JP2004334471A - Information card - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information card which enables a tamper resistance process module (IC chip card) to process information of a memory unit separated from the module. <P>SOLUTION: The information card comprises a memory unit 30, the tamper resistance processing module 20 and having an information processing function, and a controller 10 for controlling an access to the memory unit in response to an instruction received from an external apparatus 200. The controller 10 comprises a command transfer means (3) for transferring the instruction as a command to the tamper resistance processing module 20 which is sent from the external apparatus 200 to the tamper resistance processing module 20, and an internal access controller (5)-(7) which controls the access to the memory unit 30 by the processing module 20 being not tampered based on the command. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an information card, and more particularly, to an information card for writing and reading information under the control of an external device.
[0002]
[Prior art]
Conventionally, various information cards such as a memory card and an IC card have been proposed. Memory cards such as an SD (Secure Digital) card and a compact flash (registered trademark) card are equipped with a large-capacity memory such as a flash memory, and are host devices such as a personal digital assistant (PDA), a digital camera, and a personal computer. Is used as an external memory. In such a memory card, information such as images, music, and text is written and read in response to access from a host device. The IC card is a card in which an IC chip including a CPU and a memory is embedded, and is used as a highly secure information card having an arithmetic function. In this IC card, predetermined arithmetic processing is performed by the operation of the CPU based on a request from an external device, and information obtained by the arithmetic processing is stored in a memory and the stored information is transmitted to the external device. And so on.
[0003]
Further, there has been proposed an information card on which a tamper-resistant IC card chip and a memory element such as an EEPROM are mounted (for example, Patent Document 1). In this information card, different information is stored in a memory and a memory element in an IC card chip, and any information can be used by an external device.
[0004]
[Patent Document 1]
JP-A-9-237298
[0005]
[Problems to be solved by the invention]
However, in the conventional information card in which the IC card chip and the memory element are separately mounted, the CPU of the IC card chip cannot process the information of the memory element. Therefore, the information of the memory element cannot be processed by the tamper-resistant IC card chip (CPU).
[0006]
The present invention has been made in order to solve such a drawback, and an information card in which a tamper-resistant processing module (such as an IC card chip) can process information in a memory unit that is separate from the processing module. Is provided.
[0007]
[Means for Solving the Problems]
An information card according to the present invention includes: a memory unit; a tamper-resistant processing module having an information processing function; and a control unit that controls access to the memory unit when receiving a command from an external device. A command transmission means for transmitting an instruction addressed to the tamper-resistant processing module from the external device to the tamper-resistant processing module; and the memory unit of the tamper-resistant processing module based on the instruction transmitted by the command transmission means. And internal access control means for controlling access to the server.
[0008]
With such a configuration, it is possible to access the memory unit by the tamper-resistant processing module based on an instruction from an external device.
[0009]
Further, the information card according to the present invention, the control unit has a memory management unit that manages a predetermined area of the memory unit as an area that can be used by the tamper-resistant processing module, the internal access control unit, The tamper-resistant processing module may be configured to control access to a predetermined area managed by the memory management unit.
[0010]
With such a configuration, an area accessible by the tamper-resistant processing module in the memory unit is limited to a predetermined area.
[0011]
Further, the information card according to the present invention may be configured such that the memory management means manages the predetermined area of the memory unit as an area exclusively used by the tamper-resistant processing module.
[0012]
With such a configuration, a predetermined area of the memory unit can be accessed only by the tamper-resistant processing module.
[0013]
An information card according to the present invention includes: a memory unit; a tamper-resistant processing module having an information processing function; and a control unit that controls access to the memory unit when receiving a command from an external device. A command transmission means for transmitting an instruction addressed to the tamper-resistant processing module from the external device to the tamper-resistant processing module; and the memory by the tamper-resistant processing module based on the instruction transmitted by the command transmission means. The internal access control unit controls access to the memory unit, and the external access control unit controls access to the memory unit by the external device based on a command from the external device.
