JP4139674B2 - IC card and command processing method in IC card - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an IC card capable of executing a plurality of application programs (hereinafter simply referred to as applications), and more particularly to a method of processing commands in a plurality of applications executed in succession.
[0002]
[Prior art]
Conventionally, an IC card capable of executing a plurality of application programs such as JavaCard (registered trademark) and Multis is in accordance with ISO 7816-4, which is called AID 5-16 which is given by a registration system so that there is no duplication in the country and the world An application is uniquely identified by attaching a unique identifier of a byte, an application is selected by its AID, and a subsequent process is instructed.
[0003]
For example, in order to perform a credit payment process and a point addition process, first, the terminal device transmits a command “SELECT FILE xxx” (xxx is AID indicating a credit application) to the IC card, and the IC card When an application is selected and then an authentication command or a payment command is transmitted from the terminal device to the IC card, the IC card moves the execution control of those commands to the selected credit application.
[0004]
In ISO7816-4, command execution control moves to the selected application. Therefore, in order to perform point addition processing following credit payment processing, a point application is newly selected and point addition is performed. The command needs to be transmitted from the terminal device to the card.
[0005]
In other words, even in the same command that you want to be processed by multiple applications continuously, if the applications are different, you must send the application selection command and transfer execution control to the command to the selected application each time. I must.
[0006]
In the near future, IC cards will connect to networks, especially the Internet, through various devices such as mobile phones, personal digital assistants (PDAs), and information appliances. / IP (For details of the protocol, see Non-Patent Document 1) It is expected that communication is performed, and not only the IC card responds to the request of the terminal device as in the past, but it is mounted on the IC card. The application goes to connect to the Internet.
[0007]
However, since the ISO standard lower layer (ISO7816-3) used in the IC card is a half-duplex communication protocol, it is not assumed that transmission starts from the IC card side. The system always receives a command from the terminal device side and returns the processing result inside the IC card to the terminal device.
[0008]
When sending from the IC card to the network, first, the terminal device periodically inquires the IC card whether to send (whether to communicate with the network) (polling), and the IC card responds accordingly. A method for starting communication has been proposed for Internet Engineering Task Force (IETF) (see Non-Patent Document 2, for example).
[0009]
[Non-Patent Document 1]
Postel, J., “Transmission Control Protocol”, RFC 793, September 1981 [Non-Patent Document 2]
Mobile-Mind, “IP and ARP over ISO 7816”, [online], January 2001, [October 12, 2002 search], Internet <URL: http://www.scdk.com/draft- guthery-ip7816-01.txt>
[0010]
However, in the polling method, for example, in the case of an IC card that can execute 10 applications, it is necessary to issue polling to each application, so that a selection command is issued 10 times to process the polling command. However, the polling command needs to be transmitted 10 times, and there is a problem that communication cost and processing time are required.
[0011]
[Problems to be solved by the invention]
The present invention has been made in view of the above-described problems, and an object of the present invention is to reduce the number of command issuances and reduce the processing time in an IC card capable of continuously executing a plurality of applications.
[0012]
[Means for Solving the Problems]
To achieve the above object, according to a first aspect of the present invention, a processing command is received from a terminal device, the processing command is executed in an application program, and execution result data of the processing command is transmitted to the terminal device. In the IC card, a multicast command that stores processing commands executed by a plurality of application programs, a management table that manages application programs that can be executed by the IC card, and a plurality of application programs that execute the processing commands are sequentially selected. Control moving means for sequentially designating the selected plurality of application programs and transferring control of execution of the processing command to the application program; and execution of each of the plurality of application programs that have executed the processing command. A response holding area that temporarily holds result data; and a response transmission unit that sends execution result data held in the response holding area to the terminal device after all execution of processing commands by the plurality of application programs is completed. It is provided.
[0013]
According to a second aspect of the present invention, in the IC card according to the first aspect described above, the control moving means uses a plurality of application programs based on command identification information called a class byte and an instruction type in the multicast command. A multicast command to be executed and a normal command to be executed in a specific application program are identified.
