JP3607229B2 - Portable electronic device and method for checking the same - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention incorporates an IC (integrated circuit) chip having a control element such as a writable / rewritable non-volatile memory and a CPU, and performs various processes based on command data supplied from the outside. The present invention relates to a portable electronic device and a check method thereof.
[0002]
[Prior art]
In recent years, as a portable electronic device, an IC having a rewritable nonvolatile data memory and a CPU (Central Processing Unit) for controlling it, and means for inputting / outputting data from the outside So-called IC cards with built-in chips have been developed in various industries.
[0003]
With the advancement of IC cards in various industries, IC card shipment forms have been diversified. For example, when providing an IC card before issuance, there are cases where the card is issued by the provider, and when an issued IC card is provided, there is a case where personal information is written at the provider. In the case described above, it is necessary to check whether the IC card provided by the provider is normal (there is no defective product).
[0004]
As such a check method, for example, Japanese Patent Laid-Open No. 4-15778 discloses a check code calculated based on card data before writing on a card, and a check code calculated based on card data read from the card. It is described that the erroneous recording due to the fact that the write data itself is incorrect is checked by comparing the above.
[0005]
[Problems to be solved by the invention]
However, in the case of the prior art as described above, since the data recorded on the card is checked in the external device (card data check device), if the comparison result of the check code does not match, There is also a possibility that an error occurring during reading may be a cause. Furthermore, there is a possibility that the recording part of the card itself is defective before erroneous recording. Therefore, the true reason for the mismatch of the check codes is not known, and it is difficult to determine at which stage of the process the card is shipped and various processes are performed.
[0006]
The present invention has been made in view of the above points, and an object thereof is to provide a portable electronic device that can reliably detect defective products and a method for checking the portable electronic device.
[0007]
[Means for Solving the Problems]
To achieve the above object, the portable electronic device of the present invention is a portable electronic device that operates based on command data received from the outside.
A rewritable nonvolatile memory that stores a plurality of data and stores first information for confirming the validity of the data calculated based on all or a part of each data in correspondence with each data. Memory,
When receiving command data for instructing the validity of the nonvolatile memory from the outside,
Calculating means for calculating, for each data, second information for confirming the validity of the data based on the whole or a part of each data stored in the nonvolatile memory;
The second information calculated by the calculating means is compared with the first information stored in the non-volatile memory, and the first information and the second information match in all data. A legitimacy confirmation means for confirming that the data is legitimate,
Writing means for writing confirmation information into the nonvolatile memory indicating that the validity confirmation has been performed by the validity confirmation means;
When command data other than command data for instructing the validity confirmation of the nonvolatile memory is received from the outside,
Determination means for determining whether or not the validity has been confirmed based on the confirmation information indicating that the validity has been confirmed;
And a prohibiting means for prohibiting subsequent legitimacy confirmation when it is judged by the judging means that the legitimacy has been confirmed.
In order to achieve the above object, a portable electronic device checking method according to the present invention includes a rewritable nonvolatile memory for storing a plurality of data, and operates based on command data received from the outside. In a method for checking possible electronic devices,
Receiving instruction data instructing the validity of the non-volatile memory from the outside,
Calculate confirmation information for each data to confirm the validity of the data based on at least a part of each data stored in the nonvolatile memory,
Compare this confirmation information with the validity management information indicating the validity of each data stored in advance in the nonvolatile memory for each corresponding data,
As a result of comparison, when the confirmation information and the validity management information match, the data is confirmed to be valid,
Write check information indicating that the validity has been confirmed to the nonvolatile memory,
Receiving instruction data other than instruction data for instructing confirmation of the validity of the nonvolatile memory from the outside;
Based on the check information indicating that the validity has been confirmed, it is determined whether or not the validity has been confirmed,
If it is determined that the validity has been confirmed, subsequent validity confirmation is prohibited.
