JP4950730B2 - Portable electronic device, file access method and IC card in portable electronic device - Google Patents

Description

  The present invention has, for example, a nonvolatile memory that holds data, and at least one file is set in the memory, and a plurality of records are stored in the file, and commands (instructions) input from the outside are stored. ) And a portable electronic device such as an IC card that accesses the file, a file access method in the portable electronic device, and an IC card.

  In this type of IC card, the data stored in the nonvolatile memory inside thereof, such as a dedicated file (DF: Dedicated File) or an elementary file (EF: Elementary File, hereinafter simply referred to as a file), etc. A method of performing file management in units of files is common (see, for example, Patent Document 1).

In such an IC card, a command sets an access condition for a file (EF) and performs access control by the command based on the access condition (see, for example, Patent Document 2).
Japanese Patent No. 2695857 JP-A-8-263353

  However, recently, there are cases where a plurality of records are stored in one file (EF). In such a case, in the conventional access control method, access control is performed in units of files, so access control is performed for each record. There is a problem that can not be.

  Therefore, the present invention provides a portable electronic device and a portable electronic device that can perform finer access control than the case where the access condition is set for a conventional file by setting the access condition for each record. It is an object to provide a file access method and an IC card in an apparatus.

The portable electronic device of the present invention has a memory, and an elementary file having at least one record structure is set in the memory, and a plurality of records are stored in the elementary file and inputted from the outside. In the portable electronic device that accesses the elementary file , at least a record identifier that designates an access target record and a record that is designated by the record identifier are stored in the portable electronic device that accesses the elementary file. Receiving means for receiving a command for executing at least one of write, rewrite, read, delete, and record addition of data with respect to a record , which is composed of parameter data indicating a file identifier that designates the file being recorded When the command received by the receiving means An access condition to the line, the collation result of the collation key based on matching instruction executed before the execution of instructions along the access condition to determine the accessibility of the record, the authentication result by the authentication key based on the authentication command Or an access condition setting means for setting the presence or absence of secure messaging processing of an instruction itself for accessing a record for each record, and a confirmation for confirming validity of parameter data of the instruction when the instruction is received by the receiving means If the validity of the parameter data of the instruction can be confirmed as a result of the confirmation by the means and the confirmation means, whether the access condition of the record specified by the parameter data of the instruction can be permitted for the access target record Determination means for determining whether or not the result of determination by the determination means, If processing to access the record is allowed, by executing instructions received by said receiving means comprises an access control means for accessing with respect to the access target record.

The file access method in the portable electronic device of the present invention has a memory, an elementary file having at least one record structure is set in the memory, and a plurality of records are stored in the elementary file. A file access method in a portable electronic device for accessing the elementary file by interpreting and executing a command input from outside, wherein the record identifier is input from the outside and specifies at least an access target record; and consists parameter data indicating a file identifier specifying a file record specified by the record identifier is stored, the writing of data to record, rewriting, reading, deleting, at least any one of additional records Instruction to execute A receiving step of receiving, by an access condition for executing instructions received by said receiving step, based on the collation instruction executed before the execution of instructions for determining accessibility of records along the access condition The verification result of the verification key, the authentication result based on the authentication key based on the authentication command, or the access condition setting step for setting the presence or absence of secure messaging processing of the command itself for accessing the record, and the command by the receiving step When receiving, a confirmation step for confirming the validity of the parameter data of the instruction, and a record specified by the parameter data of the instruction when the validity of the parameter data of the instruction is confirmed as a result of the confirmation by the confirmation step. The access condition record A determination step for determining whether or not it is acceptable, and, as a result of the determination by the determination step, if processing is permitted for the access target record, by executing the instruction received by the reception step, An access control step for accessing the record to be accessed .

