JP4385604B2 - IC card with download program erasing function and download program erasing method for the card - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an IC card capable of downloading a program in accordance with a download program stored in a rewritable nonvolatile memory, and in particular, an IC with a download program erasure function capable of erasing a download program used for downloading the program. The present invention relates to a card and a download program erasing method for the card.
[0002]
[Prior art]
Recently, a card on which an IC chip is mounted, that is, an IC card has been widely used. This IC chip includes a CPU that performs arithmetic processing and control of each unit, and a rewritable nonvolatile memory. As the rewritable nonvolatile memory, generally an EEPROM (Electrically Erasable and Programmable Read Only Memory) is used (see, for example, Non-Patent Document 1). Recently, as described in Non-Patent Document 1, IC cards that can be downloaded from the outside to a rewritable nonvolatile memory (EEPROM) of various applications (application programs) have appeared. . With the advent of such an IC card, it is possible to upgrade an application and add an application even after the IC card is issued (distributed), and the versatility is greatly increased.
[0003]
[Non-Patent Document 1]
“Maos Platforms Technical Status Report”, [online], April 10, 2000, Europoay International SA, p.26-27, [Search April 10, 2002], Internet <URL: http: // webbox3 .noveous.net / multoslib / pdf / 00-04-10% 20Europay-maos-report.pdf>
[0004]
[Problems to be solved by the invention]
In order to download an application to a rewritable nonvolatile memory (EEPROM) in the IC card, it is necessary to have a program for controlling the download, that is, a download program in the IC card. With this download program, it is possible to download not only an application (application program) but also an OS called an IC card OS (operating system), which is basic software of an IC card, for example.
[0005]
However, the download program is generally stored in advance in a non-rewritable nonvolatile memory such as a ROM (non-programmable read-only memory) or a PROM (programmable read-only memory). For this reason, the download program remains in the IC card even after the download of the application (program) is completed. With such an IC card, there is a possibility that an application (program) may be downloaded illegally.
[0006]
The present invention has been made in view of the above circumstances, and its purpose is to delete a download program that can prevent the program from being illegally downloaded by enabling the download program to be deleted after the download of the program according to the download program is completed. It is an object to provide an IC card with a function and a method for deleting a download program in the card.
[0007]
[Means for Solving the Problems]
  The present invention solves such a problem, and the invention according to claim 1 is an IC card with a download program erasing function capable of erasing a download program for downloading a program, wherein the download programTheFor storingDownload area including the first area was securedRewritable nonvolatile memory,Stored in the first area of the rewritable nonvolatile memoryThe rewritable nonvolatile memory according to the download programFor downloading a program different from the download program to a second area different from the first area of the download areaDownload means for executing program download;in frontBefore download meansRecordAfter program download is completeAnd before issuing the IC cardThe rewritable nonvolatile memory for the download programSaid first region ofAnd an erasing unit for erasing from the IC card with a download program erasing function.
[0008]
The invention according to claim 2 is the IC card with download program erasure function according to claim 1, wherein the erasure means erases the download program according to a predetermined erasure program.
[0009]
  According to a third aspect of the present invention, there is provided an IC card with a download program erasing function according to the second aspect, wherein the erasing program is the rewritable nonvolatile memory.Said first region ofAnd the erasing means is the rewritable nonvolatile memorySaid first region ofThe erasing program itself is erased according to the erasing program stored in the memory.
[0010]
According to a fourth aspect of the present invention, in the IC card with a download program erasing function according to the third aspect, the erasure program is a specific call instruction executed after erasure of the download program according to the erasure program is completed. A specific call instruction for calling a specific function used for erasing the erasure program, and the erasure means, when the specific function is called by the specific call, the erasure program according to the specific function It is characterized by erasing.
[0011]
  The invention according to claim 5 is the rewritable nonvolatile memory according to claim 2 or 3, wherein the erasing means stores a program to be erased. ofSaid first regionFollow the erase program toDisappearBy writing last dataEligible for deletionIt is characterized by erasing the program.
[0012]
  The invention according to claim 6 is the IC card with download program erasing function according to claim 5,An erasure check means is further provided, and the erasure means erases the program to be erased stored in the first area by repeatedly writing predetermined erase data of 1 byte in the first area. The erasure check meansWhether the program has been successfully erased by the eraser, At least the first byte and the last byte of the first area areSaid1 bytePredetermined erase dataIsJudgment byRukoAnd features.
