WO2007125594A1

WO2007125594A1 - Communication terminal and access method

Info

Publication number: WO2007125594A1
Application number: PCT/JP2006/308969
Authority: WO
Inventors: Jun Anzai
Original assignee: Panasonic Corporation
Priority date: 2006-04-28
Filing date: 2006-04-28
Publication date: 2007-11-08
Also published as: JP4827919B2; JPWO2007125594A1

Abstract

A communication terminal and an access method, in which overhead in an access to a secure area controlled by an IC card can be reduced. The communication terminal comprises a handle acquiring section (105) for previously acquiring the handle of the secure area to be accessed under control by the IC card (200) upon opening of the card application of the IC card (200), an access table (101) for storing the handle acquired by the handle acquiring section (105), and an access means for accessing the secure area by using the handle of the secure area stored in the access table (101) when accessing the secure area.

Description

Specification

Communication terminal device and access method

Technical field

The present invention relates to a communication terminal apparatus and an access method for accessing a secure area managed by an IC card using a handle acquired from a card application of the IC card.

Background art

Conventionally, there has been provided an IC card capable of storing data while ensuring high security.

[0003] This kind of IC card is expected as a key device for realizing a secure ubiquitous network society where the device business, the equipment business, the service solution business, etc. will be expanded to a total.

An access-controllable memory area (hereinafter, this area is referred to as a “secure area”) managed by an IC card from a communication terminal device such as a mobile phone or PC (Personal Computer), which is a host, will be described. Methods include a method using a handle (pointer) which is a variable or an argument indicating a memory area, and a method using card information such as the type and usage status of an IC card.

In such conventional access method, when the host accesses the card application of the IC card,

(1) Card application select (processing to select one of a plurality of applications built in the IC card).

(2) Card application open (connection open process).

(3) Access request and authentication of the host (input process such as PIN).

(4) Permit access to a specific host that has passed authentication (processing for access from the host to the card application of the IC card).

Require complicated procedures such as

For this reason, in the conventional access method, from the host to the card application of the IC card There was a problem that time was hard to access.

In particular, since the conventional general IC card has a slow communication speed of 9600 dps, there is a problem that the time taken to access the card application is further increased.

Therefore, the present applicant separates the command for specifying the access area of the host (terminal) power IC card and the command for accessing, and includes host verification data in the argument of the command for accessing. Propose an access method to transmit data (see Patent Document 1).

In this access method, host verification data is included in the argument of the command for accessing the secure area. Therefore, the host application for which the access area is specified and the host for issuing the command for accessing the secure area The IC card can verify that the application and the host application with the right to access the secure area are identical.

[0010] In this access method, since the command specifying the access area and the command to access are separated, memory access is less while avoiding command complexity using conventional commands. Even with command arguments, it is possible to access the secure area without reducing security.

In addition, the present applicant has proposed an access method for high-speed SSL access by reading and caching a certificate used for SSL (Secure Socket Layer) from an IC card in advance (see Patent Document 2). ).

[0012] In this access method, since it is possible to send and receive digital certificates between the host and the IC card to the minimum number of times necessary, an authentication channel (Secure Authenticated) between the server and the IC card can be obtained. It is possible to shorten the time taken to establish the “Channel” and improve the user convenience.

Patent Document 1: Japanese Patent Application Laid-Open No. 2005-50320

Patent Document 2: Japanese Patent Application Laid-Open No. 2005-236505

Disclosure of the invention

Problem that invention tries to solve

[0013] Meanwhile, in Patent Document 1, "an acceleration method in which a handle is not dynamically allocated but fixed and shared with a host", and "a state in which multiple files can be accessed simultaneously is created. “Force” indicated by “method” In these methods, it is difficult to reduce the load (overhead) imposed on the entire system when acquiring a handle when allocating handles dynamically.

That is, when the handle is fixed, the communication path between the host and the IC card is in a 1: 1 relationship, so that multiple files can be accessed simultaneously by establishing multiple connections simultaneously. It becomes 會.

