JP7009844B2 - Update method and update program using electronic information storage medium, IC card, electronic information storage medium - Google Patents

Description

The present invention relates to a technical field of an electronic information storage medium such as an IC (Integrated Circuit) chip.

Conventionally, in an IC card incorporating an electronic information storage medium such as an IC chip, a multi-application that stores an IC card OS (Operating System) in the ROM of the IC chip and also stores a plurality of applications in the non-volatile memory of the IC chip. Type IC cards are becoming widespread. In the multi-application type IC card, the application program and the application instance generated from the application program (these may be collectively referred to as "application") are stored in the non-volatile memory, so that the application can be added or deleted. It is relatively easy to do.

In addition, the application may be updated (upgraded) for the purpose of dealing with a defect found in the application mounted on the IC chip or for the purpose of adding a function to the application. Patent Document 1 discloses a technique relating to a multi-application IC chip having an application update (update) function. Specifically, the part where the IC chip receives the address (for example, page number) for specifying the update target part in the program code from the server and the program code to overwrite the update target part from the server and is specified by the received address. The technology to overwrite with the received program code is disclosed.

However, in the technique of Patent Document 1, since the update target portion is overwritten by the overwrite program, the update may not be performed when the data amount of the overwrite program exceeds the data amount of the update target portion.

On the other hand, as another method for updating an application, there is also a method of temporarily deleting the application program and the application instance to be updated, loading the updated version of the application program, and generating the application instance from the application program. In the case of this method, the update is possible even when the data amount of the program after the update is larger than the data amount of the program before the update.

Hereinafter, the application program may be referred to as ELF (Executable Load File), and the application instance may be referred to as AP. In addition, "old" and "new" may be added to clearly distinguish the ELF or AP before and after the update. For example, the ELF already placed on the IC chip may be described as an old ELF, and the updated ELF may be described as a new ELF to distinguish them.

Japanese Unexamined Patent Publication No. 2006-293706

When updating these ELFs and APs in a state where some APs are generated based on the ELF in the IC chip, as described above, the old ELF and the old AP on the IC chip are temporarily deleted, and the new ELF is used. And the new AP needs to be placed on the IC chip. Since these processes need to exchange a plurality of commands and responses with an external device, they are relatively heavy processes for the IC chip, and it is inevitable that a lot of time is required.

Therefore, there is a possibility that the load process and the installation process of another application may be interrupted during the update process of one application (ELF and AP generated from the ELF). At this time, the specific OS management information among the OS management information related to one application (information used when the OS manages ELF and AP, and may be called registry data) is the loading process and installation of another application. It is necessary to properly inherit to one application (new ELF and new AP generated from the new ELF) even after the update process without being affected by the process. Here, the specific OS management information is, for example, information indicating which ELF or AP the exclusive target (for example, AID or privilege) assigned to only one ELF or AP in the IC chip is assigned. Is.

When the application update process is started and "Delete old ELF and old AP" is executed, if the old ELF and old AP are simply deleted, the process interrupted during the update process will be the old ELF and old AP. There is a possibility of making an allocation request for the monopoly target assigned to the AP. If the OS allocates according to the request, there arises a problem that the new ELF and the new AP cannot take over the monopoly target. For example, when updating, if the AID of a certain AP cannot be inherited from the old AP to the new AP, the external device that has been communicating with that AP will specify the same AID for the new AP to be communicated. After updating the AP, it will not be possible to communicate with that AP.

Therefore, the present invention is an application that appropriately updates even after the update process without allocating the exclusive target assigned only to the update target to another application program or application instance during the update process of the application program and the application instance. An object of the present invention is to provide an electronic information storage medium or the like that can be inherited by a program or an application instance.

In order to solve the above problem, the invention according to claim 1 is a storage means for storing an application program and an application instance, and a deletion process for deleting the application program and the application instance to be updated as a deletion target. Means, a load means for executing a load process for storing a new application program which is a new version of the application program to be updated in the storage means, and a load means stored in the storage means after the deletion process and the load process. An installation means that generates a new version of a new application instance based on the new application program and stores it in the storage means, and during execution of the deletion process, the load process, or the installation process. The exclusive target assigned only to the application program or application instance of the above, and the request to allocate the exclusive target assigned to the application program or application instance to be updated to other application programs and application instances is accepted. It is characterized in that it is provided with a refusal means for rejecting the request.

The invention according to claim 2 is the electronic information storage medium according to claim 1, and the exclusive object must be assigned to any application program or application instance stored in the storage means. Instead, when deleting the deletion target, the allocation means for allocating the exclusive target to the management application program or the management application instance that manages the deletion target, and the exclusive target assigned to the management application program or the management application instance. It is further provided with a reassignment means for reassigning to the new application program or the new application instance.

