JP2013097524A - Ic chip, data protection method, data protection program, ic card and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an IC chip, a data protection method, a data protection program, and an IC card which can secure safety of data stored in the IC chip.SOLUTION: When specific issue processing is completed, an IC chip 1 protects data for a protection set area 21 in a non-volatile memory 5.

Description

  The present invention relates to a technical field such as an apparatus and a method for protecting data.

  An IC card equipped with an IC chip used for various services such as finance, communication, and transportation is provided with a predetermined mode (operation mode) in order to execute processing required for each service. Yes.

  As an example of this mode, a mode in which an IC card user's personal information is written or an issuing process for writing an application or information necessary for processing in a predetermined mode is executed (hereinafter simply referred to as “issuing processing mode” or “ Is called “issue processing”), and after the IC card arrives at the user's hand, for example, by the operation of the application recorded (written) in the storage unit of the IC chip or the like, the service that the user desires to provide is provided. There is a user mode in which a corresponding process is executed.

  This issuance process is used by the IC card manufacturer, the service provider, and the like. For example, the application registration (recording) for executing the process according to the service, the credit function, the mobile phone It is possible to rewrite important information such as a key (such as a password) used in a telephone function (for example, data communication or a telephone function). Therefore, if the issue processing mode can be used after reaching the IC card user's hand, an unauthorized program can be written by a third party other than the IC card manufacturer or the service provider, It becomes possible to change the key (including reading or rewriting). For this reason, it is not preferable in terms of security that the issue processing mode operates after the issue processing mode is used and the predetermined processing is completed by the IC card manufacturer or the service provider.

  Therefore, in order to use the issuance processing mode, a normal IC card takes measures such as requiring a predetermined authentication process (for example, authentication using a password (such as PIN verification)).

  Further, in Patent Document 1, a pre-issue state or a post-issue state is determined based on check data calculated by a predetermined calculation process from data written in the system area, and the program is stored in the memory only when the state is the pre-issue state. A technique for writing is disclosed.

Japanese Patent No. 4457573

  However, in authentication using a password, if the authentication information (password) is leaked or guessed, the issuance processing mode can be used, and the data stored in the IC chip after the issuance processing is completed There is a risk that the data will be read by the three parties, and the safety of the data stored in the IC chip could not be ensured.

  In addition, in the technique disclosed in Patent Document 1, there is a possibility that data stored in the IC chip after completion of the issuing process may be read by a third party. Safety could not be guaranteed.

  Therefore, the present invention has been made in view of such problems and the like, and an IC chip, a data protection method, a data protection program, and an IC card that can ensure the safety of data stored in the IC chip. And it aims at providing a recording medium.

  In order to solve the above problem, the invention according to claim 1 is provided in a protection setting area in which data to be protected is stored, and in the protection setting area, and in accordance with an execution request for issuing processing, A storage unit in which an issue process confirmation area in which a value is written is set, an issue processing means for performing an issue process when a predetermined value is written in the issue process confirmation area, and when a specific issue process is completed And a protection means for protecting data for the protection setting area.

  According to this invention, the safety of data stored in the IC chip can be ensured.

  The invention according to claim 2 is the IC chip according to claim 1, wherein the protection restricts access to the protection setting area and prohibits reading or writing of data to the protection area. Features.

  According to the present invention, the safety of data stored in the IC chip can be more effectively ensured.

  According to a third aspect of the present invention, the IC chip according to the first or second aspect and an IC card base are provided.

  According to a fourth aspect of the present invention, there is provided a protection setting area in which data to be protected is stored, and an issuance process confirmation area provided in the protection setting area, in which a predetermined value is written in response to an issuance process execution request. Is a data protection method in an IC chip including a storage unit in which issuance processing steps for performing issuance processing and specific issuance processing are completed when a predetermined value is written in the issuance processing confirmation area A protection process for protecting data for the protection setting area.

  According to a fifth aspect of the present invention, there is provided a protection setting area in which data to be protected is stored, and an issuance process confirmation area provided in the protection setting area, in which a predetermined value is written in response to an issuance process execution request. When a predetermined value is written in the issuance process confirmation area, a computer included in the IC chip having a storage unit in which is set, issuance processing means for performing the issuance process, when a specific issuance process is completed, It functions as a protection means for protecting the data for the protection setting area.

