JP3788886B2 - IC card and IC card using device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an IC card and an IC card utilization device that can realize high reusability of a program even in different types of IC cards.
[0002]
[Prior art]
In recent years, in various fields such as finance, distribution, communication, and medical care, development of an IC card that is equipped with an IC chip capable of storing data and procedures and that executes a unique function has been advanced.
[0003]
In this type of IC card, an internal program is operated by a different card OS for each vendor. For this reason, even if a program has the same function, it is necessary to recreate a new program in order to mount it on an IC card of another type (other specifications).
[0004]
The type of IC card means the specification of the IC card. For example, the same RSA algorithm is different for each vendor, the same vendor is different for each combination of functions, and the same RSA of the same vendor is used. The algorithm of the method is different for each IC card version.
[0005]
On the other hand, recently, with the advent of Java cards (Java is a trademark of Sun Microsystems, Inc.), card OSs have become common. In this Java card, a program (applet) in the IC card can be mounted on other types of IC cards in principle by a common card OS.
[0006]
[Problems to be solved by the invention]
However, in the case of the IC card as described above, in the case of a common card OS, the internal program can be mounted on other types of IC cards in principle, but is actually customized for each type of IC card. It is necessary to
[0007]
For example, the amount of memory that can be used for each type of IC card differs between the types of IC cards, so that even when a key management program having the same function is installed, the number of keys entering the card differs.
[0008]
Even in the same encryption / signature function program, for example, there is a difference in the supported algorithm between the case where only the DES (Data Encryption Standard) method is implemented and the case where both the DES method and the triple DES method are implemented. Therefore, each type of IC card needs to be customized according to the number of keys and the difference in supported algorithms.
However, with the advent of a common card OS, the program itself can be installed on any IC card, so we want to minimize customization. In summary, in the field of IC cards, when a program for one type is customized and a program for another type is created, there is a demand for reusing the program before customization as much as possible.
The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an IC card and an IC card utilization device that can realize high reusability of programs even in different types of IC cards.
[0009]
[Means for Solving the Problems]
  The invention corresponding to claim 1 is an IC card issued by an IC card using device for issuing a card,Parameter management means in which management parameters indicating the type and number of individual parameters are set when issuing a card;When issuing a cardBased on the management parametersA program comprising an individual parameter that can be set individually and an algorithm that describes the operation using the individual parameter. When a program execution request including an instruction for the individual parameter is received, the program is based on the designated individual parameter. And a program execution means for executing the program, wherein the individual parameter is set as the program execution means.before, For this individual parameterManagement parametersA memory amount calculating means for calculating the memory amount of the IC card necessary for storing the individual parameter, and a memory area is secured based on the calculation result of the memory amount calculating means.AfterAnd parameter setting means for holding individual parameters input from the IC card using device in the memory area.The memory amount calculation means is obtained by multiplying the “type” indicated by the management parameter by the byte length corresponding to the “type” and the “number” corresponding to the “type”. The memory amount is calculated by adding the multiplication results and the constant α to each other.IC card.
[0010]
  An invention corresponding to claim 2 is an IC card corresponding to claim 1.,When the management parameter read request is input, the IC card includes parameter reading means for reading the management parameter in the parameter management means.
[0011]
Further, the invention corresponding to claim 3 is an IC card utilization apparatus for executing processing using the IC card corresponding to claim 2, and based on the management parameter read from the parameter reading means, the IC card This is an IC card utilization device provided with card access means for accessing the card.
[0012]
  Furthermore, the invention corresponding to claim 4 is the card issuing IC card utilization apparatus for issuing the IC card corresponding to claim 2, and when issuing the IC card, the program execution means, the parameter management means And means for writing each program of the parameter reading means to the IC card before issuance, and means for inputting individual parameters to the IC card before issuance after activation of the written program execution means. IC card using device.
  The invention corresponding to claim 5 has a program comprising an individual parameter that can be individually set at the time of card issuance and an algorithm in which an operation is described using the individual parameter, and includes an instruction for the individual parameter. When receiving an execution request, an IC card using device that executes processing using an IC card provided with program execution means for executing the program based on the instructed individual parameter, the individual parameterTheSettingYouRubefore, This individual parameterParameters indicating the type and number of itemsMemory amount calculation means for calculating the memory amount of the IC card necessary for storing the individual parameter based on the calculation result, and the calculation result of the memory amount calculation meansAnd a means for prompting the card issuer to confirm, a means for setting the management parameter in the parameter management means in the program when the management parameter is confirmed by the confirmation, and a management parameter in the parameter management means. The memory amount is calculated based on the calculation result, and the memory area is secured in the IC card based on the calculation result, and then the individual parameter input from the IC card using device can be stored in the memory area. After the memory area is secured in the IC card by the installed program and the installed program.Individual parametersIC cardIninputParameter setting meansThe memory amount calculation means is obtained by multiplying the “type” indicated by the management parameter by the byte length corresponding to the “type” and the “number” corresponding to the “type”. The memory amount is calculated by adding the multiplication results and the constant α to each other.IC card using device.