[0008]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments according to the present invention will be described in detail with reference to the drawings. FIG. 2 is a diagram for explaining a system configuration using an IC card 1 (including both contact type and wireless type) and a reader / writer 4 (including both contact type and wireless type) as portable electronic devices according to the present invention. It is.
[0009]
As shown in FIG. 2, the system using the IC card 1 includes a host computer 3 as a host device having an internal memory (not shown), a reader / writer 4 as a terminal device connected to the host computer 3, A display device 5, a keyboard 6, and a printer 7 are included.
[0010]
The reader / writer 4 has an internal memory, and performs reading and writing (transmission / reception) of messages to and from the IC card 1 in contact or non-contact. The display device 5 notifies an operator of an operation procedure and an operating state. The keyboard 6 is input by an operator. The printer 7 prints the instructed information in accordance with an operator operation instruction.
[0011]
When using a contact IC card, the reader / writer 4 is provided with an IC card insertion section (not shown) for inserting the contact IC card. When using a wireless IC card, the reader / writer A communication unit (not shown) for communicating between the wireless IC card 4 and the wireless IC card is provided.
[0012]
FIG. 3 is a diagram schematically showing functional blocks of the IC card 1 constituting the system of FIG. As shown in FIG. 3, the IC card 1 includes a read / write unit (R / W unit) 11, a password setting / password verification unit 12, and a part that executes basic functions such as an encryption / decryption unit 13. And a supervisor 14 for managing these basic functions.
[0013]
The R / W unit 11 has a function of reading, writing, or erasing data with respect to a data memory or the like. The password setting / password collating unit 12 performs processing for prohibiting the storage and reading of the password set by the user, collates the password with the password entered from the external device after setting the password, and performs subsequent processing. It has a function to give permission.
[0014]
The encryption / decryption unit 13 is an encryption for preventing leakage or forgery of communication data when data is transmitted / received between the reader / writer 4 and the IC card 1 via a communication line or by wireless communication, for example. And a function of performing decryption.
[0015]
The encryption / decryption unit 13 also has a function of encrypting transmission data and decrypting the encrypted data. The supervisor 14 has a function of decoding an instruction code input from the reader / writer 4 or an instruction code to which data is added and executing the instruction. The encryption / decryption unit 13 constitutes the decryption means of the present invention.
[0016]
FIG. 4 shows a schematic control block diagram of the IC card 1. As shown in FIG. 4, at least one or more applications can be registered in both the wireless and contact IC cards, and control of a CPU or the like as a control means in order to execute various functions as shown in FIG. The device 15 includes a data memory 16 as various storage units, a program memory 18, a working memory 17, a reader / writer 4 for receiving and transmitting signals, and a communication unit 19 as an output unit. Examples of registered applications include credits and point systems.
[0017]
In the case of the wireless IC card 1, the communication unit 19 is configured as an antenna unit, and receives a modulated wave transmitted from the reader / writer 4 in a non-contact manner or transmits a modulated wave to the outside. Further, a power supply and a clock for supplying to the internal circuit are generated from the modulated wave received by the antenna unit 19.
[0018]
In the case of the contact type IC card 1, it is configured as a contact portion, and a power source and a clock are obtained by contacting an IC card terminal portion (not shown) provided in the reader / writer 4.
[0019]
Among these components, the control element 15, the data memory 16, the program memory 18, and the working memory 17 are constituted by one IC chip (or a plurality of IC chips) 20 and are embedded in the IC card body. The control element 15 is a control unit that performs various determination processes / determination processes and data processes such as writing to and reading from the memory.
[0020]
The program memory 18 is composed of a non-rewritable fixed memory such as a mask ROM (Read Only Memory), for example, and stores a control program of the control element 15 having a subroutine for realizing each basic function as described above. doing.
[0021]
The data memory 16 is used for storing various data such as application data, and is composed of an erasable (rewritable) nonvolatile memory such as an EEPROM (Electrically Erasable and Programmable ROM) and a ferroelectric nonvolatile memory (FeRAM). ing.
