JPH03224047A - Portable electronic device - Google Patents

Abstract

PURPOSE:To decide the propriety of accesses to a memory while keeping the security by deciding whether the key data used for confirmation belongs to a common data file or an application data file and then clearing the result of confirmation at selection of applications if the key data belongs to the application data file. CONSTITUTION:A data memory consists of a common data file 21 which is used in common by all application and plural application data files 22a - 22c which are used individually by each application. Then it is decided whether they key data used for confirmation belongs to the common data file or the application data file. If the key data belongs to the latter data file, the result of confirmation of the application data file is cleared at selection of applications. Thus it is possible to decide the propriety of accesses to the data memory based on the result of confirmation while keeping the security among applications.

Description

Detailed Description of the Invention [Object of the Invention] (Industrial Application Field) The present invention relates to erasable non-volatile memory and C
The present invention relates to a portable electronic device called an IC card, which has a built-in IC (integrated circuit) chip having a control element such as a PU.

(Prior Art) As a function required of recent IC cards, external devices (
A mutual authentication function with a terminal device that handles IC cards (such as a terminal device that handles IC cards) has been proposed. In this case, there is an access control method that prohibits access unless mutual authentication is performed with the external device.

(Problem to be Solved by the Invention) In this case, as IC cards become used for multiple purposes, it is conceivable that each application will have its own authentication key data. If it can also be used when application B is operated, it will be difficult to separate the security between applications.

Therefore, the present invention provides a portable electronic device that has different authentication key data for each application, and that can determine whether access to memory is allowed based on the authentication result while maintaining security between applications. The purpose is to

[Structure of the Invention] (Means for Solving the Problems) The present invention has at least a memory and a control element that accesses the memory, and selectively exchanges data with the outside. The memory includes a first area that is commonly accessed by all applications, and at least one area that is used individually by each application.
a portable electronic device that is divided into two second areas and has at least one key data in the first and second areas, wherein after the device is activated, only the first area; means for accessing, first receiving means for receiving selection information for selecting one of the second areas from the outside, and a corresponding first receiving means based on the selection information received by the first receiving means; means for selectively making the second area accessible; second receiving means for receiving first encrypted data obtained by encrypting at least the first data using first key data; an encryption means that generates second encrypted data by encrypting the selected second area with first key data corresponding to the selected second area; a comparison means for comparing the first encrypted data received by the reception means; a means for determining whether or not the memory can be accessed based on the comparison result of the comparison means; and one of the second areas is newly selected. means for determining whether the first key data, on which the comparison result is based, exists within the first area or within the second area when the comparison result is determined; and means for converting the positive result of the comparison result into a negative result when it is determined that the comparison result exists within the area.

(Operation) Determine whether the key data used for authentication is from the common data file (first area) or the application data file (second area), and if it is from the application data file, the application The authentication result is cleared upon selection. This results in
Have different key data for each application,
Security can be ensured by performing authentication using this key data and determining whether access to the memory is allowed based on the result, while maintaining security between applications.

(Example) Hereinafter, an example of the present invention will be described with reference to the drawings.

FIG. 6 shows an example of the configuration of a terminal device that handles an IC card as a portable electronic device according to the present invention. That is, this terminal device 8 allows the IC card 1 to be connected to a control section 3 consisting of a CPU, etc. via a card reader/writer 2, and also connects the control section 3 with a keyboard 4, a CRT, etc.
It is constructed by connecting a display device at5, a printer 6, and a floppy disk device 7.

The IC card 1 is held by the user and is used to refer to a personal identification number known only to the user when purchasing a product, for example, and to store necessary data. Its functional blocks are shown in Fig. 5. It is further comprised of parts that execute basic functions such as a read/write section 11, a password setting/password verification section 12, and an encryption/decryption section 13, and a supervisor 14 that manages these basic functions. The read/write unit 11 has a function of reading, writing, or erasing data from a data memory 16, which will be described later.

The password setting/password verification unit 12 has a function of storing the password set by the user and prohibiting reading thereof, and after setting the password, verifies the password and grants permission for subsequent processing. The encryption/decryption unit 13 performs encryption and decryption of encrypted data to prevent leakage and forgery of communication data when transmitting data from the control unit 3 to another terminal device via a communication line, for example. It is something that carries out transformation. The supervisor 14 has the function of decoding the function code input from the card reader/writer 2 or the function code to which data is added, and selecting and executing a necessary function among the basic functions.

In order to perform these various functions, the IC card 1 has a control element (for example, a CPU) 1, as shown in FIG.
5, it is composed of a data memory 16, a program memory 17, and a contact part 18 for obtaining electrical contact with the card reader/writer 2, and the part within the broken line (control element 15, data memory 16, The program memory 17) is composed of one IC chip (or a plurality of IC chips) and is embedded within the IC card body.

The program memory 17 is composed of, for example, a mask ROM, and stores a control program for the control element 15 including subroutines for realizing each of the basic functions described above.

