JP2003216585A - Authentication application, management application, authentication request application and ic card - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication application, a management application, an authentication request application and an IC card capable of improving versatility, convenience and processing efficiency. <P>SOLUTION: A plurality of authentication applications 52 provided with authentication functions to decide whether or not users are holders based on each of different and plural kinds of user identification information only when accessed from an other application and to make a CPU 20 execute decision authentication for performing identical person authentication when they are right, the authentication request application 53 for making prescribed identical person authentication as an execution requirement of a main function and performing an authentication selection request and the management application 51 provided with an authentication selection function for selecting the authentication application to be executed by the CPU 20 according to the authentication selection request are mounted on the IC card 1. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to a JavaCard.
(“JAVA” is a registered trademark), etc., a plurality of applications having a shared relationship can be installed, and an IC card for performing personal authentication processing, and an authentication for being mounted on this IC card and performing personal authentication processing The present invention relates to an application, a management application for managing the process of personal authentication, and an authentication-required application having a main function execution requirement that personal authentication is performed.

[0002]

2. Description of the Related Art Conventionally, an IC card (an IC card is not limited to an IC card or a SIM card conforming to the size of a standard such as ISO, etc., and can be put in a pocket regardless of its outer shape and thickness. It is a pocket-sized portable information terminal that is about the same size.) Is equipped with an authentication function as part of the application, and it is confirmed that the user who uses this card is a holder who can use the card legally. It is used for personal authentication. For example, by using an IC card equipped with a cash application, a part of which is a PIN authentication function, a bank AT
First, in PIN M, which is a personal identification number, is entered, and after authenticating the individual, a transaction is carried out. In addition, in situations where a high security level is required, various types of personal authentication using biometrics technology such as fingerprints, voiceprints, iris, and handwriting using IC cards are performed.

FIG. 11 is a flow chart for explaining the processing of a conventional IC card. In S500, the IC card is installed in an environment capable of communicating with an external device. IC
The card receives power, clock, etc. supplied from an external device, boots the OS, and initializes the card such as memory check. The IC card 1 transmits initial response information (ATR) including self-diagnosis processing and communication conditions to an external device (S501).

At step S502, the IC card is in a reception waiting state. When the command is received from the external device, the IC card selects the application corresponding to this command (S503, S504) and calls the function of this application to perform processing (S50).
5). The IC card transmits the processing result as a response to the external device (S506) and waits for reception again (S502). The IC card repeats the same processing until it leaves the environment in which it can communicate with the external device.

[0005] For personal identification using this IC card,
There are the following methods. (1) P, which is the holder identification information for identifying the holder
IN data and biometrics data (all or only features of fingerprints and voiceprint data) are stored in the IC card, and the external terminal side reads this and compares it with the input user identification information. If the holder identification information and the user identification information match, an authentication success command is sent to the application in the IC card. (2) The PIN data or biometrics data, which is the user identification information, is sent from the external terminal side to the application having the authentication function in the IC card, and the authentication function of the application is stored in the application (or in the area accessible by the application). The recorded identification information of the holder is collated, and if they match, the authentication is successful. (3) An authentication input device (such as a PIN input keyboard or a biometrics device such as a fingerprint input device) is provided on the IC card, from which user identification information is sent to the authentication application in the card, and the application (or its Match the holder identification information recorded in the application accessible area).

Of the above three methods, since the holder identification information does not leak out from the IC card, (2),
(3) is preferable to (1), and even more so in the case of authentication based on biometrics data including the physical characteristics of the person. In operation (1), it seems that encrypted communication called secure messaging is often used for communication with the terminal, but (2) and (3) are preferable for more reliable security.

[0007] Therefore, from the viewpoint of maintaining security, it is required to mount an application equipped with a personal authentication means for collating the holder identification information and the user identification information on the IC card. Further, in the present situation where a highly convenient IC card is required due to the diversification of personal authentication due to biometrics and the like and the diversification of applications stored in the IC card, the IC card can be used in various types corresponding to security levels. It is required to have a personal authentication function.

[0008]

However, as shown in FIG. 12 (a).
As shown in FIG. 5, applications 531-5, 532 having various authentication functions corresponding to settings of various external terminals are provided.
The size of 5,533-5 is too large to be mounted on an IC card, which is not practical. In order to solve this problem, there is an IC card in which objects, functions, etc. included in an application are shared by a plurality of applications. This IC card is shown below.

For example, Ja of Sun Microsystems, Inc.
vaCard is an execution environment that manages each application (JCRE: Java in the case of JavaCard).
Card Runtime Environment
Called. ), It is possible to provide a specific object to another application (hereinafter, the application that provides the object is referred to as a “server application”, and the application that is provided is referred to as a “client application”). On the other hand, depending on the execution environment, the applications cannot directly access each other, and an error occurs even if the client application tries to directly call the object of the server application (firewall). The object is a module in which functions and data are integrated, and for example, the point balance data, the point addition function, and the point use function are integrated and implemented as a point object.

