JP4840012B2 - IC card with mode change function and IC card program - Google Patents

Description

  The present invention relates to an IC card that is a card medium on which an IC chip is mounted, and more particularly to a technique for shortening communication time between a host device and an IC card.

  A SIM (Subscriber Identity Module) obtained by cutting the vicinity of an IC chip mounted on an IC card into a strip shape is incorporated in a host device and used as a device for encrypting / decrypting data used in the host device.

  As an example of incorporating a SIM into a host device, the same applicant has applied for a system in which a SIM is mounted on a surveillance camera that can be connected to the Internet, and a moving image captured by the surveillance camera is encrypted by the SIM (Patent Document 1). .

  By combining the host device such as a monitoring camera and the SIM, there is a merit that the change of the host device to be performed for encrypting the data can be minimized and that the encryption algorithm can be easily exchanged.

  However, the communication speed of the SIM is 9600 bps as standard, which is very slow compared to a general network and wireless communication speed. When the SIM is embedded in the host device, the communication time between the host device and the SIM is a bottleneck. turn into. For this reason, in reducing the communication time between the host device and the SIM, it is very advantageous to reduce the communication amount between the host device and the SIM.

  In recent years, there has also been proposed an IC chip equipped with a USB interface as disclosed in Patent Document 2 and capable of dramatically improving the communication speed. However, the amount of communication between the host device and the SIM has been reduced. There is no substitute for the benefits of reducing it.

As one invention for reducing the amount of communication between the host device and the SIM, if the command includes a pattern that can be used repeatedly, the same applicant registers this pattern in the SIM in advance, and this is registered in the SIM. An application for reducing the amount of communication between the host device and the SIM by sending a pattern number has been filed (Patent Document 3).
Japanese Patent Application No. 2005-108601 Special table 2003-532936 gazette Japanese Patent Application No. 2005-265605

  Certainly, by using the technique of Patent Document 3, when a repeated pattern is included in the command, the pattern is registered in the SIM in advance, and the pattern number is transmitted from the host device to the SIM instead of the repeated pattern. The amount of communication can be reduced.

  However, when processing a certain command continuously in the SIM, the host device side needs to transmit the pattern number to the SIM every time the command is executed, and on the SIM side, the received pattern number is Must be interpreted.

  Therefore, the present invention can omit a pattern (for example, command code) that is repeatedly transmitted between the host device and the SIM when the processing of a certain command is continuously executed by the SIM, and further identifies this pattern. An object of the present invention is to provide an IC card and an IC card program that can omit even a pattern number.

  A first invention that solves the above-described problem is an IC card that is incorporated and used in a host device, wherein the IC card stores mode information indicating a mode of the IC card in a memory, and the mode information 1st mode for exchanging at least a command APDU and a response APDU with the higher-level device, or only exchanging command data as a data portion of the command APDU and response data as a data portion of the response APDU with the higher-level device Any one of the second modes is indicated, and the IC card refers to the mode change command for operating the mode information and the mode information, and changes the behavior of the IC card based on the mode information. And the mode change command is a specific processing module. Further, when the command change PDU is processed in the first mode, the mode change command operates the mode information to change the mode of the IC card to the second mode, and After the transition to the second mode, the data amount of the processed command data is counted, and the counted data amount exceeds the total amount of the command data indicated by the data part of the command APDU of the mode change command. When the mode information is manipulated to return the mode of the IC card to the first mode, the control means is transmitted from the host device when the mode information indicates the second mode. The command data processing is delegated to the mode change command, and the response obtained from the mode change command And transmitting the over data to the host device.

  Further, the second invention is the IC card according to the first invention, wherein the processing module associated with the mode change command is a module for encrypting / combining the command data. .

  Further, the third aspect of the present invention is at least a first mode in which a command APDU and a response APDU are exchanged with the host device, or command data that is a data part of the command APDU and response data that is a data part of the response APDU. Is an IC card program mounted on an IC card storing mode information indicating any one of the second modes for exchanging only with the host device, and is associated with a specific process, and the first mode When processing the command APDU, the mode information is manipulated to change the mode of the IC card to the second mode, and after the transition to the second mode, the processed command data The amount of counted data is the data of the command APDU A mode change command function for operating the mode information to return the mode of the IC card to the first mode when the total amount of the command data shown in FIG. As a control function for delegating the processing of the command data transmitted from the host device to the mode change command function and transmitting the response data obtained from the mode change command to the host device. It is an IC card program for operating the CPU of the card.

