JPH01177183A - Portable electronic device - Google Patents

Abstract

PURPOSE:To avoid an unfair access and to improve the property of security by releasing a collated state for one code number when the collated state becomes normal once in one collation, however, it becomes abnormal in another collation after that. CONSTITUTION:An IC card as a portable electronic device is composed of parts to execute basic functions such as a reading and writing part 11, a code setting and code collating part 12, and an enciphering and decoding part 13, and a supervisor 14 to control these basic functions. Further, while the IC card sets identifying information to indicate that the collated state is normal when the collation of the code number is completed normally, the ID card resets the identifying information when the collation is completed abnormally. Consequently, when the collated state for one code number becomes normal once in one collation, however, it becomes abnormal in another collation after that, the collated state is released. Thus, the unfair access can be avoided, and the property of the security can be heightened.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Field of Industrial Application) The present invention relates to a portable electronic device called an IC card, which is used, for example, as a credit card or a cash card.

(Prior Art) In recent years, as cards with magnetic stripes such as credit cards and cash cards, so-called magnetic cards, have become popular, erasable non-volatile memories and , CP that controls these
2. Description of the Related Art A so-called IC card incorporating an IC chip having a control element such as a U is attracting attention.

With such IC cards, transactions are performed based on transaction account information stored in memory, and when performing such transactions, a PIN number is verified to verify the identity of the cardholder. There is.

That is, a single or multiple password numbers are registered in the memory within the IC card, and the password entered from the outside is compared with the specified registered password number within the card. At this time, when the verification is successfully completed (verification match is obtained), the IC card controls access for subsequent transactions by setting the appropriate password verification status. There is.

However, in the case of conventional IC cards, the above-mentioned PIN verification state sets a verification flag etc. corresponding to the PIN number when verification of the PIN number is successfully completed, and thereafter the I
This state was maintained until the power of the C card was turned off.

Therefore, for example, if we consider a control within the card that allows access to area B in the memory if the verification of the PIN number A is successfully completed, then if the PIN number A is input and verified one time. After that, when you enter the PIN number A', response data is returned from the IC card as a verification error, but at this time, the state of the verification flag that was set when you entered the PIN A remains. , there is a possibility that the problem of being unable to access area B may occur as well.

(Problems to be Solved by the Invention) As described above, the present invention is capable of preventing unauthorized access because, for example, once a certain PIN number is successfully verified, that verification state is maintained until the power of the device is turned off. This was done to solve the problem that it is easy for the password to be misunderstood. For example, even if a certain PIN code is verified successfully once, if it is not successful in subsequent verifications, the verification status will be canceled. Therefore, it is an object of the present invention to provide a portable electronic device that can prevent unauthorized access and improve security.

[Structure of the Invention] (Means for Solving the Problems) The present invention has a memory section and a control section for reading and writing data to the memory section, and selectively allows external input. A portable electronic device comprising means for outputting a first memory stored in said memory portion.
a data string (for example, a PIN number), a second data string (for example, a PIN number) inputted from the outside, and the first data string stored in the memory section, such that a predetermined relationship exists between them. a verification means for verifying whether the identification information exists, a retention means for retaining the positive identification information when the verification result of the verification means is positive, and a storage means for retaining the positive identification information when the verification result of the verification means is negative. and a release means for releasing the positive identification information held by the means.

(Function) When verification of a data string (for example, a personal identification number) ends normally, identification information indicating that verification is normal is set, and when verification ends abnormally, the identification information is reset. As a result, for example, even if a certain PIN number is successfully verified once, if it is not successful in subsequent verifications, the verification state is canceled, thereby preventing unauthorized access and increasing security.

(Example) Hereinafter, an example of the present invention will be described with reference to the drawings.

FIG. 20 shows an IC as a portable electronic device according to the present invention.
This figure shows an example of the configuration of a terminal device that handles cards. That is, this terminal device allows an IC card 1 to be connected to a control section 3 consisting of a CPU, etc. via a card league writer 2, and also connects a keyboard 4, a CRT, etc. to the control section 3.
It is constructed by connecting a display device 5, a printer 6, and a floppy disk device 7.