[0015] Further, in Patent Document 2, the method for pre-reading digital certificates from an IC card is described. It is difficult to apply this method when pre-reading a handle of a dynamically allocated secure area. It becomes.

That is, when the handle is fixed, the handle information can be prefetched without much problem, but when the handle is dynamically assigned, the handle changes every time the host accesses. It is practically impossible to pre-read all the information.

An object of the present invention is to provide a communication terminal apparatus and an access method capable of reducing an overhead when accessing a secure area managed by an IC card. Means to solve the problem

[0018] The communication terminal device of the present invention comprises: a handle acquiring means for acquiring in advance a handle of a secure area to be accessed which is managed by the IC card when the IC card card application is opened; A configuration comprising: an access table for storing a handle; and access means for accessing the secure area using the handle of the secure area stored in the access table when accessing the secure area. Take

Effect of the invention

According to the present invention, since it is not necessary to acquire a handle each time when accessing a secure area of an IC card, overhead at the time of access can be reduced, and the communication terminal capacity is also secure for the IC card. High-speed access to the area is possible.

Brief description of the drawings

FIG. 1 is a schematic cross-sectional view showing a configuration of a communication terminal apparatus according to an embodiment of the present invention. [FIG. 2] A sequence diagram showing an outline of the operation of a portable terminal as a communication terminal apparatus and an IC card according to an embodiment of the present invention.

[FIG. 3] A block diagram for explaining the operation of a portable terminal as a communication terminal apparatus and an IC card according to an embodiment of the present invention.

[FIG. 4] A flow chart showing the operation of a portable terminal as a communication terminal apparatus according to an embodiment of the present invention

[FIG. 5] A flowchart showing the details of the access table creation routine in FIG.

[FIG. 6] A flow chart showing the details of the access table update routine in FIG. 4 Best mode for carrying out the invention

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a schematic cross-sectional view showing a configuration of a communication terminal apparatus according to an embodiment of the present invention.

As shown in FIG. 1, a portable terminal 100 as a communication terminal apparatus such as a mobile phone or PC as a host includes an access table 101, an access table creating unit 102, a table data updating unit 103, and an access count determination. A section 104, a handle acquisition section 105, a data input / output section 106, a host application 107, a card information determination section 108, a card information acquisition section 109, an IC card I ZF 110, and a CPU 111 are provided.

In FIG. 1, an IC card 200 is mounted on the portable terminal 100.

The access table 101 of the portable terminal 100 holds card information such as the number of card applications scheduled to be accessed by the IC card 200 and the number of accesses to the card application of the IC card 200.

The access table creation unit 102 creates the access table 101 based on card information such as the handle of the card application and the number of accesses.

The table data updating unit 103 transmits table data to be updated to the access table creation unit 102 when updating table data of the access table 101.

The access number determination unit 104 determines whether or not the number of accesses to the card application of the IC card 200 has reached a predetermined number.

When the handle acquisition unit 105 opens the card application of the IC card 200, Get all the handles of all the areas to be accessed.

Data input / output unit 106 includes character data and image data such as a host application 107 of portable terminal 100, a card application of IC card 200, and a server (not shown) connected to an external network such as the Internet. It outputs voice data, etc., and inputs text data, image data, voice data, etc. to the IC card 200 or a server.

The host application 107 is a program for operating various functions of the mobile terminal 100.

The card information determination unit 108 determines the presence / absence of a card abdication that the number of accesses exceeds a predetermined number based on the mounting information of the IC card 200, ie, the card information acquired by the card information acquisition unit 109, and the expiration date To determine the presence of sandals that have passed.

The card information acquisition unit 109 acquires card information such as the number of times of access to a card application of the IC card 200 and a handle, and transmits the acquired card information to the card information determination unit 108.

The IC card IZF 110 is a card interface that processes input and output signals to and from the IC card 200.

