JPS62200442A - Ic card - Google Patents

Abstract

PURPOSE:To cope easily and softly with the variation of a combination of a first and a second security levels by providing a first access control means for controlling write and read out of a data, based on the contents of a collation executing flag part, and a second access control means for controlling only read-out. CONSTITUTION:The first secrecy attribute data designates to which one of the first - the m-th secrecy codes a collation is required in order to obtain a permission of both write and read-out. The second secrecy attribute data designates to which the collation is required in order to obtain a permission of only read-out, in write and read-out. Also, the first access permission deciding means refers to a collation executing flag part, and permits an access of both write and read-out to a data memory area, only when it is confirmed that a secrecy code of a classification designated by the first secrecy attribute data is executed as to the collation already. The second access permission deciding means permits an access of only read-out in the same way with regard to the second secrecy attribute data.

Description

Detailed Description of the Invention [Field of Industrial Application] The present invention relates to a storage means made of a non-volatile semiconductor memory such as a BP-ROM or an EEP-ROM, and data processing such as writing and reading data to the storage means. The present invention relates to an IC card equipped with a data processing control means comprising a microcomputer or the like for controlling the IC card.

(Prior Art) The IC card has advantages over conventional magnetic cards, such as a large data storage capacity and relatively easy data security management.

For example, JP-A-60-1666 and JP-A-59-7538.
In No. 0, a secret code pre-stored in a part of the storage means in the IC card and a verification code given to the IC card from the outside in correspondence with the secret code are stored in the IC card. An IC card is disclosed that is configured to perform a comparison using a predetermined method in a data processing control means, and permit access to a data memory area in a storage means only when a valid match is obtained as a result.

Also, Japanese Patent Publication No. 58-57785 and Japanese Patent Publication No. 59-7769
In No. 9, [the data memory area of the storage means in the C card is divided into a plurality of blocks, and for example, a block in which both writing and reading are prohibited, a block in which writing is prohibited but reading is permitted, An IC card has been disclosed in which the degree of data protection is changed for each block, such as a block that allows both writing and reading, and a block that prohibits erasure of memory.

[Problem that the invention seeks to solve]

Conventional IC cards such as those described above certainly have a large data storage capacity and are superior in data protection and security management when compared with magnetic cards. However, when we think about the various data that we actually want to store in an IC card, who or what kind of information is stored in the IC card?
There is a first security level in the sense of whether access is permitted to the C card terminal, and a second security level in the sense of how far access is permitted between writing and reading. The reality is that both the first and second security levels are not always uniquely determined based on the nature of the data.

In other words, in the case of an IC card for financial transactions, assuming that data is accessed through a combination of an IC card terminal in a formal system on the financial institution side and a legitimate cardholder, on the other hand, the first Considering the level of security of the IC card, at least one method is necessary to prevent unauthorized use of stolen or found IC cards, and to prevent data tampering (such as unauthorized data writing or modification) by unauthorized card access tools. It is necessary to authenticate both the validity of the card owner and the validity of the IC card terminal. In order to determine the authenticity of the device, it is necessary to set a host device secret code and check them. Considering the second security level, it is clear that in the above case, it is necessary to permit both reading and writing of data such as balances and transaction details.

However, on the other hand, for example, the same financial IC as above
Card holders are now able to read and confirm data stored on their cards, such as balances and transaction details, using IC card terminals installed in so-called home terminals installed in their homes. It is also proposed that In that case, considering the first security level, even if privacy protection is taken into account when allowing data reading, it is sufficient to determine the legitimacy of the cardholder based on the cardholder secret code. , even inside the IC card terminal inside the home terminal.
It is clear that it is not only unnecessary but also dangerous and inconvenient in terms of security that the secret code of the host device for determining the validity of the above-mentioned IC card terminal be somehow infiltrated. Also, if we consider the level of the second mo-utility in this case,
It is inconvenient to allow writing (including modification) of data to the IC card terminal in the home terminal, and it is clear that it is sufficient to only allow reading.

As mentioned above, even if we assume that the data in the IC card is the same, there is a type of secret code that must be verified to allow both writing and reading of data on one side, and the other side There is also a type of secret code that you want to check when you want to allow reading only, so the combination of the first and second security levels described above is
However, the reality is that conventional IC cards such as those mentioned above cannot flexibly deal with such diversity in security levels. It is.