[0014]
According to a third aspect of the present invention, in the IC card according to the first or second aspect described above, application management information that can uniquely identify an application program is provided in the management table, and the control moving means is predetermined. In accordance with the rules, the application identification information sequentially selects a plurality of application programs that match the designation information for designating the application program stored in the multicast command, and the process command execution control is sequentially moved. is there.
[0015]
According to a fourth aspect of the present invention, there is provided a command processing method in an IC card that receives a processing command from a terminal device, executes the processing command in an application program, and transmits execution result data of the processing command to the terminal device. Storing an application program executable in the IC card in a management table, transmitting a multicast command storing a processing command to be executed by a plurality of application programs to the IC card, and the multicast command A step of sequentially selecting a plurality of application programs to be continuously executed and moving control of execution of the processing command to the selected application program; and each application program that has executed the processing command. The RAM temporarily stores the execution result data in the response holding area, and the execution result data held in the response holding area after the execution of all the processing commands by the plurality of application programs is completed in the terminal device. The transmission stage is performed.
[0016]
According to a fifth aspect of the present invention, in the command method in the IC card according to the fourth aspect described above, the processing command is used to confirm whether or not there is a communication start request for a plurality of application programs. In accordance with the processing command, each application program performs a step of temporarily holding the presence / absence of a communication start request in the response holding area.
[0017]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described based on the illustrated embodiments. FIG. 1 is a schematic configuration diagram of the inside of an IC card according to the present invention. The IC card 1 includes an I / O control unit 2, a CPU 3, a storage unit 4, a program storage unit 5, and a work memory 6.
[0018]
The I / O control unit 2 is an interface for the IC card 1 to communicate with the IC card reader / writer 7.
[0019]
The CPU 3 executes various applications recorded in the program storage unit 5. When the application is executed, the storage unit 4 and the working memory 6 are used as necessary.
[0020]
The storage means 4 is an EEPROM (Electrically Erasable Programmable Read-Only Memory) which is actually a nonvolatile memory, and is used to store and hold various data. The storage unit 4 includes an area for storing the application management table 8 in a part thereof.
[0021]
The management table 8 is used by the OS or card manager (a kind of application for selecting, installing, deleting, memory management, etc., which may be incorporated in a part of the OS) for application management. The AID for each application is stored.
[0022]
The program storage unit 5 stores an application main body corresponding to an AID executable by the OS and the CPU 3. There is a ROM (Read Only Memory) in which an application is recorded in advance when an OS or a card is manufactured, or an EEPROM in which an application can be loaded and used.
[0023]
The program storage unit 5 stores the control movement unit 9 and the response transmission unit 10. The control transfer unit 9 and the response transmission unit 10 are applications that cooperate closely with a part of the OS or the card manager or with the OS or the card manager.
[0024]
The control movement unit 9 sequentially selects a plurality of applications that execute the same command received from the terminal device, and moves the execution control of the command to the application.
[0025]
Among a plurality of applications, the order of selecting an application and moving the execution control may be the storage order of the management table 8, the order of a table for setting a priority prepared separately, or the currently selected application. You may give top priority.
[0026]
Each application temporarily stores the result of executing the command in the response holding area. The response transmission means 10 transmits the execution result held in the response holding area to the terminal device after all execution of the same command by a plurality of applications is completed.
[0027]
Here, a command executed by the IC card 1 and a response to the command will be described.
[0028]
FIG. 2 shows the structure of an APDU command sent from the terminal device defined by ISO 7816-4 to the IC card 1.
[0029]
The CLA at the head of the APDU command is called a class byte and indicates whether or not the content of the command conforms to ISO7816-4. INS indicates the type of command called a command code. P1 And P2 represents a parameter given to the command, and Lc represents a data length.
[0030]
In addition to the format shown in FIG. 2, the APDU command can use a plurality of structures in which Lc and the following are omitted, the length of a reply from an IC card called Le is added after the data portion, and no response is added. is there.
[0031]
FIG. 3 shows the structure of response data sent from the IC card 1 defined by ISO 7816-4 to the terminal device.
[0032]
The response data is composed of the processing result of the application and a 2-byte status word (SW1, SW2), and is transmitted from the application to the terminal device via the OS.
[0033]
In the present invention, the structure and coding conforms to the APDU command of ISO7816-4, but a semantically extended multicast command is defined that the command is a command executed by a plurality of applications. FIG. 4 shows the structure of the multicast command.
