JP2016099711A - Ic card and its starting method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable an IC card to execute complete start processing even if the start processing of the IC card does not complete within an IC card start time requested by an IC card reader or a reader/writer and thereby prevent security related problems.SOLUTION: An IC card comprising means for executing an initial response to a start request signal from a reader/writer within a prescribed time comprises: means for executing start processing after receiving the start request signal and before the initial response; means for receiving a command APDU from the reader/writer after the initial response; means for executing incomplete start processing when the start processing does not complete even after the command APDU is received and executing command APDU processing of generating a response APDU to the command APDU after completing the start processing; and means for transmitting the response APDU generated by the command APDU processing executed after the completion of the initial processing to the reader/writer.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an IC card and an activation method thereof, and more particularly to an activation method of an IC card when starting information communication with an IC card reader (reader / writer).

  The IC card is classified into a contact type and a non-contact type according to a method of exchanging information with the reader / writer. In any of these types of IC cards, a time range (response time) until the IC card returns an initial response to an IC card activation request such as power-on from a reader / writer and a reset signal is defined.

  For example, in the case of a contact type IC card, when the IC card receives a reset signal, it performs communication-related parameter setting as an initial setting, and returns an ATR (Answer to reset) as an initial response. This ATR response needs to be within a specified time with respect to the reset signal from the reader / writer.

  In actuality, this activation process has a very short response time of, for example, 400 to 40,000 clocks. Therefore, the activation process can be performed in a short time in order to keep the activation process of the IC card within the specified response time. Only processing is performed. That is, in the normal IC card activation process, only the minimum setting necessary for the operation of the IC card is performed, and a complete check is not performed such as whether the memory is broken.

  However, in the conventional activation processing method, as described above, since only the minimum necessary settings and checks can be performed to keep the initial response from the IC card within the specified time, there is some abnormality. But I couldn't detect it. The reader / writer transmits a command APDU (Application Protocol Data Unit) storing control contents in order to control the activated IC card. When the IC card receives this command APDU, it performs APDU processing according to the content of the received command APDU, returns a response APDU within a predetermined time as a response, and the reader / writer confirms this response, and the control is successful. Whether or not. Therefore, in the conventional activation processing method, there is a possibility that an error or an illegal operation may occur during the processing operation of the command APDU that the IC card continues due to an abnormality that cannot be detected at the time of activation.

  There is a problem that an error during the processing operation of the command APDU as described above or an illegal operation can be a fatal defect for the IC card, such as a clue to a malicious attacker extracting the secret data in the IC card. . In addition, memory check has not been executed up to now because it takes time. However, when unchecked memory is exposed to a malicious attack, for example, flash memory and EEPROM are often rewritten and malfunctions often occur. is there.

  Furthermore, since software security standards have become stricter in recent years, it is necessary to perform a complete check so as not to cause a security problem.

  Therefore, the present invention has been made in view of the above-described conventional problems, and even when the activation process of the IC card is not in time for the activation time of the IC card requested by the IC card reader or reader / writer, the complete activation process can be executed. The present invention relates to an IC card and an IC card activation method in which there is no problem in terms of security.

  In order to solve the above problem, the invention described in one embodiment is an IC card having means for initially responding to a start request signal from a reader / writer within a specified time, and receiving the start request signal Means for executing a start-up process between an initial response, a means for receiving a command APDU from the reader / writer after the initial response, and the start-up process is completed even after receiving the command APDU. If there is not, the incomplete startup process is executed, and after the startup process is completed, a command APDU process for executing the command APDU and a response APDU as a result of the command APDU process are generated as a response to the command APDU And a command APDU process executed following completion of the startup process. An IC card comprising: a means for transmitting a response APDU generated as result to the reader writer.

  According to the present invention, since command APDU processing is not performed while containing a hardware abnormality, it is possible to prevent an illegal operation of the IC card and occurrence of an error during command APDU processing. As a result, data in the IC card can be protected from malicious attackers.

It is a figure which shows the hardware constitutions of the IC card concerning this embodiment. It is a figure which shows the function structure of the IC card concerning this embodiment which communicates with a reader / writer. It is a figure which shows the timing chart of the starting process of the IC card concerning this embodiment. It is a figure which shows the timing chart of the waiting time management program in the IC card concerning this embodiment.