In other words, it is generally assumed that even for data in the same block, it is necessary to change the first security level depending on the above-mentioned second security level. Therefore, in conventional IC cards, although it is possible to change the second security level for each block, when it comes to data within the same program, both the first and second security levels mentioned above are applied. It was only possible to deal with the situation at a fixed level, and it was impossible to flexibly deal with the various situations that could be expected under the actual usage conditions of the IC card.

An object of the present invention is to provide a new IC card that can easily and flexibly deal with changes in the combination of the first and second security levels as described above. More specifically, the present invention provides for data in the same block to be accessed in different types or different types depending on whether both write and read access is permitted or when only read access is permitted. The present invention provides an IC card in which verification of a secret code in a combination can be a condition for permission.

[Means for solving problems]

The configuration of the present invention for achieving the above object will be explained based on the functional block diagram of FIG.

The storage means includes a secret code memory area for storing a plurality of types of secret codes consisting of a first secret code to an mth secret code, a data memory area consisting of one or more blocks for storing information data, and a data memory area for storing information data. a first secret attribute memory area that stores first secret attribute data for specifying the type of secret code that needs to be verified in order to permit both writing and reading from the memory area; and the data memory. and a second secret attribute memory area for storing second secret attribute data for specifying the type of secret code that needs to be verified in order to permit only reading among writing and reading to the area. There is. Further, the data processing control means includes a verification determination means for determining verification between the verification target data given to the IC card from the outside in response to the secret code and the secret code, and a verification determination means that determines the verification between the verification target data given to the IC card from the outside in correspondence with the secret code, and A verification execution flag section for temporarily storing the type of the secret code, and a comparison of the contents of the verification execution flag section and the contents of the first secret attribute data, and the information stored in the data memory area. a first access permission determining means that determines permission for both writing and reading; and a first access permission determining means that determines permission for both writing and reading; A second access permission determination means is included for determining permission for only continuous reading out of writing and reading. In other words, the first secret attribute data is required to obtain permission for both writing and reading.
The second secret attribute data specifies which of the first to m-th secret codes requires verification, and the second secret attribute data is used to obtain permission for only reading out of writing and reading. This specifies which items need to be verified. Further, the first access permission determination means refers to the verification execution flag section and only when it is confirmed that verification has already been performed for the secret code of the type specified by the first secret attribute data, the data memory Allow both write and read access to the area,
The second access permission determination means refers to the verification execution flag section and only when it is confirmed that verification has already been performed for the secret code of the type specified by the second secret attribute data, the data memory area is Allow read-only access to. That is, the first secret attribute data memory area and the first access permission determination means constitute the first access permission control means, and the second secret attribute data memory area and the second access permission determination means constitute the first access permission determination means. constitutes the second access permission control means.

Note that data is transmitted and received between the IC card and the outside through a predetermined serial communication means.

〔Example〕

Embodiments of the present invention will be described below with reference to the drawings.

2 to 17 show an IC card according to one embodiment of the present invention.

Figure 2 is a block diagram showing the system configuration of the IC card and base unit, with (a) showing the IC card side and (b) showing the base unit (IC card terminal) side including the league writer function. .

The IC card 1 includes a CPU 2, a RAM 3 for temporary storage of data, etc., a ROM 4 for program storage, and an I10 board 5.
, a microcomputer section including a pass line 6, etc., and an EEP-ROM 7 as a storage means consisting of a nonvolatile semiconductor memory. In this embodiment, the EEP-ROM 7 is configured to write and read data by receiving address signals and control signals from the microcomputer section via the I10 port 5, and by exchanging data signals. Although, M
EEP-ROM7 consisting of NOS or FAMOS, etc.
It is also possible to configure the microcomputer section and the microcomputer section as one IC chip.

On the other hand, the base device 10 has a CPU II, a RAM 12, a V-RA
M (video RAM) 13, ROM 14, I10 boat 1
5, pass line 16, display controller 17, display section 1
8 and a keyboard 19.

A reset signal supply terminal tOa and a clock signal supply terminal 1 derived from a part of the I10 boat 15 of the main unit 10
0b and serial communication terminal 10C for transmission/reception are provided corresponding to reset terminal 1a, clock signal input terminal 1b, and serial communication terminal IC for transmission/reception on the IC card 1 side, respectively. is the main unit 1
In the state where the signal is set to 0, the corresponding terminals are connected to each other.