[0013]
The invention according to claim 7 is the IC card with a download program erasing function according to claim 1, wherein after the download of the program to the rewritable nonvolatile memory by the download means according to the download program is completed, Inquiry means for inquiring to the operator of the electronic device via the connected electronic device whether to delete the download program is further included, and the deletion means deletes the download program in response to the inquiry by the inquiry means. When this is specified, the download program is erased.
[0014]
The invention according to claim 8 is the programmable read-only nonvolatile memory in which the flag area for indicating that the download program has been erased is secured in the IC card with download program erase function according to claim 1 And a flag writing means for writing a specific flag in the flag area of the programmable read-only nonvolatile memory when the download program is successfully erased.
[0015]
  The invention according to claim 9 is:TheDownload program for downloading programsA rewritable nonvolatile memory in which a download area including a first area to be stored is secured, download means, and erase means are provided.A method for erasing a download program in an IC card,The download means is in accordance with the download program stored in the first area of the rewritable nonvolatile memory.Rewritable non-volatile memoryFor downloading a program different from the download program to a second area different from the first area of the download areaDownload programThe fruitStep to run and beforeRecordAfter program download is completeAnd before issuing the IC cardInThe erasing means isThe rewritable nonvolatile memory for the download programSaid first region ofA method for deleting a downloaded program in an IC card.
[0016]
  In the invention which concerns on Claim 1 or Claim 9, the rewritable non-volatile memoryStored in the first area ofAccording to the download program stored inFor downloading a program different from the download program to a second area different from the first area of the download areaThe program download is executed by the download means. After completion of the program download according to the download program by this download meansAnd before issuing an IC cardThe download program isFrom the first area of the rewritable nonvolatile memoryIt is erased by the erasing means.
[0017]
After completing the program download in this wayBefore IC card issuanceIn addition, by deleting the download program, it is possible to prevent the program from being illegally downloaded to the IC card.
[0018]
Next, in the invention according to claim 2, erasing of the download program by the erasing means is performed according to a predetermined erasing program. As a result, the download program can be erased simply by preparing an erase program.
[0019]
  Next, in the invention according to claim 3, the rewritable nonvolatile memoryFirst region ofAccording to the erasure program stored in, not only the download program but also the erasure program itself is erased by the erasure means. Thereby, it is possible to prevent other programs and the like from being accidentally erased by the erase program.
[0020]
Next, in the invention according to claim 4, when the erasure of the download program according to the erasure program is completed, the specific call instruction included in the erasure program is executed to call the specific function. Then, the erasing program is erased by the erasing means in accordance with the called specific function. That is, erasing of the erasing program itself according to the erasing program is easily realized.
[0021]
  Next, in the invention according to claim 5, a program to be erased, that is, a download program, or a rewritable nonvolatile memory in which a download program and an erase program are stored.FirstIn the area, follow the erase program by the eraserDisappearLast data is written. Thereby, the download program or the download program and the erasure program can be easily erased.
[0022]
  Next, in the invention according to claim 6,The erasing means erases the program to be erased by repeatedly writing 1-byte predetermined erase data to the first area,Whether or not the program was successfully erased by the eraser,At least the first byte and the last byte of the first areathe above1 bytePredetermined erase dataIsIt can be easily determined by checking whether or not the erasure check means.
[0023]
Next, in the invention according to claim 7, when the program download to the rewritable non-volatile memory is completed, the operator of the electronic device may delete the download program via the electronic device connected to the IC card. Is inquired by inquiry means. When erasure of the download program is designated in response to this inquiry, the download program is erased by the erasure means. As described above, since the download program is erased according to the designation of the operator (for example, user) of the electronic device, the operator only needs to designate the erasure of the download program only when necessary, and downloads a plurality of programs. In this case, it is not necessary to perform an operation for writing the download program to the rewritable nonvolatile memory in the corresponding IC card each time.
[0024]
Next, in the invention according to claim 8, when the download program can be normally erased, the specific flag is written into the flag area of the programmable read-only nonvolatile memory by the flag writing means. As a result, it is possible to easily determine whether the corresponding IC card is an erased card of the download program simply by referring to this flag area.
[0025]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of an IC card 10 with a download program erasing function according to an embodiment of the present invention.
[0026]
The IC card 10 shown in FIG. 1 is, for example, a contact type IC card. This IC card 10 includes a ROM (Read Only Memory) 11, a PROM (Programmable ROM) 12, an EEPROM (Electrically Erasable and Programmable ROM) 13, a RAM (Random Access Memory) 14, a CPU 15, a communication interface 16, Consists of
[0027]
The ROM 11 is a read-only memory (a non-programmable read-only nonvolatile memory). The ROM 11 has a routine necessary for outputting a reset signal for resetting the inside of the IC card 10 when the IC card 10 is initialized, and a write command (physical write command) from the external device to the EEPROM 13 in the IC card 10. ) (For example, DLP 132a and EP 132b, which will be described later) are stored in advance in a routine (not shown) necessary for writing.