  According to a sixth aspect of the present invention, there is provided a protection setting area in which data to be protected is stored, and an issuance process confirmation area provided in the protection setting area, in which a predetermined value is written in response to an issuance process execution request. When a predetermined value is written in the issuance process confirmation area, a computer included in the IC chip having a storage unit in which is set, issuance processing means for performing the issuance process, when a specific issuance process is completed, A data protection program that functions as a protection unit that protects data for the protection setting area is stored in a readable manner.

  According to the present invention, when a specific issuing process is completed, the data is protected, so that the safety of the data stored in the IC chip can be ensured.

It is a block diagram which shows the structure and function outline | summary of the IC card which concerns on this embodiment. It is a conceptual diagram which shows the structure of the storage area of the non-volatile memory 5 which concerns on this embodiment. It is a flowchart which shows operation | movement of CPU6 at the time of transfering to protection mode, when the command which shows completion of a specific issuing process is received. 6 is a flowchart showing the operation of the CPU 6 when shifting to a protect mode when a predetermined value is written in the issue process confirmation area 22; It is a table | surface which shows the setting state of protection mode, and the availability of issuing processing. 6 is a flowchart showing an operation from reception of a command of the CPU 6 to processing when a numerical value is written as a predetermined value to be written in the issue processing confirmation area 22; It is a flowchart which shows operation | movement after receiving the command of CPU6 in case a random number is written as a predetermined value written in the issuing process confirmation area | region 22 until it processes.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment when the present invention is applied to an IC card on which a program for executing an issuing process and a predetermined operation is mounted.

[1. IC card hardware configuration and function overview]
First, with reference to FIG. 1, the hardware configuration and functional outline of the IC card of the present application will be described.

  FIG. 1 is a block diagram showing an outline of the configuration and functions of an IC card according to this embodiment.

  As shown in FIG. 1, the IC card 8 includes an IC chip 1 on a card base 7.

  The IC chip 1 includes an I / O circuit 2, a ROM (Read Only Memory) 3, a RAM (Random Access Memory) 4, a nonvolatile memory 5 (an example of a storage unit of the present application), a CPU (Central Processing Unit) 6, and the like. It is configured with. Note that data communication with an external device via the I / O circuit 2 may be either a contact method or a non-contact method (Type A, Type B, Felica (registered trademark), NFC standard, etc.) ( For example, conforming to ISO 7816, ISO 14443, ISO 18092, or ETSI TS 102). The I / O circuit 2 is a processing circuit for data communication with an external device (not shown). The ROM 3 stores a program to be executed by the CPU 6, and the CPU 6 comprehensively controls the IC chip 1 based on this program.

  The programs stored in the ROM 3 include a card OS (an example of the operating system of the present application), issuance processing, prepaid cards and commuter passes for transportation such as railways and buses, settlement services such as credit cards and electronic money, and facilities. There are a plurality of types of application programs for causing the CPU 6 to execute predetermined services such as entry / exit management, and the data protection program of the present invention. The data protection program of the present invention may be incorporated as a function of the card OS or application program. Further, these programs may be stored in the nonvolatile memory 5.

  The RAM 4 is a storage area used as a work area for the CPU 6 to control the IC chip 1 in an integrated manner.

  The non-volatile memory 5 is a kind of non-volatile semiconductor memory (for example, flash memory, EEPROM (registered trademark), etc.), and erases data stored in the storage area and can be stored again and again. ). In the nonvolatile memory 5, for example, each area is assigned an address, and is divided into one or a plurality of pages with a predetermined area as one page. For example, the CPU 6 can identify what data or program is stored in which area of the nonvolatile memory 5 under the control of the card OS or application. Further, under the control of the card OS and application, the CPU 6 identifies an area (for example, a protection setting area, which will be described later) for distinguishing an area partitioned into a predetermined area from the area of the nonvolatile memory 5. 21 and an area name such as the issue processing confirmation area 22).

  Here, the structure of the storage area of the nonvolatile memory 5 according to the present embodiment will be described with reference to FIG.

