JP4827919B2 - Communication terminal device and access method - Google Patents

Description

  The present invention relates to a communication terminal device and an access method for accessing a secure area managed by an IC card using a handle acquired from a card application of the IC card.

  Conventionally, an IC card capable of storing data while ensuring high security has been provided.

  This type of IC card is expected as a key device for realizing a secure ubiquitous network society in which the device business, equipment business, service solution business, etc. are developed in total.

  By the way, as a method for accessing a memory area that can be controlled by an IC card (hereinafter, this area is referred to as a “secure area”) from a communication terminal device such as a cellular phone or PC (Personal Computer) as a host, There are a method of using a variable indicating an area and a handle (pointer) as an argument, and a method of using card information such as the type and usage status of an IC card.

In such a conventional access method, when accessing the card application of the IC card from the host,
(1) Card application selection (processing for selecting one of a plurality of applications built in the IC card).
(2) Opening a card application (processing for opening a connection).
(3) Authentication of the host requesting access (input processing such as a password).
(4) Access permission to a specific host passed by authentication (access processing from the host to the card application of the IC card).
Such complicated procedures are required.

  For this reason, the conventional access method has a problem that it takes time to access the card application of the IC card from the host.

  In particular, since the conventional general IC card has a low communication speed of 9600 dps, there is a problem that the time required to access the card application is further increased.

  Therefore, the present applicant separates a command for specifying an access area of an IC card from a host (terminal) and a command for accessing, and transmits an access command including the verification data of the host in an argument of the command for accessing. (Refer to Patent Document 1).

  In this access method, since the verification data of the host is included in the argument of the command that accesses the secure area, the host application that specified the access area, the host application that issued the command to access the secure area, and the secure It is possible to verify with the IC card that the host application having the authority to access the area is the same.

  In this access method, the command to specify the access area is separated from the command to access, so for memory access, security can be achieved with a small number of command arguments while avoiding command complexity using conventional commands. It is possible to access the secure area without degrading.

  Further, the present applicant has proposed an access method for speeding up SSL by reading out a certificate used for SSL (Secure Socket Layer) from an IC card in advance and caching (see Patent Document 2).

In this access method, since it is possible to transmit and receive digital certificates between the host and the IC card to the minimum necessary number, establishment of an authentication channel (Secure Authenticated Channel) between the server and the IC card. It is possible to shorten the time required for improving the user convenience.
JP 2005-50320 A JP 2005-236505 A

  However, Patent Document 1 shows a "high-speed method that does not dynamically allocate handles but shares them with the host in a fixed manner" and "a method that creates a state where multiple files can be accessed simultaneously". In this method, when a handle is dynamically allocated, it is difficult to reduce a load (overhead) applied to the entire system when the handle is acquired.

  In other words, when the handle is fixed, the communication path between the host and the IC card has a 1: 1 relationship, and by simultaneously establishing a plurality of connections, a plurality of files can be accessed simultaneously.

  Further, in Patent Document 2, “a method for prefetching a digital certificate from an IC card” is shown, but it is difficult to apply this method when prefetching a handle of a secure area dynamically allocated. .

  In other words, when the handle is fixed, the handle information can be prefetched without any problem. However, when the handle is dynamically allocated, all the handle information that changes every time the host accesses is displayed. It is virtually impossible to read ahead.

  An object of the present invention is to provide a communication terminal device and an access method capable of reducing overhead when accessing a secure area managed by an IC card.

  The communication terminal device of the present invention stores a handle acquisition unit that acquires in advance a handle of a secure area to be accessed that is managed by the IC card when the card application of the IC card is opened, and the handle acquired by the handle acquisition unit And an access means for accessing the secure area using a handle of the secure area stored in the access table when accessing the secure area.

  According to the present invention, since it is not necessary to obtain a handle each time when accessing the secure area of the IC card, the overhead during access can be reduced, and high-speed access from the communication terminal device to the secure area of the IC card can be achieved. Access is possible.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a schematic sectional view showing a configuration of a communication terminal apparatus according to an embodiment of the present invention.

  As shown in FIG. 1, a mobile terminal 100 as a communication terminal device such as a mobile phone or PC as a host includes an access table 101, an access table creation unit 102, a table data update unit 103, an access count determination unit 104, and a handle acquisition. Unit 105, data input / output unit 106, host application 107, card information determination unit 108, card information acquisition unit 109, IC card I / F 110, and CPU 111.

