JP3967155B2 - IC card - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an IC card, and more particularly to recording a communication log between an IC card and an interface device and detecting and notifying unauthorized processing based on the recorded communication log.
[0002]
[Prior art]
Opportunities to use IC cards in various situations in daily life, such as cards for financial institutions such as cash cards and credit cards, cards for transportation such as commuter passes and prepaid tickets, ID cards such as employee ID cards and student ID cards Is increasing.
[0003]
Such an IC card is 1) it is very difficult for the card itself to physically duplicate, 2) when data is exchanged with the outside of the card, 3) the access right can be set, 4) Although it is much safer than a magnetic card, such as having an authentication function that confirms whether the card and interface device are mutually valid, it is not perfect, and a malicious person obtains an encryption key or PIN Thus, the possibility of falsifying the data in the IC card is not zero.
[0004]
Therefore, in actual use of the IC card, it is common to record a communication log between the IC card and the interface device in the interface device or the host system.
[0005]
However, in the past, there are the following problems. That is, when an IC card is tampered with, it can be determined whether or not tampering has occurred only with the communication log recorded in the interface device, but it is difficult to analyze what process (command) has been tampered with.
[0006]
In order to further enhance security, it is possible to incorporate more complicated encryption processing, authentication using biometrics such as fingerprints, voiceprints, and irises, but a high-speed CPU or communication line is required, and an IC card And the cost of the system including the reader / writer increases.
[0007]
[Problems to be solved by the invention]
The present invention has been made in view of the above-described problems, and detects that there has been an unauthorized process such as tampering with an IC card without introducing a special device or component that leads to an increase in cost. An object of the present invention is to provide an IC card that can analyze whether falsification has been made.
[0008]
[Means for Solving the Problems]
To achieve the above object, an IC card according to the first aspect of the present invention is an IC card that communicates with a host system via the interface device, the communication contents of communication between the interface device and the IC card A log recording area to record as a log;
Log recording means for recording a communication log from the start of one communication session to the end of the session in the log recording area;
A fraud detection flag that records the status of whether the previous communication is a normal process or an illegal process;
A fraud detection pattern programmed in advance in the IC card;
Monitoring means for constantly monitoring whether or not it is legitimate use in the communication session by comparing with the fraudulent processing detection pattern ;
A lock means for setting an improper processing flag in the fraud detection flag when the monitoring means detects unauthorized processing, and further prohibiting the use of the IC card;
A notification means for notifying the host system that unauthorized processing has been performed the next time the IC card is used when a character indicating unauthorized processing is set in the unauthorized detection flag;
The communication recorded in the log recording area by the log read command from the host system only when the command from the first host system after the notification is made is an unlock command that prohibits the use of the IC card. Log sending means for sending logs to the host system;
A log erasing unit for erasing the previous communication log when the log transmission unit has transmitted a communication log for which the normal processing has been performed on the IC card last time or for which the unauthorized processing has been performed on the IC card last time; ,
It is equipped with.
[0009]
In the IC card according to the second aspect of the present invention, in the IC card according to the first aspect described above, the notification means is configured with an answer-to-reset signal in which an illegal processing warning character is set in a specific byte. Is.
[0010]
The IC card according to the third aspect of the present invention is the IC card according to the first or second aspect described above, provided with a password for unlocking the card and reading the log recording area.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described based on the illustrated embodiments.
FIG. 1 is a schematic configuration diagram of an embodiment of an IC card according to the present invention.
[0020]
The IC card 1 includes an I / O control unit 2 that controls communication, a CPU 3, an EEPROM 4 that is a nonvolatile memory, a ROM 7 that records a processing program, and a RAM 15 that records temporary data. Via the host system 17.
[0021]
The EEPROM 4 which is a non-volatile memory is a log recording area 5 for recording communication contents between the IC card 1 and the interface device 16, and an unauthorized state for recording either normal processing or unauthorized processing. A detection flag 6 is provided.
[0022]
The ROM 7 records processing programs such as an illegal processing detection pattern 8, a log recording unit 9, a monitoring unit 10, a notification unit 11, a log erasing unit 12, a lock unit 13, and a log transmission unit 14.
