JP2007004624A - Information management device, information management method and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To appropriately protect user data stored in a memory when an IC card product is repaired and discarded. <P>SOLUTION: The IC card has a plurality of stages corresponding to a life cycle. In a manufacturing stage, work at manufacturing can efficiently be executed. In a maintenance stage, firmware that is actually operating can be corrected. In a suspend stage, work when the product is repaired can efficiently be executed. In a disposal stage, the operation end of the product can be carried out. In a protection stage, the use of the product when the product fails can be stopped. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an information management apparatus, an information management method, and a computer program for managing access to information stored in a relatively large memory area. In particular, the present invention relates to an electronic device on a memory area such as an IC card. The present invention relates to an information management device, an information management method, and a computer program that store secure value information and exchange secure information such as electronic payment.

  More particularly, the present invention relates to an information management apparatus and information management method for appropriately protecting user data stored in a memory by an access operation according to the life cycle of an IC card product, and a computer program. In particular, the present invention relates to an information management apparatus, information management method, and computer program for appropriately protecting user data stored in a memory at the time of repair or disposal of an IC card product.

  Non-contact / proximity communication systems represented by IC cards are widely used because of their ease of operation. A general method of using an IC card is performed by a user holding the IC card over a card read / write device. The card read / write device always polls the IC card, and when an external IC card is found, the communication operation between the two starts. For example, by storing PIN code, other personal authentication information, value information such as electronic tickets in an IC card, visitors and passengers at cash dispensers, entrances to concert venues, ticket gates at stations, etc. Authentication processing can be performed.

  Recently, IC cards having a relatively large capacity memory have appeared along with improvements in miniaturization technology. According to an IC card with a large-capacity memory, a single IC card can be used for a plurality of purposes by developing a file system in the memory space and storing a plurality of applications simultaneously. For example, by storing a plurality of applications such as electronic money for electronic payment and electronic ticket for entering a specific concert venue on a single IC card, It can be applied to various uses (see, for example, Non-Patent Document 1). The electronic money and electronic ticket mentioned here refer to a mechanism in which payment (electronic payment) is made through electronic data issued according to funds provided by a user, or such electronic data itself.

  In addition to a wireless / contactless interface, an IC card or a card reader / writer (card reader / writer) includes a wired interface for connecting to an external device, so that a mobile phone, PDA (Personal Digital Assistance) or CE (CE) These non-contact communication functions can be incorporated in each device such as a consumer electronics device and a personal computer (for example, see Non-Patent Document 1). That is, these information processing terminals are equipped with one or both of the functions of an IC card and a card read / write device, and perform non-contact communication technology using an IC card for versatile bidirectional proximity data communication. Can do. IC card technology is difficult to copy or tamper with internal information and has tamper resistance, and this type of proximity data communication can realize security at a high level.

  By the way, IC card products have a life cycle such as product shipment, use, repair, disposal and recycling, as with other devices.

  For example, as a card specification, 1) a state where a minimum function is activated (OP READY), 2) an initialized state (INITIALIZED), 3) a state where the card can be used safely (SECURED), 4) a locked state ( There are proposals for life cycle management by defining five life cycle statuses and transition conditions for CARD LOCKED) and 5) function termination (TERMINATED) and writing the life cycle status to the IC card. (See, for example, Non-Patent Document 2).

  IC card, IC card reader / writer, and IC card status management that enables the user to clearly indicate the life cycle status of the IC card by visual means and to prevent unauthorized use of the IC card. A method has been proposed (see, for example, Patent Document 1).

  As described above, in the IC card, user data such as value information is stored that significantly impairs the user's profit when illegal use or tampering is performed. For this reason, there is a problem that, for example, repair when a device equipped with an IC chip breaks down is difficult to handle because it still contains user data. In order to avoid unauthorized use of user data during a period in which the IC card is away from the user's hand for repair or the like, the user data must be initialized and repaired.

  In such a case, before sending the IC card mounted device for repair, the user goes to the IC card service provider to initialize the user data, and then passes the mounted device to the repair company. When the mounted device returns from repair, it is necessary to go to the IC card service provider again and rewrite the user data, which is troublesome. In addition, when one IC card uses services of a plurality of service providers (described above), such work must be repeated for the number of service use.