  In FIG. 1, an IC card 200 is mounted on the mobile terminal 100.

  The access table 101 of the portable terminal 100 holds card information such as the handle of the card application scheduled to be accessed by the IC card 200 and the number of accesses to the card application of the IC card 200.

  The access table creation unit 102 creates the access table 101 based on card information such as the handle of the card application and the number of accesses.

  When the table data update unit 103 updates the table data of the access table 101, the table data update unit 103 transmits the table data to be updated to the access table creation unit 102.

  The access count determination unit 104 determines whether the number of accesses to the card application of the IC card 200 has reached a predetermined number.

  The handle acquisition unit 105 acquires all handles of all areas to be accessed when the card application of the IC card 200 is opened.

  The data input / output unit 106 receives character data, image data, audio data, and the like of a host application 107 of the mobile terminal 100, a card application of the IC card 200, and a server (not shown) connected to an external network such as the Internet. The data is output, or character data, image data, voice data, or the like is input to the IC card 200 or the server.

  The host application 107 is a program for operating various functions of the mobile terminal 100.

  The card information determination unit 108 determines whether or not there is a card application whose number of accesses exceeds a predetermined number based on the mounting information of the IC card 200, that is, the card information acquired by the card information acquisition unit 109, and the handle that has exceeded the expiration date. Determine the presence or absence of

  The card information acquisition unit 109 acquires card information such as the access count and handle of the card application of the IC card 200 and transmits the acquired card information to the card information determination unit 108.

  The IC card I / F 110 is a card interface that processes input / output signals for the IC card 200.

  The CPU 111 controls the operation of each unit described above and performs arithmetic processing on input / output signals.

  The IC card 200 mounted on the portable terminal 100 of this example includes a controller unit 201, an IC card unit 202, and a flash memory unit 203.

  The controller unit 201 transmits and receives signals to and from the IC card I / F 110 of the mobile terminal 100 and controls operations of the IC card unit 202 and the flash memory unit 203.

  The IC card unit 202 employs FeRAM as a nonvolatile memory, and can realize high-speed non-contact communication. FeRAM is a kind of non-volatile memory using a ferroelectric, and has a feature that high-speed writing and high-speed rewriting can be obtained with low power consumption as compared with general non-volatile memories such as flash memory and EEPROM.

  The flash memory unit 203 can store a large amount of content, application software, and the like while ensuring high security by encrypting a part of the area with a key in the IC card unit 202. .

  Further, the IC card 200 can freely set the flash memory unit 203 as a secure area. The capacity that can be used as the secure area can be freely set within the capacity range of the flash memory unit 203.

  In addition, the IC card 200 realizes high secrecy by executing key management and encryption in the IC card unit 202, and at the same time, realizes a data transfer rate of about 600 KBytes / sec at the time of reading and writing. It is possible to provide functions suitable for applications such as protection.

  Next, operations of the mobile terminal 100 and the IC card 200 of this example will be described. FIG. 2 is a sequence diagram for explaining the operation of the portable terminal as the communication terminal apparatus and the IC card according to one embodiment of the present invention. FIG. 3 is a block diagram for explaining the operation of the portable terminal as the communication terminal apparatus and the IC card according to one embodiment of the present invention.

  As shown in FIG. 2, when directly accessing a secure area managed by the IC card 200 from the mobile terminal 100 as a host, the card information acquisition unit 109 of the mobile terminal 100 uses the card Ver, the creation maker, to the IC card 200. Request to send card information such as mounting information (step ST201).

  In response to the request at step ST201, the IC card 200 sends the requested card Ver, card information such as mounting information such as the manufacturer to the portable terminal 100 (step ST202).

  Thereby, as shown in FIG. 3, the mobile terminal 100 holds card information 301 such as mounting information such as a card Ver and a creation maker.

  Next, the mobile terminal 100 determines, based on the card information (mounting information) 301 acquired by the card information acquisition unit 109 from the IC card 200, whether the mounting of the IC card 200 can be accelerated or difficult. This is determined by the unit 108.

  Here, when it is determined that the IC card 200 can be mounted at a higher speed (step ST203), the handle acquisition unit 105 of the mobile terminal 100 requests the IC card 200 to send a handle of a scheduled access area ( Step ST204).

  When it is determined that the IC card 200 is difficult to increase in speed, the access processing from the portable terminal 100 to the secure area managed by the IC card 200 is stopped, and this is indicated by the display means of the data input / output unit 106. It is displayed on a certain display (not shown).

