JPH06176216A - Ic card - Google Patents

Abstract

PURPOSE:To prevent illegal read/write or the leakage of internal data by providing the security of stored data by performing the compression and extension of these data only when it is verified by a personal identification number that a user is legal. CONSTITUTION:A vertify control part 6 receives the personal identification number from a character input part 7, compares it with personal identification numbers previously set in a personal identification number storage part 8 and controls whether access is permitted or not. Only when these personal identification numbers are coincident, the verify control part 6 sends a verify signal to a compression control part 4 and a memory part 1 and sends a control signal to a display circuit 9. The compression/extension control part 4 controls the compressing/extending operation of data performed at a compression/extension circuit 3. The compression / extension circuit compresses data, which are exchanged with the outside via an input/output buffer 2 in the case of writing them in the memory part 1, and extends the compressed data in the case of reading them to the outside. Thus, the security of internally stored data can be provided and the unwanted leakage of information can be prevented.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an I containing a storage means.
The present invention relates to a C card, and more particularly to an IC card that can prevent internal information from being leaked out regardless of the user's will, in a card in which a plurality of functions are integrated.

[0002]

2. Description of the Related Art Conventionally, for example, some CD (cash dispenser) terminals of banks use magnetic cards to achieve predetermined functions. In this case, one magnetic card corresponds to a specific bank, and if there are transactions with a plurality of banks, the number of the magnetic cards will be possessed.

Since an IC card having a semiconductor memory inside has a larger storage capacity than a magnetic card, in the case described above as an example, one IC card has a function of realizing transactions with a plurality of banks. It is also possible to have. The configuration of such an IC card is disclosed in, for example, Japanese Patent Laid-Open No.
Japanese Patent No. 140892 discloses an IC card which has a single IC card and can fulfill the functions of a plurality of magnetic cards.

Further, Japanese Patent Laid-Open No. 2-183388 discloses an IC card in which data is compressed by a microcomputer and written in a memory so that the memory can be used effectively and more than its own capacity. It is disclosed.

[0005]

As described above, one IC card can be used more efficiently by consolidating a plurality of functions and information in one IC card or by compressing and recording data. On the other hand, if an accident or intentional falsification of internal information occurs, or if internal information leaks, the damage will be greater than with a single-function card. . In the above-mentioned publicly known example, no particular consideration is given to such a security problem.

An object of the present invention is to realize security of data stored inside by utilizing data compression in an IC card. Specifically, in an IC card capable of storing a plurality of applications, security is realized for each application so that information of other applications will not be leaked when using one of the applications. The purpose is to provide an IC card.

[0007]

In order to solve the above-mentioned problems, in the present invention, a storage means for storing data and an authentication key such as a personal identification number for identifying a user are used for authentication. An IC card having an authenticating means is provided with a data compressing / expanding means for compressing the data when writing the data into the storing means and expanding the compressed data when reading the data from the storing means. The data compression / decompression means compresses and decompresses the data only when the authentication means authenticates the user as an authorized user specified in advance.

If a plurality of storage means are provided or the storage means is divided into a plurality of areas so that a plurality of applications can be stored, each of the plurality of applications can be stored. The authentication key can be set by using the authentication key corresponding to the application to be used among the authentication keys set for each application. Only performed when the user is authenticated.

[0009]

As described above, the operation of decompressing the compressed data stored in the storage means or compressing and recording the data in the storage means is authenticated by the authenticating means as the user being authorized. Since it is performed only when the data is stored, it is possible to prevent the data stored in the storage unit from being read out or rewritten without permission.

[0010]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing an example of a block diagram of an IC card to which the present invention is applied. 1 is a memory unit for storing application data, 2 is an address signal, a data signal, and a control signal with the outside of the IC card. An input / output buffer 3 for exchanging data compresses data exchanged with the outside via the input / output buffer 2 when writing it in the memory unit 1, and expands the compressed data when reading it to the outside of the card. The compression / expansion circuit 4 is a compression / expansion control unit for controlling the compression / expansion operation of the data performed by the compression / expansion circuit 3, and a Huffman method or the like can be used as a data compression algorithm. Reference numeral 5 is a read / write control unit that receives a control signal for determining the reading / writing direction of data sent from an input / output unit (not shown) from the register 10 described below and sends it to the compression control unit 4, and 6 is a character input unit 7 described below. An authentication control unit that receives a personal identification number input from the device, compares the personal identification number with a personal identification number preset in a personal identification number storage unit 8 to be described later, and controls whether or not to permit access to the inside of the card from the outside. Reference numeral 7 denotes a character input unit that receives an input from a character input key shown in FIG. 3, which will be described later, and sends the input to the authentication control unit 6. Reference numeral 8 is set to limit access to application data stored in the memory unit 1. Security code storage unit for storing the security code
3 is a display circuit for displaying a status indicating whether or not the access is permitted by the authentication control unit 6 on a status display unit of FIG. 3 described later, and 10 is an external device to know the internal status of the IC card, It is a register for obtaining the head address and controlling the direction of reading and writing data.