The invention according to claim 3 is the electronic information storage medium according to claim 1 or 2, and is an application program or application to be deleted while the deletion process, the load process, or the installation process is being executed. When a request for searching an instance is received from an external device, the external device is further provided with a response means for giving a response to the effect that the application program or application instance to be deleted does not exist.

The invention according to claim 4 is an IC card including the electronic information storage medium according to any one of claims 1 to 3.

The invention according to claim 5 is an update method using an electronic information storage medium including a storage means for storing an application program and an application instance, and a deletion process for deleting the application program and the application instance to be updated as a deletion target. A deletion step to be executed, a load process to execute a load process for storing a new application program which is a new version of the application program to be updated in the storage means, and a storage means after the deletion process and the load process. An installation process for generating a new version of a new application instance based on the new application program stored in the storage unit and executing an installation process for storing the new application instance in the storage means, and during execution of the deletion process, the load process, or the installation process. In addition, a request to allocate the exclusive target assigned to the application program or application instance to be updated to other application programs and application instances, which is an exclusive target assigned to only one application program or application instance. It is characterized by including a refusal step of rejecting the request when it is accepted.

The invention according to claim 6 executes a deletion process for deleting a computer included in an electronic information storage medium provided with a storage means for storing an application program and an application instance, for deleting the application program and the application instance to be updated. Deletion means to be deleted, load means for executing a load process for storing a new application program which is a new version of the application program to be updated in the storage means, storage in the storage means after the deletion process and the load process. During the execution of the installation means, the deletion process, the load process, or the installation process of generating a new version of a new application instance based on the new application program and storing the new application instance in the storage means. An exclusive target assigned only to an application program or application instance, and when a request to allocate the exclusive target assigned to the application program or application instance to be updated is accepted to another application program or application instance. , It is characterized in that it functions as a refusal means for rejecting the request.

According to the present invention, when the update target is deleted in order to update the application program or application instance to which the exclusive target has been assigned, a request for assigning the exclusive target to another application program or application instance is requested. Since this is rejected when it is accepted, the exclusive target can be taken over by the application program or application instance that has been appropriately updated even after the update process.

It is a figure which shows the hardware configuration example of the IC chip 1a mounted on the IC card 1 which concerns on this embodiment. It is a block diagram which shows the functional structure example of IC chip 1a. It is a figure which shows the configuration example of the registry data storage area 200 of the IC chip 1a. It is a table which listed the explanation about the state which is given to the state grant target such as AID and privilege in the update process. It is a sequence diagram which shows an example of the update process which concerns on this embodiment. It is a flowchart which shows an example of the save / deletion process by the IC chip 1a which concerns on this embodiment. It is a flowchart which shows an example of the installation / restoration process by the IC chip 1a which concerns on this embodiment. It is a flowchart which shows an example of privilege grant determination processing by IC chip 1a which concerns on this embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment when the present invention is applied to an IC card equipped with a multi-application IC chip having an application update function.

[1. Configuration of IC chip 1a]
First, the configuration of the IC chip 1a mounted on the IC card 1 will be described with reference to FIG. FIG. 1 is a diagram showing a hardware configuration example of an IC chip 1a mounted on an IC card 1. The IC card 1 of the present embodiment is a dual interface type IC card having two communication functions of contact data communication and non-contact data communication. However, the type of the IC card 1 is not limited to the dual interface type IC card, and may be a contact type IC card in which the IC chip 1a is embedded in a plastic card having the same size as a cash card or a credit card. Further, it may be a non-contact type IC card having a built-in antenna coil and wirelessly communicating data with a reader / writer.

As shown in FIG. 1, the IC chip 1a includes a CPU (Central Processing Unit) 10, a RAM (Random Access Memory) 11, a ROM (Read Only Memory) 12, a non-volatile memory 13, and an I / O circuit 14. It is composed. The CPU 10 is a processor (computer) that executes various programs stored in the ROM 12 or the non-volatile memory 13. The I / O circuit 14 serves as an interface with the external device 2. As a result, the IC chip 1a can communicate with or without contact with the external device 2 provided with the reader / writer. In the case of the contact type IC chip 1a, the I / O circuit 14 is provided with, for example, eight terminals C1 to C8. For example, the C1 terminal is a power supply terminal (terminal that supplies power to the IC chip 1a), the C2 terminal is a reset terminal, the C3 terminal is a clock terminal, the C5 terminal is a ground terminal, and the C7 terminal communicates with an external device 2. It is a terminal of. On the other hand, in the case of the non-contact type IC chip 1a, the I / O circuit 14 is provided with, for example, an antenna and a modulation / demodulation circuit. Examples of the external device 2 include an IC card issuing machine, an ATM, a ticket gate, an authentication gate, and the like. Alternatively, when the IC chip 1a is incorporated in a communication device, the external device 2 corresponds to a control unit that has a function of the communication device.