[0023]
The illegal process detection pattern 8 includes, for example, one or a plurality of illegal process patterns to be detected in advance, such as 1) erroneously inputting a password more than a specified number of times, and 2) there is a request for prohibited processing. This is programmed in the ROM 7. As shown in FIG. 1, it can be programmed separately from the monitoring unit 10 or can be programmed in the monitoring unit 10.
[0024]
The log recording means 9 records the communication contents (command and its reply) between the IC card 1 and the interface device 16 in the log recording area 5 from the start of one communication session to the end of the section.
[0025]
The monitoring means 10 always monitors whether unauthorized processing is performed by comparing the command with the unauthorized processing detection pattern 8 in the communication session described above.
[0026]
The notification means 11 is actually an answer-to-reset signal (hereinafter abbreviated as ATR) for the IC card 1 to notify basic information in response to a reset command from the host system 17. The ATR is defined by ISO7816, and the IC card 1 notifies the host system 17 of unauthorized processing using one of the specific bytes in the ATR.
[0027]
The log erasing means 12 detects the previous time when the normal processing was performed on the IC card 1 or when the previous IC card 1 was detected to have performed unauthorized processing and the communication log was obtained. Clear communication log of.
[0028]
Therefore, when it is not possible to detect that illegal processing was previously performed on the IC card 1 for some reason, the communication log is retained by not operating the log erasing unit 12.
[0029]
When the monitoring means 10 detects an unauthorized process, the lock means 13 sets a character indicating the unauthorized process in the unauthorized detection flag and holds the IC card 1 until a valid unlock command and unlock code can be confirmed. Set the lock to the prohibited state.
[0030]
When the log transmission unit 14 receives the log read command and the log read password from the host system 17, the log transmission unit 14 transmits the communication log recorded in the log recording area 5 to the host system 17.
[0031]
The CPU 3 executes various processing programs recorded in the ROM 7 while referring to the log recording area 5 and the fraud detection flag 6 in the EEPROM 4. At this time, the RAM 15 is used as necessary.
[0032]
First, communication start processing in a general IC card will be described. When the IC card and the host system start communication, the IC card first receives a reset command from the host system via the interface device.
[0033]
The IC card that has received the reset command returns an answer-to-reset signal defined by ISO7816 in order to notify the host system of the basic information of the card.
[0034]
Next, the communication start process of the IC card 1 of the present invention will be described in detail with reference to FIG. The IC card 1 receives a reset command from the host system 17 via the interface device 16 in the same manner as a general IC card (step S1).
[0035]
Since the communication between the IC card 1 and the host system 17 is always performed via the I / O control unit 2 and the interface device 16, in the following description, the description of the I / O control unit 2 and the interface device 16 will be described. Omitted.
[0036]
The IC card 1 returns an ATR in response to the reset command from the host system 17. At this time, referring to the fraud detection flag 6, the fraud detection flag 6 is “ON” indicating that fraud processing has been performed. As the fraud notification ATR, for example, an illegal processing warning character such as “FF” in hexadecimal notation is set in a specific byte reserved in the ATR for unique use of the system and returned (step S2).
[0037]
After receiving the unauthorized processing warning character, when receiving an unlock command for unlocking and a password for unlocking from the host system 17, after confirming that the received password is correct, the log transmission means 14 The previous communication log is transmitted from the log recording area 5 to the host system 17 (step S3).
[0038]
If the unlock command has not been received, and if the unlock code number is invalid, an abnormal termination process is performed and the communication is terminated (step S4).
[0039]
If the fraud detection flag 6 is “OFF” indicating that normal processing has been performed with reference to the fraud detection flag 6, a normal character such as “00” in hexadecimal notation, for example, is designated as the normal ATR. Set in a byte and return (step S5).
[0040]
When normal processing is performed in the previous communication and when the lock is released and the previous communication log is transmitted to the host system 17, the log erasing unit 12 increases the usable area of the EEPROM 4. The previous communication log is erased (step S6).
[0041]
FIG. 3 is a diagram showing a schematic configuration of the ATR used by the IC card 1. For example, “FF” is set when the fraud detection flag 6 is “ON”, and “00” is set when the fraud detection flag 6 is “OFF”, in the specific byte TA2 of the ATR indicated by an arrow in FIG.