[0022]
The working memory 17 is a working memory for temporarily storing processing data when the control element 15 performs processing, and is configured by a volatile memory such as SRAM (Static Random Access Memory).
[0023]
FIG. 5 is a conceptual diagram showing the configuration of the data memory 16. As shown in FIG. 5, the data memory 16 is largely divided and defined into a system area 110 and a user area 120. In particular, the system area 110 is an area for storing data directly related to, for example, internal control in the IC card 1.
[0024]
Therefore, in the system area 110, card management information 111 including data used for managing the entire data memory 16, etc., DF definition information 112 for managing a plurality of data files (hereinafter referred to as DF), and EF An EF address table 113 for managing addresses of (elementary files) is stored sequentially from the top of the data memory 16.
[0025]
In the user area 120, a plurality of EF data strings 122 that are associated with the DF definition information 112 and the EF address table 113 and actually store various data are sequentially arranged from the end of the data memory 16 and set. . Therefore, the portion sandwiched between the various storage information 111, 112, 113 in the system area 110 and the EF data string 122 exists as a free area 121 in the data memory 16.
[0026]
The free area 120 is an area that does not belong to any of the various storage information 111, 112, 113 and the EF data string 122 in the system area 110, and is an area that is used when the addition of the EF data string 122 occurs. .
[0027]
Further, when the IC card manufacturer (or issuer) ships the IC card 1, it is confirmed that the memory in the entire user area 120 or in the used area (the EF data string 122) is in a normal state. The legitimacy management information shown is stored in a predetermined location (described later in each embodiment) with respect to the IC card 1.
[0028]
As a result, the provision destination provided with the IC card calculates the validity management information using the entire user area 120 or the portion used by the user area 120 (the EF data string 122 portion) and stores it in the IC card 1 in advance. By comparing with the legitimacy management information that has been provided, it is possible to confirm that the provided IC card 1 is not defective.
[0029]
Further, as shown in FIG. 6, in the present embodiment, the card management information 111 in the system area 110 is provided with a check completion flag 140 and a validity check prohibition flag 150.
[0030]
The check completion flag 140 performs a validity check (to be described later) in order to determine whether or not the memory of the entire user area 120 or the portion used (the EF data string 122 portion) is normal (no defective product). It is a flag indicating whether or not it has been implemented.
[0031]
The check completion flag 140 stores “0” indicating that the validity check has not been completed when the validity management information is set as will be described later. When the process ends normally, “1” indicating that the validity check has been completed normally is stored.
[0032]
The validity check prohibition flag 150 is a flag indicating whether or not the validity check function in the IC card 1 can be executed. When “0” is stored, the validity check function can be implemented. When “1” is stored, it indicates a state in which the execution of the validity check function is prohibited.
[0033]
The validity check prohibition flag 150 is provided for each application when the IC card 1 has a plurality of applications and holds a plurality of DFs corresponding to the plurality of applications. As a result, in the IC card 1, it is possible to prohibit the execution of the validity check function for each application (DF).
[0034]
In the present embodiment, at the first access to the IC card 1 in which the validity management information is set, a command for instructing the validity check is not executed first (that is, other processing is first performed on the IC card 1). If it is instructed, the execution of the validity check function is prohibited.
[0035]
Accordingly, since the validity check function can be executed when the validity management information is set, both the validity check prohibition flag 150 and the check completion flag 140 store “0”.
[0036]
As shown in the flowchart of FIG. 1, first, in the IC card manufacturer or issuer, the memory of the entire user area 120 of the IC card 1 or the portion used (EF data string 122) is described below. By this method, the validity management information is calculated and stored in a predetermined memory portion (ST100). Then, the IC card 1 in which the validity management information is set is provided to the providing destination.
