JPH03147086A - Ic card - Google Patents

Abstract

PURPOSE:To prevent malfunction occurring by providing an inspection program to inspect the content of a processing program stored in an electrically erasable nonvolatile memory at an electrically unerasable nonvolatile memory, and inspecting it when the processing program is executed. CONSTITUTION:It is judged whether or not the start-up of the processing program is performed with an inspection and start-up program 32 stored in a ROM 3. Then, the validity of the processing program i.e. the fact that no part or all the processing programs 63 written on the electrically erasable nonvolatile memory 6 are lost is confirmed just before the processing program 63 written on the electrically erasable nonvolatile memory 6 is started up. Thereby, it is possible to evade implementing an abnormal program with a CPU 10.

Description

[Detailed Description of the Invention] [Industrial Application Field] The present invention relates to an IC card.
The present invention relates to an IC card capable of preventing malfunctions of an arithmetic processing unit (hereinafter referred to as CPU) due to execution of a downloaded processing program in an IC card for downloading a processing program.

[Prior Art] Conventionally, as this type of IC card, for example,
Publication No. 211788 can be cited, which discloses that an electrically erasable nonvolatile memory (e.g., EEPROM) is provided for storing processing programs in order to load various processing programs on an IC card depending on the application. By downloading the IC card, a processing program suitable for the application is stored therein, thereby ensuring the versatility of the IC card.

In this case, storing the processing program in a non-volatile memory that can be electrically erased, such as an EEPROM, is because the backup battery is indestructible, unlike RAM, etc.
This is because, unlike in RAM, the contents of the stored processing program are difficult to change by t'F due to voltage fluctuations in the power supply or the like or in the =1 operation of the CPU.

[Problem to be solved] However, in the case of IC cards, the CPU's 17. Not only due to operation, but also due to defects in electrically erasable non-volatile memory elements, or failures from external devices to the IC card! The EEPROM can be
Some or all of the processing programs installed in the computer may be replaced or lost. In such a case, the processing program of EEPROM1- is transferred to the CPU.
When executed, it malfunctions and the i stored in the IC card
'Rfi data, such as transaction information such as passwords and balances, may be destroyed.

The present invention solves the problems of the prior art as described above, and is designed to prevent part or all of the processing program stored in the electrically erasable non-volatile memory 1-) from being lost. The objective is to provide an IC card that can prevent the execution of the program when the program is executed.

[R stages for solving the problem] The structure of the IC card of the present invention to achieve the first objective is as follows: an electrically erasable first nonvolatile memory in which a processing program executed by the CPU is stored;
The inspection program is controlled by the CPU and includes an input/output stage for exchanging data with the outside, and the inspection program for inspecting whether the contents of the processing program stored in the second nonvolatile memory is correct is the first nonvolatile memory. When the processing program stored in the memory and stored in the second non-volatile memory is started, the CPU executes the inspection program to check whether it is correct or not, and when it is determined that the 1F is correct. This starts the processing program.

[Operation: In this way, an inspection program is provided to inspect the contents of the processing log stored in the electrically erasable non-volatile memory Jl-, which cannot be electrically erased. Since the processing program is checked when it is executed, malfunctions are less likely to occur even if the processing program is executed in the electrically erasable non-volatile memory.

In addition, non-volatile memory IJL that can be electrically erased +1J
If part or all of the loaded processing program is lost, this will be detected, and in such a case the processing program will not be executed, so malfunctions caused by this will be avoided. This unity reduces the risk of data being destroyed and improves reliability.

[Example Code] An example of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram showing the internal configuration of an embodiment of the IC card of the present invention, FIG. 2 is a memory map diagram of the EEPROM shown in FIG. 1, and FIG. 3 is an explanatory diagram of its processing. .

In FIG. 1, an IC card 10 is attached to an IC card reader/writer 11 (or a host computer or a terminal device may be used directly).
Data is exchanged between the Although the configuration shown in the figure is an MPU 1 block, an EEPROM 6i, and two blocks (f7), these may be two chips or may be combined into one chip depending on the block.

MPUI has a microprocessor (CPU) inside it.
2, its control program, a basic processing program common to each IC card regardless of its purpose, etc.
For example, when downloading a communication control program or -)
A mask ROM (hereinafter referred to as a ROM) 3 which stores a startup program for starting an input processing program and an application processing program, a RAM 4, and an interface (one stage of input/output to an external device) 5 are provided. according to the program stored in ROM3.
The processing program (predetermined operation program) stored in the PROM 6 is activated and executed to perform predetermined processing. Incidentally, the part of the program stored in the ROM 3 may be stored in the EEPROMB.