[0028]
The PROM 12 is a programmable read-only memory (programmable read-only nonvolatile memory). The specific address of the PROM 12 is assigned to a flag area 120 for storing a specific flag indicating that a later-described DLP 132a is an erased IC card 10.
[0029]
The EEPROM 13 is a rewritable nonvolatile memory. The area of the EEPROM 13 is mainly allocated to a system area 131, a download area (hereinafter referred to as a DL area) 132, and a data area 133, which are management areas.
The system area 131 is used for storing information necessary for managing the system, such as a key (chip KEY) unique to the IC card 10 (IC chip mounted on the IC card 10).
[0030]
The DL area 132 includes programs related to program download, such as a download program (hereinafter referred to as DLP) 132a and an erase program (hereinafter referred to as EP) 132b, and a downloaded program, such as an OS (IC card OS). It is used to store 132c and various applications 132d. The DLP 132a is a program for downloading various programs. Here, the OS 132c and various applications 132d are downloaded by the DLP 132a. The EP 132b is a program for deleting the DLP 132a.
[0031]
The area of the RAM 14 is used as a work area for the CPU 15. The RAM 14 has a stack 140 for storing a return value indicating the return destination of the program.
[0032]
The CPU 15 executes various applications 132d according to the OS 132c. Further, the CPU 15 executes the DLP 132a according to an instruction from the outside. Further, the CPU 15 executes the EP 132b automatically in response to the completion of the execution of the DLP 132a or in response to an instruction from the outside. The CPU 15 further inputs / outputs data to / from an external device (electronic device) via the communication interface 16.
[0033]
Next, an outline of the operation of the embodiment of the present invention will be described with reference to the system configuration diagram of FIG. 2 and the flowchart of FIG. First, when the IC card 10 having the configuration shown in FIG. 1 is issued, the IC card 10 is inserted into the card slot 21 of the host (electronic device) 20 as shown in FIG. As a result, the IC card 10 is connected to the host 20. In this state, the host 20 can exchange data with the IC card 10.
[0034]
While being connected to the IC card 10, the host 20 performs an operation for writing the DLP 132a and the EP 132b in the DL area 132 secured in the EEPROM 13 in the IC card 10 (step S1). This write operation is performed by issuing a physical write command from the host 20 to the IC card 10.
[0035]
The host 20 activates the DLP 132a when the writing of the DLP 132a and the EP 132b to the DL area 132 is normally performed. Thereby, the CPU 15 in the IC card 10 functions as a download unit, and downloads the OS 132c and the application 132d to the DL area 132 in the EEPROM 13 according to the DLP 132a (step S2).
[0036]
When the OS 132c and the application 132d are all successfully downloaded to the DL area 132 in the EEPROM 13, the EP 132b is activated. Thereby, the CPU 15 functions as an erasing unit, and erases the DLP 132a written in the DL area 132 in accordance with EP 132b (step S3). The IC card 10 issued to the user is an IC card from which this DLP 132a has been deleted.
[0037]
Thus, in this embodiment, when the IC card 10 is issued, the program (OS 132c and application 132d) is downloaded to the DL area 132 secured in the EEPROM 13 of the IC card 10 according to the value of the DLP 132a. Then, after the download of this program is completed, the DLP 132a is automatically deleted. Thereby, it is possible to prevent the program from being illegally downloaded to the IC card 10 after the IC card 10 is issued.
[0038]
Next, details of the processing in step S1, that is, the processing for writing the DLP 132a and EP 132b to the DL area 132 secured in the EEPROM 13 of the IC card 10 will be described with reference to the flowchart of FIG.
[0039]
First, the host 20 sends a chip KEY to the IC card 10 to perform a chip KEY check by the IC card 10 (step S11). This chip KEY check is performed by the CPU 15 comparing the chip KEY sent from the host 20 with the chip KEY stored at a predetermined position in the system area 131 secured in the EEPROM 13. If both chips KEY match, the CPU 15 determines that the IC card 10 is a legitimate IC card that is allowed to download a program, and notifies the host 20 to that effect.