FIG. 2 is a diagram showing an example of the internal configuration of the memory unit 1 in FIG. 1, in which 21a, 21b, ..., 21d are memory circuits capable of storing different applications, and 22 is a memory circuit 21a for storing data. , 21b,
..., data switch to be assigned to any of 21d, 2
3 designates addresses as memory circuits 21a, 21b, ..., 21d
It is an address switch assigned to. In FIG.
When any of the memory circuits 21a to 21d is unspecified or all four of them are referred to as a memory circuit 21.

In the present embodiment, description will be made assuming that the memory section has four memory circuits as shown in FIG. 2, that is, a maximum of four applications can be stored.

FIG. 3 is a diagram showing an example of the external appearance of an IC card to which the present embodiment is applied. Reference numeral 31 is an IC card main body, 32 is a character input key for inputting simple characters such as a personal identification number and numerical values, and the like. Reference numeral 33 has a display device such as a liquid crystal display, and with respect to the personal identification number set for each application,
This is a status display unit for notifying the user of the status as to whether or not the personal identification numbers input from the character input keys 32 match.

The operation at the time of use will be described on the assumption that application data is stored in the memory unit 1 and the personal identification number for each application is set in the personal identification number storage unit 8. As an application, here is the use as a so-called prepaid card,
For example, assume a telephone card. The card user
First, the character input key 32 is pressed to input, for example, a 4-digit personal identification number for the prepaid card application. The input personal identification number is sent to the authentication control unit 6 via the character input unit 7. The authentication control unit 6 reads out a preset personal identification number of the prepaid card application from the personal identification number storage unit 8 and compares it with the input personal identification number. At the same time as sending to the extension control unit 4 and the memory unit 1,
A control signal is sent to the display circuit 9 to the status display section 33 to display to the user that the use as a corresponding application (a telephone card in this example) has been authenticated. If the two personal identification numbers do not match, a status display to that effect is displayed on the status display section 33. In this case, since the authentication signal is not sent to the companding control unit 4, the compression / expansion circuit 3 does not operate even when the access request is received from the telephone inserted in the telephone in this state, and the access is rejected. The error status signal to the effect is returned to the telephone side.

A user who confirms that the use of the card has been authenticated inserts the card into a telephone (not shown). Information of the remaining frequency usable as a telephone card is compressed and recorded in, for example, the memory circuit 21a in the memory unit 1. The operation on the telephone side is to read this remaining frequency information, subtract the frequency used at the end of the call from the previously read remaining frequency information, and write the new remaining frequency information obtained in this way into the card. Returning is the basic operation.

This operation will be described below. First, when the IC card body 31 is inserted into the card insertion slot of the telephone, the telephone accesses the register 10 through the input / output buffer 2 and a ready flag indicating the status of the IC card, that is, whether or not the card is in an access waiting state. A check is performed and the start address of the memory unit 1 is obtained. If the ready flag is not set, the card side has not transitioned to the access waiting state. Therefore, after waiting for a predetermined time, the register 10 is accessed again to read the ready status.
Check the flag. If the ready flag is set, the IC indicates the signal indicating the direction of access, that is, the read, and the start address of the memory unit 1 as a read access request.
Send to the card side. The signal indicating the former read is sent to the read / write control unit 5 and further transferred to the companding control unit 4.
Since the reading of data means decompression, that is, the data read out according to the head address of the memory unit 1 is sequentially decompressed by the compression / decompression circuit 3 and transferred to the telephone side.

Here, the operation of the memory section 1 will be described with reference to FIG. The address space of the memory unit 1 seen from the external device side (the telephone in this example) is one memory circuit 21. Therefore, the address sent from the external device through the input / output buffer 2 is transferred to the address switch 23. The address switch 23 switches the address using the authentication signal sent from the authentication control unit 6 so as to select the memory circuit 21a among the four memory circuits 21 existing inside the memory unit 1. As a result, this address signal is sent to the memory circuit 21a, and the memory circuit 21a
The data is read from a. The read data is sent to the compression / expansion circuit 3 via the data switch 22.

As described above, from the external device side, the memory circuit 21 corresponding to the application (that is, 21a to 2a).
Since only one of the 1d) is visible, there is no risk of accidentally or intentionally accessing other unrelated application information.

