JP3346711B2 - IC card system and IC card - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an IC card having a function of restricting access to stored data when an update state cannot be consistent with data managed by a center system which is a card issuer, and The present invention relates to an IC card system using the IC card.

[0002]

2. Description of the Related Art Target data managed by a center system which is a card issuer, for example, data corresponding to an amount of money (hereinafter referred to as amount data) is stored in an IC card. There is a transaction form in which a product is purchased without obtaining the consent of the center system. Such a transaction form is called offline transaction. For example, an ATM (automa
Using a tic teller machine, etc., the amount data corresponding to all or a part of the bank balance of the user is stored in the memory area of the IC card, and when purchasing the product, the amount data is stored using an offline terminal in the store. The case of sequentially subtracting corresponds to an offline transaction.

In such an offline transaction, I
Take measures to avoid the occurrence of trouble between the card issuer and the card holder due to the mismatch between the amount data stored in the C card and the amount data corresponding to the deposit balance managed on the center system side. It becomes important.

Therefore, conventionally, a procedure has been adopted in which the amount data in the card is updated first, and then the deposit balance of the bank account is updated online. Or, conversely, a procedure may be adopted in which the balance in the bank account is updated and then the data inside the card is updated later. To update the amount data inside the card, 1
The data inside the card is updated by the data update request command for each time, and the history is added to the inside of the card as needed.

FIG. 10 is a sequence chart showing a procedure for preventing inconsistency in the amount data between the IC card and the center system. A card reader / writer (hereinafter referred to as R / W) provided in the IC card and ATM is provided. ),as well as,
This figure shows the flow of each processing in the center system connected online to the ATM.

In FIG. 10, the R / W (ATM) issues a request for updating the current amount data (update data + command) to the inserted IC card (R41, R4).
2). Upon receiving the update request, the IC card updates the amount data stored in its own memory area (K
41) At the same time, the update history is added to the memory area (K4
2). If the processing has been completed normally, an updated notification is sent to the R / W side (K43). R that has received the update notification from the IC card
/ W makes a request (R43) for updating the management data (update data + command) to the center system (R4).
3). Here, the management data refers to money amount data managed for the authorized owner of the IC card. The center system retrieves and updates the corresponding management data upon receipt of the management data update request (C41), and sends a notification of the update to the R / W when it is completed normally (C42). The R / W that has received this notification displays the updated status on a display or the like (not shown) (R44), and then controls the ejection of the IC card (R45). In this way, cooperation between the amount data of the IC card and the amount data managed by the center system is achieved.

[0007]

Here, it is assumed that the amount data is increased. Further, as a data updating method in this case, after updating (increase) the amount data on the IC card side, update (increase) the management data on the center system side.
Let's say that you have adopted the technique of In such a situation,
Although the data update in the IC card has been completed normally and the amount data has increased accordingly, if the online data update of the center system was not performed normally,
It is conceivable that a cardholder who does not know this may purchase with an IC card for an amount exceeding the management data on the center system side.

Conversely, when reducing the amount data inside the IC card, a method of updating (reducing) the management data of the center system and then updating (reducing) the amount data of the IC card has been adopted. I do. At this time, the data update on the center system side has been completed normally, and the management data has been reduced accordingly. However, if the data update inside the IC card could not be executed normally for some reason, it is assumed that the reduction was made normally. It is conceivable that a card owner who believes will make an IC card purchase for an amount exceeding the management data of the center system.

That is, in the conventional IC card, there is a high possibility that the amount data inside the card and the management data on the center system side will be inconsistent during the offline transaction, and it is difficult to guarantee the use of the correct amount data. was there.

[0010] Therefore, an object of the present invention is to provide an inconsistency between the update state of the stored data inside the card and the update state of the side managing the stored data, and to autonomously perform card transactions in the mismatched state. IC card that can be suppressed,
And an IC card system using the IC card.