  The invention corresponding to claim 6 is the IC card utilization apparatus according to claim 5, wherein the IC card is,When the management parameter read request is input, the IC card utilization apparatus includes parameter reading means for reading the management parameter in the parameter management means.
  According to a seventh aspect of the present invention, there is provided an IC card utilization apparatus according to the sixth aspect, wherein the IC card use device comprises card access means for accessing the IC card based on the management parameter read from the parameter reading means. It is a card using device.
[0014]
(Function)
  Accordingly, claim 1, 5In the invention corresponding to the above, the program execution means has a program comprising an individual parameter that can be set individually and an algorithm in which an operation is described using the individual parameter. When the program execution request including the instruction is received, the program is executed based on the instructed individual parameter.
[0015]
  Thereby, when customizing a program of a certain type of IC card to a different type of IC card, the customization can be executed by changing the individual parameters without changing the algorithm. That is, when customizing, the algorithm part of the program can be reused. Therefore, high reusability of the program can be realized even with IC cards having different specifications.
  In the invention corresponding to claims 1 and 5, the memory amount calculation means in the program execution means is set with individual parameters.before,The type and number of these individual parametersManagement parameter indicatingThe memory capacity of the IC card necessary for storing the individual parameter is calculated based on the parameter, and the parameter setting means in the program execution means secures a memory area based on the calculation result of the memory quantity calculation means.AfterSince the individual parameters input from the IC card using device are held in the memory area, in addition to the above-described operation, the efficiency of the work for examining the necessary memory amount can be improved during customization.
[0016]
  Further, the invention corresponding to claims 2 and 6 is,When the parameter reading means receives a management parameter read request, the parameter reading means reads the management parameter in the parameter management means. Thus, in addition to the operation corresponding to claims 1 and 5, the card body from the outside according to the contents of the management parameter. The details of the function (such as the number of keys for the key management function) can be easily found.
[0017]
  Furthermore, claim 3, 7The card access means accesses the IC card based on the management parameter read from the parameter reading means., 6In addition to the action corresponding to the above, unnecessary access can be eliminated by accessing the IC card only when there is a request for a function supported by the IC card (indicated by the management parameter).
[0018]
  Claims4The corresponding invention isWhen an IC card using device for issuing a card issues an IC card, each program of the program execution means, parameter management means, and parameter reading means is written in the IC card before issuance, and the program execution means is activated. Thereafter, since the individual parameters are input to the IC card before issuance, the IC card corresponding to claim 2 can be issued.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
(First embodiment)
FIG. 1 is a block diagram showing a configuration of an IC card and an IC card using apparatus according to the first embodiment of the present invention. The IC card 10 includes a parameter management unit 11, a program execution unit 12, and a parameter reading unit 13.
[0020]
Here, the parameter management unit 11 is set with management parameters for managing the attributes of the individual parameters in the program execution unit 12, and the management parameters can be read by the program execution unit 12 and the parameter reading unit 13. It has become. The management parameters are management attribute data that can be read out of the card, unlike the individual parameters that cannot be read out of the card. For example, when the individual parameter is the encryption key itself, the type and number of encryption keys (individual parameter attributes) can be applied as the management parameter.
[0021]
When using the card, the program execution unit 12 refers to the parameter management unit 11 based on the input content from the IC card utilization device 20, confirms the input content and the consistency of the program, and then executes the program. The execution result is sent to the IC card utilization device 20.
[0022]
Specifically, when the program execution unit 12 receives a program execution request including an instruction for an individual parameter, the program execution unit 12 determines whether the program execution request is appropriate based on the management parameter in the parameter management unit 11, and determines that the program execution request is appropriate. In this case, the program is executed based on the instructed individual parameter, and the execution result is returned to the IC card utilization device 20.
[0023]
The executed program is composed of an algorithm part unrelated to the type of the IC card 10 and an individual parameter part used in the algorithm, and without changing the algorithm part by changing the individual parameter. It can be used for other types of IC cards 20.
