JPH02247790A - Ic card apparatus - Google Patents

Abstract

PURPOSE:To prevent the generation of invalid transacting action and to improve safeness by providing a terminal equipment with a certification means for retrieving a signature sentence. CONSTITUTION:Transaction data transmitted from the 1st IC card device 100 are received by the 2nd communication means 151 and inputted to the 1st certification means 156 formed in the 2nd card device 155 and the means 156 inspects the signature sentence in the transaction data, and at the time of confirming its validity, stores the transaction data in the 2nd memory means 152. A signature sentence formed only by the 1st valid IC card device 100 is added to the transaction data transmitted from the 1st IC card device 100 to a terminal equipment 150 and the signature sentence is inspected by the 1st certification means 156 at real time, so that the generation of invalid transaction can be previously prevented.

Description

DETAILED DESCRIPTION OF THE INVENTION Field of Industrial Application The present invention mainly consists of an IC card device in which an integrated circuit for recording information is built into the card, and a terminal device that exchanges information with the IC card device. The present invention relates to IC card equipment used in this field.

BACKGROUND ART FIG. 5 shows a conventional example of an IC card device.

In FIG. 5, an IC card device 500 includes a terminal device 5.
a first communication means 501 for transmitting and receiving data with 50;
The terminal device 550 is equipped with a first memory means 502 for recording data input from the terminal device 550, and a signature means 507 for generating a signature from the data input from the terminal device 550. data input means 553 for inputting transaction data, data processing means 554 for generating transaction data from input data, and IC card device 5.
a second communication means 551 for transmitting and receiving data with 00;
It has a second memory means 552 for recording data input from the IC card device 500.

Regarding the conventional IC card device configured in this way,
Its operation will be explained below.

When the IC card device 500 is inserted into the terminal device 550 and input data is input from the data input means 553, the data processing means 554 adds transaction-related data to the input data to generate transaction data. The communication means 551 transmits transaction data obtained from the data processing means 554 to the IC card device 500. The first communication means 501 receives transaction data transmitted from the terminal device 550, and stores it in the first memory means 502 and inputs it into the signature means 507. The signature means 507 creates a signature sentence from the input transaction data, adds it to the transaction data, and inputs it to the first communication means 501. First communication means 50
1 transmits transaction data with a signature obtained from the signature means 507 to the terminal device 550.

Transaction data with a signature transmitted from the IC card device 500 is received by the second communication means 551, and
is stored in the memory means 552 of.

The transaction data stored in the second memory means 552 includes:
Since a signature text that can only be generated by a legitimate IC card device is added, if the transaction data with the signature text is brought to a center (for example, a bank) that manages the signature means of the IC card device, it will be possible to identify the fraudulent IC card device. It is possible to detect fraudulent activities such as transactions by users and forgery/duplication of transaction data.

Problems to be Solved by the Invention However, in such a conventional configuration, the terminal device 55
0 cannot verify the signature generated by the IC card device 500, and therefore has the problem that it is impossible to prevent illegal transactions using the IC card device 500.

Of course, this problem can be avoided by connecting the terminal device 550 to a center such as a bank via a communication line and verifying the signature for each transaction online.

However, with this method, as the terminal device 550 becomes widespread and the number of transactions using the IC card device 500 increases, the load on central convenience stores such as banks increases, and the terminal device 550
It is not a fundamental solution, as the communication costs will also increase.

The present invention solves the above-mentioned conventional problems, and by providing the terminal device 550 with a recognition means that can verify a signature text, the present invention is an IC card device that can prevent illegal transactions using an IC card device. The purpose is to provide card equipment.

Means for Solving the Problems and In order to achieve the above objects, the present invention provides a first IC
The first IC card device includes a card device and a terminal device that communicates with the first IC card device, and the first IC card device includes a first communication means, a first memory means, and a first signature means. , the terminal device is configured to include a second communication means, a second memory means, a data input means, a data processing means, and a first authentication means.

Operation With this configuration, when the first IC card device is inserted into the terminal device and input data is input to the terminal device, a signature text is generated by the first IC card device, and the signature text is verified in the terminal device. be done. The flow of the process will be explained below.

First, when input data is input from the data input means, the data processing means adds related data such as a terminal number and transaction date and time to the input data to generate transaction data, and inputs the transaction data to the second communication means. The second communication means transmits the input transaction data to the first IC card device.