[0037]
Next, the supply destination of the IC card 1 supplies power, a clock signal, and a reset signal to the IC card 1 in which the validity management information is set in ST100. When the control element 15 of the IC card 1 detects a reset signal (ST101), an initial response signal (Answer to Reset: ATR) corresponding to the reset is output to the outside (ST102).
[0038]
Next, when a command is received from the outside (ST103), the content of the received command is analyzed to determine whether it is a validity check command (ST104). If it is determined that the validity check command has been received as a result of the determination in ST104, the validity check prohibition flag 150 and the check completion flag 140 are referred to and it is confirmed whether or not “0” is stored (ST105).
[0039]
As a result of the confirmation in ST105, when the validity check prohibition flag 150 stores “1” and execution of the validity check function is prohibited, an error response in which a status code indicating that execution is impossible is set. Is output and the series of processing is interrupted (ST110).
[0040]
As a result of the confirmation in ST105, if the check completion flag 140 stores “1” and the validity check has already been completed normally, an error response in which a status code indicating that the check has already been completed is set. Output, and a series of processing is interrupted (ST110).
[0041]
As a result of the confirmation in ST105, when both the validity check prohibition flag 105 and the check completion flag 140 store “0”, and the validity check is not completed and the check function can be executed, the control element 15 Legitimacy management information is calculated using the entire area 120 or a portion used in the area 120 (EF data string 122 portion), and is compared with the legitimacy management information stored in advance in the IC card 1 (ST106).
[0042]
If the validity management information does not match as a result of the comparison in ST106, the control element 15 outputs an error response in which a status code indicating a mismatch is set to the outside (ST110). If the validity management information matches as a result of the comparison in ST106, the check completion flag 140 is changed from “0” to “1”, and a normal response in which the status code “9000” indicating normal termination is set is displayed. Output to the outside (ST109).
[0043]
Next, when a command that is not a validity check command is received as a result of the determination in ST104, the process proceeds to the flowchart of FIG. 7, and the control element 15 refers to the check completion flag 140 and the validity check is already normal. It is determined whether the process has been completed (ST111).
[0044]
As a result of the determination in ST111, if the check completion flag 140 stores “1” and it is determined that the validity check has been completed normally, the process is executed according to the instruction of the received command, and the process result is displayed. A response is output (ST112).
[0045]
As a result of the determination in ST111, if the check completion flag 140 stores “0” and it is determined that the validity check has not yet been executed, the validity check prohibition flag 150 is changed from “0” to “ 1 "(ST113). Then, processing is executed in accordance with the received command instruction, and the processing result is output as a response (ST114).
[0046]
Therefore, in the embodiment, the validity check function is executed at the first access to the IC card 1 in which the validity management information is set at the providing destination, and it is confirmed whether the provided IC card is a defective product. It has become. Conversely, when command processing other than the validity check is instructed, execution of the validity check function is prohibited.
[0047]
For this reason, it is possible to recognize whether the provided IC card is not normal or whether a defect has occurred because different processing is performed at the providing destination.
[0048]
(First embodiment regarding validity check function)
Next, a first embodiment relating to the memory validity checking function in the IC card 1 will be described with reference to FIGS. In the first embodiment, the above-described validity management information of the user area 120 is calculated and assigned for each EF data generated in the user area.
[0049]
FIG. 8 is a diagram showing a configuration of the EF data string 122 of the data memory 16. Each EF data string 122 includes at least EF data string length management information 126, EF definition information 127, EF data 128, and EF validity management information 129 described later, as shown in FIG.
[0050]
The EF data string length management information 126 is composed of 1 byte, and is length information from the head of the EF data string length management information 126 to the end of the EF definition information 127, EF data 128, and EF validity management information 129. Is stored. The EF definition information 127 stores identification information for identifying a file configuration, an authentication key necessary for access, and the like. The EF data 128 is a part that actually stores data.
[0051]
The EF validity management information 129 is a flag for confirming that the data of the EF is valid. For example, all values (bytes) of the EF data string length management information 126, the EF definition information 127, and the EF data 128 are stored. The carry value is a 1-byte value that is ignored.
