JP4228567B2 - Data transfer system, data transfer method, value information transfer service device, value information transfer service method, and computer program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a non-contact (or contact type) IC card or IC chip having a memory function for holding data and capable of reading and writing to the memory by non-contact, and in particular, a memory from an external reader / writer by wireless data. A wireless interface for accessing functions and a non-contact IC card or IC chip with a wired interface for connecting to an external device, and this type of IC card or IC chip via a wired interface The present invention relates to an information processing terminal such as a mobile phone or a PDA that is installed and used.
[0002]
More specifically, the present invention includes a contactless IC card or IC chip that electronically stores electronic money, electronic tickets, or other value information, and such an IC card or IC chip via a wired interface. In particular, the present invention relates to secure movement of value information between information processing terminals.
[0003]
[Prior art]
Conventionally, various devices using a personal identification number and password for identity verification and authentication processing have been devised and put into practical use. For example, when using a cash card or credit card at a bank or other financial institution, the user must enter a PIN or password as a means of personal authentication on the cash dispenser or other financial terminal. After confirming that the correct password and password have been entered by the user, the deposit / withdrawal operation is performed.
[0004]
In a storage medium such as a magnetic stripe arranged on one cash card, only a storage area usable only for the bank is provided. Therefore, since the input of a password or password as described above is only an access to this single storage area, it cannot be said that protection against forgery or theft is sufficient.
[0005]
For this reason, from the standpoint of preventing counterfeiting, there are contact IC cards that have electrical contacts with cash cards and credit cards, and non-contact IC cards that read and write data wirelessly via wireless data. It is becoming popular. For example, an IC card reader / writer installed at a cash dispenser, an entrance / exit of a concert hall, a ticket gate of a station, etc. can access the IC card held by the user in a non-contact manner.
[0006]
The user inputs the password to the IC card reader and verifies the identity between the IC card and the IC card reader / writer by comparing the input password with the password stored on the IC card. Alternatively, authentication processing is performed. When the identity verification or authentication process is successful, for example, an application stored in the IC card can be used. Here, examples of applications held by the IC card include value information such as electronic money and electronic tickets. Further, by storing the prepaid voucher electronically, it is possible to use an IC card or a portable terminal connected thereto as a prepaid card. (The personal identification number used when accessing the IC card is particularly called a PIN (Personal Identification Number).)
[0007]
Recently, along with the improvement in miniaturization technology, IC cards having a relatively large storage space have emerged and become popular. Since a conventional cash card or the like carries only a single storage area, that is, a single application, it is necessary to carry a plurality of cards according to each use or purpose. On the other hand, according to such an IC card with a large-capacity memory, a plurality of applications can be stored simultaneously, so that one IC card can be used for a plurality of purposes. For example, two or more applications such as electronic money for electronic payment, electronic ticket for entering a specific concert venue, digitized prepaid voucher are stored on one IC card. One IC card can be applied to various uses.
[0008]
Furthermore, in addition to the non-contact (or contact type) interface with the card reader / writer (card reader / writer), the IC card includes a wired interface for connecting to an external device, so that the IC card can be connected to a mobile phone, PDA. It can be used by being connected to (personal digital assistant) or built in (however, in most cases, the IC card is configured as one chip).
[0009]
In such a case, various application services using the IC card can be executed on the information processing terminal. For example, user interaction with the IC card can be performed on the information processing terminal using a user interface such as a keyboard or display on the information processing terminal. In addition, since the IC card is connected to the mobile phone, the contents stored on the IC card can be exchanged via the telephone network.
[0010]
Of course, in the case where value information such as electronic money, electronic ticket, and prepaid voucher is stored on the IC card, the information processing terminal processes value information such as electronic payment and payment in a prepaid card format, Various other services can be realized. Furthermore, it is possible to provide processing according to the phase of data transfer between the IC card and the card read / write device and processing according to the internal state of the IC card.
[0011]
By the way, when the IC chip storing the value information is built in the mobile phone, it is necessary to move the value information between the IC chips, that is, between the mobile terminals for reasons such as model change.
[0012]
The mobile phone model change procedure is generally performed at a telephone company store or the like, and personal information such as an address book in the old model is moved to the new model. However, when moving the value information in the IC chip, there is a possibility that the value information may be lost due to a communication failure or a machine failure during the movement, and the value information may be illegally copied or falsified. Is overly responsible.
[0013]
In the first place, telephone companies are not integrated with electronic money or electronic ticket service providers, and do not have the keys and logic necessary to access value information, so there are many inconveniences in processing value information. In addition, by contracting the transfer of value information, the telephone company inevitably takes responsibility for the value information and its key. Also, it is not preferable for electronic money or electronic ticket service providers to pass outside access keys and logics that form the basis of service trust, even though they are telephone companies.
[0014]
A value information service provider usually uses a tamper-resistant hardware module SAM (Secure Application Module) to confine the value information itself, a key for accessing the value information, and its logic. In order to move a plurality of pieces of value information using a single mobile server such as a telephone company, it is necessary to store the value information even if it is temporary. However, unless a SAM or the like is used, Even if it is encrypted independently, there is a high possibility that the value information and its key will be decrypted on the server.
[0015]
On the other hand, apart from the procedure for changing the model of the mobile terminal body, a method in which the value information in the IC chip is moved by the service provider of the value information is also conceivable. This method may be effective from the viewpoint of separation of responsibilities.
[0016]
However, the user has to take a plurality of procedures as the model of the portable terminal is changed. In particular, when various types of value information are stored in one IC chip as the memory capacity of the IC card or IC chip increases, the procedure for transferring the value information to each service provider Has to be taken and is extremely annoying. Further, a reader / writer that reads value information from an IC chip needs to switch sessions to a plurality of service providers. However, it takes time to manually perform this switching operation. In addition, since the communication mechanism on the IC chip side is complicated, there is a high possibility that a failure will occur.
[0017]
[Problems to be solved by the invention]
An object of the present invention is to provide an excellent data transfer system, data transfer method, value information transfer service device, value information transfer service method, and storage medium capable of securely transferring value information such as electronic money and electronic tickets. It is to provide.