[0034]
As for the multicast command, for example, CLA is “0xD0 (0x is hexadecimal notation; the same applies hereinafter)”, INS is “0x00”, and a command to be executed by the application (hereinafter referred to as a processing command) is stored in the data portion. Define by
[0035]
Furthermore, it is possible to define two types of multicast commands depending on whether P1 or P2 is used.
[0036]
For example, by setting the value of P2 to “0x00” and storing the normal APDU command itself in the data part, all the applications stored in the management table 8 execute the APDU command.
[0037]
By omitting header information such as CLA and INS from the APDU command stored in the data part of the multicast command and storing only the data part of the normal APDU command, it is possible to reduce the amount of communication.
[0038]
When the length of the AID is stored in P2, that is, when the value of P2 is other than “0x00”, the AID is stored at the head of the processing command in the data part of the multicast command, and the AID stored in the management table 8 is All applications that partially match the AID having the length specified by the AID length from the top of the processing command are to execute the processing command.
[0039]
Further, FIG. 5 shows the structure of a response holding area for collectively transmitting the results of execution of processing commands by a plurality of applications using a multicast command.
[0040]
In the response holding area, a set of AID length, AID, processing result of the application, and SW is set in order to distinguish the response area in ISO7816-4 storing the command execution result for each application. Are stored in sequence. Information other than AID may be used as long as each application can be distinguished.
[0041]
In the following, the procedure for selecting an application and executing a processing command will be described with reference to the flowchart of FIG. .
[0042]
FIG. 7 shows an example of a management table 8 for managing a plurality of applications for realizing two tasks of credit processing and entrance / exit management in the IC card 1.
[0043]
FIG. 7 shows a credit card settlement function (AID is “0x01 02 03 04 05 01”), a point management function (AID is “0x01 02 03 04 05 02”), and entrance / exit management (AID is “0x05 06 07 08 09) 0A ") indicates that the IC card 1 can execute the three applications.
[0044]
In addition, FIG. 7 shows that the credit card settlement function and the point management function are “0x01 02” to indicate that a plurality of related applications are continuously executed, such as adding points according to the payment amount with the credit card. 03 04
It also shows that the first five digits of the AID “05” are shared.
[0045]
In addition, entrance / exit management (AID is “0x05 06 07 08 09 0A”) is a single application, but it has a function to save the authentication process for opening and closing some door gates and the record of which doors were opened and closed. Etc. shall be provided.
[0046]
The IC card 1 is supplied with power from the terminal device, activates the OS unit, and waits for reception of an APDU command. In the following description, the process of the APDU command reaching the IC card is a process of a network device such as a terminal device, and the description thereof will be omitted.
[0047]
When the IC card 1 receives the APDU command, the control moving unit 9 refers to CLA and INS and determines whether it is a multicast command.
[0048]
When the received APDU command is not a multicast command but a normal APDU command, the control moving unit 9 determines whether the INS is a selection command (SELECT FILE: actual value is “0xA4”).
[0049]
The selection command for selecting the payment function of the credit card is “0x04 00” in FIG. 8A indicating that the application is selected using the selection command for INS and the AID for P1 and P2, in the data portion. The APDU command in which the AID “0x01 02 03 04 05 01” of the settlement function is stored in Lc is the length of the data portion, that is, the length of AID “6 bytes”.
[0050]
Next, when INS is a selection command, the control moving unit 9 refers to the management table 8 based on P1, P2, Lc, and the AID “0x01 02 03 04 05 01” stored in the data part, Check whether there is a payment function.
[0051]
If the settlement function exists in the management table 8, the control transfer means 9 selects the settlement function, puts the selected mark on it, and then transfers control to the selected settlement function.
[0052]
The settlement function returns its processing result (for example, a code indicating “selection OK”) to the OS, and the OS transmits a response of the settlement function to the terminal device and returns to a command reception waiting state.
[0053]
When the received APDU command is the multicast command shown in FIG. 8B, the value of P2 is “0x05”, indicating that the AID is stored at the beginning of the data part. Then, “0x01 02 03 04 05” for 5 bytes of AID stored at the head of the data part and the processing command “DEBIT 100yen” are taken out.