The data memory 16 is used to store various data, and is composed of an erasable nonvolatile memory such as an EEPROM.

For example, as shown in FIG. 3, the data memory 16 stores one common data file (hereinafter abbreviated as CDF) 21 that is commonly used by all applications, and a plurality of application data files (hereinafter referred to as CDF) that are used individually by each application. (hereinafter abbreviated as ADF) 22a, 2
2b and 22c, and each ADF 22
a.

In 22b and 22c, the data file name (D
FN) is given.

In the example shown in FIG. 3, the CDF 21 contains designation key data a indicated by the key data number KIDOI.
aa and internal key data bbb indicated by key data number KIDO2, and the ADF 22a indicated by DFN-AAA includes designation key data CCC indicated by key data number KIDO3 and key data number KIDO4. Designation key data ddd is included. The ADF 22b indicated by DFN-BBB contains internal key data eee indicated by key data number KIDO5.
, and a data area indicated by area number AIDS5. In particular, the data area is given attribute information (A) indicating that it can be accessed if authentication is confirmed through authentication processing using internal key data within the ADF 22b. In addition, the ADF22c indicated by DFN-CCC contains internal key data fff indicated by key data number KID80.
, a data area indicated by area number A I DS6,
and a data area indicated by area number AIDS7. In particular, the data area indicated by the area number AIDS6 is given attribute information (C) that indicates that it can be accessed if authentication is confirmed in the authentication process using the internal key data in the CDF21, and the data area indicated by the area number AIDS
The data area indicated by 7 is given attribute information (X) indicating that it can be accessed if authentication is confirmed through authentication processing using internal key data in the CDF 21 or internal key data in the ADF 22c.

Here, the designation key data is key data for the terminal device 8 to authenticate the IC card 1, and the internal key data is the key data for the IC card 1 to authenticate the terminal device 8.

Next, an overview of the operation of the IC card 1 will be explained using FIG. When the IC card 1 receives the message shown in FIG. 2(a) from the terminal device 8, it selectively reads the message shown in FIG. 1(a) from the function code.
Execute the mutual authentication preparation flow in a). These processes are performed by the control element 15 according to the program in the program memory 17. That is, first, it is determined whether the ADF has been selected or not by checking the internal RAM (RAM in the control element 15).
) in the selected ADF specific information. At this time, if it has not been selected, the key data number (K
ID), and if it is already selected, CDF21
Find the KID within and also within the selected ADF. If it is not found at this point, an error status will be output. Note that normally, the CDF 21 is automatically selected at startup.

When the key data number (KID) is found, the corresponding key data is internally read and checked to see if it is normal. At this time, if it is not normal, an error status is output. If normal, the random number information A in the message and the key data are stored in a predetermined area of the internal RAM. Next, random number information B is generated according to a predetermined algorithm using this random number information A, the card-specific number set at the time of card issuance, and card random number information stored in advance as an initial value in the data memory 16. , rewrite this as new card random number information.

Next, check again whether the ADF has been selected, and if it is not selected, find the KID of the internal key data from the CDF21, and if it has been selected, check the internal key data KID in the CDF21 and the selected ADF.
Find KID from inside (ADF is prioritized). If not found, output an error status. If found, the corresponding key data is read internally and checked to see if it is normal. At this time, if it is not normal, an error status is output.

Now, if it is a pressure sensation, the previously generated random number information B is encrypted using the found internal key data as an encryption key, and the result is stored in a predetermined area of the internal RAM as authentication information C2X. Then, the internal key data KID and random number information B are output, and this flow ends.

Through this flow, random number information and key designation information can be shared in mutual authentication between the terminal device 8 and the IC card 1.

Next, when the message shown in FIG. 2(b) is received, the flow shown in FIG. 1(b) is selectively executed from the function code. That is, first, it is checked whether the mutual authentication preparation command described above has been executed, and if not, an error status is output.

If it has been executed, the authentication information C2 in the next input message
and the authentication information C2X that was previously stored on the internal RAM.
If they match, turn on the match flag, otherwise turn it off. At this time, the match flag is AD
There is an ADF compatible match flag that indicates the authentication result of F, and a CDF compatible match flag that indicates the CDF authentication result, and depending on whether the internal key data belongs to ADF or CDF,
Turn on or off the F-compatible match flag or the CDF-compatible match flag. Next, the random number information A previously stored in the internal RAM is encrypted using the specified key data as the encryption key, and the result is output as the authentication information CIX together with the result of the matching flag above, and this flow is executed. finish.

This flow enables mutual authentication with the terminal device 8.

Next, when the message shown in FIG. 2(C) is received, the ADF selection flow shown in FIG. 1(C) is selectively executed from the function code. That is, first, it is checked whether the DFN in the message is registered in the data memory 16 of the IC card 1, and if it is not found, an error status is output.

If found, the ADF compatible match flag of the C2/C2X match flag is turned off. Next, the specified DFN
It holds the unique information corresponding to in the internal RAM and outputs the normal completion status.