[0018]
A further object of the present invention is to provide an excellent data transfer system, data transfer method, and value information transfer capable of securely transferring value information such as electronic money and electronic tickets held in an IC card or IC chip. To provide a service device, a value information transfer service method, and a storage medium.
[0019]
A further object of the present invention is to provide an excellent data transfer system and data transfer capable of securely moving a plurality of value information held in an IC card or IC chip by simply connecting to one server. To provide a method, a value information transfer service device, a value information transfer service method, and a storage medium.
[0020]
[Means and Actions for Solving the Problems]
The present invention has been made in consideration of the above problems, and a first aspect thereof is a data transfer system for transferring value information,
A value information service device that securely holds the value information itself to be transferred, the key for accessing the value information, and its logic;
A value information transfer service device that relays upload of value information stored in a source information recording medium to the value information service device and download of value information from the value information service device to a destination information recording medium;
A data transfer system comprising:
[0021]
However, “system” here refers to a logical collection of a plurality of devices (or functional modules that realize specific functions), and each device or functional module is in a single housing. It does not matter whether or not.
[0022]
The second aspect of the present invention is a data transfer method for transferring value information,
Relaying the upload of the value information to the value information service device that securely holds the key and its logic for accessing the value information itself and the value information from the information recording medium of the transfer source;
The value information service device temporarily storing the value information in transit;
Relaying download of value information from the value information service device to a destination information recording medium;
A data transfer method characterized by comprising:
[0023]
According to the data transfer system or the data transfer method according to the first or second aspect of the present invention, the value information held in the information recording medium such as the IC chip is accessed to the value information with the value information itself. To control value information service devices such as tamper-resistant hardware modules SAM that contain the necessary keys and logic, and to access value information and value information other than authorized devices It can be securely transferred onto another information recording medium without showing a necessary key and its logic and while preventing duplication or falsification of value information. For example, when exchanging a portable terminal for a new model, all the value information held in the terminal can be securely moved by connecting to a single location. Therefore, it is possible to clearly separate the responsibility range of the value information mobile operator and each service provider operating the value information service.
[0024]
Here, the value information transfer service device changes the key for accessing the value information on the transfer source information recording medium from the real key during normal use to the temporary key, and then the value to the value information service device. Information may be uploaded. In such a case, it is possible to prevent the value information from being illegally duplicated or altered during use and used. Even if the transfer of the value information fails, it can be used as a backup by returning the key of the transfer source to the real key, and the loss of the value information can be prevented.
[0025]
The value information transfer service device may change the temporary key to the real key after downloading the value information from the value information service device to the transfer destination on the information recording medium. In such a case, since the value information remaining in the information recording medium of the transfer source remains as a temporary key, the normal use remains unusable, so that unauthorized use can be prevented.
[0026]
In addition, when there are a plurality of value information service devices that hold a plurality of value information on the information recording medium of the transfer source and securely hold each value information itself and a key for accessing the value information and its logic, The value information transfer service device may perform the upload of the value information from the transfer source information recording medium and the download to the transfer destination information recording medium for each value information service device. In such a case, it is only necessary to connect to one value information mobile service device, and there is no need to switch communication for each value information service manually or automatically. For this reason, labor can be reduced and the possibility of communication failure can be reduced. Considering from the information recording medium side of the movement source, it is not necessary to be conscious of each value information service device as a relay destination, and the procedure is simplified.
[0027]
The value information transfer service device may perform initialization processing of a transfer destination information recording medium before downloading value information from the value information service device.
[0028]
Further, the value information transfer service device may perform an authentication process on a transfer source information recording medium and / or a transfer destination information recording medium.
[0029]
The third aspect of the present invention is a value information transfer service device or a value information transfer service method that services transfer of value information between information recording media,
Means or step for relaying the upload of the value information to the value information service device that securely holds the value information itself and the key for accessing the value information and the logic from the information recording medium of the transfer source; and
Means or step for relaying download of value information from the value information service device to a destination information recording medium;
A value information transfer service device or a value information transfer service method.
[0030]
According to the value information transfer service device or the value information transfer service method according to the third aspect of the present invention, the value information held in the information recording medium such as an IC chip is accessed to the value information with the value information itself. To control value information service devices such as tamper-resistant hardware modules SAM that contain the necessary keys and their logic, and to access value information itself and value information other than authorized devices Can be securely transferred onto another information recording medium without showing the necessary key and its logic and preventing duplication or falsification of value information. For example, when exchanging a portable terminal for a new model, all the value information held in the terminal can be securely moved by connecting to a single location. Therefore, the business operator who switches the model of the portable terminal can move the value information while clearly separating the responsibilities of each service provider operating the value information service.
[0031]
Here, the value information transfer service device according to the third aspect of the present invention changes the key for accessing the value information on the transfer source information recording medium from the real key during normal use to the temporary key. You may make it upload the value information to the said value information service apparatus. In such a case, it is possible to prevent the value information from being illegally duplicated or altered during use and used. Even if the transfer of the value information fails, it can be used as a backup by returning the key of the transfer source to the real key, and the loss of the value information can be prevented.
[0032]
Further, after the value information is downloaded onto the information recording medium from the value information service device to the destination, the temporary key may be changed to the real key. In such a case, since the value information remaining in the information recording medium of the transfer source remains as a temporary key, the normal use remains unusable, so that unauthorized use can be prevented.
[0033]
In addition, when there are a plurality of value information service devices that hold a plurality of value information on the information recording medium of the transfer source and securely hold each value information itself and a key for accessing the value information and its logic, You may make it perform the upload of the value information from the information recording medium of a movement origin, and the download to the information recording medium of a movement destination for every value information service apparatus. In such a case, it is only necessary to connect to one value information mobile service device, and there is no need to switch communication for each value information service manually or automatically. For this reason, labor can be reduced and the possibility of communication failure can be reduced. Considering from the information recording medium side of the movement source, it is not necessary to be conscious of each value information service device as a relay destination, and the procedure is simplified.
[0034]
The value information transfer service device or the value information transfer service method according to the third aspect of the present invention may perform the initialization process of the information recording medium of the transfer destination before downloading the value information from the value information service device. Good.