[0024]
The parameter reading unit 13 has a function of reading a management parameter in the parameter management unit 11 based on a request from the IC card using device 20 and sending it to the IC card using device 20.
[0025]
On the other hand, the IC card utilization device 20 includes an application software unit, a card access unit 21 and a card R / W (reader / writer) unit 22 not shown.
[0026]
Here, the card access unit 21 has a function of reading management parameters in the parameter management unit 11 via the parameter reading unit 13 of the IC card when a card access request is received in accordance with execution of processing of the application software unit. As shown in FIG. 2, based on this management parameter, a function for determining whether or not the contents of the card access request can be executed by the IC card 10 and, if possible, via the card R / W unit 22 It has a function of accessing the IC card 10 and a function of returning an error notification to the application software unit when the execution is impossible and terminating the process.
[0027]
Note that the card access request is a concept including all requests accompanying access to the IC card 10, and here, a program execution request including designation of individual parameters is applicable.
[0028]
The card R / W unit 22 is a device that is controlled by the card access unit 21 and is capable of reading / writing information with respect to the IC card 10, and is specifically a known IC card reader / writer.
[0029]
Next, operations of the IC card and the IC card using apparatus configured as described above will be described.
(When issuing a card)
First, when issuing a card, management parameters are specified by the card issuer. This management parameter is described in the parameter management unit 11 by an IC card using device (not shown) for issuing a card. Each program of the parameter management unit 11, the program execution unit 12, and the parameter reading unit 13 is written to the IC card 20 by the IC card using device.
[0030]
Thereafter, the activated program execution unit 12 calculates the amount of memory required to hold the individual parameters (eg, key) based on the management parameters (eg, key type and number) in the parameter management unit 11, and calculates A memory area is secured based on the result. Subsequently, the program execution unit 12 holds the individual parameters input from the IC card using device in this memory area. Further, after registration of the user ID and the like, the IC card 10 is issued.
[0031]
(When using a card)
Next, the operation when using this IC card will be described with reference to FIG.
When using the card, in the IC card using device 20, the card access unit 21 specifies individual parameters (for example, the type of key and the number among the types) in accordance with the execution of processing of the application software unit. When the program execution request including “” is received, the management parameter in the parameter management unit 11 is read via the parameter reading unit 13 of the IC card 10.
[0032]
Subsequently, as shown in FIG. 2, the card access unit 21 determines whether or not the content of the program execution request can be executed by the IC card 10 based on the management parameter (specific parameter specification conforms to the management parameter). Or not).
[0033]
If the result of this determination is that execution is impossible, an error notification is returned to the application software unit and the processing is terminated. However, since it can be executed here, the IC card 10 is accessed via the card R / W unit 22.
[0034]
In the IC card 10, when this program execution request is received, the suitability of the program execution request is determined based on the management parameter in the parameter management unit 11, and when it is determined appropriate, based on the instructed individual parameter, While executing the program, the execution result is sent to the IC card utilization apparatus 20.
[0035]
The execution result is sent to an application software unit (not shown) via the card R / W unit 22 and the card access unit 21. As a result, the application software unit can execute processing using the function of the IC card 10.
[0036]
As described above, according to the present embodiment, the program execution unit 12 includes a program including an individual parameter that can be individually set and an algorithm in which an operation is described using the individual parameter, and includes an instruction for the individual parameter. When a program execution request is received, the program is executed based on the instructed individual parameters.
[0037]
Thereby, when customizing a program of a certain type of IC card to a different type of IC card, the customization can be executed by changing the individual parameters without changing the algorithm. In other words, since the algorithm portion of the program can be reused during customization, the program can be customized with a minimum of change work. Therefore, high reusability of the program can be realized even with IC cards having different specifications.
[0038]
Further, when an individual parameter is set, the program execution unit 12 calculates the amount of memory necessary for storing the individual parameter based on the attribute of the individual parameter, and sets the individual parameter based on the calculation result. Therefore, it is possible to improve the efficiency of the work for examining the required memory amount during customization.
[0039]
Further, a parameter management unit 11 in which management parameters for managing the attributes of the individual parameters are set is provided. When the parameter reading unit 13 receives a management parameter read request, the management parameters in the parameter management unit 11 are changed. Since the data is read, the details of the card body functions (such as the number of keys for the key management function) can be easily known from the outside according to the contents of the management parameters.
[0040]
Further, since the card access unit 21 accesses the IC card 10 based on the management parameter read from the parameter reading unit 13, the request from the application software unit corresponds to the function supported in the IC card 10. By only accessing the IC card 10, useless access can be eliminated.