The IC card 1 is held by the user, and is used to refer to a personal identification number known only to the user when purchasing products, etc., and to store necessary data. Its functional blocks are shown in Fig. 18. It is comprised of parts that execute basic functions such as a read/write section 11, a password setting/password verification section 12, and an encryption/decryption section 13, and a supervisor 14 that manages these basic functions. Lead
The write section 11 has a function of reading, writing, or erasing data from/to the card reader/writer 2. The password setting/password verification unit 12 has a function of storing the password set by the user and prohibiting reading thereof, and after setting the password, verifying the password and granting permission for subsequent processing. The encryption/decryption unit 13 performs encryption and encryption of encrypted data to prevent leakage and forgery of communication data when transmitting data from the control unit 3 to another terminal device via a communication line, for example. It performs decoding, for example, DES (Data Encryption).
This is a function that processes data according to an encryption algorithm that has sufficient cryptographic strength, such as encryption standards. The supervisor 14 has the function of decoding the function code inputted from the card reader/writer 2 or the function code to which data is added, and selecting and executing a necessary function among the basic functions.

In order to perform these functions, the IC card 1 has a control element (control unit) 15 such as a CPU, a data memory (memory unit) 16, a program memory 17, and a card reader/card reader, as shown in FIG. It is composed of a contact part 18 for obtaining electrical contact with the writer 2, and the parts within the broken line (control element 15, data memory 16, program memory 17) are integrated into one IC.
IC consists of a chip (or multiple IC chips)
It is embedded within the card body. Program memory 17
is composed of, for example, a mask ROM, and stores a control program for the control element 15 including subroutines for realizing each of the basic functions described above. The data memory 16 is used to store various data, such as EEF
It is composed of erasable nonvolatile memory such as ROM.

The card reader/writer 2 sends and receives function codes and data between the IC card 1 and the control unit 3.
It also has a function of performing one command, one response operation to the IC card 1 based on macro commands from the control unit 3. Specifically, as shown in FIG. 19, there is a transport mechanism 21 that transports the IC card 1 inserted into a card insertion slot (not shown) to a predetermined position, and a contact section 18 of the IC card 1 set at the predetermined position. a contact section 22 that is electrically contacted, a control circuit 23 consisting of a CPU that controls the entire system, and an input/output ink face for exchanging command data and response data between the control circuit 23 and the control section 3. It is composed of a circuit 24, a data memory 25 for storing data, and the like.

The data memory 16 includes, for example, an area definition table 161 and a password information table 162, as shown in FIG.
, and a data area 163. In particular, the area definition table 161 includes a password information area definition table 164 and a transaction data area definition table 165.

The password information area definition table 164 is data area 1
Definition information that defines a password information area is stored in 63, and this definition information is, for example, a set of a series of data strings consisting of an area number, an area start address, and an area size, as shown in FIG. It is the body.

The transaction data area definition table 165 is
Definition information that defines a transaction data area is stored in the data area 163, and this definition information is, for example, a series of area numbers, area start addresses, area sizes, and access condition information, as shown in FIG. is a collection of data strings.

The data area 163 is the password information area definition table 1
The area is defined by 64 and transaction data area definition table 165, and various data are stored therein, and a specific example thereof is shown in FIG.

For example, as shown in FIG. 7, the PIN information table 162 includes an index section, an area number section of the PIN area,
This is a collection of a series of data strings consisting of the area number part of the error counter area, the area number part of the error limit area, and the area number part of the password verification status area.

The index section contains password verification command data (second
It operates in association with the index specification information in (see figure). That is, a search is made for the same index as the index designation information in the password verification command data, and if it is found, the corresponding password etc. becomes the target of verification.

The area number part of the password area is the area number of the password area in the data area 163 in which the password specified as the verification target is stored.

The area number part of the error counter area is the control cable 15.
This specifies the first error counter (see FIG. 8) on the RAM in the data area 163, and also serves as the area number of the error counter area m2 in the data area 163.

The area number part of the error limit area is the area number of the error limit area in the data area 163 in which the limit values of the first and second error counters are stored. This error limit area is a 1-byte area, and as shown in the format shown in Figure 9, the upper 4 bits indicate the limit value of the first error counter, and the lower 4 bits indicate the limit value of the second error counter. Indicates the limit value.

