JP5822123B2 - Security token, data update method, and computer program - Google Patents

Description

  The present invention relates to a technique for verifying the consistency of data stored in a memory of a security token represented by an IC card.

  A data object used in a secure service is stored in a memory of a security token represented by an IC card. As disclosed in Patent Document 1, this data object includes data included in the data object. An error detection code (Error Detection Code) is added so that it can be verified that there is no error.

  In the conventional method of verifying data consistency using an error detection code, when data is read from a data object stored in the security token memory, (R1) the data object containing the data to be read is included. A step of calculating an error detection code; (R2) a step of verifying the error detection code added to the data object for which the error detection code has been calculated and the calculated error detection code; and (R3) if the error detection code is successfully verified, The steps of reading data to be read from the data object are executed in order. Further, when updating the data included in the data object, after executing (R1) and (R2) described above, and (U1) succeeding in collating the error detection code, the step of updating the data to be updated (U2) A step of calculating an error detection code after updating the updated data object, and (U3) a step of updating the error detection code added to the updated data object are sequentially executed.

  However, in the above-described procedure, if the data not to be updated is falsified or garbled between (U1) and (U2) at the time of update, In U2), an error detection code is calculated in a state including erroneous data not to be updated. For example, when data is read from a data object, it cannot be detected that the data object has an error. .

  The above contents will be described with reference to FIG. FIG. 5 is a diagram for explaining a case where the conventional technique is insufficient. In FIG. 5, the size of the data object is 8 bytes, and a 2-byte error detection code (in this case, CRC16) is added to the data object. Yes.

  FIG. 5A is a diagram for explaining a data object before updating data. All data included in the data object before updating data is “00h” and is added to the data object. The error detection code is “66BBh”.

  FIG. 5B is a diagram for explaining the contents of the step (U1) for updating data to be updated. In FIG. 5B, 2 bytes of D3 and D4 of the data object are data to be updated, and the content of D3 of the data object is updated from “00h” to “AAh”, and D4 is updated from “00h” to “BBh”. Thus, the data of D6 that is not subject to update due to data corruption or data tampering attack is illegally updated from “00h” to “FFh”.

  FIG. 5C is a diagram for explaining the contents of the step (U2) of calculating the error detection code of the updated data object. The error detection code of the updated data object is included in the updated data object. In FIG. 5C, the updated error detection code is calculated including the illegally updated data D6, and the officially updated error detection code is “ In spite of becoming “4E3Fh” calculated from “0000AABB00000000h”, “2E3Eh” is calculated as the updated error detection code.

  FIG. 5D is a diagram for explaining the contents of the step (U3) of updating the error detection code added to the updated data object. The calculation is performed including the data of D6 that is illegally updated. 2E3Eh "is added to the data object whose data has been updated, and even if the error detection code is collated when the data object is read after the update, it is calculated from the content of the updated data object and the content of the data object. Since the error detection codes to be matched coincide with each other, it is impossible to detect that the illegally updated data (D6 data here) is included in the updated data object.

Japanese Patent No. 3321448

  As described above, in the conventional method of verifying data consistency using an error detection code, when data of a data object stored in a memory of a security token is updated, data that is not an update target is illegally updated. However, there was a problem that it was not possible to detect that the data not subject to update was updated illegally.

  Therefore, according to the present invention, when the data of the data object stored in the memory of the security token is updated, it is detected that the data that is not the update target is illegally updated even if the data that is not the update target is illegally updated. An object is to provide a security token and method that can be used.

According to a first aspect of the present invention for solving the above-described problem, when a data update command for designating data to be updated is received for data included in a data object stored in a memory, before the data to be updated is updated to the advance from data contained in the data object to calculate the EDC before data update from the data outside updated excluding data to be the updated after updating the data to be the update target, the update exempt and EDC after the data update calculated from data of a security token with data updating means for matching the EDC before data update calculated from data outside the update target.

  According to a second invention, in the security token of the first invention, the data updating means updates the data to be updated, and then updates the EDC after data update calculated from the data not to be updated. Only when the EDC before the data update calculated from the data not to be updated is successfully verified, the EDC after the data update of the data object is calculated, and the EDC added to the data object is used as the EDC after the data update. The security token to be updated.

  Furthermore, in a third invention for solving the above-described problem, when a security token receives a data update instruction for designating data to be updated with respect to data included in a data object stored in a memory, the security token is: Before updating the data to be updated, calculating the EDC before data update from the data not to be updated excluding the data to be updated from the data included in the data object, the security token is: After updating the data to be updated, step 2 is executed in order to collate the EDC after data update calculated from the data not to be updated with the EDC before data calculated from the data not to be updated. This is a data update method.

According to a fourth aspect of the present invention, in the data update method according to the third aspect, after the execution of the step 2, the security token is an EDC after data update calculated from the data not to be updated; Only when the EDC before the data update calculated from the data not to be updated is successfully verified, the EDC after the data update of the data object is calculated, and the EDC added to the data object is updated to the EDC after the data update. This is a data update method for executing step 3.