  Hereinafter, the IC card and the IC card activation processing method according to the present embodiment will be described in detail.

  In the IC card of this embodiment, the hardware check and setting of the IC card can be performed before the IC card operation without depending on the time limit of the initial response of the IC card. Specifically, only the minimum necessary settings are made before the initial response, and the initial response is made. After that, after checking the hardware and setting that could not be made before the initial response in the IC card, and receiving the first command APDU from the R / W, the response APDU reply waiting time for the received APDU is extended as needed. Then, if there is no abnormality as a result of the complete check, processing of the command APDU is started.

  FIG. 1 shows the hardware configuration of an IC card according to this embodiment. The IC card 1 of this embodiment includes a CPU 11, a coprocessor 12, a random number generator 13, an I / O 14, a ROM 15, a RAM 16, and an EEPROM 17. The CPU 11, the coprocessor 12, the random number generator 13, the I / O 14, the ROM 15, the RAM 16, and the EEPROM 17 are connected to each other via a bus.

  The CPU 11 functions as a control unit that controls the entire IC card 1. The CPU 11 executes processing based on control programs and control data stored in the ROM 15 and the EEPROM 17. For example, the CPU 11 executes various processes according to signals / commands received from the reader / writer, and generates data such as ATRs and responses as processing results. Further, the CPU 11 can generate a command to be executed by the reader / writer.

  The coprocessor 12 functions as a processing device dedicated to cryptographic operations. The coprocessor 12 is controlled by the CPU 11 based on a signal / command from the reader / writer, performs necessary cryptographic operations such as encryption and decryption, and sends the result of the operation to the CPU.

  The random number generator 13 functions as a processing device dedicated to random number generation. The random number generator 13 is controlled by the CPU 11 on the basis of a signal / command from the reader / writer and performs random number generation processing. For example, when the IC card 1 receives a mutual authentication command, it generates a random number and sends the generated random number to the CPU 11.

  The I / O 14 performs signal processing such as encoding and load modulation on the data to be transmitted to the reader / writer, and transmits / receives the data. For example, the I / O 14 modulates (amplifies) data to be transmitted to the external device, and transmits the data subjected to signal processing to the reader / writer.

  The ROM 15 is a non-volatile memory that stores a control program, control data, and the like in advance. The ROM 15 is incorporated in the IC card 1 in a state where a control program, control data, and the like are stored at the manufacturing stage. That is, the control program and control data stored in the ROM 15 are incorporated in advance according to the specifications of the IC card 1.

  The RAM 16 is a volatile memory that functions as a working memory. The RAM 16 temporarily stores data being processed by the CPU 25 and the coprocessor 12.

  The EEPROM 17 is a nonvolatile memory in which data can be written and rewritten. The EEPROM 17 can store, for example, control programs, control data, applications, personal information, security information such as encryption keys, data used for applications, and the like.

  FIG. 2 shows a functional configuration of the IC card according to the present embodiment that communicates with the reader / writer. The IC card 1 of the present embodiment can communicate with the reader / writer 10 in contact or non-contact. The communication method differs depending on whether it is contact or non-contact. In the non-contact type, different methods are defined depending on how to put signals and commands. For example, there are a type A method, a type B method, and a Felica method.

  The IC card 1 includes a receiving unit 21 and a transmitting unit 22 corresponding to either or both of contact and non-contact communication methods, and a response processing unit 23 that executes a response process for the reader / writer. The response processing unit 23 includes an activation processing unit 24 that executes activation processing, an APDU processing unit 25 that executes APDU processing, and a waiting time management unit 26 that manages response time for the command APDU.

  The activation processing unit 24 executes activation processing for activating the IC card 1 in accordance with an activation request from the reader / writer 10. As the start-up process, for example, it is possible to check whether the memory is broken by executing data recovery when the power is turned off during writing to the EEPROM during the previous IC card operation. In addition, it is possible to check whether the program itself has been tampered with by executing integrity check of the ROM and EEPROM and program code check. Furthermore, by performing cryptographic operations on sample data and confirming that correct results are output, it is possible to check whether the cryptographic operation hardware such as a coprocessor is operating normally, generating multiple random numbers, By checking the characteristics, it can be checked whether the random number generator is operating normally.

