JP2019160191A - Portable electronic device and IC card - Google Patents

Abstract

To provide a portable electronic device and an IC card with which it is possible to realize more appropriate control of access to specific data.SOLUTION: The portable electronic device of an embodiment comprises a storage unit, a state control unit, and an execution unit. The storage unit stores specific data in a specific data area. The state control unit manages a security state in memory that pertains to access to the specific data area in the storage unit. When a prescribed command for accessing the specific data is accepted, the execution unit determines whether or not the accepted prescribed command is executable, on the basis of the security state concerning the specific data area managed by the state control unit, and when determined as executable, executes the processing of the prescribed command. The state control unit initializes the security state when the processing of the prescribed command by the execution unit is terminated.SELECTED DRAWING: Figure 3

Description

  Embodiments described herein relate generally to a portable electronic device and an IC card.

  In recent years, portable electronic devices such as IC cards incorporating IC (Integrated Circuit) chips have been widely used. In a conventional portable electronic device, data stored in a storage area of an IC card is accessed in accordance with a command received from an external device. The update of the security status for data is limited to commands for setting the security status such as the VERIFY command and the EXTERNAL AUTHENTICATE command. After the security status is set by these commands, the application reset or the portable electronic device The status is maintained until the power is turned off. For this reason, there is a case where the command is illegally executed while the status is continued and the data in the IC card is accessed.

JP 2013-196436 A JP 2001-307043 A Japanese Patent Laid-Open No. 11-306301

  The problem to be solved by the present invention is to provide a portable electronic device and an IC card that can realize more appropriate access control for specific data.

  The portable electronic device according to the embodiment includes a storage unit, a state control unit, and an execution unit. The storage unit stores specific data in a predetermined data area. The state control unit manages a security state related to access to the predetermined data area in the storage unit on the memory. When the execution unit receives a predetermined command for accessing the specific data, the execution unit can execute the received predetermined command based on a security state for the predetermined data area managed by the state control unit. If it is determined that it can be executed, the predetermined command processing is executed. The state control unit initializes the security state when the execution unit finishes processing the predetermined command.

1 is an external view showing an example of an IC card according to a first embodiment. 1 is a diagram illustrating a hardware configuration example of an IC card according to a first embodiment. The block diagram which shows the function structural example of the IC card of 1st Embodiment. The figure which shows an example of the data of the TLV format stored in the file. The figure which shows the example of data which the collation data memory | storage part of 1st Embodiment memorize | stores. The figure which shows the example of data which the security status memory | storage part of 1st Embodiment memorize | stores. The figure which shows the example of data which the access authority memory | storage part of 1st Embodiment memorize | stores. 5 is a flowchart illustrating an example of processing of a VERIFY command of the IC card 1 according to the first embodiment. 6 is a flowchart illustrating an example of processing of a COMPARE command of the IC card according to the first embodiment. The block diagram which shows the function structural example of the IC card of 2nd Embodiment. The figure which shows the example of data which the access authority memory | storage part with number of times restrictions of 2nd Embodiment memorize | stores. The figure which shows the example of data which the execution counter memory | storage part classified by command of 2nd Embodiment memorize | stores. 9 is a flowchart illustrating an example of processing of a COMPARE command of an IC card according to a second embodiment.

  Hereinafter, a portable electronic device and an IC card according to embodiments will be described with reference to the drawings.

(First embodiment)
FIG. 1 is an external view showing an example of an IC card 1 according to the first embodiment.
As shown in FIG. 1, the IC card 1 includes an IC module 10. The IC module 10 includes a contact portion 3 and an IC chip 100 inside.

The IC card 1 is formed, for example, by mounting an IC module 10 on a plastic card base PT (an example of a card body). That is, the IC card 1 includes an IC module 10 and a card base PT in which the IC module 10 is embedded. Further, the IC card 1 can communicate with the external device 2 via the contact unit 3.
In the first embodiment, an IC card 1 will be described as an example of a portable electronic device.

For example, the IC card 1 receives a command (processing request) transmitted from the external device 2 via the contact unit 3 and executes processing (command processing) according to the received command. Then, the IC card 1 transmits a response (processing response) that is an execution result of the command processing to the external device 2 via the contact unit 3.
Here, the external device 2 is a device that communicates with the IC card 1, and is, for example, a terminal device including a reader / writer device.

