JP2014215979A - Information storage medium and bytecode execution method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information storage medium and a bytecode execution method capable of effectively coping an attack to cause an illegal operation, while maintaining processing performance.SOLUTION: In an IC card 1, when a value of a program counter indicates a value which corresponds to a bytecode indicating NOP in execution of the bytecode, the value of the program counter is returned to the value before jump after jumping to NOP processing, a value corresponding to the bytecode is acquired from the value of the program counter returned to the value before the jump, and operation of the IC card 1 is stopped when the acquired value corresponding to the bytecode does not indicate NOP.

Description

  The present invention relates to an IC card technology including a virtual machine that executes bytecode.

  Many recent IC cards are compatible with Java (registered trademark) Card. A programming language such as Java (registered trademark) is different from a language that is converted from source code to native code (machine language) by compiling, such as C language, in order to absorb hardware dependency. It is converted into byte code which is called executable format. The byte code is a data string including instructions such as arithmetic and branch. This bytecode is executed by a virtual machine. In an IC card including such a virtual machine, a threat that data on the memory is falsified by an external attack (attack) on the virtual machine or the memory becomes a problem. There are technologies disclosed in Patent Documents 1 and 2 as existing technologies related to the security of virtual machines and Java (registered trademark) cards in secure microcomputers. The technique of Patent Document 1 is a technique for improving security by mounting a plurality of virtual machines on one processor. On the other hand, the technique of Patent Document 2 is a technique for preventing a malicious program by inserting an encrypted application in the middle of communication, decrypting the application internally, and further performing a falsification inspection at a predetermined timing using Hash. .

JP-T-2006-522968 JP 2007-226277 A

  By the way, in Java (registered trademark), NOP (No operation) is defined in a byte code instruction (mnemonic) in accordance with a program language specification. NOP is an instruction that does nothing, and in the NOP processing corresponding to the instruction, nothing is done and only the program counter is incremented. The NOP instruction is not used for operating a normal application installed in the IC card. However, as long as it conforms to the language specification described above, the IC card needs to provide an environment in which the NOP instruction can be executed.

  However, there is a problem that a malicious attacker intentionally changes the byte code to NOP by laser attack or the like, thereby skipping a specific process (branch, calculation) and causing the application to perform an unintended operation. With respect to this problem, the technique of Patent Document 1 is not practical in an environment such as an IC card where power is low and resources are small. On the other hand, although the technique of Patent Document 2 can prevent a malicious program from operating, it is not effective for an attack in which an illegal operation is generated by an attack based on the language specification described above. Further, when security is improved in an IC card on which a virtual machine is mounted, the processing becomes heavier and performance is degraded accordingly.

  An object of the present invention is to provide an information storage medium and a bytecode execution method that can effectively cope with an attack that generates an illegal operation while maintaining processing performance.

  In order to solve the above-mentioned problem, the invention according to claim 1 is capable of executing a plurality of byte codes stored in a non-volatile memory, including a byte code indicating an instruction that does nothing. An information storage medium comprising a virtual machine, and in the execution of the bytecode, when the value of the program counter indicates a value corresponding to the bytecode indicating the instruction that does nothing, after shifting to the processing of the bytecode The program counter value is returned before the transition, the acquisition means for acquiring the value corresponding to the byte code from the value of the program counter returned before the transition, and the byte code acquired by the acquisition means Stop means for stopping the operation of the information storage medium when the value does not indicate the instruction to do nothing. To.

  According to a second aspect of the present invention, in the information storage medium according to the first aspect, the nonvolatile memory stores an error detection code used for error detection of the plurality of byte codes, and the acquisition unit When the value of the program counter indicates a value corresponding to a byte code indicating an instruction that does nothing, the error detection code is used to determine whether there is an error in the plurality of byte codes and to determine that there is an error. In this case, after shifting to the processing of the byte code, the value of the program counter is returned before the transition, and a value corresponding to the byte code is obtained from the value of the program counter returned before the transition. And

  The invention according to claim 3 is an information storage medium comprising a virtual machine capable of executing a plurality of byte codes stored in a nonvolatile memory and including a byte code indicating an instruction that does nothing In the bytecode execution method, in the execution of the bytecode, when the value of the program counter indicates a value corresponding to the bytecode indicating the instruction that does nothing, the program is transferred to the bytecode and then the program Returning the value of the counter before the transition, obtaining a value corresponding to the byte code from the value of the program counter returned before the transition, and the value corresponding to the acquired byte code do nothing And a step of stopping the operation of the information storage medium when no command is indicated.