Further, in JavaCard, when an application is installed, a unique ID (hereinafter referred to as "AID") of a client application predicted to request shared access in advance and a parameter (PIN or the like) for authentication are provided. The data can be given to the target server application as data, and the server application can confirm whether or not the client is a legitimate application based on this data (unlimited access may be permitted if there is no security problem).

However, since the AID is not known, it is impossible to cope with the unexpected addition of a client application. In order to solve this problem, the present applicant has
A "portable information processing device having a shared access management function" (IC card) (Japanese Patent Application No. 2000-268676) is proposed.

Each application installed in the portable information processing device having the shared access management function has shared management information for judging what kind of permission is given to which client. Since this management information can be added, deleted, and updated, it is possible to correctly manage the permission / non-permission of access even for the addition / deletion of applications that were not expected at the time of card issuance, and it is possible to access / disable the functions and data. Can be

However, if the access from a client application is made public to another client application, it cannot be controlled. In addition, although the access between the server application and the client can be managed, there is a problem that the client application that once obtains the object cannot manage it if the object is arbitrarily disclosed to another application. In order to solve this problem, the present applicant has proposed “IC card program and IC card”.
(Japanese Patent Application No. 2001-397304) is proposed. This IC card can be loaded with a plurality of applications such as JavaCard, and when an object can be used by other applications, an application having a function of limiting the number of times and the range of provision (not to be copied indefinitely It is equipped with.

As shown in FIG. 12B, the IC card corresponds to the security level by sharing the object to which the various authentication functions are distributed among a plurality of applications 531-6, 532-6, 533-6. It is possible to provide various personal authentication functions described above.

However, when the external terminal requests the authentication result, the IC card (1) selects an application having an authentication function and (2) checks the flag indicating the authentication result in this application. Must be repeated, resulting in poor processing efficiency. In addition, since personal authentication is often performed at the start of a series of processes, rapid processing is particularly required. Furthermore, it is necessary to distribute a plurality of authentication functions to each application so as to match them, which imposes restrictions on the application design and may lack versatility.

An object of the present invention is to provide an authentication application, a management application, an authentication required application, and an IC card which can improve versatility, convenience and authentication processing efficiency.

[0017]

The present invention solves the above-mentioned problems by the following means for solving the problems. It should be noted that, for ease of understanding, reference numerals corresponding to the embodiments of the present invention will be given and described, but the present invention is not limited thereto. That is, the invention of claim 1 is mounted on an IC card (1, 1-2, 1-3) capable of mounting a plurality of applications, and causes the CPU (20, 20-2) to execute to perform personal authentication. Whether or not the user is a holder based on the user identification information only when the application is an authentication application and is accessed from the outside by another application (53, 53-2, 53-3) (S111). The determination authentication procedure (S112, S2)
02) is included in the authentication application (52, 52-2).

According to a second aspect of the present invention, in the authentication application according to the first aspect, an authentication result storage procedure (S2) for storing an authentication result which is a result of the determination authentication procedure.
03) is included in the authentication application (52-2).

The invention according to claim 3 is claim 1 or claim 2.
In the authentication application described in (1), another application (51,
51-3), and an access authentication result storing procedure (S121) for storing the authentication result, which is the result of the determination authentication procedure, in the one application, the authentication application (52). .

According to a fourth aspect of the present invention, it is determined whether or not the user is a holder based on the CPU (20) and a plurality of different types of user identification information. It is mounted on an IC card (1, 1-3) equipped with an authentication application storage means (50, 50-3) for storing a plurality of authentication applications (52) for causing the CPU to execute the determination authentication procedure (S112) to be performed, A management application that causes the CPU to execute to manage personal authentication, and when an authentication selection request is made, an authentication selection procedure for selecting the authentication application to be executed by the CPU in response to the authentication selection request ( S102,
S103) is included in the management application (51, 51-3).

According to a fifth aspect of the present invention, in the management application according to the fourth aspect, an authentication result storage procedure (S1) for storing an authentication result which is a result of the determination authentication procedure.
21) is provided, which is a management application (51, 51-3).

According to a sixth aspect of the present invention, there is provided an authentication-required application, which is mounted on an IC card (1, 1-2) equipped with a CPU, and which has a predetermined personal authentication as a main function execution requirement. , An access authentication procedure for accessing the one or more other applications (52, 52-2) mounted on the IC card and causing the CPU to execute the function of performing the predetermined personal authentication included in the application (S111). , S201) is included in the authentication-required application (53, 53-2).

According to the invention of claim 7, the CPU (20, 20-
2) and the determination authentication procedure (S112, S202) for determining whether or not the user is a holder based on different types of user identification information, and authenticating the user if the result is affirmative. An authentication application storage means (50, 50-2) for storing the plurality of authentication applications (52, 52-2) according to claim 1 or 2;
It is an IC card (1, 1-2) provided with.