  FIG. 2 is a conceptual diagram showing the structure of the storage area of the nonvolatile memory 5 according to this embodiment.

  As shown in FIG. 2, a protection setting area 21 and an issue process confirmation area 22 are set in a storage area (memory space) of the nonvolatile memory 5 according to the present embodiment.

  Here, the protection setting area 21 and the issue process confirmation area 22 will be described.

  As described above, in the IC chip 1, the issuing process is executed under the control of a predetermined program.

  In general, in the issue processing in an IC chip, one or a plurality of subdivided issue processing is executed in a predetermined order under the IC card manufacturer (manufacturer) or service provider. It has become.

  Specifically, as one or a plurality of subdivided issue processes, respective issue processes referred to as manufacturing stage, zero-order issue, primary issue, and secondary issue are executed in order.

  The processing contents of each issuance process will be described. For example, in the manufacturing stage, processing related to the manufacture of the IC chip 1 is performed. Specifically, the card OS or the like is stored in the ROM 3 or the like. In the 0th issue, processing related to the individualization of the IC chip 1 is executed. Specifically, the initialization of the IC chip 1, the identifier for identifying the IC chip from other IC chips, and the like are stored. In the primary issue, processing related to AP setting of the IC chip 1 (setting of a predetermined application stored in the IC chip 1) is executed. Specifically, the format of the nonvolatile memory 5 and the predetermined application are stored in the nonvolatile memory. 5, processing such as initial setting information and area reservation necessary for storage in the memory 5, storage (writing) of a predetermined application, and the like are performed. In the secondary issue, processing related to personalization of the IC chip 1 (processing for providing the IC chip 1 optimized in consideration of the user's usage mode, etc.) is executed, and the personal use of the user who uses the IC card 8 And authentication information such as PIN (Personal Identification Number) and biometric information (body / behavioral characteristics such as fingerprints) are stored.

  The protect setting area 21 in the present embodiment is an area in which data to be protected is stored, and is set including the issue process confirmation area 22.

  The data stored in the protection setting area 21 is assumed to be information or an application stored in the issuing process. For example, the application itself for executing the issuing process or AP setting or the identifier of the IC chip 1 is used. It is important to prevent personal information such as personal settings, registration of personal information, authentication information such as PIN, biometrics information, etc. from being read or altered by a third party (ensure confidentiality) Information is expected.

  The issue process confirmation area 22 in the present embodiment is an area in which a predetermined value is written in response to an issue process execution request.

  For example, a different value is written in the issuance process confirmation area 22 each time a command requesting execution of each of the issuance processes referred to as the manufacturing stage, 0th issue, 1st issue, and 2nd issue is input. It is like that.

  As will be described in detail later, the CPU 6 in this embodiment performs an issuing process when a predetermined value is written in the issuing process confirmation area 22.

  As the predetermined value, for example, a numerical value (for example, hexadecimal number, random number, or the like), a symbol, or the like is applied, but any value can be applied. Further, the subdivided one or a plurality of issuing processes are not limited to the above-described example, and can be arbitrarily subdivided (set) according to the specifications of the manufacturer or the like, for example.

  The CPU 6 controls the overall operation of the IC chip 1 based on the program as described above, and functions as an issue processing unit and a protection unit of the present application as a part of its function.

[2. Operation of CPU 6 when shifting to protected mode]
Next, the operation of the CPU 6 when shifting to the protect mode will be described with reference to FIGS.

  As described above, in the issuing process, important information that should be prevented from being read or tampered with by a third party is stored, and an application necessary for providing the service is stored. And if such information is read by a third party after the IC card is distributed to the market, it is not possible to ensure the safety of these information and applications. In addition, if the issuing process is executed after the IC card is distributed in the market, there is a possibility that these information and applications are read, altered, or deleted by a third party.

  Therefore, the CPU 6 according to the present embodiment performs the issuing process when a predetermined value is written in the issuing process confirmation area 22, and the data stored in the protection setting area 21 when the specific issuing process is completed. Is supposed to protect. Hereinafter, the operation of protecting the data stored in the protection setting area 21 when the specific issuing process in the CPU 6 is completed is referred to as “protect mode”.