[0014]
With such a configuration, both access to the memory unit by the tamper-resistant processing module based on an instruction from the external device and access to the memory unit by the external device are possible.
[0015]
Further, in the information card according to the present invention, the control unit may use the first area of the memory unit as an area exclusively usable by the tamper-resistant processing module and set the second area of the memory unit to an external device. Has a memory management means for managing each area as a dedicated use area, and the internal access control means controls access by the tamper resistant processing module to the first area managed by the memory management means. The external access control means may control access to the second area managed by the memory management means by the external device.
[0016]
With such a configuration, only the tamper-resistant processing module can access the first area of the memory unit, and only the external device can access the second area of the memory unit. As a result, it is possible to store the information in the memory unit separately based on the necessity of confidentiality.
[0017]
Further, in the information card according to the present invention, the control unit may set the first area of the memory unit as an area exclusively usable by the tamper-resistant processing module and set the second area of the memory unit to an external device. Has a memory management means for managing a third area of the memory unit as an area that can be exclusively used as an area that can be used by both the tamper-resistant processing module and the external device; Means for controlling access by the tamper-resistant processing module to any of the first area and the third area managed by the memory management means, wherein the external access control means The configuration may be such that access by the external device to any of the managed second area and third area is controlled.
[0018]
With such a configuration, only the tamper-resistant module can access the first area of the memory unit, and only the external device can access the second area of the memory unit. Both the tamper-resistant processing module and the external device can access the third area. As a result, it is possible to store information in the memory unit separately based on the necessity of confidentiality, and to store information that can be processed by both the external device and the tamper-resistant processing module in the memory unit. It becomes possible.
[0019]
The information card according to the present invention may be configured such that data necessary for processing in the tamper-resistant processing module is stored in the first area of the memory unit.
[0020]
With such a configuration, more data required for processing by the tamper-resistant processing module can be stored in the information card. As a result, the tamper-resistant module can be multifunctional.
[0021]
Further, the information card according to the present invention may be configured such that a processing program to be executed by the tamper-resistant processing module is stored in the first area of the memory unit.
[0022]
According to such a configuration, more processing programs to be executed by the tamper-resistant processing module can be stored in the information card according to the capacity of the memory unit. As a result, the tamper-resistant module can be multifunctional.
[0023]
Further, in the information card according to the present invention, the tamper-resistant processing module includes an encryption key and means for encrypting data or a processing program to be stored in the first area of the memory unit using the encryption key. And the data or the processing program may be encrypted and stored in the first memory unit of the memory unit.
[0024]
With such a configuration, even if the memory unit does not have tamper resistance, data or a processing program usable in the tamper resistant processing module can be stored in the memory unit with higher security secured. it can.
[0025]
In the information card according to the present invention, the command transmission unit has a command extraction unit that extracts a command addressed to the tamper-resistant processing module from a command from the external device, and the command extraction unit extracts the command extracted by the command extraction unit. A configuration may be adopted in which the information is transmitted to the tamper-resistant processing module.
[0026]
With such a configuration, even if the tamper-resistant processing module performs processing according to its own instruction system, an instruction that can be interpreted by the tamper-resistant processing module can be easily given to the tamper-resistant processing module from an external device. Can be done.
[0027]
Further, in the information card according to the present invention, when the command extraction unit receives a predetermined control command from the external device prior to the command from the external device, the command extraction unit may execute the command from the command from the external device. It is possible to adopt a configuration in which an instruction addressed to the tamper processing module is extracted.
[0028]
With such a configuration, when a predetermined control command is sent from the external device, a command addressed to the tamper-resistant processing module is extracted from a command subsequently sent from the external device. Processing for extracting an instruction addressed to the tamper-resistant processing module from an instruction from an external device can be reliably performed.
