JP7334718B2 - Secure element, privilege allocation management method in secure element, and IC chip - Google Patents

Description

The present invention relates to a secure element on which multiple applications can be installed.

Secure elements that can be loaded with multiple applications are used in various fields. A secure element is a small semiconductor device that includes a memory, processor, and operating system, has strong tamper resistance, and can safely store important data such as IDs, encryption keys, and electronic certificates.

A secure element that can be loaded with multiple applications can generally be assigned a privilege that gives a special function to the application loaded in the secure element. Privileges that can be set for applications are mainly functions related to the security of the secure element.

Non-Patent Document 1 is one of the specifications of a secure element that can be loaded with multiple applications. Non-Patent Document 1 will be used as an example to explain the problems that arise when privileges are assigned to applications.

Non-Patent Document 1 defines two types of applications installed in secure elements: domain applications that perform processing related to domain security management in secure elements, and normal applications that perform processing that conforms to services provided by service providers. It is In Non-Patent Document 1, the domain application is called "Security Domain".

In Non-Patent Document 1, privileges can be defined for both domain applications and normal applications. Non-Patent Document 1 defines 20 privileges as privileges that can be assigned to applications.

As described in Patent Literature 1, in Non-Patent Literature 1, the privilege assigned to the application installed in the secure element is specified when the application is installed in the secure element. Specifically, the command to install an application onto the secure element specifies the privileges assigned to the application being installed onto the secure element.

Privileges that can be assigned to applications include those that mandate special handling in the operations performed in the secure element. Privileges that obligate special processing include those that oblige consistency verification of the program code of the application when the application is installed in the secure element. In Non-Patent Document 1, this privilege is called Mandated DAP (Data Authentication Pattern) Verification, but in the present invention, this privilege is called a consistency verification request.

If a privilege requiring special processing is assigned to a large number of applications, the special processing required by this privilege is required for each application, which causes a problem of increasing the time required for processing executed by the secure element.

The integrity verification requirements described above are privileges that can be assigned to domain applications. When the application program code is loaded into the secure element, consistency verification of the application program code is repeatedly performed by the number of domain applications to which consistency verification requests are assigned. For this reason, if the number of domain applications to which integrity verification requests are assigned is large, the process of loading the program code of the application into the secure element will be significantly slowed down.

Among the privileges that can be assigned to the applications installed in the secure element, there are privileges that require a memory area in the secure element. For example, in the case of a consistency verification request, a memory area for recording the consistency verification results related to the program code of the application is required for each domain application to which the consistency verification request is assigned. Therefore, if a large number of applications are assigned privileges that require a memory area, the corresponding memory area will be required.

JP 2018-67795 A

Global Platform Card Specification (v2.3)

SUMMARY OF THE INVENTION An object of the present invention, which has been devised in view of the above-described problems, is to manage the number of applications to which pre-specified privileges are assigned in a secure element in which a plurality of applications can be installed.

The invention related to the secure element that solves the above-mentioned problems confirms whether the privilege for which the allocation request for the application is received is a privilege with an upper limit on the number of allocations, and if it is a privilege with an upper limit on the number of allocations, Confirming the number of allocations related to the privilege for which the allocation is requested, and only when the number of allocations related to the privilege for which the allocation is requested has not reached the upper limit value set for the privilege for which the allocation is requested, the allocation request A secure element characterized by comprising a privilege management unit that executes processing for allocating a privilege received from the above to the application. Note that it is preferable to use a privilege with an upper limit on the number of assignments as a consistency verification request.

In the invention related to the privilege setting management method for solving the above-mentioned problems, a privilege management unit that manages privilege allocation checks whether the privilege requested for allocation to an application is a privilege with an upper limit on the number of allocations. step, if the privilege for which the allocation request is received is a privilege for which an upper limit is set for the number of allocations, the step of confirming the number of allocations related to the privilege for which the allocation request is received, receiving the allocation request; only when the number of privileges assigned does not reach the upper limit set for the privilege requested to be assigned, the privilege management unit assigning the requested privilege to the application; A privilege allocation management method in a secure element characterized by: Note that it is preferable to use a privilege with an upper limit on the number of assignments as a consistency verification request.