  In the conventional IC card operation, there are provisions regarding the life cycle as in other products, but there is no provision regarding a method for protecting user data according to the state of the life cycle.

  In order to properly protect user data in a period when the IC card is away from the user's hand, such as during repair or disposal, the present inventors intend to smoothly use the user data in the IC card. Thinks that a mechanism for controlling the access operation to the IC card for each stage of the life cycle is necessary.

JP 2004-110087 A “Business changes with sesame seed chips for all wireless IC tags” (pages 106-107, RFID Technology Editorial Department, Nikkei Business Publications, April 20, 2004) “Open Platform Card Specification Version 2.1”, Global Platform, June 4, 2001, p. 38-39

  An object of the present invention is to provide an excellent information management apparatus and information management method capable of storing electronic value information in a memory area like an IC card and exchanging secure information including electronic payment. And providing a computer program.

  A further object of the present invention is to provide an excellent information management apparatus, information management method, and computer program capable of appropriately protecting user data stored in a memory according to the life cycle of an IC card product. It is to provide.

  A further object of the present invention is to provide an excellent information management apparatus, information management method, and computer program capable of appropriately protecting user data stored in a memory when an IC card product is repaired or discarded. Is to provide.

The present invention has been made in consideration of the above problems, and a first aspect thereof is an information management apparatus for managing user data stored in a memory,
A communication control function unit that controls communication operation with an external device connected via a communication interface;
A stage management function unit for setting a stage in the life cycle of the information management device based on an external event detected through the communication interface or an internal state of the information management device itself;
A stage holding function unit for storing the stage set by the stage management function unit;
An access control function unit for controlling an access operation to user data stored in the memory according to a stage held in the stage holding function unit;
It is an information management device characterized by comprising.

  The information management device mentioned here includes an IC chip that executes a non-contact IC card function, a non-contact IC card that incorporates an IC chip as a wireless communication unit and a non-contact IC card function execution unit, and a non-contact IC excessive discharge function unit. An IC card such as a mounted SIM card or UIM card, a contact IC card having a terminal on the surface, an IC chip having a function similar to that of a contact / non-contact IC card, a mobile phone, a PHS (Personal Handyphone System), a PDA (Personal Digital) This is a device built in an information communication terminal device such as Assistance. An IC chip as a non-contact IC card function execution unit has a data transmission / reception function and a data processing unit, but an RF analog front end and a logic circuit (protocol control, RF modulation / demodulation, command processing, encryption processing, memory management). May be constituted by one chip, or may be constituted by two or more ICs separated from each other. Hereinafter, these may be collectively referred to simply as an “IC card function execution unit”.

  This information management apparatus has a memory area including a data storage memory such as an EEPROM and a data processing unit, and also has a data communication function. In the case of a mobile phone or the like, an external storage medium such as an IC card incorporating an IC chip may be detachable. In addition, a SIM (Subscriber Identity Module) function that records subscriber information issued by a mobile phone company may be mounted on the IC chip. The information management device may perform data communication via an information communication network such as the Internet, or may directly perform data communication with an external terminal device in a wired or wireless manner.

  Since IC card technology is difficult to copy and falsify internal information and has tamper resistance, this type of information management device is of a high level in carrying information and communicating with external devices. Can realize security.

  As with other devices, IC card products have a life cycle such as product shipment, use, repair, disposal and recycling. In the IC card, user data such as value information is stored, and the user's profit is significantly impaired when illegal use or tampering is performed. For this reason, for example, repair when an IC chip-mounted device breaks down is difficult to handle because the user data is still included, and there is no choice but to initialize the user data for repair.

  On the other hand, in the present invention, by introducing a mechanism for controlling the access operation to the IC card at each stage of the life cycle, the data in the IC card can be used smoothly, while at the time of repair, disposal, etc. Appropriate protection of user data was realized when the card was away from the user.

  An information management apparatus according to the present invention has a plurality of stages corresponding to the life cycle of an IC card, and is based on an external event detected through the communication interface or an internal state of the information management apparatus itself. The stage in the life cycle is set.