[0011]

SUMMARY OF THE INVENTION In order to solve the above-mentioned problems, the present invention provides an IC card having an update control means for updating data stored in a data storage area inside the IC,
A first device having an internal control data update control unit corresponding to data stored in the card, and a second device for issuing a data update request to each of the update control units of the IC card and the first device. In the configured IC card system, a temporary update request issuing unit for requesting the second device to temporarily update the stored data to an update control unit of the IC card; First
A real update request issuing means for requesting the real update of the internal management data to the update control means of the device; and requesting the real update to the IC card update control means when confirming the normal end of the real update of the internal management data. A main update issuing unit is provided, and the contents of the data stored in the IC card are determined by executing the main update.

As a more preferred form of the IC card system, the second device further includes a system monitoring means for monitoring the presence or absence of an abnormality in the actual updating of the internal management data, and the system monitoring means detects an abnormality. And a recovery request issuing means for transmitting a recovery request to the update control means of the IC card in place of the main update request. In this case, the update control means of the IC card is configured to restore the state before the execution of the provisional update when receiving the recovery request.

The present invention also provides an IC card suitable for use in the above-mentioned IC card system. This IC card is characterized by having update control means having the following functions. (1) a first means for generating update candidate data based on a temporary update request when a temporary update request for data stored in a data storage area inside an IC is received; Second means for determining the content of the update candidate data when the update request is received. (2) A third means for restricting at least access to the data storage area upon receiving the temporary update request and releasing the restriction upon receiving the main update request. (3) Recovery request execution means for restoring data stored in the data storage area to a state before the provisional update request upon receiving a predetermined recovery request. (4) a data buffer for temporarily holding an execution result of the temporary update request or original data of the update candidate data;
Buffer control means for clearing the contents held in the data buffer when the main update request or the recovery request is received.
In other words, the presence / absence of inconsistency between the data stored in the IC and the data that manages the IC is detected, and while the use of update candidate data cannot be ensured while the consistency cannot be ensured, the use of update candidate data is restricted.
Provided is an IC card capable of speeding up subsequent processing at the time of a main update request or a recovery request.

[0014]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a diagram showing a configuration example of an IC card to which the present invention is applied. The IC card 1 includes an input / output control unit (I / O) 11 for performing data input / output control with a card reader / writer (R / W) 2, a microprocessor (CPU) 12, a ROM 13, and a RAM 1.
4 and an EEPROM 15.

The RAM 14 is a working memory used by the CPU 12 to execute a program.
M13 is a memory for storing at least a control program executed by the CPU 12. In this embodiment, the CP
The U12, the ROM 13, and the RAM 14 implement the update control unit of the present invention.

FIG. 2 is an explanatory diagram of the contents of the EEPROM 15. In the present embodiment, the EEPROM 15 has at least a status storage area 151 for storing a card status indicating whether a current setting state of a PIN (Personal Identification Number) is a PIN lock state or a PIN unlock state, and change data. Buffer 15
2, an amount data storage area 153 and an update history storage area 154 are formed. In addition, a PIN storage area may be separately formed as necessary (for example, when a plurality of PINs are set).

[0017] The PIN lock state means that when accessing the amount data (data saving, updating, reading, etc., the same applies hereinafter).
This is a state where it is necessary to prompt the input of the holder PIN and perform user authentication. When the card status is in this state, the PIN input is indispensable when using the card. On the other hand, the PIN unlocked state is a state in which PIN input is unnecessary in consideration of operational convenience, that is, a state in which user authentication by PIN is omitted. When the card status is in this state, the PIN input at the time of using the card becomes unnecessary.

The change data buffer 152 stores data stored in, for example, the money amount data storage area 153 externally (R /
In the case of generating (calculating) based on the data received from W2), the received data and the like are temporarily held, and when the contents are determined or when the contents cannot be finally determined, the holding is performed. Amount data storage area 153 based on data
Is used to restore the amount data in.

The update history storage area 154 is an area for adding a history of the transaction date and the amount each time the update of the amount data is determined. This update history is used at a later time, for example, when analyzing a transaction.