The CPU 111 controls the operation of each unit described above and performs arithmetic processing of input / output signals.

The IC card 200 mounted on the portable terminal 100 of this example includes a controller unit 201, an IC card unit 202, and a flash memory unit 203.

The controller unit 201 exchanges signals with the IC card IZF 110 of the portable terminal 100, and controls the operations of the IC card unit 202 and the flash memory unit 203.

The IC card unit 202 adopts FeRAM as a non-volatile memory, and can realize high-speed non-contact communication. FeRAM is a type of non-volatile memory that uses ferroelectrics, and compared to general non-volatile memory such as flash memory and EEPROM.

, High-speed write and high-speed rewrite frequency can be obtained with low power consumption.

[0039] In the flash memory unit 203, a part of the area is encrypted by the key in the IC card unit 202, and it is possible to store large-capacity content and application software while securing high security. It becomes. Also, the IC card 200 can freely set the flash memory unit 203 as a secure area. The capacity that can be used as this secure area can be freely set within the capacity of the flash memory unit 203.

In addition, by executing key management and encryption in the IC card unit 202, the IC card 200 realizes high confidentiality and, at the same time, realizes a data transfer rate of approximately 600 KBytZ at the time of reading and writing, It is possible to provide functions suitable for applications such as confidential information protection.

Next, operations of the portable terminal 100 and the IC card 200 of this example will be described. FIG. 2 is a sequence diagram for explaining the operation of a portable terminal as a communication terminal apparatus and an IC card according to an embodiment of the present invention. FIG. 3 is a block diagram for explaining the operation of a portable terminal as a communication terminal apparatus according to an embodiment of the present invention and an IC card.

As shown in FIG. 2, when the mobile terminal 100 as a host directly accesses the security area managed by the IC card 200, the card information acquisition unit 109 of the mobile terminal 100 sends a command to the IC power card 200. Request to send card information such as the mounting information of the card Ver and the maker of the product (step ST201).

In response to the request in this step ST201, the IC card 200 sends card information such as the requested information of the card Ver, the manufacturer of the product, etc. to the portable terminal 100 (step ST202).

Thereby, as shown in FIG. 3, the portable terminal 100 holds the card information 301 such as the mounting information of the card Ver, the maker of the product, and the like.

Next, from the card information (implementation information) 301 acquired from the IC card 200 by the card information acquisition unit 109, the portable terminal 100 can realize high-speed installation of the IC card 200 or high-speed trouble The card information determination unit 108 determines whether the

Here, if it is determined that the IC card 200 can be mounted at high speed (step ST 203), the handle acquisition unit 105 of the portable terminal 100 sends a handle of the access scheduled area to the IC card 200. Request (step ST204).

When it is determined that the IC card 200 is difficult to mount at high speed, access processing from the portable terminal 100 to the secure area managed by the IC card 200 is stopped, and the data input / output unit 106 is notified of that. It displays on the display (not shown) which is the display means of. When IC card 200 receives a handle request of the access scheduled area (step ST 204) from handle acquisition section 105 of portable terminal 100, the handle of the requested access scheduled area (A,

B, · · · to the mobile terminal 100 (step ST205).

The portable terminal 100 transmits the handle of the access scheduled area sent from the IC card 200 to the access table creation unit 102 to create the access table 101 (step ST

206).

Thereby, as shown in FIG. 3, the handle of the access scheduled area of the IC card 200 is stored in the access table 101 of the portable terminal 100. At this time, the access table 101 also stores how many times the portable terminal 100 has accessed an address and the number of accesses as information.

Next, in the portable terminal 100 of this example, the handle of the expiration date is updated according to the mounting of the IC card 200 (step ST207).

In this step ST207, as a result of the card information judgment unit 108 judging the card information acquired by the card information acquisition unit 109 of the portable terminal 100, if there is an expired handle (B), the handle acquisition unit 105 requests the IC card 200 to send an expired handle (B) (step ST208).