[0052]
That is, when two bytes consisting of “FEh” and “02h” (h indicates a hexadecimal number) are added, “101h” is obtained, but the carry is ignored, so that “01h” is added as the addition result. Further, the next byte is added.
[0053]
The EF validity management information 129 is based on the values of the EF data string length management information 126, the EF definition information 127, and the EF data 128 when the EF data string 122 is created in the user area 120 of the data memory 16. And is stored following the end of the EF data string 122.
[0054]
FIG. 9A is a diagram for explaining the configuration of command data supplied from the reader / writer 4 to the IC card 1. As a command used in the present embodiment, there is a validity check command to be described later. The validity check command is a command for instructing whether the IC card 1 is normal (not defective) after receiving the provision of the IC card 1 from the manufacturer (or issuer) of the IC card.
[0055]
As shown in FIG. 9A, the validity check command has a command code portion including a command classification (CLA: class) and an instruction (INS: instruction), and parameter data P1 and P2.
[0056]
FIG. 9B shows a structure of response data output from the IC card 1 to the reader / writer 4 after executing the command shown in FIG. 9A, and includes a status code part (SW1, SW2). . Then, in the IC card 1, when the execution of the validity setting command or the validity check command is normally completed, the status code portion is set as SW1 = 90 and SW2 = 00 and is output externally. ing.
[0057]
FIG. 10 is a flowchart of the first embodiment regarding the validity check command processing in the IC card 1 configured as described above. This is a function that is executed in order to confirm whether the IC card 1 is received from the manufacturer (or issuer) of the IC card.
[0058]
FIG. 10 is a flowchart illustrating the validity check command processing of ST106 to ST107 in FIG. 1 in detail in ST121 to ST124, and the same step numbers are assigned to other identical parts.
[0059]
As shown in FIG. 10, when power is supplied to the provided IC card 1 and a reset signal is detected (ST101), the control element 15 outputs an ATR corresponding to the reset to the outside (ST102). ).
[0060]
Next, when a command is received from the outside (ST103), the content of the received command is analyzed to determine whether it is a validity check command (ST104). If the result of the determination in ST104 is not a validity check command, the process proceeds to ST111 and subsequent steps shown in FIG.
[0061]
If it is determined that the validity check command has been received as a result of the determination in ST104, the validity check prohibition flag 150 and the check completion flag 140 are referred to and whether the validity check function can be implemented (both “0” is set). Whether it is stored) is confirmed (ST105).
[0062]
As a result of the confirmation in ST105, if either the validity check prohibition flag 150 or the check completion flag 140 stores “1”, the execution of the validity check function is prohibited as described with reference to FIG. Since the validity check has already ended normally, an error response is output and the series of processing is interrupted (ST110).
[0063]
As a result of the confirmation in ST105, when both the validity check prohibition flag 105 and the check completion flag 140 store “0”, the validity check is not completed and the check function can be executed, the control element 15 All values of the EF data string length management information 126, the EF definition information 127, and the EF data 128 are added from the EF data string 122a at the tail of the memory 16, and the carry value is a 1-byte value ignored. Calculate (ST121).
[0064]
Then, the calculated value of ST121 is compared with the stored value of the EF data validity management information 129 of the EF data string 122a to be calculated (ST122). As a result of the comparison, if they match, the addition calculation process after the next EF data string 122b and the comparison process (ST121-ST124) are repeatedly executed. If the result of the comparison in ST123 is that they do not match, the control element 15 sets a status code indicating an error and outputs it to the outside (ST110).
[0065]
Further, the addition calculation process and the comparison process are executed for all the EF data strings 122 existing in the data memory 16 in ST124, and when all match (ST121-ST124), the control element 15 sets the check completion flag 140. “0” is changed to “1” (ST108), status code “9000” indicating normal termination is set, and output to the outside (ST109).