The IC card of the present invention has a memory, and an elementary file having at least one record structure is set in the memory, and a plurality of records are stored in the elementary file, and an instruction input from the outside. In an IC card that accesses the elementary file by interpreting and executing the above, a file that is input from the outside and stores at least a record identifier that specifies the access target record and a record that is specified by the record identifier is stored It consists parameter data indicating a file identifier that specifies the writing of data to the record, rewriting, reading, deleting, and receiving means for receiving a command for executing at least any one of the additional records, the receive for executing instructions received by means An access condition, or matching result of the matching key based on matching instruction executed before the execution of instructions along the access condition to determine the accessibility of the record, the authentication result by the authentication key based on the authentication command, the record An access condition setting means for setting the presence or absence of secure messaging processing of the instruction itself for each record, a confirmation means for confirming validity of parameter data of the instruction when the instruction is received by the receiving means, As a result of confirmation by the confirmation means, if the validity of the parameter data of the instruction can be confirmed, it is determined whether or not the access condition of the record specified by the parameter data of the instruction can be permitted for the access target record. A determination unit and a result of determination by the determination unit, the access target If the process is allowed for code storage by executing the instructions received by the receiving means, and an IC module and an access control means for accessing with respect to the access target record, the IC module IC card main body.

  According to the present invention, by setting an access condition for each record, a portable electronic device and a portable electronic device that can perform finer access control than when the access condition is set for a conventional file. A file access method and an IC card in the apparatus can be provided.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 shows a configuration example of an IC card system that handles an IC card as a portable electronic device according to the present invention. In this IC card system, an IC card 101 can be connected to a terminal device 103 via a card reader / writer 102 as an external device, and a keyboard 104, a CRT display unit 105, and a printer 106 are connected to the terminal device 103. Composed.

  The IC card 101 becomes operable by supplying power from the card reader / writer 102, and executes various processes in accordance with commands supplied from the card reader / writer 102. The card reader / writer 102 supplies operating power to the IC card 101 and commands for requesting various processes.

  Here, the content of the command supplied from the card reader / writer 102 to the IC card 101 is a record operation (access). For example, at least one of data write, rewrite, read, delete, and record addition to the record One of them.

  The terminal device 103 is constituted by, for example, a personal computer, and executes various processes by executing various control programs stored in a memory (not shown), and also performs an IC via the card reader / writer 102. Data is input to and output from the card 101.

  FIG. 2 shows the configuration of the IC card 101. The CPU 201 is a control element, the data memory 202 is a storage means (memory) whose contents can be rewritten, the working memory 203, the program memory 204, and the card reader The communication unit 205 is configured to communicate with the writer 102. Of these, the portion within the broken line (CPU 201, data memory 202, working memory 203, program memory 204) is composed of one (or a plurality) of IC chips 206, and further this IC chip 206 and communication unit 205. Are integrated into an IC module and embedded in the IC card main body 101a.

  The CPU 201 is a control unit that performs various determination processes, determination processes, and various data processes such as writing to and reading from a memory.

  The data memory 202 is composed of an erasable (rewritable) non-volatile memory such as an EEPROM (Electrical Eraseable and Programmable Read Only Memory), and various data such as various application data are files. Stored in structure.

  The working memory 203 is a working memory for temporarily storing processing data when the CPU 201 performs processing. For example, the working memory 203 includes a volatile memory such as a RAM (Random Access Memory).

  The program memory 204 is configured by a non-rewritable fixed memory such as a mask ROM (read only memory), for example, and stores a control program of the CPU 201 and the like.

  The communication unit 205 is configured as an antenna unit when the IC card 101 is a non-contact (wireless) IC card, and receives the modulated wave transmitted from the card reader / writer 102 in a non-contact manner or transmits the modulated wave to the outside. Or to send. Further, a power supply and a clock for supplying to the internal circuit are generated from the modulated wave received by the communication unit 205. In the case of a contact type IC card, it is configured as a contact portion, and a power source and a clock are obtained by contacting with an IC card terminal portion (not shown) provided in the card reader / writer 102.

FIG. 3 shows an example of the internal structure of the data memory 102. In this example, three files (EF) are set.
In the data memory 102, for example, record EF definition information (1) 301, record EF definition information (2) 302, record EF definition information (3) 303 defining EF of a record structure (hereinafter referred to as record EF). Verification key EF definition information 304 that defines a verification key EF that stores a verification key, authentication key EF definition information 305 that defines an authentication key EF that stores an authentication key, and an authenticator generation key EF that stores an authenticator generation key The authenticator generation key EF definition information 306 to be defined and the data encryption key EF definition information 307 for defining the data encryption key EF for storing the data encryption key are stored, and the record EF definition information (1) 301 is used. Defined by record EF (1) 308, record EF definition information (2) 302 defined by record EF (2) 309, and record EF definition information (3) 303 Record EF (3) 310, verification key EF 311 defined by verification key EF definition information 304, authentication key EF 312 defined by authentication key EF definition information 305, and authenticator defined by authenticator generation key EF definition information 306 A generation key EF313 and a data encryption key EF314 defined by the data encryption key EF definition information 307 are stored.