  Here, completion of the issuance process determined by the CPU 6 indicates a process (operation) that can be assumed that the issuance process by the IC chip manufacturer or the service provider has been completed. For example, the issuance process confirmation area 22 has a predetermined value. Is written (for example, when a flag indicating completion of any issuing process such as the above-described manufacturing stage, zero-order issue, primary issue, or secondary issue is written), or a specific issue process Received a command indicating completion of the process (for example, completion of the issuing process of the above-described manufacturing stage, primary issue, primary issue, or secondary issue), or the issue process has been completed a predetermined number of times Processing of the case etc. can be assumed. Then, when detecting these processes, the CPU 6 determines that the issuing process has been completed.

  Further, the protection of data stored in the protection setting area 21 means that, for example, access to the protection setting area 21 is restricted by software or hardware (switch) control, and the data stored in the protection setting area 21 is stored. Refers to prohibiting reading or writing. Since such a protection method is known, detailed description thereof is omitted. For example, as disclosed in a publicly known document (Japanese Patent Laid-Open No. 2005-85398, etc.), access to the protection setting area 21 by a hardware switch or a software switch. The specific area may be read-only (Read only) or read / write prohibited by setting a status register (bit) that protects the specific area of the nonvolatile memory 5. .

  Here, with reference to FIG. 3, an operation of the CPU 6 when shifting to the protect mode when a command indicating the completion of a specific issuing process is received as an example of the completion of the issuing process determined by the CPU 6 will be described.

  FIG. 3 is a flowchart showing the operation of the CPU 6 when shifting to the protect mode when a command indicating completion of a specific issuing process is received.

  As shown in FIG. 3, when the CPU 6 receives a command set in advance as a command indicating completion of a specific issuing process (step S1: YES), the CPU 6 shifts to the protect mode (step S2). .

  The command indicating the completion of the specific issuing process is defined by, for example, an application that executes the issuing process according to the setting example described above, and is preset (stored) as a command for shifting to the protect mode. . Therefore, when receiving the command, the CPU 6 can identify (determine) whether the received command is a command set in advance as a command indicating completion of a specific issuing process.

  On the other hand, when the received command is not a command preset as a command indicating completion of the specific issuing process (step S1: NO), the CPU 6 executes the process of the received command (step S3). .

  Next, with reference to FIG. 4, the operation of the CPU 6 when shifting to the protect mode when a predetermined value is written in the issue process confirmation area 22 as an example of completion of the issue process determined by the CPU 6 will be described. .

  FIG. 4 is a flowchart showing the operation of the CPU 6 when shifting to the protect mode when a predetermined value is written in the issue process confirmation area 22.

  As shown in FIG. 4, when the CPU 6 receives the command (step S11) and interprets that the received command is a command requesting a data write process to the nonvolatile memory 5 (step S12), the write process is performed. It is determined whether or not the command requesting is a request for writing a predetermined value in the issuing process confirmation area 22 (step S13).

  The predetermined value written by the request for writing the predetermined value in the issuing process confirmation area 22 is defined by, for example, an application that executes the issuing process according to the setting example described above, and is written when the issuing process is completed. As a flag (numerical value or symbol) to be set, it is set in advance. Therefore, when the CPU 6 receives a command requesting a process for writing data to the nonvolatile memory 5, it determines whether or not the predetermined value indicated in the received command is a flag to be written when the issuing process is completed. Can be identified.

  If the CPU 6 determines that the value written in step S12 is a flag to be written when the issuing process is completed (step S13: YES), the CPU 6 shifts to the protect mode (step S14).

  On the other hand, if the CPU 6 determines that the value written in step S12 is not a flag to be written when the issuing process is completed (step S13: NO), the process ends.

  Next, with reference to FIG. 5, the setting state of the protect mode and the availability of the issuing process (mode) will be described.

  FIG. 5 is a table showing the setting state of the protect mode and the availability of the issuing process.

  As described above, a predetermined value that is different every time the issuing process is executed is written in the issuing process confirmation area 22. Then, the CPU 6 permits use of the issuing process (executes the issuing process) only when a predetermined value is normally written in the issuing process confirmation area 22.