[0041]
(Second Embodiment)
3 and 4 are block diagrams showing the configuration of an IC card and an IC card using device according to the second embodiment of the present invention. The same elements are denoted by the same reference numerals and redundant description is omitted.
[0042]
In addition, this embodiment describes the effect similar to 1st Embodiment in detail.
Specifically, the card issuer IC card utilization device 30A includes a card issuance application 31A, a card encryption function module 32, an R / W driver unit 33, and a card R / W unit 34.
[0043]
Further, the IC card utilization device 30B for the card user has a file encryption application 31B in place of the card issuing application 31A in the configuration described above.
[0044]
Here, the card issuing application 31A provides a card issuer with a user interface for issuing a card, and implements a card issuing procedure using the card encryption function module 32 in response to a request from the issuer. It is implemented as a Java application.
[0045]
Specifically, the card issuing application 31A is a higher-level application for executing card issuing processing. In response to a card issuer's request, each Java method of the encryption function module 32 (Java is a US sun sample). It has a function of giving a card access request (hereinafter referred to as a “card command”) corresponding to each Java method to the card encryption function module 32 so as to call “Microsystems trademark”.
[0046]
Note that the Java methods called by the card issuing application 31A include, for example, methods in the order of “key selection”, “key import”, and “personalization”. As shown in FIGS. Called by inputting the card selection “key import”, “key import”, and “personalize” card instructions to the card encryption function module 32, and ends by outputting the return value to the card issuing application 31A.
[0047]
Similarly, the file encryption application 31B provides a user interface for file encryption to the user, and implements a file encryption function using the card encryption function module 32 in response to a user request. Implemented as a Java application.
[0048]
Specifically, the file encryption application 31B is a host application for executing file encryption processing, and calls each Java method of the encryption function module 32 in response to a user request. For each Java method, upon receiving a function for giving a corresponding card instruction to the card encryption function module 32 and a function execution result (return value) from the card encryption function module 32, a predetermined process (eg, function execution result) And a function to execute (save etc.).
[0049]
As the Java method called by the file encryption application 31B, there are, for example, “key selection” and subsequent “encryption” or “decryption” methods, as shown in FIGS. In addition, each of the “key selection”, “encryption”, and “decryption” card instructions is called by input to the card encryption function module 32, and the process ends when the return value is output to the file encryption application 31B.
[0050]
The card encryption function module 32 is a module that provides a data encryption function using a key in the IC card 40, and that conceals command transmission to the IC card 40 and provides an intuitive interface to a host application. It is implemented as a Java class library.
[0051]
Specifically, the card encryption function module 32 interprets the card commands received from the higher-order applications 31A and 31B, and performs “key selection”, “key import”, “personalization”, “encryption”, “encryption”, “ Move to one of five types of Java methods called “decryption”, and send the corresponding command to the IC card 40 via the R / W driver unit 33 and the card R / W unit 34 as shown in FIGS. And a function for sending a function execution result (response) received from the IC card 40 in response to the transmission to the upper applications 31A and 31B and returning from the Java method.
[0052]
Note that the card encryption function module 32 automatically automatically selects the option list for the Java method corresponding to the card command “obtain option list” as shown in FIG. 15 when the connection to the IC card 40 is started. It has a function of sending an acquisition command to the IC card 40 via the R / W driver unit 33 and the card R / W unit 34.
[0053]
The R / W driver unit 33 is a known IC card reader / writer driver that is controlled by the card encryption function module 32 and drives the card R / W unit 34. For example, the R / W driver unit 33 may be a combination of software (for example, a PC / SC resource manager) that collectively manages each card R / W driver for PC / SC and each card R / W driver. PC / SC is a mechanism for accessing an IC card on Microsoft Windows (Windows is a trademark of Microsoft Corporation, USA).
[0054]
As described above, the card R / W unit 34 is a known IC card reader / writer that is controlled by the R / W driver unit 33 and can read / write information in the IC card 40. For example, the FY-1300 (FY -1300 can be used with Toshiba Corporation model numbers.
[0055]
On the other hand, the IC card 40 includes a common card OS 41, a reception buffer 42, a transmission buffer 43, an encryption card applet 44, a DES encryption device 45, and a triple DES encryption device 46, and more specifically, a Java card OS. Any IC card (Java card) may be used. For example, JMAGIC (JMAGIC is a trademark of Toshiba Corporation) can be used.