In addition to the above-mentioned terminals, the IC card 1 side and the base unit 10 side also have power supply terminals and power reception terminals.
In FIG. 2, all power supply related blocks and lines are omitted to simplify the diagram.

Next, FIG. 3 shows the EEP-RO installed as a storage means.
FIG. 3 is a map diagram showing a schematic memory area division state of M. FIG. The EEP-ROM 7 of this embodiment includes an open ID area 20 that can be read freely, and a secret code memory area 30 that is provided for storing a plurality of types of secret codes.
, a disaster flag area 40 provided for storing the number of consecutive verification failures, a card invalidation mark, etc., which will be described later, a file directory area 50, and a file area 60 provided as a data memory area. ing.

Note that the oven ID area 20 above is for card manufacturers,
This is a data area that stores public ID information indicating the card issuer, card owner, etc. Further, in this embodiment, the data memory area is divided into three blocks consisting of the first file to the third file.

Furthermore, FIG. 4 is a map diagram showing the details of the secret code memory area, and the secret code memory area 30 includes:
a card issuer ID code for verifying the card issuer; an owner ID code for verifying the card owner;
and a group for checking the card's effective distribution group, etc. [It is configured so that it can store three types of secret codes such as the D code, and the I/O of the memory contents related to this area.
All direct reading to the outside of the C card is prohibited. Note that the group ID code is used, for example, when a plurality of specific card issuers form a group that mutually accepts cards issued by other issuers.
It is a secret code shared by each base unit in the group to identify the group, and in that sense, it functions as a host device secret code to confirm the validity of the IC card terminal. be.

FIG. 5 is a map showing a first file directory area which is a part of the file directory area 50. As shown in FIG.

Each file directory area is composed of a file name area 51, a secret attribute memory area 52, a protect attribute memory area 53, and a file header start address 54. Such an individual file directory area is used for each of the data memory areas. They are provided independently from each other in correspondence with blocks (files).

FIG. 6 is a detailed diagram of the secret attribute memory area 52 consisting of 1 byte (8 bits), and this area basically has permission to write and read data to the corresponding file. A first secret attribute memory area that stores which type of secret code is required to be verified (hereinafter referred to as the first verification condition) in order to obtain the data; and a second secret attribute memory area that stores which type of secret code requires verification (hereinafter referred to as a second verification condition) in order to permit reading. That is, in FIG. 6, bits a, ~a0
is the first secret attribute memory area, and bits a7 to a
4 constitutes the second secret attribute memory area, and each bit has an independent meaning and can be set independently of each other.

In this embodiment, if the content of each bit is 0, it indicates that the corresponding secret code must be verified, and if the content is 1, verification is not necessary. It shows.

Therefore, for example, the contents of the secret attribute memory area 52 are D9.
H”, bits a2 and a are “O” for the first secret attribute memory area, so
The first verification condition indicates the necessity of verifying the owner ID code and the group ID code, and since only bit a2 of the second secret attribute memory area is 0'', the second The verification condition indicates the necessity of verifying only the owner ID code.

Furthermore, FIG. 7 is a detailed diagram of the protected attribute memory area 53, and this area contains information regarding the corresponding file.
This is an area that stores data (hereinafter referred to as physical protect attribute) that specifies whether writing, modifying, and deleting files are permitted or prohibited. For this area, the content of bit b0 is 0”
, the writing (addition) of new data in the corresponding file will be interrupted, and the contents of b+ will be "0".
If the data is corrected, bit b
If the content of 2 is "0", deletion of the file is prohibited.

Next, FIG. 8 is a map diagram showing the configuration of each file section.

First, each file has a file header area at the beginning, and this header area has a number of fields n.
, the number of first field bytes f0, the number of second field bytes ft...-nth field byte number f', the number of reserved records R1, and the file password FPW are stored and written by securing their respective memory areas. There is. Among the above, the structure of the file is determined by the number of fields n and the number of bytes of each field fl-..ffi, and the size of the file is determined by adding the number of reserved records R. Also file password F
PW is a secret code fixed to the file. For example, if there is a sub-issuer in addition to the main issuer of the card, the file password FPW should be used as a verification code to confirm the sub-issuer. is possible.