  Furthermore, a fourth invention is the IC card program according to the third invention, wherein the process associated with the mode change command function is a process of encrypting / combining the command data. It is a card program.

  According to the above-described invention, in the above-described second mode, command data / response data is transmitted between the host device and the IC card, so that an effect of reducing the communication amount between the host device and the IC card can be obtained. Since the IC card does not need to interpret the command APDU received from the host device every time, the effect of shortening the processing time of the IC card can be obtained.

  Furthermore, after the amount of command data processed in the second mode reaches the total amount, only the command data that is the data portion of the command APDU and the response data that is the data portion of the response APDU are exchanged with the host device. In order to automatically return from the mode 2 to the first mode in which the command APDU and response APDU are exchanged with the host device, the host device is compliant with the ISO / IEC7816 standard even after the transition to the second mode. The transaction using the IC card can be executed.

  Furthermore, the processing module included in the mode change command is a module that encrypts / combines plaintext, so that the processing time can be shortened when the host device encrypts a large amount of plaintext. By automatically returning to the first mode, processing other than the mode change command, such as changing the encryption key and authenticating the IC card, can be performed.

  In the present invention, an IC card means a card medium on which an IC chip is mounted, and an interface for communicating with a host device does not ask for contact / non-contact. Further, the IC card according to the present invention includes a SIM or UIM obtained by cutting the periphery of the IC chip into a strip shape.

  From here, the SIM according to the present invention will be described in detail with reference to the drawings. The SIM 1 according to the present invention includes two modes as modes for communicating with the host device 2, one mode is an ISO mode for exchanging APDU (Application Protocol Data Unit), and the other mode is APDU data. This is a data mode in which only parts are exchanged.

  FIG. 1 is a diagram for explaining the behavior of SIM1, FIG. 1 (a) is a diagram for explaining an ISO mode for exchanging APDU, and FIG. 1 (b) is a data mode for exchanging only the data part of APDU. It is a figure explaining.

  As shown in FIG. 1A, the ISO mode is a mode in which APDUs are exchanged between the upper apparatus 2 and the SIM 1 according to the procedure of ISO / IEC 7816. The APDU transmitted from the upper apparatus 2 to the SIM 1 is a command APDU. This command APDU includes a command header indicating a command to be executed and command data used in the command.

  An APDU transmitted from the SIM 1 to the higher-level device 2 is called a response APDU, and the response APDU includes a response data of the command and a status word (SW: status word) indicating the execution result of the command.

  As shown in FIG. 1B, when the SIM1 is in the data mode, only the data part of the APDU is exchanged between the upper apparatus 2 and the SIM1, and only the command data is transmitted from the upper apparatus 2 to the SIM1. Only the response data is transmitted to the host device 2.

  When activated, the SIM1 mode is the ISO mode, and the SIM1 includes a mode change command that triggers a transition from the ISO mode to the data mode.

  When the SIM1 receives the mode change command, the SIM1 mode transitions from the ISO mode to the data mode. In the data mode, the SIM1 processes the command data transmitted from the host device 2 by the mode change command, and the mode change command Only the response data that is the result of the above process is transmitted to the host device 2.

  The data portion of the mode change command includes the total amount of command data to be processed when transitioning to the data mode. When the data amount of command data processed in the data mode reaches the total amount, the mode of the SIM1 Automatically returns from the data mode to the ISO mode.

  Since the SIM 1 has the above-described data mode, not only can the effect of reducing the communication amount between the upper apparatus 2 and the SIM 1 be obtained, but the SIM 1 does not need to interpret the command APDU received from the upper apparatus 2 every time. The effect of shortening the processing time is obtained.

  Furthermore, by including the total amount of command data to be processed when transitioning to the data mode in the data portion of the mode change command, it is possible to process command data having a very large data amount.

  Furthermore, since the SIM1 mode automatically returns from the data mode to the ISO mode after the data amount of the command data that has processed the command data reaches the total amount, the higher-level device 2 remains in ISO / IEC7816 even after the transition to the data mode. The transaction using the IC card can be executed according to the procedure conforming to the above.