  For example, in a contact IC card, the activation processing unit 24 is an activation process triggered by receiving a reset signal from the reader / writer 10 while the connection circuit is activated and is in a cold reset waiting state. Set communication parameters. In many cases, the startup processing executed by the startup processing unit 24 from the power ON to the initial response is limited to some limited processing. Since it is necessary to execute the start-up process between the reception of the reset signal received during at least 300 clock cycles after the start of the clock signal supply in the cold reset waiting state and the initial response (ATR) within 40000 clock cycles. It is. In the activation processing unit 24 of the present embodiment, the remaining activation processing can be executed after the initial response. For example, after the command APDU is received, the remaining activation processing can be executed before the execution of the command APDU processing is started. When executing the activation process after receiving the command APDU, the waiting time is controlled by the waiting time management unit 26, so that the activation processing unit 24 can complete the activation process.

  The APDU processing unit 25 executes a command APDU process for executing a command APDU from the reader / writer 10 and an APDU process for generating a response APDU as a result of the command APDU process as a response to the command APDU. For example, when a select command is transmitted as a command APDU, a select process is executed to generate a response APDU. The generated response APDU is transmitted to the reader / writer 10 by the transmission unit 22.

  The waiting time management unit 26 manages a response time, which is a time from when the command APDU is received from the reader / writer 10 to when the response APDU is transmitted, and performs a process of extending the time as necessary. It is necessary to extend the response time until the startup process and the command APDU process are completed.

  Next, processing at the time of activation of an IC card having the functional configuration shown in FIG. 2 will be described. FIG. 3 is a diagram showing a timing chart of the activation process of the IC card according to the present embodiment.

  First, when the IC card 1 is connected to the reader / writer (R / W) 10, the reader / writer 10 transmits a reset signal to the IC card 1 (S1). When the IC card 1 receives the reset signal by the receiving unit 21 (S2), the activation processing unit 24 performs a minimum activation process (S3). For example, communication parameters such as communication speed, operation clock, interrupt setting, etc. can be set in the register as the minimum necessary startup processing. After performing the minimum necessary settings, the IC card 1 transmits an ATR (Answer To Reset), which is an initial response, to the reader / writer 10 within a specified time by the transmitting unit 22 (S4).

  Upon receiving the initial response (ATR) (S5), the reader / writer 10 transmits a first command APDU such as a Select command (S6).

  When the IC card 1 receives the first command APDU at the receiving unit 21 (S7), the waiting time management unit 26 starts the waiting time management process (S8), and the activation processing unit 24 checks whether there is an abnormality in hardware internally. Incomplete startup processing such as No. is performed (S9). The incomplete activation process is a process that has not yet been completed among the activation processes set in advance so that the safety of the IC card 1 can be ensured. For example, if the communication parameter setting, memory check, and program check are set as the startup process, and only the communication parameter setting is completed as the minimum required startup process, the memory check and program check are not completed. The activation process is executed in S9.

  Here, the waiting time management processing by the waiting time management unit 26 (see FIG. 2) will be described. FIG. 4 is a diagram showing a timing chart of the waiting time management program in the IC card 1 according to the present embodiment. When the waiting time management program is activated, time measurement from the reception of the command APDU is started (S21), and it is confirmed whether or not the waiting time, which is a time for which a response APDU should be returned every predetermined time, is approaching ( S22). If it is determined that the waiting time is approaching (S22: Yes), it is determined whether the activation process and the APDU process are completed (S23). Here, the activation process and APDU process whose completion is confirmed in S23 are the command APDU process for executing the received command APDU and the generation of the response APDU in addition to the memory check and program check executed as the activation process described above. Is included.

  When it is determined that the check or the like has been completed (S23: Yes), the waiting time management program is terminated, and a process of transmitting a response APDU by the transmission unit 22 (S13 in FIG. 3) is performed. On the other hand, when it is determined that the activation process and the APDU process are not completed (S23: No), a waiting time extension request for extending the waiting time is transmitted (S24). Upon receiving the waiting time extension request (S25), the reader / writer transmits a waiting time extension response indicating that the waiting time extension has been accepted (S26). When the IC card 1 receives the waiting time extension response (S27), the IC card 1 returns to S21 again and starts measuring time from the reception of the waiting time extension response (S21) until the start-up process and the APDU process are completed (S23: Yes). ) Perform subsequent processing. For example, when the memory check and the program check are completed, but the APDU processing to be executed after that takes time, and the APDU processing does not end within the waiting time, a waiting time extension request is made.