[0040]
When the IC card 10 is a valid IC card, the host 20 sequentially writes DLP data constituting the DLP 132a from a predetermined address of the DL area 132 in the EEPROM 13, for example, the head address (step S12). As a result, the DLP 132a is stored in the area starting from the start address of the DL area 132, as shown in FIG. That is, in this embodiment, the head address of the area where the DLP 132a is stored is made to coincide with the head address of the DL area 132. As a result, it is possible to easily establish that the DLP 132a is stored in the DL area 132. When the DLP 132a is not stored in the DL area 132, the leading portion of the DL area 132 has the same value representing a blank (or erased state).
[0041]
Next, the host 20 sequentially writes the EP data constituting the EP 132b in a predetermined area in the DL area 132 having a size matching the size of the EP 132b, for example, the final area (step S13). As a result, the EP 132b is stored in the final area of the DL area 132 as shown in FIG.
[0042]
When the host 20 finishes writing the DLP 132a and the EP 132b, the host 20 reads the status of the IC card 10 to perform a status check to determine whether or not the writing of the DLP 132a and the EP 132b has been completed normally (step S14). As a result of this status check, the host 20 activates the DLP 132a if it can be determined that the writing of the DLP 132a and EP 132b has been completed normally (step S15). As a result, the process of step S2, that is, the program download process according to the DLP 132a is executed.
[0043]
Next, details of the process of step S2 (program download process according to DLP 132a) will be described with reference to the flowchart of FIG.
First, the CPU 15 downloads the OS 132c and the application 132d in accordance with the DLP 132a into an area in the DL area 132 secured in the EEPROM 13 that is different from the area where the DLP 132a and the EP 132b are stored (Step S21). Next, the CPU 15 performs a status check for determining whether or not the download of the OS 132c and the application 132d has been normally completed (step S22). If the host 20 determines that the download of the OS 132c and the application 132d has been normally completed as a result of the status check, the host 20 activates the EP 132b (step S23). As a result, the process of step S3, that is, the DLP erasure process according to EP132b is executed.
[0044]
Next, details of the process of step S3 (DLP erasing process according to EP132b) will be described with reference to the flowchart of FIG.
First, the CPU 15 sets, for example, predetermined erase data of 1 byte for erasing the DLP 132a stored in the head area of the DL area 132 secured in the EEPROM 13 in the RAM 14 according to the EP 132b (step S31). Next, the CPU 15 repeatedly writes the set erase data continuously in the head area of the DL area 132, that is, in the area where the DLP 132a is stored in the DL area 132 (hereinafter referred to as the DLP area) (step S32). ).
[0045]
The CPU 15 functions as an erasure check unit when writing of the erasure data to the DLP area is completed, and performs an erasure check for checking whether or not the DLP 132a stored in the DLP area has been correctly erased as follows (step) S33). First, the CPU 15 checks whether, for example, the first byte of the DLP area is erased data (step S33a). Next, the CPU 15 checks whether, for example, the last byte in the DLP area is erased data (step S33b).
[0046]
If the CPU 15 determines that both the first byte and the last byte of the DLP area are erased data by the erase check (step S33), the CPU 15 determines that the DLP 132a has been correctly erased (step S34). In this case, the CPU 15 functions as a flag writing means, and writes a specific flag indicating that the DLP 132a has been erased in the flag area 120 secured at the specific address of the PROM 12 (step S35). By writing the specific flag in the flag area 120, it is possible to determine whether the corresponding IC card 10 is an IC card from which the DLP 132a has been deleted simply by referring to the flag area 120. Further, by writing a specific flag in the flag area 120, it is possible to prohibit a new program download for the IC card 10 from which the DLP 132a has been deleted.
[0047]
On the other hand, if the CPU 15 determines that at least one of the first and last bytes of the DLP area is other than erased data by the erase check (step S33), the CPU 15 determines that the DLP 132a has not been erased correctly (step S34). ). In this case, the CPU 15 locks the application 132d so that the application 132d downloaded to the DL area 132 cannot be used (step S36). The lock of the application 132d is realized by changing a flag indicating that the application 132d can be executed to another value.
[0048]
When step S35 or S36 is executed in accordance with EP 132b, control is transferred to the main routine of the OS 132c, for example.
[0049]
[First Modification]
Next, the 1st modification in one Embodiment of this invention is demonstrated.