According to an eighth aspect of the present invention, a plurality of authentication means (2) for determining whether or not the user is a holder based on different types of user identification information, and authenticating the individual when the user is affirmative.
1, 2, 23, 24) and, when there is an authentication selection request, an authentication selection means (25) for selecting an authentication means to perform the determination in response to the request, an IC card (1, 1) -3).

The invention according to claim 9 is the IC according to claim 8.
In the card, a required authentication application storage means (50) for storing the required authentication application (53) for making the authentication selection request, with the CPU (20) as a main function execution requirement that a predetermined authentication is performed. An authentication application storage means (50) for storing a plurality of authentication applications (52) for realizing the plurality of authentication means by causing the CPU to execute; and authentication application identification information for identifying the authentication application.
Authentication selection information storage means (5) for storing authentication selection information associated with authentication application identification information for identifying the authentication application in a management application (51) accessible from the authentication-required application.
0), and the authentication selection means makes a selection based on the authentication selection information.

The invention according to claim 10 is the I according to claim 9.
In the C card, the authentication application storage means is an IC card (1) characterized by storing the authentication application (52) according to claim 1 or 2.

According to a tenth aspect of the invention, in the IC card according to the ninth or tenth aspect, the authentication result which is the result of the determination authentication procedure is set as one application (5
1) An IC card (1) characterized by comprising an authentication result storage means (50) stored therein.

[0028]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in more detail below with reference to the drawings. (First Embodiment) FIG. 1 is a block diagram showing a first embodiment of an IC card according to the present invention. It should be noted that the same reference numerals are given to the portions having the same functions as those of the above-described conventional example, and the duplicate description will be appropriately omitted. As shown in Figure 1,
The IC card 1 is an I / O that controls communication with the external device 2.
Interface 10, CPU2 for controlling the entire device
0, RAM 30 which is storage means for storing information, ROM
40, EEPROM 50, user identification information input unit 60
Java that can be loaded with multiple applications
It can be built on a multi-application IC card such as aCard or MultisCard.

The I / O interface 10 is a communication means for receiving a command from the reader / writer of the external device 2 via a physical transmission path or a non-contact transmission path and transmitting a response. RAM30 is a volatile memory, C
It is used as a work area in which the PU 20 performs processing. RO
M40 is a nonvolatile read-only memory,
S, execution environment, etc. are stored. The OS is basic software that can be used universally regardless of the application of the IC card.

The EEPROM 50 is a nonvolatile memory that can be rewritten at any time, and includes a fingerprint authentication application 521 and a PIN.
Authentication application 522, voiceprint authentication application 523, handwriting authentication application 524 (hereinafter, these applications 521,
522, 523, and 524 are collectively referred to as an authentication application 52. ), Management application 51, employee ID application 53
1, point application 532, cash application 533,
(Hereafter, these applications 531, 532, 5
33 is collectively referred to as an authentication required application 53. )
It stores various applications such as. The application is a program for the CPU 20 to perform various unique processes of the IC card 1 in the management of basic software such as the OS. In addition, the EEPROM 50 is
Used as a work area for OS and applications.

FIG. 2 is a logical structure diagram for explaining the first embodiment of the authentication application, the management application, the authentication required application and the IC card according to the present invention. FIG. 3 is a diagram showing a sharing relationship between applications stored in the EEPROM 50. As shown in FIG. 2, the CPU 20 executes each application 51, 52, 53 under the control of the OS.

As shown in FIGS. 2 and 3, the authentication required application 53 can access the management application 51 and call the authentication selection function (# 1, solid line).
An authentication selection request for calling this authentication selection function is made. The authentication-required application 53 can access the predetermined authentication application 52 by the address received by accessing the management application 51 and call the authentication function (# 2, broken line). The point application 532 is a fingerprint authentication application 521, the employee ID application 531 is a fingerprint authentication application 521, a PIN authentication application 522, a voiceprint authentication application 523, and a cash application 5.
33 is a PIN authentication application 522 and a handwriting authentication application 52
4 can be accessed respectively. The authentication application 52 can access the management application 51 and call the table writing function (# 3, alternate long and short dash line).

It is assumed that these sharing relationships are established at some point before access. As a method of implementing the sharing relationship, the management application 51 may have an application authentication function that authenticates whether or not to permit access from the authentication application 52 and the application requiring authentication, and the authentication may be implemented by this authentication. Etc. (Japanese Patent Application 2
000-268676, Japanese Patent Application No. 2001-397304)
May be implemented with.

Employee ID application 531 and point application 53
2 and the cache application 533 are respectively CPU2
0 has the employee authentication function, the point conversion function, and the cash settlement function as main functions (main function) that realizes the predetermined purpose, and that the predetermined type of personal authentication is performed. It is a required authentication application. The authentication-required application 53 calls the authentication selection function of the management application 51 before executing the main function, accesses the authentication application 52 based on the received address, and calls the authentication function for performing a predetermined type of personal authentication. In the present embodiment, the cache application 533
Indicates that PIN authentication and handwriting authentication are performed, point application 532 is fingerprint authentication, and employee ID application 531 is PIN authentication, fingerprint authentication, and voice print authentication (see FIG. 4 described later).

