JPS63259785A - Ic card certification system - Google Patents

Abstract

PURPOSE:To exactly prevent the forgery of an IC card by providing card certification memory parts where the plural certification cards of the same contents are stored in an IC card and a terminal, and designating an address from the output of a random number generation part. CONSTITUTION:The card certification memory parts 48 are provided which store the plural certification codes of the same contents respectively in an IC card 1 and a terminal 2, and the addresses of these part 48 are instructed by outputs from the random number generation part 47 and also the IC card 1 is certified by means of a certification code read out by the output. Since the same certification codes are read out with respect to the random number supplied by the generation part 47, a different certification code is used at every certification of an IC card, hence only in case of an authorized IC card 1, the both certification codes coincide with each other. Therefore, even if an IC card is forged on the sly, to pass through the certification of a card is made almost impossible, and thus the use of a forgery card can be prevented exactly.

Description

DETAILED DESCRIPTION OF THE INVENTION [Technical Field of the Invention] The present invention relates to an IC card authentication method designed to improve operational safety of an IC card system.

[Prior art and its problems] In recent years, it has become known as the cashless era, and by using cards issued by credit card companies, it has become possible to purchase products without handling cash.

Conventionally used cards include plastic cards, embossed cards, and magnetic striped cards, but these cards are easy to forge due to their structure, so unauthorized use has become a problem.

Therefore, in order to solve this problem, an information card, a so-called IC card, has been devised, which has an IC circuit that stores a PIN number stored inside the card so that the PIN number cannot be read easily from the outside. Therefore, an IC card system that combines such an IC card and a terminal has been developed.

By the way, in such an IC card system, when actually using an IC card, it is necessary to check whether the IC card itself is genuine or officially issued, that is, to have the IC card authenticated. There is.

However, the IC card authentication method that has been adopted so far is to store an authentication code pre-arranged by the card issuer in the IC card, and when the card is used, this code is taken out to the terminal side and used. The validity of the IC card is determined by comparing the same authentication code with the authentication code of the IC card stored in advance in the terminal.

However, with this type of authentication method, the code used for IC card authentication is fixed.
If this code somehow became known to a third party, it would be possible to easily create counterfeit cards using this code, and the security of the IC card system would be seriously threatened. There was a risk of being exposed.

Conventionally, card-specific data such as an account number is encrypted and stored in an IC card using an encryption code, while a terminal is stored with a decryption key paired with the encryption code and a decryption algorithm. When performing card authentication, the terminal reads the encrypted data from the card, decrypts it using the terminal's decryption key and decryption algorithm, and if it can be decrypted here, the I
A method of authenticating the C card as genuine is also being considered.

However, with this method, encryption and decryption take time, which tends to reduce the driving efficiency of the entire system.
Moreover, in this case as well, there is only one pair of encryption code and decryption key, so if a third party finds out about these, they can easily create counterfeit cards in the same way as described above. However, there was a drawback that the safety of the Yabari IC card system was seriously threatened.

[Purpose of the Invention] This invention was made in view of the above circumstances, and its purpose is to provide an IC card authentication method that can reliably prevent card forgery and improve the security of system operation. do.

[Summary of the Invention] The IC card authentication method according to the present invention is such that an IC card and a terminal are provided with a card authentication storage section storing a plurality of authentication codes having the same content, and the addresses of these card authentication storage sections are set as random numbers. In addition to giving instructions from the output of the generation unit, the I
C card authentication is now performed.

[Embodiments of the invention] An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows the circuit configuration of the IC card 1. As shown in FIG. In the figure, 11 is a system bus, and this system bus 1
1 includes a storage unit 12, a two-king RAM 13, a system program storage unit 14,
Control unit 15, write/continue output R/W) control unit 16, card authentication code storage unit 17, address conversion unit 18, clock circuit 19, authentication key storage unit 20, decryptor 21, balance update unit 22, data A holding section 23, a comparator 24, a serial number 1025, an input control section 26, a display control section 27, an access prohibited area number storage section 28, and a comparator 29 are connected to each other.

In this case, the answer-to-reset storage unit 12 stores all operating conditions for the IC card 1 itself (for example, data writing, applied voltage, current permissible value, maximum applied voltage, maximum data transmission amount, maximum response waiting time, etc.). Something,
When the internal initialization of the card itself is completed, these condition data are sent to the terminal 2 side as answer-to-reset data, which will be described later, in accordance with a predetermined format. The working RAM 13 stores various processing data within the card.

The system program storage unit 14 stores various system programs as well as a code signal indicating whether the signal sent from the terminal 2 is correct or not. The control unit 15 outputs operation commands to each circuit according to the data reception signal and operation state supplied via the serial I1025. The R/W control unit 16 controls writing and reading of data in the data memory 30 in response to commands from the control unit 15. Here, the data memory 30 has a password=
6 = rPINJ etc. are written. The card authentication code storage section 17 stores a plurality of authentication codes used for IC card authentication. The address conversion section 18 converts a random number sent from the terminal 2, which will be described later, into corresponding predetermined address data and provides it to the card authentication code storage section 17. The clock circuit 19 measures the current date and time. The authentication key storage unit 20 stores an authentication key, and the encryption and decryption are performed by the decryptor 21 using this authentication key. The data holding unit 23 stores the rP given from the terminal 2 in P I NJ verification.
Holds INJ etc. The output of this data holding section 23 is given to a comparator 24.

