JPH0660235A - Ic card - Google Patents

Abstract

PURPOSE:To allow the IC card to correspond to a file structure of a multi- hierarchy, and to obtain independence of a file from an issuer by setting a hierarchy number of unlocking information whose reference is desired at the time of deciding whether an access to the file is allowable or not, to an access condition setting part. CONSTITUTION:An access condition setting part 80 is constituted of an access key setting part 81 and a logical condition setting part 82, and the logical condition setting part 82 consists of a horizontal direction setting part 83 and a vertical direction setting part 84. The access key setting part 81 sets a key number of a key whose collation becomes necessary prior to read-out of a data area, and is constituted of 8 bits corresponding to key number. Also, the vertical direction setting part 84 designates in which hierarchy the unlocking information is used in a calculation of OR, and is constituted of 5 bits corresponding to each hierarchy. Moreover, the horizontal direction setting part 83 sets a logical condition of the key designated by the access key setting part 81, and can designate one of AND ('1' is set) and OR ('0' is set).

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an IC card for controlling access to a plurality of built-in files by using key verification information.

[0002]

2. Description of the Related Art The file structure of a conventional IC card is shown in FIG.
As shown in FIG. 2, it was logically composed of two layers. Two
Reference numeral 00 denotes a memory built in the IC card, which is composed of a unique parent file 201 located in the first layer and a plurality of child files 202 and 203 located in the second layer.
Each child file 202, 203 is used for each application. The parent file 201 is a file commonly used by a plurality of applications, and stores common data 204 such as the cardholder's name, address, and telephone number, as well as an application-independent global key 205. On the other hand, the child files 202 and 203 store application-specific data 206 and 208 and local keys 207 and 209. Global key 205
The local keys 207 and 209 (hereinafter, simply referred to as “key” as a generic name) are for controlling access to the parent file 201 and the child files 202 and 203, and the necessary keys are collated normally. Only after, common data 204 and unique data 206, 20
8 can be accessed.

In the conventional IC card, the file structure has only two layers, and the access control method is limited to two layers. More specifically, if the global key 205 is collated, not only the common data 204 but also the unique data 206 and 208 can be accessed. If the local keys 207 and 209 are collated, the files to which the respective local keys belong. Access to the unique data of

[0004]

There are two problems with such a conventional configuration. The first point is that the access control method is limited to the case of a two-layer file structure, so that it cannot support a file structure of three or more layers. For example, when a grandchild file (not shown) is created under the child file 202, the local key 207 may be required to act as a global key for the subordinate grandchild files. It cannot be realized.

The second point is that a person who knows the global key 205 (generally an issuer) can access the unique data 206 and 208 without knowing the local keys 207 and 209. That is, it is not possible to create an application-specific file that even the publisher cannot access, and the independence of the file cannot be maintained.

The present invention is intended to solve such a conventional problem, and can cope with a multi-layered file structure and can ensure the independence of the file from the issuer.
The purpose is to provide a C card.

[0007]

In order to achieve the above object, an IC card of the present invention comprises a processing control section, a non-volatile memory and a volatile memory, and the non-volatile memory has a plurality of hierarchical structures. The volatile memory has a file and an access condition setting unit related to a layer number, and the volatile memory has a plurality of unlocking information fields corresponding to the layer number.

[0008]

With this structure, for example, an access condition setting unit is provided for each file, and the hierarchy number of the unlock information to be referred to when determining whether or not access to the file is set in the access condition setting unit. Access control corresponding to a multi-layered file structure becomes possible. Further, by setting the access condition setting unit so that only the unlock information of the file itself can be referred to, it becomes possible to provide a file independent of the issuer.

[0009]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram of an IC card,
The IC card 1 is composed of a processing control unit 2, a RAM 3 and a non-volatile memory 4. The processing control unit 2 is composed of a CPU, a ROM, an input / output unit, and the like as hardware, but in FIG. 1, it is described as a processing block realized by a program stored in the ROM. The contents of these processes will be described later.