Furthermore, each record area has a 1-byte character area at the beginning of the record area, in which the first field data dl, the second field data dt, etc.
---Nth field data d, . . . Memory areas are formed. In addition, the file has records with the above structure, and the number of reserved records is R.
It is possible to memorize only That is, each file includes one or more sections called records, and each record (section) includes a record attribute area and one or more fields.

For example, if the record number and field number are specified, the number of fields n, the number of bytes of each field f1, etc.
It is clear that the corresponding address in the record area can also be determined by simple calculations based on the data defining the file structure consisting of -, f.

In this example, the record attribute area provided for each record is an area for indicating whether the record is in the state of data not written, data written, or data invalidated. The record attribute area of an unwritten record is FFH'', and if it has been written, it is OFH, and if the written data is invalidated, it is OOH. Here, data invalidation in this embodiment refers to invalidating data when, for example, there is a security problem in allowing data to be modified (rewritten or erased) even if data is written incorrectly. This means that it is marked with a no mark indicating that it is.

Next, FIGS. 9 to 17 are flowcharts corresponding to the main parts of the program in the ROM 4 of the IC card 1,
Data processing in this embodiment will be described below with reference to these figures.

First, FIG. 9 shows the main routine, in which the operation starts following a reset signal from the base unit 10, and proceeds to step M1 of receiving a command from the base unit 10.

Here, in step M2, the disabled flag area 40 of the EEP-ROM 7 is referred to, and if there is already a disabled flag and the card itself is invalidated, the process according to the received command is not performed. , the process proceeds to step M9 in which a message is sent back to the base unit 10 that the card is disabled, and the process ends.

On the other hand, if there is no disabled flag, the process proceeds to a processing step according to the content of the received command. That is, in the case of a secret code write command, the secret code write subroutine MIO is entered from step M3, and in the case of a verification request command, the verification subroutine Mll is entered from M4.
In the case of a file creation command, M5 goes to the file creation subroutine M12; in the case of a file oven command, M6 goes to the file oven subroutine M13; in the case of a file reference command, M7 goes to the file reference subroutine M14; If so, the process proceeds from M8 to the file deletion subroutine M15. Furthermore, when each of the above processes is completed and each subroutine returns, the main unit 10 returns to the start and waits for the next command from the main unit 10.
The main routine will be repeated until the power supply is cut off and the battery is discharged.

Next, FIG. 1O is a flowchart showing the secret code writing subroutine.

In the secret code writing process, first, if the command requests writing of the card issuer ID code, a step of checking from step A1 whether the card issuer ID has not been written or has already been written. Proceed to A5. If the data has already been written, a reply (hereinafter referred to as a negative response) is sent to the base unit 10 to reject the command processing, and then the process returns from the subroutine.

If the card ID code has not been written yet, the card ID code designated by the base unit 10 is written in A6, and then the process returns. That is, in this embodiment, the card issuer ID code is allowed to be written only once, and once written, it cannot be rewritten (changed).

On the other hand, in the case of a request to write a secret code other than the card issuer ID code, the process proceeds to step A2 in which it is checked from A1 whether a verification flag related to the card issuer ID is set, and if the verification flag is not set, the process proceeds to step A2. , a negative response is made at A7 and the process returns. Also, if the verification flag is set and the command requests writing of a group ID code,
Step A of writing the group ID code from A3
Proceed to step 8 and then return. Additionally the command is owner I
If the request is to write a D code,
4, the process proceeds to step A9 in which the owner ID code is written, and then returns.

FIG. 11 is a flowchart showing the verification subroutine.

Here, a secret code of a type that is determined to be verified from the master device 10 is first read from the secret code memory area 30 in step B1. The base unit IO corresponds to this read secret code and the specified type of secret code.
At 82, a comparison is performed based on a predetermined algorithm etc. with the comparison data sent from The process proceeds to step B3 in which the counter portion of the number counter corresponding to the secret code to be verified is incremented. Here, the contents of the counter section are 3
(in other words, the verification has failed three times in a row), the disaster flag area 40 is moved from B4.
After proceeding to step B5 in which a card disable flag is written to the CPU 10, the process returns to step B6 where the invalidation of the card is sent back to the main device 10 side. If the counter value is less than 3, the process proceeds to step B7 in which a negative response is made to the base unit 10, and then returns.