  When the IC card 200 receives a handle request for the scheduled access area (step ST204) from the handle acquisition unit 105 of the portable terminal 100, the portable terminal 100 sends the requested handle (A, B,...) Of the scheduled access area. (Step ST205).

  The mobile terminal 100 creates the access table 101 by transmitting the handle of the scheduled access area sent from the IC card 200 to the access table creation unit 102 (step ST206).

  As a result, as shown in FIG. 3, the handle of the scheduled access area of the IC card 200 is stored in the access table 101 of the portable terminal 100. At this time, the access table 101 also stores the number of accesses as information indicating how many times the mobile terminal 100 has accessed a certain address.

  Next, in the mobile terminal 100 of the present example, the expired handle is updated according to the mounting of the IC card 200 (step ST207).

  In step ST207, if the card information obtained by the card information obtaining unit 109 of the portable terminal 100 is judged by the card information judging unit 108 and there is an expired handle (B), the handle obtaining unit 105 performs the IC card 200. Is requested to send an expired handle (B) (step ST208).

  In response to the handle request from the portable terminal 100, the IC card 200 sends the requested expired handle (B) (step ST209).

  The portable terminal 100 sends the handle (B) re-acquired from the IC card 200 by the handle acquisition unit 105 to the table data update unit 103, and the access table creation unit 102 updates the expired handle (B) of the access table 101. . Note that, here, in addition to updating the handle (B) that has expired, the handle that has passed a predetermined time until the expiration date may be updated.

  In the mobile terminal 100 of this example, the access count determination unit 104 determines whether or not the access count to the access planned area of the IC card 200 exceeds a predetermined threshold, and the access count to the access planned area is predetermined. Even when the threshold is exceeded, the access table creation unit 102 can update the table data of the access table 101 via the table data update unit 103. Here, the table data of the access table 101 may be updated in descending order of the number of accesses without providing a threshold.

  Next, the operation of the mobile terminal 100 of this example will be described. FIG. 4 is a flowchart showing the operation of the mobile terminal as the communication terminal apparatus according to the embodiment of the present invention.

  In FIG. 4, when the access operation to the secure area of the IC card 200 starts, the mobile terminal 100 first refers to the access table 101 (step ST401), and whether there is a handle of the access area (secure area) to be accessed from now on Is checked (step ST402).

  In step ST402, when the handle of the secure area to be accessed by the mobile terminal 100 is in the access table 101, the secure area is accessed from the mobile terminal 100 using the handle of the access table 101 (step ST403).

  On the other hand, if the access table 101 does not have the handle of the secure area that the portable terminal 100 is to access in step ST402, the access table creation routine is executed (step ST404), and the handle of the newly created access table 101 is set. To access the secure area.

  Next, in portable terminal 100 of this example, it is determined whether or not to update access table 101 referred to in step ST401 (step ST405). Here, whether or not to update the access table 101 may be determined by a user operation or may be determined by a preset program.

  If it is determined in step ST405 that the access table 101 is to be updated, the access table update routine is executed (step ST406), and then the process proceeds to step ST407.

  On the other hand, if it is determined in step ST405 that the access table 101 is not updated, the process jumps to step ST407 without executing the access table update routine.

  In step ST407, it is determined whether or not to end the access from the mobile terminal 100 to the secure area of the IC card 200. If the access is continued, the process returns to step ST403, and if the access is ended, the mobile terminal 100 Stop the access operation.

  As described above, in step ST402, when the access table 101 does not have the handle of the secure area to be accessed by the mobile terminal 100, the access table creation routine shown in FIG. 5 is executed. FIG. 5 is a flowchart showing details of the access table creation routine in FIG.

  As shown in FIG. 5, in the access table creation routine, the portable terminal 100 first checks the mounting of the IC card 200 (step ST501). In this mounting check, the card information acquisition unit 109 acquires card information (mounting information) 301 (see FIG. 3) in order to check the mounting of the IC card 200.

  Next, from the acquired card information (mounting information) 301, the portable terminal 100 determines whether the mounting of the IC card 200 can be speeded up or difficult to speed up using the card information determining unit 108 (step ST502).

  If it is determined in step ST502 that it is difficult to mount the IC card 200, the access operation of the mobile terminal 100 is stopped.