  User data stored in the memory can be used, that is, user data stored in the memory cannot be used in addition to the first stage of using the IC card in a general usage mode. A second stage is defined. In the first stage, the access control function unit permits an external device through the communication interface to access user data stored in the memory through a predetermined authentication procedure. In the second stage, all access to the user data stored in the memory is not permitted for the external device through the communication interface.

  The second stage in which all access to user data is denied is the “maintenance stage” in which the firmware for internal operation of the IC card can be modified, the IC card itself repaired, or the IC "Suspend stage" that temporarily stops the use of user data stored in the memory when the information processing terminal equipped with the card is repaired, "Dispose stage" that ends the use of the IC card, or an abnormality has occurred It is possible to define a plurality of life cycle stages such as a “protection stage” for stopping the use of user data stored in the memory.

  For example, when an IC chip mounted device is sent out for repair, the IC chip is moved from the first stage as a general use stage to the suspend stage through a predetermined procedure, and the device is in a period away from the user's hand. User data can be protected. In addition, when the IC chip mounted device returns from the repair, the IC chip is returned from the suspend stage to the general use stage through a predetermined procedure, and the use of the user data in the IC chip can be resumed smoothly. it can.

According to a second aspect of the present invention, there is provided a computer program written in a computer-readable format so that processing for managing user data stored in a memory in an IC card is executed on a computer system. With respect to the computer system,
A communication control procedure for controlling a communication operation with an external device connected via a communication interface;
A stage management procedure for setting a stage in the life cycle of the IC card based on an external event detected through the communication interface or an internal state of the IC card;
An access control procedure for controlling an access operation to user data stored in the memory according to the current stage set in the stage management step;
Is a computer program characterized in that

  The computer program according to the second aspect of the present invention defines a computer program described in a computer-readable format so as to realize predetermined processing on a computer system. In other words, by installing the computer program according to the third aspect of the present invention in the computer system, a cooperative action is exhibited on the computer system, and the information management according to the first aspect of the present invention is performed. The same effect as the apparatus can be obtained.

  According to the present invention, an excellent information management device, information management method, and computer program capable of appropriately protecting user data stored in a memory according to the life cycle of an IC card product are provided. can do.

  Further, according to the present invention, an excellent information management apparatus and information management method capable of appropriately protecting user data stored in a memory at the time of repair or disposal of an IC card product, and a computer A program can be provided.

  Other objects, features, and advantages of the present invention will become apparent from more detailed description based on embodiments of the present invention described later and the accompanying drawings.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  The present invention relates to a wireless communication unit, a non-contact IC card incorporating an IC chip having a data transmission / reception function and a data processing unit, a contact IC card having a terminal on the surface, and an IC having the same function as a contact / non-contact IC card The present invention relates to an information management device configured by incorporating a chip in an information communication terminal device such as a mobile phone, a PHS (Personal Handyphone System), or a PDA (Personal Digital Assistance).

  An IC chip equipped with a non-contact IC card function has a data transmission / reception function and a data processing unit, but an RF analog front end and a logic circuit (protocol control, RF modulation / demodulation, command processing, encryption processing, memory management) are one chip. Alternatively, it may be configured by an IC of two or more chips separated from each other. Hereinafter, these may be collectively referred to simply as an “IC card function execution unit”. First, a mechanism of contactless data communication using an IC card will be described.

Wireless communication between the card read / write device and the IC card is realized based on the principle of electromagnetic induction, for example. FIG. 1 conceptually illustrates a wireless communication mechanism between a card read / write device based on electromagnetic induction and an IC card. The card read / write device includes an antenna _LRW composed of a loop coil, and generates a magnetic field around the antenna LRW by _passing a current _IRW . On the other hand, in the IC card side, the electrical loop coil L _c around the IC card is Katachi設. The loop coil L _c ends of the IC card side occurs voltage induced by the magnetic field emitted by the loop antenna L _c of the card reading and writing apparatus, is input to the IC card terminal connected to the loop coil L _c end .

Loop coil L _c of the antenna L _RW and IC card side of the card reading and writing apparatus is the degree of coupling will vary depending on the positional relationship of each other, can be regarded as examples of the system forms a single transformer, The read / write operation of the IC card can be modeled as shown in FIG.

On the card read / write device side, by modulating the current I _RW flowing through the antenna L _RW , the voltage V _O induced in the loop coil L _c on the IC chip is modulated, and the card read / write device is utilized by using the modulation. Can transmit data to the IC card.