  As described above, the waiting time management unit 26 waits for the reader / writer 10 to wait for the reader / writer 10 at an arbitrary timing specified in each protocol from the reception of the command APDU (S7) to the transmission of the response APDU (S13). A time extension request can be made. Since a waiting time extension request can be made, even when the startup process and the APDU process take a long time, the processing can be performed to the end by making a waiting time extension request. Incidentally, the waiting time cannot be extended between the reset and the initial response.

  Returning to FIG. 3, when the hardware check (S9) by the activation processing unit 24 is completed, the activation processing unit 24 of the IC card 1 determines whether there are errors in various check results in the activation processing (S10), and the check result. If there is an abnormality (S10: Yes), the activation processing unit 24 performs error processing (S11). As the error processing, for example, an error response is transmitted, and the self-processing can be performed so that the IC card 1 itself becomes permanently unusable so as not to operate any further.

  If there is no abnormality in the check result (S10: No), the IC card 1 performs APDU processing based on the command APDU received by the APDU processing unit 25 (S12), and transmits a response APDU generated for the command APDU. Transmitted by the unit 22 (S13). When the reader / writer 10 receives the response APDU (S14), the processing at the time of activation of the IC card 1 is completed.

  In the above embodiment, an example of starting the incomplete start-up process after receiving the first command APDU has been described as an example. However, if the incomplete start-up process (S9 ′) is started after the initial response, However, the present invention is not limited to this. When an incomplete activation process is executed between the initial response and the reception of the command APDU, what can be processed within the expected command APDU reception time may be executed.

  According to the IC card and the IC card activation method of the present embodiment described above, the command APDU processing is not performed while the hardware abnormality is included, so that the illegal operation of the IC card or the command APDU processing is not performed. An error can be prevented. As a result, data in the IC card can be protected from malicious attackers.

1 IC Card 10 Reader / Writer 11 CPU
12 Coprocessor 13 Random number generator 14 I / O
15 ROM
16 RAM
17 EEPROM
21 reception unit 22 transmission unit 23 response processing unit 24 activation processing unit 25 APDU processing unit 26 waiting time management unit

Claims (6)

An IC card having means for initially responding to a start request signal from a reader / writer within a specified time,
Means for executing an activation process between receiving the activation request signal and an initial response;
Means for receiving a command APDU from the reader / writer after the initial response;
If the activation process is not completed even after receiving the command APDU, an incomplete activation process is executed, and after the activation process is completed, the command APDU is executed, and the command APDU is processed. Means for executing a process for generating a response APDU as a result of the command APDU process as a response;
An IC card comprising: means for transmitting a response APDU generated as a result of the command APDU process executed following completion of the activation process to the reader / writer.   The apparatus further comprises means for requesting an extension of a response time of the response APDU for the command APDU until the command APDU process executed following completion of the activation process and the generation of the response APDU are completed. Item 1. The IC card according to Item 1.   3. The apparatus according to claim 1, further comprising means for executing an incomplete hardware check when there is an incomplete hardware check that can be processed between the initial response and reception of the command APDU. IC card according to. An IC card activation processing method comprising means for initially responding within a specified time to an activation request signal from a reader / writer,
Performing a startup process between receiving the startup request signal and an initial response; and
Receiving a command APDU from the reader / writer after the initial response;
If the activation process is not completed even after receiving the command APDU, an incomplete activation process is executed, and after the activation process is completed, the command APDU is executed, and the command APDU is processed. Executing a process of generating a response APDU that is a result of the command APDU process as a response;
And a step of transmitting a response APDU generated as a result of the command APDU process executed following completion of the activation process to the reader / writer.   The method further comprises a step of requesting an extension of a response time of the response APDU for the command APDU until the command APDU processing executed following completion of the activation processing and generation of the response APDU are completed. Item 5. An IC card activation processing method according to Item 4.   6. The method according to claim 4, further comprising a step of executing the incomplete hardware check when there is an incomplete hardware check that can be processed between the initial response and reception of the command APDU. 2. An activation process method for an IC card according to 1.

Images