  The IC module 10 includes a contact portion 3 and an IC chip 100, and is a module that is traded in a form such as COT (Chip On Tape) in which a plurality of IC modules 10 are arranged on a tape. Note that the single IC module 10 that has been cut out and separated from the tape may be referred to as COT.

The contact part 3 has terminals for various signals necessary for the operation of the IC card 1. Here, the terminals of various signals have a terminal for receiving a power supply voltage, a clock signal, a reset signal and the like from the external device 2 and a serial data input / output terminal (SIO terminal) for communicating with the external device 2 .
The IC chip 100 is, for example, an LSI (Large Scale Integration) such as a one-chip microprocessor.

Next, the hardware configuration of the IC card 1 according to the first embodiment will be described with reference to FIG.
FIG. 2 is a diagram illustrating a hardware configuration example of the IC card 1 according to the first embodiment.
As shown in FIG. 2, the IC card 1 includes an IC module 10 including a contact portion 3 and an IC chip 100. The IC chip 100 includes a UART (Universal Asynchronous Receiver Transmitter) 4, a CPU 5, a ROM (Read Only Memory) 6, a RAM (Random Access Memory) 7, and an EEPROM (Electrically Erasable Programmable ROM) 8. Yes. Each component (4 to 8) is connected via an internal bus BS1.

  The UART 4 performs serial data communication with the external device 2 via the SIO terminal described above. The UART 4 outputs data (for example, 1-byte data) obtained by parallel-converting the serial data signal received via the SIO terminal to the internal bus BS1. The UART 4 serially converts the data acquired via the internal bus BS1 and outputs it to the external device 2 via the SIO terminal. For example, the UART 4 receives a command from the external device 2 via the SIO terminal. The UART 4 transmits a response to the external device 2 via the SIO terminal.

  The CPU 5 executes programs stored in the ROM 6 or the EEPROM 8 to perform various processes of the IC card 1. For example, the CPU 5 executes command processing according to the command received by the UART 4 via the contact unit 3.

The ROM 6 is a non-volatile memory such as a mask ROM, for example, and stores a program for executing various processes of the IC card 1 and data such as a command table.
The RAM 7 is a volatile memory such as SRAM (Static RAM), for example, and temporarily stores data used when performing various processes of the IC card 1.

  The EEPROM 8 is, for example, an electrically rewritable nonvolatile memory. The EEPROM 8 stores various data used by the IC card 1. The EEPROM 8 stores information used for various services (applications) using the IC card 1, for example.

Next, a functional configuration example of the IC card 1 according to the first embodiment will be described with reference to FIG.
FIG. 3 is a block diagram illustrating a functional configuration example of the IC card 1 according to the first embodiment.
As shown in FIG. 3, the IC card 1 includes, for example, a communication unit 40, a control unit 50, an AP (application) data storage unit 81, a file management information storage unit 82, a collation data storage unit 83, a security A status storage unit 71 and an access authority storage unit 84 are provided.
Here, each part of the IC card 1 shown in FIG. 3 is realized by using the hardware of the IC card 1 shown in FIG.

  The communication unit 40 is realized by, for example, the UART 4, the CPU 5, and a program stored in the ROM 6, and transmits and receives commands and responses to and from the external device 2 through the contact unit 3, for example. That is, the communication unit 40 receives a command (processing request) requesting a predetermined process from the external device 2 and transmits a response (processing response) to the command to the external device 2.

  The AP data storage unit 81 (an example of a storage unit) is a storage unit configured by, for example, the EEPROM 8 and stores application data. The AP data storage unit 81 stores files such as MF (Master File), DF (Dedicated File), and EF (Elementary File) in a predetermined data area in a hierarchical structure. The EF is managed so as to be identifiable by identification information (hereinafter referred to as EFID), and each EF includes, for example, data (specific data) in TLV format (Tag-Length-value format) as shown in FIG. ) Is stored. That is, the AP data storage unit 81 stores a file including TLV format data (an example of specific data).

FIG. 4 is a diagram illustrating an example of TLV format data stored in a file.
The example illustrated in FIG. 4 illustrates an example in which a plurality of TLV format data (“data A”, “data B”,...) Is stored in the EF. Here, “Tag name” is identification information for identifying the Tag of specific data, and “Len” indicates the length of specific data. Further, “Value” stores the contents (data) of specific data.
Specific data (“Data A”, “Data B”,...) Includes, for example, personal information such as “name”, “address”, “date of birth”, “age”, “phone number”, Information that can only be accessed by a specific authority and other information are included.
Each TLV format data can be selected based on “Len” from the start address of the EF, thereby selecting the TLV format data to be selected. Therefore, for example, after verifying the identity of the card user with the VERIFY command and establishing a predetermined authentication, for example, by setting “Tag name” with the SELECT DATA command or the like, the value (data) corresponding to the Tag name is set. ) Can be obtained.

