JPH1065663A - Ic card system and ic card - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an IC card system and an IC card, which can improve the security of secret data, by transmitting and receiving data through the use of a plurality of encryption algorithm. SOLUTION: The IC card 1 and an external device 6 have memories 3 and 8 for storing the plurality of encryption algorithms, encryption generation means, decoding means and data storage means. The IC card 1 has a discrimination means which transmits discrimination data to the external device 6, receives discrimination data ciphered in the external device 6 by the encryption algorithm similar to that ciphering received ciphered data, decodes received and ciphered discrimination data and compares whether it is matched with transmitted discrimination data or not so as to discriminate by which encryption algorithm received and ciphered data is ciphered. The external device 6 has the similar discrimination means.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an IC card system and an IC card, and more particularly, to an IC card system capable of improving the security of secret data by transmitting and receiving data using a plurality of encryption algorithms. And an IC card.

[0002]

2. Description of the Related Art Conventional techniques for transmitting and receiving data between an IC card and an external device include, for example, JP-A-1-189792 and JP-A-5-347616.
No. 6,086,045.

FIG. 5 is a configuration diagram showing an IC card disclosed in Japanese Patent Application Laid-Open No. 1-189792. As shown in FIG. 5, this IC card includes a plastic card main body 20, a CPU 21, a memory 22, and four signal connection mechanisms 23, 24, 2 having different characteristics.
5 and 26. Further, between the plurality of different signal connection mechanisms 23, 24, 25, 26 and the CPU 21, there is provided a signal converter 27 for converting signals into and out of each other.
Is provided. According to this IC card, when one signal connection mechanism is selected according to the direction of insertion into the external device, the signal converter 27 sets the selected signal connection mechanism to the CP.
Since the selection signal is output to the CPU 21 so that it can be processed by the U21, one IC card can be connected to a plurality of external devices having different characteristics.

FIG. 6 is a configuration diagram showing an IC card system disclosed in Japanese Patent Application Laid-Open No. 5-347616. As shown in FIG. 6, the IC card system includes a plurality of IC cards 30, a plurality of workstations 40 having an input / output interface of the IC card 30,
This is a group encryption communication system including a communication network connecting these workstations 40. IC card 3
0, a CPU 31, a memory 32 for storing a business identification number, a personal identification number, a single business master key, a partial area master key, a memory 33 for storing a group key generation program 1, an IC card Side interface 34.

[0005] The workstation 40 includes a CPU 41.
And a memory 42 for storing a business identification number, a personal identification number, and a group key, a memory 43 for storing the group key generation program 2, and a workstation-side interface 44. The IC card 30 and the workstation 40 can read and write data via the IC card side interface 34 and the workstation side interface 44.

[0006] In this IC card system, a predetermined master key is held by each of the IC card 30 and the workstation 40. The encryption algorithm is executed by a predetermined single type of group key generation program, but since there are a plurality of master keys, it is possible to select an arbitrary IC card 30 and a work station 40.

[0007]

In the IC card shown in FIG. 5, data can be transmitted / received to / from an external device by a unique interface procedure via each signal connection mechanism. However, since a physically independent signal connection mechanism is provided, a plurality of interface procedures cannot be performed by a physically single interface.

In the IC card system shown in FIG. 6, in order to enable data transmission and reception between the respective IC card 30 and the workstation 40, a predetermined "office identification number" and "personal identification number" are required. To use the master key applied to each IC card 3
Data communication corresponding to an arbitrary master key cannot be realized with respect to 0 and the work station 40. Also, since the encryption algorithm is single, data files corresponding to a plurality of encryption algorithms are stored in the IC card 30.
And cannot be held in the workstation 40.

The present invention has been made in view of the above problems, and an IC card system and an IC card capable of improving the security of secret data by transmitting and receiving data using a plurality of encryption algorithms. The purpose is to provide the card.

[0010]

An IC card system according to the present invention is an IC card system having an IC card and an external device and capable of transmitting and receiving data to and from each other. Storage means for storing the algorithm, encrypted data generation means for generating encrypted data using the encryption algorithm stored in the storage means, and decryption for decrypting the encrypted data using the encryption algorithm stored in the storage means Encrypting means, data storage means for storing the encrypted data received from the external device, and transmitting the discrimination data to the external device and encrypting the received encrypted data by the external device using the same encryption algorithm as used for encrypting the received encrypted data. The encrypted identification data is received, and the received encrypted identification data is decrypted by the decryption means and transmitted. Determining whether or not the received encrypted data has been encrypted by comparing with the separate data to determine whether or not the received encrypted data has been encrypted by the external device. Storage means for storing, encrypted data generation means for generating encrypted data using an encryption algorithm stored in the storage means, and decryption means for decrypting the encrypted data using the encryption algorithm stored in the storage means When,
A data storage unit for storing the encrypted data received from the IC card; and a determination that the identification data is transmitted to the IC card and the received encrypted data is encrypted by the IC card using the same encryption algorithm as used for encrypting the received encrypted data. Receiving the encrypted data, decrypting the received encrypted identification data by decryption means, and comparing whether or not the received identification data matches the transmitted identification data. Determining means for determining whether or not encryption has been performed by an encryption algorithm.