Fingerprint authentication application 521, PIN authentication application 522, voiceprint authentication application 523, handwriting authentication application 524
Is the fingerprint of the holder, which is the holder identification information, and PI.
An authentication application 52 such as an authentication-necessary application 53 stored in the IC card 1 having N, voiceprint, and handwriting information.
Only when called from outside the CPU, the authentication application having the authentication function to realize the fingerprint authentication unit 21, the PIN authentication unit 22, the voiceprint authentication unit 23, and the handwriting authentication unit 24 as main functions by being executed by the CPU 20. is there. The authentication application 52 accesses the management application 51 and calls the table rewriting function to write and store the authentication result of the authentication function in the management table 510. If the IC card 1 is a family card and a plurality of persons, such as a married couple, are registered as legal users of the IC card 1, the authentication application 52 displays the fingerprints of the married couples who are the owners. Has holder identification information.

The authentication application 52 may be mounted on the IC card 1 at any timing, and may be downloaded to the IC card 1 when it is needed, and it is not necessary to install the authentication application 52 from the beginning. Conversely, an authentication application that is no longer needed may be deleted.

The management application 51 has data such as the management table 510, and is provided with programs such as an authentication selection function and a table rewriting function. The management application 51 is an application for managing personal authentication. The authentication selection function and the table rewriting function are programs that are executed by the CPU 20 to realize the authentication selection unit 25 and the table rewriting unit 26, respectively.

FIG. 4 is a diagram for explaining the management table. FIG. 4A shows the case where the personal authentication is not performed, and FIG. 4B shows the case where the personal authentication by PIN is performed. Shows. As shown in FIG. 4, the management table 510 is
The authentication-required application 53 shows the personal authentication required for executing the main function. In addition, the management table 51
0 indicates the authentication result of whether or not the authentication units 21, 22, 23, and 24 have performed various authentications.

The management table 510 has authentication application identification information and authentication application identification information such as the name of the authentication application 53 and the name of the authentication application 52 arranged in a row and a column, respectively. Stores a flag (value) associated with personal authentication. The flag “0” indicates unauthenticated, and the flag “1” indicates authenticated. For example, in FIG.
As shown in (b), when the PIN authentication unit 22 authenticates the person, the table rewriting unit 26 displays the PIN.
The flags in the two intersecting columns of the authentication application 522, the employee ID application 531 and the cash application 533 are rewritten as "1". In this case, in order to execute the main function of the cache application 533, it is necessary that the handwriting authentication unit 24 further authenticates the person. Flag "1"
Is rewritten to "0" when the IC card 1 cannot communicate with the external device 2. The names of the authentication-requiring application 53 and the authentication application 52 may be information such as an application ID (AID) that can identify the authentication-requiring application 53 and the authentication application 52.

As shown in FIG. 1, the CPU 20 is a central processing unit for controlling the IC card 1 in a centralized manner, and has a fingerprint authentication unit 21, a PIN authentication unit 22, a voiceprint authentication unit 23, a handwriting authentication unit 24, and an authentication selection unit 25. , A table rewriting unit 26 and the like. These parts 21, 22, 23, 24, 25, 26
Is realized by the CPU 20 executing an application stored in the EEPROM 50.

The fingerprint authenticating section 21, the PIN authenticating section 22, the voiceprint authenticating section 23 and the handwriting authenticating section 24 (hereinafter collectively referred to as authenticating sections 21, 22, 23 and 24) respectively have different kinds of user identification information and user identifying information. I based on the holder identification information
This is an authentication means that determines whether the user who is using the C card 1 is a holder who can legally use the IC card 1 and, if the result is affirmative, authenticates the person.

The authentication units 21, 22, 23 and 24 are
User identification information for identifying the user from others, such as the user's fingerprint, PIN, voiceprint, handwriting information, etc. input from the user identification information input unit 210 of the external device 2, and the EEPROM.
It is determined whether or not it can be regarded as the same by collating with the holder identification information that identifies the holder from other persons, such as the fingerprint of the holder stored in advance in 50, and if so, the user is the holder. It is an authentication means that performs determination authentication to authenticate that there is something (personal authentication).

When a plurality of persons are holders,
The authentication units 21, 22, 23 and 24 store user identification information,
By collating with a plurality of holder identification information, it is determined whether or not it can be regarded as the same as any one of the holder identification information, and if it can be regarded, personal authentication is performed. Therefore, for example, in the case where the married couple is the owner, whichever person uses the IC card 1, personal authentication is performed. Further, the format of the owner identification information and the user identification information such as the fingerprint, PIN, voiceprint, and handwriting information is determined according to the algorithm for personal authentication.