In this case, the comparison result of the comparator 24 is sent to the control section 15. The balance update section 22 updates the contents of the balance storage section 31 according to transactions. The data input/output terminal I10 is connected to the serial I1025, and data is exchanged with the terminal 2.

The input control section 26 provides a sampling signal to the keyboard section 36 to detect human key data. The display control unit 27 controls the display of the display unit 37. The access prohibited area number storage unit 28 stores the access prohibited area number of the data memory 30, and when this prohibited area is accessed, a matching output is generated from the comparator 29, and a match output is generated to the R/W control unit 16. Reading of the corresponding area is prohibited.

Note that when such an IC card 1 is attached to the terminal 2, the terminal 2 supplies a reset signal to the Re5et terminal, a system clock signal to the Cl0Ck terminal, a vpp power supply to the vpp terminal, a Vcc power supply to the Vcc terminal, and A ground line is connected to the GND terminal.

The V-cc power supply applied to the Vcc terminal is supplied to the voltage detection circuit 3.
given to 2. This voltage detection circuit 32 has an internal power supply 3.
3 is connected. Here, the voltage detection circuit 32
When the c power source is connected, the Vcc power source is detected with priority, and when the Vcc power source is not connected, the internal power source 33 is detected and the output Vdd is generated.

The clock signal given to the C1ock terminal is the selector 3
given to 4. This selector 34 has an internal oscillator 35.
is connected. Here, the selector 34 selects the clock signal applied to the C1ock terminal or the output of the internal oscillator 35 according to the detection content of the voltage detection circuit 32, and supplies the selected signal to each circuit. In this case, the oscillation frequency of the internal oscillator 35 is set lower than the clock signal applied to the C1ock terminal.

Next, Figure 2. A circuit configuration of a terminal 2 into which such an IC card 1 is installed is shown.

In the figure, 41 is a system bus, and this system bus 41 includes a central control unit 42, a working RAM 43, a main program memory 44, and a memory for writing/distributing data (R/W).
Control unit 45, clock unit 46, random number generator 47, card authentication code storage unit 48, address conversion unit 49, calculation unit 50
．． Comparator 51, IC card interface 52, input/output control section 53, tone generation section 54, key controller 5
5, a printer controller 56, a display driver 57, and an indicator driver 58 are connected.

The central control unit 42 gives control commands to each circuit depending on the operating state of the system. The working RAM 43 stores each code sent from the IC card 1, as well as various processing data within the terminal 2. The main program memory 44 stores various system programs. The R/W control section 45 controls reading and writing to and from the storage memory 59 in accordance with commands from the central control section 42 . The clock section 46 measures the current date and time. In this case, the clock section 46 has a backup power source 46]. The random number generation section 47 generates random numbers according to instructions from the central control section 42 during IC card authentication.

The card authentication code storage section 48 stores a plurality of authentication codes used for IC card authentication. In this case, the card authentication code storage section 48 stores an authentication code exactly the same as the card authentication code storage section 17 of the IC card 1 described above, and the same authentication code is read out using the same random number. ing. The address converter 49 converts the random number generated by the random number generator 47 into corresponding predetermined address data, and provides it to the card authentication code storage 48 . The comparator 51 compares the authentication code read from the card authentication code storage section 48 with the card authentication code read from the card authentication code storage section 17 of the IC card 1 and sent. In this case, the comparison result from the comparator 51 is sent to the central control section 42. The IC card interface 52 includes a card mechanism section 6.
o is connected. This card mechanism section 60 is to which the IC card 1 is attached, and has contacts, a lock, a shutter, and the like. The input/output control section 53 is the central control section 42
A network control unit 62 is connected via a modem 61. The tone generator 54 is configured to automatically output a dial signal to the public telephone line according to instructions from the central control unit 42. The key controller 56 provides a sampling signal to the keyboard 63 to detect human key data. The printer controller 56 controls the operation of the printer mechanism section 64. The display driver 57 controls the display on the liquid crystal display section 65. The indicator driver 58 is an LED
Controls the display of the indicator 66.

Note that 67 is a power supply unit that generates driving power from a commercial power source of 100 volts, and 68 is an oscillator that generates a system clock signal φ to be supplied to each circuit.

Next, the operation of the embodiment configured as described above will be explained with reference to the flowchart shown in FIG.

Now, insert the IC card 1 into the card mechanism section 60 of the terminal 2.
When the IC card 1 is attached to the IC card 1, a reset signal set in advance on the terminal 2 side is sent to the IC card 1 via the Re5et terminal in step A1.