[0056]
The card OS 41 is capable of individually executing a plurality of card applets. Specifically, the card OS 41 is a Java card OS. Here, the function for controlling the encryption card applet 44 and the IC card using devices 30A and 30B are used. 2 has a function of storing data received from the reception buffer 42 and a function of transmitting data in the transmission buffer 43 to the IC card utilization devices 30A and 30B.
[0057]
The encryption card applet 44 is application software that operates on the Java card OS, and the source code can be described in the Java language. Here, the encryption card applet 44 has the functions of the parameter management class 47 and the encryption / key management applet. An encryption / key management applet class 48 is included.
[0058]
The parameter management class 47 holds the type and number of keys (management parameters) mounted on the card 40 as shown in the source code in FIG. This list of management parameters is referred to as an “option list” in this specification.
[0059]
The encryption / key management applet class 48 includes a user ID memory 48a, a personalized state memory 48b, a key memory 48c, and a method (algorithm) in which an operation is described using a key (individual parameter) in the key memory 48c. When a program execution request including a key instruction is received, it is executed by a CPU (not shown) on the basis of the instructed key so that the outside of the card is transmitted via the transmission buffer 43 and the reception buffer 41. The communication process is performed.
[0060]
Specifically, the encryption / key management applet class 48, as shown in FIG. 17, performs the initialization processing function when installing the applet, and the “key selection” received in the reception buffer 42 from the IC card utilization devices 30A and 30B. The processes shown in FIGS. 18 to 23 are executed according to the command, the “import key” command, the “personalize” command, the “option list acquisition” command, the “encryption” command, or the “decryption” command. A command processing function for writing the result into the transmission buffer 43;
[0061]
The DES encryption device 45 is controlled by the encryption card applet 44, executes encryption processing or decryption processing by the DES method for the data given by the encryption card applet 44, and sends the execution result to the encryption card applet 44. To be sent.
[0062]
The triple DES encryption device 46 is controlled by the encryption card applet 44, executes encryption or decryption processing by the triple DES method for the data given by the encryption card applet 44, and the execution result is the encryption card applet. 44.
[0063]
Next, the operation of the IC card using apparatus and the IC card configured as described above will be described separately when the card is issued and when the card is used.
[0064]
(When issuing a card)
When issuing a card, the card issuer uses the IC card utilization device 30A shown in FIG. 1, and the encryption card applet 44 is customized for an individual IC card and then installed in the IC card 40. Here, a case where the number of keys of each of DES and triple DES is customized will be described as an example.
[0065]
Now, in the IC card utilization apparatus 30A, it is assumed that the card issuing application 31A is activated and the encryption card applet 44 to be customized has been selected.
[0066]
When the card issuing application 31A is designated to specify the type and number of keys to be mounted by the card issuer during execution, the card issuing application 31A determines the required memory amount M [byte] according to the specified contents as follows. Calculated by equation (1) and displayed appropriately to prompt the card issuer to confirm.
[0067]
M = 8D + 16T + α (1)
However, D: Number of DES keys, T: Number of triple DES keys, α: Constant.
The calculation of the necessary memory amount may be performed in a portion other than the card issuing application 31A.
[0068]
When the specified contents are confirmed, the values (number of keys of each type) of the parameter management class constants (numOfDesKey and numOfDes3Key) are changed as shown in FIG. 16 by executing the card issuing application.
This completes customization of the encrypted applet.
[0069]
Next, the IC card utilization device 30A installs the encryption card applet 44 in the IC card 40 based on the operation of the card issuer. At the time of this installation, a dedicated installation procedure for each card is used. As shown in FIG. 17, initialization processing at the time of applet installation is executed by the encryption card applet 44.
[0070]
That is, the encryption / key management applet class 48 in the encryption card applet 44 secures a user ID storage area (user ID memory 48a) during execution (ST1) and sets a flag for storing the personalized state. Declare to secure the personalized normal memory 48b, and initialize the flag to the “before personalization” state (ST2).
[0071]
Subsequently, the memory amount necessary for storing the key is calculated by the above-described equation (1), and a storage area (a part of the key memory 48c) corresponding to the memory amount is secured (ST3).
Next, an area for storing the key type and the offset value (key offset (start address)) on the key memory 48c is secured (ST4), and the initialization process at the time of installing the applet is terminated.
[0072]
Next, the card issuing application 31A executes an import process for importing the key into the IC card by the operation of the card issuer, and performs the “key selection” method and “key import” of the card encryption function module. In order to call the method, the card commands of “key selection” and “key import” are sequentially sent to the card encryption function module.