[0035]
Further, the value information movement service device or the value information movement service method according to the third aspect of the present invention may perform authentication processing on the information recording medium of the movement source and / or the information recording medium of the movement destination.
[0036]
According to a fourth aspect of the present invention, there is provided a computer readable form of computer software written to execute a value information transfer service for transferring value information between information recording media on a computer system. A storage medium stored on the computer, wherein the computer software comprises:
Relaying the upload of the value information to the value information service device that securely holds the key and its logic for accessing the value information itself and the value information from the information recording medium of the transfer source;
Relaying download of value information from the value information service device to a destination information recording medium;
It is a storage medium characterized by comprising.
[0037]
The storage medium according to the fourth aspect of the present invention is a medium that provides computer software in a computer-readable format to, for example, a general-purpose computer system that can execute various program codes. Such a medium is a removable and portable storage medium such as a DVD (Digital Versatile Disc), a CD (Compact Disc), an FD (Floppy Disk), and an MO (Magneto-Optical disc). Alternatively, it is technically possible to provide computer software to a specific computer system via a transmission medium such as a network (whether the network is wireless or wired).
[0038]
The storage medium according to the fourth aspect of the present invention has a structural or functional cooperative relationship between the computer software and the storage medium for realizing the function of predetermined computer software on the computer system. Defined. In other words, by installing predetermined computer software in the computer system via the storage medium according to the fourth aspect of the present invention, a cooperative action is exhibited on the computer system, and the The same effect as the value information movement service apparatus or the value information movement service method according to the third aspect can be obtained.
[0039]
Other objects, features, and advantages of the present invention will become apparent from more detailed description based on embodiments of the present invention described later and the accompanying drawings.
[0040]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0041]
According to the present invention, a plurality of pieces of value information held in an IC card or an IC chip can be securely moved simply by connecting to one server. The server that moves the value information is hereinafter referred to as a “value transfer server”. For example, when changing the value information on a built-in IC chip when changing the model of a mobile phone, a telephone company that provides a model change service may operate a value transfer server. Although the value transfer server is not integrated with each provider of value information services, according to the present invention, value information can be transferred securely, so that the separation of responsibilities becomes clear. The responsibility of the operator operating the value transfer server will not be excessive.
[0042]
FIG. 1 schematically shows the configuration of a network system that realizes secure movement of value information.
[0043]
As shown in the figure, on a network such as a VPN (Virtual Private Network) or a dedicated line, application servers (APS) 10A, 10B,. There is a value transfer server 20 for securely transferring value information built in an IC card or IC chip between IC chips.
[0044]
Each of the application servers (APS) 10A, 10B,... And the value transfer server 20 includes a tamper-resistant hardware module SAM (Secure Application Module). The SAM contains the value information itself, the key for accessing the value information, and its logic.
[0045]
In the present embodiment, the value transfer server 20 includes a management SAM 21 for securely managing information in each IC chip. The management SAM 21 manages each IC chip holding value information, such as an IC chip initialization process. In addition, the management SAM 21 includes logic for changing the value information in the IC chip from a “real key” during normal use to a temporary “temporary key” used only during movement. .
[0046]
Further, each application server 10A... Operates as a normal SAM 11 that operates with the real key used when value information is normally used, and a transfer SAM 12 that operates during transfer with a temporary key issued by the management SAM 21 of the value transfer server 20. It has.
[0047]
SAM11 is usually a service provider Set up Managed individually on the application server 10 to provide value information services. Usually, the SAM 11 cannot know the contents of the SAM 11 unless each service provider who knows the key for accessing the value information and its logic has authority for each other. The value transfer server 20 is also unable to know the contents of the normal SAM 11.
[0048]
Normally, the SAM 11 and the mobile SAM 12 may be physically integrated in the same hardware module or may be independent hardware modules. Further, depending on the contract, the service provider may arrange the SAM in another place such as the value transfer server 20 instead of the application server operated by the service provider.
[0049]
Each application server 10 and value transfer server 20 can be configured as a server device with dedicated hardware, but on a general computer system called a workstation (WS) or a personal computer (PC). This can also be realized by starting a predetermined server application. An example of the computer system is IBM's PC / AT compatible machine or its successor.
[0050]
In addition, the IC card is used as an IC chip incorporated in a mobile terminal 30A such as a mobile phone or a PDA (Personal Digital Assistant), or non-contact (or contact) access to a mobile terminal 30B with a reader / writer. Used. When transferring value information between IC chips or IC cards for changing the model of the mobile terminal or replacing the IC card itself, the mobile terminal 30 is connected to the VPN via a wireless or wired communication medium. The value transfer server 20 is requested to transfer value information. It should be noted that in the present embodiment, even when a plurality of value information held in the IC chip is moved, the mobile terminal 30 only needs to be connected to one value transfer server 20. .
[0051]
When the value information is transferred, the value transfer server 20 uses the management SAM 21 to control the IC chip via the communication path.
[0052]
In the present embodiment, the value transfer server 20 uses the management SAM 21 to relay encrypted communication between the transfer SAM 12 of each service provider and the IC chip for the transfer of value information. To play a role. In addition, the portable terminal 30B having a reader / writer function on the IC chip side and the portable terminal 30A having a built-in IC chip connect the IC chip and the value transfer server 20 when encrypted communication is performed between the SAM and the IC chip. Take the role of doing.
[0053]
Between the value transfer server 20 and each transfer SAM 12, the authority to control the transfer SAM 12 with the value transfer server 20 can be set individually. Further, the value transfer server 20 and each transfer SAM 12 can be encrypted with a PKI (Public Key Infrastructure) or a common key. The value transfer server 20 and the remote transfer SAM 12 are connected by a VPN or a dedicated line.
[0054]
In the network system shown in FIG. 1, in order to move value information in an IC chip built in an IC card or a portable terminal, the connection destination of the IC chip that is the movement source and the movement destination is a single value. It becomes the movement server 20.