  From here, it demonstrates in more detail about SIM1 which concerns on this invention. FIG. 2 is an external view of the SIM 1 according to the present invention. The SIM1 has a shape obtained by cutting the periphery of the IC module 1a in which the IC chip 10 is molded into an approximately 11.5 mm × 25 mm shape, and the detailed shape of the SIM1 is standardized by the GSM (Global System for Mobile communications) standard, etc. Has been.

  FIG. 3 is a hardware structure diagram of the IC chip 10 molded in the IC module 1 a of the SIM 1. The IC chip 10 has external terminals for Vcc, Reset, Clock, I / O, and Gnd. The IC chip 10 has a bus 17 connected to a central processing unit 11 (Central Processing Unit, hereinafter referred to as CPU). Read-only memory 15 (Read Only Memory, hereinafter referred to as ROM), EEPROM 16 (Electrically Erasable Programmable Read-Only Memory) as rewritable memory, and Random Access Memory 14 (hereinafter referred to as Random Access Memory) as volatile memory. (Referred to as RAM), a cryptographic operation circuit 12 that is a dedicated circuit for cryptographic operations, a communication I / F circuit 13 for communicating data with the host device 2, and the like.

  FIG. 4 is a software configuration diagram of the SIM1. As shown in FIG. 4, the SIM 1 stores an encryption key 104 for encrypting plain text transmitted from the host device 2 in the EEPROM 16, and stores mode information 105 indicating a mode in which the SIM 1 is changing into a volatile memory such as the RAM 14. Stored in memory.

  Further, the SIM 1 uses the hardware of the IC chip 10 shown in FIG. 3, controls the I / F circuit 13 as a program for operating the CPU 11, and a transmission control module 103 for data communication with the host device 2. , A command group including a dispatcher 100 (dispatcher) serving as means for delegating processing to a command corresponding to the command APDU and interpreting the command APDU transmitted from the host apparatus 2, and a command group delegating processing from the dispatcher 100 The command group 106 includes an encryption command 101 for encrypting plain text transmitted from the host device 2 and an encryption key setting command 102 for writing the encryption key 104 used in the encryption command 101 to the EEPROM 16. Is included.

  Further, the encryption command 101 includes an encryption module 107 that operates the encryption arithmetic circuit 12 and encrypts / combines data delivered by a predetermined algorithm using the encryption key 104.

  The transmission control module 103 provided in the SIM 1 is a program for controlling the communication I / F circuit 13 and reliably transmitting / receiving data to / from the higher-level device 2. For example, a transmission protocol (defined in ISO / IEC 7816) T0, T1) and a program that performs error correction, retransmission control, and the like according to a USB standard transmission protocol.

  The dispatcher 100 is a program that realizes the control means according to the present invention, and refers to the mode information 105 to change the behavior of the SIM1. When the mode information 105 indicates the ISO mode, the dispatcher 100 interprets the command APDU transmitted from the host apparatus 2, selects a command for processing the command APDU from the command group 106, and processes the command APDU in the selected command. Delegate.

  When the mode information 105 indicates the data mode, the dispatcher 100 delegates the command data processing to the encrypted command 101 without interpreting the command data transmitted from the host apparatus 2.

  The encryption key setting command 102 is a program for writing the data (encryption key 104) received from the higher-level device 2 to the EEPROM 16, like the Write command defined in the ISO / IEC7816 standard. Since the SIM 1 includes the encryption key setting command 102, the encryption key 104 for encrypting plaintext can be arbitrarily changed.

  The encryption command 101 is a processing module that operates the cryptographic operation circuit 12 of the IC chip 10 and uses the encryption key 104 stored in the SIM 1 to encrypt plaintext transmitted from the higher-level device 2 according to a predetermined encryption algorithm. Is a mode change command that triggers the SIM 1 to transition to the data mode.

  FIG. 5 is a diagram for explaining the mode transition of the SIM1. As described above, the SIM1 has two modes, the ISO mode and the data mode, and the mode in which the SIM1 is transitioning is indicated by the mode information 105.

  In the ISO mode, when an APDU is exchanged between the SIM 1 and the host device 2 and the command APDU of the encryption command 101 is received in the ISO mode, the SIM 1 mode transits from the ISO mode to the data mode. In the data mode, only the data part of the APDU, that is, only command data and response data are exchanged.