The non-volatile memory 4 stores a plurality of files as shown in FIG. 2, and logically has a hierarchical structure of five stages. As shown in FIG. 3, each file has a plurality of data areas for storing data and a plurality of keys for access control, and these are managed by the directory 61. FIG. 3 shows the case of the file 11, which has three data areas and two keys. The other files have the same configuration except that the data area and the number of keys are different, and therefore the drawings are omitted.

Up to eight keys can be registered for each file, and any one of the numbers 1 to 8 is given to the registered keys. This key number is for identifying the key, and is set so that no two or more keys having the same key number exist in one file. However, since a key having the same key number exists in another file, when specifying the key, the key number is specified after selecting the file.

The process when the keys are collated will be described below with reference to FIGS. 1 and 2. Now, it is assumed that the file 11 of the layer 1 is selected. Input / output means 5
When the key collating command accompanied by the key number and the key data is received from the external device (not shown), the control shifts to the command processing means 6. When the command processing means 6 interprets that it is a key collation command, it searches the file 11 for a key having the designated key number, and collates this with the key data input from the external device. If this matches, it is determined that the matching was successful,
The control is transferred to the access control means 7 for the unlocking process.

The unlocking process by the access control means 7 will be described with reference to FIG. FIG. 4 shows the RAM 3 of FIG.
2 is a diagram showing a portion related to access control among the information held in the unlocking information area 71 divided into five fields corresponding to the five-level hierarchical structure shown in FIG.
have. Each field is composed of 8 bits corresponding to the key number (bit 1 corresponds to key number 1). For example, when the key number checked this time is 1, in the unlock information area 71, bit 1 of file 11 (layer 1)
Is set to "1". "1" means that the key has already been verified.

Next, the case where the file 32 (layer 3) is selected will be described. As before, the file selection command is received by the input / output means 5 and interpreted by the command processing means 6. The command processing means 6 searches for the file according to the file name specified by the external device, and transfers control to the access control means 7. The processing performed by the access control means 7 with respect to the file selection command is partial holding or discarding of the unlock information area 71 of FIG. Here, what information is retained or discarded becomes a problem. Since the key of the file 11 is a global key for the file 32, when the file 32 is selected, it is necessary to retain the unlocking information of the key of the file 11. That is, bit 1 of layer 1 of the unlock information area 71 is held. In this embodiment, the file 22 (layer 2)
The key is not collated, but if it is collated, the unlocking information of layer 2 is also held. (Holding or discarding the unlocking information will be described in detail later.) Thereafter, the file 32
When the key of (the key number = 2 here) is collated,
Bit 2 of the file 32 (layer 3) in the unlock information area 71 is set to "1" in the same manner as the procedure described above.

Next, the case of reading the data area in the file 32 will be described. Each data area has an access condition setting unit having the structure shown in FIG. The value set here differs for each data area.
FIG. 5 shows an access condition setting unit for the data area to be read now. The access condition setting unit 80 is composed of an access key setting unit 81 and a logical condition setting unit 82, and the logical condition setting unit 82 is horizontal. It includes a direction setting unit 83 and a vertical direction setting unit 84. The access key setting unit 81 sets a key number of a key that needs to be collated before reading the data area, and is composed of 8 bits corresponding to the key number (bit 1 corresponds to key number 1). ). In this embodiment, the key with key number 1 (bit 1) and the key with key number 2 (bit 2) are designated.