Further, IC card has features to vary the load between the terminals of the loop coil L _c in accordance with the data to be returned to the card reading and writing device (LoadSwitching). When the load between the terminals of the loop coil L _c is varied, a card reading and writing apparatus to change the impedance between the antenna terminal appears as a variation of the passing current I _RW and voltage V _RW antenna L _RW. By demodulating the fluctuation, the card read / write device can receive the return data of the IC card.

  That is, the IC card performs communication by applying amplitude modulation to the signal appearing in the receiving circuit on the card read / write device side by changing the load between its own antennas according to the response signal to the interrogation signal from the card read / write device. That's why you can.

  As shown in FIG. 3, the contactless card communication system includes a card read / write device 1, an IC card function execution unit 2, and a controller 3, and uses electromagnetic waves between the card read / write device 1 and the IC card 2. Thus, data is transmitted and received without contact. That is, the card read / write device 1 transmits a predetermined command to the IC card function execution unit 2, and the IC card function execution unit 2 performs processing corresponding to the received command. Then, the IC card function execution unit 2 transmits response data corresponding to the processing result to the card read / write device 1.

  The card read / write device 1 is connected to the controller 3 via a predetermined interface (for example, one that conforms to the RS-485A standard or the like). The controller 3 supplies a control signal to the card read / write device 1 to cause the IC card function execution unit 2 to perform predetermined processing.

  In addition to the wireless / contactless interface, the IC card function execution unit is equipped with a wired interface for connecting to an external device, so that a mobile phone, PDA (Personal Digital Assistance), CE (Consumer Electronics) device, personal -It can be used in an information processing terminal such as a computer or connected to a cable.

  FIG. 4 schematically shows the hardware configuration of this type of IC card function execution unit. As shown in the figure, the IC card function execution unit includes an analog unit 102 connected to the antenna unit 101, a digital control unit 103, a memory 104, and an external interface 105, and is built in the portable terminal 110. ing. The IC card function execution unit may be configured with a one-chip semiconductor integrated circuit, or may be configured with a two-chip semiconductor integrated circuit by separating the RF analog front end and the logic circuit unit.

  The antenna unit 101 transmits / receives non-contact data to / from a card read / write device (not shown). The analog unit 102 processes analog signals transmitted and received from the antenna unit 101, such as detection, modulation / demodulation, and clock extraction. These constitute a non-contact interface between the IC card function execution unit and the card read / write device.

  The digital control unit 103 comprehensively controls processing of transmission / reception data and other operations in the IC card function execution unit. The digital control unit 103 connects an addressable memory 104 locally. The memory 104 includes a nonvolatile storage device such as an EEPROM (Electrically Erasable Programmable Read Only Memory), stores user data such as electronic money and an electronic ticket, and writes a program code executed by the digital control unit 103. Or can be used to save work data being executed.

  In this embodiment, the IC card function execution unit defines a plurality of stages corresponding to the life cycle of the IC card function execution unit, such as a manufacturing stage, a maintenance stage, a suspend stage, a dispose stage, and a protection stage. Has been. The digital control unit 103 controls the access operation to the memory 104 according to each stage, and details of this point will be described later.

  The external interface 105 is a functional module for the digital control unit 103 to wire-connect a device such as the portable terminal 110 with an interface protocol different from a non-contact interface connected to a card read / write device (not shown). Data written in the memory 104 can be transferred to the mobile terminal 110 via the external interface 105.

  Here, when communicating with the card read / write device, the received data from the card read / write device is converted as it is, according to an appropriate conversion rule, or converted into another packet structure, and the portable terminal via the external interface 105 110. Conversely, the data received from the mobile terminal 110 via the external interface 105 is converted as it is, or converted according to an appropriate conversion rule, or converted into another packet structure and transmitted to the card read / write device via the non-contact interface. To do.

  In the present embodiment, it is assumed that the IC card function execution unit is built in and used in the mobile terminal 110 as an information processing terminal, and the external interface 105 is wired such as a UART (Universal Asynchronous Receiver Transmitter). Use the interface.

  The IC card function execution unit can be driven by energy obtained from a reception signal from a card read / write device received via the antenna unit 101, for example. Of course, part or all may be configured to operate by power supplied from the portable terminal 110 via the wired interface 105.