  According to the present invention, it is possible to effectively cope with an attack that causes an illegal operation such as changing the bytecode to an instruction that does nothing intentionally while maintaining processing performance.

(A) is a figure which shows the hardware structural example of IC card 1, (B) is a figure which shows the functional block example of IC card 1. FIG. It is a flowchart which shows a NOP process example.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  First, the schematic configuration and functions of the IC card 1 will be described with reference to FIG. FIG. 1A is a diagram illustrating a hardware configuration example of the IC card 1, and FIG. 1B is a diagram illustrating a functional block example of the IC card 1. The IC card 1 is used as a cash card, a credit card, an employee card, or the like. Alternatively, the IC card 1 is incorporated into a communication device such as a smartphone or a mobile phone. The IC card 1 constitutes an information storage medium in the present invention. However, the IC card 1 may be directly incorporated on a circuit board of a communication device.

  As shown in FIG. 1A, an IC chip 1a is mounted on the IC card 1. The IC chip 1a includes a CPU (Central Processing Unit) 10, a ROM (Read Only Memory) 11 that is a nonvolatile memory, a RAM (Random Access Memory) 12 that is a volatile memory, a flash memory 13 that is a nonvolatile memory, and an I / O circuit 14 is provided. Note that an EEPROM may be used instead of the flash memory. The IC chip 1a communicates with or without contact with the external terminal 2 including the IC reader / writer via the I / O circuit 14. The I / O circuit 14 serves as an interface with the external terminal 2. The I / O circuit 14 is provided with eight terminals C1 to C8 defined by, for example, ISO / IEC7816. For example, the C1 terminal is a power supply terminal, the C2 terminal is a reset terminal, the C3 terminal is a clock terminal, the C5 terminal is a ground terminal, and the C7 terminal is a terminal that performs data communication with the external terminal 2. Examples of the external terminal 2 include an ATM, a ticket gate, and an authentication gate. Alternatively, when the IC card 1 is incorporated in a communication device, the external terminal 2 corresponds to a controller responsible for the function of the communication device.

  The CPU 10 is an arithmetic device that executes various programs stored in the ROM 11 or the flash memory 13. The various programs include application programs described in a program language (program language in which NOP is defined in bytecode instructions (mnemonics)) such as an OS (Operating System), a virtual machine, and Java (registered trademark). . As shown in FIG. 1B, the virtual machine operating on the OS interprets and executes bytecode that is an intermediate language between the source code and the native code. The virtual machine also has a value corresponding to a byte code to be executed next (for example, an address of the byte code, an offset indicating the byte code, or the byte code) among the plurality of byte codes stored in the flash memory 13. A program counter indicating (label value). Such a bytecode is obtained by compiling the application program at the time of installation of the application program and stored in the flash memory 13, for example.

  Further, the flash memory 13 stores a CRC (Cyclic Redundancy Check) as an error detection code used for error detection of all byte codes corresponding to the application program (in other words, error detection of the application program). Instead of CRC, a check code or a checksum may be used. This CRC is calculated and stored when the application program is installed, for example, and is associated with the application program.

  The virtual machine functions as an acquisition unit of the present invention, so that the value of the program counter corresponds to a byte code indicating NOP that is an instruction to do nothing (NOP mnemonic value ( For example, when pointing to a mnemonic type)), after jumping (transitioning) to NOP processing, the program counter value is returned before the jump, and the program counter value returned before the jump corresponds to the byte code. Get the value to be. The virtual machine functions as a stopping unit of the present invention, and stops the operation of the IC card 1 when the value corresponding to the acquired bytecode does not indicate NOP. When the value of the program counter indicates the value corresponding to the byte code indicating NOP, the virtual machine determines whether or not there are errors in a plurality of byte codes corresponding to the application program using CRC (by checking CRC) Only when it is determined that there is an error, it may be configured to jump to the NOP process (after the jump, the same as above).

  Next, details of the NOP process will be described with reference to FIG. FIG. 2 is a flowchart showing an example of NOP processing.