The logical condition in the vertical direction relates to the handling of unlocking information of a file which is higher than itself in the same branch in the hierarchical structure of files, and the keys having the same key number among a plurality of files. It is the logical sum of unlocking information. That is, it corresponds to the logical sum in the vertical direction of the unlock information area 71 in FIG. The vertical direction setting unit 84 specifies which layer of unlock information is used in this logical sum calculation, and is composed of 5 bits corresponding to each layer (bit 1 corresponds to layer 1). . In this embodiment, bits 1 to 3 are set to "1", which indicates that the unlock information of layers 1 to 3 in the unlock information area 71 is logically ORed. The calculation result is held in the logical sum area 72 of FIG. In this embodiment, key number 1
Since (layer 1) and key number 2 (layer 3) have already been collated, bit 1 and bit 2 of the logical sum area 72 are "1".
Becomes

Finally, in determining whether the access condition for reading the data area is satisfied, the contents of the logical sum area 72, the access key setting section 81, and the horizontal direction setting section 83 are checked. The horizontal direction setting unit 83 sets the logical condition of the key specified by the access key setting unit 81, and can specify either a logical product (set "1") or a logical sum (set "0"). . Here, the logical product means that all the keys of the keys designated by the access key setting unit 81 need to be collated, and the logical sum is one of the keys designated by the access key setting unit 81.
Means that one key needs to be matched. In the present embodiment, since the logical product is set, it is necessary to collate both the key number 1 and the key number 2 designated by the access key setting unit 81 in order to read the data area. Based on the contents of the logical sum area 72, reading of the area is permitted.

In the above description, reading of the data area has been described, but there is a separate access condition setting unit for writing. Further, not only the data area but also the key is provided with an access right setting unit for each function such as registration and update.

Various access controls can be performed depending on how the horizontal setting unit 83 and the vertical setting unit 84 are set. Hereinafter, a typical example thereof will be described.
In the following description, the file 11 (tier 1) has the issuer key (key number 1) and the personal password of the card holder (key number 2), and the file 32 (tier 3) uses this file. It has a terminal key (key number 1) of the terminal used in.

First, in the above-mentioned application, when it is necessary to verify the personal identification number and the terminal key in order to read the data area of the file 32, the horizontal access condition of the data area read function is set to the key number 1. It is set to the logical product (set in the horizontal direction setting section) of the key and the key of key number 2 (set in the access key setting section). In addition, for processing at the issue stage, etc., in order to be able to access with the issuer key instead of the terminal key,
Of the vertical direction setting section, at least the portions corresponding to the layers 1 and 3 are set to "1". On the contrary, when it is desired to protect this data area so that even the issuer cannot access it, only "1" is set to the part corresponding to the hierarchy 3 of the vertical direction setting part. This allows a file independent of the issuer to be provided in the IC card.

In addition, regarding the update of the personal identification number, in order for the card holder to independently update it without the involvement of the issuer, and for the issuer to respond when the card holder forgets the personal identification number. Sets the access condition in the horizontal direction to the logical sum of the key of key number 1 and the key of key number 2 for the personal identification number updating function.

As described above, various access conditions can be set such that a file independent of the issuer can be provided, and according to this method, access control processing can be performed without depending on the number of layers. .

In this embodiment, as the structure of the vertical direction setting unit 84, the hierarchy number used in the calculation of the logical sum is specified, but the structure is not limited to this.
Any method may be used as long as it can identify the method of calculating the logical sum.

Next, a method for holding or discarding the information in the unlock information area 71 when another file is selected will be described. It is preferable that a key located in a higher hierarchy can be used as a key global to a lower file. A typical example of this is raising a personal identification number. You may want to use a common number for multiple applications as your personal security code. In this case, instead of registering the same personal security code for each file,
It is desirable to register only in the highest hierarchy so that it can be used as an access key for all files. This global key concept is not limited to personal identification numbers, and it is desirable that any key can be targeted. Further, not only the key registered in the highest hierarchy can be used as a global key, but the key registered in hierarchy n can be used as a global key for files in all the hierarchy lower than n. Therefore, it is desirable to have versatility.