First, the first modification is characterized in that the EP 132b itself is erased by the EP 132b for erasing the DLP 132a. Therefore, in the first modified example, as shown in FIG. 7, a specific function SF that is called from the EP 132 b and is used to erase the EP 132 b is stored in advance at a specific address in the ROM 11, for example. In addition, the EP 132b calls the specific call instruction CALL that calls the specific function SF in order to delete the EP 132b itself after the deletion of the DLP 132a is completed._{science fiction}(See FIG. 7). This specific call instruction CALL_{science fiction}Is the last executed instruction in EP132b. Further, as shown in FIG. 7, the OS 132c includes an erasure check routine ECR that is executed after the erasure of the DLP 132a and the EP 132b is completed. This erasure check routine ECR may be stored in a predetermined area of the ROM 11, for example, independently of the OS 132c.
[0050]
Next, the outline of the operation of the first modification in one embodiment of the present invention will be described with reference to the flowchart of FIG.
When the CPU 15 executes the process of step S2 in the flowchart of FIG. 3 (program download process according to DLP132a), the process shown in the flowchart of FIG. 8 replaces the process of step S3 in the flowchart (DLP erase process according to EP132b). Steps S41 and S42 are executed. That is, the CPU 15 first functions as an erasing unit, and executes a process (step S41) for erasing the DLP 132a and the EP 132b itself according to the EP 132b. Next, the CPU 15 functions as an erasure check unit, and executes a process (step S42) for checking whether the DLP 132a and the EP 132b have been correctly erased according to the erasure check routine ECR. Thus, by deleting not only the DLP 132a but also the EP 132b itself according to the EP 132b, it is possible to prevent other programs and the like from being erroneously deleted by the EP 132b.
[0051]
Next, details of the processes of steps S41 and S42 will be described with reference to the flowchart of FIG.
When the DLP 132a is activated at the end of the program download in step S2 (step S15), the CPU 15 executes the following processing according to the DLP 132a.
[0052]
First, the CPU 15 loads a return value indicating the erase check routine ECR (for example, the start address of the erase check routine ECR) on the stack 140 secured in the RAM 14 (step S51). Next, the CPU 15 sets, for example, 1-byte erase data in the RAM 14 for erasing the DLP 132a stored in the head area of the DL area 132 secured in the EEPROM 13 (step S52). Next, the CPU 15 repeatedly writes the set erase data continuously in the head area of the DL area 132, that is, the DLP area (step S53).
[0053]
In the first modification of the present embodiment, when the process of writing erase data in the DLP area (step S53) is completed according to EP 132b, the specific call instruction CALL, which is the last instruction of the EP 132b._{science fiction}Is executed by the CPU 15. As a result, the specific function SF stored in the specific address of the ROM 11 is called (step S54). At this time, in the specific function SF, the last address of the DL area 132, that is, the start address and size of the area where the EP 132b is stored in the DL area 132 (hereinafter referred to as the EP area), and the bytes that match the size. A number of erase data as write data is passed as an argument. The specific function SF is a function that controls data writing.
[0054]
CPU15, specific call instruction CALL_{science fiction}By executing the specific function SF called by the above, erase data is written to the EP area in the DL area 132 (step S55). When executing the specific function SF, the CPU 15 starts an erasure check routine ECR specified by the return value according to the return value stored in the stack 140 in the RAM 14 (step S56).
[0055]
Then, according to the erasure check routine ECR, the CPU 15 performs an erasure check for checking whether the DLP 132a and EP 132b stored in the DLP area and EP area in the DL area 132 have been correctly erased as follows (step S57). ). First, the CPU 15 checks whether, for example, the first byte and the last byte of the DLP area are erased data, respectively, in the same manner as in steps S33a and S33b (steps S57a and S57b). Further, the CPU 15 checks whether, for example, the first byte and the last byte of the EP area are erase data (steps S57c and S57d).
[0056]
If the CPU 15 determines that both the first and last bytes of the DLP area and the first and last bytes of the EP area are erased data by the erasure check (step S57), the DLP 132a and EP132b are correctly erased. Is determined (step S58). In this case, the CPU 15 functions as a flag writing means, and writes a specific flag in the flag area 120 of the PROM 12 as in step S35 (step S59). On the other hand, if it is determined that at least one of the first and last bytes of the DLP area and the first and last bytes of the EP area is other than erased data, the CPU 15 correctly erases at least one of the DLP 132a or EP132b. It is determined that it has not been performed (step S58). In this case, the CPU 15 locks the application 132d downloaded to the DL area 132 as in step S36 (step S60).
[0057]
When step S59 or S60 is executed in accordance with the erase check routine ECR, control is transferred to the main routine of the OS 132c, for example.