[0055]
Before the value information is transferred, the management SAM 21 of the value transfer server 20 changes the key of the value information from a “real key” during normal use to a temporary “temporary key” for transfer. Also, as long as the transfer of all value information held in the IC chip is not completed, the original IC chip value Keep the information for backup without deleting it yet.
[0056]
When the transfer is completed, the management SAM 21 returns the temporary key to the real key in the transfer destination IC chip, so that the value information can be used normally. Further, since the original IC chip side that has been left for backup remains in a temporary key, it cannot be used normally, so that unauthorized use can be prevented.
[0057]
The value transfer server 20 moves individual value information in the IC chip using the transfer SAM 12 of the corresponding service provider. At this time, the transfer SAM 12 on the service provider (APS) side sets an access restriction from the value transfer server 20 in advance.
[0058]
On the application server 10 side of the service provider, a key for accessing value information during normal use and its logic are stored in the normal SAM 11, and a key for transferring value information and its logic are stored in the movement SAM 12. ing. Further, during movement, the value information in the IC chip is temporarily stored in the movement SAM 12 of the application server 10.
[0059]
On the IC chip side to which the value information is transferred, after performing predetermined preprocessing such as formatting of the memory area, the value is transferred from the service provider, that is, the transfer SAM 12 of the application server 10 via the value transfer server 20. The transfer is completed by downloading the information.
[0060]
After the movement, the management SAM 21 changes to the correct key, thereby making it impossible to move the value information with the same movement key thereafter. As a result, the backup value information remaining on the source IC chip cannot be used.
[0061]
When the transfer of all the value information in the IC chip is completed, the value information temporarily stored in the service provider transfer SAM 12 is deleted.
[0062]
FIG. 2 shows a processing procedure for securely transferring the value information between the IC chips on the network system according to the present embodiment in the form of a flowchart. This processing procedure is realized by a cooperative operation among the IC chip connected to the network via the portable terminal, the value transfer server 20, and the transfer SAM 12 of each corresponding application server (provider) 10. The Hereinafter, the secure transfer process of value information will be described with reference to this flowchart.
[0063]
First, the IC chip that is the source of the value information is connected to a communication device 30 having a reader / writer function (for example, a mobile phone with a reader / writer, or a mobile phone with a built-in IC chip) 30. Further, the source IC chip is connected to the value transfer server 20 via the communication device 30 and authenticates with the value transfer server 20 using the user ID and password sent from the communication device 30 (step S1).
[0064]
The value transfer server 20 searches the value information transfer source IC chip, detects all types of value information registered in the IC chip, and uses the information to transfer the information to the server 20 local transfer information. Save in a database (not shown). Alternatively, a serial table of IC chips prepared in advance by the value transfer server 20 side and a comparison table of registered value information types are prepared in advance in the transfer information database, and the transfer source IC of the value information is stored. By obtaining the serial number of the chip, the type of value information registered in the IC chip is determined using this comparison table (step S2). Assume that for each type of value information, a corresponding service provider, that is, an application server that prepares a SAM, is different.
[0065]
Next, the management SAM 21 of the value transfer server 20 temporarily changes the key necessary for accessing the value information itself in the transfer source IC chip of the value information from the “real key” during normal use during the transfer. The “temporary key” to be used is changed (step S3). As a result, during the movement of the value information, the normal value information cannot be used on the movement source IC chip. That is, by switching to the temporary key, the normal SAM 11 of the corresponding service provider cannot access the value information in the IC chip, but the mobile SAM 12 can access the value information in the IC chip.
[0066]
Next, the value transfer server 20 takes out one service provider retrieved from the IC chip (step S4). Then, the management SAM 21 of the value transfer server 20 starts to transfer value information in units of value information types (application units).
[0067]
First, the service provider that manages the value information to be moved first, that is, the migration SAM 12 of the application server 10 is specified, and the IC chip that is the source of the value information is communicated with the migration SAM 12 (step S5).
[0068]
The value transfer source IC chip performs mutual authentication with the transfer SAM 12 with respect to certain value information in the chip, and starts encrypted communication (step S6).
[0069]
Next, the value information in the transfer source IC chip of the value information is copied (that is, the value information is uploaded) to the memory area in the transfer SAM 12 on the application server 10 side (step S7).
[0070]
When copying of the value information to the memory area in the transfer SAM 12 is completed, the transfer SAM 12 of the service provider that manages the next transfer target value information is specified, and the transfer source IC chip is executed in the same procedure as described above. Communicate with the mobile SAM 12. Subsequently, steps S4, S5, S6, and S7 are repeated until all value information in the source IC chip is copied, that is, uploaded (step S8).
[0071]
In other words, the value transfer server 20 to which the value information transfer source IC chip is connected is one place, and this value transfer server 20 communicates with the transfer source SAM chip 12 and the transfer SAM 12 of the service provider. In short, relay.
[0072]
After copying all the value information in the source IC chip to the SAM 12 for transfer of each service provider, that is, after the upload of the value information is completed, the destination IC chip of the value information is now connected. The communication device 30 having a reader / writer function (for example, a mobile phone having a reader / writer function or a mobile phone incorporating an IC chip) is connected to the value transfer server 20 and sent from the communication device. Then, the value transfer server 20 is authenticated with the password (step S9).
[0073]
The management SAM 21 of the value transfer server 20 searches the transfer information database based on the authentication information of the value information with the transfer destination IC chip, and obtains initialization (format) information of the transfer destination IC chip. Then, the management SAM 21 of the value transfer server 10 initializes the memory area of the transfer destination IC chip based on the initialization information (step S10). In this initialization, a temporary key for transferring value information is used instead of the main key used when using the value information.
[0074]
Next, the value transfer server 20 extracts one service provider from the transfer information database (step S11). Then, the value transfer server 20 starts transferring value information in units of value information types (application units), that is, downloading to the IC chip.
[0075]
First, the service provider that manages the value information to be moved first, that is, the migration SAM 12 of the application server is specified, and the IC chip to which the value information is moved is communicated with the migration SAM 12 (step S12).
[0076]
Then, the IC chip to which the value information is transferred performs mutual authentication with the transfer SAM 12 using a key in the chip set at the time of initialization, that is, a temporary key, with respect to certain value information, and starts encrypted communication (step) S13).