The area number part of the password verification status area is a data area 163 in which information identifying which bit of the verification status bits (see FIG. 10) on the RAM in the control element 15 is to be used as the verification status flag is stored. This is the area number of the password verification status area within the area.

For example, if you specify the index "31", the area number of the corresponding PIN area will be "0" as shown in Figure 7.
1”. This is searched from the password information area definition table 164 shown in FIG. 4, and from the corresponding area start address rTAolJ and area size "10 bytes",
Referring to the data area 163 shown in FIG.
11111111J is obtained. Here, the password area consists of a length section indicating the number of bytes of the 11-byte password and a variable length password section. The length part is “FF”
-Hex, it is recognized that no password is stored.

Next, the area number of the corresponding error counter area is
According to FIG. 7, it is "11", so similarly refer to the data area 163 shown in FIG. 6 from the area start address TA and area size "1 byte",
Obtain the value "00" of the second error counter.

In the same way, the PIN specified by index "31" is 8-byte data "11111111J".
, and the value of the second error counter is "00",
The error limit value is "3" as the first error counter.
, the second error counter is "5", and the control element 15 of the IC card 1 recognizes that the verification status bit corresponds to the 0th bit in FIG.

Next, the operation in such a configuration will be explained.

First, the card league writer 2 operates according to the flowchart shown in FIG. That is, in the steady state, it is in a state of waiting for command data from the control section 3. When command data is input from the control unit 3, the control circuit 23 determines whether or not the IC card 1 is being executed. If the IC card 1 is being executed, the control circuit 23 sends response data indicating a multiple command data error to the control unit. 3 and returns to the instruction data waiting state. If the IC card 1 is not in execution, the control circuit 2-3 outputs command data to the IC card 1 and waits for response data from the IC card 1.

When there is response data from the IC card 1, the control circuit 23
If the command is a macro command, it outputs command data to the IC card 1 again, otherwise it outputs response data to the control unit 3, and returns to the state of waiting for command data.

The command data output from the card league writer 2 to the IC card 1 has a format as shown in FIG. 12, for example, and may be in the form of only a function code as shown in FIG. As shown in b), there is a form in which data is added to the function code.

The IC card 1 operates according to the flowchart shown in FIG. That is, in the steady state, it is in a state of waiting for command data from the card reader/writer 2. When command data is input from the card reader/writer 2, the control element 15 executes basic functions according to the command data, outputs response data indicating the processing result to the card reader/writer 2, and waits for command data again. Return to state.

The response data in this case is, for example, in the format shown in FIG. Consider protective measures in the event of disruption.

Next, a password verification operation will be explained with reference to the flowchart shown in FIG. When command data is input, the control element 15 confirms whether the command data is password verification command data having a format as shown in FIG. Here, the password verification command data includes the password verification function code, index specification information, and password information (
(consisting of PIN length and PIN number). According to the above confirmation, if it is not the password verification command data, the control element 15 decodes the function code in the command data, executes the corresponding process, outputs response data for the processing result, and returns to the command data waiting state. return.

As a result of the above confirmation, if it is the password verification command data, the control element 15 searches the index section of the password information table 162 in the data memory 16 for an index that matches the index designation information in the command data. As a result of this search, if no command is found, the control element 15 outputs response data indicating that execution is not possible, and returns to the command data waiting state.

If it is found through the above search, the control element 15 refers to the password area corresponding to the index.

Here, if the length part of the PIN code area is "FF"
If it is Hex, the control cord 15 recognizes that no password is stored, outputs response data meaning that the password is not set, and returns to the command data waiting state.

If the length part of the password area is other than "FF" Hex, the control element 15 recognizes that the password is stored, and then calculates the value of the corresponding second error counter and its limit value. Read and compare and check the two. As a result of this comparison and verification, if the limit value is larger than the value of the second error counter, the control element 15 performs a password verification process. If the limit value is not larger than the value of the second error counter as a result of the above comparison and verification, the control element 15 refers to the password verification status area corresponding to the index and reads out the contents of that area to take the corresponding action. The verification status bit is set to "0", response data indicating that the password cannot be used is output, and the process returns to the command data waiting state.