[0029]
The tamper-resistant processing module is not particularly limited as long as it has a certain mechanism (tamper resistance) for protecting internal information against external attacks (hardware or software). In the information card according to the present invention, the tamper-resistant module may be an IC card chip.
[0030]
Embodiment
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0031]
An information card according to an embodiment of the present invention is configured as shown in FIG.
[0032]
In FIG. 1, an information card 100 is connected to a host device 200 (external device) such as a personal digital assistant (PDA), a mobile phone, a digital camera, and a personal computer. The interface of the information card 100 to the host device 200 can be, for example, equivalent to a known memory card (for example, an SD card). The information card 100 includes a controller 10, a tamper-resistant module (hereinafter, referred to as TRM) 20, and a memory unit 30. With the information card 100 connected to the host device 200, information can be exchanged between the host device 200 and the controller 10 via the interface.
[0033]
The TRM 20 includes, for example, a CPU having an information processing function and an internal memory (for example, E ² ROM) and an external hardware such as a mechanism that makes data leakage by probing difficult, a mechanism that erases internal information when destroyed, and a mechanism that encrypts internal information. It has a mechanism (tamper resistance) that protects internal information against static or soft attacks. The memory unit 30 is constituted by a large-capacity flash memory. The controller 10 controls information exchange between the host device 200 and the TRM 20 and controls access to the memory unit 30.
[0034]
The controller 10 has a memory management table 11 and manages the area of the memory unit 30 using the memory management table 11. When the information card 100 is initialized, the controller 10 defines, for example, the area E1 of the memory unit 30 on the memory management table 11 as an area exclusively used by the TRM 20 (security protection area). Further, with respect to other areas of the memory unit 30, the controller 10 sets the area E2 as an area exclusively usable by the host device 200 (general memory area for external device), and further sets the area E3 of the TRM 20 and the host device 30. Each area is defined on the memory management table 11 as an area that can be used by both (external device / TRM common area). The controller 10 includes an interface for accessing the memory unit 30 of the host device 200 (an interface equivalent to an interface on a known memory card (for example, an SD card)) and an interface for accessing the memory unit 30 of the TRM 20. The access to the memory unit 30 by the host device 200 and the TRM 20 is controlled using the management table 11.
[0035]
Hereinafter, the operation of the information card 100 will be described.
[0036]
The host device 200 sends a command according to a command system for a known memory card (for example, an SD card) to the information card 100, for example. When the controller 10 inputs an access request command (read / write command) to the memory unit 30 from the host device 200, the controller 10 refers to the memory management table 11 and sets an area related to the access request as an area that can be used by the host device 200. It is determined whether or not there is. The controller 10 controls access to the area related to the access request if the area related to the access request is one of the external device general memory area E2 and the external apparatus / TRM common area E3 available in the host device 200. (Read / write control). As a result, the host device 200 can read and write information from or to any of the external device general memory area E2 and the external device / TRM common area E3 of the memory unit 30 (marked with a circle in FIG. 2). Solid arrow).
[0037]
On the other hand, when it is determined that the area related to the access request is the security protection area E1 that cannot be used by the host device 200, the controller 10 rejects the access request from the host device 200 and sends an error response to the host device 200. Send to 200. As a result, the host device 200 cannot read or write information from or to the security protection area E1 of the memory unit 30 (see a solid arrow with a cross in FIG. 2). That is, the confidentiality of the information stored in the security protection area E1 can be ensured.
[0038]
When sending a command related to a processing request to the TRM 20, the host device 200 sends a command in a format that encapsulates a command of a command system applied to the TRM 20 to the information card 100. Specifically, a command for a known memory card (for example, an SD card) includes an IC card command (hereinafter, referred to as an APDU (Application Protocol Data Unit) command) defined by ISO7816 applied to the TRM 20 (IC card chip). The encapsulated extended format command is sent from the host device 200 to the information card 100.