The authentication selecting section 25 is a section for authenticating the person, when an authentication selection request is made.
Authentication selection means for selecting 22, 23, and 24. The authentication selection unit 25 uses the cache application 53 by the CPU 20.
When an authentication request (call of the authentication selection function of the management application 51) is made in the execution of No. 3, the authentication application 52 whose value is “0” is searched for in the flag corresponding to the cache application 533 of the management table 510. , By returning the address to the cache application 533, the authentication units 21, 22, 23, which perform personal authentication.
Select 24. If there is no authentication application 52 that is “0”, the fact that all are authenticated is returned to the cache application 533.

The table rewriting unit 26 is a rewriting unit that writes, rewrites, deletes, etc. the contents of the management table 510 included in the management application 51.
The authentication result indicating whether or not the authentication is performed is recorded in the management table 510 and stored therein.

The external device 2 includes the fingerprint information input units 211, P.
A user identification information input unit 210 including an IN input unit 212, a voice print information input unit 213, and a handwriting information input unit 214;
This is an information processing apparatus that supplies power to the IC card 1, clocks, etc., transmits commands, etc., and receives a response, which is a processing result in the IC card 1.

Fingerprint information input section 211, PIN input section 21
2. Voiceprint information input unit 213 and handwriting information input unit 214
Is the fingerprint information of the user, which is the user identification information,
It is a user identification information input means for inputting user identification information such as PIN, voiceprint information, and handwriting information. The user identification information input unit 210 converts user identification information input from a sensor, a keyboard, a microphone or the like into a predetermined format and puts it in a predetermined format so that it can be compared with the holder identification information stored in the EEPROM 50. It is converted and input to the external device 2. This user identification information is transmitted to the IC card 1.

FIG. 5 is a flow chart showing a first embodiment of the authentication application, the management application and the authentication required application according to the present invention, and FIG. 6 is
It is a figure explaining the shared access between an authentication application, a management application, and an authentication required application. 5 and 6 show the processing of the IC card 1 in S505 of FIG. Hereinafter, description will be given mainly with reference to FIG. 5 and with reference to other drawings such as FIG. 6 as appropriate. S
In 100, the CPU 20 is installed in an environment in which it can communicate with the external device 2, and the external device 2 allows the cache application 5 to operate.
33, the request for executing 33 is received (FIG. 11, S502, S50
3), select the cache application 533 (FIG. 11, S5
04), start execution.

In S101, the CPU 20 executes the cache application 533 to make an authentication selection request from the cache application 533 to the management application 51, access the management application 51, and call the authentication selection function (FIG. 6, # 1). ). In S102 and S103, the authentication selection unit 25 searches the flag corresponding to the cache application 533 of the management table 510 for the authentication application 52 whose value is “0” (FIG. 6, # 2), and the flag of “0”. If there is not, the main function such as cash settlement is executed (S1
04, FIG. 6, # 3 ', # 4'), and the process is terminated (S1).
30). The processing result is transmitted from the IC card 1 to the external device 2 (FIG. 11, S506).

On the other hand, when there is the authentication application 52 of "0", the authentication application 52 is selected and accessed (# 3 in FIG. 6), and the authentication units 21, 22, 23 and 24 determine and authenticate. Is performed (S111, FIG. 6, # 4). In the present embodiment, the management table 510 is in the state shown in FIG. 4A, the authentication selection unit 25 selects the PIN authentication application 522, and the PIN authentication unit 22 identifies the PIN based on the user's PIN. It is determined whether or not to authenticate (S112). In addition,
The user identification information required for personal authentication such as PIN is S1.
At the stage before this processing, such as when the IC card 1 requests and receives the external device 2 at 11, the PIN input unit 21
The information such as 2 may be input to the IC card 1 from the user identification information input unit 210. In S112, in the case of no,
The processing ends as an error (S113, S130, # 5 ′ in FIG. 6), and the IC card 1 displays the processing result in the external device 2
To S506 (FIG. 11, S506).

When the personal authentication is performed, the CPU 20 accesses the management application 51 (# 5 in FIG. 6), and the table rewriting unit 26 sets the flags corresponding to the PIN authentication of the management table 510 from "0" to "1". "S121,
FIG. 6, # 6, FIG. 4 (b)]. The authentication selection unit 25 searches the management table 510 again (S102, FIG. 6, #).
7) Similarly, the handwriting authentication application 524 is selected and the same processing is repeated (S103, S111, S112, S1).
21, S102, FIGS. 6, # 8 to # 11). Handwriting authentication part 2
When 4 authenticates the user with the handwriting information of the user, all the flags corresponding to the cache application 533 in the management table 510 become "1", and the CPU 20 executes the main function of this cache application 533 (S103, S10).
4, FIG. 6, # 12, # 13), the process ends (S13).
0). The processing result is transmitted from the IC card 1 to the external device 2 (FIG. 11, S506).

As described above, according to this embodiment, the IC card 1 is provided with a plurality of authentication functions distributed to a plurality of applications, so that it is possible to efficiently use the limited memory. It was In addition, the authentication application 52
Has as its main function an authentication function for performing personal authentication based on user identification information, and the management application 51 collectively manages access to this function, so that the authentication-required application 53 installed in the IC card 1 must be matched. It is easy to take, and it has become possible to improve convenience and versatility.