As the non-volatile memory 13, for example, a flash memory, a ferroelectric memory, or an "Electrically Erasable Programmable Read-Only Memory" can be used. The non-volatile memory 13 stores an IC card OS (hereinafter, may be referred to as “OS”), various applications, and data used by these.

Here, the function of the application is realized by the CPU 10 executing the AP generated in the non-volatile memory 13 by the installation process based on the ELF. Since the function of the application is realized by executing the AP, the AP may be referred to as an application. Further, the ELF is divided by the [LOAD] command from the server and transmitted to the IC chip 1a as described later, and is stored in the non-volatile memory 13. That is, ELF and AP are stored in the non-volatile memory 13.

[2. Functional configuration of IC chip 1a]
FIG. 2 is a block diagram showing a functional configuration example of the IC chip 1a. In the IC chip 1a, there is always one or more security domains (Security Domain, hereinafter referred to as "SD") which are applications for managing the IC chip 1a itself and the applications in the IC chip 1a. SD includes ISD (Issuer Security Domain) and SSD (Supplementary Security Domains). Such SD mainly supports the following functions (1) to (9).

(1) IC card life cycle management
(2) ELF life cycle management
(3) AP life cycle management
(4) ELF loading
(5) AP generation (installation)
(6) Delete ELF or AP
(7) Writing instance data (issued data) for applications
(8) Reading data
(9) Ensuring a secure communication path according to the Secure Channel Protocol (hereinafter referred to as "SCP")

By supporting the functions (1) to (9) above, the ISD realizes the management and security policy of the issuer of the IC card 1 for the card content (ELF, AP, etc.) in the IC chip 1a. .. On the other hand, SSD supports the functions (1) to (9) above to realize the management and security policy of a third party who provides services on the IC card for the card content in the IC card. .. Here, the third party who provides the service on the IC card means a person in a position other than the issuer of the IC card and the holder of the IC card (the user who is the target of issuing the IC card). Further, in the function of (9) above, the SCP has the confidentiality of the command data, the integrity of the command (and the guarantee of the command sequence), and the command data (for the communication path between the SD in the IC card and the external device). Provides additional integrity of sensitive data (eg, keys and PIN codes) in plain text.

As shown in FIG. 2, an OS is installed in the IC chip 1a, and applications such as the above-mentioned ISD, SSD, and Applications 1 and 2 that provide various services are installed (AP is a non-volatile memory 13). Remembered in). In addition, instance data (for example, key value for authentication, point data, user ID, etc.) used and managed by APs such as ISD, SSD, Application 1, and 2 are assigned to each AP on the non-volatile memory 13. Is remembered in. Further, in the area allocated to the OS on the non-volatile memory 13, registry data (for example, AID, privilege, etc.) managed by the OS and associated with each AP is stored.

Applications such as ISD, SSD, Applications 1 and 2 are updated when a defect is found or a function is added. Here, since the main purpose of updating the application is to update the ELF and AP, the instance data and the registry data are often the same data before and after the update (algorithms and key lengths due to cryptographic compromise, etc.). If you change the data, the data may be different). Therefore, the IC chip 1a of the present embodiment saves the instance data and the registry data when updating the application, deletes the old ELF and the old AP, loads the new ELF, and installs the new ELF into the new ELF. Based on this, a new AP is generated, and then a series of processes (referred to as "update process") such as restoring the saved instance data and registry data are performed. When saving instance data and registry data, (A) the data is not actually moved to another storage area, but a flag is set for the data and the flag is being saved by switching on / off. There are a method of switching between non-save and (B) a method of actually moving the data to another storage area and re-registering the data when the saved data is restored. Both (A) and (B) are methods of evacuation, but in the present embodiment, the evacuation method of (A) is adopted, and an update flag described later is provided as a flag.

Here, the update process of another application may be interrupted during the update process of one application. Then, in the update process of another application, it is assumed that a request is made to assign the AID, privileges, etc. included in the registry data saved for one application to the other application. At this time, in the update process of one application, if only the registry data is saved, the AID and privileges are assigned to other applications, and the AID and privileges cannot be properly inherited for one application. There is a risk.

Therefore, in the following, a method for appropriately inheriting AID, privileges, etc. in the application update process will be described. FIG. 3 is a diagram showing a configuration example of the registry data storage area 200 on the non-volatile memory 13, and FIG. 4 is a list of explanations regarding the states given to the state grant targets such as AID and privilege in the update process. It is a table.

As shown in FIG. 3, the ELF management information 210 and the AP management information 220 are stored in the registry data storage area 200 managed by the OS in the non-volatile memory 13.