[0054]
The control moving means 9 searches the management table 8 using “0x01 02 03 04 05” of 5 bytes, first selects a settlement function whose first five digits are “0x01 02 03 04 05”, and has already been selected. Then, the processing command “DEBIT 100 yen” is passed to the selected settlement function, and control is transferred.
[0055]
The payment function performs a payment process of 100 yen by the received processing command “DEBIT 100yen”, an AID length, an AID, and a code such as “payment end” (here, “Null“ 0x00 ”), A set of SWs is stored in the response holding area. The response holding area at this time is shown in FIG.
[0056]
After the settlement function is completed, the control moving means 9 searches the management table 8 again, selects the point management whose first 5 digits are “0x01 02 03 04 05”, puts the selected mark, The processing command “DEBIT 100yen” is passed to the selected point management, and control is transferred.
[0057]
For the point management, for example, 10% of the payment amount of 100 yen, that is, 10 points is added by the received processing command “DEBIT 100 yen”, AID length, AID, for example, point balance 10 (“0x0A”), and SW are added. One set is stored in the response holding area. The response holding area at this time is shown in FIG.
[0058]
Further, after the point management is completed, the control moving unit 9 searches the management table 8 again and searches for an application having the AID of “0x01 02 03 04 05” in the first five digits, but the entry / exit management is “0x05 06”. 07 08 09 ”, all the applications that execute the processing command“ DEBIT 100yen ”have been completed, so the response transmission means 10 is notified of the end of the search.
[0059]
The response transmission means 10 transmits the response holding area in the state of FIG. 9B holding the processing result of the settlement processing and the point management to the terminal device via the OS.
[0060]
Conventionally, by using the multicast command, the control moving means 9 and the response transmitting means 10, four times of “selection of payment function”, “execution of payment function”, “selection of point management”, and “point addition” are conventionally performed. The command processing can be performed by two command processings of “application selection” and “sequential execution of a plurality of applications”.
[0061]
As another embodiment, the log stored in the IC card 1 in the entry / exit management server after the IC card 1 having the IP address and equipped with the TCP / IP communication protocol has been passed for a certain period of time. The operation when starting communication to store the data will be described.
[0062]
As described above, since communication cannot be started from the IC card 1 side, the terminal device polls at regular intervals (for example, Lc is set to “0x00”, nothing is stored in the data part, and nothing is performed) To check whether the IC card 1 performs communication.
[0063]
Since the terminal device polls a plurality of applications at once, “0xD0 00 00 00 00” in which CLA and INS indicating a multicast command and a polling command are stored in the APDU command is transmitted to the IC card 1. To do.
[0064]
The IC card 1 determines that the selected APDU command received is a multicast command and the value of Lc is “0x00”, so that the control moving means 9 is a polling command for a plurality of applications. To do.
[0065]
The control moving unit 9 tries to poll all applications stored in the management table 8 because P2 is “0x00”.
[0066]
First, the settlement function which is the first application stored in the management table 8 is selected, a selected mark is added, and control is transferred to the selected settlement function.
[0067]
When the payment function does not need to communicate, the payment function stores the AID length, its own AID, and SW1 and SW2, for example, “0x9000” in the response holding area, and returns control.
[0068]
After the settlement function returns a response, the control transfer means 9 selects point management which is the next application in the management table 8, puts a selected mark, and transfers control to the selected point management.
[0069]
If the point management does not need to be communicated, the point management stores the AID length, its own AID, for example, SW1 and SW2 “0x9000” in the response holding area in the same manner as the payment function, and performs control. return.
[0070]
After the point management returns a response, the control movement means 9 further selects entry / exit management, which is the next application of the management table 8, puts the selected mark, and transfers control to the selected entry / exit management. .
[0071]
The entrance / exit management checks the current time, and when a certain time has passed since the previous communication, the AID length, its own AID, for example, SW1 and SW2 are “0x91”.
00 ”is stored in the response holding area, and control is returned.
[0072]
Further, the control moving means 9 searches the management table 8 again after the entrance / exit management returns the control, but since there is no next application in the management table 8, all the applications that perform polling have ended. Is sent to the response transmission means 10.