Next, the process at the end of the call, that is, the process of writing data to the card will be described. At the end of the call, data obtained by subtracting the frequency used for the call from the frequency previously read from the card is written to the card. At this time, the control signal indicating writing, the head address of the memory unit 1 and the data to be written are sent to the IC card side. The operation of the memory unit 1 at the time of writing data is almost the same as that of the previous reading. In the write operation, the data compressed by the compression / expansion circuit 3 is sent to the memory circuit 21a via the data switch 22. When the above operation is completed, the card is ejected from the insertion slot of the telephone.

As described above, in the present embodiment, in the IC card storing four applications, the personal identification number is set for each application, and the data compression / expansion is performed only when the user is authenticated. Since the processing is performed, it can be prevented from being abused when it is accidentally reached by the wrong person.

Further, since only the memory space corresponding to each application can be accessed from the external device side, there is no fear that unnecessary data will be extracted and misused.

In the embodiment described here, the output of the data itself is stopped by not expanding the data when reading access from the outside when the authentication information does not match. Alternatively, the compressed data may be output. By doing so, meaningless data is output to the data receiving side, so security against unauthorized access is protected.

Although the number of storages of application data has been described as 4, the number may be actually larger or smaller than that, and may be implemented within the range permitted by the memory capacity.

Alternatively, if the authentication information such as the personal identification number is also compressed using a compression algorithm,
Security is further improved.

Further, although the specifications of the input / output interface with the external device are not particularly mentioned, this may take the form of a connector like a normal IC card or a form like a magnetic card. These are application dependent and do not affect the essence of the invention.

Further, the Huffman method is taken as an example of the data compression algorithm, but other algorithms may be used as long as the same effect can be obtained.

The status display unit 33 is assumed to be a display device using liquid crystal or the like, but other display methods such as LE.
Anything using D or the like or any other one that allows the user to identify the authentication status of the card may be used.

[0028]

As described above, according to the present invention, a memory area for storing a plurality of applications is provided in the IC card, and compression is performed when recording data in this memory area and when reading data. The compressed data is decompressed and read according to the authentication information set for each application, and the address space of the memory circuit where the application is stored is accessed from the external device side that accesses each application. Since it is configured to be accessible only to other users, when using one of the applications, the data of other applications are accessed, and in the unlikely event that it gets into the hands of others, reading and writing of the internal data are performed. It is extremely unlikely to be abused. As a result, it is possible to maintain a high level of security even for data that may be misused, such as private data such as medical record information of hospitals and personal addresses, or transaction information with banks and credit companies. Therefore, it is particularly effective when these applications are mixed and used.

Further, since data compression is used, there is an effect that the memory can be used efficiently.

[Brief description of drawings]

FIG. 1 is a block diagram 1 of an IC card to which the present invention is applied.
It is a figure which shows an example.

FIG. 2 is a diagram showing an example of an internal configuration of a memory unit 1 in FIG.

FIG. 3 is a diagram showing an example of an external appearance of an IC card to which this embodiment is applied.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Memory part, 2 ... Input / output buffer, 3 ... Compression / expansion circuit, 4 ... Companding control part, 5 ... Read / write control part, 6 ... Authentication control part, 7 ... Character input part, 8 ... PIN code storage part, 9 ... display circuit, 10 ... register.

 ─────────────────────────────────────────────────── ─── Continuation of front page (72) Inventor Tsutohiro Ono 292 Yoshida-cho, Totsuka-ku, Yokohama-shi, Kanagawa Ltd. Microelectronics Device Development Laboratory, Hitachi, Ltd. (72) Inventor Yukio Nakata Yoshida-cho, Totsuka-ku, Yokohama-shi, Kanagawa 292 Hitachi Ltd. Microelectronics Device Development Laboratory

Claims (3)

[Claims] 1. An IC card having storage means for storing data and authentication means for performing authentication using an authentication key such as a personal identification number for identifying a user, when writing data to the storage means. Compress this data to
When the data is read from the storage unit, the data compression / decompression unit that decompresses the compressed data is provided, and the compression and decompression of the data by the data compression / decompression unit is performed by the authenticating unit. An IC card, which is performed only when the user is authenticated. 2. The IC according to claim 1, wherein a plurality of storage means are provided, or a plurality of application data can be stored by a method such as dividing the storage means into a plurality of areas. A card,
The authentication key for the authentication means can be set for each application, and the compression and decompression of data by the data compression / expansion means when using each application is performed by the authentication key set for each application. An IC card, which is executed only when a user is authenticated by the authentication means using an authentication key corresponding to an application to be used. 3. The storage device according to claim 1 or 2, wherein a plurality of storage means are provided or a plurality of application data can be stored by a method of dividing the storage means into a plurality of areas. An IC card, using an authentication key set for each of the applications, to select one of the plurality of storage units or any one of the storage units divided into the plurality of regions. An IC card characterized by being configured as described above.