  The mobile terminal 110 corresponds to an information processing terminal such as a mobile phone, a PDA, or a personal computer (PC). The portable terminal 110 includes a program control unit 111, a display unit 112, and a user input unit 113.

  The program control unit 111 includes, for example, a microprocessor, a RAM, and a ROM (none of which are shown in FIG. 4), and the microprocessor uses the RAM as a work area in accordance with the program code stored in the ROM. Run various processing services. The processing service includes processing for the IC card function execution unit in addition to the original functions of the mobile terminal 1100 such as a mobile phone. Of course, the program control unit 111 may include an external storage device such as a hard disk and other peripheral devices.

  In the configuration example shown in FIG. 4, the antenna unit 101 for non-contact IC card interface is mounted in an IC chip as an IC card function execution unit, but the antenna configuration is not limited to this. For example, the antenna unit 101 may be externally connected to the IC chip module, or the antenna unit 101 may be disposed on the mobile terminal 101 side in which the IC chip module is built.

  As already known, IC card technology is difficult to copy or tamper with internal information and has tamper resistance. Therefore, according to this type of information management device, information carrying and external devices Security can be realized at a high level in information communication.

  As with other devices, IC card products have a life cycle such as product shipment, use, repair, disposal and recycling. User data such as value information is stored in the IC card. If user data is illegally used or tampered with, the user's profit will be significantly impaired. For this reason, there is a problem that, for example, repair in the case where a device on which an IC card is mounted fails is difficult to handle because user data is still included. Therefore, in this embodiment, while aiming for smooth use of data in the IC card, in order to properly protect the user data during a period when the IC card is away from the user, such as during repair or disposal, Introduced a mechanism to control access to the IC card for each stage of the life cycle.

  FIG. 5 shows a state transition diagram of the IC card according to the present embodiment. As shown in the figure, in addition to the general use stage, the IC card has a plurality of stages corresponding to the life cycle of the IC card, such as a manufacturing stage, a maintenance stage, a suspend stage, a dispose stage, and a protection stage. have.

  The manufacturing stage is a manufacturing state of the IC card. By performing a predetermined issuance procedure for the IC card at the manufacturing stage, the user data is written in the IC card, and the process proceeds to the general use stage where the IC card is normally used. The IC card issuance procedure corresponds to assigning an authentication ID to the IC card.

  The suspend stage is a state where the use of the IC card is stopped, in other words, a state where all accesses to data (including user data) stored in the IC card are denied. When leaving an IC card-equipped device for repair, such as leaving the user's hand, the IC card is placed in a suspend stage to protect the user data while remaining.

  The dispose stage is a state in which the IC card is discarded, in other words, the function as the IC card is completely stopped. This stage can be used not only when the IC card is discarded but also when it is recycled. The IC card can be initialized and reused by reissuing the IC card in the dispose stage (that is, reassigning the ID).

  The maintenance stage is a state for downloading a correction program to the IC card. This stage is not directly related to the gist of the present invention and will not be further described here.

  The protection stage is a state of self-protection when an abnormality occurs in the IC card. For example, when the digital control unit 103 activates a self-defense program and an abnormality is detected, or when it is recognized that an attack such as an unauthorized access from the outside is detected, the process proceeds to the protection stage. By denying access to all data (including user data) stored in the IC card, the user data can be protected while remaining. The protection stage can be shifted from any other stage in response to detection of the occurrence of an abnormality.

  In the conventional IC card operation method, repair when an IC card equipped device fails is difficult to handle because the user data is still included, and there is no choice but to initialize the user data for repair. It was. In contrast, in this embodiment, the IC card can be held in the suspend stage state, and access to user data in the IC card can be denied in this state. Therefore, when a device equipped with an IC card is sent out for repair, the IC card is transferred from the general use stage to the suspend stage through a predetermined procedure to protect user data while the device is away from the user. be able to. In addition, when the IC card-equipped device returns from the repair, the IC card can be returned from the suspend stage to the general use stage through a predetermined procedure, and the use of user data in the IC card can be resumed smoothly. it can.