[0066]
In the first embodiment, the validity management information of the user area is individually assigned to all EF data generated in the user area. Therefore, when it is determined that the normality is not normal during the validity check, it is possible to recognize which part in the user area is not normal.
[0067]
As shown in the first embodiment, in the case where the validity management information is provided for each EF data string, the validity management information is calculated for each EF data string and stored together when the EF data string is created. Therefore, it goes without saying that the same effect can be obtained even if the check completion flag 140 shown in FIG. 6 is not held.
[0068]
(Second embodiment regarding validity check function)
Next, a second embodiment relating to the memory validity checking function in the IC card 1 will be described with reference to FIGS.
[0069]
In the second embodiment, as compared with the first embodiment, the validity management information of the user area 120 is calculated based on the entire user area 120 (the generated EF data string 122 and the free area 121), The difference is that the data is stored in the system area 110. The same parts as those in the first embodiment will be described using the same reference numerals, and overlapping descriptions will be omitted.
[0070]
In the second embodiment, as a command to be used, in addition to a validity check command, there is a new validity setting command described later. This validity setting command is a command that is executed before the IC card 1 is provided to a third party. The validity of the user area 120 in the data memory 16 is calculated, and the calculation result is stored in the system area. It is a command to instruct. This is a command used in the stage of ST100 in FIG.
[0071]
The validity setting command and the response data corresponding thereto are transmitted and received between the reader / writer 4 and the IC card 1 in the format shown in FIG. 9 in the same manner as the validity check command in the first embodiment. .
[0072]
In the second embodiment, as shown in FIG. 11A, the card area management information 111 in the system area 110 further includes user area validity management information 130 for managing the validity of the user area 120, and the validity of the user area. A management information flag 131 indicating that the management information is set is stored.
[0073]
The user area validity management information 130 is calculated from the values of the entire user area 120 (the generated EF data string 122 and the free area 121). The management information flag 131 stores “1” when the user area validity management information 130 is set.
[0074]
As shown in FIG. 11B, system area validity management information 132 for managing the validity of the part other than the user area 120 of the data memory 16, that is, the system area 110, is stored in the system area (EF address table). 113).
[0075]
In the self-diagnosis process performed when the IC card 1 is started, the system area 110 (specifically, the system area excluding the user area validity management information 130, the management information flag 131, and the system area validity management information 132). A validity check is performed. The validity check method is similarly calculated based on the value (byte) of the system area 110 and compared with the management information 131 of the system area.
[0076]
FIG. 12 is a flowchart for explaining a method for setting the user area validity management information 130 and the management information flag 131. As shown in FIG. 12, in the second embodiment, the reader / writer 4 is valid for the IC card 1 in which the state of the management information flag 131 in the system area indicates that the management information is not set. The setting command is executed.
[0077]
When receiving the validity setting command from the outside (ST131), the control element 15 of the IC card 1 refers to the management information flag 131 stored in the card management information 111 and determines whether the management information has already been set. (ST132).
[0078]
As a result of the determination in ST132, when “1” is stored in the management information flag 131 and it is determined that the management information has already been set, the control element 15 indicates that the management information has already been set. An error response in which the status code shown is set is output, and a series of processing is interrupted (ST133).
[0079]
As a result of the determination in ST132, if “0” is stored in the management information flag 131 and it is determined that the management information is not set, the control element 15 sets the value in the user area of the data memory 16 to the value. Based on this, the user area validity management information 130 is calculated (ST134).
[0080]
As this calculation method, for example, a method in which all values (bytes) in the user area 120 are added and a value of 1 byte is calculated by ignoring the carry value.
[0081]
In the case of the second embodiment, all values in the user area 120 can be calculated including not only the existing EF data strings 122a, 122b, 122c,. Therefore, the validity can be confirmed not only in the user area where the EF data string 122 exists but also in the empty area 121.