Transaction data transmitted from the terminal device is received by the first communication means, stored in the sixteenth memory means, and input into the signature means. The first signature means creates a signature text of the first IC card device from the transaction data, adds it to the transaction data and inputs it to the first communication means, and the first communication means deals with the transaction to which the signature text is added. Send data to the terminal device. Transaction data transmitted from the first IC card device is received by the second communication means, and the first authentication means verifies the validity of the signature text added to the transaction data.

Once the authenticity of the signature is confirmed, this transaction data is transferred to the second
stored in the memory means of.

In this way, the transaction data sent from the first IC card device to the terminal device is appended with a signature text that can only be created by the authorized first IC card device, and this signature text is sent to the transaction data sent from the first IC card device to the terminal device. Since the verification is performed in real time by the recognition means 1, it is possible to prevent transactions using legitimate IC card devices.

EXAMPLE An example of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of an IC card device in a first embodiment of the present invention.

In FIG. 1, 101 is a first communication means for transmitting and receiving data with the terminal device 150, and 102 is a first memory means for recording data input from the terminal device 150. Reference numeral 107 denotes a first signature unit that generates a signature text of the first IC card device 100 from data transmitted from the terminal device 150, and the first IC card device 100 is configured from the above.

Further, 153 is a data input means for inputting data from the outside, 154 is a data processing means for processing input data from the outside and generating transaction data, and 151 is a first IC.
A second communication means for transmitting and receiving data with the card device 100; 156 is a first authentication means for verifying the validity of the signature text generated by the first IC card device 100;
2 is a second memory means for recording data input from the first IC card device 100, and from the above, the terminal device 15
0 is configured.

Note that the first recognition means 156 is configured within a second IC card device 155 attached to the terminal device 150 and functions as a part of the terminal device 150.

The operation of the IC card device configured as described above will be explained below.

Generally, when a transaction is performed using an IC card device, the first IC card device 100 owned by the cardholder is
It is inserted into a terminal device 150 installed at a store, etc., input data such as transaction amount is inputted from the data input means 153, and the terminal device 150 and the first IC card device 1
00 memory means 152, 102.

First, when the first IC card device 100 is inserted into the terminal device 150 and input data is input from the data input means 153, the data processing means 154 adds related data such as the terminal number and transaction date and time to the input data. to generate transaction data, and the second communication means 151 transmits this transaction data to the first IC card device 100.

Transaction data transmitted from the terminal device 150 is received by the first communication means 101 and is stored in the first memory means 102.
and input to the first signature means 107. The first signature means 107 collects the transaction data from the first IC.
Create a signature sentence for the card device 100, add it to transaction data, input it to the first communication means 101, and send it to the first communication means 1.
01 sends the transaction data with the signature added to the terminal device 150
Send to.

Transaction data transmitted from the first IC card device 100 is received by the second communication means 151, and the transaction data transmitted from the first IC card device 100 is received by the second communication means 151.
First authentication means 156 provided within card device 155
is input. The first authentication means 156 verifies the signature text of the input transaction data, and when the validity of the signature text is confirmed, stores this transaction data in the second memory means 152.

In this way, the transaction data sent from the first IC card device 100 to the terminal device 150 includes the authentic first IC card.
A signature text that can only be created by the card device 100 is added, and this signature text is verified in real time by the first authentication means 156 in the terminal device 150, thereby preventing unauthorized transactions by the IC card device. be able to. Furthermore, since the transaction data stored in the second memory means 152 in the terminal device 150 is attached with a signature text that can only be generated by the authorized first IC card device, the transaction data is stored in the terminal device 150. It is extremely difficult to fraudulently falsify.

Next, a second embodiment of the present invention will be described with reference to the drawings.

FIG. 2 is a block diagram of an IC card device showing a second embodiment of the present invention.

In the figure, 200 is a first card device, 250 is a terminal device, 201 is a first communication means, 202 is a first memory means, and 207 is a first signature means. Also, 25
1 is a second communication means, 252 is a second memory means, 25
3 is a data input means, 254 is a data processing means, 255
is a second IC card device, 256 is a first authentication means,
The above configuration is similar to the configuration shown in FIG.

What is different from the configuration shown in FIG. 1 is the second IC card device 25.
A second signature means 257 for generating a signature text of the terminal device 250 is provided in the IC card device 5, and a second authentication means 206 for verifying the signature text generated by the terminal device 250 is provided in the first IC card device 200. It is a point.

The operation of the IC card device configured as described above will be explained below.