  FIG. 4 shows an example of the internal structure of the working memory 203. The working memory 203 has an area 203a for storing the verification state of the verification key and an area 203b for storing the authentication status of the authentication key and the authenticator.

FIG. 5 shows details of the record EF definition information 301, 302, and 303. In this example, a case where three records are stored in one record EF is shown.
The record EF definition information 301, 302, and 303 indicate an address 401 indicating a position where the record EF is defined, an EF-ID 402 as identification information of the record EF, a file type 403 of the record EF, and a record length. A record length 404, a record number 405 indicating the number of records (“3” in this example), a record (1) access condition 406 indicating the access condition of the record (1), and a record (2 indicating the access condition of the record (2) (2) ) Access condition 407 and record (3) access condition 408 indicating the access condition of record (3).

  Here, as the record access conditions 406, 407, and 408, for example, the data read process access condition, the data write process access condition, the data append process access condition, the data rewrite process access condition, and the secure messaging process access Conditions can be considered.

  Access conditions for data read processing include read prohibition, readability when verification key verification is successful, readability when authentication key authentication is successful, verification key verification is successful, or authentication key authentication is successful It is possible to read the data sometimes, the data can be read when the verification of the verification key is successful, and the authentication of the authentication key is successful.

  Here, collation of the collation key refers to collation of the collation key added to the collation command from the card reader / writer 102 with the collation key in the collation key EF311. This means that collation is unsuccessful when the collation keys do not match, and the collation result is stored in the collation state storage area 203a of the working memory 203. This collation processing is performed prior to execution of actual processing commands such as writing and reading.

  Authentication key authentication refers to successful authentication when the encrypted authentication data added to the authentication command from the card reader / writer 102 is decrypted with the authentication key in the authentication key EF312 and correctly decrypted. This means that the authentication is unsuccessful when decryption is not successful, and the authentication result is stored in the authentication state storage area 203b of the working memory 203. This authentication process is also performed prior to executing an actual processing command such as writing or reading.

As access conditions for the secure messaging process, there may be no secure messaging, an authenticator is required, data encryption is required, an authenticator and data encryption is required, and the like.
Here, the fact that the authenticator is necessary means that the data of the specified part (for example, header part and data part) of the received command is encrypted by using the authenticator generation key in the authenticator generation key EF313. The generated authenticator is compared with the authenticator attached to the received command. If both authenticators match, authentication is successful, and if both authenticators do not match, authentication fails. The authentication result is stored in the authentication state storage area 203b of the working memory 203. Command processing is performed when authentication of the authenticator is successful.

  The necessity of data encryption means that the command processing is performed after the data is decrypted (encrypted) by using the data encryption key in the data encryption key EF314. For example, in the case of a data write command, the write data added to the command is decrypted using the data encryption key in the data encryption key EF 314 and then the data memory 102 is written. Further, for example, in the case of a data read command, the record (data) designated by the command is read from the data memory 102, and the read record (data) is encrypted using the data encryption key in the data encryption key EF314. Output to the card reader / writer 102.

  In addition, the authentication code and data encryption are required. The authentication code and data encryption are necessary. As described above, the authentication of the authentication code is successful and the data part is decrypted (encrypted). This means that command processing is performed.

  FIG. 6 shows the records stored in the records EF308, 309, and 310. In this example, there are three records in one record EF, 501 indicates the record (1), 502 indicates the record (2), and 503 indicates the record (3). These records 501, 502, 503 are composed of, for example, record management information (the size of the record, position information of the next record, etc.) and data of the record.