The ELF management information 210 is a set of management information (one line (record) corresponds to the management information regarding one ELF) stored in the non-volatile memory 13. Similarly, the AP management information 220 is a set of management information (one line (record) corresponds to the management information regarding one AP) stored in the non-volatile memory 13.

The ELF management information 210 and the AP management information 220 include an updating flag 230 indicating whether or not an update process is being performed for each record. The “1” (on) of the updating flag 230 indicates that the update is in progress, and the “0” (off) indicates that the update is not in progress. The updating flag 230 is referred to when each function held by the OS (for example, ELF load function, AP installation function, ELF / AP deletion function, AP search function, etc.) is realized.

Further, each record constituting the ELF management information 210 and the AP management information 220 holds a combination of the state assignment target 240 and the state 250. The state grant target 240 is, for example, an AID or privilege assigned to an ELF or AP, and the state 250 is a state to be granted with respect to the AID or privilege. Hereinafter, a specific description will be given with reference to FIG.

As shown in FIG. 4, there are "suspended" and "transferred" in the states assigned to the AID, privilege, etc. assigned to the ELF or AP that is the target of the update process.

The state grant target 240 to which "stopped" is given includes, for example, an ELF AID, an AP AID, and a registered global service name (these may be collectively referred to as "AID or the like"). The stop grant target 240 to which the state 250 “stopped” is given is assigned to only one ELF or AP in the IC chip 1a. Here, when the AID "00000001" is assigned to only one ELF or AP in the IC chip 1a, it means that the ELF or AP monopolizes the AID "00000001", so that the AID or the like is an exclusive target. It can be said.

Global service is a general term for functions in which one application on IC chip 1a provides its own service to other applications on IC chip 1a. For example, PIN (Personal Identification Number) verification service and encryption service. Services such as are provided. For an application that provides a global service, a service ID (serviceID) is described for each service to be provided in the parameters of the Initial for installation command at the time of installation. In the case of an application that provides two services, a PIN verification service and an encryption service, for example, "AABBh" is described as the service ID of the PIN verification service, and "CCDDh" is described as the service ID of the encryption service in the parameters. Then, the OS generates a registry entry of the application as a part of the process when receiving the Installation for installation command, sets the AID and the service ID (“AABBh”, “CCDDh”), and then manages the registry entry. On the other hand, the application that uses the service specifies the service ID of the service to be used for the OS and the AID of the application that provides the service. On the other hand, the OS searches for the specified AID and service ID from the registry and hands it over to the application that uses the target service (specifically, the service is transferred from the OS to the object reference in the Java (registered trademark) language. The service can be used by handing it over to the application to be used). Here, as the number of applications on the IC chip 1a increases, it becomes necessary to manage the AID and the service ID for each service, which becomes complicated. Therefore, the IC chip 1a incorporates a mechanism in which the AID is omitted and the service is specified only by the service ID. At this time, by registering the service ID and the specific application in association with each other in advance, the OS can specify and provide the service of the application when only the service ID is specified. The registered global service name, which is an example of the status assignment target 240, is the only service ID registered in association with the application in advance.

The OS treats the ELF or AP to which the status grant target 240 (AID, etc.) is assigned when the status 250 "stopped" is set, as if it were deleted, but the allocation request for the AID, etc. If you receive, reject the request. Hereinafter, a specific description will be given.