[0039]
When the extended format command in which the APDU command related to the processing request is encapsulated is input from the host device 200, the controller 10 extracts the APDU command related to the processing request from the extended format command, and converts the extracted APDU command into Send to TRM20. The TRM 20 sends an access request command of a predetermined format to the controller 10 when an access to the memory unit 30 is required in a process performed according to a processing program in the internal memory based on an APDU command related to a processing request from the controller 10. . The controller 10 refers to the memory management table 11 and determines whether or not the area related to the access request is an area that can be used by the TRM 20. The controller 10 performs access control (read / write control) on the area related to the access request if the area related to the access is one of the security protection area E1 and the external device / TRM common area E3 available in the TRM 20. Do. As a result, the TRM 20 can read and write information from or to any of the security protection area E1 and the external device / TRM common area E3 of the memory unit 30 (see the dashed arrow with a circle in FIG. 2).
[0040]
On the other hand, when it is determined that the area related to the access request is the external device general memory area E2 that cannot be used by the TRM 20, the controller 10 rejects the access request from the TRM 20 and sends an error response to the TRM 20. . As a result, the TRM 20 cannot read and write information from and to the general memory area E2 for the external device of the memory unit 30 (see the dashed arrow marked with X in FIG. 2).
[0041]
With reference to FIGS. 3 and 4, a more specific processing procedure will be described. In this example, a processing procedure relating to a reference request (data reading) to the memory unit 30 is shown.
[0042]
In the processing procedure (1) shown in FIG. 3, when a command for requesting reference to the external device general memory area E2 of the memory unit 20 is sent from the host device 200 to the controller 100 ((1)), the controller 10 With reference to the memory management table 11, it is determined that the external device general memory area E2 related to the reference request is an area that can be used by the host device 200. In accordance with the determination result, the controller 10 refers to the external device general memory area E2 of the memory unit 30 ((2)) and reads data (reference result data) from the external device general memory area E2 ((2)). 3 ▼). Then, the controller 10 sends the read data to the host device 200 ([4]). Thereby, the host device 200 can obtain the data relating to the reference request from the information card 100.
[0043]
Further, in the processing procedure (2) shown in FIG. 3, when a command related to a reference request for the security protection area E1 of the memory unit 20 is sent from the host device 200 to the controller 10 ((1)), the controller 10 performs memory management. Referring to the table 11, it is determined that the security protection area E1 related to the reference request is an area that cannot be used by the host device 200. In response to this determination result, the controller 10 rejects the reference request and sends an error response to the host device 200 ((2)). That is, the information in the security protection area E1 of the memory unit 30 cannot be referred to by the external device (host device 200).
[0044]
Further, in the processing procedure (3) shown in FIG. 4, the host device 200 discriminates the extended format command (encapsulated SD command) from the extended format command before sending the extended format command (encapsulated SD command). A switch command which is a control command to be transmitted is sent to the controller 10 ((1)). Thereafter, the host device 200 sends the extended format command to the controller 10 ((2)). When receiving the switch command, the controller 10 extracts the APDU command from the extended format command without recognizing that the extended format command received next is a command of a processing request to the memory unit 30. Then, the controller 10 sends an APDU command related to the extracted reference request to the TRM 20 ([3]).
[0045]
The TRM 20 sends a command for a reference request for the security protection area E1 to the controller 10 based on the APDU command related to the reference request ([4]). Then, the controller 10 refers to the memory management table 11 and determines that the security protection area E1 related to the reference request is an area that can be used in the TRM 20. In accordance with the determination result, the controller 10 refers to the security protection area E1 of the memory unit 30 (5), and reads data (reference result data) from the security protection area E1 (6). Then, the controller 10 sends the read data to the TRM 20 ([7]). The TRM 20 that has acquired the data (reference result data) related to the reference request in this way sends a APDU command representing the reference result to the controller 10 after performing necessary processing on the data ([8]). The controller 10 encapsulates the APDU command response into a command for a known memory card (for example, an SD card) to create an extended format command, and sends the extended format command to the host device 200 as a response to the reference request.