In order to realize this, it is necessary to hold only the unlocking information of the part where the branch is common in the hierarchical structure of the previously selected file and the newly selected file. Specifically, in FIG. 2, when the file selected so far is the file 32 and the newly selected file is the file 41, the file 32 and the file 41 form a common branch up to the layer 2. Since they are connected, unlock information up to layer 2 is held.
Since the key that the file 32 (tier 3) has is irrelevant to the file 41, using these keys, the file 4
Accessing 1 must be prohibited to ensure security. Therefore, the unlock information of the layer 3 is discarded.

In order to appropriately perform such processing in various cases, the unlocking information area 71 of FIG. 4 has fields for each layer as described above, but in addition to that, the unlocking information area 71 of FIG. The directory has information as shown in FIG. Of course, other information (file address, etc.) is also included, but FIG. 6 shows only the information necessary for this explanation. Although FIG. 6 illustrates the directory 61 of the file 11, other files have the same configuration, and therefore the illustration is omitted. The layer number 91 is the layer number of itself, and in the case of the file 32, "3" is set. The parent pointer 92 is a pointer to its own parent file (such as the top address of the directory of the parent file), and in the case of the file 32, the pointer to the parent file 22 is stored. Since only the file 11 has no parent file, the information to that effect is written.

A processing method using these pieces of information will be described with reference to FIG. FIG. 7 is a part of the access control means 7 of FIG. 1, and illustrates a part relating to the processing of the access right unlock information in the file selection command processing, and the procedure is as follows (in the following, The file selected so far is called file A, and the newly selected file is called file B). (1) [Steps 101 to 104] The layer numbers of the file A and the file B are compared. If they are the same, X = file A and Y = file B are set, and the process proceeds to (2).
When they are different, X = the file with the higher hierarchy is set, and the parent file is traced until the file with the lower hierarchy is equal to the hierarchy number of X. The parent file finally reached is set to Y and the process proceeds to (2). (2) [Steps 105 to 108] (X layer number) = (Y layer number) = L. When X and Y are the same file, the unlock information from the layer 1 to the layer L is retained, and the unlock information lower than the layer L is discarded and the process ends. When X and Y are not the same file, return to (2) with X = (parent file of X) and Y = (parent file of Y).

In this way, (2) is repeated until X and Y match. Since only one root file exists in the IC card as shown in FIG. 2, the process ends with L ≧ 1 in any case. The hierarchy number of each file shown in FIG. 6 is used to know the hierarchy number of X and Y, and the parent pointer of each file is used to know its own parent file.

The fact that various cases can be dealt with by such a processing procedure will be specifically described with reference to the example of the file structure shown in FIG.

When the previously selected file (file A) is the file 32 (layer 3) and the newly selected file (file B) is the file 51 (layer 5), the file 32 has a higher layer. Is located at X =
It becomes the file 32. On the other hand, the parent file is traced from the file 51 to the layer 3, and Y = file 32 is obtained. At this time, L = 3. Where X = Y = file 3
Since it is 2, the unlock information of the layers 1 to 3 is held. The unlocking information of the layers 4 and 5 will be discarded, but since the file selected so far is the file 32 (layer 3), since it does not have the information originally, there is no actual change.

On the contrary, even when the previously selected file (file A) is the file 51 and the newly selected file (file B) is the file 32, the unlocking information from the layer 1 to the layer 3 Hold. In this case, the unlock information of the layers 4 and 5 has some information, but these are discarded.

Next, when the previously selected file (file A) is the file 41 and the newly selected file (file B) is the file 51, X = file 41, Y = file 42, L = It becomes 4. here,
Since X and Y are different files, their respective parent files are traced to obtain X = file 31 and Y = file 32. At this time, L = 3. Since X and Y are different files, the parent files are further traced to obtain X = file 22 and Y = file 22. Here, since X and Y match and L = 2 at this time, the unlock information of the layers 1 and 2 is held, and the unlock information of the layers 3 to 5 is discarded.

In addition, even when the previously selected file is the same as the newly selected file, the processing can be correctly performed according to this procedure.