  The IC card is provided with a stage transition (Transit Stage) command. A device that accesses the IC card via the non-contact interface or the wired interface can perform a predetermined mutual authentication process with the IC card, and then change the state of the IC card using this stage transition command.

  For example, a device that accesses an IC card via a non-contact interface or a wired interface performs mutual authentication of the IC card with the system operation encryption key on the IC card in the general use stage, and then issues a stage transition command. By transmitting, it is possible to shift to the suspend stage.

  In addition, a device that accesses an IC card via a non-contact interface or a wired interface performs mutual authentication of the IC card with the encryption key for system operation on the IC card in the suspend stage, and then issues a stage transition command. By transmitting, it is possible to return to the general use stage.

  FIG. 6 schematically shows a functional configuration for controlling the state transition of the IC card shown in FIG. 5 in the digital control unit 103.

  The communication control function unit 103-1 controls communication operation with an information processing terminal via a wired interface and control communication operation with a card read / write device via a non-contact interface.

  The stage management function unit 103-2 controls the stage transition of the IC card according to the external event detected through the communication function control unit 103-1, or the internal state of the IC card itself. Specifically, after a predetermined mutual authentication process is performed with a device capable of transferring data through a wired interface or a non-contact interface, the stage shifts to a stage specified by the stage shift command. Alternatively, when the occurrence of an abnormality is detected or when it is recognized that an attack such as an unauthorized access from the outside is detected, the process proceeds to the protection stage.

  The stage holding function unit 103-3 holds the current stage set by the stage management function unit 103-2 in a nonvolatile manner.

  The access control function unit 103-4 responds to user data stored in the memory 104 in the IC card via the non-contact interface and the wired interface according to the current stage held in the stage holding function unit 103-3. Control access behavior.

  In the suspend stage, the use of the IC card is stopped, and the access control function unit 103-4 rejects all access to data (including user data) stored in the IC card. Further, in the protection stage, when an abnormality occurs in the IC card, it is in a state of self-defense, and the access control function unit 103-4 moves to the data (including user data) stored in the IC card. Deny all access.

  FIG. 7 shows an operation flow for shifting the stage of the IC card with the control configuration shown in FIG.

  When a stage transition command is issued to the IC card via a non-contact interface or a wired interface, it is passed to the stage management function unit 103-2 via the communication function control unit 103-1.

  The stage management function unit 103-2 executes a predetermined mutual authentication process defined by the interface protocol of the IC card. The procedure of the mutual authentication process follows the provisions of each protocol, but the mutual authentication itself is not directly related to the gist of the present invention, so the description is omitted here.

  If the authentication is successful, it is subsequently checked whether or not the transition of the stage requested by the stage transition command is permitted. The permitted transition referred to here is whether the transition is determined as a stage transition (see FIG. 5) or whether it is a transition defined in the last page.

  If the transition is permitted, the stage transition is performed as requested by the stage transition command. And the present stage is memorize | stored in the stage holding | maintenance function part 103-3, and this process is complete | finished.

  FIG. 8 shows a sequence when the access operation is performed on the IC card in the general use stage by the control configuration shown in FIG.

  When a user data access request command is issued to the IC card via the non-contact interface or the wired interface, it is passed to the access control function unit 103-4 via the communication function control unit 103-1.

  The access control function unit 103-4 makes an inquiry to the stage holding function unit 103-3 and confirms the current stage of the IC card. If the access is in the general use stage and access in the memory 104 is not restricted, a permission notification is sent from the stage holding function unit 103-3 to the access control function unit 103-4.

  In response to this permission notification, the access control function unit 103-4 executes access (reading, writing, etc.) to the user data requested by the user data access request command with respect to the memory 104. Then, the access result is returned to the requesting device through the communication control function unit 103-1. In addition to determining whether access is possible by confirming the current stage of the IC card, the access control function unit 103-4 performs additional verification processing such as verification of a PIN code such as a PIN (Personal Indentative Number). You may make it perform.

  FIG. 9 shows a sequence when an access operation is performed on an IC card in each stage other than the general use stage by the control configuration shown in FIG. The stage other than the general use stage refers to the production stage, the suspend stage, the dispose stage, and the protection stage.

  When a user data access request command is issued to the IC card via the non-contact interface or the wired interface, it is passed to the access control function unit 103-4 via the communication function control unit 103-1.