  On the other hand, if it is determined in step ST502 that the mounting speed of the IC card 200 can be increased, the handle acquisition unit 105 acquires the handle of the scheduled access area of the IC card 200 (step ST503).

  Then, the handle acquisition unit 105 sends the handle of the scheduled access area acquired from the IC card 200 to the access table creation unit 102.

  When the access table creation unit 102 receives the handle of the scheduled access area of the IC card 200 acquired by the handle acquisition unit 105, the access table creation unit 102 creates the access table 101 including the received handle (step ST504).

  Then, after creating the access table 101 in step ST504, the process returns to step ST403 in FIG.

  If the access table 101 is updated in the determination at step ST405, the access table update routine shown in FIG. 6 is executed. FIG. 6 is a flowchart showing details of the access table update routine in FIG.

  As shown in FIG. 6, in the access table update routine, the portable terminal 100 first checks the mounting of the IC card 200 (step ST601). In this mounting check, the card information acquisition unit 109 acquires the card information (mounting information) 301 as in the case of the access table creation routine.

  Next, the mobile terminal 100 determines whether or not it is the update timing of the mounted IC card 200 from the acquired card information (mounting information) 301 (step ST602).

  If it is determined in step ST602 that the update timing is not reached, the process jumps to step ST407 in FIG.

  On the other hand, if it is determined in step ST602 that the update timing is reached, it is determined whether there is an expired handle in the access table 101 (step ST603).

  When it is determined in step ST603 that there is no expired handle in the access table 101, the process jumps to step ST407 in FIG.

  On the other hand, if it is determined in step ST603 that there is an expired handle in the access table 101, the handle acquisition unit 105 reacquires the handle of the card application of the IC card 200 that has expired (step ST604). ).

  The handle of the card application of the IC card 200 that has expired and is reacquired by the handle acquisition unit 105 is sent to the table data update unit 103.

  The table data update unit 103 sends the handle reacquired by the handle acquisition unit 105 to the access table creation unit 102, and updates the corresponding handle of the access table 101 (step ST605).

  And after updating the access table 101 by step ST605, it returns to step ST407 of FIG.

  As described above, in the mobile terminal 100 of this example, when the card application is opened, the access table 101 can be created by acquiring the handle of the access area to be accessed. If the access area used by the IC card 200 is not known, the handles of all areas can be acquired.

  Further, in the mobile terminal 100 of this example, the rules for assigning the handle of the IC card 200 differ depending on the mounting, so that the creation and update timing of the access table 101 can be changed for each mounting of the IC card 200. However, when the IC card 200 mounted on the portable terminal 100 is one type, it is not necessary to change the creation and update timing of the access table 101. The valid period of the handle differs depending on the mounting of the IC card 200 (setting of the card manufacturer) such as when the card application is closed or when the connection is closed.

  By the way, the planned areas where the mobile terminal 100 accesses the card application of the IC card 200 are determined in several places by the host application of the mobile terminal 100.

  Therefore, in the mobile terminal 100 of this example, all the handles of the access area used by the user are cached in advance, and the access table 101 is created first.

  Further, the timing at which the handle of the card application of the IC card 200 is changed depends on the mounting of the IC card 200, that is, depending on the card manufacturer.

  Therefore, in the mobile terminal 100 of this example, the access table 101 is updated according to the timing when the handle of the mounted IC card 200 changes, that is, according to the rule and card version determined by the mounting company.

  As described above, the access table 101 in the portable terminal 100 of this example is updated to the access table 101 of the index corresponding to the card version of the IC card 200 and the card company.

  Further, in the mobile terminal 100 of this example, the handle of the expiration date (varies depending on the type of the IC card 200 or the like) is prompted and updated.

  Therefore, in the mobile terminal 100 of this example, for example, in the case of the IC card 200 manufactured by company A, each time the card application is closed, in the case of the IC card 200 manufactured by company B, when the connection is recreated In addition, the handle of the access table 101 can be updated according to the type of the IC card 200 or the like.

  By the way, if the access area to be used in advance of the IC card 200 is not known, the handles of all the access areas may be acquired. However, if all the handles of the all access areas of the IC card 200 are cached, the card application is Access to is slow.

  Therefore, in the portable terminal 100 of this example, when the access area is not known as described above, only the handle of the predetermined access area is cached at each access timing to the IC card 200.

  That is, the mobile terminal 100 of this example caches the handle while distributing the access area. For example, in the mobile terminal 100 of this example, when the access area is large, the access area is divided into n groups, and a handle of one group is acquired every time the card application is accessed.