[0042]
By setting different characters depending on the presence or absence of unauthorized processing in the previous communication in the specific byte of the ATR to which a reply is always sent at the start of communication, the host system 17 that has received the ATR determines whether the IC card 1 has been illegally processed. It becomes possible to know whether or not.
[0043]
Next, an operation during normal communication is shown in FIG. After the communication start process, the log recording unit 9 starts recording the communication log of the current communication session (step S11).
[0044]
The log recording unit 9 records all communication contents performed between the IC card 1 and the interface device 16 in the log recording area 5 from the start to the end of the communication session (step S12).
[0045]
In addition, during the communication session, the monitoring unit 10 is always in operation, and it is monitored whether there is an unauthorized process while referring to the unauthorized process detection pattern 8 (steps S13 to S15).
[0046]
If the monitoring unit 10 detects a process corresponding to the fraud detection pattern 8, the lock unit 13 sets the fraud detection flag 6 to “ON”, and at the same time ends the communication session abnormally and locks the IC card 1 (step S1). S16 and S17).
[0047]
In the following, referring to FIGS. 5 to 7, 1) when the previous communication session ends normally, 2) when the previous communication session ends abnormally, and unlocking fails in this communication, 3) the previous time Each of the cases where the communication session ends abnormally and unlocking succeeds in the current communication will be described more specifically.
[0048]
FIG. 5 shows the operation when the previous communication session ends normally. First, the host system 17 transmits a reset command.
[0049]
The IC card 1 that has received the reset command refers to the fraud detection flag 6. Since the fraud detection flag 6 is “OFF”, the notification means 11 returns a normal ATR. The log erasing unit 12 erases the previous communication log in the log recording area 5.
[0050]
The host system 17 that has received the normal ATR can confirm that there is no unauthorized processing for the IC card 1 in the previous communication session, and thus starts normal communication, that is, transmission of a normal command and exchange of its reply.
[0051]
The log recording unit 9 starts recording the current communication log at the start of normal communication, and at the same time, the monitoring unit 10 starts monitoring whether or not unauthorized processing is performed on the IC card 1. . The communication log recording and communication monitoring are repeated until the communication session ends.
[0052]
Next, FIG. 6 shows an operation in the case where the previous communication session ended abnormally and unlocking failed in the current communication. First, the host system 17 transmits a reset command.
[0053]
The IC card 1 that has received the reset command refers to the fraud detection flag 6. Since the fraud detection flag is “ON”, the notification unit 11 returns a fraud notification ATR. Only the monitoring unit 10 is operated by holding the previous communication log without starting the log erasing unit 12.
[0054]
If the host system 17 that has received the fraud notification ATR cannot confirm that the fraudulent processing has been performed on the IC card 1 in the previous communication session for some reason, it starts normal command transmission. When the host system 17 itself is hacked, the IC card 1 is set in the host system 17 that does not support the fraud detection flag, such as a system for analyzing or altering an IC card created by an unauthorized person. In this case, normal command transmission is started.
[0055]
After returning the fraud notification ATR, the first command from the host system 17 is a normal command, not an unlock command for releasing the lock, so an error signal is transmitted and the communication is terminated abnormally.
[0056]
Since the IC card 1 remains locked, no further processing can be performed. Furthermore, since the previous communication log is left, it is possible to collect the IC card 1 and analyze the contents of illegal processing at the command level.
[0057]
Next, FIG. 7 shows an operation in the case where the previous communication session ended abnormally and unlocking succeeded in the current communication. First, the host system 17 transmits a reset command.
[0058]
The IC card 1 that has received the reset command refers to the fraud detection flag 6. Since the fraud detection flag is “ON”, the notification unit 11 returns a fraud notification ATR. Only the monitoring unit 10 is operated by holding the previous communication log without starting the log erasing unit 12.
[0059]
When the host system 17 that has received the fraud notification ATR confirms that fraudulent processing has been performed on the IC card 1 in the previous communication session, it transmits an unlock command and unlock code for unlocking. To do.
[0060]
The IC card 1 that has received the unlock command and the unlock code number from the host system 17 confirms that the code number is correct, and then unlocks the IC card 1 and informs the host system 17 that the lock has been unlocked. Notice.
[0061]
Next, the host system 17 transmits a communication log read command and a log read password.