On the other hand, if the verification is successful, the process proceeds from step B2 to step B8 in which a verification execution flag corresponding to the type of secret code that was successfully verified is set in the verification execution flag section in the RAM 5, and then continues at step B9. After clearing the counter corresponding to the secret code to be verified in the verification failure count counter, return to the secret.

FIG. 12 is a flowchart showing the file creation subroutine.

In the file creation process, step C1 first refers to the file directory area 50 and checks whether there is a remaining space for the number of files to be created and whether there is enough remaining space in the file area 60 to create a new file.
Proceed to. If a file can be created here, base unit 1
According to the file name specification and file structure specification information sent from 0, the file directory area 50
After executing writing to the file in the file area 60 in step 02, the process jumps to the process after opening the designated file shown in FIG.

If it is already impossible to create a file, a negative response is made at C3 and the process returns.

In addition, in the case of a file creation command, in addition to the file name, the base unit 10 sends the field fin, the number of first field bytes fI...--------- the number of bytes of the nth field f, , , File structure specification information consisting of the number of reserved records R is sent, but before specifying these structures, the structure and size of the file are completely determined. Also file directory area 50
Regarding the file header start address 54, the file header start address is also calculated based on the information in the file directory area 50 of the file that has already been created and the information on a part of the file header. , which is also written when a new file is created.

Next, FIG. 13 is a flowchart showing the file open subroutine, which includes processing for obtaining permission for both writing and reading for a specified file (hereinafter referred to as file opening), and processing for obtaining permission for both writing and reading for a specified file. This includes the actual file operation processing after the specified file is opened (after the specified file is opened).

Regarding the process for opening a file, first, the secret attribute memory area 5 of the file specified in step Di is
Read the first secret attribute data from 2, and then RA from B2.
Refer to the verification execution flag in M'3. Here, in B3, the first matching condition specified in the first secret attribute data and the matching execution flag are compared, and if the first matching condition is not satisfied, a negative response is made in B4. After that, turn immediately.

On the other hand, if the first matching condition is satisfied, step D5 proceeds to processing after opening the specified file and receives a processing command for file operation from the base device 10.
Proceed to. If the processing command received here is a close command, the process after opening the file ends and returns from D6, and if it is any other command, proceed to the processing step according to the content of the received command. .

In other words, in the case of a secret attribute set command, step D7
Secret attribute writing subroutine D1 in FIG. 14, which will be described later.
Proceed to step 3, and in the case of a protected attribute set command, proceed to D8.
The process then proceeds to step D14 in which a process is executed to populate (including change) the protected attribute specified by the parent device 10 into the protected attribute memory area 53 of the file. Further, in the case of a file password cent command, the process proceeds from step D9 to step D15 in which a process is executed to write the file password designated from the parent device 10 into the file header area of the file.

Furthermore, in the case of a read command, the process proceeds to step D16 in which the DIO reads and transmits the record data of the record number specified from the parent [10], and in the case of a write command,
Write subroutine D17 in FIG. 15, which will be described later from Dll.
Proceed to. Further, in the case of a data invalidation command, the process proceeds from step D12 to step D18 in which an invalidation mark "OOH" is written in the record attribute area of the record number designated from the parent device 10.

It should be noted that when the processing corresponding to each of the above commands is completed, the file operation process can be repeated until the close command is received from the base unit 10, such as waiting for the next command from the base unit 10 again. There is.

As described above, in this embodiment, a set of secret attributes and protect attributes, a set of file passwords, etc. that have an important relationship with security and physical protection are
Settings (changes) must be made after opening the file.
It is configured so that it is not possible. In other words, each file operation process can only be executed on a specified file that is open, but as an exception, even when creating a new file as mentioned above, a special processing routine after opening the specified file is executed. Since the file jumps, in that case, it is possible to perform the same processing as after opening the created file as described above. This is because creating a new file also means accessing the created file for the first time, so there is no need to open the file anew to allow file operations. .

FIG. 14 is a flowchart showing the secret attribute writing subroutine.

Here, first, in step E1, the secret code memory area 30 and the file password area of the file header are referred to, and the type of verification required for the secret attribute data sent from the base unit 10 is performed. The E2 checks whether the secret code (including the file password) has already been written, and if it has been written, the secret attribute data sent from the base unit 10 is stored in the secret attribute memory of the file directory 50. After proceeding to step E3 in which data is written in the area 52 (including changes), the process returns. If the corresponding secret code has not been written yet, it is impossible to make a verification judgment based on the secret attribute data, so a negative response is made in E5 to reject the secret attribute data writing process, and then the process returns. .