Now, in the password verification process, the password information in the input command data is compared and verified with the specified password. Through this comparison, if the two match,
The control element 15 sets the first and second error counters to "0".
0", then refer to the password verification status area corresponding to the index and read the contents of that area.
The corresponding verification status bit is set to "1", response data indicating completion of verification is output, and the state returns to the instruction data waiting state.

According to the above comparison, if the two do not match,
The control element 15 refers to the error limit area corresponding to the index and reads the contents of that area to determine whether the value of the lower 4 bits (limit value of the second error counter) is "0" or not. to judge. Based on this judgment, if the value is "0", the control element 15 refers to the password verification status area corresponding to the index, reads the contents of that area, and sets the corresponding verification status bit to "0". , outputs response data indicating that the PIN number does not match, and returns to the command data waiting state.

Based on the above judgment, if rOJ is not achieved, the control element 15 compares and verifies the value of the upper 4 bits (the limit value of the first machine counter) and the value of the first error counter. As a result of this comparison, if the former is greater than the latter, the control element 15 increments the value of the corresponding first error counter by one. Then, the control coder 15 refers to the password verification status area corresponding to the index, reads the contents of the area, sets the corresponding verification status bit to "0", and responds with a response indicating that the password does not match. Outputs the data and returns to the instruction data waiting state.

As a result of the above comparison, if the former is not larger than the latter, the control indexer 15 refers to the second error counter area corresponding to the index and reads the contents of that area, thereby increasing the second error counter. The value is compared and verified with the corresponding limit value (value of the lower 4 bits). As a result of this comparison, if the latter is larger than the former, the control element 15 increases the value of the corresponding second error counter by one. Then, the control coder 15 refers to the password verification status area corresponding to the index, reads the contents of that area, and sets the corresponding verification status bit as "
0'', outputs response data indicating that the PIN number does not match, and returns to the command data waiting state.

If the latter is not larger than the former, the control element 15 refers to the password verification status area corresponding to the index, reads the contents of that area, and reads the corresponding verification status bit. Set it to "0",
It outputs response data indicating that the password cannot be used and returns to the command data waiting state.

Furthermore, as shown in FIG. 7, the area numbers "12" and "13" of the error counter area correspond to the index "3".
2" and "33j" and "34" and "35", respectively. This means that the same error counter is used as the password corresponding to the index "32" and the password "33" as the verification command target. Also, indexes "34" and "35"
' has a similar relationship. Furthermore, especially the index “3
For "4" and "35", the error limit value is also shared (
"24" is commonly used as the area number). As a result, if the second error counter reaches the limit value when, for example, a password is verified using the index "34", it becomes impossible to simultaneously verify the password using the index "35".

Further, the area numbers of the password verification state areas corresponding to indexes "32" and "33" also indicate the same area number "42". Therefore, no matter which one is used for verification, the first bit of the verification status flag in FIG. 10 becomes "1".

Next, the transaction data write operation will be explained with reference to the flowchart shown in FIG. 15. In FIG. 1, if the input command data is not password verification command data, the control cable 15 determines whether the next input command data is transaction data write command data having the format shown in FIG. Decide whether or not. 22. Transaction data write command data is composed of a transaction data write function code, area designation information, and write data.

Based on the above judgment, if the transaction data is not write command data, the control element 15 decodes the function code in the command data, executes the corresponding processing, outputs response data for the processing result, and returns to the command data waiting state. Return to

If the above judgment indicates that the transaction data is write command data, the control search element 15 searches the transaction data area definition table 165 in the data memory 16 for an area number that matches the area designation information in the command data. As a result of this search, if no data is found, the control module 15 outputs response data indicating that the area is undefined, and returns to the command data waiting state.

If found through the above search, the control element 15 refers to the access condition information corresponding to the area number, and
It is determined whether the collation status bit indicated by the access condition information is "1" or not.

As a result of this determination, if it is "0", the control element 15 outputs response data indicating that access is prohibited, and returns to the command data waiting state again. If the above judgment is "1", the control element 15 performs transaction data write processing, outputs response data corresponding to the processing result, and returns to the command data waiting state again.