An invention related to an IC chip that solves the above-mentioned problems is to check whether a privilege that has received an allocation request for an application is a privilege that sets an upper limit on the number of allocations, and if it is a privilege that sets an upper limit on the number of allocations, Confirming the number of allocations related to the privilege for which the allocation is requested, and only when the number of allocations related to the privilege for which the allocation is requested has not reached the upper limit value set for the privilege for which the allocation is requested, the allocation request The IC chip is characterized by comprising a privilege management unit that executes processing for allocating the privilege received from the application to the application. Note that it is preferable to use a privilege with an upper limit on the number of assignments as a consistency verification request.

According to the present invention, in a secure element in which a plurality of applications can be installed, the number of applications to which privileges are assigned with an upper limit set for the number of assignments can be managed below the upper limit of privileges.

FIG. 4 is a diagram for explaining the structure of a secure element according to the embodiment; FIG. 4 is a diagram for explaining a registry owned by a privilege management unit; FIG. FIG. 4 is a flowchart for explaining the operation of a privilege management unit;

Embodiments according to the present invention will now be described. This embodiment is intended to facilitate understanding of the present invention, and the present invention is not limited to this embodiment. In addition, unless otherwise specified, the drawings are schematic diagrams drawn to facilitate understanding of the present invention.

The present invention relates to a secure element 1 in which multiple applications 11 can be installed. The form of the secure element 1 is arbitrary. The secure element 1 may be in the form of a card medium (for example, an IC card or SIM (Subscriber Identity Module)). Alternatively, the secure element 1 may be in the form of a semiconductor product (e.g. eSIM (Embedded SIM)) embedded in a mobile terminal (e.g. smart phone).

FIG. 1 is a diagram for explaining the structure of a secure element 1 according to this embodiment. The structure of secure element 1 illustrated in FIG. 1 includes an IC chip 12 .

The IC chip 12 illustrated in FIG. /Transmitter), timer 125 and accelerator 123 are connected.

A RAM 122 is a volatile memory that serves as the main memory of the secure element 1 . The ROM 121 is an electrically non-rewritable non-volatile memory. The NVM 124 is an electrically rewritable nonvolatile memory. A UART 126 is a circuit that controls communications of the secure element 1 . A timer 125 is a circuit for measuring time. The accelerator 123 is a circuit for increasing the processing speed of cryptographic operations.

The structure of the secure element 1 illustrated in FIG. 1 includes, as software, an operating system 10 (Operating System (OS)) and a plurality of applications 11 that operate based on the OS 10 . Program codes of the OS 10 are mainly stored in the ROM 121 . The program code of application 11 is stored in NVM 124 .

The application 11 is software that operates based on the OS 10 . If the OS 10 has a virtual machine, the application 11 is written in bytecode corresponding to the virtual machine.

As described above, according to Non-Patent Document 1, the applications 11 installed in the secure element 1 include an application 11 that performs processing related to domain security in the secure element 1 and an application 11 that performs processing suitable for a specific service. is included. In this embodiment, when describing the application 11 that performs processing related to the security of the domain in the secure element 1 and the application 11 that performs processing suitable for a specific service, according to Non-Patent Document 1, the domain The application 11 that performs security-related processing is described as a domain application 110 , and the application 11 that performs processing adapted to a specific service is described as a normal application 111 .

Each domain application 110 corresponds to a different operator. When the domain applications 110 are described separately according to the provider, an alphabetical code is added. In FIG. 1, the number of domain applications 110 installed in the secure element 1 is three. One domain application 110 is the secure element 1 issuer's domain application 110b. The other two domain applications 110 are service provider domain applications 110a. A service provider's domain application 110a is linked with one normal application 111 that is compatible with the service provided by the service provider.

In this embodiment, an application 11 installed in the secure element 1 can be assigned a privilege that gives the application 11 a certain special function. For example, the application 11 that becomes the domain application 110 is assigned a privilege that allows the application 11 to function as the domain application 110 . Applications 11 that have been assigned this privilege are identified as domain applications 110 and applications 11 that have not been assigned this privilege are identified as normal applications 111 .

The OS 10 provides various platform functions to the applications 11 operating on the basis of the OS 10 . The OS 10 according to this embodiment includes a privilege management unit 100 that manages privileges assigned to the applications 11 . The privilege management unit 100 according to this embodiment has a registry 101 that stores at least management information of the applications 11 installed in the secure element 1 .