(1) SELECT command The SELECT command specifies an AID and a logical channel number, so that a logical communication path (logical channel) with an AP identified by the AID is identified by the specified logical channel number. It is a command that requests to be a channel. When the OS receives the SELECT command from the external device 2, if the AID that identifies the AP selected by the SELECT command is "stopped", the OS treats the AP as nonexistent (the following candidates are treated as nonexistent). Search for). When the OS receives the SELECT command, the AID described in the data field of the command and each AID in the application registry held by the OS are compared in order (for example, the order of installation (creation order)). At this time, the AID described in the command data field may be a part of the AID (for example, only the first 3 bytes), and there may be a plurality of matching candidate AIDs as a comparison result. When the AIDs are (partially) matched, the OS checks whether the application can be selected on the logical channel (for example, whether the life cycle of the application whose AIDs are partially matched is locked). If the OS is in a selectable state, the application selection process is performed, and if the selectable state is not possible, the OS performs AID comparison (that is, search) for the next candidate application. In the present embodiment, the OS further determines whether or not it is "stopped" as a confirmation item of the "selectable state".
(2) GET STATUS command The GET STATUS command is a command for searching all AIDs on the IC chip 1a. When the OS receives the GET STATUS command from the external device 2, the OS treats the "stopped" AID as nonexistent. That is, the search result in the response to the GET STATUS command does not include the AID that is "stopped".
(3) INSTALL for LOAD / LOAD command The INSTALL for LOAD / LOAD command is a command for loading an ELF onto the IC chip 1a. In addition, in the INSTALL for LOAD / LOAD command, it is possible to make an allocation request such as AID for the ELF to be loaded. When the OS receives an INSTALL for LOAD / LOAD command accompanied by an allocation request such as an AID from the external device 2, and the AID for which the allocation request is made is "stopped", the AID has already been assigned. (Send an error response notifying that the AIDs are duplicated).
(4) INSTALL for installation command The INSTALL for installation command is a command to specify the AID of the loaded ELF and generate an AP. When the OS receives the INSTALL for installation command from the external device 2, if the specified AID is "stopped", the OS responds as if the ELF specified by the AID does not exist (sends an error response). do). Further, in the INSTALL for installation command, an AID or the like allocation request can be made for the generated AP, and when the OS receives an INSTALL for installation command accompanied by an AID or the like allocation request for the generated AP from the external device 2. In, when the AID for which the allocation request is made is "stopped", the AID is treated as assigned and responds (sending an error response notifying that the AIDs are duplicated).
(5) API for global service registration
For applications that provide global services, execute registerService (serviceID), which is an API (API for global service registration) of Global Platform (registered trademark) specifications, so that you can easily use the service by omitting the AID after installation. May be done. This method is a Java (registered trademark) interface method, and is called by specifying an interface type object reference (which corresponds to the application specification). At this time, if the OS sets the service ID (“AABBh”, “CCDDh”) in the registry when installing the application that provides the global service, the serviceID is either “AABBh” or “CCDDh”. As a result, services that can be used even if the AID of the application is omitted in the OS are associated. On the other hand, an application that uses a global service can normally use the getService (AID, serviceID) method to acquire an object reference that implements the service and use the service. In the above example, it can be obtained by getService (AID1, AABB) or getService (AID1, CCDD). However, if registerService (AABB), which is an API for global service registration, is executed in advance, it can be used in the same way with getService (null, AABB) without specifying AID. Here, although multiple applications can register services with the same service ID in the registry at the time of installation, the application that can be registered by registerService (serviceID), which is an API for global service registration, is one of the IC chips 1a. Only one application for the service ID. In addition, these rules and methods (APIs) that are the means of implementation are defined in the Global Platform specifications. When registerService (serviceID), which is an API for global service registration, is executed, the OS is set to state 250 "stopped" for the state grant target 240 "registered global service name". The global service specified by the API is treated as if it has already been registered, and the execution of the API for global service registration ends in failure because the execution condition is not satisfied.

On the other hand, the state grant target 240 to which "transferring" is granted includes, for example, a Card Reset privilege, a Final Application privilege, and an Privilege selection parameter (these may be collectively referred to as "privilege, etc."). .. The stop grant target 240 to which the state 250 "in transfer" is granted must be unique and always exist in the IC chip 1a, and is assigned to only one ELF or AP in the IC chip 1a. Here, when the privilege or the like is assigned to only one ELF or AP in the IC chip 1a, it means that the privilege or the like is monopolized, so that the privilege or the like can be said to be an exclusive target.

The Card Reset privilege is a privilege that allows the contents of the ATR (Answer-To-Reset) output when a reset signal is received when the power is turned on to the IC chip 1a to be changed, and is one in the IC chip 1a. Granted to AP. Examples of the contents of the ATR include information indicating the communication protocol and communication speed of the IC chip 1a, application identification information stored in the IC chip 1a, and the like.

The Final Application privilege is a privilege that is only allowed to operate even when the IC chip 1a (or IC card 1) is locked and cannot be used by the user, and is granted to one AP in the IC chip 1a. Will be done. When the IC chip 1a (or IC card 1) is locked, for example, when the expiration date of the IC chip 1a (or IC card 1) has expired, or when the IC chip 1a (or IC card 1) itself has security. For example, when a threat is detected and the function is stopped by itself. Examples of the AP to which the Final Application privilege is granted include an AP that outputs the reason for the lock to the external device 2. For example, if the IC card 1 is a credit card, if the lock is applied, payment cannot be made with that credit card, but the AP that outputs management information including the reason for the lock to the external device 2 is given the Final Application privilege. If so, you can figure out why the card was locked.

Impact selection is a Manage that switches the logical channel identified by the logical channel number from closed to open by setting the AP and the logical channel number in advance in association with each other even if the OS does not accept an explicit SELECT command. When a Channel command (a command that controls OPEN and CLOSE of a logical channel by specifying OPEN or CLOSE in the command header) is accepted, communication with a preset AP is possible on the logical channel. It is a function to do. Then, the OS is set in advance by associating the AP with the logical channel number by using the Impact selection parameter. At this time, only one AP can be specified by the Impact selection parameter on the IC chip 1a.