  Returning to the description of FIG. 3, the file management information storage unit 82 is, for example, a storage unit configured by the EEPROM 8, and stores management information (for example, directory information) for managing the various files described above. The file management information storage unit 82 stores, for example, file identification information such as a file name and file ID in association with the start address of the file (hereinafter referred to as the start address of the file). Here, the head address of the file is, for example, the physical address of the EEPROM 8. In the IC card 1, when selecting each file or executing an access process for each file, each file is selected or each file is selected based on the file management information stored in the file management information storage unit 82. Execute access processing. Here, the access processing refers to processing such as data reading, writing, and updating.

  The collation data storage unit 83 is, for example, a storage unit configured by the EEPROM 8, and stores information related to a security status (security state) set for each EFID by, for example, a VERIFY command. Here, an example of data stored in the collation data storage unit 83 will be described with reference to FIG.

FIG. 5 is a diagram illustrating an example of data stored in the collation data storage unit 83 according to the first embodiment.
As shown in FIG. 5, the collation data storage unit 83 stores EFID, collation data, and a position where a collation result is set in association with each other. The collation data is data for the command execution unit 53 to determine whether or not the command can access the data when the command received from the external device is a command for accessing data corresponding to the designated EFID. is there. The verification data may be set when the IC card 1 is issued, or the IC card owner may arbitrarily set it from an external device. The position where the collation result is set is, for example, the position of the security status information where the collation result is set, and each can be managed using a bit value. For example, when the verification data for the designated EFID is matched by the VERIFY command or the like and authentication is established, “1” is set to the corresponding bit position of the data stored in the security status storage unit 71. As a result, data access by the SELECT DATA command or COMPARE command performed during this session is permitted for the data in the designated EFID. The collation data storage unit 83 may be provided in the AP data storage unit 81 or the file management information storage unit 82, for example.

  The security status storage unit 71 is, for example, a storage unit configured by the RAM 7 and stores the security status for each data stored in the file management information storage unit 82 described above. Here, an example of data stored in the security status storage unit 71 will be described with reference to FIG.

FIG. 6 is a diagram illustrating an example of data stored in the security status storage unit 71 according to the first embodiment.
As illustrated in FIG. 6, the security status storage unit 71 stores access authority data (for example, bits b1 to b8) and security status in association with each other. The access authority data corresponds to the position where the collation result stored in the collation data storage unit 83 is set. For example, when the security status is “zero (0)”, it indicates that the security status is not set or the security status is inaccessible, and when it is “1”, the security status is already set or This shows that access to data associated with the EFID stored in the verification data storage unit 83 is possible.

  The access authority storage unit 84 is, for example, a storage unit configured by the EEPROM 8, and when receiving an access authority for each command and a command from an external device, authority information indicating whether data can be accessed by the command, Stores the contents of the security status after command execution. Here, an example of data stored in the access authority storage unit 84 will be described with reference to FIG.

FIG. 7 is a diagram illustrating an example of data stored in the access authority storage unit 84 according to the first embodiment.
As shown in FIG. 7, the access authority storage unit 84 stores the target command, access authority data, and the security status after command execution in association with each other. The target command is a command that can be executed by the command execution unit 53, and includes, for example, a read system (GET DATA), a setting system (PUT DATA), a reference system (COMPARE), and a change system (WRITE). The access authority data is, for example, information on the position of data that manages the permission state of access to data assigned for each command described above. The security status after command execution is, for example, information indicating whether the security status is initialized (cleared) after command execution.

  In the example of FIG. 7, in the case of a command for a reference system (COMPARE), the security status after the command execution is initialized, and a command for a read system (GET DATA), a setting system (PUT DATA), or a change system (WRITE) is initialized. In this case, the security status after command execution is not initialized. As described above, since the security status after the command execution can be adjusted for each target command by the access authority storage unit 84, there is no need to wait until the application is reset or the IC card 1 is turned off. Access control can be performed.