Further, since the management application 51 collectively stores the authentication results in the management table 510, it is possible to improve the efficiency of the processing and improve the convenience.
Furthermore, since the IC card 1 is provided with a plurality of authentication units 21, 22, 23, 24 that perform personal authentication based on a plurality of different types of user identification information, respectively, it is psychologically difficult to take a fingerprint. However, it is possible to perform the authentication in consideration of various circumstances such as the fingerprint is thin and the authentication cannot be performed, and the convenience can be improved. In addition, since there is a difference in authentication accuracy depending on various authentication algorithms, it has become possible to improve the authentication accuracy of the entire system by combining a plurality of authentications.

(Second Embodiment) FIG. 7 shows the I according to the present invention.
It is a block diagram which shows 2nd Embodiment of C card. In addition, in the portion that performs the same function as the above-described embodiment,
The same reference numerals are given and duplicate explanations are appropriately omitted. As shown in FIG. 7, the IC card 1-2 includes an I / O interface 10, a CPU 20-2, a RAM 30, and a ROM 4.
0, EEPROM 50-2 and the like.

The EEPROM 50-2 includes a fingerprint authentication application 521-2, a PIN authentication application 522-2, a voiceprint authentication application 523-2, a handwriting authentication application 524-2 (these applications 521-2, 522-2, 52.
3-2.524-2 together authentication application 5
2-2. ), Employee ID application 531-2, cash application 533-2, point application 532-2 (hereinafter, these applications 531-2 and 532-).
2, 533-2 are collectively required authentication application 53
-2. ) And other various applications are stored.

FIG. 8 is a logical structure diagram for explaining the second embodiment of the authentication application, the authentication required application and the IC card according to the present invention. Each of the authentication-required applications 53-2 has the main function execution requirement that the same type of personal authentication as in the first embodiment is performed (see FIG. 4). Authentication Required Application 53-2
Is a predetermined authentication application 52 based on the address of the authentication function of the authentication application 52-2.
-2, it is possible to call the authentication function.

As in the first embodiment, the cash application 533-2 is the PIN authentication application 522-2 and the handwriting authentication application 524-2, and the point application 532-2 is the fingerprint authentication application 521-2 and the employee ID application 531. -2 is a PIN authentication application 522-2 and a fingerprint authentication application 521-
2 and the function of calling the authentication function of the voiceprint authentication application 523-2. The authentication application 52-2 is
An authentication function is provided as its main function, and the authentication result is returned to the calling application or the like. The authentication application 52-2 has a writing function of writing and storing the authentication result in the authentication application 52-2.

FIG. 9 is a flow chart showing a second embodiment of the authentication application and the application requiring authentication according to the present invention, and shows the processing of the IC card 1-2 in S505 of FIG. In S200, I
The C card 1-2 is I of S100 in the first embodiment.
In the same state as the C card, the CPU 20-2 starts executing the cache application 533-2. In S201, the CPU 20-2 accesses the PIN authentication application 522-2 from the cache application 533-2 by executing the cache application 533, and the PIN authentication unit 22 makes an authentication determination (S201, S202).

If the person is not authenticated, the processing ends as an error (S211, S220), and the IC card 1-2
Transmits the processing result to the external device 2 (FIG. 11, S50).
6). When the person is authenticated, the CPU 20-2 determines PI
Write the authentication result in the N authentication application 522-2 (S2
03), the authentication result is returned from the PIN authentication application 522-2 to the cache application 533-2, and it is determined whether all the personal authentication required to execute the main function has been performed (S204).

The CPU 20-2 uses the cash application 53.
Since the handwriting authentication is not performed to execute the main function of 3-2, the handwriting authentication application 524-2 is similarly accessed (S201) and the same processing is performed (S202, S20).
3). When all the required personal authentication is performed in S204, the CPU 20-2 determines that the cache application 53
The main function of 3-2 is executed (S205), and the process ends (S220). The processing result is transmitted from the IC card 1-2 to the external device 2 (FIG. 11, S506).

As described above, according to the present embodiment, since the authentication-required application 53-2 directly accesses the authentication application 52-2 without going through the management application 51 in the first embodiment, there is no management application 51. Even in such a case, it is possible to obtain the same effect as that of the first embodiment.

(Third Embodiment) FIG. 10 is a diagram for explaining an authentication application, a management application, an authentication required application, and an IC card according to a third embodiment of the present invention. FIG. 10A is a block diagram. Figure 10
(B) is a figure which shows the sharing relationship of an application. As shown in FIG. 10A, the IC card 1-3 is
I / O interface 1 as in the first and second embodiments
0, CPU20, RAM30, ROM40, EEPRO
It is equipped with M50-3. EEPROM50-3 is
The management application 51, the PIN authentication application 522, the point application 532-3, the employee ID application 531-3, the cash application 533-3, (hereinafter, these applications 531-3, 532-3, 533-3 are collectively required to be authenticated. It is called application 53-3.)