FIG. 3 is a functional block diagram of the update control means realized by the CPU 12 according to the control program stored in the ROM 13. In this embodiment, the update request execution processing unit 121, the arithmetic processing unit 122,
History state determination unit 123, status transition control unit 124,
The buffer control unit 125, the data update processing unit 126, and the update history additional write processing unit 127 are constructed. The update request execution processing unit 121 supervises the control of the following units 122 to 127, identifies various requests (commands), amount data, and the like input from the R / W 2 via the I / O 11,
Performs various requests input while monitoring the current card status. For example, if the card status is PI
In the N lock state, access to the amount data is prohibited unless there is a specific command input other than verification by PIN input. This prohibited state of data access is referred to simply as a “locked state”, and is described separately from the PIN locked state. However, an exception command is set so as to accept and execute a later-described main update request or recovery request even in the locked state.

The arithmetic processing section 122 is used for calculating the amount data. Data / history state determination unit 1
23 determines whether the current amount data or history state is a tentative state (updatable but undecided state, the same applies hereinafter) or this state (update is confirmed, the same applies hereinafter). This determination is made, for example, if the data is held in the change data buffer 152, the temporary state, the held data does not exist, and the amount of money in the amount data storage area 153 and the update history in the change history storage area 154 are checked. If the contents have been determined, this state is determined. The determination may be made by setting a flag of the temporary state or the actual state in the held data in the change buffer memory 152, the amount data in the amount data storage area 153, or the update history in the change history storage area 154.

The status transition control unit 124 receives the instruction from the update request execution
The monitoring and transition control of the current card status 51 are performed. In this embodiment, when the amount data or the like is in the provisional state, it is assumed that the state is locked to restrict access to the amount data, and when the state is changed to the unlocked state.

The buffer control section 125 clears the changed data buffer 152 and the like. The data update processing unit 126 updates the amount data stored in the amount data storage area 153, and the update history additional processing unit 127 adds the update history in the update history storage area 154. is there. The update history storage area 15
The update history in 4 may be changed so as to be overwritten.

Next, the configuration of the R / W2 (second device) that exchanges data with the IC card 1 will be described. In this case, the R / W2 is assumed to be provided in, for example, an ATM or a POS operation terminal connected online with a center system (not shown).

The R / W 2 includes an update management unit 21, a command issuing unit 22, and a system monitoring unit 23. The update management unit 21 has a temporary memory (not shown), and receives amount data, update data, various notifications, a system monitoring result to be described later, and the like from the R / W 2 operator, the IC card 1, and the center system. And temporarily outputs or sends back information about various notifications and data updates. Further, the command issuing unit 22 is instructed to issue various requests based on the data stored in the temporary memory. The command issuing unit 22
A temporary update request, a main update request (including data), or a recovery request is generated and transmitted to the IC card 1, and a real update request for management data is generated and transmitted to the center system.

The provisional update request is a command for requesting the IC card to temporarily update the amount data. For example, the relevant data of the amount data input at the time of card transaction (for example, update data transmitted to the center system) is updated and managed. Part 21
If the temporary memory does not exist in the temporary memory, it is generated in accordance with an instruction from the update management unit 21 that has detected this (temporary update request issuing means).

The update request is a command for requesting the IC card to determine the provisional amount data. If the update data is temporarily present when the update completion notification is received from the center system, the update request is issued. Is generated in response to an instruction from the update management unit 21 that has detected the update request (this update request issuing unit).

On the other hand, if the actual update of the management data on the center system side is not successful for some reason after the issuance of the provisional update request, the contents of the IC card 1 are returned to the state immediately before the issuance of the provisional update request. This is a command for restoring, and is generated in response to an instruction from the update management unit 21 that has detected the occurrence of a situation where the main update request cannot be issued after the normal completion of the temporary update process (recovery request issuing means).

The system monitoring unit 23 includes, for example, a timer, and monitors the elapsed time after the command issuing unit 22 issues a management data update request to the center system.
When the update completion notification is not received before the time-up, the result is notified to the update management unit 21 (system monitoring means).