  Furthermore, the fifth invention for solving the above-mentioned problem updates the data to be updated when receiving a data update command for designating data to be updated with respect to data included in the data object stored in the memory. Step 1 of calculating EDC before data update from data not to be updated excluding data to be updated from data included in the data object before updating, updating the data to be updated It is a computer program for causing a security token to execute step 2 for collating EDC after data update calculated from non-target data and EDC before data calculated from non-update data.

According to a sixth aspect of the present invention, in the computer program according to the fifth aspect, after the execution of the step 2, the EDC after the data update calculated from the non-update target data and the non-update target data are calculated. Only when the verification of the EDC before the data update is successful, the EDC after the data update of the data object is calculated, and the step 3 of updating the EDC added to the data object to the EDC after the data update is performed as the security token. This is a computer program to be executed.

  According to the present invention described above, when the data object data stored in the memory of the security token is updated, the error detection code calculated from the data object data not to be updated and the data are updated before the data is updated. After the update, the error detection code calculated from the data of the data object that is not the update target is collated, so even if the data of the data object that is not the update target is updated illegally, the data that is not the update target is incorrect It becomes possible to detect that it has been updated.

The figure explaining an example of a security token. Block diagram of a security token. The flowchart explaining operation | movement of a data update means. FIG. 6 is a supplementary diagram for explaining the operation of the data updating means. The figure explaining the case inadequate in the conventional method.

  Now, preferred embodiments of the present invention will be described in detail with reference to the drawings. The embodiment described below is only one embodiment of the present invention, and various modifications and changes are possible.

  FIG. 1 is a diagram illustrating an example of a security token. A security token 1 according to the present embodiment is a device that has a memory therein and is configured to be able to communicate data with an external device. In FIG. 1, the security token 1 is illustrated as an IC card (smart card, chip card). However, the form of the security token 1 is not limited to the IC card, and may be a form of a USB key.

  FIG. 2 is a block diagram of the security token 1. The security token 1 of the present embodiment includes a CPU 100, a RAM 101, a ROM 102 (Read # Only Memory), an EEPROM 104 (Electrically Erasable Programmable Read-Only Memory), a UART 103 (Universal Asynchronous Receiver Transmitter) corresponding to a specific protocol, and a specific operation. In this embodiment, the data module 11 is stored in the EERPOM 104 and operates when updating the data included in the data object 11. A computer program that functions as 10 is mounted in the ROM 102.

  In the present embodiment, the data object 11 stored in the EEPROM 104 is a data block such as a binary or record type data file, a page memory in which the EEPROM 104 is divided into a predetermined size, or a data object in the BER-TLV format. The data updating means 10 realized by a computer program installed in the ROM 102 of the security token 1 updates the data included in the data object 11 so that the problems described in the prior art do not occur. Is designed to verify that data that is not subject to update has not been updated.

  As a method for verifying that the data not to be updated is not updated, before updating the data, the contents of the data object 11 including the data are temporarily buffered in the RAM 101, and the data is stored. After updating, the contents of the updated data object 11 and the contents buffered in the RAM 101 can be collated to verify whether the data not to be updated has been changed, but the size of the data object 11 is large. In this case, since the entire contents of the data object 11 may not be buffered in the RAM 101, the data updating unit 10 of the present embodiment uses the error detection code of the data not to be updated to update the data not to be updated. Verify that there is no.

  FIG. 3 is a flowchart for explaining the operation of the data updating unit 10 in the present embodiment, and FIG. 4 is a supplementary diagram for explaining the operation of the data updating unit 10.

  When the security token 1 receives the data object 11 containing the data to be updated and the data update command specifying the update target data and the update value from the external device (S1), the data update unit 10 of the security token 1 The data updating means 10 of the security token 1 first matches the error detection code calculated from the specified data object 11 with the error detection code added to the data object 11 to specify The error detection code added to the data object 11 is verified (S2).

  FIG. 4A is a diagram for explaining the designated data object 11. In FIG. 4, the size of the designated data object 11 is 8 bytes, all the data included in the designated data object 11 is “00h”, and the error detection code added to the designated data object 11 (In this case, CRC16) is “66BBh”.

  When the verification of the error detection code added to the designated data object 11 fails, the data updating process ends, but the data included in the designated data object 11 in FIG. Therefore, it is assumed here that the pre-update error detection code added to the specified data object 11 has been successfully verified.

  If the data update unit 10 of the security token 1 succeeds in verifying the error detection code added to the designated data object 11, the data update unit 10 before the data update is performed on the non-update target data from the designated data object 11. The error detection code before data update calculated from the data not to be updated is temporarily stored in the RAM 101 (S3).

  It should be noted that non-update target data is not illegally updated by temporarily storing in RAM 101 the error detection code before the data update calculated from the non-update target data instead of the non-update target data. The area of the RAM 101 necessary for verifying the error is the number of bytes of the error detection code (here, 2 bytes).

  FIG. 4B is a diagram for explaining an error detection code of data that is not an update target. In FIG. 4B, the data to be updated is D3 / D4, and the error detection code calculated from “000000000000h” obtained by combining D0, D1, D2, D5, D6, and D7 which are data not to be updated is It becomes “7459h”.

