the control of the IC card reader / writer 2 will be described in detail. If there is a matching record in the card registration information table 2a, the search means 2d notifies the control switching means 2e to that effect. The control switching unit 2e instructs the control switching unit 27 to switch control. Upon receiving such a command, the control switching unit 27 notifies the plug and play mechanism (not shown) of the operating system of the IC card server 2 that the IC card reader / writer 7 has been disconnected. As a result, the software level USB connection is disconnected, and the control of the IC card reader / writer 7 is turned off.

  Returning to the flow of FIG. When the control of the IC card reader / writer 7 is turned OFF, the control switching unit 27 switches the control of the host controller driver 21 to the USB virtual driver 26 of the IC card server 2. Then, the USB virtual driver 26 of the IC card server 2 establishes a USB virtual connection with the USB virtual driver 38 of the client terminal 3 (step S1105). The IP address of the client terminal to be connected is registered in the matched record.

  Here, the process of establishing the USB virtual connection (step S1105) will be described. The control switching unit 27 associates the host controller driver 21 and the USB virtual driver 26 after turning off the control of the IC card reader / writer 7. Further, the card information management unit 24 gives the IP address of the client terminal to be connected to the USB virtual driver 26. In response to this, the USB virtual driver 26 establishes a communication connection with the client terminal 3. Specifically, the USB virtual driver 26 of the IC card server 2 issues a communication connection establishment request by the TCP / IP protocol to the USB virtual driver 38 of the client terminal 3, and the USB virtual driver 38 of the client terminal 3 This is done by sending a response to the establishment. When the USB virtual connection is established, USB configuration information is transmitted from the IC card server 2 to the client terminal 3, and a plug and play process is started by a plug and play mechanism (not shown) of the client terminal 3. . As a result, the IC card R / W driver 35 of the client terminal 3 is registered, and the IC card reader / writer 7 connected to the IC card server 2 from the client terminal 3 can be controlled.

  That is, the IC card application 34 of the client terminal 3 can access the IC card by controlling the IC card reader / writer 7 connected to the IC card server 2 via the USB virtual connection.

  Returning to the flow of FIG. The USB virtual connection process shown in step S1106 indicates a state in which data communication is performed through USB virtual connection. In the USB virtual connection state, the IC card server 2 determines whether there is a record deletion request from the client terminal 3 (step S1107). If there is a record deletion request, the registration information deletion unit 2f of the card information management unit 24 deletes the record in the card registration information table 2a (step S1108).

  When the use of the IC card reader / writer 7 connected to the IC card server 2 by the client terminal 3 ends, a disconnection command is given to the USB virtual driver 38 of the client terminal 3. The USB virtual driver 38 of the client terminal 3 transmits a disconnection command to the USB virtual driver 26 of the IC card server 2. Thereby, the USB virtual connection communication connection between the client terminal 3 and the IC card server 2 is disconnected.

  When determining that the USB virtual connection is disconnected (step S1109), the control switching unit 27 switches the control of the IC card reader / writer 7 to the USB host driver 23. Specifically, when the control switching unit 27 gives a signal to the effect that the IC card reader / writer 7 has been connected to the plug and play mechanism of the operating system of the IC card server 2, the plug and play operates, and the USB upper driver 23 And the IC card R / W driver 22 is registered. As a result, the control of the IC card reader / writer 7 is turned on (step S1110).

  This completes the description of the USB virtual connection when the card type is A or C. Next, USB virtual connection when the card type is B will be described. The IC card of the card type B has a different card ID value for each reading, and therefore only the card type is checked without checking the card ID.

If it is determined in step S1004 of the operation flow in FIG. 10 that the card type is B, the operation flow proceeds to FIG.
First, it is determined whether or not the control of the IC card reader / writer 7 of the IC card server 2 is ON (step S1201). If the control of the IC card reader / writer 7 is ON, it is turned OFF (step S1202). When the control of the IC card reader / writer 7 is turned off, the search means 2d searches for a card type B record, and makes a USB virtual connection to the client terminal of the IP address registered in the record (steps S1203 and S1204).

In step S1205, it is determined whether a record deletion request is received. If received, the record is deleted (step S1206).
Next, it is determined whether or not the USB virtual connection has been disconnected (step S1207). If disconnected, it is determined whether or not the record has been deleted in step S1206 (step S1208). If deleted, the control of the IC card reader / writer 7 is turned on (step S1209). In step S1206, if not deleted, it is determined whether there is a next record (step S1212).