[0073]
The response transmission unit 10 transmits the response holding area to the terminal device via the OS.
[0074]
The terminal device receives the response, detects that the AID “0x05 06 07 08 09 0A” that has returned “0x91 00” has issued a request to start communication, and issues a command to the entry / exit management of the AID Can be issued and the subsequent processing can be continued.
[0075]
As described above, the present invention has been described in detail based on the embodiments. However, the IC card and the command processing method in the IC card according to the present invention are not limited to the above-described embodiments, and the gist of the present invention. It goes without saying that various changes can be made without departing from the scope of the invention.
[0076]
【The invention's effect】
As described above, according to the IC card and the command processing method in the IC card according to the present invention, the received one command is continuously executed in all applications or a part of applications that can be executed by the IC card. Therefore, the number of application selections and the number of communication can be reduced.
[0077]
In addition, the command execution result of each application is also transmitted to the terminal device at a time, so that the number of communication and the communication amount can be reduced.
[0078]
In addition, while maintaining compatibility with ISO 7816-3, it is possible to confirm whether or not there is a communication start request with a single poll for the start of communication from the IC card side. It is possible to reduce the number of polling for each application.
[Brief description of the drawings]
FIG. 1 is a schematic structural diagram inside an IC card of the present invention.
FIG. 2 is an explanatory diagram showing a configuration of an APDU command in ISO 7816-4.
FIG. 3 is an explanatory diagram showing a response structure in ISO7816-4.
FIG. 4 is an explanatory diagram showing a configuration of a multicast command according to the present invention.
FIG. 5 is an explanatory diagram showing a structure of a response holding area according to the present invention.
FIG. 6 is a flowchart showing a command processing method in the IC card of the present invention.
FIG. 7 is an example of a management table of the present invention.
FIG. 8 is an example of a multicast command of the present invention.
FIG. 9 is an example of a response holding area according to the present invention.
[Explanation of symbols]
1 IC card 2 I / O control unit 3 CPU
4 Storage means 5 Program storage section 6 Work memory 7 IC card reader / writer 8 Management table 9 Control movement means 10 Response transmission means

Claims (5)

An IC card that receives a processing command from a terminal device, executes the processing command in an application program, and transmits execution result data of the processing command to the terminal device,
A multicast command for storing processing commands executed by a plurality of application programs;
A management table for managing application programs executable by the IC card;
A control moving means for sequentially selecting a plurality of application programs for executing the processing commands, and for transferring control of the processing command execution to the application programs;
A response holding area for temporarily holding execution result data of each of the plurality of application programs that executed the processing command;
A response transmission means for transmitting execution result data held in the response holding area to the terminal device after execution of processing commands by the plurality of application programs is completed;
An IC card comprising: The IC card according to claim 1, wherein
The control moving means is
Identifying a multicast command to be executed in a plurality of application programs and a normal command to be executed in a specific application program by class identification in the multicast command and command identification information called an instruction type.
IC card characterized by that. The IC card according to claim 1 or 2,
The management table is
With application identification information that can uniquely identify the application program,
The control moving means is
In accordance with a predetermined rule, the application identification information sequentially selects a plurality of application programs that match the designation information designating the application program stored in the multicast command, and sequentially moves the control of processing command execution.
IC card characterized by that. A command processing method in an IC card that receives a processing command from a terminal device, executes the processing command in an application program, and transmits execution result data of the processing command to the terminal device,
Storing an application program executable in the IC card in a management table;
Transmitting a multicast command storing a processing command to be executed by a plurality of application programs to the IC card by the terminal device;
Sequentially selecting a plurality of application programs to be continuously executed based on the multicast command, and moving control of the processing command execution to the selected application program;
Each application program that has executed the processing command temporarily holds execution result data in a response holding area;
A step of transmitting execution result data held in the response holding area to the terminal device after execution of processing commands by the plurality of application programs is completed;
A command processing method in an IC card, comprising: A command processing method for an IC card according to claim 4,
The processing command is
It is a processing command to check whether there is a communication start request for multiple application programs,
In response to the processing command, each application program temporarily holds the presence or absence of a communication start request in the response holding area;
A command processing method in an IC card, comprising:

Images