  When the data update unit 10 of the security token 1 calculates the error detection code before the data update for the data not to be updated, the data to be updated from the data included in the designated data object 11 Is updated to the updated value (S4).

  FIG. 4C illustrates the updated data object 11. 4C, the data to be updated is D3 / D4. In FIG. 4C, the content of D3 of the data object 11 is changed from “00h” to “AAh”, and D4 is changed from “00h” to “BBh”. It has been updated to. Here, the error detection code added to the data object 11 remains the value before update (here, “66BBh”).

  When the data update unit 10 of the security token 1 updates the data to be updated from the designated data object 11 to the update value, when the data to be updated is updated, the data update means 10 causes data corruption or data tampering attack. In order to verify that data not to be updated has been illegally updated, an error detection code after data update is calculated from the designated data object 11 for data that is not to be updated (S5).

  When the data update unit 10 of the security token 1 calculates the error detection code after the data update from the data not to be updated, the error detection code before the data update calculated from the data not to be updated (the error detection code is stored in the RAM 101). Stored) and the error detection code after data update are collated (S6), and if the collation is not successful, this procedure is terminated without updating the error detection code of the data object 11.

  FIG. 4D is a diagram illustrating a case where data that is not an update target is updated illegally. In FIG. 4C, D6, which is data that is not the update target, is illegally updated to “FFh”, and “00000000FF00h” is a combination of D0, D1, D2, D5, D6, and D7, which is the data that is not the update target. The error detection code after updating the data calculated from “1458h” is different from the error detection code “7459h” before updating the data. In the case of FIG. 4D, the error detection code is not updated. This procedure ends.

  The data update means 10 of the security token 1 is included in the data object 11 after the data update if the error detection code before the data update calculated from the data not to be updated and the error detection code after the data update are successfully verified. The updated error detection code is calculated from all the data (S7), the error detection code of the designated data object 11 is updated to the updated error detection code (S8), and this procedure is terminated.

  FIG. 4E is a diagram illustrating a case where data that is not an update target has not been updated illegally. In FIG. 4E, since the data that is not to be updated is not updated illegally and remains “00h”, the error detection code after update calculated from the content “0000AABB00000000h” of the updated data object 11 is “4E3Fh”, and the error detection code added to the data object 11 is updated from the value “66BBh” before update to the value “4E3Fh” after update.

  In this way, by comparing the error detection code before the data update calculated for the data that is not the update target with the error detection code after the data update, it is detected that there is an illegal error in the data that is not the update target. If the collation is not successful, the procedure is terminated without updating the error detection code of the data object, so that the next time the content of the data object 11 is read, the content of the data object 11 is read. Since the calculated error detection code (here, “2E3Eh”) and the error detection code added to the data object 11 (here, “66BBh”) are different, the data object that is illegally updated and includes data 11 is never used.

1 security token 10 data updating means 11 data object

Claims (6)

Upon receiving the data update instruction data to be updated for the data included in the stored data object in the memory is designated, before updating the data to be the update target, the update from the data contained in the data object leave calculates EDC before data update from the update excluded data except data of interest, the update subject to data after update, and EDC after the data update calculated from the updated data outside, security token comprising the data updating means for matching the EDC before data update calculated from the updated data outside. The data updating means is for comparing the EDC after the data update calculated from the data not to be updated after the data to be updated is updated and the EDC before the data update calculated from the data not to be updated. 2. The security token according to claim 1, wherein the EDC after data update of the data object is calculated only when the data object is successful, and the EDC added to the data object is updated to the EDC after the data update. When a data update instruction data comprising the data subject to update contained in the data stored object in memory is designated security token receives the security token, before updating the data to be the update target, the data step 1 calculates the EDC before data update from the data outside the update target from the data included in the object except for data to be the update target, after the security token, updating the data to be the update target, the update target A data update method, wherein step 2 of collating EDC after data update calculated from outside data and EDC before data update calculated from data not to be updated is sequentially executed. After the execution of the step 2, the security token is obtained only when the EDC after the data update calculated from the non-update target data and the EDC before the data update calculated from the non-update target data are successfully verified. 4. The data update according to claim 3, wherein step 3 of calculating EDC after data update of the data object and updating EDC added to the data object to EDC after the data update is executed. Method. When receiving a data update command specifying data to be updated with respect to data included in a data object stored in a memory, the update is performed from the data included in the data object before updating the data to be updated. step 1 calculates the EDC before data update from the update excluded data except data of interest, after updating the data to be the update target, and EDC after the data update calculated from the updated data outside, computer program for executing the steps 2 to match the EDC before data update calculated from the updated data outside the security token. After the execution of the step 2, the data update of the data object is performed only when the EDC after the data update calculated from the non-update target data and the EDC before the data update calculated from the non-update target data are successfully collated. 6. The computer program according to claim 5, wherein the security token is caused to execute step 3 of calculating a later EDC and updating an EDC added to the data object to an EDC after the data update.

Images