  When the CPU 6 determines that the issuing process has been completed, the CPU 6 executes the protect mode.

  Here, when a command (instruction) requesting the use of the issue process is executed after the protect mode is executed, for example, the software writes a predetermined value in the issue process confirmation area 22 in the CPU 6 simultaneously with the authentication. Try to let them. However, since the protect mode is being executed, the CPU 6 cannot write a predetermined value in the issue process confirmation area 22 included in the protect setting area 21. In this case, the CPU 6 determines that the issuance process is completed, and ends the process without executing the issuance process.

  These relationships are shown in the table of FIG.

  As shown in FIG. 5, the protect mode is invalid before the CPU 6 determines that the issuing process is completed (hereinafter referred to as “before issuing process is completed”), and the CPU 6 determines that the issuing process is completed. (Hereinafter referred to as “after issuance process completion”).

  Writing to the issuance process confirmation area 22 can be performed before the issuance process is completed, and cannot be performed after the issuance process is completed.

  The issuing process can be used before the issuing process is completed, and cannot be used after the issuing process is completed.

  Even if a third party who knows the authentication information (authentication for executing the issuance process, PIN, or the like) tries to use (execute) the issuance process after the issuance process is completed, the use of the issuance process is performed. Can be stopped. Thereby, it is possible to prevent such a third party from using the issuing process illegally.

[3. Operation of IC chip 1]
Next, with reference to FIG. 6 and FIG. 7, an operation from receiving a command of the CPU 6 to processing will be described.

  FIG. 6 is a flowchart showing an operation from reception of a command of the CPU 6 to processing when a numerical value is written as a predetermined value written in the issue process confirmation area 22.

  As illustrated in FIG. 6, the CPU 6 receives a command, and when the received command is not an issue processing execution request (step S21: NO), the CPU 6 executes the processing indicated by the command (step S22). For example, when the process indicated by the received command is a user mode execution request (for example, a payment service process request), the CPU 6 executes the user mode.

  On the other hand, if the received command is a request for executing the issuance process (step S21: YES), the CPU 6 is currently issued to write a predetermined value in the issuance process confirmation area 22 in order to execute the issuance process. The value stored in the processing confirmation area 22 is confirmed (step S23).

  If the value stored in the issuance process confirmation area 22 is 1 (step S23: YES), the CPU 6 should write a value different from the value currently stored in the issuance process confirmation area 22. Then, 2 is written in the issuance process confirmation area 22 (step S24).

  On the other hand, if the value stored in the issue process confirmation area 22 is not 1 (step S23: NO), the CPU 6 should write a value different from the value currently stored in the issue process confirmation area 22. Then, 1 is written in the issuance process confirmation area 22 (step S25).

  Then, the CPU 6 determines whether or not the writing to the issuing process confirmation area 22 has been normally completed (step S26).

  When the writing to the issuance process confirmation area 22 is normally completed (step S26: YES), the CPU 6 executes the issuance process (step S27).

  In this case, since the above-described protect mode is not executed, writing of values to the issue process confirmation area 22 is not restricted. Therefore, the CPU 6 is configured to execute an issuing process.

  On the other hand, when the writing to the issuing process confirmation area 22 has not been completed normally (step S26: NO), the CPU 6 executes the fraud handling process (step S28).

  As described above, when the protect mode is executed, a value (information or data) cannot be written in the issue process confirmation area 22. Therefore, in this case, the CPU 6 determines that the third party is using an illegal issue process, and executes an illegal response process.

  The fraud handling process is for stopping the execution of the issuing process. For example, the operation of the IC card 8 (CPU 6) is temporarily stopped, the user mode provided in the IC card 8 is switched, the IC card The code area destruction for destroying 8 can be applied, but is not limited to this, and can be arbitrarily set.

  Next, with reference to FIG. 7, an operation from reception of a command of the CPU 6 in the case where a random number is written as a predetermined value written in the issue process confirmation area 22 to processing will be described.

  FIG. 7 is a flowchart showing an operation from reception of a command of the CPU 6 to processing when a random number is written as a predetermined value written in the issue process confirmation area 22.

  As shown in FIG. 7, the CPU 6 receives a command, and when the received command is not an issue process execution request (step S31: NO), the CPU 6 executes the process indicated by the command (step S32).