Next, when the read command message shown in FIG. 2(d) or the write command message shown in FIG. 2(e) is received, the flow shown in FIG. 1(d) is selectively executed from the function code. That is, first determine whether the ADF has been selected,
If it has not been selected, the area number (AID) in the input message is found in the CDF 21, and if it has been selected, the AID is found in the selected ADF and the CDF 21.

At this time, if it is not found, an error status is output. If found, it is determined whether or not it is necessary to check the previous match flag by referring to the attribute information of the correspondingly stored area. If necessary, it is AD
F-compatible match flag or CDF-compatible match flag, or
Decide which one is better.

If the ADF compatible match flag is required or if either is acceptable, refer to the ADF compatible match flag and check whether it is turned on. If off, output error status.

Furthermore, if the CDF correspondence match flag is required or either is acceptable, the CDF correspondence match flag is referred to and checked to see if it is turned on. If it is off, it will output an error status.

Then, according to the function code in the message, the corresponding read or write processing is performed and the processing result is output.

Next, the operation of the IC card 1 with respect to the key data and area configuration as shown in FIG. 3, for example, will be explained. In Fig. 3, as described above, in this state, for mutual authentication when ADF selection is not performed, the key data of KIDOI is used as the designated key data, and the key data of KID02 is used as the internal key data. is used.

In addition, when ADF22a is selected by DFN-AAA, the specification key data is KID03 or KID03.
IDO4 key data or KIDOI key data is used, and KIDO2 key data is used as internal key data.

Similarly, when the ADF 22b is selected by DFN-BBB, the key data of KIDOI is used as the specification key data, and the key data of KIDO5 is used as the internal key data.

Now, in order to access the area of AIDS5 in the ADF 22b, the attributes of this area must be set to the ADF 22b.
The internal key data is now required. Therefore, mutual authentication must be performed after selecting the ADF 22b. If ADF22b is selected after mutual authentication, the internal key data used for this mutual authentication is KI.
This is because it becomes the key data for DO2.

Furthermore, in order to access the area of AIDS 6 in the ADF 22c, the attributes of this area require internal key data in the CDF 21. Therefore, C
After mutual authentication using key data KIDO2 inside the DF, the ADF 22c must be selected and the area accessed.

Therefore, if the CDF compatible match flag is on, access is possible.

Also, for the AIDS7 area, since no internal key data is required, the key data K in CDF21 is
Even if ADF22c is selected after mutual authentication using IDO2, the reverse is true, that is, ADF22C is selected and then ADF
The key data KIDO8 in 22c allows access even after mutual authentication.

Therefore, especially when ADF 22b is selected first, mutual authentication is executed, and then ADF 22c is selected, access to the AIDS7 area becomes impossible.

In this way, determine whether the key data used for authentication is from the common data file (CDF) or the application data file (ADF), and if it is from the application data file, select the application data file. Sometimes it clears the authentication results of the Aburi Kenyon data file. As a result, security can be ensured by providing different key data for each application, performing authentication using this key data, and determining whether access to the data memory is possible based on the result, while maintaining security between applications. I can do it.

[Effects of the Invention] As detailed above, according to the present invention, each application has different authentication key data, and while maintaining security between applications, it is possible to determine whether or not to access memory based on the authentication result. It is possible to provide a portable electronic device capable of

[Brief explanation of drawings]

The figures are for explaining one embodiment of the present invention.
The figure shows examples of various command message formats input to the IC card, Figure 3 shows the file structure of the data memory, Figure 4 is a block diagram showing the schematic configuration of the IC card, and Figure 5 shows the IC card. FIG. 6 is a block diagram showing the configuration of the terminal device. 1...IC card (portable electronic device), 8.
...Terminal device, 15... Control element, 16
... Booter memory (non-volatile memory), 17 ... Program memory, 21 ... Common data file (CDF. first area), 22a, 22b, 22cm = -=Application data file (ADF, second area).

Claims (1)

[Claims] The device has at least a memory and a control element that accesses the memory, and selectively exchanges data with the outside, and the memory is commonly accessed by all applications. The portable device is divided into a first area of interest and at least one second area used for each application individually, and has at least one key data in the first and second areas. An electronic device, comprising: means for accessing only the first region after the device is activated; and a first receiving means for receiving selection information for selecting one of the second regions from the outside. , means for selectively making accessible a corresponding second area based on the selection information received by the first receiving means; a second receiving means for receiving the first encrypted data; and an encrypting means for encrypting the first data using the first key data corresponding to the selected second area to generate the second encrypted data. , a comparing means for comparing the second encrypted data generated by the encrypting means and the first encrypted data received by the second receiving means, and controlling access to the memory based on the comparison result of the comparing means. means for determining whether or not the first key data, which is the basis of the comparison result when one of the second areas is newly selected, exists in the first area or not; A mobile phone characterized by comprising: means for determining whether the second region exists within the second region; and means for making a positive result of the comparison result a negative result if it is determined that the second region exists as a result of this determination. Possible electronic devices.