FIG. 2 is a diagram for explaining the registry 101 that the privilege management unit 100 has. The registry 101 of the privilege management unit 100 stores at least management information of the applications 11 installed in the secure element 1 . In FIG. 1, three domain applications 110 and two normal applications 111 are installed. Therefore, the registry 101 illustrated in FIG. 2 contains three pieces of management information for domain applications 110 and two pieces of management information for normal applications 111 .

The management information of the application 11 includes at least an AID (Application Identifier) as an identifier of the application 11 and a privilege number assigned to the application 11 . A privilege number is information identifying a privilege. The management information of the application 11 can contain information other than these. For example, the life cycle state of the application 11 can be included in the application 11 management information.

FIG. 3 is a flowchart for explaining the operation of the privilege management unit 100, and the explanation of FIG. 3 also serves as an explanation of the privilege management method in the secure element 1. When the privilege management unit 100 performs processing for allocating privileges to the application 11, the privilege management unit 100 first receives a privilege allocation request (step S1). The privilege assignment request includes the privilege number of the privilege and the AID of the application 11 to which the privilege is assigned.

The application 11 that transmits the privilege allocation request to the privilege management unit 100 is the domain application 110 that is authorized to install the application 11 . For example, in this embodiment, the domain application 110 to which the authority to install the domain application 110 is given is the issuer's domain application 110b. Also, the domain application 110 to which the authority to install the normal application 111 is given becomes the domain application 110a of the service provider that provides the normal application 111. FIG.

A domain application 110 requesting the privilege management unit 100 to assign a privilege is sent a command APDU from an external terminal, which is a command indicating the privilege number of the privilege to be assigned to the application 11 . In Non-Patent Document 1, the command for assigning privileges to the application 11 is the INSTALL [for install] command. The privilege number of the privilege assigned to the application 11 and the AID of the application 11 to which the privilege is assigned are specified by the data fields of this command.

Next, the privilege management unit 100 checks whether the privilege number of the privilege for which the allocation request has been received is a privilege number registered in advance in the privilege management unit 100 (step S2). In the privilege management unit 100, the privilege number of this privilege and the upper limit of the number of privileges to be assigned are registered in advance for each privilege for which the upper limit of the number of privileges to be assigned is set. A privilege that sets an upper limit on the number of privileges to be assigned can be a privilege that requires special processing in processing executed by the secure element 1 or a privilege that requires a memory area in the secure element 1 .

The privilege management unit 100 branches the processing according to the confirmation result of the privilege number (step S3). If the privilege number of the privilege requested for assignment is not the privilege number registered in advance in the privilege management unit 100, the privilege management unit 100 proceeds to step S7 in FIG. 3 is executed, and the procedure of FIG. 3 ends.

If the privilege number of the privilege for which the allocation request has been received is a privilege number registered in advance in the privilege management unit 100, the privilege management unit 100 confirms the number of allocated privileges at this point in time for the privilege for which the allocation request has been received (step S4). The number of assigned privileges at this point in time for the requested privilege can be checked using the registry 101 . The privilege management unit 100 accesses the registry 101 and counts the number of management information of the application 11 including the privilege number of the privilege requested to be assigned, thereby obtaining the number of assigned privileges at this time. confirm.

Next, the privilege management unit 100 confirms whether or not the number of assigned privileges at this point in time for the privilege for which the assignment request has been received reaches the upper limit value of this privilege (step S5). Next, the privilege management unit 100 branches the processing according to the confirmation result of the assigned number (step S6).

In step S6 of FIG. 3, if the number of assigned privileges at this point in time for the privilege requested to be assigned has not reached the upper limit value of this privilege, the privilege management unit 100 assigns the privilege requested to be assigned to the privilege indicated by the assignment request. The process of assigning to the application 11 is executed (step S7), and the procedure of FIG. 3 ends. In this embodiment, the privilege management unit 100 accesses the registry 101 as a process of allocating the privilege requested to be allocated to the application 11 indicated by the allocation request, and accesses the management information of the application 11 corresponding to the AID included in the allocation request. to the privilege number of the privilege requested to be assigned.

In step S6 of FIG. 3, if the number of allocated privileges at this point in time for the privilege for which the allocation request has been received does not reach the upper limit of this privilege, the privilege management unit 100 sends the privilege allocation request to the domain application 110 Then, the application 11 is notified that the privilege for which the allocation request has been received cannot be set (step S8), and the procedure of FIG. 3 ends.