The OS transfers the privilege, etc. to the ISD during the update process for the state grant target 240 (privilege, etc.) for which the state 250 “transferring” is set, and restores the privilege, etc. after the update process is completed. Further, the OS rejects even if there is a request for granting the privilege or the like in the installation process of another application when the privilege or the like is transferred to the ISD.

Even if the OS does not refer to the state 250, when the update flag 230 is "1" (on), the ELF or AP AID or the like is "stopped", and the privilege or the like is "transferred". It can also be determined that.

[3. Update process]
Hereinafter, an operation example of the application update process in the IC chip 1a will be described with reference to FIGS. 5 to 7. FIG. 5 is a sequence diagram showing an example of an update process, FIG. 6 is a flowchart showing an example of a save / delete process by the IC chip 1a, and FIG. 7 is an example of an installation / restore process by the IC chip 1a. It is a flowchart which shows.

FIG. 5 shows the IC chip 1a and the server (of the point application) when updating the point application (an application that enables point addition and use at affiliated facilities, etc., hereinafter referred to as "point application"). It shows the flow of command and response of the provider's server).

First, the server transmits a [SELECT ISD] command to the IC chip 1a in order to form a communication path with the ISD, which is an SD that manages the point application in the IC chip 1a (step S1). The [SELECT] command includes an AID that is an ID that identifies an application that is a destination of a communication path, and a logical channel number that identifies a communication path (logical channel) with the application. On the other hand, the IC chip 1a executes a process for forming a communication path in response to a command, and transmits an OK response (step S2). However, if the processing according to the command cannot be completed normally, a response indicating that an error has occurred is transmitted to the server (hereinafter, the same applies to steps S4, S6, S9, S11, S13, and S16). As a result, a communication path (logical channel) identified by the logical channel number is formed, and thereafter, the server includes the logical channel number in the command, and the server passes through the communication path identified by the logical channel number. Can communicate with ISD.

Next, the server executes secure processing (mutual authentication processing to protect commands by SCP) that makes the communication path (logical channel) formed so far into a secure communication path in order to increase the confidentiality of the communication path. ..

The mutual authentication process is a process in which the server and the IC chip 1a authenticate each other on the premise that each other knows the key that is the source of the cryptographic operation according to the algorithm determined by the protocol. Specifically, the server sends the [INITIALIZE UPDATE] command and the [EXTERNAL AUTHENTICATE] command, which are commands for mutual authentication, to the IC chip 1a (steps S3 and S5), and the IC chip 1a responds to each command. It is performed by executing the process and transmitting an OK response when the process is completed normally (step S4, step S6). In FIG. 3, mutual authentication is completed by transmitting an OK response by the process of step S6.

Next, the server transmits a [save / delete process] command for causing the IC chip 1a to execute the save / delete process (step S7). The save / delete process is a part of the process for updating the application. On the other hand, the IC chip 1a executes the save / delete process (step S8). The save / delete process will be described later. When the IC chip 1a normally completes the save / delete process, it transmits an OK response (step S9).

Next, the server sends a [LOAD (0)] command to the IC chip 1a (step S10). The [LOAD] command is a command for transmitting the application program of the new point application by dividing it into n pieces. The [LOAD (0)] command is a command for transmitting the first part of the n divisions and storing them in the IC chip 1a. The IC chip 1a performs a process of storing a part of the application program included in the [LOAD] command in the non-volatile memory 13, and when the process ends normally, sends an OK response to the server (step S11). Similarly, the server sends the [LOAD (1)] command, the [LOAD (2)] command, ..., and the [LOAD (n-1)] command to send the remaining part of the split. Each time, the IC chip 1a performs a process of storing a part of the application program included in the [LOAD] command in the non-volatile memory 13, and when the process ends normally, sends an OK response to the server. When the [LOAD (n-1)] command is transmitted (step S12) and the OK response is transmitted (step S13), the entire application program of the new point application is stored in the non-volatile memory 13 of the IC chip 1a. It will be memorized (load completed). The processes of steps S10 to S13 may be collectively referred to as "load process". The load process may be performed after the completion of mutual authentication and before the processes of steps S7 to S9.

Next, the server transmits an [installation / restoration process] command for causing the IC chip 1a to execute the installation / restoration process (step S14). The installation / restore process is a part of the process for updating the application. On the other hand, the IC chip 1a executes the installation / restoration process (step S15). The installation / restoration process will be described later. When the IC chip 1a normally completes the installation / restoration process, it sends an OK response (step S16) and ends the application update process.

[4. Evacuation / deletion process]
Next, the evacuation / deletion process by the IC chip 1a will be described with reference to FIG. The save / delete process is a process executed in response to the [Save / Delete process] command from the server.

First, the OS (CPU 10 that executes the IC chip 1a) saves the instance data related to the point application (step S101). At this time, the OS saves the data by turning on the flag corresponding to the instance data.