The above description has dealt with the case where only one file can be opened at the same time. However, if you can open only one file at the same time, and you need to access another file while opening one file, you can close the opened file and access it. You have to select a file and match the required keys. When it becomes necessary to access two files alternately, this series of processes must be repeated, which is inefficient. To solve this, it is very convenient to have a function that allows multiple files to be opened simultaneously.

Here, for simplification, the case where two files are simultaneously opened by using two channel numbers (A, B) is dealt with. Which of the two open files is to be accessed is specified by the channel number in the command. In order to realize the simultaneous opening of two files, the RAM 3 has unlocking information areas 71 and 73 for each channel as shown in FIG. However, since the layer 1 is always common to the two channels, the unlock information area 73 of the channel B does not have a field corresponding to the layer 1.

Retention and discard of the unlocking information are not distinguished for each channel and depend only on the hierarchical structure of files. That is, assuming that the files previously selected by the channels A and B are file P and file Q respectively, and the file newly selected by using the channel A is file R, the file P for the channel A is the file P.
And the file R holds the unlocking information of the portion having the common branch, and the portion corresponding to the union of the unlocking information of the portion having the common branch between the file Q and the file R.

For the sake of concrete explanation, it is assumed that the file 41 is the file P, the file 51 is the file Q, and the file 43 is the file R in FIG. Due to the relationship between the file 41 and the file 43, according to the procedure described above, the layer 2
The unlocking information up to is retained. On the other hand, due to the relationship between the file 51 and the file 43, the unlock information up to the layer 3 is held. Since the former is included in the latter, the unlocking information of the channel A holds the latter, that is, the unlocking information up to the layer 3 common to the file 51 and the file 43.

A method for performing this processing commonly for all cases will be described with reference to FIG. FIG. 9 shows a part of the access control means 7 of FIG. 1, and shows a part relating to the processing of the unlocking information for the channel A.
The procedure is as follows. (1) [Step 111] The unlocking information of the channel A is retained and discarded based on the relationship between the file P and the file R (a specific method is the method already described in the case where the number of files that can be opened simultaneously is one). . (2) [Step 112] The layer numbers 1 to L to be held are obtained from the relationship between the file Q and the file R (a specific method is based on the method already described when the number of files that can be opened simultaneously is one). . (3) [Step 113] Of the unlock information of channel B, the part corresponding to layers 2 to L is copied to the unlock information of channel A (for the unlock information of channel B, the selected file changes) It doesn't change because it doesn't exist.)

The above procedure is as follows when the file 41 is the file P, the file 51 is the file Q, and the file 43 is the file R. Assuming that the initial state is FIG. 8, the unlocking information of the channel A is held in the layers 1 and 2 by the process of (1), and becomes as shown in FIG. Next, L = 3 is obtained by the processing of (2) above, and by the processing of (3), the portions corresponding to the layers 2 and 3 of the unlock information of the channel B are copied to the unlock information of the channel A. It becomes like 11.

Here, since the layers up to layer 2 are common to the three files 41, 51 and 43, in this example, the unlocking information of the part corresponding to layer 2 in the process of (3) is performed. Copying is an extra process. However, considering that there are many cases of how to select a file, this procedure is a useful method that can cover all cases by a very simple method. Further, in order to omit the above-mentioned extra processing, it is difficult to examine a branch common to a plurality of files in a variety of file selection states, and as a result, this method is superior.

Furthermore, as an advantage of this method, the expandability can be increased. That is, even if the number of files that can be opened simultaneously is 3 or more (A, B, C ...),
The above procedure (3) may be repeated for channels B, C .... As described above, this method is excellent in terms of program capacity, processing speed, and expandability.

[0042]

As described above, according to the present invention, the non-volatile memory has the access condition setting section related to the hierarchy number, and the volatile memory has a plurality of unlocking information fields corresponding to the hierarchy number. With the configuration, it is possible to provide an IC card that can support a multi-layered file structure and can secure the independence of the file from the issuer.