  FIG. 7 shows a format example of a command sent from the card reader / writer 102 to the IC card 101. This example shows a command for writing data, for example, a classification unit (CLA) 801 having a function for identifying the command, an instruction unit (INS) 802, parameter data (P1, P2) ) 803, 804, a data length (Lc) 805 representing the length of data to be written, and write data (Data) 806.

  The parameter data (P1) 803 stores, for example, data (record number or the like) specifying a record to which data is to be written, and the parameter data (P2) 804 is specified by, for example, parameter data (P1) 803 An identifier (such as EF-ID) indicating a file (record EF) in which the record to be stored is stored is stored.

Next, an access process for a command from the card reader / writer 102 in such a configuration will be described with reference to a flowchart shown in FIG.
When the CPU 201 receives a command input from the card reader / writer 102 (step S1), the CPU 201 checks the command format to confirm the validity of the command (step S2). In this format check, for example, it is confirmed whether the command classification unit 801 and the command unit 802 indicate regular commands, whether parameter data 803 and 804 are set out of function, and the data length It is confirmed whether or not 805 is set to a non-standard value such as “00”, and whether or not the data 806 is a data string having a data length indicated by the data length 805 is confirmed.

  As a result of the format check in step S2, if an abnormality is found in the format, the CPU 201 sets a status word indicating a format error, executes the status word output process (step S3), and ends the process. .

  If no abnormality is found in the format as a result of the format check in step S2, the CPU 201 checks whether the record number stored in the parameter data (P1) 803 of the command is correct (step S4). If not, a status word indicating a processing error is set, the status word output process is executed (step S3), and the process ends.

  If the record number stored in the parameter data (P1) 803 is correct as a result of the check in step S4, the CPU 201 checks whether the EF-ID stored in the parameter data (P2) 804 of the command is correct. (Step S5) If it is not correct, a status word indicating a processing error is set, the status word output process is executed (Step S3), and the process ends.

As a result of the check in step S5, if the EF-ID stored in the parameter data (P2) 804 of the command is correct, the CPU 201 determines that the EF-ID stored in the parameter data (P2) 804 of the command is a shortened EF. Whether it is an identifier (Short EF Identifier) or a current EF identifier is checked (step S6), and if it is a shortened EF identifier, the designated record EF is made current (step S7), and the process proceeds to step S8.
If the result of the check in step S6 is the current EF identifier, the CPU 201 jumps to step S7 and proceeds to step S8.

  In step S8, the command processing is performed by referring to the corresponding record EF definition information in FIG. 3 and the matching state and authentication state in FIG. 4 for the access condition of the record specified by the parameter data (P1) 803 of the command. It is determined whether or not the target record is acceptable.

  If the result of determination in step S8 is that processing is not permitted for the target record, the CPU 201 sets a status word indicating a processing error, executes output processing of the status word (step S3), and ends the processing To do.

  As a result of the determination in step S8, if the process is permitted for the target record, the CPU 201 executes command processing (for example, data writing or reading) on the record (step S9), and then When the process ends, a status word indicating normal end is set, the status word output process is executed (step S10), and the process ends.

  As described above, according to the above-described embodiment, the nonvolatile memory that holds data is provided, at least one file is set in the memory, and a plurality of records are stored in the file. By interpreting and executing an externally input command and setting an access condition for each record in an IC card that accesses the file, the access condition is set for a conventional file rather than the case of setting the access condition for a conventional file. Fine access control can be performed.

  In the above-described embodiment, the case where the present invention is applied to an IC card as a portable electronic device has been described. However, the present invention is not limited to this, and for example, a portable terminal device called PDA, a cellular phone, etc. However, the shape is not limited to the card type, but may be a booklet type, a block type, or a tag type.

The block diagram which shows the structural example of the IC card system which handles the IC card as a portable electronic device concerning the present invention. 1 is a block diagram schematically showing the configuration of an IC card. The schematic diagram which shows the internal structure example of a data memory. The schematic diagram which shows the example of an internal structure of a working memory. The block diagram which shows the detail of record EF definition information. The block diagram which shows the record stored in the record EF. The schematic diagram which shows the example of a format of the command sent to an IC card. The flowchart explaining the access process with respect to a command.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 101 ... IC card (portable electronic device), 101a ... IC card main body, 102 ... Card reader / writer, 103 ... Terminal device, 104 ... Keyboard, 105 ... CRT display part, 106 ... Printer, 201 ... CPU (control element) 202 ... Data memory (storage means) 203 ... Working memory 204 ... Program memory 205 ... Communication unit 206 ... IC chip 301,302,303 ... Record EF definition information 308,309,310 ... Record EF ( File), 406, 407, 408, record access conditions.