  The NOP process shown in FIG. 2 is started by jumping to the byte code indicating the NOP when the value of the program counter indicates a value corresponding to the byte code indicating the NOP after the virtual machine is started, for example. . When the NOP process shown in FIG. 2 is started, the virtual machine uses the CRC to determine whether or not there are errors in a plurality of bytecodes corresponding to the application program (that is, whether or not the CRC is invalid). Determine (step S1). For example, if the fixed-length value obtained by substituting all byte codes corresponding to the application program as input values into a predetermined function does not match the CRC stored in the flash memory 13, the CRC is invalid. (Step S1: YES), the operation of the IC card 1 is stopped (Step S2). On the other hand, if the CRC matches, it is determined that the CRC is not invalid (step S1: NO), and the process proceeds to step S3.

  In step S3, the virtual machine returns the value of the program counter before the jump to the NOP process (for example, subtracts the value of the program counter). Note that, since the value of the program counter is returned to the original value in step S7, which will be described later, the value before the NOP processing may be held in a backup.

  Next, the virtual machine acquires a value corresponding to the byte code from the value of the program counter returned before the jump of the NOP process (step S4). Next, the virtual machine determines whether or not the value corresponding to the bytecode acquired in step S4 indicates NOP (step S5). If the value corresponding to the byte code indicates NOP (step S5: YES), the virtual machine returns the value of the program counter to the original value (that is, the value before returning to NOP processing) (step S6). , NOP processing ends. The value subtracted in step S3 may be returned to the original value by incrementing (adding), or may be returned using the value stored in the backup. On the other hand, if the value corresponding to the bytecode does not indicate NOP (step S5: NO), it is considered that the program counter has been tampered with (that is, the bytecode has been intentionally changed to NOP by an external attack). The virtual machine stops the operation of the IC card 1 (step S7).

  As described above, according to the above embodiment, in the IC card 1, in the execution of the byte code, when the value of the program counter indicates the value corresponding to the byte code indicating NOP, after jumping to the NOP process, When the value of the program counter is returned before the jump, the value corresponding to the byte code is acquired from the value of the program counter returned before the jump, and the value corresponding to the acquired byte code does not indicate NOP Since the operation of the IC card 1 is stopped, it is possible to effectively cope with an attack that causes an illegal operation such as intentionally changing the byte code to NOP while maintaining the processing performance. . For example, checking the CRC of the bytecode for each mnemonic process leads to a problem that the processing speed decreases, but in this embodiment, the CRC check is performed only for NOPs that are not normally used during the operation of the application program. Therefore, the application operation speed is not lowered, and therefore the processing performance can be maintained.

1 IC Card 2 External Terminal 1a IC Chip 10 CPU
11 ROM
12 RAM
13 Flash memory 14 I / O circuit

Claims (3)

An information storage medium comprising a virtual machine capable of executing a plurality of byte codes stored in a non-volatile memory and including a byte code indicating an instruction that does nothing.
In execution of the bytecode, when the value of the program counter indicates a value corresponding to the bytecode indicating the instruction that does nothing, after the transition to the processing of the bytecode, the value of the program counter is changed to the value before the transition. Return means for acquiring a value corresponding to a bytecode from the value of the program counter returned before the transition;
Stop means for stopping the operation of the information storage medium when the value corresponding to the bytecode acquired by the acquisition means does not indicate the instruction to do nothing;
An information storage medium comprising: The nonvolatile memory stores an error detection code used for error detection of the plurality of byte codes,
When the value of the program counter indicates a value corresponding to a byte code indicating an instruction that does nothing, the acquisition unit determines whether or not there is an error in the plurality of byte codes using the error detection code. Only when it is determined that there is, after shifting to the processing of the byte code, the value of the program counter is returned before the shifting, and the value corresponding to the byte code is obtained from the value of the program counter returned before the shifting. The information storage medium according to claim 1. A bytecode execution method in an information storage medium comprising a virtual machine capable of executing a plurality of bytecodes stored in a non-volatile memory and including a bytecode indicating an instruction that does nothing.
In execution of the bytecode, when the value of the program counter indicates a value corresponding to the bytecode indicating the instruction that does nothing, after the transition to the processing of the bytecode, the value of the program counter is changed to the value before the transition. Returning, obtaining a value corresponding to the bytecode from the value of the program counter returned before the transition;
Stopping the operation of the information storage medium if the value corresponding to the acquired bytecode does not indicate the instruction to do nothing;
A bytecode execution method comprising:

Images