[0046]
Through such processing, the information in the security protection area E1 of the memory unit 30 that cannot be processed by the host device 200 can be processed by the TRM 20.
[0047]
According to the information card 100 as described above, both the host device 200 and the TRM 20 (IC card chip) can access the memory unit 30. Therefore, the information card 100 can be used as a normal memory card and can be used as a normal IC card. It becomes possible to use as. In addition, since the area of the memory unit 30 that can be accessed by the TRM 20 can be set freely, it becomes possible to perform highly confidential processing by the TRM 20 for more information.
[0048]
In the information card 100 as described above, data necessary for the processing of the TRM 20 such as an encryption key, personal authentication data used in various services, a password, a prepaid amount data, It is preferable to store data requiring high secrecy, such as money information, various card information, and personal information. As a result, more information can be stored with higher confidentiality than the memory in a normal IC card chip, so that more processes (functions) can be realized by the TRM 20 (IC card chip). .
[0049]
In the security protection area E1, a processing program (such as a JAVA (registered trademark) applet) to be executed by the TRM 20 can be stored. As a result, more programs can be stored with higher confidentiality than the memory in the normal IC card chip, so that more processes (functions) can be realized by the TRM 20 (IC card chip). .
[0050]
The TRM 20 has a mechanism for protecting internal information against an external attack (hard or soft), but the memory unit 30 generally does not have such tamper resistance. . Therefore, data and processing programs stored in the security protection area E1 of the memory unit 30 are protected from access from an external device (host device 200). Unavoidable from the danger of leakage to the outside. In order to minimize such a risk, information (data, processing program) to be stored in the security protection area E1 can be further encrypted. This encryption process can be performed by the TRM 20 using the encryption key stored in the internal memory. By encrypting the data and the processing program stored in the security protection area E1 of the memory unit 30 with a strength corresponding to a desired security level, the data and the processing program can be further securely stored in the information card 100. Can be.
[0051]
In order to improve the tamper resistance of the security protection area E1 of the memory unit 30, the interface between the TRM 20 and the memory unit 30 in the controller 10 may be subjected to data protection such as address scrambling. preferable.
[0052]
In the example described above, the memory unit 30 is divided into three areas: the security protection area E1, the external device general memory area E2, and the external apparatus / TRM common area E3. The area E1 or the external device / TRM common area E3 may be used. The memory unit 30 may be divided into two areas, that is, a security protection area E1 and an external device general memory area E2, and may further include an external apparatus / TRM common area E3 and an external apparatus general memory area E2. It may be divided into regions. Further, the memory unit 30 may be divided into two parts, a security protection area E1 and an external device / TRM common area E3. The controller manages the area of the memory unit 30 according to each of the above-described methods.
[0053]
In the configuration of the information card 100, the controller 10 is a control unit (claims 1 and 4), the TRM 20 is a tamper-resistant processing module (claims 1 and 4), and the memory unit 30 is a memory unit (claims). A control function (see (3) shown in FIG. 4) related to information exchange between the host device 200 and the TRM 20 in the controller 10 is a command transmission means (claim 1, claim 4). 4), and an interface for accessing the memory unit 30 of the TRM 20 in the controller 10 (see the dotted arrows with circles in FIG. 2; see (5) to (7) in FIG. 4). (Claims 1 and 4). The area management function of the memory unit 30 of the controller 10 using the memory management table 11 corresponds to a memory management means (claims 2, 5, and 6). An interface (a solid arrow with a circle in FIG. 2 and (2) to (4) shown in FIG. 3) for access to the memory unit 30 of the host device 200 in the controller 10 is provided by an external access control means (claim). The function of the controller 10 that extracts the APDU command from the SD command after the procedure (2) shown in FIG. 4 corresponds to the command extraction means (claim 10).