FIG. 15 is a flowchart showing the write subroutine.

First, in step Fl, the protected attribute is read from the protected attribute memory area 53 of the file,
If the bit I'bo is 0'' and there is write protection, all new record data will be prohibited from being written even if the file is open, so in step F7 of the negative response. Go ahead and return.

Also, if write protection is not set, F
3, the record attribute of the record number specified for writing from the base device 10 is referred to. Here, if the specified record attribute is "FFH" and the record has not been written yet, the main device 10 writes the specified record to the specified record from F4.
After proceeding to step F9 to write the data sent from , an attribute setting is performed to write "OFH" as a mark indicating that the data has been written in the specified record attribute area in the FIO, and then the process returns.

On the other hand, if the record has already been written, it is checked in F5 whether the record attribute is "OOH" and an invalidation mark has been attached to the record.

If there is no invalidation mark, this indicates that the record still stores valid data, so a negative response is made at F7 to refuse writing data there, and the process returns.

If there is an invalidation mark, it is checked in F6 whether or not modification protection is set among the protection attributes. Here, if the protect attribute bin) b+ is 0" and there is modification protection, return after making the same negative response (rejecting data writing with F7). Also, if there is no modification protection, After erasing the data already written in the specified record in step F8 (converting the specified record area to "FFH"), proceed to step F9 where data is written to the specified record, and then write the specified record attribute area in FIO. After setting the attribute to write "OFH" as a mark indicating that the data has been written to, the process returns.

Regarding the protected attributes mentioned above, as can be seen from the fact that an operator who is qualified to open a file can freely change the protected attributes, the protected attributes themselves do not allow the file to be opened. This function is provided to prevent erroneous operations by qualified personnel.

Next, FIG. 16 is a flowchart showing a file reference subroutine, in which writing to a specified file is unconditionally prohibited while reading is permitted (hereinafter referred to as read-only open for file reference). ), and the actual processing of subsequent access after the specified file is opened read-only.

Regarding the process for read-only opening, first, in step G1, the second secret attribute data is read from the secret attribute area 53 of the file specified from the base device 10, and further, in G2, the verification execution flag in the RAM 3 is referred to. Here, in 03, the second secret attribute data specified in the second secret attribute data is
The comparison condition is compared with the comparison execution flag, and if the second comparison condition is not satisfied, a negative response is made in G4, and then the process immediately returns.

On the other hand, if the second matching condition is satisfied, the process proceeds to a process after read-only opening of the specified file, and proceeds to step G5 in which a process command from the base device 10 is received. If the processing command received here is a close command, the processing after the read-only open from G6 ends and returns.

Also, if the received processing command is a read command, C
After proceeding from Step 7 to step G8 in which the record data of the designated record number is read and transmitted from the base device 10, the process returns to step G5 in which a processing command is received from the base device 10 again. If the received command is neither a close command nor a read command, a negative response is made at G4, the process after read-only open is completed, and the process returns.

FIG. 17 is a flowchart showing the file deletion subroutine.

In this case, first, in step H1, the protect attribute of the file specified from the parent device 10 is referred to from the protect attribute memory area 53. If bit bt is “0” and there is file deletion protection, H
Returns after making a negative response in step 5. In addition, if there is no file deletion protection, refer to the file directory area 50 and check whether the file in question is the last file actually created in the file area 60. Check in step H3. If the file in question was created at the end, it is possible to create a file with a new structure in the area after completely erasing the file, so first, in step H6, the specified file is deleted. Delete directory area 50 and header area (area “FF
H"), deletes the record area of the specified file in H4 (converts all record areas including the record attribute area to "FFH"), and then returns. In other words, in this case, the file directory area and file It is possible to write new file structure specification data, etc. to the Noder area, so when creating a new file next time, the area after deletion is used in exactly the same way as an unused file area. Is possible.

On the other hand, if the relevant file is not the last file created, a file has already been created in the subsequent file area, and the area of the relevant file cannot necessarily be used freely (for example, if the file is large (If you try to create a file, the area will overlap with the subsequent file area), so in step H4, all record areas of the specified file are deleted without deleting the file directory area and file area. Returns after erasing.