  If there is no next record, the process proceeds to step S1214. If there is a next record, the next record is confirmed (step S1213), and it is determined whether the card type is B (step S1211). If the card type is B, the process returns to step S1201 again. If the card type is not B and there is no further record (step S1212), it is determined whether or not the control of the IC card reader / writer 7 is ON (step S1214). If the control of the IC card reader / writer 7 is OFF, it is turned ON (step S1215).

  The above is the operation flow for the USB virtual connection in the case of the card type B. Next, the difference between the case where the card type is B and the case where the card type is A or C will be described. The card type B is different in that the card ID is not verified before the USB virtual connection. This is because the value of the card ID of the card type B is different every time the IC card reader / writer reads it, so that the collation based on the card ID cannot be performed. Therefore, when it is determined that the card type is B, the USB virtual connection is performed as it is. This is the operation flow from step S1201 to step S1215 shown in FIG.

  In the operation flow of the card type B, if the collation is successful as a result of the collation of the user information, the subsequent operation is the same as that of the card type A or C. If the user information is collated and the collation is NG, the USB virtual connection is disconnected. Upon receiving such disconnection, the search means of the card information management unit searches for the next card type B record registered in the card registration information table. If there is a record of card type B, the USB virtual connection is made to the client terminal of the record, and the user information is collated again at the client terminal. As described above, when the card type is B, a plurality of records (records with a card type of B) registered in the card registration information table are sequentially checked until valid authentication of user information is obtained.

Details of the operation of the client terminal 3 will be described with reference to FIGS. 1, 13, and 14.
First, an operation flow when a print request is made from a client terminal will be described with reference to FIG.

  The user instructs printing by operating the print application 31 of the client terminal 3 (step S1301). In response to this, the print application 31 gives a print instruction to the printer driver 32 via the operating system. Based on the print instruction, the printer driver 32 converts the data to be printed into a format that can be interpreted by the printer device 6 such as PDL, and provides the print data to a print spooler (not shown).

  Next, the port monitor 33 is activated by a command from the printer driver 32. The port monitor 33 instructs the IC card application 34 to acquire the card ID, card type, and user information of the IC card. In response to this instruction, the IC card application 34 determines whether an IC card is placed in the IC card reader / writer 5. If the IC card is placed and can be read, the card ID, card type, and user information are acquired (step S1302). If the acquisition is successful, the IC card application 34 stores the card ID, card type, and user information of the IC card. The print spooler stores the print data received from the printer driver 32 in a spool area such as a hard disk (step S1303). Next, the IC card application 34 gives the card ID and card type to the port monitor 33. The port monitor 33 transmits the card ID and card type to the IC card server 2 (step S1304).

  Next, an operation flow for collating an IC card input to an IC card reader / writer connected to the IC card server will be described with reference to FIG.

  First, the client terminal 3 determines whether print data is stored in the spool area (step S1401). If the print data is stored in the spool area, it waits for a request for establishing a USB virtual connection from the IC card server 2 (step S1402). If a USB virtual connection establishment request is not received after a certain period of time, it is determined that a timeout has occurred (step S1403), and the print data, card ID, card type, and user information are deleted (step S1409). When a USB virtual connection establishment request is received from the IC card server 2, the USB virtual connection is established in response thereto. Thereby, the IC card reader / writer 7 connected to the IC card server 2 from the client terminal 3 can be controlled.

  When the USB virtual connection is established, the IC card application 34 of the client terminal 3 acquires user information of the IC card input to the IC card reader / writer 7 connected to the IC card server 2 (step S1404). The acquired user information and the already acquired user information are collated (step S1405). If the collation is NG, the USB virtual connection is disconnected (step S1410). If the verification is OK, a record deletion request of the IC card server 2 is made (step S1406), and a USB virtual connection disconnection request is made (step S1407).

  Next, the port monitor 33 of the client terminal 3 acquires the print data stored in the spool area and transmits it to the IC card server 2 (step S1408). Then, the card ID, card type, and user information are deleted (step S1409).

  In the above description, the print data is transmitted after the USB virtual connection is disconnected. However, the print data may be transmitted before the USB virtual connection is disconnected. In this way, after transmitting the print data, peripheral device information such as print information after printing and billing information can be written in the user information of the IC card using the USB virtual connection.

