JPS63262779A - Ic card issuing system - Google Patents

Abstract

PURPOSE:To secure a secret in respective steps by deciding as reasonableness relating to a transport key every time when an IC card is mounted on terminals disposed in the respective steps from the production of the IC card to the issue thereof. CONSTITUTION:Initially, in the step of an LSI manufacturer, a manufacturer key is coded in a code decoder 48 by the use of a serial number SN generated in a serial number generator 46 and written in the LSI together with the serial number. Then, in the step of the card manufacturer, the coded manufacturer key read from the LSI incorporated IC card 60 and the manufacturer key inputted from a keyboard 55 and coded in the code decoder 48 are compared in a comparator 73 to decide whether the card manufacturer is a reasonable receiver or not. Similarly,in the respective steps from the production to the issue, the reasonableness of the card receiver is decided by the use of the transport key inputted in the step preceding by one.

Description

[Detailed Description of the Invention] [Technical Field of the Invention] This invention provides an I
Regarding the C card issuing system.

[Prior art and its problems] In recent years, it has become known as the cashless era, and by using cards issued by credit card companies, it has become possible to purchase products without handling cash.

Conventionally, there are plastic cards, embossed cards, magnetic stripe cards, etc., but these cards are easy to forge due to their structure, so fraudulent use has become a problem.

To solve this problem, an information card with a personal identification number stored inside the card, a so-called IC card, has been considered, and an IC card system that combines such an IC card and a terminal has been developed. ing.

By the way, IC cards used in such systems go through various stages from card manufacture to card issuance, such as manufacturer, issuer, and card owner. By allowing data access and data writing only to the IC
Consideration has been taken to prevent tampering and forgery of the card's internal data and to ensure the safety of card usage.

Therefore, conventionally, in order to prevent such a situation from occurring, the following methods have been taken. FIG. 5 shows the mutual relationship between a manufacturer who manufactures an IC card, an issuer such as a bank that issues an IC card, and a cardholder who uses an IC card. First, the card manufacturer 1 prepares a card terminal 11 as shown in FIG.
Attach the card 12. Here, the terminal 11 includes a card insertion slot 11a, a keyboard 11b, and a display panel 11C.
1 printer unit 11d, various codes,
Here, rcAJ, rlPIN'' and rPMKJ are written to the IC card 12. In this case, “cAJ (Card
The Authenticator is a random, eg, 64-bit code that is used to encrypt and decrypt messages. rlPINJ (Initial
Ization Personal Identity
This is a random code of, for example, 6 bits, and is a number until the self-identification PIN (described later) is used. rPMKJ
tion Master KeyCode) is a manufacturing number, the same number is used for one group, and is kept secret within the factory. In this way, when the predetermined code is written on the IC card 12, "PMKJ" is printed on the printing paper 13 by the printer section 11.d. card 12
and the printing paper 13 are sealed separately and shipped to the issuer 2.

Issuer 21, IC card 1 sent by manufacturer 1.
2 to the card issuing terminal 21, and the contents of the printing paper 13 sent by the manufacturer 1 rPMKJ
and enter the code into the card issuing terminal 21. At the same time, the issuer 2 sends the account number rPANJ (P
r L mary Account Number
Enter r). Here, the card issuing terminal 21 includes a card insertion slot 21a1 and a keyboard 21b1 as described above.
It has a display panel 21c1 and a printer section 21d.
The rPMKJ written in the C card 12 is compared with the rPMKJ input from the keyboard 21d, and if they match, the ``PANJ'' is written to the IC card 12, and the ``1PINJ'' is read and printed from the IC card 12. Print on paper 23. From this state, issuer 2
The IC card 12 on which NJ is written and the printing paper 23 are sealed separately and shipped to the card owner 3.