  Returning to the description of FIG. 3 again, the control unit 50 is realized by, for example, the CPU 5, the RAM 7, and the ROM 6 or the EEPROM 8, and comprehensively controls the IC card 1. The control unit 50 includes, for example, a file management unit 51, a security status control unit (an example of a state control unit) 52, and a command execution unit 53.

  The file management unit 51 manages files in the AP data storage unit 81 based on management information (for example, directory information) stored in the file management information storage unit 82. For example, when executing file access processing, the file management unit 51 searches the management information stored in the file management information storage unit 82 and identifies the storage location of the file.

  Based on the command (processing request) transmitted from the external device 2 to the IC card 1, the security status control unit 52 uses the verification data included in the parameter of the command to store the verification data stored in the verification data storage unit 83. And set the security status based on the verification result.

  The security status control unit 52 initializes the security status stored in the security status storage unit 71 when a command is executed by the command execution unit 53. Specifically, the security status control unit 52 initializes the security status when the command executed by the command execution unit 53 ends normally. An example of initialization is to set the bit to “0”. In addition, the security status control unit 52 may initialize the security status when an error occurs during command execution and the processing ends abnormally.

  The command execution unit (an example of an execution unit) 53 executes various command processing (command processing) in response to a command (processing request) transmitted from the external device 2 to the IC card 1. The command execution unit 53 executes command processing according to a command received from the external device 2 via the communication unit 40, for example. Further, the command execution unit 53 transmits a response that is a result of the command processing to the external device 2 via the communication unit 40.

  Further, the command execution unit 53 determines whether or not the command received from the external device 2 is a specific processing request (specific command) for specific data, and the contents of the security status when the command is a specific command Based on the above, it is determined whether or not execution is possible. The specific processing request is, for example, a COMPARE command for obtaining a comparison result with specific data, an access processing command for specifying and accessing specific data (for example, Tag name in EF), or the like. The access processing command is a command for executing access processing such as data writing, reading, and updating.

  For example, when the command execution unit 53 receives an access processing request (access processing command) for specific data from the external device 2, the command execution unit 53 specifies based on the start address corresponding to the selected (acquired) specific data. Execute the process to access the data.

  Next, the operation of the IC card 1 of the first embodiment will be described with reference to the drawings. In the following processing, the processing of the VERIFY command that performs authentication processing such as identity verification will be mainly described first, and then an example of using the COMPARE command as an example of a specific command will be described. .

FIG. 8 is a flowchart illustrating an example of processing of the VERIFY command of the IC card 1 according to the first embodiment.
As shown in FIG. 8, in a state where the external device 2 and the IC card 1 are connected via the contact unit 3 and the IC card 1 is active (when power is supplied), the command execution unit 53 Is received (step S100), it is determined whether or not the received command is a VERIFY command (step S102). When the received command is a VERIFY command command (step S102; YES), the command execution unit 53 advances the process to step S104. If the received command is not a VERIFY command (step S102; NO), the process proceeds to step S114.

  In the process of step S104, the command execution unit 53 determines whether or not the parameter of the VERIFY command is valid data (step S104). The parameter of the VERIFY command is, for example, information such as a PIN (Personal Identification Number) that is a password for authenticating the card user of the IC card 1, collation data, reference destination data, and the like. For example, the command execution unit 53 determines that the parameter data attribute (for example, character string type, integer type) and data content are valid data when the preset condition is satisfied, and satisfies the condition. If not, it is determined that the data is not valid. For example, the command execution unit 53 may determine that the data is not valid when the reference data specified by the parameter is not found. If the command execution unit 53 determines that the parameter is valid data (step S104; YES), the process proceeds to step S106. If the command execution unit 53 determines that the parameter is not valid data (step S104; NO), the process proceeds to step S106. Proceed to S116.

  In the process of step S106, the command execution unit 53 selects data associated with the EFID in the collation data storage unit 83 based on the target EF (EFID) specified by the parameter (step S106), and the process is stepped. Proceed to S108.

  In the process of step S108, the command execution unit 53 determines whether the collation data of the target EF matches the PIN data input by the command (step S108). If the collation data and the PIN data match (step S108; YES), the command execution unit 53 advances the process to step S110. If the match does not match (step S108; NO), the command execution unit 53 advances the process to step S118.

  In the process of step S110, the security status control unit 52 acquires the position of the security status associated with the EFID, and sets a value for permitting access to the acquired position (step S110). In the data of the security status storage unit 71 shown in FIG. 6, “1” is set in b3, which means that the collation with the EFID “0003” is successful and the access is permitted. Yes. Next, the command execution unit 53 transmits a status word indicating normal termination to the external device 2 (step S112).