  Next, Example 2 will be described. FIG. 15 is a functional block diagram of the IC card information authentication system according to the second embodiment. The difference from the first embodiment is that the printer device 6 is directly connected to the network 4. Therefore, there is no print server function unit in the IC card server 2. The functional blocks of the client terminal 3 are the same as those in the first embodiment.

  The hardware configuration of the client terminal of the second embodiment is the same as that of the first embodiment.

  FIG. 16 shows a hardware configuration of the IC card server according to the second embodiment. Since the printer apparatus is directly connected to the network, the printer apparatus is different from the first embodiment in that there is no printer I / F.

The operation of the second embodiment will be described.
The procedure from establishing a USB virtual connection to collating user information is the same as in the first embodiment. When valid authentication is obtained by collating user information, the port monitor transmits print data to the printer device on the network instead of the IC card server. Note that the IP address of the printer apparatus to be transmitted may be registered in the port monitor in advance. That is, the port monitor according to the second embodiment transmits the card ID and the card type to the IC card server when the printing process is started by a printing instruction from the user. Then, after establishing the USB virtual connection and collating the user information, if the collation is OK, the print data is transmitted to the printer device registered in the port monitor.

  In the above description, the IP address of the printer apparatus is registered in the port monitor of the client terminal. However, it may be registered on the IC card server side. In this case, the port monitor can know the IP address of the printer apparatus to be transmitted by notifying the port monitor of the IP address of the printer apparatus from the IC card server side.

  Next, Example 3 will be described. FIG. 17 is a functional block diagram of the IC card information authentication system according to the third embodiment.

A functional block of the client terminal 3 will be described.
The difference from the first embodiment is that the USB virtual connection is also performed in the print data transmission process. As shown in FIG. 17, the print data output from the port monitor 33 of the client terminal 3 is passed to the USB virtual driver 38 via the USB upper driver 36. The port monitor 33 recognizes that the printer device is connected to the local USB I / F of the client terminal. Therefore, the port monitor 33 does not perform the process of transmitting the print data to the network 4, but performs the same process as the process of transmitting to the printer device connected to the local USB I / F. Therefore, the port monitor 33 gives print data to the USB host driver 36. The USB upper driver 36 gives this to the USB virtual driver 38. Then, it is encapsulated in an IP packet by the USB virtual driver 38 and transmitted to the network 4. The card ID and the card type are transmitted from the port monitor 33 to the IC card server via the network control unit 39 as in the first and second embodiments. Other configurations are the same as those in the first embodiment.

A functional block of the IC card server 2 will be described.
The difference from the first embodiment is that the USB virtual connection is also performed in the print data reception process. As shown in the figure, the print data received by the network control unit 25 is given to the USB virtual driver 26. The USB virtual driver 26 releases the encapsulation, gives print data to the host controller driver 21, and the host controller driver 21 transmits the print data to the printer device 6. Other configurations are the same as those in the first embodiment.

  The hardware configuration of the client terminal is the same as in the first and second embodiments.

  The hardware configuration of the IC card server is the same as that of the second embodiment. The printer device is connected to the USB I / F of the IC card server. In the first embodiment, since the IC card server functions as a print server, the printer I / F between the IC card server and the printer device uses IEEE 1284. However, in the third embodiment, since a virtual USB driver is registered in the USB driver stack and the printer apparatus that has passed through the network is controlled, a USB I / F is used as an interface with the printer apparatus. The interface with the IC card reader / writer is the USB I / F as in the first embodiment.

  Next, a data flow between the client terminal and the IC card server in the IC card information authentication system according to the third embodiment will be described with reference to FIGS. 17 and 18. The numbers in parentheses in the figure correspond to the column writings in the parenthesis numbers in the description as in FIG.

As an example, a processing flow will be described below in the case where printing is performed from the print application 31 of the client terminal 3. In the following, differences from the first embodiment will be described.
The difference from the first embodiment is that the print data (8) is transmitted via the USB virtual connection. When the USB virtual connection is established and the client terminal 3 is authenticated with the user information, the port monitor 33 receives the print data from the spool area and gives it to the USB host driver 36. The USB host driver 36 gives the print data to the USB virtual driver 38, and the USB virtual driver 38 transmits it to the IC card server 2. Upon receiving this, the IC card server 2 transmits it to the printer device 6 via the USB virtual driver 26 and the host controller driver 21. As a result, the print data is printed out by the printer device 6.