When the cardholder 3 receives the IC card 12 and printing paper 23 from the issuer 2, the cardholder 3 goes to the issuing light and inserts the IC card 12 into the user terminal 31 installed there.
At the same time, it reads the content rlPINJ of the printing paper 23 sent from the issuer 2 and enters the code into the user terminal 31. At the same time, cardholder 3
Enter your personal identification number “P I NJ” on the user terminal 31.
(Personal Identity, catio
n Number). As mentioned above, the user terminal 31 has a card insertion slot 31a, a keyboard 31b, a display panel 31c, and a printer section 31d.
J and rIPINJ input from the keyboard 31d are compared, and if the two match, rPINJ is written into the IC card 12. Through these procedures, IC cards12
The issuance process has been completed, and the IC card 12 can now be actually used.

In this way, in the conventional method, "PMK" rIPINJ
These transport keys are used, and without these transport keys, transactions cannot proceed to the next stage.

However, these transport keys are written as they are by data input from the card terminal during the card manufacturing stage, so if the card is stolen at a later stage, information about a single card may be lost. “If PMKJ becomes known, it will be possible to access or write data on all other cards in the group to which this card belongs □, which will cause serious problems in terms of security, such as data falsification and forgery. The same thing happened when rPMKJ was discovered from the printed paper sent separately from the IC card.

[Purpose of the Invention] This invention was made in view of the above circumstances, and is an IC card issuance system that can ensure confidentiality at each stage from IC card manufacture to issuance, and that can improve handling safety. The purpose is to provide a system.

[Summary of the Invention] According to this invention, each time an IC card is inserted into a terminal provided at each stage from IC card manufacturing to issuance, the validity of the transport key encrypted and given in the previous stage is verified. and if it is determined to be correct here,
You can encrypt and enter the transport key to be used in the next step to proceed to the next step.

[Embodiments of the invention] An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows the circuit configuration of a terminal used in the same embodiment. In the figure, 41 is a system bus, and this system bus 41 includes a central control unit 42, a working RAM 43, a main program ROM 44, and a
(Read R/W) controller 45, serial number generator 46, encryption key memory 47, code decryptor 48
, an IC card interface 49, a key controller 50, a printer controller 51, and a display driver 52 are connected.

The central control unit 42 gives control commands to each circuit depending on the operating state of the system. The working RAM 43 stores each code sent from the IC card, as well as various processing data within the terminal. The main program ROM 44 stores various system programs.

The R/W controller 45 controls reading and writing to and from the storage memory 53 in accordance with commands from the central control unit 42 . The serial number generator 46 generates a serial number unique to the IC card. Encryption key memory 47
is used to store keys for encryption. The decryptor 48 performs encryption and decryption using the key stored in the encryption key memory 47. IC card interface 4
9 is connected to a card mechanism section 54. This card mechanism section 54 is used to mount an IC card, and has contacts, a lock, a shutter, and the like.

The key controller 50 sends a sample i to the keyboard 55.
Signals are given to detect key human data. The printer controller 51 controls the operation of the printer mechanism section 56. The display driver 52 controls the display on the LC display 57.

Note that 58 is a power supply unit that generates driving power from a commercial power source of 100 volts, and 59 is an oscillator that generates a system clock signal φ to be supplied to each circuit.

Next, FIG. 2 shows the circuit configuration of an IC card 60 installed in such a terminal 40. In the figure, 61 is a system bus, and this system bus 61 includes an answer-to-reset storage unit 62 and a working RA.
M63, system program storage unit 64, control unit 65,
Write/read R/W) control unit 66, random number generation unit 6
7, clock circuit 68, authentication key storage section 69, authentication calculation section 7
0, balance update unit 71, data holding unit 72, comparator 73,
Serial l1074, input control section 75, display control section 76
, access prohibited area number storage unit 77 and comparator 78
are connected to each other.