  In the process of step S114, the command execution unit 53 executes a process corresponding to a command other than the VERIF command (step S114).

  In the process of step S116, the command execution unit 53 transmits a status word indicating parameter abnormality to the external device 2 (step S116).

  In the process of step S118, the command execution unit 53 transmits a status word indicating that they do not match to the external device 2 (step S118). Thereby, the process of this flowchart is complete | finished.

  FIG. 9 is a flowchart illustrating an example of processing of the COMPARE command of the IC card 1 according to the first embodiment. Note that the process of FIG. 9 may be repeatedly executed every time a command is received.

  As shown in FIG. 9, when the external device 2 and the IC card 1 are connected via the contact unit 3 and the IC card 1 is active (when power is supplied), the command execution unit 53 Is received (step S200), it is determined whether or not the received command is a COMPARE command (step S202). If the received command is a COMPARE command (step S202; YES), the command execution unit 53 advances the process to step S204. If the received command is not a COMPARE command (step S202; NO), the command execution unit 53 performs the process. Proceed to S220.

  In the process of step S204, the command execution unit 53 determines whether the parameter of the COMPARE command is valid data (step S204). The parameters of the COMPARE command are, for example, information on two data (variables) to be compared, the byte length of the target data, the comparison result, and the like. The determination as to whether the parameter is valid can be made using, for example, the attributes of the two comparison target data set as parameters. For example, when one of the two comparison target data set as parameters is an integer type and the other is a character string type, the command execution unit 53 is not valid data because the attributes are different from each other. judge. Further, the command execution unit 53 determines that the parameter is valid when both of the two comparison target data are integer types. When it is determined that the parameter of the COMPARE command is valid data (step S204; YES), the command execution unit 53 advances the processing to step S206, and when it is determined that the parameter is not valid data (step S204; NO). Then, the process proceeds to step S216.

  In the process of step S206, the command execution unit 53 selects the target EF specified by the parameter (step S206), and determines whether the security status corresponding to the COMPARE command is set (step S208). Specifically, the command execution unit 53 refers to the data in the access authority storage unit 84 shown in FIG. 7 based on the received command, and based on the access authority data associated with the target command that matches the received command. Then, it is determined whether or not the security status corresponding to the command is already set (access permission state). For example, in the example of FIGS. 6 and 7, the security status of the data “b3” corresponding to the COMPARE command is “1” in the data of the security status storage unit 71, so the security status is already set. It is determined. If the command execution unit 53 determines that the security status corresponding to the command has been set (step S208; YES), the command execution unit 53 proceeds to step S210, and determines that the security status has not been set (step S208; NO). ), And the process proceeds to step S214.

  In the process of step S210, the command execution unit 53 compares the data referred to by the target EF with the comparison data input by the parameter of the COMPARE command (step S210), and the status word indicating the comparison result and normal termination Is transmitted to the external device 2 (step S212), and the process proceeds to step S218.

  In step S214, the security status control unit 52 transmits a status word indicating that the security status is not set to the external apparatus 2 (step S214), and the process proceeds to step S218.

  Further, in the process of step S216, the command execution unit 53 transmits a status word indicating parameter abnormality (step S216), and the process proceeds to step S218.

  In the process of step S218, the security status control unit 52 initializes the security status of the data in the security status storage unit 71 (step S218). Specifically, the security status control unit 52 initializes the value of the bit b3 set by the VARIFY command from “1” to “0”. As a result, the security status is initialized after the command execution regardless of whether the COMPARE command ends normally or abnormally. The security status control unit 52 may initialize the security status at a timing immediately after normal termination or abnormal termination, or may initialize it after a predetermined time elapses after the command execution is completed. Further, the security status control unit 52 may initialize the security status at the timing when the second COMPARE command is received. These timings may be variably set based on, for example, the type of data on which the command is executed by the security status control unit 52.

  In the process of step S220, the command execution unit 53 executes a process for a command other than the COMPARE command (step S220). Thereby, the process of this flowchart is complete | finished.