  On the other hand, when the received command is an issue process execution request (step S31: YES), the CPU 6 writes a random number as a predetermined value in the issue process confirmation area 22 in order to execute the issue process. A random number is generated (step S33).

  Then, the CPU 6 checks the value currently stored in the issue process confirmation area 22 (step S34).

  If the value stored in the issuance process confirmation area 22 is the same as the generated random number (step S34: YES), the CPU 6 is different from the value currently stored in the issuance process confirmation area 22. In order to write the value, a random number is generated again (step S33).

  On the other hand, if the value stored in the issue process confirmation area 22 is not the same as the generated random number (step S34: NO), the CPU 6 writes the generated random number in the issue process confirmation area 22 (step S35). .

  Then, the CPU 6 determines whether or not the writing to the issuing process confirmation area 22 has been normally completed (step S36).

  When the writing to the issue process confirmation area 22 is normally completed (step S36: YES), the CPU 6 executes the issue process (step S37).

  On the other hand, when the writing to the issue process confirmation area 22 has not been completed normally (step S36: NO), the CPU 6 executes the fraud handling process (step S38).

  As described above, the IC chip 1 according to the present embodiment is provided in the protection setting area 21 in which data to be protected is stored and the protection setting area 21, and has a predetermined value according to the execution request for the issuing process. Is issued when a predetermined value is written in the non-volatile memory 5 in which issuance process confirmation area 22 is set, and issuance process confirmation area 22, and when a specific issuance process is completed, protection is performed. Since the data for the setting area 21 is protected, the safety of the data stored in the protection setting area 21 can be ensured. Further, even if a third party who knows the authentication information after using the IC card on the market tries to use the issuance process after the issuance process is completed, the use of the issuance process can be stopped. The security of the collected data can be ensured. Furthermore, after the issuing process is completed, after the issuing process is completed, reading and writing of data stored in the protection setting area 21 are prevented, so that the safety of the data stored in the protection setting area 21 is increased. Can be secured. The embodiments described above do not limit the invention according to the claims. And not all the combinations of the configurations described in the above embodiment are indispensable means for solving the problems of the invention.

1 IC chip 2 I / O circuit 3 ROM
4 RAM
5 Nonvolatile memory 6 CPU
7 Card base 8 IC card

Claims (6)

A protection setting area for storing data to be protected;
A storage unit that is provided in the protection setting area and in which an issuance process confirmation area in which a predetermined value is written is set in response to an issuance process execution request;
Issuance processing means for performing issuance processing when a predetermined value is written in the issuance processing confirmation area;
Protection means for protecting data for the protection setting area when a specific issuing process is completed;
An IC chip comprising: The IC chip according to claim 1,
The IC chip is characterized in that access to the protection setting area is restricted and data reading or writing to the protection area is prohibited.   An IC card comprising the IC chip according to claim 1 and an IC card base. A protection setting area for storing data to be protected;
A data protection method in an IC chip, which is provided in the protection setting area and includes a storage unit in which an issuance process confirmation area in which a predetermined value is written according to an issuance process execution request is set,
An issuance processing step for performing issuance processing when a predetermined value is written in the issuance processing confirmation area;
A protection process for protecting data for the protection setting area when a specific issuing process is completed;
A data protection method comprising: A protection setting area for storing data to be protected;
A computer included in an IC chip, which is provided in the protection setting area and includes a storage unit in which an issuance process confirmation area in which a predetermined value is written is set in response to an issuance process execution request;
Issuance processing means for performing issuance processing when a predetermined value is written in the issuance processing confirmation area;
Protection means for protecting data for the protection setting area when a specific issuing process is completed;
Data protection program characterized by functioning as A protection setting area for storing data to be protected;
A computer included in an IC chip, which is provided in the protection setting area and includes a storage unit in which an issuance process confirmation area in which a predetermined value is written is set in response to an issuance process execution request;
Issuance processing means for performing issuance processing when a predetermined value is written in the issuance processing confirmation area;
Protection means for protecting data for the protection setting area when a specific issuing process is completed;
A recording medium in which a data protection program is stored so as to be readable.

Images