  The establishment of the USB virtual connection between the client terminal 3 and the printer device 6 is performed simultaneously with the establishment of the USB virtual connection of the IC card reader / writer 7 in FIG. However, the establishment timing of the USB virtual connection can be arbitrarily determined. For example, after the USB virtual connection of the IC card reader / writer 7 is performed first and the authentication of the IC card is obtained, the USB connection with the printer device 6 is performed. You may implement by the procedure of establishing a virtual connection.

  Although the embodiments of the present invention have been described above, the specific configuration is not limited to the above embodiments, and various modifications can be made within the scope described in the claims.

  For example, in each of the above embodiments, a printer device is shown as a peripheral device that transmits or receives data after valid authentication is obtained by checking user information, but other peripheral devices (multifunction devices, Web cameras, A scanner or the like).

  Further, in each of the above embodiments, for convenience of explanation, an example in which one client terminal and one IC card server are connected on the network has been described, but there may be a plurality of these on the network. There may be a plurality of USB devices connected to the IC card server. For example, two printer apparatuses may be connected to one IC card server with a USB cable so that the user can appropriately select a printer apparatus that performs printing via a USB virtual connection.

  In each of the above embodiments, the standard of the interface for performing the virtual connection is USB, but other standards can be used. For example, an IEEE 1394 command can be encapsulated in a network protocol to realize a virtual connection based on IEEE 1394.

  In each of the above embodiments, the USB virtual connection is established even when the card type is A or C. However, the USB virtual connection may be established only when the card type is B. That is, when the card type is A or C, the card ID is verified by the IC card server, so that the IC card verification process is completed, and the print data is transmitted without establishing the USB virtual connection. The process is performed.

  In each of the above embodiments, even when the card type is A or C, the USB virtual connection is established and the user information is collated. However, since the collation by the card ID has already been performed by the IC card server. In the USB virtual connection, only the user information reading process and writing process may be performed without performing user information verification.

  In each of the above embodiments, the printer device and the IC card server are configured as separate units in hardware, but may be configured as a single unit.

  The IC card information authentication system of the present invention can be used for a system using an IC card such as a security printing system.

Functional block diagram of the IC card information authentication system of Embodiment 1 Schematic diagram of IC card structure Functional block diagram related to the card information management unit in the IC card server Card registration information table Encapsulated data format diagram Hardware configuration diagram of client terminal according to first to third embodiments 1 is a hardware configuration diagram of an IC card server according to a first embodiment. Data flow diagram of client terminal and IC card server in IC card information authentication system of the present invention IC card server operation flowchart for IC card information registration Operation flow chart until card type judgment Confirmation flowchart for card type A / C in the flowchart for confirming the card ID Confirmation flowchart for card type B in the flowchart for confirming the card ID Flow chart of print request in client terminal Authentication flowchart for client terminals Functional block diagram of the IC card information authentication system of the second embodiment Hardware configuration diagram of the IC card server of the second and third embodiments Functional block diagram of an IC card information authentication system of Embodiment 3 Data flow diagram of client terminal and IC card server in IC card information authentication system of the present invention (when USB virtual connection is used for transmission of print data)

Explanation of symbols

1 IC card information authentication system 2 IC card server 3 Client terminal 4 Network 5, 7 IC card reader / writer (IC card R / W)
6 Printer device 8 IC card

Claims (12)