Further, since each file has information for identifying its own hierarchy number and information for identifying its own parent file, it is possible to efficiently hold and discard the hierarchized unlocking information. It can be carried out.

Further, when a plurality of files are simultaneously opened, the first selected file,
The unlock information of the first file is updated from the positional relationship in the hierarchical structure with the second file newly selected using this same channel, and then the files other than the first file are selected. For each of the above, from the positional relationship between these files and the second file, a part of the unlocking information of each file is copied to the unlocking information of the first file, and the unlocking information of the second file is newly added. By providing such means, it is possible to provide an access control method excellent in program capacity, processing speed, and expandability.

[Brief description of drawings]

FIG. 1 is a configuration diagram of an IC card according to an embodiment of the present invention.

FIG. 2 is a configuration diagram of a nonvolatile memory according to an embodiment of the present invention.

FIG. 3 is a configuration diagram of a file according to the embodiment of the present invention.

FIG. 4 is a block diagram of a RAM according to an embodiment of the present invention.

FIG. 5 is a configuration diagram of an access condition setting unit according to the embodiment of the present invention.

FIG. 6 is a configuration diagram of a directory in the embodiment of the present invention.

FIG. 7 is a flowchart showing a part of access control processing in the embodiment of the present invention.

FIG. 8 is a configuration diagram of a RAM according to an embodiment of the present invention.

FIG. 9 is a flowchart showing a part of access control processing in the embodiment of the present invention.

FIG. 10 is a block diagram of a RAM according to an embodiment of the present invention.

FIG. 11 is a block diagram of a RAM according to an embodiment of the present invention.

FIG. 12 is a configuration diagram of a memory in an IC card in a conventional example.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 IC card 2 Processing control section 3 RAM 4 Non-volatile memory 5 Input / output means 6 Command processing means 7 Access control means 80 Access condition setting section 81 Access key setting section 82 Logical condition setting section 83 Horizontal direction setting section 84 Vertical direction setting section

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Nobunari Murai 1006 Kadoma, Kadoma City, Osaka Prefecture Matsushita Electric Industrial Co., Ltd. (72) Takeshi Nakatomi 1006 Kadoma, Kadoma City, Osaka Matsushita Electric Industrial Co., Ltd.

Claims (4)

[Claims] 1. A processing control unit, a non-volatile memory, and a volatile memory at least, wherein the non-volatile memory has a plurality of files having a hierarchical structure and access conditions related to a hierarchical number of the hierarchical structure. An IC card having a setting section, and the volatile memory having a plurality of unlocking information fields corresponding to hierarchy numbers. 2. The IC according to claim 1, wherein the access condition setting unit has information for limiting a layer number.
card. 3. A processing control unit, a non-volatile memory, and a volatile memory, the non-volatile memory having a plurality of files having a hierarchical structure, each file having at least its own hierarchy. It has hierarchical number information for identifying the number and parent file information for identifying its own parent file on the hierarchical structure, and the volatile memory has a plurality of unlocking information fields corresponding to the hierarchical number. Have
Further, by using the layer number information and the parent file information, the first file that has been selected so far and the second file that has been newly selected are the lowest among the branches common in the hierarchical structure. An IC card having means for obtaining a layer number L and means for holding information of fields corresponding to layers 1 to L of the unlocking information field and discarding information of other fields. 4. A processing control unit, a non-volatile memory, and a volatile memory, the non-volatile memory having a plurality of files having a hierarchical structure, and the volatile memory being selected. It has n unlocking information areas corresponding to n (≧ 2) files, and also has a first file of the selected n files and a newly selected second file. From the positional relationship in the hierarchical structure,
Means for changing the content of the unlocking information area of the first file in the unlocking information area, and each of the n-1 files other than the first file among the n files, An IC card having means for copying a part or all of the contents of the unlocking information area of each file to the first unlocking information area based on the positional relationship in the hierarchical structure with the second file.