[0082]
Next, the control element 15 stores the user area validity management information 130 calculated in ST134 at a predetermined location of the card management information 111 in the system area 110, and sets the management information flag 130 in the validity management information. It is changed to the information “1” indicating that it has been made (ST135). Then, the response data indicating the normal end is output to the outside, and the series of processes of the validity setting command is ended (ST136).
[0083]
FIG. 13 is a diagram showing the configuration of the EF data string 122 of the data memory 16 in the second embodiment. Each EF data string 122 includes at least EF data string length management information 126, EF definition information 127, and EF data 128. Further, as shown in FIG. 13A, a configuration including EF validity management information 129 may be used as in the first embodiment.
[0084]
FIG. 14 is a flowchart of the second embodiment regarding the validity check command processing in the IC card 1 having the configuration shown in FIGS. As in the first embodiment, when the IC card 1 is provided from the IC card manufacturer (or issuer), it is a function that is executed first to confirm whether the product is defective.
[0085]
As shown in FIG. 14, when power is supplied to the provided IC card 1 and a reset signal is detected (ST141), the control element 15 performs self-diagnosis processing of various circuits inside the IC card 1. Execute. In this self-diagnosis process, the system area 110 is checked and compared with the management information 132 of the system area to confirm that they match.
[0086]
When the self-diagnosis process in ST42 ends normally, the ATR including the result of the self-diagnosis is output to the outside (ST142). Note that the timing for performing the self-diagnosis process is not limited to the timing of the present embodiment.
[0087]
Next, when a command is received from the outside (ST143), the content of the received command is analyzed to determine whether it is a validity check command (ST144). If the result of the determination in ST104 is not a validity check command, the process proceeds to ST111 and subsequent steps shown in FIG.
[0088]
If it is determined that the validity check command has been received as a result of the determination in ST144, the management information flag 131 is referred to determine whether the validity management information is set (ST145), and the validity check is prohibited. Referring to flag 150 and check completion flag 140, it is confirmed whether the validity check function can be implemented (both store “0”) (ST146).
[0089]
When it is determined in ST145 that “0” is stored in the management information flag 131 and the validity management information is not set, or in ST146, “1” is set in either the validity check prohibition flag 150 or the check completion flag 140. When it is determined that the execution of the validity check function is prohibited or the validity check has already been completed normally as described in FIG. 1, an error response is output and a series of Processing is interrupted (ST147).
[0090]
In ST145, “0” is stored in the management information flag 131 and the validity management information is set. In ST146, the validity check prohibition flag 105 and the check completion flag 140 both store “0”, and the validity check is not completed. If it is determined that the check function can be executed, the control element 15 adds, for example, all the values (in bytes) of the user area 120 of the data memory 16 and ignores the carry value. A 1-byte value is calculated (ST148).
[0091]
Then, the calculated value of ST148 is compared with the user area validity management information 130 stored in the card management information 111 (ST149). As a result of this comparison, if they do not match (ST151), the control element 15 sets a status code indicating an error and outputs it to the outside (ST147).
[0092]
If it is determined in ST150 that they match, the control element 15 changes the check completion flag 140 from “0” to “1” (ST151), sets the status code “9000” indicating normal termination, and external (ST152).
[0093]
As described above, in the second embodiment, the validity management information is calculated based on the value of the entire user area including the empty area 121 as well as the part storing the EF data. Therefore, it is possible to confirm the validity in the empty area, and it is possible to deliver the normal IC card 1 to the provider more reliably.
[0094]
In the second embodiment, the validity of the user area 120 of the data memory 16 is confirmed by a validity check process, and the validity of the system area 110 is checked by self-diagnosis. . Therefore, it is possible to check the validity of the entire data memory 16.
[0095]
In the second embodiment, the process for confirming the validity of the user area can be instructed with one command. Therefore, it is possible for the provider to easily confirm the validity of the provided IC card.