[0062]
Upon receiving the communication log read command and the log reading password, the log transmission means 14 confirms that the password is correct, and then sends the previous communication log, that is, the communication log when unauthorized processing is performed, to the host system 17. Send to.
[0063]
After the log transmission unit 14 transmits the previous communication log, the log deletion unit 12 deletes the previous communication log from the log recording area 5 and the log recording unit 9 starts recording the current communication log. Thereafter, normal communication is continued, and the recording of the communication log is terminated when the communication session is completed.
[0064]
As described above, the present invention has been described in detail on the basis of the embodiment. However, the IC card according to the present invention is not limited to the above-described embodiment, and various types of the IC card can be used without departing from the spirit of the present invention. Of course, changes are possible.
[0065]
【The invention's effect】
As described above, according to the IC card according to the present invention, all communication contents between the IC card and the interface device are recorded as a log, so that the exchange of commands in unauthorized processing can also be recorded as a communication log.
[0066]
Further, by comparing the communication, that is, the command with the unauthorized process detection pattern by the constant monitoring means, the IC card can be locked in the unauthorized process execution stage.
[0067]
Furthermore, since an administrator who knows an appropriate personal identification number can unlock the IC card and refer to the communication log recorded on the IC card itself, it is possible to analyze a command used for illegal processing.
[0068]
Furthermore, the host system is trying to access an IC card that may have been tampered with by notifying the host system of the presence or absence of unauthorized processing by means of data that is always returned at the start of communication called ATR. Can be recognized.
[0069]
Furthermore, since it is possible to recognize IC cards that may have been tampered with at the start of communication and obtain communication logs, it is possible to know when and where the card was used. It is possible to track illegal processing.
[Brief description of the drawings]
FIG. 1 is a schematic structural diagram of an IC card of the present invention.
FIG. 2 is a flowchart showing the operation of an IC card communication start process of the present invention.
FIG. 3 is a schematic configuration diagram of an answer-to-reset signal according to the present invention.
FIG. 4 is a diagram illustrating an operation during normal communication according to the present invention.
FIG. 5 is a diagram showing an operation when the previous communication session is normally terminated in the IC card of the present invention.
FIG. 6 is a diagram showing an operation in the IC card of the present invention when a previous communication session ends abnormally and unlocking fails in the current communication.
FIG. 7 is a diagram showing an operation when the previous communication session ends abnormally and unlocking succeeds in the current communication in the IC card of the present invention.
[Explanation of symbols]
1 IC card 2 I / O control unit 3 CPU
4 EEPROM
5 Log recording area 6 Fraud detection flag 7 ROM
8 Unauthorized processing detection pattern 9 Log recording means 10 Monitoring means 11 Notification means 12 Log erasing means 13 Locking means 14 Log sending means 15 RAM
16 Interface device 17 Host system

Claims (3)

An IC card that communicates with a host system via an interface device, a log recording area for recording communication contents between the interface device and the IC card as a communication log ;
Log recording means for recording a communication log from the start of one communication session to the end of the session in the log recording area;
A fraud detection flag that records the status of whether the previous communication is a normal process or an illegal process;
A fraud detection pattern programmed in advance in the IC card;
Monitoring means for constantly monitoring whether or not it is legitimate use in the communication session by comparing with the fraudulent processing detection pattern ;
A lock means for setting an improper processing flag in the fraud detection flag when the monitoring means detects unauthorized processing, and further prohibiting the use of the IC card;
A notification means for notifying the host system that unauthorized processing has been performed the next time the IC card is used when a character indicating unauthorized processing is set in the unauthorized detection flag;
The communication recorded in the log recording area by the log read command from the host system only when the command from the first host system after the notification is made is an unlock command that prohibits the use of the IC card. Log sending means for sending logs to the host system;
A log erasing unit for erasing the previous communication log when the log transmission unit has transmitted a communication log for which the normal processing has been performed on the IC card last time or for which the unauthorized processing has been performed on the IC card last time; ,
An IC card comprising:   2. The IC card according to claim 1, wherein the notifying means is an answer-to-reset signal in which an illegal processing warning character is set in a specific byte.   3. The IC card according to claim 1, further comprising a password for unlocking the card and reading the log recording area.

Images