Next, the processing operation of the IC card 1 when receiving the various requests (commands) from the R / W 2 will be described with reference to FIG.
This will be described with reference to FIG. FIG. 5 is an example of a case where a temporary update request is received. In this case, the card status is checked first, and if it is in the unlocked state, it is shifted to the locked state (steps S101, S102, S10).
3). Next, it is checked whether or not the change data buffer 152 is in the clear state. If the change data buffer 152 is in the clear state, it is checked whether the target amount data is in this state. S104, 10
5,106). If the latest update history is in this state, the data sent together with the temporary update request is written to the changed data buffer (step S107), and update candidate data is calculated (step S108). Then, the amount data storage area 1
Temporary update of amount data in 53 and update history storage area 154
Is temporarily added to the update history (step S109, 1).
10), a normal processing completion notification is sent to the R / W2 side (step S111). Steps S103, 104, 105, 10
If the determination result in step 6 is negative, error processing, for example, a response indicating that the provisional update could not be normally performed is sent to R / W2
Send to the side.

FIG. 6 shows an example of a case where the update request is received. In this case, the card status is checked to confirm that the card is locked (steps S201 and S20).
2). If it is in the locked state, it is checked whether valid data, that is, data used in the main update, exists in the changed data buffer 152 (step S20).
3). If the existence of valid data is confirmed, it is checked whether the target amount data is in the provisional state, and if it is in the provisional state, it is checked whether the latest update history is in the provisional state (step S204,
205). In the provisional state, the main update of the corresponding amount data and the main addition of the update history are performed (steps S206 and S20).
7). Thereafter, the contents of the changed data buffer 152 are cleared (step S208), the locked state is released (step S209), and a notification of normal processing completion is sent to the R / W.
This is performed for the second side (step S210). On the other hand, if the determination results in steps S202, 203, 204, and 205 are negative, the above-described error processing is performed on the R / W2 (step S211).

The above description has been made on the assumption that the function of locking the IC card is included in the provisional update request and the function of unlocking the IC card is included in the update request. The function can be performed by a command different from each update request.

Next, the overall flow of processing on the IC card 1, the R / W2, and the center system that operate as described above will be described with reference to FIGS.

FIG. 7 is a sequence chart showing a normal flow. After R / W2 transmits the provisional update request (R
11, R12) and the procedure (K11 to K14) until the notification of normal processing completion is received from the IC card 1 are as shown in FIG. When the temporary update processing on the IC card 1 side is completed normally, the R / W 2 next sends a request for actual update of management data (including update data) to the center system (R13). The center system retrieves the relevant management data and updates it (C11), and sends an updated notification to the R / W2 (C12). The R / W 2 that has confirmed the actual update of the management data by this notification (R 14) transmits a main update request to the IC card 1 (R 15). After the IC card 1 that has received the main update request performs the main update of the target amount data and the update history and the main postscript, the procedure from notifying the R / W 2 of the release of the locked state (K15 to K19)
Is as shown in FIG. R / received notification of cancellation
W2 displays the normal processing completion on a display or the like (R1
6) Perform card ejection control after required end processing (R
17).

FIG. 8 is a sequence chart showing a flow at the time of abnormality. Various types of abnormalities can be considered, but in this case, the cause of the fact that the actual update cannot be performed on the center system side has occurred, and the update completion notification (C1
2) is not transmitted to the R / W2 side.

In this case, the R / W 2 transmits a provisional update request to the IC card 1, and the R / W 2 having received the normal processing completion notification from the IC card 1 transmits a management data actual update request to the center system. Procedure up to (R21, R2
2, K21 to K25, R23) are the same as those in FIG. Here, in the R / W2, the monitoring by the timer is started at the same time as the transmission of the management data update request (R24).
This monitoring is performed by the system monitoring unit 23. Since an abnormality has occurred in the center system as described above (C21),
Even after the time-up, the update completion notification is not performed (R25).
Therefore, the system monitoring unit 23 informs the update management unit 21 that the monitoring result is negative. The update management unit 21
Error processing is performed based on the monitoring result, for example, an error is displayed on a display (not shown) (R27). As described above, if an abnormality occurs after the provisional update request and before the main update request, the amount data and the update history of the IC card 1 remain in the provisional state, and the card status remains locked.