[0058]
Thus, in the first modification of the present embodiment, not only the DLP 132a but also the EP 132b itself can be erased by the EP 132b. In the first modification, the IC card 10 from which both the DLP 132a and the EP 132b are erased is issued to the user.
[0059]
[Second Modification]
Next, a second modification of the embodiment of the present invention will be described.
Furthermore, the feature of the second modification is that the DLP 132a is erased by the user's instruction every time the program is downloaded to the IC card 10 issued to the user by the user's instruction.
[0060]
Assume that the IC card 10 having the configuration shown in FIG. 1 is issued to the user. It is assumed that the IC card 10 is an IC card issued by applying the first modification. Therefore, the OS 132c and the application 132d are downloaded into the DL area 132 secured in the EEPROM 13 of the IC card 10 as shown in FIG. On the other hand, DLP 132 a and EP 132 b are erased from DL region 132. Further, it is assumed that the application 132d downloaded to the DL area 132 at the time of issuing the IC card 10 is a basic application prepared as a standard in the IC card 10.
[0061]
When the user wants to download the application 132d other than the basic application to the IC card 10, the IC card 10 is inserted into the card slot 31 of the terminal (electronic device) 30 as shown in FIG. Thereby, the IC card 10 is connected to the terminal 30. In this state, the terminal 30 can exchange data with the IC card 10. Therefore, when the user operates the terminal 30, the application 132 d designated by the user can be downloaded to the DL area 132 secured in the EEPROM 13 of the IC card 10 by the terminal 30.
[0062]
Hereinafter, an operation when the user-specified application 132d by the terminal 30 is downloaded to the IC card 10 will be described with reference to a flowchart of FIG.
[0063]
First, the terminal 30 writes predetermined DLP 132a and EP 132b in the DL area 132 secured in the EEPROM 13 in the IC card 10 in accordance with a user operation while being connected to the IC card 10 as shown in FIG. The operation | movement for this is performed (step S71). This step S71 is the same as the writing of the DLP 132a and EP 132b by the host 20 when the IC card 10 is issued (step S1). However, in step S71, well-known user authentication is performed in the terminal 30 (step S71a), and writing of the DLP 132a and EP 132b is executed only when the authentication is successful, that is, when the user is a valid user.
[0064]
The terminal 30 activates the DLP 132a when the DLP 132a and the EP 132b are normally written in the DL area 132. Thereby, the CPU 15 in the IC card 10 functions as a download unit, and downloads the application 132d designated by the user via the terminal 30 to the DL area 132 in the EEPROM 13 according to the DLP 132a (step S72). This step S72 is the same as the download of the OS 132c and the application 132d according to the DLP 132a when the IC card 10 is issued (step S2) except that the user-specified EP 132b is downloaded.
[0065]
When the user-specified application 132d is normally downloaded to the DL area 132 in the EEPROM 13 in accordance with the DLP 132a, the EP 132b is activated. Then, the CPU 15 functions as an inquiry unit, and transmits a DLP deletion inquiry instruction for inquiring of the user whether or not to delete the DLP 132a to the terminal 30 via the communication interface 16 according to EP 132b (step S73). This DLP deletion inquiry instruction is displayed on the screen by the terminal 30. As a result, the user is inquired whether to delete the DLP 132a. The user performs an operation of selecting whether or not to delete the DLP 132a on the DLP deletion inquiry screen displayed on the terminal 30. The result of this selection operation is notified from the terminal 30 to the IC card 10.
[0066]
When erasure is designated in response to the DLP erasure inquiry (step S74), the CPU 15 functions as an erasure unit and erases the DLP 132a and the EP 132b itself in accordance with EP 132b (step S75) as in step S41. The CPU 15 functions as an erasure check means, and checks whether the DLP 132a and EP 132b have been correctly erased according to the erasure check routine ECR, similarly to step S42 (step S76).
[0067]
As described above, in the second modification of the present embodiment, when the program download to the IC card 10 is executed according to the designation of a valid user after the IC card 10 is issued, the DLP 132a used for the download is deleted. The user can select whether or not to do so. Thereby, even if the program download to the IC card 10 is executed after the IC card 10 is issued, the program can be prevented from being illegally downloaded to the IC card 10 thereafter.
[0068]
[Third Modification]
Next, a third modification of the embodiment of the present invention will be briefly described with reference to the flowchart of FIG.
First, a feature of the third modification is that the DLP 132a is automatically deleted every time a program is downloaded to the IC card 10 issued to the user according to the user's instruction. Therefore, as shown in the flowchart of FIG. 12, when the user-specified application 132d is downloaded to the IC card 10 according to the DLP 132a (step S82), the EP 132b is activated by the DLP 132a. Then, according to EP 132b, DLP 132a and EP 132b themselves are erased (step S83).