[0077]
Next, the value information copied or uploaded from within the transfer source IC chip of the value information to the memory area in the transfer SAM 12 is copied or downloaded into the transfer destination IC chip of the value information (step S14).
[0078]
When copying of certain value information into the destination IC chip is completed, the migration SAM 12 of the service provider that manages the value information to be moved next is specified, and the destination IC is identified by the same procedure as described above. The chip communicates with the mobile SAM 12. Subsequently, steps S11, S12, S13, and S14 are repeated until all value information is copied into the destination IC chip (step S15).
[0079]
In other words, the value transfer server 20 to which the value information transfer destination IC chip is connected is one location, and this value transfer server 20 communicates with the transfer destination SAM chip of each service provider. In short, relay.
[0080]
When the transfer of all value information is completed, the value transfer server 20 changes the temporary key for transferring the value information of the value transfer destination IC chip to the real key for normal use (step S16). As a result, the value information can be normally used on the destination IC chip side. Further, since the IC chip that is left for backup remains in a temporary key by being left as a temporary key, unauthorized use can be prevented. Further, as needed, the value information remaining in the source IC chip is deleted.
[0081]
Further, the value transfer server 20 clears the transfer value information stored in the memory area in the transfer SAM 21 of each application server 10 related to the transfer of the value information (step S17).
[0082]
FIG. 3 shows a processing procedure for uploading the value information held in the movement source IC chip to the movement SAM 12 of each service provider. Hereinafter, a collaborative operation between each person for uploading the value information from the movement source IC chip to the movement SAM 12 will be described with reference to FIG.
[0083]
First, an IC chip that is a source of value information is connected to a communication device 30 having a reader / writer function (for example, a mobile phone with a reader / writer or a mobile phone with a built-in IC chip), and the communication device is an IC chip. Get serial number etc.
[0084]
Next, the communication device having the reader / writer function performs user authentication with the value transfer server 20 and, after successful authentication, requests the communication device to secure a communication path for IC chip control, A communication path is secured.
[0085]
Next, the value transfer server 20 temporarily uses the key necessary for accessing the management SAM 21 to access the value information itself in the transfer source IC chip from the “real key” for normal use during transfer. The management SAM 21 performs the key change process by requesting the key change so as to change to the “temporary key”. By changing from the real key to the temporary key, the moving SAM 12 can access the value information of the source IC chip instead of the normal SAM 11 on the corresponding service provider 10 side.
[0086]
Next, the value transfer server 20 requests the service provider 10 that manages the value information to transfer (upload) the value information.
[0087]
On the service provider 10 side, in response to this request for value information transfer processing, the transfer SAM 12 issues a request for uploading value information to the source IC chip. On the other hand, the transfer source IC chip copies, that is, uploads the value information to the transfer SAM 12.
[0088]
The value information transfer processing request, the value information upload request, and the value information upload are repeatedly executed for the necessary service providers.
[0089]
FIG. 4 shows a processing procedure for downloading the value information uploaded to the transfer SAM 12 of the service provider to the transfer destination IC chip. Hereinafter, with reference to the figure, a collaborative operation between each person for downloading the value information from the movement SAM 12 to the movement destination IC chip will be described.
[0090]
First, an IC chip that is a source of value information is connected to a communication device 30 having a reader / writer function (for example, a mobile phone with a reader / writer or a mobile phone with a built-in IC chip), and the communication device is an IC chip. Get serial number etc.
[0091]
Next, the communication device having the reader / writer function performs user authentication with the value transfer server 20 and, after successful authentication, requests the communication device to secure a communication path for IC chip control, A communication path is secured.
[0092]
When the communication path is secured, the management SAM 21 of the value transfer server 20 searches the transfer information database by the serial number of the transfer destination IC chip, and obtains initialization (format) information of the transfer destination IC chip. . Then, the management SAM 21 of the value transfer server 10 initializes the memory area of the transfer destination IC chip based on the initialization information. The destination IC chip notifies the management SAM 21 when the initialization is completed.
[0093]
Next, the value transfer server 20 requests the service provider 10 that manages the value information to transfer (download) the value information.
[0094]
On the service provider 10 side, in response to the request for value information transfer processing, the transfer SAM 12 downloads the value information uploaded to its own memory area to the transfer destination IC chip. On the other hand, the destination IC chip notifies when the download is completed.
[0095]
The value information transfer processing request, the value information download request, and the value information download end notification are repeatedly executed for the necessary service providers.
[0096]
When the download of all the value information is completed, the value transfer server 20 obtains the key necessary for accessing the value information itself in the transfer destination IC chip with respect to the management SAM 21 as “temporary use”. The management SAM 21 performs a key change process by requesting a key change so that the key is changed to a “real key” that is temporarily used at the time of movement. By returning from the temporary key to the real key, the normal service SAM 11 instead of the transfer SAM 12 can access the value information of the transfer source IC chip on the corresponding service provider 10 side.
[0097]
As a result, the destination IC chip can normally use the value information (for example, electronic payment using electronic money or use of an electronic ticket). On the other hand, since the original IC chip side that has been left for backup remains in a temporary key by leaving it as a temporary key, unauthorized use can be prevented. Further, as needed, the value information remaining in the source IC chip is deleted.
[0098]
5 and 5 illustrate the mechanism of contactless data communication between an IC card and a card reader / writer.
[0099]
Wireless communication between the reader / writer and the IC card is realized based on the principle of electromagnetic induction, for example. FIG. 5 conceptually illustrates a wireless communication mechanism between a reader / writer and an IC card based on electromagnetic induction. The reader / writer is an antenna L composed of a loop coil. _RW This antenna L _RW Current I _RW To generate a magnetic field around it. On the other hand, on the IC card side, a loop coil L is electrically disposed around the IC card. _c Is formed. IC card loop coil L _c Loop antenna L on the reader / writer side at the end _c An induced voltage is generated by the magnetic field generated by the loop coil L _c It is input to the terminal of the IC card connected to the end.