  As described above, according to the first embodiment, the IC card 1 (portable electronic device) can realize more appropriate access control for specific data. Specifically, according to the first embodiment, when a specific command is executed after a security status is established (session is established) (after being set to an access-permitted state), the command is normal. In either case of termination or abnormal termination, it is not necessary to wait until the session is terminated, the application is reset, or the power of the IC card 1 is turned off, and the security status can be cleared. Therefore, for example, when a certain service provider determines how old (or below) the card holder's age is, the comparison target is set to 20 years old, 21 years old, 22 according to the parameters of the COMPARE command. By repeatedly executing while sequentially changing the age,..., It is possible to suppress not being unjustly specified not only about how old but also how old.

  In the first embodiment, an example has been described in which the security status information is initialized when the COMPARE command is normally terminated or abnormally terminated. However, the present invention is not limited to this, and the normal termination is performed. In such a case, the security status may be initialized. As a result, it is possible to prevent the COMPARE command from being repeatedly executed as described above. Also, if the parameter is not valid and ends abnormally, it will only repeat abnormally even if it is repeated. If the parameter is changed and it ends normally, it will be initialized at that time, so it ends normally. Processing that repeats the above is not executed.

  In the first embodiment, the security status control unit 52 may control the security status based on, for example, authority information of an accessor to the IC card 1. In this case, the security status control unit 52, for example, permits access to all information stored in the data when the accessor has administrator level or owner level authority, or repeatedly uses the command. Allow. Thereby, the security status control unit 52 can perform more appropriate access control according to the accessor.

(Second Embodiment)
Next, an IC card 1a according to the second embodiment will be described with reference to the drawings. FIG. 10 is a block diagram illustrating a functional configuration example of the IC card 1a according to the second embodiment.
As shown in FIG. 10, the IC card 1a includes, for example, a communication unit 40, a control unit 50, an AP data storage unit 81, a file management information storage unit 82, a collation data storage unit 83, and a security status storage unit. 71, an access authority storage unit 85 with a limited number of times, and a command-specific execution counter storage unit 72.

  Note that the external appearance and hardware configuration of the IC card 1a according to the second embodiment are the same as those of the first embodiment shown in FIGS. 1 and 2, and the description thereof is omitted here. In FIG. 10, the same components as those shown in FIG. 3 are denoted by the same reference numerals, and the description thereof is omitted. Each part of the IC card 1a shown in FIG. 10 is realized by using the hardware of the IC card 1 shown in FIG.

  In the second embodiment, as compared with the IC card 1 of the first embodiment, instead of the security status control unit 52 and the access authority storage unit 84, a security status control unit 52a and an access authority storage unit with a limited number of times are provided. 85 and the command-specific execution counter storage unit 72 are different. Therefore, the following description will mainly focus on the security status control unit 52a, the access authority storage unit 85 with a limited number of times, and the command-specific execution counter storage unit 72.

  The access authority storage unit 85 with a limited number of times is, for example, a storage unit configured by the EEPROM 8. The access authority storage unit 85 with a limited number of times stores a target command, access authority data, a command execution number limit value, and a security status after command execution in association with each other. Here, with reference to FIG. 11, an example of data stored in the access authority storage unit 85 with limited number of times will be described.

FIG. 11 is a diagram illustrating an example of data stored in the access authority storage unit 85 with limited number of times according to the second embodiment.
As illustrated in FIG. 11, the access authority storage unit 85 with limited number of times stores, for example, information in which a target command, an access permission condition, a command execution number limit value, and a security status after command execution are associated with each other. . Compared with the data in the access authority storage unit 84 of the first embodiment, the data in the access authority storage unit 85 with a limited number of times is added with a command execution frequency limit value that limits the number of times the command is executed. In the example of FIG. 11, “3” is set as the predetermined number in the command execution number limit value of the reference system (COMPARE). This indicates that the COMPARE command is permitted from the external device 2 up to three times continuously.
The command execution frequency limit value may be set when the IC card 1a is issued, and the administrator or the like can execute the execution frequency at an arbitrary timing according to instruction information from a specific external device (for example, an administrator terminal). It may be set.

  The command-specific execution counter storage unit 72 is a storage unit configured by the RAM 7, for example, and stores the command executable count for each command. Here, an example of data stored in the security status storage unit 71 will be described with reference to FIG.

FIG. 12 is a diagram illustrating an example of data stored in the command-specific execution counter storage unit 72 according to the second embodiment.
As illustrated in FIG. 12, the command-specific execution counter storage unit 72 stores the command name and the command executable count [times] in association with each other. The command executable count is a value obtained from the command execution count limit value in the access authority storage unit 85 with limited count. The number of times the command can be executed is decremented by the security status control unit 52a every time the command is executed by the command execution unit 53.