In response to the handle request from portable terminal 100, IC card 200 sends the requested expired handle (B) (step ST209).

The portable terminal 100 sends the handle (B) that the handle acquisition unit 105 reacquired from the IC card 200 to the table data update unit 103, and the access table creation unit 102 handles the expired handle of the access table 101 ( B) Update. Here, in addition to the renewal of the expired handle (B), it is possible to renew the steering wheel which has been cut by a predetermined time until the expiration date.

In the mobile terminal 100 of this example, the access count determination unit 104 determines whether the number of accesses to the planned access area of the IC card 200 exceeds a predetermined threshold, and the access to the planned access area is performed. Even when the number of accesses exceeds the predetermined threshold value, the table data of the access table 101 can be updated by the access table creation unit 102 via the table data update unit 103. Also, here, the number of accesses is high without setting a threshold The table data of the access table 101 may be updated in order.

Next, the operation of the mobile terminal 100 of the present example will be described. FIG. 4 is a flow chart showing the operation of a portable terminal as a communication terminal apparatus according to an embodiment of the present invention.

In FIG. 4, when the access operation to the secure area of the IC card 200 starts, the portable terminal 100 first refers to the access table 101 (step ST401), and tries to access this function as well. Check the presence or absence of the handle of the access area (secure area) to be selected (step ST402).

In step ST 402, when the handle of the secure area to be accessed by portable terminal 100 is in access table 101, secure area is accessed from portable terminal 100 using the handle of access table 101 (step ST 403).

On the other hand, if the handle of the secure area to be accessed by portable terminal 100 does not exist in access table 101 in step ST402, the access table creation routine is executed (step ST404), and the newly created access table is executed. Access the secure area by using the 101 handle.

Next, in the portable terminal 100 of the present example, it is judged whether or not to update the access table 101 referenced in step ST401 (step ST405). Here, the determination as to whether or not the access table 101 is to be updated may be performed by the user's operation, or may be performed by a preset program.

Then, in the case where the access table 101 is updated in the determination of step ST405, the access table update routine is executed (step ST406), and then the process proceeds to step ST407.

On the other hand, the access table 101 is not updated in the determination at step ST405, and in the case, the process jumps to step ST407 without executing the access table update routine.

In step ST407, it is determined whether or not the access from portable terminal 100 to the secure area of IC card 200 is ended. If access is continued, the process returns to step ST403, and the access is ended. Stops the access operation of the portable terminal 100.

As described above, when there is no handle of the secure area to be accessed by portable terminal 100 in access table 101 in step ST 402, as shown in FIG. Execute access table creation routine. FIG. 5 is a flowchart showing the details of the access table creation routine in FIG.

As shown in FIG. 5, in the access table creation routine, first, the portable terminal 100 performs an implementation check of the IC card 200 (step ST501). In this mounting check, the card information acquisition unit 109 acquires card information (mounting information) 301 (see FIG. 3) in order to check the mounting of the IC card 200.

Next, the portable terminal 100 determines from the acquired card information (mounting information) 301 whether the mounting of the IC card 200 is possible at high speed or difficult at the card information determination unit 108. (Step ST502).

If it is determined in step ST 502 that mounting of the IC card 200 is difficult at high speed, the access operation of the portable terminal 100 is stopped.

On the other hand, when it is determined in step ST 502 that the IC card 200 can be mounted at high speed, the handle acquisition unit 105 acquires the handle of the access planned area of the IC card 200 (step ST 503). .

Then, the handle acquisition unit 105 sends the handle of the access scheduled area acquired from the IC card 200 to the access table creation unit 102.

Upon receiving the handle of the access scheduled area of IC card 200 acquired by handle acquisition unit 105, access table creation unit 102 creates access tape 101 including the received handle (step ST 504).

Then, after creating access table 101 in step ST 504, step ST 4 in FIG. 4 is performed.

Return to 03.