  The access control function unit 103-4 makes an inquiry to the stage holding function unit 103-3 and confirms the current stage of the IC card. If it is in a stage other than the general use stage and access to all data in the memory 104 is denied, the rejection is notified from the stage holding function unit 103-3 to the access control function unit 103-4. Is done.

  In response to this rejection notification, the access control function unit 103-4 does not access the memory 104, but instead returns an access rejection notification to the requesting device through the communication control function unit 103-1.

  As described above, according to the present invention, since a mechanism for controlling the access operation to the IC card is introduced for each stage of the life cycle, the IC card can be used even when a device equipped with the IC card fails. The user data can be properly protected during a period in which the IC card is away from the user, such as during repair or disposal, while ensuring smooth use of the data.

  For example, when sending a device equipped with an IC card for repair, the IC card is transferred from the general use stage to the suspend stage through a predetermined procedure to protect user data while the device is away from the user. be able to. In addition, when the IC card-equipped device returns from the repair, the IC card can be returned from the suspend stage to the general use stage through a predetermined procedure, and the use of user data in the IC card can be resumed smoothly. it can.

  Finally, an example of an authentication processing procedure performed between the IC card and the external device when the IC card is externally accessed via a non-contact interface or a wired interface will be described with reference to FIG. However, in the figure, a card read / write device accessed from a non-contact interface is assumed as an external device.

  The illustrated authentication processing procedure is composed of a two-step authentication procedure called Authentication 1 and Authenticatoin 2. In Authentication 1, first, a card read / write device that accesses an IC card via a non-contact interface generates a random number A, encrypts the random number A with an access encryption key, and transmits it to the IC card. On the other hand, on the IC card side, the received data is decrypted with the access encryption key, the random number B is generated, and the decrypted random number A and the random number B are encrypted with the encryption key, respectively. The random number B is returned to the card read / write device.

  When receiving the reply message from the IC card, the card read / write device decrypts the encrypted random number A in the received data with the access encryption key, compares the generated random number A with the decrypted random number A, and Check authenticity. Here, when the authenticity of the IC card is proved, the encrypted random number B in the received data is further decrypted with the access encryption key, and the decrypted random number B is encrypted with the access encryption key. Then, the encrypted random number B is transmitted to the IC card as Authentication2.

  The IC card decrypts the encrypted random number B in the received data with the access encryption key, compares the generated random number B with the decrypted random number B, and checks the authenticity of the other party. Then, this determination result is returned to the card read / write device, and the authentication process is terminated.

  The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiment without departing from the gist of the present invention.

  In the present specification, the embodiment in which the present invention is applied to an IC card product has been mainly described. However, the gist of the present invention is not limited to this. The present invention can be similarly applied to other types of information devices that store important information securely and have a life cycle.

  In short, the present invention has been disclosed in the form of exemplification, and the description of the present specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims should be taken into consideration.

FIG. 1 is a diagram conceptually showing a mechanism of wireless communication between a card read / write device based on electromagnetic induction and an IC card. FIG. 2 is a diagram modeling a system composed of a card read / write device and an IC card as a single transformer. FIG. 3 is a diagram schematically showing the configuration of the non-contact IC card communication system. FIG. 4 is a diagram schematically showing a hardware configuration of an IC card according to an embodiment of the present invention. FIG. 5 is a diagram showing a state transition diagram of the IC card. FIG. 6 is a diagram schematically showing a functional configuration for controlling the state transition shown in FIG. FIG. 7 is a diagram showing an operation flow for shifting the stage of the IC card by the control configuration shown in FIG. FIG. 8 is a diagram showing a sequence when the access operation is performed on the IC card in the general use stage by the control configuration shown in FIG. FIG. 9 is a diagram showing a sequence when an access operation is performed on an IC card in each stage other than the general use stage by the control configuration shown in FIG. FIG. 10 is a sequence diagram illustrating an example of an authentication processing procedure performed between the IC card and the external device.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Card read / write device 2 ... IC card 3 ... Controller 101 ... Antenna part 102 ... Analog part 103 ... Digital control part 104 ... Memory 105 ... External interface

Claims (19)