  After the transition from the ISO mode to the data mode, the SIM1 mode changes from the data mode to the ISO mode when all the plaintext encryption processing of the processing data amount included in the data field of the command APDU of the encryption command 101 is completed. And automatically return.

  FIG. 6 is a diagram for explaining the operation of the SIM 1 in the ISO mode. In the ISO mode, commands included in the command group 106 can be executed. In this ISO mode, a command APDU to which a protocol byte and a check code are added is transmitted from the higher-level device 2 to the SIM 1.

  When the transmission control module 103 of the SIM 1 receives the command APDU, it confirms the protocol byte and the check code added to the command APDU, and if it is determined that the data has been received normally, the dispatcher 100 determines the contents of the command header of the command APDU. And the processing is delegated to a command included in the command group 106 and corresponding to the received command APDU. The delegated command executes processing indicated by the command APDU, and then generates a response APDU, and the transmission control module 103 returns the generated response APDU to the higher-level device 2.

  FIG. 7 is a diagram for explaining the operation of the SIM 1 in the data mode. When the SIM 1 receives the command APDU of the encryption command 102, the SIM 1 mode changes from the ISO mode to the data mode, and ACK (acknowledgment) is returned to the higher-level device 2.

  In the data mode, unlike the ISO mode, only plain text is transmitted from the host device 2 to the SIM 1. When the host device 2 transmits a plain text to the SIM 1, a protocol byte and a check code are added to the plain text in the same manner as the command APDU.

  When the SIM1 receives the plaintext, the transmission control module 103 checks the protocol byte and the check code added to the plaintext, and if the SIM1 determines that the data has been received normally, the encryption of the received plaintext is sent to the encryption command 101. After entrusting, the encryption command 101 passes the plaintext to the encryption module 107 to obtain a ciphertext obtained by encrypting the plaintext.

  The ciphertext obtained by the encryption command 101 is transferred to the transmission control module 103, and an appropriate protocol byte and check code are added to the ciphertext and transmitted from the SIM1 to the host device 1.

  The encryption command 101 counts the amount of plaintext data encrypted in the data mode, and when the counted data amount reaches the processing data amount indicated by the data field of the command APDU of the encryption command 101, the mode Manipulate the information 105 to change the SIM1 mode from the data mode to the ISO mode, generate a response APDU of the encrypted command, add a protocol byte and a check code to the generated response APDU, and send it to the host device 2 To do.

  In a conventional IC card, when plaintext with a large data capacity is encrypted, the plaintext must be divided into block sizes that can be included in one command APDU, and a command APDU must be generated for each divided plaintext. If the SIM1 according to the present invention is used, it is not necessary to generate a command APDU for each divided plaintext, so that not only the effect of reducing the amount of communication between the host device 2 and the SIM1 is obtained, but the SIM1 is received from the host device 2. This eliminates the need to interpret the command APDU every time, so that the processing time of the SIM 1 can be shortened.

  Furthermore, since the SIM1 mode automatically returns from the data mode to the ISO mode after processing the plain text of the processing data amount, the upper apparatus 2 conforms to ISO / IEC7816 and the like even after the transition to the data mode. A transaction using an IC card can be executed according to the procedure.

  FIG. 8 is a diagram illustrating an example of a command APDU of the encryption command 101. As shown in FIG. 8, in the present embodiment, the structure of the command APDU transmitted from the higher-level device to the SIM 1 in the ISO mode is the case 3 command structure of the ISO / IEC 7816 standard, and CLA, INS, P1, and P2 And a body consisting of Lc and a data field.

  CLA and INS included in the header of the command APDU of the encrypted command 101 are data for identifying the command APDU. In this embodiment, the CLA of the encrypted command 101 is “D0h” and the INS is “04h”. It is.

  P1 and P2 included in the command APDU header of the encrypted command 101 are parameters when the encrypted command 101 is executed. In this embodiment, P1 and P2 are not used, and values of P1 and P2 are used. Is “00h”.

  Lc of the body of the encryption command 101 indicates the length of data included in the data field, and the total amount of plaintext to be encrypted is described in the data field. As described above, in the data mode, only plain text is transmitted, and the command headers CLA, INS, P1, and P2 are not transmitted.

  When the SIM 1 is in the data mode, a plain text data object is transmitted from the host apparatus 2 to the SIM 1, and this data object includes a plain text data length and a plain text, and the encryption command 101 is indicated by the data length. Encrypt length plaintext.