First, when the first IC card device 200 is inserted into the terminal device 250 and input data is input from the data input means 253, the data processing means 254 adds related data such as the terminal number and transaction date and time to the input data. transaction data is generated and input into the second signature means 257 provided within the second IC card device 255. The second signature means 257 uses the transaction data inputted to the terminal device 25.
0 is generated, added to the transaction data, and inputted into the second communication means 251. The second communication means 251 transfers the input transaction data with signature to the first IC card device 20.
Send to 0.

Transaction data with a signature transmitted from the terminal device 250 is received by the first communication means 201 and input to the second authentication means 206. The second authentication means 206 verifies the signature text of the input transaction data, and when the authenticity of the signature text is confirmed, stores this transaction data in the first memory means 202 and also stores it in the first signature means 207. input. The first signature means 207 creates a signature for the first IC card device 200 from the transaction data, adds it to the transaction data, and inputs it to the first communication means 201. The added transaction data is transmitted to the terminal device 250.

Transaction data transmitted from the first IC card device 200 is received by the second communication means 251, and
First authentication means 256 provided within the card device 255
is input. The first authentication means 256 verifies the signature text of the input transaction data, and when the validity of the signature text is confirmed, stores this transaction data in the second memory means 252.

As described above, the second signature means 257 is provided in the second IC card device 255, and the second signature means 257 is provided in the second IC card device 255.
By providing the second authentication means 206 within the terminal device 250, a signature text that can only be generated by an authorized terminal device 250 is added to the transaction data sent from the terminal device 250 to the first IC card device 200. , this signature is the first
Since the second authentication means 206 in the IC card device 200 verifies the transaction in real time, it is possible to prevent unauthorized transactions using the terminal device.

FIG. 3 is a block diagram showing one embodiment of the first and second signature means (hereinafter referred to as signature means) in the first and second embodiments.

In the figure, 301 is a first encryption means that encrypts data blocked into n bits (n>0) using a secret key encryption method, and 302 is a first encryption means 301.
A first register means 303 temporarily holds n-bit data encrypted by the first register means 303, and a first register means 303 performs an exclusive OR operation between the encrypted data obtained from the first register means 302 and the input data. It is an exclusive OR means.

Further, 304 is a first selection means for selecting m-bit data S (12m>0) from the encrypted data of the final block, and 305 is input data that selects m-bit data S obtained from the first selection means 304. It is a connecting means for connecting.

The operation of the signature means configured as described above will be explained below.

The transaction data input to the signature means 300 is divided into k blocks (Ml, M2, . . . , Mt), and each block is input to the first exclusive OR means 303. However, the data length of each block is n bits.

The first exclusive OR means 303 performs the first
An exclusive OR operation is performed on the encrypted data obtained from the register means 302 and the input transaction data, and the operation result is input into the first encryption means 301. The first encryption means 301 performs encryption processing for each block using a secret key encryption method, and sends the encrypted data to the first register means 3.
Enter 02. The encrypted data held in the first register means 302 is fed back to the first exclusive OR means 303 in order to perform an exclusive OR operation with the transaction data one block later.

The first selection means 304 is the final block Mk of transaction data.
m bits are selected from the encrypted data C1 corresponding to , the signature text S is extracted, and input to the linking means 305. The connection means 305 receives input transaction data (M,, M2...
..., Mh) obtained from the first selection means 304
Signature text S of bits is concatenated to generate transaction data with signature text.

In this way, a signature text is generated from the input transaction data, the signature text is added to the original transaction data, and the signature text is output from the signature means 300.

FIG. 4 is a block diagram showing an example of first and second authentication means (hereinafter referred to as authentication means) in the first and second embodiments.

In the figure, 401 is a second encryption means that encrypts data blocked into n bits (n>0) using a secret key encryption method, and 402 is a second encryption means 401.
A second register means 403 temporarily holds n-bit data encrypted by the second register means 402, and a second register means 403 performs an exclusive OR operation between the encrypted data obtained from the second register means 402 and the input data. It is an exclusive OR means.

Further, 404 is a second selection means for selecting m-bit (12m>0) data from the encrypted data of the final block;
Comparison means 405 compares the signature text S added to the input data and the m-bit data S° obtained from the second selection means 404.

The operation of the authentication means configured as described above will be explained below.

The transaction data input to the authentication means 400 consists of k blocks (M+, M=, . . . Ml), excluding the signature text S.
and a second exclusive OR means 4 for each block.
03.