  When the security status control unit 52a receives an input of a command from the external device 2, the security status control unit 52a refers to the command executable count in the command-specific execution counter storage unit 72, and repeats the command by the command execution unit 53 within the set range. Allow execution.

  Next, the operation of the IC card 1a of the second embodiment will be described with reference to the drawings. Note that the processing of the VERIFY command in the second embodiment is the same as that in the first embodiment, and therefore, an explanation will be made mainly on an example in which the COMPARE command is mainly used. FIG. 13 is a flowchart illustrating an example of a COMPARE command process of the IC card 1a according to the second embodiment. Note that the process of FIG. 13 may be repeatedly executed every time a command is received.

  In the example of FIG. 13, the processing of steps S300 to S308 is the same as the processing of steps S200 to S208 shown in FIG. When the security status corresponding to the command has been set (step S308; YES), in the process of step S310, the security status control unit 52a refers to the command executable count in the command-specific execution counter storage unit 72 and executes the command. It is determined whether the possible number is 1 or more (step S310). In the process of step S310, when the command executable count is not set, the security status control unit 52a acquires the command execution count limit value of the access authority storage unit 85 with a limited count, and uses the acquired value as the command executable count. Set to. If the command execution frequency limit value in the access authority storage unit 85 with limited number of times is not set, the security status control unit 52a sets the command executable number to a fixed value (for example, once). Also good. The security status control unit 52a advances the process to step S312 when the command executable count is 1 or more, and advances the process to step S320 when the command executable count is 0.

  In the process of step S312, the command execution unit 53 compares the data referred to by the target EF with the comparison data input by the command (step S312), and sends the comparison result and a status word indicating normal termination to the external device 2. (Step S314). Next, the security status control unit 52a decrements the command executable count (step S316), and advances the processing to step S318.

  In the process of step S318, for example, the command execution unit 53 determines whether or not the next command has been received in the same session (step S318). When it is determined that the next command has been received (step S318; YES), the command execution unit 53 returns to the process of step S302, and when it is determined that the next command has not been received (step S318; NO). Then, the process proceeds to the process of step S326.

  In step S320, the security status control unit 52a transmits a status word indicating that the command cannot be executed because the number of executions has been exceeded (step S320). The process proceeds to step S326.

  If the security status corresponding to the command has not been set in the process of step S308 (step S308; NO), the security status control unit 52a sends a status word indicating that the security status is not set to the external device 2. (Step S322), and the process proceeds to step S326.

  If it is determined in step S304 that the parameter is not valid data (step S304; NO), the command execution unit 53 transmits a status word indicating a parameter abnormality (step S324), and performs the process. The process proceeds to step S326.

  In the process of step S326, the security status control unit 52a initializes the command executable count of the command name (COMPARE) in the command-specific execution counter storage unit 72 to “0” (step S326), and sets the security status to “0”. Initialization is performed (step S328). The process of step S328 is the same as the process of step S218.

  If the command is not a COMPARE command in step S302 (step S302; NO), the command execution unit 53 executes processing for a command other than the COMPARE command (step S330). Thereby, the process of this flowchart is complete | finished.

  As described above, according to the second embodiment, the IC card 1a (portable electronic device) has the same effect as the IC card 1 in the first embodiment, and executes a plurality of times for a specific command. Can be tolerated. Therefore, according to the second embodiment, for example, when a certain service provider provides a service for ages from 20 to 40 years old, the “age” stored in the IC card 1a is set to “age”. On the other hand, since the COMPARE command can be executed twice: “Is it over 20 years old” or “Is it under 40 years old?”, More complicated age restriction authentication can be performed. Therefore, more appropriate access control can be realized for specific data.

  In each of the above embodiments, the COMPARE command is used as an example of the specific command. However, the specific command may be either the COMPARE command or the access processing command. The access processing command may be a part of the access processing commands that the IC card 1 (1a) has. In each of the above embodiments, the data to be accessed is the data in the EF. For example, when a command that can access another area (for example, DF) is used, Thus, the security status can be controlled as described above.

  In each of the above embodiments, the IC card 1 (1a) has been described as communicating with the external device 2 via the contact unit 3. However, the IC card 1 (1a) communicates with the external device 2 via a contactless interface using a coil or the like. You may comprise so that it may communicate.