  FIG. 9 is a diagram showing an example of a response APDU of the encrypted command 101. When the total amount of encrypted plaintext data reaches the total amount indicated by the data field of the encrypted command 101, a response APDU is generated.

  As shown in FIG. 9, the response APDU structure of the encrypted command 101 conforms to the response APDU structure of ISO / IEC7816, and is composed of a body and a 2-byte SW that is a trailer.

  The body of the response APDU of the encrypted command 101 includes a ciphertext obtained by encrypting the plaintext received last. The 2-byte SW of the response APDU indicates the execution result of the encryption command 101.

  From here, the operation flow of the SIM 1 in which the encryption command 101 is implemented will be described. FIG. 10 is a flowchart showing the operation of the SIM1. The first step S1 in FIG. 10 is a step in which SIM1 is activated. In this step, SIM1 is activated according to the procedure of ISO / IEC7816, and the initial processing of SIM1 is executed.

  By this initial processing, the value of the SIM1 mode information 105 is set to a value indicating the ISO mode, so that the SIM1 mode becomes the ISO mode.

  The next step S2 is a loop process that is repeatedly executed until SIM1 is deactivated.

  The next step S3 is a step in which the SIM 1 receives a command APDU from the higher-level device 2. When the transmission control module 103 of the SIM 1 receives the command APDU to which the protocol byte and the check code are added from the host device 2, the transmission control module 103 confirms the protocol byte and the check code added to the command APDU, and receives the data normally. If it is determined, only the command APDU is transferred to the dispatcher 100.

  The next step S4 is a step of specifying a command for processing the command APDU received by the SIM 1 from the upper apparatus. In this step, since the value of the mode information 105 of the SIM1 is set to a value indicating the ISO mode, the dispatcher 100 of the SIM1 analyzes the CLA and INS of the command APDU, so that the command group 106 of the SIM1 has From among them, the SIM1 specifies a command to be executed, and delegates the processing of the command APDU to the specified command by delivering data of P1, P2 and the data field.

  In this step, if the specified command is the encrypted command 101, the process proceeds to step S10, and if it is another command, the process proceeds to step S5.

  In step S5, a command other than the encryption command 101 (for example, the encryption key setting command 102) is processed, and a response APDU is generated. In step S <b> 6, the transmission control module 103 adds a protocol byte and a check code to the generated response APDU and transmits the response APDU to the higher-level device 2.

  FIG. 11 is a flowchart showing the procedure for processing the encryption command 101, which is executed in step S10 of FIG. The first step S11 of the procedure for processing the encryption command 101 is a step of changing the SIM1 mode from the ISO mode to the data mode.

  In this step S11, when the dispatcher 100 determines that the command APDU received in step S3 in FIG. 10 is the command APDU of the encrypted command 101, the dispatcher 100 calls the encrypted command 101. When the encryption command 101 is read, the encryption command 101 changes the value of the mode information 105 from the value indicating the ISO mode to the value indicating the data mode, thereby changing the SIM1 mode from the ISO mode to the data mode. Transition.

  The next step S12 is a step of initializing a counter indicating the amount of encrypted plaintext data. In this step, the encryption command 101 of the SIM 1 copies the total amount included in the command APDU of the encryption command 101 received in step S 3 of FIG. 10 to the register of the CPU 11 or the RAM 14.

  The next step S13 is a step of returning an ACK indicating that the command APDU of the encrypted command 101 has been normally received. Note that the transmission control module 103 adds a protocol byte and a check code to this ACK. It should be noted that the ACK value is preferably a value other than that used by the SW so that the ACK and the SW included in the response APDU can be distinguished.

  The next step S <b> 14 is a step of receiving plain text from the higher-level device 2. A protocol byte and a check code are added to the plaintext received at this step. When the SIM1 receives the plain text, the transmission control module 103 confirms the protocol byte and the check code added to the command APDU.

  The next step S15 is a step of generating a ciphertext obtained by encrypting the plaintext transmitted from the host device 2. In this step, the encryption command 101 activates the cryptographic operation circuit 12 and encrypts the plain text delivered from the dispatcher 100 according to a predetermined cryptographic algorithm using the cryptographic key 104.

  The next step S16 is a step of updating a counter indicating the amount of encrypted plaintext data. In this step, the encryption command 101 updates the counter by adding the data length included in the plaintext data object to the counter.