Claims (3)

There is a memory, and at least one record structure elementary file is set in this memory. A plurality of records are stored in this elementary file, and an instruction input from the outside is interpreted and executed. In a portable electronic device that accesses the elementary file,
It consists of parameter data that indicates the file identifier that specifies the file that specifies the record that stores the record specified by the record identifier and the record specified by the record identifier that is input from the outside, and the record is written, rewritten, Receiving means for receiving an instruction to execute at least one of read, delete, and record addition ;
The access condition for executing the command received by the receiving means, the verification result of the verification key based on the verification command executed before the execution of the command for determining whether or not the record can be accessed according to the access condition, An authentication result based on an authentication key based on the authentication command, or an access condition setting means for setting the presence or absence of secure messaging processing of the command itself for accessing the record, for each record;
When the command is received by the receiving unit, a checking unit for checking the validity of the parameter data of the command;
As a result of confirmation by the confirmation means, if the validity of the parameter data of the instruction can be confirmed, it is determined whether or not the access condition of the record specified by the parameter data of the instruction can be permitted for the access target record Determination means to perform,
As a result of determination by the determination unit, when processing is permitted for the access target record, an access control unit that accesses the access target record by executing a command received by the reception unit ;
A portable electronic device comprising: There is a memory, and at least one record structure elementary file is set in this memory. A plurality of records are stored in this elementary file, and an instruction input from the outside is interpreted and executed. A file access method in a portable electronic device for accessing the elementary file,
It consists of parameter data that indicates the file identifier that specifies the file that specifies the record that stores the record specified by the record identifier and the record specified by the record identifier that is input from the outside, and the record is written, rewritten, A receiving step for receiving an instruction to execute at least one of reading, deleting, and adding a record ;
The access condition for executing the instruction received by the receiving step, the collation result of the collation key based on the collation instruction executed before the execution of the instruction for determining whether the record can be accessed according to the access condition, An access condition setting step for setting, for each record, an authentication result based on an authentication key based on an authentication command, or whether or not the command itself accessing the record has secure messaging processing ;
Upon receiving the instruction by the receiving step, a confirmation step for confirming the validity of the parameter data of the instruction;
As a result of the confirmation in the confirmation step, when the validity of the parameter data of the instruction can be confirmed, it is determined whether or not the access condition of the record specified by the parameter data of the instruction can be permitted for the access target record. A determination step to:
As a result of determination by the determination step, when processing is permitted for the access target record, an access control step for accessing the access target record by executing the instruction received by the reception step ;
A file access method in a portable electronic device comprising : There is a memory, and at least one record structure elementary file is set in this memory. A plurality of records are stored in this elementary file, and an instruction input from the outside is interpreted and executed. In an IC card for accessing the elementary file,
It consists of parameter data that indicates the file identifier that specifies the file that specifies the record that stores the record specified by the record identifier and the record specified by the record identifier that is input from the outside, and the record is written, rewritten, Receiving means for receiving a command for executing at least one of reading, deleting, and adding a record; and an access condition for executing a command received by the receiving means , wherein the access condition The verification result of the verification key based on the verification command executed before the execution of the command that determines whether or not the record can be accessed, the authentication result based on the authentication key based on the authentication command, or the secure messaging processing of the command itself that accesses the record setting the presence or absence for each of the record And access condition setting means, upon receiving the instruction by the receiving unit, a confirmation means for confirming the validity of the parameter data of the instruction, a result of confirmation by the confirming means, to check the validity of the parameter data of the instruction A determination unit that determines whether or not the access condition of the record specified by the parameter data of the instruction is acceptable for the access target record; An IC module having an access control means for accessing the record to be accessed by executing a command received by the receiving means ,
An IC card body containing the IC module;
IC card comprising:

Images