The RAM 4 is a memory in which data transferred from an external device, read data, processing result data, etc. are temporarily stored, and may be an EEPROM.

The EEPROMB is a storage area 6 that stores processing programs 63 such as processing programs other than basic processing programs and application programs corresponding to specific uses.
It is downloaded here from a host computer, a terminal device (not shown), etc. via the IC card reader/writer 11. Therefore, ROM3
The downloaded write processing program 31 for that purpose and the downloaded location [11! A test/startup program 32 that checks whether the program content is 1[: normal or not and starts if IF is normal is stored.

In this example, signal lines (signal terminals) such as a data bus, address bus, and control bus are provided between the MPUI and the EEPROM 6, and are connected to the EEPROM 6. If the and MPUI are configured on one chip, it will be inside the MPUI.

In addition to a processing program area 6a in which the downloaded processing program 63 is stored, the EEPROM 6 has a check information storage area 8b1 for program checking.
This is based on the password storage area (ID) 61 and program inspection for checking the PIN number etc. inside the C card. A flag area 62 is provided for managing the number of Zl slips and the like.

Here, the processing program 63 stored in the processing program area 6a includes, for example, -) loading and reading of data in the RAM 4, and password input from a terminal. ! (
A program for causing the CPU 2 to perform the first match and the like is stored. Further, the check information stored in the check information storage area 6b is the SUM value for the data stored in the processing program area 6a. To explain this relationship according to the memory map in FIG. 2, from the address (AAAA) of the processing program area 6a to the address (
Calculate the total value of each byte of data stored in each address of BBBB), and store the 1-byte value of the total value of all data values in this area in the address (CCCC) of the check information storage area 6b. do. Note that the 1-byte value of this total value stored here is determined by the processing program 63.
is generated and stored by the inspection/startup program 32 when it is downloaded to the processing program area 6a, but this is because it receives such a SUM value during download from the host computer and stores it here. You can. That is, the δ-inclusive processing program 31 starts the inspection-startup program 32 after downloading the processing program 63 to the processing program area 6a. The inspection/startup program 32 uses the information of the processing program 62 as data in the memory map (AAAA) shown in FIG.
Data is sequentially read out at addresses ψ from BBBB to (BBBB), and the data is sequentially added in the address direction to obtain one byte of the resultant value, which is stored in the check information storage area 6b.

Further, when there are a plurality of processing programs 63, these SUM values may be calculated for each processing program to be started, or may be a total value of all the processing programs as described above.

In the former case, the area of the check information storage area 6b is
It is necessary to have a sufficient number of bytes to store the SUM value corresponding to the number of processing programs. In this case, since the SUM value is stored in units of 1 byte, the number of bytes ccccc By counting the number of addresses from 111 to 11, it can be determined whether the address belongs to the 11th processing program.

The normal processing operation of the IC card 10 having such a configuration will be explained with reference to FIG. After the internal circuit of the card 10 is reduced to its initial state, the CPU 2 starts the inspection 0 starting program 32, and the EEPRO
It is determined whether or not to execute the M8 processing program 63 (step 101). Note that when downloading and writing an arbitrary processing program 63 into the EEPROM 6 from the outside, the SF is written by activating the three-component processing program 31 using a command and transferring the processing program 63 from the outside.

If YES here, then the inspection/startup program 32 verifies the validity of the processing program 63 using the 80M method (step 102). That is,
In the same way as when the inspection/startup program 32 calculated the SUM value to be stored in the check information storage area 61),
Processing program 8 stored in processing program area 6a
2's t74 N is read out sequentially as data in address units, and the data is sequentially added in the address direction to obtain 1 byte of the resultant value, which is used as a check that was previously stored when downloading the processing program 63. The processing program 63 is started only when it is compared with the 5I incorrect SUM value in the information storage area 6b and -. At this time, based on this coincidence, the inspection/startup program 32 determines that the processing program 63 is valid (or normal) (part or all of the program information is not lost at all).