An IC card information authentication system comprising an IC card server and a client terminal connected via a network, wherein the IC card server includes a first IC card reader / writer, and the client terminal includes a second IC card reader / writer. There,
A) The IC card server
Card information registration means for storing the IC card information received from the client terminal and the identification information of the client terminal as a record in the card registration information table;
First IC card information acquisition means for acquiring IC card information via the first IC card reader / writer;
Search means for searching a corresponding record corresponding to the IC card information acquired by the first IC card information acquisition means from the card registration information table;
Converting data received from the first IC card reader / writer into a data format capable of communicating with the network, and converting data received from the network into a data format capable of communicating with the first IC card reader / writer. The first IC card reader / writer and the client terminal can communicate with each other through the network by the first data conversion means,
Control switching means for switching the control right of the first IC card reader / writer between the IC card server and the client terminal;
B) The client terminal
Second IC card information acquisition means for acquiring IC card information via the second IC card reader / writer;
Card information transmitting means for transmitting the IC card information acquired by the second IC card information acquiring means to the IC card server;
IC card control means for controlling the first IC card reader / writer and the second IC card reader / writer,
The data issued by the IC card control means is converted into a data format that can be communicated with the network, and the data received from the network is converted into a data format that can be communicated with the IC card control means. An IC card reader / writer and a second data conversion means for enabling communication between the client terminal through the network;
An IC card information authentication system comprising:   The IC card information authentication system according to claim 1, wherein the IC card information includes information on either a card ID or a card type.   The IC card control means includes at least one of reading, writing, and collation of user information of the IC card input to the first IC card reader / writer, and the second data conversion means and the first data conversion means. 3. At least one of reading, writing, and verification of user information of an IC card input to the second IC card reader / writer via the data conversion means is performed. The IC card information authentication system described.   When the card type of the IC card acquired by the first IC card reader / writer is a type in which the card ID does not change every time the IC card is read, the search means specifies the corresponding record by comparing the card type with the card ID. 4. The IC card according to claim 1, wherein the first data conversion unit is connected to the second data conversion unit of the client terminal stored in the corresponding record. Information authentication system.   When the card type of the IC card acquired by the first IC card reader / writer is a type in which the card ID changes every time the IC card is read, the search unit specifies the corresponding record by checking the card type, and 4. The IC card information authentication system according to claim 1, wherein the first data conversion unit performs connection with the second data conversion unit of the client terminal stored in the correspondence record. 5. .   When the card type of the IC card acquired by the first IC card reader / writer is a type in which the card ID changes each time the IC card is read, the first data conversion unit and the second data conversion unit After the connection is disconnected, the search means searches whether there is another record in which the same card type is stored. If the record is detected, the first data conversion means 6. The IC card information authentication system according to claim 5, wherein the connection is made with the second data conversion means of the client terminal stored in the record.   When the card type of the IC card acquired by the first IC card reader / writer is a type in which the card ID changes each time the IC card is read, the first data conversion unit and the second data conversion unit After the connection is disconnected, the search means determines whether or not the record of the disconnected connection has been deleted. If not, there is another record in which the same card type is stored. If the record is detected, the first data conversion unit connects to the second data conversion unit of the client terminal stored in the record. The IC card information authentication system according to claim 5 or 6.   The IC card control means of the client terminal stores the IC card user information acquired by the second IC card server, and collates it with the IC card user information acquired by the first IC card server. The IC card information authentication system according to any one of claims 1 to 7.   When a peripheral device is connected to the IC card server and valid authentication is obtained by collating user information by the IC card control means, the client terminal and the peripheral device are connected via the IC card server. 9. The IC card information authentication system according to claim 1, wherein the data is transmitted or received.   When a peripheral device is connected to a network and when valid authentication is obtained by collating user information by the IC card control means, data transmission or reception is performed between the client terminal and the peripheral device. The IC card information authentication system according to any one of claims 1 to 9.   The second data conversion unit of the client terminal issues a disconnection request to the first data conversion unit after the IC card control unit writes the peripheral device information to the IC card. The IC card information authentication system according to any one of claims 1 to 10. IC card information comprising an IC card server and a client terminal connected via a network, the IC card server comprising a first IC card reader / writer and peripheral devices, and the client terminal comprising a second IC card reader / writer An authentication system,
A) The IC card server
Card information registration means for storing the IC card information received from the client terminal and the identification information of the client terminal as a record in the card registration information table;
First IC card information acquisition means for acquiring IC card information via the first IC card reader / writer;
Search means for searching a corresponding record corresponding to the IC card information acquired by the first IC card information acquisition means from the card registration information table;
Data received from the first IC card reader / writer or the peripheral device is converted into a data format that can be communicated with the network, and the data received from the network is communicated with the first IC card reader / writer or the peripheral device. A first data conversion unit that enables communication between the first IC card reader / writer and the peripheral device and the client terminal through the network by converting the data into a data format that can be performed;
Control switching means for switching the control right of the first IC card reader / writer and the peripheral device between the IC card server and the client terminal;
B) The client terminal
Second IC card information acquisition means for acquiring IC card information via the second IC card reader / writer;
Card information transmitting means for transmitting the IC card information acquired by the second IC card information acquiring means to the IC card server;
IC card control means for controlling the first IC card reader / writer and the second IC card reader / writer,
Peripheral device control means for controlling the peripheral device;
Data that can be communicated with the IC card control means or the peripheral device control means by converting the data issued by the IC card control means or the peripheral device control means into a data format that can be communicated with the network. A second data conversion unit that enables communication between the first IC card reader / writer and the client terminal through the network by converting into a format;
An IC card information authentication system comprising:

Images