[0100]
Reader / writer side antenna L _RW And IC card loop coil L _c Although the degree of coupling varies depending on the positional relationship with each other, the system can be regarded as forming one transformer, and can be modeled as shown in FIG.
[0101]
On the reader / writer side, the antenna L _RW Current I _RW By modulating the loop coil L on the IC chip _c Induced voltage V _O Receives the modulation, and using this, the reader / writer can transmit data to the IC card.
[0102]
In addition, the IC card has a loop coil L according to data to be returned to the reader / writer. _c It has a function to change the load between the terminals (Load Switching). Loop coil L _c When the load between the two terminals fluctuates, the impedance between the antenna terminals changes on the reader / writer side, and the antenna L _RW Passing current I _RW And voltage V _RW Appears as fluctuations. By demodulating this fluctuation, the reader / writer can receive the return data of the IC card.
[0103]
That is, the IC card performs communication by applying amplitude modulation to the signal appearing in the receiving circuit on the reader / writer side by changing the load between its antennas according to the response signal to the interrogation signal from the reader / writer. be able to.
[0104]
FIG. 7 schematically shows an internal hardware configuration of a portable terminal 110 of a type incorporating the IC chip 100. Here, the portable terminal 110 corresponds to an information processing terminal such as a cellular phone or a PDA (Personal Digital Assistant). If it is a mobile phone, it is connected to a VPN or a dedicated line via a wireless telephone network. In the case of a mobile terminal, it is connected to a VPN or a dedicated line via a wireless telephone network via another mobile phone.
[0105]
As shown in FIG. 1, the IC chip 100 includes an antenna unit 101, an analog unit 102, a digital control unit 103, a memory 104, and an external interface 105.
[0106]
The antenna unit 101 transmits and receives contactless data to and from the reader / writer 200. The analog unit 102 processes analog signals transmitted and received from the antenna unit 101, such as detection, modulation / demodulation, and clock extraction. The IC chip 100 performs communication by applying amplitude modulation to the signal appearing in the receiving circuit on the reader / writer side by changing the load between its antennas in accordance with the response signal to the interrogation signal from the reader / writer 200. be able to.
[0107]
The digital control unit 103 comprehensively controls processing of transmission / reception data and other operations in the IC card. The digital control unit 103 is connected locally to the addressable memory 104, stores applications such as electronic money and electronic tickets, loads program codes executed by the digital control unit 103, Can be used to save work data.
[0108]
Various applications are stored in the memory 104 of the IC chip 100. Examples of the application include value information such as electronic money and electronic tickets.
[0109]
The external interface 105 is a functional module for the digital control unit 103 to connect to the mobile terminal 110 main body using an interface protocol different from the non-contact interface connecting the reader / writer 200. Data written in the memory 104 can be transferred to the main body of the mobile terminal 110 via the external interface 105.
[0110]
In the present embodiment, the external interface 105 that connects the portable terminal 110 and the built-in IC chip 100 has UART and I ² A wired interface such as C is used. However, the interface specifications of the external interface 105 are not particularly limited, and may be other wired interfaces, or Bluetooth or IEEE. A wireless interface such as 802.11b may be used.
[0111]
The IC chip 100 can be driven by, for example, a received radio wave from a card read / write device that is received via the antenna unit 101. Of course, part or all may be configured to operate by the power supplied from the mobile terminal 110 side.
[0112]
On the other hand, the mobile terminal 110 main body side includes a program control unit 111, a display unit 112, and a user input unit 113.
[0113]
The program control unit 111 includes, for example, a microprocessor, a RAM, and a ROM (all not shown), and the microprocessor uses various processing services using the RAM as a work area according to the program code stored in the ROM. Execute. The processing service includes processing for the IC chip 100 in addition to the original functions of the mobile terminal 110 such as a mobile phone or a PDA.
[0114]
The program control unit 111 can access the IC card 100 via the external interface 105.
[0115]
The program control unit 111 is provided with an information storage unit 114. The information storage unit 114 includes a writable memory device such as an EEPROM (Electrically Erasable and Programmable ROM), an external storage device such as a hard disk, and the like.
[0116]
The display unit 112 is configured by, for example, a liquid crystal display (LCD). For example, the display unit 112 can output the processing result in the program control unit 111 to the user and notify the user.
[0117]
The user input unit 113 includes a keyboard, a jog dial, or a touch panel superimposed on the display screen of the display unit 112, and is used by the user to input commands and data to the mobile terminal 110.
[0118]
The program control unit 111 in the portable terminal 110 is driven by power supply from a main power source (not shown) such as a battery.
[0119]
By holding the portable terminal 110 incorporating the IC chip 100 over the reader / writer (R / W) 200, contactless data communication is started between the built-in IC chip 100 and the reader / writer 200. Then, access to value information such as an electronic ticket or electronic money in the IC chip 100 is permitted through verification of a PIN such as a PIN.
[0120]
[Supplement]
The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiment without departing from the gist of the present invention. That is, the present invention has been disclosed in the form of exemplification, and the contents described in the present specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims section described at the beginning should be considered.
[0121]
【The invention's effect】
As described in detail above, according to the present invention, an excellent data transfer system and data transfer method, value information transfer service device, and value information transfer, which can securely transfer value information such as electronic money and electronic tickets, etc. A service method and a storage medium can be provided.
[0122]
In addition, according to the present invention, it is possible to securely move value information such as electronic money and electronic tickets held in an IC card or IC chip, an excellent data transfer system, data transfer method, and value information transfer. A service device, a value information transfer service method, and a storage medium can be provided.
[0123]
Further, according to the present invention, an excellent data transfer system and data transfer capable of securely moving a plurality of value information held in an IC card or an IC chip only by connecting to one server. A method, a value information transfer service device, a value information transfer service method, and a storage medium can be provided.
[0124]
According to the present invention, the access key of the value information for movement and the value information itself need not be stored in the value transfer server, but are stored in the SAM of the service provider that operates the value information. Therefore, it is possible to clearly separate the responsibility range of the value information mobile operator and each service provider operating the value information service.