[0069]
As described above, in the third modification example of the present embodiment, each time the program specified through the terminal 30 by the authorized user is downloaded to the IC card 10 according to the DLP 132a after the IC card 10 is issued, the DLP 132a is It is automatically deleted. As a result, even if the program download to the IC card 10 is executed in accordance with the designation of a legitimate user after the IC card 10 is issued, the program is illegally stored in the IC card 10 after that without performing any special operation. Can be downloaded.
[0070]
The IC card 10 connected to the terminal 30 in the second and third modifications is an IC card issued to the user. However, the IC card 10 may be an IC card before being issued to a user, and the operator of the terminal 30 may be a card issuer.
[0071]
In the second and third modified examples, as in the first modified example, EP 132b itself, which is a program for erasing DLP 132a, is also erased. However, similar to the above embodiment, only the DLP 132a may be deleted. However, when the EP 132b is not erased, there is a possibility that other programs and the like may be mistakenly erased by the EP 132b. Further, when the EP 132b is not erased, the EP 132b may be stored in the EEPROM 13 in advance. Further, the EP 132b may be stored in the ROM 11 in advance.
[0072]
In addition, the OS 132c and the (standard) application 132d do not necessarily need to be stored in the EEPROM 13 (the DL area 132 secured in the EEPROM 13) built in the IC card 10 issued to the user. That is, in the program download process according to the DLP 132a in step S72 or S82, it is possible to download the OS 132c and the (standard) application 132d.
[0073]
Further, the IC card 10 applied in the above embodiment and its modification is a contact type IC card. However, the IC card 10 may be a non-contact type IC card, or an IC card combining a contact type called a hybrid type and a non-contact type.
[0074]
In addition, this invention is not limited to the said embodiment and its modification, In the implementation stage, it can change variously in the range which does not deviate from the summary. Further, the above embodiment and its modifications include inventions at various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. For example, even if some constituent elements are deleted from all the constituent elements shown in the embodiment or its modification, the problems described in the column of the problem to be solved by the invention can be solved, and are described in the column of the effect of the invention. In a case where at least one of the obtained effects can be obtained, a configuration in which this configuration requirement is deleted can be extracted as an invention.
[0075]
【The invention's effect】
  As described in detail above, according to the invention according to claim 1 or claim 9, after the program download according to the download program is completed.Before IC card issuanceIn addition, since the download program is erased, it is possible to prevent the program from being illegally downloaded to the IC card.
[0076]
According to the second aspect of the invention, since the download program is erased according to the erase program, the download program can be erased only by preparing the erase program.
[0077]
Next, according to the invention of claim 3, the erasing program is stored in the rewritable nonvolatile memory, and not only the download program but also the erasing program itself is erased according to the erasing program. Therefore, it is possible to prevent other programs and the like from being accidentally erased by the erase program.
[0078]
Next, according to the invention of claim 4, when the erasure of the download program according to the erasure program is completed, the specific call instruction included in the erasure program is executed and the specific function is called, and the erasure is performed according to the specific function. Since the program is erased, the erasing of the erasing program itself according to the erasing program can be easily realized.
[0079]
  Next, according to the invention of claim 5, a program to be erased, that is, a download program, or a rewritable nonvolatile memory area in which the download program and the erase program are stored (In the first area)Since the program is erased by writing the last data, the program can be easily erased.
[0080]
  Next, according to the invention of claim 6,By repeatedly writing 1 byte of predetermined erase data to the first area, the program stored in the first area is erased.Whether or not the program was successfully erasedAt least the first byte and the last byte of the first areathe above1 bytePredetermined erase dataIsYou can easily determine whether or not it is.
[0081]
Next, according to the invention of claim 7, when the program download is completed, the operator of the electronic device connected to the IC card can be designated (selected) to delete the download program. You only need to specify erasure of the download program only when necessary. When downloading multiple programs, there is no need to perform an operation to write the download program to the rewritable nonvolatile memory in the corresponding IC card each time. It will be over.
[0082]
Next, according to the invention according to claim 8, when the download program can be normally erased, the specific flag is written in the flag area of the programmable read-only nonvolatile memory. With this, it can be easily determined whether the corresponding IC card is an erased card of the download program.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an IC card with a download program erasing function according to an embodiment of the present invention.
FIG. 2 is a block diagram showing the configuration of a system used to issue the IC card 10 of FIG.