For example, referring to FIG. 5, the access condition information is "04" for area number "80", so if the second bit of the verification status bit is "1", the transaction data It is possible to write. Therefore, if the verification of the PIN number using the index "34" is successfully completed, the area "
Data can be written to "80". Also, since the area number "81" is related to the first bit of the verification status bit, if the verification of the PIN using the index "32" or "33" is successfully completed, the area in the data area 163 Data can now be written to "81".

In this way, when the PIN verification ends normally, identification information indicating that the verification was successful is set (the verification status bit is set to "1"), and when the verification ends abnormally, the identification information is set. (reset the collation status bit to '
0”). As a result, for example, even if a certain PIN is successfully verified once, if it is not successful in subsequent verifications, the verification status will be reset to the state before the verification process was performed, and therefore, there will be no unauthorized verification. Access is avoided and security is increased.

In the above embodiments, an IC card is used as an example of a portable electronic device, but the present invention is not limited to a card-like device, and may be, for example, a pro-shaped device or a stick-like device. Furthermore, the hardware configuration of the portable electronic device can be modified in various ways without departing from the spirit of the invention.

[Effects of the Invention] As described in detail above, according to the present invention, for example, when verification of a PIN number is successfully completed, identification information indicating that verification is normal is set, and when verification is abnormally completed, identification information is set. By resetting the identification information, for example, even if a certain PIN is successfully verified once, if the verification is not successful in subsequent verifications, the verification status will be canceled, thereby preventing unauthorized access. , it is possible to provide a portable electronic device with improved security.

[Brief explanation of the drawing]

The figures are for explaining one embodiment of the present invention.
The figure shows the format of the password verification command data.
Figure 4 shows the format of the data memory, Figure 4 shows a specific example of the password area definition table, Figure 5 shows a specific example of the transaction data area definition table, and Figure 6 shows the data area definition table. FIG. 7 is a diagram showing a specific example of the stored data; FIG. 7 is a diagram showing a specific example of the password information table; FIG. 8 is a diagram showing the first error counter area; FIG.
Figure 10 shows the format of the limit value stored in the error counter area, Figure 10 shows the format of the collation status bit, Figure 11 is a flowchart explaining the operation of the card league writer, and Figure 12 shows the format of the limit value stored in the error counter area. A diagram showing the format of command data input to the IC card,
FIG. 13 is a flowchart explaining the operation of the IC card, FIG. 14 is a diagram showing the format of general response data output from the IC card, FIG. 15 is a flowchart explaining the transaction data write operation, and FIG. 16 is a flowchart explaining the operation of the IC card. The figure shows the format of transaction data write command data, Fig. 17 is a block diagram showing the configuration of the IC chip built into the IC card, Fig. 18 shows the functional blocks of the IC card, and Fig. 19 shows the card league. - A block diagram showing the configuration of the writer; FIG. 20 is a block diagram showing the configuration of the terminal device. 1...IC card (portable electronic device), 2.
... Card league writer, 15 ... Control element (control section), 16 ... Data memory (memory section), 17 ... Program memory, 161
...Area definition table, 162...
Password information table, 163..."Data area, 164...Password information area definition table, 1
65... Transaction data area definition table. Applicant's representative Patent attorney Takehiko Suzue Figure 1 (a)
) Figure 1 (c) Figure 1 (d) Figure 2 Figure 3 Figure 4 Figure 5 Figure 8 Figure 9 Figure 10 Figure 6 Figure 7 Figure 16 Figure 11 (a) = Figure 12 Figure 14 ■ L ++ -1 Figure 17 Figure 18

Claims (1)

[Scope of Claims] A portable electronic device comprising a memory section, a control section for reading and writing data to the memory section, and means for selectively inputting and outputting data from the outside. a first data string stored in the memory section; and a second data string inputted from the outside and the first data string stored in the memory section with a predetermined gap between them. a verification means for verifying whether there is a relationship; a holding means for retaining positive identification information when the verification result of the verification means is positive; and a storage means for retaining positive identification information when the verification result of the verification means is negative; and a release means for releasing the positive identification information held by the holding means.