As shown in FIG. 10B, the employee ID application 531-3 is the voiceprint authentication application 5 in the first embodiment.
It has a voiceprint authentication object 523-3, which is an object having the same function as 23. The point application 532-3 and the cache application 533-3 similarly have the fingerprint authentication object 521-3 and PIN that have the same functions as the fingerprint authentication application 521 and the handwriting authentication application 524.
Each has an authentication object 522-3 (hereinafter, these objects 521-3, 523-3, 5
24-3 is collectively referred to as an authentication object 52-3. ).

The authentication-required application 53-3 requires that the same type of personal authentication as that in the first embodiment is performed, as an execution requirement for the main function (see FIG. 4). The authentication-required application 53-3 can access the management application 51 and call the authentication selection function (# 1, solid line). In addition, the authentication required application 53-
3 can access the predetermined PIN authentication application 522 or the authentication object 52-3 by the address received by accessing the management application 51 and call the authentication function (# 2, broken line).

The employee ID application 531-3 can access the fingerprint authentication object 521-3 and the PIN authentication application 522, and the cache application 533-3 can access the PIN authentication application 522. The authentication application 52 and the authentication required application 53-3 can access the management application 51 and call the table writing function (# 3, solid line).

The flow of processing in the third embodiment of the authentication application and the management application according to the present invention is as shown in FIG.
The process is substantially the same as the process in the first embodiment except that the authentication selection unit 25 selects and executes the unauthenticated PIN authentication application 522 or the authentication object 52-3 (see FIG. 5).

As described above, according to the present embodiment, even when various authentication functions are allocated and stored in the authentication-required application 53-3, the same effect as in the first embodiment can be obtained. It was

(Modifications) The present invention is not limited to the above-described embodiments, and various modifications and changes can be made, which are also within the scope of the present invention. For example, in each embodiment, the IC cards 1, 1-2, 1-3 may include the same user identification information input means as the user identification information input unit 210. It is possible to further improve convenience.

In each embodiment, the IC cards 1, 1-
2 and 1-3 may have a fingerprint authentication function and a PIN authentication function in one authentication application.

In each embodiment, the IC cards 1, 1-
The programs 2 and 1-3 may store in the ROM 30 a program such as the authentication application 52, which is considered not to be rewritten. It is possible to allocate the limited capacity of the EEPROM 50 to other applications and improve the convenience. Further, the RAM 30 may store the management table 510. It may be stored in a location accessible from the table rewriting program of the management applications 51 and 51-2.

In each embodiment, the authentication units 21, 22,
23 and 24 perform authentication based on the user identification information and the owner identification information, that is, the fingerprints, voiceprints, and PINs of the user and the owner, but the iris, palm shape, vein pattern, retina, signature, etc. An authentication unit may be provided that authenticates the person based on the biometrics information and the information on which the characteristics of the biometrics have been extracted. Any information can be used as long as it can identify the user and the owner and can be collated. IC card 1.1
It is possible to perform various types of personal authentication in accordance with various conditions such as usage of -2 and 1-3.

In each embodiment, the IC cards 1, 1-
Reference numerals 2, 1-3 denote four authentication units 21, 22, 23, 24 that perform personal authentication based on four different types of user identification information.
However, it may be provided with 1 to 3 or 5 or more authentication units that respectively perform personal authentication based on different types of user identification information. It can be set according to various conditions such as usage and performance of the IC cards 1, 1-2 and 1-3.

In each embodiment, the management applications 51, 5
When the file system is provided by another application mounted on the 1-3 or the IC cards 1, 1-2, 1-3, the holder identification information may be stored in this file system.

In the first or third embodiment,
The IC cards 1 and 1-3 are managed by the external device 2 through the management application 5
When there is an authentication selection request to 1, 51-3, the authentication application 52 is selected according to this authentication selection request,
The authentication result may be returned as a response. Also, IC
When there is an authentication result request for requesting a predetermined authentication result from the external device 2, the cards 1, 1-3 may return the corresponding flag of the management table 510 depending on the content of the authentication result request.

In the first or third embodiment,
Each authentication application 52 is added to the shared management table 510.
The number of times of disapproval, which is the number of times of authentication, is stored in association with the name of each authentication application, and when the number of times of disapproval reaches a predetermined number, the flag may be blocked. It is possible to improve the convenience of the IC card. Further, the flags of the management table 510 may be set with flags of other situations such as "2" indicating the situation of blockage. In the case of blockage, the table rewriting unit 26 cannot rewrite the flag from “2” to “1”, and the flag does not indicate the authenticated status in principle.
It is possible to manage various authentications and improve the convenience of the IC card 1.