Further, in the case where the access table 101 is to be updated in the determination of step ST 405, the access table update routine shown in FIG. 6 is executed. FIG. 6 is a flow chart showing details of the access table update routine in FIG.

As shown in FIG. 6, in the access table update routine, first, the portable terminal 100 performs an installation check of the IC card 200 (step ST601). In this implementation check, the card information acquisition unit 109 acquires the card information (implementation information) 301 as in the case of the access table creation routine. Next, the portable terminal 100 is mounted from the acquired card information (mounting information) 301.

It is determined whether or not it is the update timing of the C card 200 (step ST602).

If it is determined in step ST602 that the update timing is not reached, the process jumps to step ST407 in FIG.

On the other hand, when it is determined in step ST602 that the update timing is reached, it is determined whether or not there is an expired handle in access table 101 (step ST60).

3).

If it is determined in step ST603 that the expired handle is not stored in the access table 101, the process jumps to step ST407 in FIG.

On the other hand, when it is determined in step ST603 that there is an expired handle in the access table 101, the handle acquisition unit 105 reacquires the handle of the card application of the IC card 200 that has expired. (Step ST604).

The handle of the expired card application of the IC card 200 that the handle acquisition unit 105 reacquired is sent to the table data update unit 103.

The table data updating unit 103 sends the handle acquired again by the handle acquiring unit 105 to the access table creating unit 102, and updates the corresponding handle of the access table 101 (step ST605).

Then, after updating the access table 101 in step ST605, the process returns to step ST407 in FIG.

As described above, in the portable terminal 100 of this example, when the card application is opened, the handle of the access area to be accessed can be acquired, and the access table 101 can be created. If the access area used by the IC card 200 does not have a component, the handle of the entire area can be acquired.

Further, in the portable terminal 100 of this example, since the handle allocation rule of the IC card 200 differs depending on the implementation, the timing of creating and updating the access table 101 is changed for each implementation of the IC card 200. be able to. However, when the type of IC card 200 mounted on the portable terminal 100 is, there is no need to change the timing of creating and updating the access table 101. Also, the lifetime of the handle is It depends on the implementation of the IC card 200 (setting of the card manufacturer), such as when the connection is closed.

By the way, the planned area for the portable terminal 100 to access the card application of the IC card 200 is determined by the host application of the portable terminal 100 to several places.

Therefore, in the portable terminal 100 of this example, all handles in the access area used by the user are cached in advance, and the access table 101 is first created.

In addition, the timing at which the card application handle of the IC card 200 changes depends on the implementation of the IC card 200, that is, the implementation differs depending on the card manufacturing company.

Therefore, in the portable terminal 100 of the present example, the access table 101 is updated according to the timing at which the handle of the mounted IC card 200 changes, that is, the rules and card version decided by the mounting company. It is.

Thus, the access table 101 in the mobile terminal 100 of this example is updated to the access table 101 of the card version of the IC card 200 and the index corresponding to the card company.

Further, in the portable terminal 100 of the present example, the handle of the expiration date (different according to the type of the IC card 200, etc.) is urged to update.

Therefore, in the case of the portable terminal 100 of this example, for example, in the case of the IC card 200 manufactured by A company, every time the card application is closed, in the case of the IC card 200 manufactured by B company, the connection is When rebuilt, the handle of the access table 101 can be updated according to the type of IC card 200 and so on.

By the way, in the case where the access area used in advance by IC card 200 is not a component, if the handle of all access areas is acquired, all handles in all access areas of IC card 200 will be cached. Then, access to the card application from the portable terminal 100 is delayed.

Therefore, in the case of portable terminal 100 of this example, when the access area does not have a division factor as described above, the handle of the access area determined in advance for each access timing to IC card 200. Make only caching.

That is, in portable terminal 100 of the present example, the handle is distributed while the access area is dispersed. Shout. For example, in the case of the portable terminal 100 of this example, when the access area is large, the access area is divided into n groups, and a handle of one group is acquired each time the card application is accessed.