[0096]
【The invention's effect】
As described above, according to the present invention, defective products can be reliably detected.
[Brief description of the drawings]
FIG. 1 is a flowchart for explaining validity management information setting processing and validity check processing in an IC card 1 according to a portable electronic device of the present invention.
FIG. 2 is a diagram for schematically explaining a system configuration using an IC card 1 and a reader / writer 4;
3 is a view showing basic functional blocks of the IC card 1. FIG.
FIG. 4 is a diagram showing a control block of the IC card 1;
FIG. 5 is a diagram for explaining a configuration of a data memory 16 of the IC card 1;
FIG. 6 is a flowchart for explaining the validity management information setting process and the validity check process in the IC card 1;
FIG. 7 is a diagram for explaining storage information related to validity check processing;
FIG. 8 is a diagram for explaining the configuration of an EF data string 122 in a user area 120 in the first embodiment.
FIG. 9 is a diagram showing a configuration of command data (in particular, a validity check command and a validity setting command) and response data corresponding thereto.
FIG. 10 is a flowchart for explaining a first embodiment relating to a validity check process in the IC card 1;
FIG. 11 is a diagram showing information related to the validity check process of the IC card 1 in the second embodiment.
FIG. 12 is a flowchart for explaining legitimacy setting processing in the IC card 1;
FIG. 13 is a diagram for explaining the configuration of an EF data string 122 in a user area 120 in the second embodiment.
FIG. 14 is a flowchart for explaining a second embodiment relating to a validity check process in the IC card 1;
[Explanation of symbols]
1 IC card
4 Reader / Writer
16 data memory
17 Working memory
18 Program memory
110 System area
120 User area
121 Free space
122 EF data string
129 EF legitimacy management information
130 User area validity management information
131 Management information flag
132 System area correctness management information
140 Check complete flag
150 Validity check prohibition flag

Claims (2)

In a portable electronic device that operates based on command data received from outside,
Storing a plurality of data, a rewritable nonvolatile storing the first information to confirm the validity of the data calculated on the basis of the whole or part of the respective data to correspond to the respective data Memory,
When receiving command data for instructing the validity of the nonvolatile memory from the outside,
Calculating means for calculating, for each data, second information for confirming the validity of the data based on all or part of each data stored in the nonvolatile memory;
The second information calculated by the calculation means is compared with the first information stored in the non-volatile memory, and the first information and the second information match in all data. A legitimacy confirmation means for confirming that the data is legitimate,
Writing means for writing confirmation information into the nonvolatile memory indicating that the validity confirmation is performed by the validity confirmation means;
When command data other than command data for instructing the validity confirmation of the nonvolatile memory is received from the outside,
Determination means for determining whether or not the validity has been confirmed based on the confirmation information indicating that the validity has been confirmed;
A portable electronic device comprising: prohibiting means for prohibiting subsequent validity checking when it is determined by the determining means that the validity has been confirmed. In a check method of a portable electronic device having a rewritable nonvolatile memory for storing a plurality of data and operating based on command data received from outside,
Receiving instruction data for instructing confirmation of the validity of the non-volatile memory from the outside,
Calculating a check information to confirm the validity of the data based on at least a portion of each data stored in the nonvolatile memory for each data,
Comparing the confirmation information calculated in this calculation step with the validity management information indicating the validity of each data stored in advance in the nonvolatile memory for each corresponding data;
As a result of comparison in this comparison step, when the confirmation information matches the validity management information, the step of confirming that the data is valid;
Writing check information into the non-volatile memory indicating that the validity is confirmed in the confirmation step;
Receiving command data other than command data for instructing confirmation of the validity of the nonvolatile memory from the outside;
Determining whether or not validity has been confirmed based on check information indicating that validity has been confirmed in the confirmation step; and
A method for checking a portable electronic device, comprising: a step of prohibiting subsequent legitimacy confirmation when it is judged that the legitimacy has been confirmed in this judgment step.

Images