[0076]

As described in detail above, according to the present invention, the following effects can be obtained. (1) The authentication application has a main function of an authentication function for determining whether or not the user is a holder, and has a determination authentication procedure for performing this determination only when called from outside the authentication application. This makes it easier to match with other applications, and improves convenience and versatility. (2) By collectively storing the authentication result in one application, the processing efficiency is improved and the convenience is improved. (3) The authentication-required application and the information linking the authentication application are collectively stored in one application, and the authentication application is selected in accordance with the authentication request, so that the processing efficiency is improved and the convenience is improved. Increase. (4) By performing authentication based on a plurality of different types of user identification information, the plurality of authentications are combined to improve the authentication accuracy of the entire system.

[Brief description of drawings]

FIG. 1 is a block diagram showing a first embodiment of an IC card according to the present invention.

FIG. 2 is a logical structure diagram illustrating a first embodiment of an authentication application, a management application, an authentication required application, and an IC card according to the present invention.

FIG. 3 is a diagram showing a sharing relationship between applications stored in an EEPROM 50.

FIG. 4 is a diagram illustrating a management table.

FIG. 5 is a flowchart showing a first embodiment of an authentication application, a management application, and an authentication required application according to the present invention.

FIG. 6 is a diagram illustrating shared access among an authentication application, a management application, and an authentication required application according to the present invention.

FIG. 7 is a block diagram showing a second embodiment of an IC card according to the present invention.

FIG. 8 is a logical structure diagram illustrating a second embodiment of an authentication application, an authentication required application, and an IC card according to the present invention.

FIG. 9 is a flowchart showing a second embodiment of an authentication application and an authentication required application according to the present invention.

FIG. 10 is a diagram illustrating a third embodiment of an authentication application, a management application, an authentication required application, and an IC card according to the present invention.

FIG. 11 is a flowchart illustrating processing of a conventional IC card.

FIG. 12 is a schematic diagram illustrating a memory of an IC card.

[Explanation of symbols]

1,1-2,1-3 IC card 2 External device 10 I / O interface 20, 20-2 CPU 21,22,23,24 Authentication section 25 Authentication selection section 26 Table rewriting section 30 RAM 40 ROM 50, 50-2, 50-3 EEPROM 51,51-3 Management app 52,52-2 Authentication application 53,53-2,53-3 Required authentication application 210 User identification information input section

Claims (11)

[Claims] 1. An I capable of mounting a plurality of applications
An authentication application that is mounted on a C card and that executes a CPU to perform personal authentication, and the user is the holder based on the user identification information only when accessed from outside such as another application. An authentication application characterized by comprising a judgment and authentication procedure for judging whether or not it is, and if it is affirmative, authenticating the person. 2. The authentication application according to claim 1, further comprising an authentication result storage procedure for storing an authentication result which is a result of the determination authentication procedure. 3. The authentication application according to claim 1 or 2, wherein another application installed in the IC card is accessed and an authentication result which is a result of the determination authentication procedure is displayed in the one application. An authentication application characterized by having an access authentication result storage procedure stored in the application. 4. A determination authentication procedure for determining whether or not a user is a holder based on the CPU and a plurality of different types of user identification information, and if the result is affirmative, the CPU is provided with a determination authentication procedure. The CPU is mounted on an IC card including an authentication application storage unit that stores a plurality of authentication applications to be executed, and the CPU is used to manage personal authentication.
A management application for executing the authentication selection request, the management application having an authentication selection procedure for selecting the authentication application to be executed by the CPU in response to the authentication selection request. . 5. The management application according to claim 4, further comprising an authentication result storage procedure for storing an authentication result which is a result of the determination authentication procedure. 6. An IC card equipped with a CPU,
An authentication-required application whose main function is that a predetermined identity authentication is performed, wherein one or a plurality of other applications installed in the IC card are accessed to access the predetermined application. An authentication-required application, comprising an access authentication procedure for causing the CPU to execute the function of authenticating the person. 7. The CPU and the CPU are caused to execute a judgment authentication procedure for judging whether or not the user is a holder based on different types of user identification information, and authenticating the user if the user is affirmative. An IC card, comprising: an authentication application storage unit that stores the plurality of authentication applications according to claim 1 or 2. 8. A plurality of authentication means for determining whether or not a user is a holder based on different types of user identification information, and if affirmative, a plurality of authentication means and an authentication selection request. And an authentication selection unit that selects an authentication unit that should make the determination in response to the request. 9. The IC card according to claim 8, wherein a CPU and a predetermined identity authentication are used as main function execution requirements, and an authentication required application for storing the authentication selection request is stored. Application storage means, authentication application storage means for storing a plurality of authentication applications for realizing the plurality of authentication means by causing the CPU to execute, authentication-required application identification information for identifying the authentication-required application, and the authentication application Authentication selection information associated with the authentication application identification information for identifying the authentication selection information storage means for storing in the management application accessible from the authentication-required application, the authentication selection means, in the authentication selection information Making a selection based on IC card. 10. The IC card according to claim 9, wherein the authentication application storage unit stores the authentication application according to claim 1 or 2. 11. The IC according to claim 9 or 10.
An IC card, comprising: an authentication result storage unit that stores an authentication result, which is a result of the determination authentication procedure, in one application.