Then, after the IC card 1 is reset in step B1, it is operated under the operating conditions based on the reset signal. That is, in step B2, the answer-to-reset signal stored in the answer-to-reset storage section 12 is read out according to a command from the control section 15, and sent to the terminal 2 via the serial I1025.

When the answer-to-first reset signal is sent to the terminal 2, the terminal 2 performs answer-to-reset processing in step A2. In this case, at Terminal 2, the answer to
Determine whether the reset signal is the correct one corresponding to terminal 2.

Here, if it is determined to be correct, the operating conditions of the terminal 2 are set to the contents based on the answer-to-reset signal.

In this state, when a random number is generated by the random number generator 47 in step A3, this random number from the random number generator 47 is given to the address conversion section 49. Then, in step A4, the address conversion unit 49 outputs predetermined address data corresponding to the random number at this time, and provides it to the card authentication code storage unit 48. As a result, as shown in state A5, the authentication code corresponding to the address is read from the card authentication code storage section 48 and provided to the comparator 51.

On the other hand, in step A3, the random number generated by the random number generator 47 is sent to the IC card 1 via the IC card interface 52 and given to the address conversion section 18. Then, in step B3, the address converter 1
8 outputs predetermined address data corresponding to the random number at this time, and the card authentication code storage section 17
given to. As a result, as shown in step B4,
The authentication code corresponding to the address is read from the card authentication code storage section 17. This authentication code is then sent to the terminal 2 via the serial number 1025 and given to the comparator 51.

In this state, the authentication code of the IC card 1 and the authentication code of the terminal 2 are compared in step A6. In this case, the card authentication code storage section 17 of the IC card 1
The card authentication code storage unit 48 of terminal 2 stores exactly the same authentication code, and the same authentication code is read out using the same random number, so it can be determined that the IC card 1 is legitimate. If so, both authentication codes will match.

Then, the process moves to the next PIN verification. PI in this case
For N verification, the password rP I NJ is input from the keyboard 63 of the terminal 2. This rPINJ is sent to the IC card 1 via the IC card interface 52 and stored in the data holding section 23. Then, the control section 1
The comparator 24 compares the personal identification number rP I NJ read out from the data memory 30 with the command No. 5.

On the other hand, in step A6, if the authentication codes do not match, it is determined that the IC card 1 is not valid, and the card is invalidated.

Therefore, by doing this, similar authentication codes are stored in the card authentication code storage section of the IC card and the card authentication code storage section of the terminal, and the same authentication code is stored in the card authentication code storage section of the IC card and the same authentication code for the random number given by the random number generator. is read out, a different authentication code -15= is used each time the IC card is authenticated, and the two authentication codes match only when the IC card 1 is valid. As a result, even if the IC card is forged, it will be almost impossible to obtain card authentication, and the use of counterfeit cards can be reliably prevented and the safety of system operation can be improved. Furthermore, since no calculations using advanced algorithms are used as in the past, the initial processing time immediately after the IC card is inserted into the terminal can be shortened, and the operational efficiency of the system can be increased.

It should be noted that the present invention is not limited to the above-mentioned embodiments, but can be implemented with appropriate modifications without changing the gist.

For example, in the case of ``Double Series'', a random number generator was installed on the terminal side to authenticate the IC card.
The IC card may also be provided with a random number generator to authenticate the terminal. Further, in the above description, the random number from the random number generator is converted into a corresponding address and used, but a read command to which an address is added may be generated and used. In this way, the address translation section can be omitted.

[Effects of the Invention] According to the present invention, the IC card and the terminal are provided with card authentication storage sections each storing a plurality of authentication codes having the same content, and the addresses of these card authentication storage sections are outputted from the random number generation section. Since the IC card is authenticated using the authentication code read by this output, counterfeiting of the card can be reliably prevented, and the security of system operation can be improved.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing the circuit configuration of an IC card according to an embodiment of the present invention, FIG. 2 is a block diagram showing the circuit configuration of a terminal according to the same embodiment, and FIG. 3 explains the operation of the same embodiment. This is a flowchart for DESCRIPTION OF SYMBOLS 1... IC card, 12... Answer two, reset storage section, 13... Working RAM, 14... System program storage section, 15... Control section, 17...
・Card authentication code storage unit, 18... Address conversion unit, 24... Comparator, 30... Data memory, 2.
...Terminal, 42...Central control unit, 43...
Working RAM, 44... Main program ROM
, 47... Random number generator, 48... Card authentication code storage section, 49... Address conversion section, 51... Comparator, 59... Storage memory.

Claims (1)

[Claims] In an IC card system consisting of an IC card and a terminal to which the IC card is installed,
Instructs the address of a card authentication code storage section provided in each of the card and terminal and storing a plurality of authentication codes having the same content, and the card authentication code storage section provided in at least one of the IC card and the terminal. and a random number generation section that generates random numbers, and the IC card is authenticated using a code from a card authentication code storage section of the IC card and terminal that is read out in response to the random number of the random number generation section. I do
C card authentication method.