  In the next step S17, the total amount contained in the data field of the command PADU of the encrypted command 101 received in step S3 is compared with the value of the counter to check whether the plaintext of the total amount has been encrypted.

  If the total amount of plaintext is not encrypted in step S17, the process proceeds to step S18. If encrypted, the process proceeds to a normal end process (step S20).

  In step S <b> 18 executed when the total amount of plaintext is not encrypted, only the ciphertext obtained by encrypting the plaintext is transmitted to the host apparatus 2. In this step, the encryption command 101 passes the ciphertext generated in step S15 to the transmission control module 103, and the transmission control module 103 adds the protocol byte and the check code to the ciphertext and sends it to the upper level apparatus 2. After transmission, the SIM 1 is in a state of receiving data from the higher-level device 2. In addition, after performing step S18, it returns to step S14.

  FIG. 12 is a flowchart showing a procedure for normal termination processing. The first step S21 of this procedure is to generate a response APDU composed of SW indicating normal termination and response data which is the last encrypted plaintext ciphertext, and further indicates the ISO mode from the value indicating the data mode. The value of the mode information 105 is changed to a value.

  Step S22 executed after step S21 is a step of transmitting the response APDU generated in step S21 to the higher-level device 2. In this step, the encryption command 101 passes the response APDU generated in step S21 to the transmission control module 103, and the transmission control module 103 adds a protocol byte and a check code to the response APDU, and sends the response APDU to the higher-level device 2. Send.

The figure explaining behavior of SIM. The external view of SIM. 1 is a hardware structure diagram of an IC chip. The software block diagram of SIM. The figure explaining the mode transition of SIM. The figure explaining operation | movement of SIM in ISO mode. The figure explaining operation | movement of SIM in a data mode. The figure which showed an example of command APDU of an encryption command. The figure which showed an example of the response APDU of an encryption command. The flowchart which showed operation | movement of SIM. The flowchart which showed the procedure which processes an encryption command. The flowchart which showed the procedure at the time of normal completion.

Explanation of symbols

1 SIM
100 Dispatch 101 Encryption Key Setting Command 102 Encryption Command 103 Transmission Control Module 104 Encryption Key 105 Mode Information 2 Host Device

Claims (4)

  An IC card incorporated in and used in a host device, wherein the IC card stores mode information indicating a mode of the IC card in a memory, and at least a command APDU and a response APDU are stored in the host device according to the mode information. Or the first mode for exchanging data with the host device or only the command data that is the data part of the command APDU and the response data that is the data part of the response APDU. The IC card includes a mode change command for operating the mode information, and a control unit that refers to the mode information and changes the behavior of the IC card based on the mode information. Associated with a specific processing module, and When the command further processes the command APDU in the first mode, the mode information is manipulated to change the mode of the IC card to the second mode, and then to the second mode. Counts the data amount of the processed command data, and operates the mode information when the counted data amount exceeds the total amount of the command data indicated by the data portion of the command APDU of the mode change command. The mode of the IC card is returned to the first mode, and when the mode information indicates the second mode, the control unit performs processing of the command data transmitted from the host device. Delegating to a change command and sending the response data obtained from the mode change command to the host device. IC card to be butterflies.   2. The IC card according to claim 1, wherein the processing module associated with the mode change command is a module that encrypts / combines the command data.   At least a first mode in which a command APDU and a response APDU are exchanged with the host apparatus, or only command data that is a data part of the command APDU and response data that is a data part of the response APDU are exchanged with the host apparatus. An IC card program mounted on an IC card storing mode information indicating any one of the second modes, when associated with a specific process and processing the command APDU in the first mode The mode information is manipulated to change the mode of the IC card to the second mode. After the transition to the second mode, the data amount of the processed command data is counted, and the counted data The frame whose amount is indicated in the data part of the command APDU A mode change command function for operating the mode information to return the mode of the IC card to the first mode when the total amount of data exceeds the mode, and when the mode information indicates the second mode, The CPU of the IC card is operated as a control function for delegating the processing of the command data transmitted from the host device to the mode change command function and transmitting the response data obtained from the mode change command to the host device. IC card program to let you. 4. The IC card program according to claim 3, wherein the process associated with the mode change command function is a process of encrypting / combining the command data.

Images