  By the way, as described above, when the card application is operated by actually accessing the IC card 200 using the handle of the access table 101, the handle of the access table 101 can be used frequently or not. Come.

  For this reason, when all the expired handles are updated, the access speed from the portable terminal 100 to the card application of the IC card 200 may be lowered.

  Therefore, in the mobile terminal 100 of this example, the number of accesses to the access area of the IC card 200 is recorded in the access table 101. In the portable terminal 100 of this example, the table data of the past access table 101 is held even when the IC card 200 is removed.

  In the portable terminal 100 of this example, when the access table 101 is created when the next IC card 200 is accessed, a handle is acquired only for an access area in which the number of accesses exceeds a predetermined threshold. .

  Thereby, in the mobile terminal 100 of this example, the frequently used handle is preferentially updated, and the handle that is not frequently used is not updated, so that the access table 101 can be efficiently used and accessed. The efficiency of updating the table 101 can be improved.

  In the mobile terminal 100 of this example, the access table 101 is also updated when accessing the IC card 200 that is not related to the secure area.

  Here, the portable terminal 100 as the target host has been described assuming a mobile phone, but this host may be any device into which the IC card 200 can be inserted, for example, a personally owned home PC. May be.

  Further, the IC card 200 may not be a card shape but may be a chip, for example, a chip built in a mobile phone such as a wallet.

  As described above, according to the mobile terminal 100 and the access method of this example, the secure area managed by the IC card 200 can be directly accessed from the mobile terminal 100 using the handle of the access table 101 acquired in advance.

  Therefore, in the mobile terminal 100 and the access method of this example, when accessing the secure area of the IC card 200 from the mobile terminal 100, it is not necessary to acquire a handle each time. The overhead can be reduced.

  The communication terminal device and the access method according to the present invention do not need to acquire a handle each time when accessing the secure area of the IC card, so the overhead at the time of access can be reduced, and the communication card can be changed from the communication terminal device to the IC card. Therefore, it is useful as a communication terminal apparatus and an access method for accessing the secure area managed by the IC card using the handle acquired from the card application of the IC card.

Schematic sectional view showing a configuration of a communication terminal device according to an embodiment of the present invention The sequence diagram which shows the outline of operation | movement with the portable terminal and IC card as a communication terminal device based on one Example of this invention The block diagram for demonstrating operation | movement with the portable terminal and IC card as a communication terminal device based on one Example of this invention The flowchart which shows operation | movement of the portable terminal as a communication terminal device based on one Example of this invention. The flowchart which shows the detail of the access table creation routine in FIG. The flowchart which shows the detail of the access table update routine in FIG.

Claims (5)

A handle acquisition means for acquiring in advance a handle of a secure area to be accessed that is managed by the IC card when the card application of the IC card is opened;
An access table for storing the handle acquired by the handle acquisition means;
Access means for accessing the secure area using the handle of the secure area stored in the access table when accessing the secure area;
An access table creating means for changing the creation timing of the access table for each mounting of the IC card, wherein the handle allocation rule is different for each mounting;
Table data update means for changing the update timing of the table data of the access table for each mounting of the IC card;
A communication terminal device comprising: The access table stores the number of accesses to the access area of the IC card, and retains past table data even when the IC card is removed,
The communication terminal device includes an access count determination unit that determines whether or not the access count stored in the access table exceeds a predetermined threshold,
The handle acquisition means, when creating the access table by the access table creation means at the next access of the IC card, the access area of the access area of the access count determined by the access count determination means to exceed the threshold Only get the handle,
The communication terminal device according to claim 1. The table data update means updates only the handle of the access area of the access count determined to exceed the threshold by the access count determination means;
The communication terminal device according to claim 2. The table data update means updates the handle of the previous access area in descending order of the access count determined by the access count determination means.
The communication terminal device according to claim 2. A handle acquisition step of acquiring in advance a handle of a secure area to be accessed that is managed by the IC card when the card application of the IC card is opened;
A storage step of storing the handle acquired in the handle acquisition step in an access table;
An access step of accessing the secure area using the handle of the secure area stored in the access table when accessing the secure area;
An access table creation step of changing the creation timing of the access table for each mounting of the IC card, wherein the handle allocation rule of the IC card is different for each mounting.
A table data update step for changing the update timing of the table data of the access table for each mounting of the IC card;
An access method comprising:

Images