By the way, as described above, an IC card is actually used by using the handle of the access table 101.

If you access 200 to operate the card application, the access table

The handle of 101 comes with something that is used frequently and one that is not used.

For this reason, if all expired handles are updated, the access speed from the portable terminal 100 to the card application of the IC card 200 may be rather reduced.

Therefore, in the mobile terminal 100 of the present example, the number of accesses to the access area of the IC card 200 is recorded in the access table 101. Moreover, in the portable terminal 100 of this example,

Even when the IC card 200 is removed, the table data of the access table 101 in the past is held.

Then, in the portable terminal 100 of the present example, when creating the access table 101 at the time of access to the next IC card 200, an access area where the number of accesses exceeds a predetermined threshold value is stored. Just like getting handle.

As a result, in the mobile terminal 100 of this example, the frequently used handle force is also updated preferentially, and the handle that is not used frequently is not updated, so efficient use of the access table 101 is achieved. And the access table 101 can be updated more efficiently.

In the mobile terminal 100 of this example, the access table 101 is updated also when accessing the IC card 200 that is not related to the secure area!

Furthermore, although the mobile terminal 100 as the target host is described here as a mobile phone, this host may be any device into which the IC card 200 can be inserted. You may be a PC!

In addition, the IC card 200 may not be in the form of a card, but may be a chip or the like. For example, the IC card 200 may be a chip built in a portable telephone such as a wallet carrying cell.

As described above, according to the mobile terminal 100 and the access method of the present example, The secure area managed by the IC card 200 can be directly accessed from the portable terminal 100 using the handle of the access table 101 that has been stored.

Therefore, according to the portable terminal 100 and the access method of the present example, it is not necessary to acquire a handle each time when the portable terminal 100 accesses the secure area of the IC card 200! Since, the overhead in accessing the secure area of the IC card 200 can be reduced.

Industrial applicability

The communication terminal apparatus and access method according to the present invention can reduce the overhead during access since it is not necessary to acquire the handle each time when accessing the secure area of the IC card. Also, since the communication terminal device power can be accessed at high speed to the secure area of the IC card, as a communication terminal device and access method for accessing the secure area managed by the IC card using the handle acquired from the card application of the IC card. It is useful.

Claims

The scope of the claims

[1] Handle acquisition means for acquiring in advance a handle of a secure area scheduled to be accessed by the IC card when the IC card card application is opened,

An access table for storing the handle acquired by the handle acquiring means, and an access means for accessing the secure area using the handle of the secure area stored in the access table when accessing the secure area; A communication terminal apparatus comprising

[2] In the IC card, the assignment rule of the handle differs depending on the implementation,

Access table creation means for changing the creation timing of the access table for each mounting of the IC card;

The communication terminal according to claim 1, further comprising: table data updating means for changing update timing of table data of the access table for each mounting of the IC card.

[3] The access table stores the number of accesses to the access area of the IC card, and holds past table data also when the IC card is removed,

The access count determination means is provided to determine whether the access count stored in the access table exceeds a predetermined threshold value.

When the handle acquisition means creates the access table by the access tape creation means at the time of the next access of the IC card, the access frequency of the access frequency determined to exceed the threshold value is determined by the access frequency determination means. The communication terminal according to claim 2, wherein only a handle of the area is acquired.

4. The communication terminal apparatus according to claim 3, wherein the table data update unit updates only the handle of the access area of the access count determined to exceed the threshold by the access count determination unit.

5. The communication terminal device according to claim 3, wherein the table data update unit updates the handle of the access area in order of the number of accesses determined by the access number determination unit. A handle acquisition step of acquiring in advance a handle of a secure area scheduled to be accessed managed by the IC card when the IC card card application is opened;

An access table for storing the handle acquired in the handle acquisition step;

An access step of accessing the secure area using the handle of the secure area stored in the access table when accessing the secure area.