The second exclusive OR means 403 performs the second
An exclusive OR operation is performed on the encrypted data obtained from the register means 402 and the input transaction data, and the operation result is input into the second encryption means 401. The second encryption means 401 performs encryption processing for each block using a secret key encryption method, and sends the encrypted data to the second register means 4.
Enter 02. The encrypted data held in the second register means 402 is fed back to the second exclusive OR means 403 in order to perform an exclusive OR operation with the transaction data one block later. The above processing is exactly the same as the signature means shown in FIG.

The second selection means 404 is the final block Mk of transaction data.
m bits are selected from the encrypted data Ck corresponding to the reference data S' and inputted to the comparison means 405.

The comparison means 405 compares the signature text S added to the input transaction data with the m-bit reference data S° obtained from the second selection means 404, and inputs only when the two match. Output transaction data.

In this way, the signature S added to the input transaction data is verified, and if its validity is confirmed, the input transaction data is output from the authentication means 400.

Note that in the first embodiment, the first authentication means 156 is configured in the second IC card device 155, and in the second embodiment, the first authentication means 256 and the second authentication means 256 are configured in the second IC card device 155.
It is extremely important for security that the signature means 257 is configured within the second IC card device 255.

Generally, it is possible to perform the functions of the first recognition means 156, 256 and the second signature means 257 by the data processing means 154, 254, but the normal terminal device 150,
In 250, the functions of the data processing means 154 and 254 are realized by software, so the functions can be easily copied or counterfeited. Therefore, there is a risk that an unauthorized transaction may be authenticated, or that a signature that can only be created by a legitimate terminal device may be easily forged.

However, if an IC card device is used as an authentication means or a signature means, since this IC card device is an extremely safe medium against fraudulent acts from outside, fraudulent transaction acts can be easily eliminated.

Effects of the Invention As described above, the present invention can prevent illegal transactions using an IC card device by providing a terminal device with an authentication means that can verify a signature.
It is possible to realize an IC card device with extremely high safety.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the configuration of an IC card device according to the first embodiment of the present invention, FIG. 2 is a block diagram showing the configuration of the IC card device according to the second embodiment of the present invention, and FIG. FIG. 4 is a block diagram showing an example of the first and second signature means in this embodiment, FIG. 4 is a block diagram showing an example of the first and second authentication means in this embodiment, and FIG. FIG. 1 is a block diagram showing the configuration of a conventional IC card device. 100.200...first IC card' device,
101, 201...-first communication means, 102°202...first memory means, 107,207
...First signature means, 206...Second authentication means, 150.250...Terminal device,
151.251... second communication means, 152.
252... Second memory means, 153, 253
...Data means, 154.254...
...Data processing means, 155,255...Second
IC card device, 156, 256: old: first authentication means, 257: second signature means. Name of agent: Patent attorney Shigetaka Awano and one other person

Claims (4)

[Claims] (1) comprising a first IC card device and a terminal device that communicates with the first IC card device;
The card device includes a first communication means for transmitting and receiving data to and from the terminal device, a first memory means for recording data input from the terminal device, and a signature sentence from the data input from the terminal device. the terminal device has a first signature means for generating and adding a signature sentence to the input data; the terminal device has a data input means for inputting data from the outside; a data processing means for generating transaction data; a second communication means for transmitting and receiving data to and from the first IC card device;
The first step is to verify the signature text of the data obtained from the communication means of
An IC card device comprising: an authentication means; and a second memory means for recording data input from the first IC card device. (2) The first authentication means is a second authentication means attached to the terminal device.
The IC card device according to claim 1, configured in an IC card device of. (3) comprising a first IC card device and a terminal device that communicates with the first IC card device;
The card device includes a first communication means for transmitting and receiving data with the terminal device, a second authentication means for verifying a signature text of data input from the terminal device, and a second authentication means for verifying a signature text of data input from the terminal device. The terminal device has a first memory means for recording data, and a first signature means for generating a signature text from data input from the terminal device and adding the signature text to the input data, and the terminal device receives data from the outside. a data input means for inputting data; a data processing means for processing data input from the data input means to generate transaction data; and a data processing means for generating a signature from the data input by the data processing means and adding a signature to the input data. a second signature means for adding a second signature, a second communication means for transmitting and receiving data with the first IC card device, and a first authentication for verifying a signature of data obtained from the second communication means. and second memory means for recording data input from the first IC card device. (4) The IC card device according to claim 3, wherein the second signature means and the first authentication means are configured in a second IC card device installed in the terminal device.