[0073]
When the card encryption function module 32 receives a “key selection” card command, it sends a “key selection” command to the IC card 40. Next, upon receiving the “import key” card command, the card encryption function module 32 sends an “import key” command to the IC card 40. These “key selection” command and “key import” command are stored in the reception buffer 42 of the IC card 40 via the R / W driver unit 33 and the card R / W unit 34.
[0074]
The encryption card applet 44 of the IC card 40 is designated based on the “key selection” command in the reception buffer 42 while referring to the constants (numOfDesKey and numOfDes3Key) of the parameter management class 47 as shown in FIG. It is determined whether or not the type and the key number indicating the number of the key can be used (ST11). When the key number is not available, the process is terminated. The offset of the key memory 48c is calculated and stored (ST12).
[0075]
For example, in the case of the first key of the DES method, the head offset (head address) of the DES key is obtained. In the case of the DES No. 3 key, the key offset is calculated as the first offset + the predetermined byte length of the DES key × 3 (the first key). The predetermined byte length of the key is 8 bytes for the DES key and 16 bytes for the triple DES key.
[0076]
Further, after step ST12, the encryption / key management applet class 48 stores the designated key type (ST13).
[0077]
Next, as shown in FIG. 19, the encryption card applet 44 refers to the flag in the personalized state memory 48b based on the “import key” command in the reception buffer 42 to determine whether it is before personalization (after). If it is determined to be negative (ST21), the process is terminated, but before personalization, the data in the reception buffer 42 is copied to the area from the key offset in the key memory 48c by the byte length corresponding to the key type. (ST22).
[0078]
The key import process is executed by repeatedly calling the “key selection” and “key import” methods for the number of times corresponding to the designated key type and the number of keys.
[0079]
Next, the card issuing application 31A executes personalization processing for personalizing the IC card 40 using the user ID by the operation of the card issuer, and the “personalization” of the card encryption function module 32 is executed. "Personalize" card command is sent to the card encryption function module 32 so as to call the "method".
[0080]
Upon receiving the “personalize” card command, the card encryption function module 32 sends a “personalize” command to the IC card 40. The “personalize” command is stored in the reception buffer 43 of the IC card 40 via the R / W driver unit 33 and the card R / W unit 34.
[0081]
Based on the “personalize” command in the reception buffer 43, the encryption card applet 33 of the IC card 40 copies the data in the reception buffer 43 by 8 bytes to the user ID memory 48a as shown in FIG. (ST31), the flag of the personalized state memory 48b is set to “after personalization” (ST32).
[0082]
Here, the IC card 40 is personalized based on the user ID, and subsequent key import is disabled due to the “personalized” personalized state flag.
[0083]
Thereby, the personalization process of the IC card 40 is completed, and the issue of the IC card 40 is completed. The issued IC card 40 is distributed to users by handing or mailing.
(When using a card)
When using the card, the IC card using device 30B shown in FIG. 2 is used by the user to encrypt or decrypt the file. At that time, a key for encryption / decryption can be selected.
[0084]
Now, in the IC card utilization device 30B, it is assumed that the file encryption application 31B is activated and the user's IC card 40 is held in the card R / W unit 34. When the connection to the IC card 40 is started, the card encryption function module 32 first automatically sends an “option list acquisition” command to the IC card 40.
[0085]
The encryption / key management applet class 48 of the IC card 40 calls an option list acquisition method based on an “option list acquisition” command in the reception buffer 43 to call a constant (DES) of the parameter management class 47 as shown in FIG. A list of the number of keys and the number of triple DES keys is stored in the transmission buffer 43 as an option list (ST41), and the process returns from the option list acquisition method.
[0086]
The option list in the transmission buffer 43 is sent to the IC card utilization apparatus 30B by the card OS 41, and is sent to the card encryption function module 32 via the card R / W unit 34 and the R / W driver unit 33.
[0087]
Next, a key is selected as described above. The file encryption application 31B executes a key selection process based on the specified key type and number by the user's operation, and a “key selection” card for calling the “key selection” method. The command is sent to the card encryption function module 32.
[0088]
When the card encryption function module receives the card instruction of “select key”, it determines whether or not the key specified in the card instruction is used in the IC card 40, and only when it can be used. As described above, a “key selection” command is sent to the IC card 40.
[0089]
The encryption / key management applet class 48 of the IC card 40 confirms the constants of the parameter management class 47 as shown in FIG. 18 based on the “key selection” command in the reception buffer 42 (ST11). Based on the specified contents, the offset of the corresponding key memory 48c is saved (ST12), and the key type is saved (ST13).
[0090]
Next, the file encryption application 31B executes an encryption process for encrypting the data m by the user's operation, and calls the “encryption” method of the card encryption function module 32 to “encrypt” Card command is sent to the card encryption function module 32.