An information management device for managing user data stored in a memory,
A communication control function unit that controls communication operation with an external device connected via a communication interface;
A stage management function unit for setting a stage in the life cycle of the information management device based on an external event detected through the communication interface or an internal state of the information management device itself;
A stage holding function unit for storing the stage set by the stage management function unit;
An access control function unit for controlling an access operation to user data stored in the memory according to a stage held in the stage holding function unit;
An information management apparatus comprising: As the communication interface, comprising a non-contact interface for performing non-contact communication based on a non-contact IC card interface protocol from a card read / write device as the external device,
The stage management function unit performs a stage transition in response to a request with authentication from the card read / write device.
The information management apparatus according to claim 1. As the communication interface, equipped with a wired interface that is wired with an information processing terminal as the external device that is mounted or externally connected with the information management device,
The stage management function unit performs a stage transition in response to a request with authentication from the information processing terminal.
The information management apparatus according to claim 1. The stage management function unit performs a stage transition in response to detecting a failure in the information management apparatus, an attack on user data stored in the memory, or other abnormality,
The information management apparatus according to claim 1. The stage management function unit sets a first stage in which user data stored in the memory can be used and a second stage in which user data stored in the memory cannot be used. ,
In the first stage, the access control function unit permits an external device through the communication interface to access user data stored in the memory through a predetermined authentication procedure. In the second stage, all access to the user data stored in the memory is not permitted to an external device through the communication interface.
The information management apparatus according to claim 1. The second stage includes a maintenance stage capable of correcting firmware for internal operation of the information management device.
The information management apparatus according to claim 5. The second stage includes a suspend stage for temporarily suspending use of user data stored in the memory when the information management device itself is repaired or an information processing terminal equipped with the information management device is repaired. ,
The information management apparatus according to claim 5. As the second stage, a dispose stage for ending use of the information management apparatus itself is provided.
The information management apparatus according to claim 5. The second stage includes a protection stage for stopping the use of user data stored in the memory when an abnormality occurs in the information management device.
The information management apparatus according to claim 5. An information management method for managing user data stored in a memory in an IC card,
A communication control step for controlling a communication operation with an external device connected via a communication interface;
A stage management step of setting a stage in the life cycle of the IC card based on an external event detected through the communication interface or an internal state of the IC card;
An access control step for controlling an access operation to user data stored in the memory according to the current stage set in the stage management step;
An information management method comprising: The communication interface includes a non-contact interface that performs non-contact communication based on a non-contact IC card interface protocol from a card read / write device as the external device,
In the stage management step, a stage transition is performed in response to a request with authentication from the card read / write device.
The information management method according to claim 10. The communication interface includes a wired interface that is wired with an information processing terminal as the external device that is mounted or externally connected with the IC card,
In the stage management step, a stage transition is performed in response to a request with authentication from the information processing terminal.
The information management method according to claim 10. In the stage management step, a stage transition is performed in response to detecting a failure in the IC card, an attack on user data stored in the memory, or other abnormality.
The information management method according to claim 10. In the stage management step, a first stage in which user data stored in the memory can be used and a second stage in which user data stored in the memory cannot be used are set,
In the access control step, an external device through the communication interface in the first stage is allowed to access user data stored in the memory through a predetermined authentication procedure. Does not allow all access to the user data stored in the memory to the external device through the communication interface in the stage of
The information management method according to claim 10. As the second stage, provided with a maintenance stage capable of correcting firmware for internal operation of the IC card,
The information management method according to claim 14. The second stage includes a suspend stage for temporarily suspending use of user data stored in the memory when repairing the IC card or repairing an information processing terminal equipped with the IC card.
The information management method according to claim 14. The second stage includes a dispose stage that terminates the use of the IC card.
The information management method according to claim 14. The second stage includes a protection stage for stopping the use of user data stored in the memory when an abnormality occurs in the IC card.
The information management method according to claim 14. A computer program written in a computer-readable format to execute processing for managing user data stored in a memory in an IC card on a computer system, the computer system
A communication control procedure for controlling a communication operation with an external device connected via a communication interface;
A stage management procedure for setting a stage in the life cycle of the IC card based on an external event detected through the communication interface or an internal state of the IC card;
An access control procedure for controlling an access operation to user data stored in the memory according to the current stage set in the stage management step;
A computer program for executing

Images