FIG. 9 is a sequence chart at the time of recovery processing. In the recovery process, when the amount data or the like of the IC card 1 is in the temporary state, it is forcibly restored to the state immediately before the temporary update request. This recovery process is started when a recovery request is transmitted from the R / W2 to the IC card 1 (R31, R3).
2). In the IC card 1, the update request execution processing unit 121
Adds the change amount data in the change data buffer 152 to the amount data in the amount data storage area 153 (when the provisional update is a decrease) or subtracts (when the provisional update is an increase) (K31). . Further, the latest data update provisional history is deleted (K32). Thereafter, the changed data buffer 152 is cleared (K33), the lock state is released, and the lock state release is notified to the R / W 2 (K3).
4). After displaying this unlocked state on a display or the like (R33), the R / W 2 performs card ejection control (R33).
34). Thereby, the IC card 1 returns to the state before the temporary update request.

As described above, the IC card 1 of the present embodiment
Has a function to detect inconsistency with the management data in the center system and to prevent the card from being used in such a state. Can be avoided.

In the present embodiment, an example of the case of the amount data is shown. However, the same embodiment is also possible in the case of the lending amount by the book card and the score amount by the game card.

[0040]

As is apparent from the above description, according to the IC card of the present invention, the cooperation with the management data on the center system side is achieved, so that the transaction by the IC card in a state where the management data does not match the management data. The effect is avoided. Such an effect is particularly effective in an IC card system that allows off-line transactions.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of an IC card to which the present invention is applied.

FIG. 2 is a diagram illustrating the contents of an EEPROM of the IC card according to the embodiment.

FIG. 3 is a configuration diagram of functional blocks realized by the IC card according to the embodiment;

FIG. 4 is a configuration diagram of functional blocks provided on the card reader / writer side of the embodiment.

FIG. 5 is an explanatory diagram of a processing procedure on the IC card side when a temporary update request is received in the embodiment.

FIG. 6 is an explanatory diagram of a processing procedure on the IC card side when a main update request is received in the embodiment.

FIG. 7 is a sequence chart showing a normal processing flow in the IC card, R / W, and center system of the embodiment.

FIG. 8 is a sequence chart showing the flow of processing when an abnormality occurs in the IC card, R / W, and center system of the embodiment.

FIG. 9 is a sequence chart showing a flow of a recovery process in the IC card, the R / W, and the center system of the embodiment.

FIG. 10 is a sequence chart showing a conventional processing flow when a data update request occurs in the IC card, R / W, and center system.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 IC card 2 Card reader / writer (R / W) 11 I / O control part (I / O) 12 Microprocessor (CPU) 13 ROM 14 RAM 15 EEPROM 121 Update request execution processing part 122 Arithmetic processing part 123 Data / history state judgment Unit 124 status transition control unit 125 buffer control unit 126 data update processing unit 127 update history appending processing unit 151 status storage area 152 change data buffer 153 amount data storage area 154 update history storage area

──────────────────────────────────────────────────の Continuing on the front page (51) Int.Cl. ⁷ Identification symbol FI G07F 7/08 G07F 7/08 Z (72) Inventor: Kenji Imai 3-3-3 Toyosu, Koto-ku, Tokyo NTT (56) References JP-A-61-296486 (JP, A) JP-A-8-235043 (JP, A) JP-A-7-56783 (JP, A) JP-A-2- 138646 (JP, A) JP-A-8-256367 (JP, A) (58) Fields investigated (Int. Cl. ⁷ , DB name) G06F 19/00 B42D 15/10 521 G06K 17/00 G07F 7/08

Claims (2)

(57) [Claims] An IC card having an update control means for updating data stored in a data storage area inside the IC;
A first device having an internal control data update control unit corresponding to data stored in the card, and a second device for issuing a data update request to each of the update control units of the IC card and the first device. In the configured IC card system, a temporary update request issuing unit for requesting the second device to temporarily update the stored data to an update control unit of the IC card; First
A real update request issuing means for requesting the real update of the internal management data to the update control means of the device; and requesting the real update to the IC card update control means when confirming the normal end of the real update of the internal management data. An IC card system comprising: a main update issuing unit; and the contents of data stored in the IC card are determined by executing the main update. 2. The system according to claim 1, further comprising: a system monitoring unit that monitors whether there is an abnormality in the actual update of the internal management data; Recovery request issuing means for sending a recovery request to the update control means of the IC card, and the update control means of the IC card restores the state before execution of the temporary update when the recovery request is received. 2. The integrated circuit according to claim 1, wherein
Card system.