[0091]
Upon receiving the “encryption” card command, the card encryption function module 32 sends an “encryption” command to the IC card 40.
[0092]
The encryption / key management applet class 48 of the IC card 40 is based on the “encryption” command in the reception buffer 42 and, as shown in FIG. 22, the DES encryption device 45 or the triple DES encryption device according to the type of the stored key. 46 is selected (ST51).
[0093]
Also, the encryption / key management applet class 48 initializes the selected DES encryption device 45 for encryption, for example, and gives a key offset in the key memory 48c to the DES encryption device 45 as an argument (ST52). As a result, the DES encryption device 45 can execute encryption processing using the key in the key memory 48c.
[0094]
Also, the encryption / key management applet class 48 gives the data m in the reception buffer 42 to the DES encryption device 45, and then stores the result of encryption by the DES encryption device 45 in the transmission buffer 43 (ST53). Exit.
This encryption result is sent to the IC card utilization apparatus 30B by the card OS 41, and is given to the card encryption function module 32 via the card R / W unit 34 and the driver R / W unit 33, and the card encryption function module 32. To the file encryption application 31B.
[0095]
Thereby, the encryption process is completed.
Next, the decoding process will be described. In the DES encryption device 45, encryption and decryption are basically the same conversion process.
Therefore, the decryption process in the IC card using device 30B uses the decryption target data c instead of the encryption target data m in the above-described encryption process, and replaces the “encryption” method with “decryption”. The method is the same as that in which a “decryption” card command and a “decryption” command are used instead of an “encryption” card command and an “encryption” command. In addition, the specified content of the key is the same as in the encryption process (since the illustrated DES is a common key method).
[0096]
That is, in the IC card using device 30B and the IC card 40, as shown in FIGS. 18 and 23, the decrypting process for the data c is executed in response to the decryption request from the user, as shown in FIGS.
[0097]
As described above, according to the present embodiment, the following effects can be obtained in addition to the effects of the first embodiment.
[0098]
For example, since the upper-level applications 31A and 31B can access the IC card 40 only by calling a Java method, the ease of access can be improved.
[0099]
Further, as described above, when the program of the IC card 40 is customized, it is not necessary to change the encryption / key management applet class 48 at all, so that high reusability of the program can be realized.
[0100]
Further, since the change of the constant of the parameter management class 47 is reflected in the option list, the card issuer and the IC card using apparatus 30A do not need to know the format of the option list and can easily customize. In addition, when the parameter management class 47 constant is changed, the necessary memory amount is immediately calculated, so that the program can be changed under a clear guideline.
[0101]
In addition to these, by creating the encryption / key management applet class 48 so as to support only the commands used by the card encryption function module 32, the memory of the IC card 40 is provided for the programs corresponding to other commands. The amount of program development can be further reduced.
[0102]
In addition, with the configuration that supports only necessary commands in this manner, the configuration of the entire system including the IC card 40 and the IC card using devices 30A and 30B can be facilitated, and maintainability can be improved.
[0103]
The present invention can be implemented with various modifications without departing from the scope of the invention.
[0104]
【The invention's effect】
As described above, according to the present invention, it is possible to provide an IC card and an IC card utilization apparatus that can realize high reusability of programs even in different types of IC cards.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an IC card and an IC card using apparatus according to a first embodiment of the present invention.
FIG. 2 is a schematic diagram for explaining a function of a card access unit in the embodiment;
FIG. 3 is a block diagram showing a configuration of an IC card and an IC card using apparatus according to a second embodiment of the present invention.
FIG. 4 is a block diagram showing a configuration of an IC card and an IC card using apparatus according to the embodiment.