In this case, the answer-to-reset storage unit 62 stores all operating conditions for the IC card 60 itself (for example, data writing, applied voltage, current permissible value, maximum applied voltage, maximum data transmission amount, maximum response waiting time, etc.). When the internal initialization of the card itself is completed, these condition data are sent to the terminal 40 side as answer-to-reset φ data in accordance with a predetermined format. The working RAM 63 stores various processing data within the card. The system program storage unit 64 stores various system programs as well as code signals sent from the terminal 40 to indicate whether or not the signals are correct.
An operation command is output to each circuit according to the data reception signal supplied via the circuit 1074 and the operation state. P, /W￥
The iIJ phloem 66 controls writing and reading of data in seven data memories in response to commands from the control unit 65. Here, the data memory 7 has a secret zone shown in FIG. 3, in which the serial number rSNJ, encrypted transport keys rsMKJ, rsPKJ, and "IPLNJ, rP I NJ, etc. are written. Random number generation The unit 67 generates random numbers used for IC card authentication.

The clock circuit 68 measures the current date and time.

The authentication key storage section 6 stores an authentication key, and the authentication calculation section 70 performs encryption and decryption using this authentication key. The input data holding unit 72 is the terminal 40
Retains data given by The output of this input data holding section 72 is given to a comparator 73. In this case, the comparison result of the comparator 73 is sent to the control section 65. The balance update section 71 updates the contents of the balance storage section 80 in accordance with transactions. A data input/output terminal I10 is connected to the serial I1074, and data is exchanged with the terminal 40. The input control section 75 provides a sampling signal to the keyboard section 81 to detect human key data. The display control section 76 controls the display of the display section 82 . The access prohibited area number storage unit 77 stores the access prohibited area number of the data memory 79, and when this prohibited area is accessed, a matching output is generated from the comparator 78, and the R/W control unit 66
The system prohibits reading of the corresponding area.

Note that when such an IC card 60 is attached to the terminal 40, the terminal 40 supplies a reset signal to the Re5et terminal, a system clock signal to the C1ock terminal, a vpp power supply to the Vl)I) terminal, and a Vcc power supply to the Vcc terminal. However, a ground line is connected to the GND terminal.

The Vcc power supply applied to the Vcc terminal is supplied to the voltage detection circuit 83.
given to. This voltage detection circuit 83 has an internal power supply 84
is connected. Here, the voltage detection circuit 83
When the power supply is connected, the Vcc power supply is detected with priority, and when the Vcc power supply is not connected, the internal power supply 84 is detected and the output Vdd is generated.

The clock signal given to the C1ock terminal is the selector 8
given to 5. This selector 85 has an internal oscillator 86.
is connected. Here, the selector 85 selects the clock signal applied to the C1ock terminal or the output of the internal oscillator 86 according to the detection content of the voltage detection circuit 83, and supplies the selected signal to each circuit. In this case, the oscillation frequency of the internal oscillator 86 is set lower than the clock signal applied to the C1ock terminal.

Next, the operation of the embodiment configured as described above will be explained according to the flowchart of FIG. In this case, the above-mentioned terminal 40 is manufactured by LSI manufacturer A.

It is assumed that one is provided for each card manufacturer 81 and card issuer C1 customer.

First, in step A1, LSI manufacturer A
Manufacturing the LSI to be incorporated into the card 60, Step A2
Test the LSI with On the other hand, in step B1,
A serial number generator 46 of the terminal 40 generates a serial number SN unique to the card. Then, when the operator inputs the manufacturer key MK from the keyboard 55, the process advances to step B2. In this step B2, the serial number SN from the serial number generator 46 and the manufacturer key MK input from the keyboard 55 are given to the decryptor 48. Then, the manufacturer key MK is encrypted using the serial number SN, and the encrypted manufacturer key S M K is sent to the IC card 60 side via the IC card interface 49 along with the serial number SN. In this case, the manufacturer key MK is printed on the printing paper 81 via the printer mechanism section 56 under the control of the printer controller 51.

The encrypted manufacturer key SMK and serial number SN sent to the IC card 60 are transferred to the LSI in step 83.
written to. In this case, the encrypted manufacturer key SMK and serial number SN are stored in the data memory 79 shown in FIG.
is written to the secret zone.