In each of the above embodiments, the IC card 1 (1a) is configured to include the EEPROM 8 as a rewritable nonvolatile memory, but the present invention is not limited to this.
For example, the IC card 1 (1a) may include a flash memory, a FeRAM (Ferroelectric Random Access Memory), etc. instead of the EEPROM 8.

  In each of the above-described embodiments, the example in which the IC card 1 (1a) is used as an example of the portable electronic device has been described. However, the present invention is not limited to this. The portable electronic device may be, for example, an electronic device such as an IC tag that is not a card shape.

  According to at least one embodiment described above, the AP data storage unit 81 that stores specific data in a predetermined data area, and the security status regarding access to the predetermined data area in the AP data storage unit 81 are stored in the memory. When a security status control unit 52 to be managed and a command to access specific data are received, the received command can be executed based on the security state for a predetermined data area managed by the security status control unit 52. A command execution unit 53 that executes command processing when it is determined that the command can be executed. The security status control unit 52 performs processing of a predetermined command by the command execution unit 53. Initialize the security state when The Rukoto can for a particular data, to achieve a more appropriate access control.

The above embodiment can be expressed as follows.
A storage unit for storing specific data in a predetermined data area;
A hardware processor for executing a program stored in the storage unit,
In the storage unit, the hardware processor,
Managing on the memory a security state relating to access to the predetermined data area in the storage unit;
When a predetermined command for accessing the specific data is received, it is determined whether or not the received predetermined command is executable based on a security state for the predetermined data area managed;
If it is determined that the command can be executed, the predetermined command processing is executed,
A portable electronic device in which the program for executing processing for initializing the security state when processing of the predetermined command is completed is stored.

In addition, the program for realizing the function of each component included in the IC card 1 (1a) in the embodiment is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system, By executing, the processing in each configuration included in the IC card 1 (1a) described above may be performed. Here, “loading and executing a program recorded on a recording medium into a computer system” includes installing the program in the computer system. The “computer system” here includes an OS and hardware such as peripheral devices.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 1, 1a ... IC card, 2 ... External device, 3 ... Contact part, 4 ... UART, 5 ... CPU, 6 ... ROM, 7 ... RAM, 8 ... EEPROM, 10 ... IC module, 40 ... Communication part, 50 ... Control , 51 ... File management part, 52, 52a ... Security status control part, 53 ... Command execution part, 71 ... Security status storage part, 72 ... Command-specific execution counter storage part, 81 ... AP data storage part, 82 ... File management Information storage unit, 83 ... collation data storage unit, 84 ... access authority storage unit, 85 ... access authority storage unit with limited number of times, 100 ... IC chip, BS1 ... internal bus, PT ... card substrate

Claims (8)

A storage unit for storing specific data in a predetermined data area;
A state control unit that manages on a memory a security state related to access to the predetermined data area in the storage unit;
Whether or not the received predetermined command can be executed based on the security state for the predetermined data area managed by the state control unit when a predetermined command for accessing the specific data is received. And an execution unit that executes processing of the predetermined command when it is determined that the determination is executable,
The state control unit initializes the security state when processing of a predetermined command is completed by the execution unit.
Portable electronic device. The state control unit sets the security state to the predetermined data area to an access-permitted state when predetermined authentication is established before receiving the predetermined command;
The portable electronic device according to claim 1. The state control unit determines whether or not to initialize the security state when processing of the predetermined command by the execution unit is completed based on an access right to the predetermined data area;
The portable electronic device according to claim 1 or 2. The security state is a state associated with the predetermined command and an access right to the predetermined data area.
The portable electronic device according to any one of claims 1 to 3. The state control unit initializes the security state based on a timing at which the processing of the predetermined command by the execution unit is normally terminated or abnormally terminated.
The portable electronic device according to any one of claims 1 to 4. The state control unit initializes the security state when processing of the predetermined command is executed a predetermined number of times by the execution unit.
The portable electronic device according to any one of claims 1 to 5. The state control unit sets the predetermined number of times based on external instruction information.
The portable electronic device according to claim 6. A storage unit for storing specific data in a predetermined data area;
A state control unit that manages on a memory a security state related to access to the predetermined data area in the storage unit;
When a command for accessing the specific data is received, it is determined whether or not the received command can be executed based on a security state for the predetermined data area managed by the state control unit, and executed. An IC module comprising: an execution unit that executes processing of the predetermined command when it is determined that it is possible;
A card body in which the IC module is embedded;
With
The state control unit initializes the security state when processing of a predetermined command is completed by the execution unit.
IC card.

Images