In other words, in this case, data that defines the file structure remains in the directory area and header area of the file, so it is not possible to create a file with a completely new structure in the file area after this process. However, it is possible to write and store record data again as a file with exactly the same structure as the original file.

〔Effect of the invention〕

As described above, according to the present invention, there is a secret code memory area that stores a plurality of types of secret codes, a verification execution flag section that temporarily stores the types of secret codes that have been successfully verified, and the verification execution flag. a first access control means that controls permission for both writing and reading of data based on the contents of the section; By providing a second access control means that controls permission for only access to the It becomes possible to set verification of secret codes of different types or combinations of mutually different types as a permission condition. As a result, even when configuring a system that reads financial IC cards using a home terminal, for example, the overall security of the IC card becomes vulnerable due to the presence of the home terminal. is prevented.

Note that the verification execution flag section does not necessarily need to be provided in the RAM, but may be provided in an EEP-ROM for data memory, for example.
It is also possible to configure the memory contents to be provided in a part of the card and to clear the stored contents each time processing for one card is completed.

Further, it is not necessarily necessary to provide the first and second secret attribute storage sections in the storage means including the data memory area; for example, the first and second secret attribute storage sections in the above-mentioned embodiments may be provided depending on the configuration of the microcomputer program in the ROM itself. It is also possible to substitute the role of the second secret attribute storage section.

Furthermore, when dividing the data memory area into multiple blocks, this embodiment adopts a file structure that takes flexibility into account. It is clear that the blocks may have a fixed common configuration.

[Brief explanation of drawings]

1 to 17 show an IC card according to an embodiment of the present invention, FIG. 1 is a functional block diagram, and FIG.
) and (b) are block diagrams showing the system configurations of the IC card side and the base device side, respectively. Figure 3 is a map diagram showing the memory area of the EEP-ROM, Figure 4 is a map diagram of the secret code memory area, Figure 5 is a map diagram showing the file directory area, and Figures 6 and 7 are the secret attribute memory. FIG. 8 is a detailed diagram of the area and the protected attribute memory area, and FIG. 8 is a map diagram showing the file area. 9 to 17 are flowcharts of main parts of the microcomputer program in the IC card.
Figure 10 shows the secret code writing subroutine, Figure 11 shows the verification subroutine, Figure 12 shows the file creation subroutine, Figure 13 shows the file reference subroutine, and Figure 17 shows the file deletion subroutine. Flowchart diagrams respectively shown. l-・-・-・IC card, 4-・-・ROM, 5-・
-...-I10 boat? ------・EIF, P-
ROM, 10・-～---・Main unit, IC110c・・
- Serial communication terminal, 30 - Secret code memory area, 31 - Card issuer ID code memory area, 32 - Owner ID code memory area, 33 - - ...Group ID code memory area, 40--Disease flag area, 5
0-・-・-File directory area, 52-・-
---Secret attribute memory area, 60-----File area. Fig. 2 Fig. 6 Fig. 7”--7y volume L right protection π; 8 Fig. TS ! J a 11! Fig. 16 Fig. 17

Claims (2)

[Claims] (1) An IC card having a storage means made of a non-volatile semiconductor memory and a data processing control means for controlling access such as writing and reading of data stored in the storage means, wherein the storage means has a plurality of types. a secret code memory area for storing a secret code; and a data memory area consisting of one or more blocks; a verification execution flag section; a first access permission control means for controlling permission for both data writing and reading of the block based on the contents of the verification execution flag section; An IC card comprising: second access permission control means for controlling permission for only data reading out of data writing and reading of the block. (2) The first access permission control means stores a first secret attribute that stores secret attribute data for specifying the type of secret code that needs to be verified in order to permit both data writing and reading of the block. a storage unit; and a first access permission determination unit that determines whether or not access is permitted based on a comparison between the contents of the first secret attribute storage unit and the contents of the matching execution flag unit; The control means includes a second secret attribute storage section that stores secret attribute data for specifying the type of secret code that needs to be verified in order to permit only reading out of data writing and reading of the block;
a second access permission determination means for determining whether or not access is permitted based on a comparison between the contents of the secret attribute storage section and the contents of the verification execution flag section, and the first and second secret attribute storage sections. 2. The IC card according to claim 1, wherein is provided in a part of storage means made of a non-volatile semiconductor memory.