FIG. 3 is a flowchart for explaining an outline of the operation of the embodiment;
FIG. 4 is a flowchart for explaining details of processing in step S1 in FIG. 3;
FIG. 5 is a flowchart for explaining details of processing in step S2 in FIG. 3;
6 is a flowchart for explaining details of processing in step S3 in FIG. 3;
FIG. 7 is an exemplary view showing the structure of a program applied in the first modification of the embodiment;
FIG. 8 is a flowchart for explaining the outline of the operation of the first modified example with respect to a portion different from FIG. 3;
FIG. 9 is a flowchart for explaining details of processes in steps S41 and S42 in FIG. 8;
FIG. 10 is an exemplary block diagram showing the configuration of a system applied in a second modification of the embodiment;
FIG. 11 is a flowchart for explaining the operation when a user-specified application is downloaded to the IC card 10 in the second modification.
FIG. 12 is a flowchart for explaining an operation when a user-specified application is downloaded to the IC card 10, which is applied in the third modification of the embodiment;
[Explanation of symbols]
10 ... IC card
11 ... ROM
12 ... PROM
13… EEPROM
14 ... RAM
15 ... CPU
20 ... Host
30 ... terminal
120 ... Flag area
131 ... System area
132 ... DL region
132a ... DLP (download program)
132b ... EP (erase program)
132c ... OS (Operating System)
132d ... Application
140 ... Stack
CALL_{science fiction}... specific call instructions
ECR ... Erase check routine
SF: Specific function

Claims (9)

An IC card with a download program erasure function capable of erasing a download program for downloading a program,
A rewritable nonvolatile memory the download area is secured comprising a first area for storing the downloaded program,
The download program in a second area different from the first area of the download area of the rewritable nonvolatile memory according to the download program stored in the first area of the rewritable nonvolatile memory Download means for executing a program download for downloading a program different from the program ;
By comprising an erasing means for erasing the downloaded program before and issuance of the IC card after the completion of the download before Kipu program from said first region of said rewritable non-volatile memory according to prior Symbol downloading means IC card with download program erasing function. 2. The IC card with a download program erasure function according to claim 1, wherein the erasure means erases the download program in accordance with a predetermined erasure program. The erase program is stored in the first area of the rewritable nonvolatile memory;
3. The download program erasing function according to claim 2, wherein the erasing means erases the erasing program itself according to the erasing program stored in the first area of the rewritable nonvolatile memory. IC card. The erasing program includes a specific call instruction that is executed after the erasure of the download program according to the erasing program is completed, and includes a specific call instruction for calling a specific function used for erasing the erasing program. And
4. The IC card with a download program erasing function according to claim 3, wherein when the specific function is called by the specific call, the erasing unit deletes the erasing program according to the specific function. Said erasing means, a program to be the erasing by writing erase data in accordance with the erase program to said first region of said rewritable non-volatile memory in which the program to be erased is stored 4. The IC card with a download program erasing function according to claim 2, wherein the erasing function is erased. Further comprising an erasure check means,
The erasing means erases the program to be erased stored in the first area by repeatedly writing 1-byte predetermined erasure data in the first area,
The erase check means to determine whether erasure of program is done properly by the erasing means, the or at least the first byte and the last byte of the first region is a predetermined erasing data of one byte Turkey The IC card according to claim 5, wherein: Whether the download program is erased by the operator of the electronic device via the electronic device connected to the IC card after the download of the program to the rewritable nonvolatile memory by the download unit according to the download program is completed. Inquiry means for inquiring
2. The IC card with a download program erasure function according to claim 1, wherein the erasure unit erases the download program when erasure of the download program is designated in response to an inquiry by the inquiry unit. A programmable read-only nonvolatile memory in which a flag area for indicating that the download program has been erased is secured;
The download program erase according to claim 1, further comprising flag writing means for writing a specific flag in the flag area of the programmable read-only nonvolatile memory when the download program is successfully erased. IC card with function. A rewritable nonvolatile memory the download area is secured comprising a first region for storing a download program for downloading programs, the download program erasing method in an IC card comprising a downloading means, an erasing means There,
The download means has a second different from the first area of the download area of the rewritable nonvolatile memory according to the download program stored in the first area of the rewritable nonvolatile memory . a step of executing a program download to download another program with the downloaded program in the region,
Before the issuance of and prior to the IC card after the completion of the program download Kipu, said erase means, and a step of erasing the downloaded program from said first region of said rewritable non-volatile memory A method for erasing a download program in an IC card.

Images