- On the other hand, if the above comparison result is negative, part or all of the processing program 63 is lost, and it is determined that there is an abnormality in the program, and the processing program 63 is not started and an error occurs. Processing (step 103) is performed, and the processing program is started for 11 degrees. In this case, the operation of the IC card can be stopped if necessary. If the comparison results do not match, the inspection/startup program 32 uses 1z&revision II: code as an error process, makes the lost processing program 63 a litter, returns to step 101, and +I! After recovery, the processing program 63 can be activated and executed (step 104) by carrying out the same processing as in step 102 (step 104).

When performing the above-mentioned error correction, one error code is added to the processing program 63 itself, and an error correction processing program is provided inside the inspection O startup program 32 or separately, or an error correction circuit is provided to correct the error in the processing program. 63 to ++T and 14 to the processing program area 6a.
It is something to write.

In addition, in the process 1- below, if the result is No in step 101, the process returns to step 101 and becomes a standby state so that the next command can be received, or the same process is repeated and the same process continues. Do the same thing multiple times,
For example, when an error occurs three times and the process returns to step 101, the error management flag 61 can be set to stop the operation. Further, when the answer is YES in step 102, the processing program 63 is executed (step 104).

In this way, it is determined whether or not to start the processing program 63 based on the test pot starting program 32 stored in the ROM 3, and immediately before starting the processing program stored in the electrically erasable non-volatile memory. Validity of processing program, i.e. non-volatile memory that can be electrically erased
Since it is confirmed that part or all of the processing program loaded in J and -L is not lost, it is possible to prevent the CPU 10 from executing a program with an abnormality.

As explained above, the force formula for determining the iE validity of the processing program by the inspection/startup program 32 may use the SUM check using pari-day pits in the vertical and horizontal directions in the memory map 1- of FIG. . Furthermore, the SUM value in the embodiment may be the total value itself instead of using l bytes. Furthermore, checking for abnormalities in the processing program is not limited to the SUM check method, and other error detection methods may be used.

Any method may be used as long as it can determine that part or all of the processing program has been lost.

In addition, the startup program that determines the +E validity of the processing program is stored in the ROM3j-, which is a non-volatile memory that cannot be erased.
There is no 2 value stored in 71'1, but it is also possible to store it in EEPROM 61-, which is a non-volatile memory that can be erased electrically.

Furthermore, if the startup program determines that part or all of the processing program has been lost, the order of processing may of course be such that other processing is performed after error processing or without error processing. be.

[Effects of the Invention] As can be understood from the explanation in 1 below, in this invention, the processing program stored in the nonvolatile memory that cannot be electrically erased + 1J is An inspection program for inspecting the contents is provided, and it is inspected when the processing program is executed, so that electrically erasable non-volatile memory 1
Even if the processing program - is executed, malfunctions are less likely to occur.

In addition, electrically erasable 11J non-volatile memory 1-8
If part or all of the installed processing program is lost, this will be detected, and since the processing program will not be executed in such a case, malfunctions due to this will be avoided. As a result, the risk of data corruption is reduced and reliability is improved.

4. Final Explanation of the Drawings Figure 1 is a block diagram showing the internal configuration of an embodiment of the IC card of the present invention, and Figure 2 is the EEPROM of Figure 1.
The memory map diagram of FIG. 3 is an explanatory diagram of the processing.

■... Arithmetic processing unit (MPU), 2... Microprocessor (CPU), 3... ROM, 4... RA
M, 5...Interface, 6...EEPROM1
6a... Processing program storage area, 6b... SUM value storage area, 10... IC card, 11... IC card reader.
Writer, 31...AF-inclusive processing program, 32...
・Inspection/startup program, 61...Password storage area (ID), 62.
... Flag area, 63... Processing program.

Claims (2)

[Claims] (1) An arithmetic processing unit, an electrically non-erasable first non-volatile memory in which a processing program executed by the arithmetic processing unit is stored, and an electrical unit in which a processing program executed by the arithmetic processing unit is stored. a second non-volatile memory that can be erased automatically; and an input/output means that is controlled by the arithmetic processing unit and exchanges data with the outside; An inspection program for inspecting whether the An IC card characterized by inspecting whether or not it is correct and activating its processing program when it is determined to be correct. (2) The writing program that writes the processing program to the second non-volatile memory by downloading is further stored in the first non-volatile memory, and the inspection program performs checks necessary for inspection in the second non-volatile memory. 2. The IC card according to claim 1, wherein information is stored.