Next, the OS saves the registry data related to the point application (step S102). At this time, the OS saves by turning on the update flag 230 corresponding to the registry data. The process of step S101 and the process of step S102 may be collectively referred to as "evacuation process".

Next, the OS changes the state 250 corresponding to the state grant target 240 with respect to the saved registry data, and transfers privileges and the like (step S103). Specifically, the OS changes the state 250 to "stopped" for the ELF and AP AID of the point application that is the target of the update process, and if the point application is granted privileges or the like. , Change state 250 to "Transferring" for each privilege. In addition, the OS transfers the privilege, etc. that changed the state 250 to "transferring" to ISD.

Next, the OS deletes the AP of the point application (step S104).

Next, the OS deletes the ELF of the point application (step S105), and ends the save / delete process. The process of step S104 and the process of step S105 may be collectively referred to as "deletion process".

[5. Installation / restoration process]
Next, the installation / restoration process by the IC chip 1a will be described with reference to FIG. 7. The installation / restore process is a process executed in response to the [install / restore process] command from the server.

First, the OS (CPU 10 for executing the IC chip 1a) performs the installation process of the ELF of the new version of the point application stored based on the [LOAD] command in steps S10 to S12 of FIG. 5 (that is, the new version). AP is generated) and stored in the non-volatile memory 13 (step S201).

Next, the OS restores the instance data saved in the process of step S101 of FIG. 6 (step S202). Specifically, the OS restores the data by turning off the flag corresponding to the saved instance data.

Next, the OS restores the registry data saved in the process of step S102 in FIG. 6 (step S203). Specifically, the OS restores the data by turning off the update flag 230 corresponding to the saved registry data. The process of step S202 and the process of step S203 may be collectively referred to as "association process".

Next, the OS restores the state 250 changed in the process of step S103 of FIG. 6 (step S204). Specifically, the OS cancels "stopped" for the ELF and AP AID of the point application that is the target of the update process, and if the point application is granted privileges, the privileges are given. Cancel "Transferring". In addition, the OS re-transfers the privilege, etc. that changed the state 250 to "transferring" from the ISD to the point application. When the OS finishes the process of step S204, the OS finishes the installation / restoration process.

[6. Privilege grant judgment processing]
Next, using FIG. 8, the privilege grant determination process of whether or not to grant the privilege in the installation process based on the reception of the INSTALL for instant command accompanied by the privilege grant request such as the privilege of "transferring" in the state 250. Will be explained. FIG. 8 describes a case where the privilege or the like is a Final Application privilege. It should be noted that the same determination processing can be performed for the Card Reset privilege and the Privilege selection parameter.

First, when the OS receives the INSTALL for installation command accompanied by the request for granting the Final Application privilege, the OS searches for the AP to which the Final Application privilege is granted (step S301).

Next, the OS determines whether or not the AP to which the Final Application privilege is granted is an ISD (step S302). When the OS determines that the AP to which the Final Application privilege is granted is not ISD (step S302: NO), the OS sends an error response indicating that the installation has failed to the source of the INSTALL for installation command. (Step S303), and the privilege grant determination process is terminated. On the other hand, when the OS determines that the AP to which the Final Application privilege is granted is ISD (step S302: YES), the OS determines whether or not another application is being updated (step S304). .. Specifically, when any of the update flags 230 is turned on, it is determined that the update process is in progress.

When the OS determines that the update process of another application is not in progress (step S304: NO), the OS assigns the Final Application privilege to the AP generated by the INSTALL for installation command accompanied by the request for granting the Final Application privilege. Grant (step S306), and end the privilege grant determination process. On the other hand, when the OS determines that the update process of another application is in progress (step S304: YES), the OS then refers to the AP management information 220 and has a Final Application privilege (Final Application privilege) for the AP in the update process. It is determined whether or not the state 250 of the state granting target 240) is “in transfer” (step S305).

When the OS determines that the state 250 of the Final Application privilege (state grant target 240) is not "transferring" for the AP in the update process (step S305: NO), the OS requests the grant of the Final Installation privilege. The Final Application privilege is granted to the AP generated by the accompanying INSTALL for installation command (step S306), and the privilege grant determination process is terminated. On the other hand, when the OS determines that the state 250 of the Final Application privilege (state grant target 240) is "transferring" for the AP being updated (step S305: YES), the INSTALL for installation command is issued. An error response indicating that the installation has failed is transmitted to the source (step S303), and the privilege grant determination process is terminated.