[0125]
Further, according to the present invention, when a plurality of value information in the IC chip must be moved, each communication device for the value information transfer source IC chip and the value information transfer destination IC chip is It is sufficient to connect to only one value transfer server. Therefore, it is not necessary for the communication apparatus to sequentially switch communication for each value information service manually or automatically. For this reason, labor can be reduced and the possibility of communication failure can be reduced. In this case, considering from the IC chip side, if it is connected to one value transfer server, there is no need to be aware of the existence of the SAM of each service provider as a relay destination.
[0126]
In addition, according to the present invention, the key for accessing the value information is changed to the “temporary key” before the movement, and the key is returned to the real key after the movement is completed. Can be prevented from being duplicated or tampered with. Even if the transfer of the value information fails, the loss of the value information can be prevented by returning the source key to the real key.
[Brief description of the drawings]
FIG. 1 is a diagram schematically showing a configuration of a network system that realizes secure movement of value information.
FIG. 2 is a flowchart showing a processing procedure for securely transferring value information between IC chips on the network system according to the present embodiment.
FIG. 3 is a sequence diagram showing a processing procedure for uploading value information held in a movement source IC chip to a movement SAM 12 of each service provider.
FIG. 4 is a sequence diagram showing a processing procedure for downloading value information uploaded to a migration SAM 12 of each service provider to a migration source IC chip.
FIG. 5 is a diagram conceptually showing a mechanism of wireless communication between a reader / writer based on electromagnetic induction and an IC card.
FIG. 6 is a diagram modeling a system composed of a reader / writer and an IC card as a single transformer.
7 is a diagram schematically showing an internal hardware configuration of a portable terminal 110 of a type incorporating an IC chip 100. FIG.
[Explanation of symbols]
10 ... Application server (service provider)
11 ... Normal SAM
12 ... SAM for movement
20 ... Value transfer server
21 ... SAM for management
100 ... IC chip
101. Antenna part
102 ... Analog part
103 ... Digital control unit
104 ... Memory
105 ... External interface
110: Mobile terminal
112 ... display section
113 ... User input section
114: Information storage unit
200: Reader / Writer

Claims (9)

A data transfer system for transferring value information between IC chips,
When moving the value information in the IC chip, the value information is provided with a management SAM storing a key change logic for changing the key of the IC chip from a normal key during normal use to a temporary temporary key. Server,
A normal SAM storing a normal key and a normal use logic for normal use of the value information, which are provided in an application server installed by a provider who provides the value information service, and which is used when the value information in the IC chip is normally used; And a transfer SAM storing a temporary key issued by the management SAM of the value information transfer server and a transfer logic for transferring the value information,
A connection means for connecting between the IC chip and the value information transfer server, between the value information transfer server and the transfer SAM, and between the IC chip and the transfer SAM;
The management SAM of the value information transfer server communicates with the transfer source IC chip via the connection means, and a key for accessing the value information in the transfer source IC chip is obtained according to the key change logic. To the temporary key, the normal SAM in the provider cannot access the value information in the source IC chip using the normal use logic, and the transfer SAM uses the transfer logic to move to the source A key changing means for making it possible to access value information in the IC chip of
In response to a request from the value information transfer server, the transfer SAM communicates with the transfer source IC chip via the connection means, and performs mutual authentication using the temporary key in the transfer source IC chip. Uploading means for uploading value information from the source IC chip to the transfer SAM according to the transfer logic;
An initialization unit that communicates with the destination IC chip via the connection unit, and initializes the destination IC chip using a temporary key;
In response to a request from the value information transfer server, the transfer SAM communicates with the transfer destination IC chip via the connection means, and performs mutual authentication using a temporary key in the transfer destination IC chip. Download means for downloading the value information uploaded from the movement source IC chip to the movement destination IC chip according to the movement logic;
When the transfer SAM has completed the transfer of the value information to the destination IC chip, the management SAM of the value information transfer server uses the temporary key in the transfer destination IC chip according to the key change logic. The normal key SAM in the provider can access the value information in the destination IC chip using the normal use logic;
Comprising
SAM (Secure Application Module) is a tamper-resistant hardware module. Each SAM and IC chip mutually authenticate with a key stored in each other, and access to value information in the IC chip according to the logic stored in the SAM. Do,
A data transfer system characterized by that. Multiple types of value information can be stored in the IC chip,
The provider installs an application server that prepares a normal SAM and a mobile SAM for each type of value information,
The value information moving server detects all types of value information stored in the source IC chip, identifies the application server moving SAM installed by the provider managing each value information,
For all value information in the transfer source IC chip, the upload means repeatedly uploads the value information from the transfer source IC chip to the transfer SAM,
For all value information uploaded to the transfer SAM, the download means repeatedly downloads the value information from the transfer SAM to the transfer destination IC chip.
The data transfer system according to claim 1. A value information transfer server having a management SAM storing key change logic for changing a key of an IC chip from a normal key during normal use to a temporary key, and a provider that provides a value information service are installed. A temporary SAM storing a normal key used for normal use of the real key and value information normally used when the value information stored in the IC chip is used, and a temporary SAM issued by the management SAM of the value information transfer server. A data transfer method for transferring value information between IC chips in a data transfer system including an application server having a transfer SAM storing transfer logic for transferring a key and value information, Between the IC chip and the value information transfer server, Between the value information transfer server and the transfer SAM, IC chip and the transfer SA During are connected via a predetermined connection means,
The management SAM of the value information transfer server communicates with the transfer source IC chip via the connection means, and a key for accessing the value information in the transfer source IC chip is obtained according to the key change logic. A key change step for changing from a temporary key to a temporary key;
In response to a transfer request from the value information transfer server, the transfer SAM communicates with the transfer source IC chip via the connection means, and uses the temporary key in the transfer source IC chip. An upload step of authenticating and uploading value information from the source IC chip to the transfer SAM according to the transfer logic;
An initialization step in which the management SAM of the value information transfer server communicates with the destination IC chip via the connection means, and initializes the destination IC chip using a temporary key;
In response to a request from the value information transfer server, the transfer SAM communicates with the transfer destination IC chip via the connection means, and performs mutual authentication using a temporary key in the transfer destination IC chip. Download step of downloading the value information uploaded from the source IC chip according to the transfer logic to the destination IC chip;
When the transfer SAM completes the transfer of the value information to the destination IC chip, the management SAM changes the temporary key to the real key in the destination IC chip according to the key change logic. Steps,
Comprising
SAM (Secure Application Module) is a tamper-resistant hardware module. Each SAM and IC chip mutually authenticate with a key stored in each other, and access to value information in the IC chip according to the logic stored in the SAM. Do,
A data transfer method characterized by the above. Multiple types of value information can be stored in the IC chip,
The provider installs an application server that prepares a normal SAM and a mobile SAM for each type of value information,
The value information transfer server detects all types of value information stored in the source IC chip, and specifies a transfer SAM of an application server installed by a provider managing each value information Further comprising
For all value information in the transfer source IC chip, the upload of the value information from the transfer source IC chip to the transfer SAM in the upload step is repeated,
For all value information uploaded to the transfer SAM, the download of the value information from the transfer SAM to the transfer destination IC chip in the download step is repeated.