[0054]
【The invention's effect】
As described above, according to the present invention, the tamper-resistant processing module can access the memory unit based on an instruction from an external device. Therefore, a tamper-resistant processing module (such as an IC card chip). Can provide an information card that can process information in a memory unit that is separate from the information card.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of an information card according to an embodiment of the present invention.
FIG. 2 is a diagram showing a state of access control to a memory unit in the information card shown in FIG.
FIG. 3 is a sequence diagram showing a processing procedure in the information card shown in FIG. 1 (part 1);
FIG. 4 is a sequence diagram showing a processing procedure in the information card shown in FIG. 1 (part 2);
[Explanation of symbols]
10 Controller
11 Memory management table
20 Tamper resistant module (TRM)
30 Memory section
100 Information Card
200 Host device

Claims (12)

A memory unit, comprising a tamper-resistant processing module having an information processing function, and a control unit that controls access to the memory unit when receiving a command from an external device,
The control unit, a command transmission means for transmitting a command addressed to the tamper-resistant processing module from the external device to the tamper-resistant processing module,
An information card, comprising: an internal access control unit that controls access to the memory unit of the tamper-resistant processing module based on a command transmitted by the command transmission unit. The control unit has a memory management unit that manages a predetermined area of the memory unit as an area that can be used by the tamper-resistant processing module,
2. The information card according to claim 1, wherein the internal access control unit controls access to the predetermined area managed by the memory management unit by the tamper-resistant processing module. 3. The information card according to claim 2, wherein the memory management unit manages the predetermined area of the memory unit as an area exclusively used by the tamper-resistant processing module. A memory unit, a tamper-resistant processing module having an information processing function, and a control unit that controls access to the memory unit when receiving a command from an external device,
The control unit, a command transmission means for transmitting a command addressed to the tamper-resistant processing module from the external device to the tamper-resistant processing module,
Internal access control means for controlling access to the memory unit by the tamper resistant processing module based on the command transmitted by the command transmission means,
An information card, comprising: external access control means for controlling access to the memory unit by the external device based on a command from the external device. The control unit sets a first area of the memory unit as an area exclusively used by the tamper-resistant processing module and a second area of the memory unit as an area exclusively used by an external device. Has a memory management means for managing,
The internal access control unit controls access by the tamper-resistant processing module to the first area managed by the memory management unit, and the external access control unit manages access to the first area managed by the memory management unit. 5. The information card according to claim 4, wherein access to the second area by the external device is controlled. The control unit, the first area of the memory unit as an area exclusively available to the tamper-resistant processing module, the second area of the memory unit as an area exclusively available to external devices, A memory management unit that manages a third area of the memory unit as an area that can be used by both the tamper-resistant processing module and the external device,
The internal access control means controls access by the tamper resistant processing module to any of the first area and the third area managed by the memory management means, and the external access control means 5. The information card according to claim 4, wherein the external device controls access to one of the second area and the third area managed by management means. 7. The information card according to claim 5, wherein data necessary for processing in the tamper-resistant processing module is stored in the first area of the memory unit. The information card according to claim 5, wherein a processing program to be executed by the tamper-resistant processing module is stored in the first area of the memory unit. The tamper-resistant processing module has an encryption key, means for encrypting data or a processing program to be stored in the first area of the memory unit using the encryption key,
9. The information card according to claim 7, wherein the data or the processing program is encrypted and stored in the first memory unit of the memory unit. The command transmitting unit includes a command extracting unit that extracts a command addressed to the tamper-resistant processing module from a command from the external device, and transmits the command extracted by the command extracting unit to the tamper-resistant processing module. The information card according to any one of claims 4 to 9, wherein: The command extracting means extracts a command addressed to the tamper-resistant processing module from a command from the external device when a predetermined control command is sent from the external device prior to a command from the external device. The information card according to claim 10, wherein: 12. The information card according to claim 1, wherein the tamper-resistant module is an IC card chip.

Images