As described above, in the IC chip 1a (an example of the "electronic information storage medium") of the present embodiment, the non-volatile memory 13 (an example of the "storage means") stores ELF and AP, and the CPU 10 ("deletion means"). , "Loading means", "Installing means", "Rejecting means") is a new version of the ELF that is the update target by executing the deletion process that deletes the ELF and AP that are the update targets. A load process for storing the new ELF in the non-volatile memory 13 is executed, and after the deletion process and the load process, a new version of the new AP is generated based on the new ELF stored in the non-volatile memory 13 to generate the non-volatile memory. The installation process stored in 13 is executed, and during the execution of the deletion process, load process, or installation process, the exclusive target assigned to only one ELF or AP and the exclusive target assigned to the ELF or AP to be updated. When a request for assigning an object to other ELFs and APs is accepted, the request is rejected.

Therefore, according to the IC chip 1a of the present embodiment, when the update target is deleted in order to update the ELF or AP to which the monopoly target has been assigned, the monopoly target is assigned to other ELFs and APs. Since the request for allocation is rejected when it is accepted, the monopoly target can be taken over by the ELF or AP that has been appropriately updated even after the update process.

Further, in the IC chip 1a of the present embodiment, the privilege or the like (an example of the “exclusive object”) must be assigned to any ELF or AP stored in the non-volatile memory 13, and the CPU 10 (“assignment means”). , An example of "reassignment means") assigns privileges, etc. to the ISD that manages the deletion target (an example of "management application program or management application instance") and assigns it to the ISD. Reassign privileges, etc. to the new ELF or new AP. As a result, when updating an ELF or AP to which a privilege or the like is assigned, it is possible to prevent the privilege or the like from being unassigned to any ELF or AP when the ELF or AP is deleted. ..

Further, the CPU 10 of the IC chip 1a (an example of "response means") makes a request to search for an ELF or AP to be deleted while executing a deletion process, a load process, or an installation process, as an example of a server (an example of an "external device"). ), The server is replied that the ELF or AP to be deleted does not exist.

1 IC card 1a IC chip 10 CPU
11 RAM
12 ROM
13 Non-volatile memory 14 I / O circuit 2 External device

Claims (6)

A storage means for storing application programs and application instances,
A deletion means that executes a deletion process that deletes the application program and application instance that are the update targets as the deletion target, and
A load means for executing a load process for storing a new application program, which is a new version of the application program to be updated, in the storage means, and a load means.
After the deletion process and the load process, an installation means for executing an installation process of generating a new version of a new application instance based on the new application program stored in the storage means and storing the new application instance in the storage means.
An exclusive target assigned to only one application program or application instance during the execution of the deletion process, the load process, or the installation process, and the exclusive target assigned to the application program or application instance to be updated. When a request to be assigned to another application program or application instance is accepted, a denial means for rejecting the request and
An electronic information storage medium characterized by comprising. The electronic information storage medium according to claim 1.
The monopoly must always be assigned to any application program or application instance stored in the storage means.
When the deletion target is deleted, the allocation means for assigning the exclusive target to the management application program or management application instance that manages the deletion target, and
A reassignment means for reallocating the monopoly target assigned to the management application program or the management application instance to the new application program or the new application instance.
An electronic information storage medium characterized by further comprising. The electronic information storage medium according to claim 1 or 2.
When a request to search for the application program or application instance to be deleted is received from an external device during the deletion process, the load process, or the installation process, the application program or application instance to be deleted is subjected to the deletion process. An electronic information storage medium further comprising a response means for making a response to the effect that it does not exist to the external device. An IC card including the electronic information storage medium according to any one of claims 1 to 3. An update method using an electronic information storage medium provided with a storage means for storing an application program and an application instance.
A deletion process that executes a deletion process that deletes the application program and application instance that are the update targets as deletion targets, and
A loading process for executing a loading process for storing a new application program, which is a new version of the application program to be updated, in the storage means, and a loading process.
After the deletion process and the load process, an installation process of generating a new version of a new application instance based on the new application program stored in the storage means and storing the new application instance in the storage means is executed.
An exclusive target assigned to only one application program or application instance during the execution of the deletion process, the load process, or the installation process, and the exclusive target assigned to the application program or application instance to be updated. , A refusal process that rejects a request to be assigned to another application program or application instance,
An update method using an electronic information storage medium, which comprises. A computer included in an electronic information storage medium provided with storage means for storing application programs and application instances.
A deletion means that executes a deletion process that deletes the application program and application instance that are the update targets as the deletion target.
A loading means for executing a loading process for storing a new application program, which is a new version of the application program to be updated, in the storage means.
An installation means for executing an installation process of generating a new version of a new application instance based on a new application program stored in the storage means and storing the new application instance in the storage means after the deletion process and the load process.
An exclusive target assigned to only one application program or application instance during the execution of the deletion process, the load process, or the installation process, and the exclusive target assigned to the application program or application instance to be updated. , Rejection means to reject a request to be assigned to another application program or application instance,
An update program characterized by functioning as.

Images