FIG. 5 is a schematic diagram for explaining a card command and its return value in the embodiment;
FIG. 6 is a schematic diagram for explaining a card instruction and its return value in the embodiment;
FIG. 7 is a schematic diagram for explaining a card instruction and its return value in the embodiment;
FIG. 8 is a schematic diagram for explaining a card instruction and its return value in the embodiment;
FIG. 9 is a schematic diagram for explaining a card command and its return value in the embodiment;
FIG. 10 is a schematic diagram for explaining a card instruction and its return value in the embodiment;
FIG. 11 is a schematic diagram for explaining commands and responses in the embodiment;
FIG. 12 is a schematic diagram for explaining commands and responses in the embodiment;
FIG. 13 is a schematic diagram for explaining commands and responses in the embodiment;
FIG. 14 is a schematic diagram for explaining a command and its response in the embodiment;
FIG. 15 is a schematic diagram for explaining a command and its response in the embodiment;
FIG. 16 is a schematic diagram for explaining a parameter management class in the embodiment;
FIG. 17 is a flowchart for explaining initialization processing when an applet is installed in the embodiment;
FIG. 18 is a flowchart for explaining key selection processing in the embodiment;
FIG. 19 is a flowchart for explaining key import processing according to the embodiment;
FIG. 20 is a flowchart for explaining personalization processing in the embodiment;
FIG. 21 is a flowchart for explaining option list acquisition processing in the embodiment;
FIG. 22 is a flowchart for explaining encryption processing in the embodiment;
FIG. 23 is a flowchart for explaining decoding processing in the embodiment;
[Explanation of symbols]
10, 40 ... IC card
11 ... Parameter management section
12 ... Program execution part
13 ... Parameter reading section
20, 30A, 30B ... IC card utilization device
21 ... Card access section
22, 34 ... Card R / W section
31A ... Card issuing application
31B ... Application for file encryption
32 ... Card encryption function module
33 ... R / W driver section
41 ... Common card OS
42 ... Receive buffer
43 ... Transmission buffer
44 ... Encryption card applet
45 ... DES encryption device
46 ... Triple DES encryption device
47 ... Parameter management class
48 ... Encryption / key management applet class
48a ... User ID memory
48b ... Personalized state memory
48c ... Key memory

Claims (7)

An IC card issued by an IC card using device for issuing cards,
Parameter management means in which management parameters indicating the type and number of individual parameters are set at the time of card issuance, individual parameters that can be individually set based on the management parameters at the time of card issuance, and operation using these individual parameters And a program execution means for executing the program based on the instructed individual parameter when a program execution request including an instruction for the individual parameter is received.
The program execution means includes
Before setting the individual parameters, based on the management parameters of the individual parameters, a memory amount calculating means for calculating the memory amount of the IC card necessary for storing the individual parameters;
Parameter setting means for holding individual parameters input from the IC card using device in the memory area after securing the memory area based on the calculation result of the memory amount calculating means ;
For each “type” indicated by the management parameter, the memory amount calculation unit multiplies the byte length corresponding to the “type” by the “number” corresponding to the “type”, and obtains each multiplication obtained. An IC card , wherein the memory amount is calculated by adding a result and a constant α to each other . In the IC card according to claim 1 ,
An IC card comprising parameter reading means for reading a management parameter in the parameter management means when a management parameter read request is inputted. In the IC card utilization apparatus for executing processing using the IC card according to claim 2,
An IC card utilization apparatus comprising card access means for accessing the IC card based on management parameters read from the parameter reading means. In the IC card utilization apparatus for card issuance which issues the IC card according to claim 2,
Means for writing each program of the program execution means, the parameter management means and the parameter reading means to the IC card before issuance when issuing the IC card;
An IC card utilization device comprising: means for inputting individual parameters to the IC card before issuance after the written program execution means is activated. There is a program consisting of an individual parameter that can be set individually when issuing a card and an algorithm that describes the operation using this individual parameter. An IC card utilization device that executes processing using an IC card provided with program execution means for executing the program based on individual parameters,
Before you set the individual parameters, and this shows the type and number of the individual parameters based on the control parameters, the memory amount calculating means for calculating an amount of memory IC card required for storage of the individual parameters,
Means for displaying the calculation result of the memory amount calculating means and prompting the card issuer to confirm;
Means for setting the management parameter in the parameter management means in the program when the management parameter is confirmed by the confirmation;
The memory areas individual parameters input from the IC card utilization device after securing a memory area in the IC card on the basis to calculate the amount of memory on the basis of management parameters in this parameter in the management unit in the calculation out results Means for installing the program on the IC card;
After the memory area is secured in the IC card by the installed program, and a parameter setting means for inputting a pre-Symbol individual parameters in the IC card,
For each “type” indicated by the management parameter, the memory amount calculation unit multiplies the byte length corresponding to the “type” by the “number” corresponding to the “type”, and obtains each multiplication obtained. An IC card utilization apparatus , wherein the memory amount is calculated by adding a result and a constant α to each other . In the IC card utilization apparatus according to claim 5,
The IC card,
An IC card utilization apparatus comprising parameter reading means for reading a management parameter in the parameter management means when a management parameter read request is input. In the IC card utilization apparatus according to claim 6,
An IC card utilization apparatus comprising card access means for accessing the IC card based on the management parameter read from the parameter reading means.

Images