From now on, the contents of FIG. 3 will be explained in more detail while explaining the case where the consistency verification request is used as the privilege for setting the upper limit of the number of privileges to be assigned. The reason why the privilege that sets the upper limit on the number of privilege assignments is used as a consistency verification request is that the consistency verification related to the program code of the application 11 is necessary for the same number of domain applications 110 to which the consistency verification request is assigned. Because it becomes. If consistency verification for the program code of the application 11 is required for the same number of domain applications 110 to which consistency verification requests are assigned, the process of loading the program code for the application 11 into the NVM 124 will take a long time.

Integrity verification request is a privilege that can be assigned to domain applications 110 . In step S1 of FIG. 3, the application 11 that transmits the privilege allocation request to the privilege management unit 100 is the domain application 110 (here, the issuer's domain application 110b) that has been granted the authority to install the domain application 110. In Non-Patent Document 1, the command for assigning privileges to the application 11 is the INSTALL [for install] command. The privilege number of the privilege assigned to the application 11 and the AID of the application 11 to which the privilege is assigned will be specified by the data field of this command.

When setting an upper limit for the number of consistency verification requests to be allocated, the privilege number of the consistency verification request is registered in advance in the privilege management unit 100 . In Non-Patent Document 1, the privilege number of the privilege (Mandated DAP Verification) corresponding to the consistency verification request is "7".

Since the privilege number of the consistency verification request is registered in the privilege management unit 100 in advance, the privilege management unit 100 proceeds to step S4 in FIG. 3 at step S3 in FIG. In step S4 of FIG. 3, the privilege management unit 100 counts the number of matching verification requests assigned at this time. Further, in step S5 of FIG. 3, the privilege management unit 100 confirms whether or not the number of consistency verification requests allocated at this time has reached the upper limit of consistency verification requests. In step S7 of FIG. 3, the privilege management unit 100 accesses the registry 101 and adds the privilege number of the consistency verification request to the management information of the application 11 (which becomes the domain application 110) to which the consistency verification request is assigned. .

According to the flow of FIG. 3, if the upper limit of consistency verification requests is two in FIG. 1, the processing of step S8 in FIG. Become. Further, according to the flow of FIG. 3, if the upper limit of consistency verification requests is 3 in FIG. will be

In this way, the secure element 1 according to this embodiment can limit the number of domain applications 110 to which consistency verification requests can be assigned to the upper limit or less. Therefore, even if the consistency verification request is assigned to the domain application 110, the time required for loading the program code of the application 11 will not be extremely long.

1 secure element 10 operating system (OS)
100 Privilege Management Unit 101 Registry 11 Application 110 Domain Application 111 Normal Application 12 IC Chip

Claims (6)

Confirm whether the privilege requested to be allocated to the application is a privilege for which an upper limit is set for the number of allocations, and if the privilege is for which an upper limit is set for the number of allocations, confirm the number of allocations related to the privilege for which the allocation is requested. and only when the number of allocations related to the allocation-requested privilege does not reach the upper limit value set for the allocation-requested privilege, the processing for allocating the allocation-requested privilege to the application is executed. A secure element characterized by comprising a privilege management section. 2. The secure element according to claim 1, wherein a privilege with an upper limit on the number of assigned privileges is used as the integrity verification request. a step of confirming whether the privilege requested to be assigned to the application is a privilege for which an upper limit is set for the number of assignments by a privilege management unit that manages assignment of privileges; In the case of the provided privilege, the step of confirming the number of allocations related to the privilege for which the allocation is requested by the privilege management unit, and the number of allocations related to the privilege for which the allocation is requested is set to the privilege for which the allocation is requested. A privilege assignment management method in a secure element, comprising the step of: executing a process in which the privilege management unit assigns the privilege requested to be assigned to the application only when the upper limit is not reached. 4. The privilege allocation management method in a secure element according to claim 3, wherein a privilege for which an upper limit is set for the number of privileges to be allocated is used as a consistency verification request. Confirm whether the privilege requested to be allocated to the application is a privilege for which an upper limit is set for the number of allocations, and if the privilege is for which an upper limit is set for the number of allocations, confirm the number of allocations related to the privilege for which the allocation is requested. and only when the number of allocations related to the allocation-requested privilege does not reach the upper limit value set for the allocation-requested privilege, the processing for allocating the allocation-requested privilege to the application is executed. An IC chip comprising a privilege management section. 6. The IC chip according to claim 5, wherein a privilege with an upper limit set for the number of assignments is used as a consistency verification request.

Images