The LSI manufactured in this way is sealed separately from the "MKJ" printing paper 81 and sent by separate mail to card manufacturer B. Card manufacturer B, in step A4,
is incorporated into the card to complete the IC card 60. Then, this IC card 60 is attached to the terminal 40. Then, in step A5, the serial number SN stored in the data memory 79 of the IC card 60 is output one after another and sent to the terminal 40 via the serial number 1074. At the terminal 40, the manufacturer key MK (MS -) written on a printing paper 81 and sent is inputted from the keyboard 55. Then, proceed to step B3,
The serial number SN from the IC card 60 and the manufacturer key MK- input from the keyboard 55 are sent to the decryptor 48.
given to.

Then, the manufacturer key MK- is encrypted using the serial number SN, and this encrypted manufacturer key SMK (
SMK-) is the IC card interface 49
is sent to the IC card 6o side via. .

In the IC card 60, the encrypted manufacturing key SMK from the terminal 4o is held in the input data holding section 72 and then given to the comparator 73, while the encrypted manufacturing key SMK- stored in the data memory 79 is read out. , to the comparator 73.

Then, in step A6, both are compared.

Here, if the two do not match, the determination is NO and the card is invalidated. In this case, it is determined that card manufacturer B is not the legitimate recipient. On the other hand, if the two match and the determination is YES, "OK" data is sent to the terminal 40. Then, the display driver 52 of the terminal 40 causes the LC display 57 to display a message prompting the user to input the issuer key PK.

In this state, when the operator manually inputs the issuer key PK from the keyboard 55 of the terminal 40, the process proceeds to step B4. In this step B4, the serial number generator 4
The serial number SN from 6 and the issuer key PK manually entered from the keyboard 55 are given to the decryptor 48.

Then, the issuer key PK is encrypted using the serial number SN, and the encrypted issuer key SPK is sent to the IC card 60 side via the IC card interface 49.

Further, the issuer key PK is printed on printing paper via the printer mechanism section 56 under the control of the printer controller 51.

The encrypted issuer key PK sent to the IC card 60 side is written in the secret zone of the data memory 79 of the IC card 60 shown in FIG. 3 in step A7. Then, in step A8, an IC card test is performed.

IC card 60 manufactured and tested in this way
is sealed separately from the rPKJ printing paper 82 and sent to card issuer C by separate mail. Card issuer C uses this IC
The card 6o is attached to the terminal 40. Then, in step A9, the data memory 79 of the IC card 60
The serial number SN stored in is read out and sent to terminal 4o via serial I'/074. At the terminal 40, the issuer key PK written on the printing paper 82 and sent is inputted from the keyboard 55. Then, the process proceeds to step B5, where the serial number SN from the IC card 60 and the issuer key PK input from the keyboard 55 are given to the decryptor 48. Then, the issuer key PK is encrypted using the serial number SN, and this encrypted issuer key SPK (referred to as SPK-) is sent to the IC card 60 side via the IC card interface 49.

In the IC card 60, the encrypted issuer key 5PK- sent from the terminal 40 is held in the input data holding section 72 and then given to the comparator 73, while the encrypted issuer key SPK stored in the data memory 79 is is read out and applied to the comparator 73. Then, in step AIO, both are compared.

Here, if the two do not match, the determination is NO and the card is invalidated. In this case, it is determined that card issuer C is not the legitimate recipient. On the other hand, if the two match and the determination is YES, "OK" data is sent to the terminal 40. Then, the display driver 52 of the terminal 40 displays the rl on the LC display 57, which is used until the personal identification number PIN is registered.
A display prompting you to enter your PINJ is displayed.

When the operator, who is deaf in the 20's, inputs ``IPINJ'' from the keyboard 55 of the terminal 40, it will be sent to the IC card 60 side via the four IC card interfaces.

Further, "IPINJ" is printed on the printing paper 83 via the printer mechanism section 56 under the control of the blink controller 51.

The rlPINJ sent to the IC card 60 side is in step A.
At 11, the data is written to the secret zone of the data memory 79 of the IC card 60 shown in FIG. and,
An IC card is issued in step A12.

The IC card 60 issued in this way has an rlPI
It is sealed separately from the NJ printing paper 83 and sent to the customer by separate mail. The customer brings this IC card 60 to the issuing office and attaches it to the terminal 40 installed there. Then, from the terminal 40, the rlPINJ (rlPINJ (referred to as IPIN-) written on the printing paper 83 and sent) is inputted from the keyboard 55. This rlPINI is the IC
It is sent to the IC card 60 side via the card interface 49.