The data transfer method according to claim 3, wherein: Stores a normal SAM storing normal key and normal use logic used when the value information stored in the IC chip is normally used, and a transfer logic for moving the value information by moving the value information using the temporary key. in the data transfer system of claim 1, value information service is provided by a provider to install the application server with moving SAM that, the movement of the value information between IC chip as said value information moved server A value information transfer service device for managing
Rutotomoni a management for SAM storing the key change logic to change the key of the IC chip to the temporary temporary key from the key at the time of normal use, between the IC chip, between the moving SAM, The IC chip and the moving SAM are connected via a predetermined connection means,
The management SAM communicates with the movement source IC chip via the connection means to access the value information in the movement source IC chip before uploading the value information from the movement source IC chip to the movement SAM. A key to be changed from a real key to a temporary key according to the key change logic, communicate with the destination IC chip via the connection means, initialize the destination IC chip using the temporary key, and After downloading the value information from the SAM to the destination IC chip after initialization, the temporary key is changed to the real key in the destination IC chip according to the key change logic, and the normal SAM in the provider Use value logic to make it possible to access value information in the destination IC chip,
SAM (Secure Application Module) is a tamper-resistant hardware module. Each SAM and IC chip mutually authenticate with a key stored in each other, and access to value information in the IC chip according to the logic stored in the SAM. Do,
A value information transfer service device characterized by that. Multiple types of value information can be stored in the IC chip,
The provider installs an application server that prepares a normal SAM and a mobile SAM for each type of value information,
A means for detecting all types of value information stored in the source IC chip, and for specifying a SAM for movement of an application server installed by a provider managing each value information;
For all value information in the source IC chip, repeat the upload request of the value information from the source IC chip to the transfer SAM by the upload request means,
Repeating the download request of the value information from the transfer SAM to the transfer destination IC chip by the download request means for all the value information uploaded to the transfer SAM.
The value information transfer service device according to claim 5, wherein: Stores a normal SAM storing normal key and normal use logic used when the value information stored in the IC chip is normally used, and a transfer logic for moving the value information by moving the value information using the temporary key. 2. The data transfer system according to claim 1, wherein a value information service is provided by a provider that installs an application server having a mobile SAM, wherein the value information transfer server constructed using a computer is an IC chip. A value information transfer service method for managing the transfer of value information between IC chips using a management SAM storing a key change logic for changing a key from a normal key during normal use to a temporary temporary key. There,
Before the management SAM uploads the value information from the movement source IC chip to the movement SAM, the management SAM communicates with the movement source IC chip via the connection means, and the value information in the movement source IC chip. Changing a key for accessing the key from a real key to a temporary key according to the key change logic;
The management SAM communicates with the destination IC chip via the connection means, and initializes the destination IC chip using a temporary key;
After downloading the value information from the transfer SAM to the destination IC chip after initialization, the management SAM changes the temporary key to the real key in the destination IC chip according to the key change logic, Allowing the normal SAM in the provider to access the value information in the destination IC chip using the normal use logic;
Comprising
SAM (Secure Application Module) is a tamper-resistant hardware module. Each SAM and IC chip mutually authenticate with a key stored in each other, and access to value information in the IC chip according to the logic stored in the SAM. Do,
A value information transfer service method characterized by the above. Multiple types of value information can be stored in the IC chip,
The provider installs an application server that prepares a normal SAM and a mobile SAM for each type of value information,
A step of detecting all types of value information stored in the source IC chip and identifying a SAM for movement of an application server installed by a provider managing each value information;
For all value information in the transfer source IC chip, repeat the upload request of value information from the transfer source IC chip to the transfer SAM in the upload request step,
Repeating the download request of the value information from the transfer SAM to the transfer destination IC chip in the download request step for all the value information uploaded to the transfer SAM.
8. The value information transfer service method according to claim 7. Stores a normal SAM storing normal key and normal use logic used when the value information stored in the IC chip is normally used, and a transfer logic for moving the value information by moving the value information using the temporary key. in the data transfer system of claim 1, value information service is provided by a provider to install the application server with moving SAM that, computer, temporarily key IC chip from the key at the time of normal use In a computer-readable format, the management SAM storing key change logic for changing to a temporary key is used to execute processing as a value information transfer server that manages the transfer of value information between IC chips. A written computer program for the computer
Before uploading value information from the source IC chip to the transfer SAM, a key for communicating with the source IC chip via the connection means to access the value information in the source IC chip To change from a real key to a temporary key according to the key change logic of the management SAM;
A procedure in which the management SAM communicates with a destination IC chip via the connection means to initialize the destination IC chip using a temporary key;
After downloading the value information from the transfer SAM to the destination IC chip after initialization, the management SAM changes the temporary key to the real key in the destination IC chip according to the key change logic, A procedure for allowing a normal SAM in the provider to access value information in a destination IC chip using the normal use logic;
And execute
SAM (Secure Application Module) is a tamper-resistant hardware module. Each SAM and IC chip mutually authenticate with a key stored in each other, and access to value information in the IC chip according to the logic stored in the SAM. Do,
A computer program characterized by the above.

Images