In the IC card 60, the rlP from the terminal 40
I N I is held in the input data holding section 72 and then given to the comparator 73 , while [IPINJ stored in the data memory 79 is read out and given to the comparator 73 . Then, in step A13, both are compared.

Here, if the two do not match, the determination is NO and the card is invalidated. In this case, it is determined that the customer is not the legitimate recipient. On the other hand, both parties agree, YES
If it is determined, rOKj data is sent to the terminal 40. Then, the display driver 52 of the terminal 40 displays on the LC display 57 a message prompting the cardholder to input his or her personal identification number PIN.

In this state, when the personal identification number PIN is input from the keyboard 55 of the terminal 40, it is sent to the IC card 60 side via the IC card interface 49. Then, in step A14, the data is sent to the secret zone of the data memory 79 shown in FIG. 3 of the IC card 60, the "IPIN" is cleared and the personal identification number PIN is written, and all processing ends.

Therefore, in this way, the manufacturer key rMKJ encrypted at the LSI manufacturer stage is judged to be valid at the card manufacturer stage, and if it is determined to be correct, the next card issuer Encrypt and input the issuer key rPKl for the card, and move it to the next card issuer. Once the validity of the issuer key "PK" is determined here, subsequent input of rlPNJ rPINJ is allowed. In particular, the manufacturer key "MK" and the publisher key "
Since the transport key for "PK" is handled in an encrypted format, even if the card is stolen at some stage, the transport key obtained from this will be encrypted, and the original transport key will not be recovered from now on. It is completely impossible to know the key, so it is possible to ensure secrecy at each stage from IC card production to issuance, thereby significantly increasing its security.

It should be noted that the present invention is not limited to the above-mentioned embodiments, but can be implemented with appropriate modifications without changing the gist.

For example, in the above embodiment, the steps up to IC card issuance include LSI manufacturer, power source, card manufacturer, B1, card issuer, C1, and customer.However, it can also be applied to systems that have steps other than these. .

Further, although the serial number SN is used as data for encryption in the above description, a random number may be used instead.

[Effects of the Invention] According to this invention, each time an IC card is inserted into a terminal provided at each stage from IC card manufacturing to issuance, the validity of the transport key encrypted and given in the previous stage is verified. If it is determined that it is correct,
Since the transport key used in the next step is encrypted and entered before proceeding to the next step, the confidentiality of each step from IC card manufacture to issuance can be ensured, and the safety of its handling can be ensured. can be increased.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the circuit configuration of a terminal used in an embodiment of the present invention, FIG. 2 is a block diagram showing the circuit configuration of an IC card used in the embodiment, and FIG. Diagram for explaining data memory, 4th
The figure is a flow chart for explaining the operation of the same embodiment.
FIG. 5 is a diagram for explaining a conventional IC card issuing system. 40...Terminal, 42...Central control unit, 43.
...Working RAM, 44...Main program ROM, 46...Serial number generator, 4...
- IC card interface, 51... printer controller, 52... display driver, 55.
...Keyboard, 56...Printer mechanism section, 57...
・LC display, 60...IC card, 63...
- Working RAM, 64... System program storage unit, 65... Control unit, 72... Input data holding unit, 73... Comparator, 74... Serial I10.79
...Data memory.

Claims (1)

[Claims] At each stage from IC card manufacturing to issuance, a terminal is provided which has an input means for inputting a transport key and an encryption means for encrypting the transport key inputted from the input means based on predetermined data. An IC card is installed in a terminal at each stage, which has a storage means for storing an encrypted transport key from the terminal, and a comparison means for comparing the transport key inputted from the terminal with the contents stored in the storage means. When the transport key given in the previous stage is input through the input means of the terminal, and the transport key matches the memory content stored in the storage means, the transport key is used in the next stage. An IC card issuance system characterized by allowing input of the following information.