Preferably, the encrypted data generating means generates the encrypted data by using an encryption algorithm arbitrarily selected from the encryption algorithms stored in the storage means.

The discrimination data is preferably a random number encrypted by an arbitrarily selected encryption algorithm.

[0013] The discriminating means sequentially decrypts the encrypted discriminating data according to an encryption algorithm stored in the storage means.

The present invention is also an IC card used in the above IC card system.

According to the present invention, the IC card and the external device have a plurality of encryption algorithms, an encryption algorithm is arbitrarily selected between the IC card and the external device, and it is determined which encryption algorithm has been selected. Since the IC card has means capable of performing the above operation, the IC card can hold data generated by a plurality of encryption algorithms, and the external device can read data generated by the plurality of encryption algorithms.

[0016]

Next, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 shows an IC of the present invention.
It is a block diagram showing a card system.

As shown in FIG. 1, the IC card 1 has a CP
U (central processing unit) 2, memory 3, memory 4, and IC card side interface 5. CPU2 is an IC
The operation of the entire card 1 is controlled. The memory 3 stores an encryption algorithm A, an encryption algorithm B, and an encryption algorithm C. The memory 3 can also be used as a data file area other than the storage areas for the above-mentioned encryption algorithms A, B, and C. The memory 4 stores a random number generation algorithm.

The external device 6 is a communication terminal device such as a computer or a workstation connected to a communication network. As shown in FIG. 1, the external device 6 has a CPU 7, a memory 8, a memory 9, and an external device-side interface 10. The CPU 7 controls the operation of the entire external device 6. The memory 8 stores an encryption algorithm A, an encryption algorithm B, and an encryption algorithm C. The memory 8 also stores the encryption algorithms A, B, C
Can be used as a data file area. The memory 9 stores a random number generation algorithm.

The IC card 1 and the external device 6 can read and write data via the interface 5 and the interface 10. In practice, the operator inserts the IC card 1 into a reader / writer (not shown) provided in the external device 6 to perform work.

FIG. 2 is a configuration diagram of a data file used in the IC card system of the present invention. As shown in FIG. 2, the data file includes a file name 15, an encryption algorithm name 16, and a data name 17. FIG.
Now, there are four files. FIG. 2 (A)
File name: 1, encryption algorithm name: A, data name:
Data file of A (Datal) (Data1 is encrypted by encryption algorithm A), FIG. 2B shows file name: 2, encryption algorithm name: B, data name: B (Data2) (Data2 is encrypted by encryption algorithm B) Encrypted) data file, Figure 2
(C) shows a file name: 3, an encryption algorithm name: C,
Data name: C (Data3) (Data3 is encrypted with encryption algorithm C), and FIG. 2D shows file name: 4, encryption algorithm name: A, data name: A (Data
4) shows a data file of (Data4 is encrypted by the encryption algorithm A).

Next, the operation of the IC card system of the present invention will be described with reference to the flowcharts of FIGS.
FIG. 3 is a flowchart showing an operation when writing data from an external device to an IC card.

First, the external device 6 generates a random number. An arbitrary encryption algorithm is selected according to the generated random numbers. In the example of FIG. 3, C is selected as the encryption algorithm. Next, the external device 6 encrypts the data to be written (Data3) using the encryption algorithm C, and
(Data3) is generated. The external device 6 writes C (Data 3) on the IC card 1. Also, file 3 is specified as the file name.

The IC card 1 generates a file 3.
Write C (Data3) in the data area of the generated file 3. Next, the IC card 1 generates a random number according to a random number generation algorithm stored in the memory 4.
An arbitrary encryption algorithm is selected according to the generated random number 1. In the example of FIG. 3, A is selected as the encryption algorithm. The IC card 1 encrypts the random number 1 according to the encryption algorithm A, and generates A (random number 1) as discrimination data. Next, A (random number 1) is transmitted to the external device 6.

The external device 6 converts the received A (random number 1) into
A (random number 1) is encrypted according to the encryption algorithm C used when writing data to the IC card 1 first, and C (A
(Random number 1)) is generated. The external device 6 transmits C (A (random number 1)) to the IC card 1.

The IC card 1 decrypts the received C (A (random number 1)). The decryption is performed in the order of the three types of encryption algorithms A, B, and C held by the IC card 1, and it is determined whether the decrypted result matches A (random number 1). As a result of the determination, C (A
When (random number 1)) is decoded, it matches A (random number 1), so C (Data 3) previously transmitted from the external device 6
Can be determined that the encryption algorithm C has been used. The IC card 1 writes “C” in the area of the encryption algorithm name 16 of the file 3.

As described above, the IC card 1 can add, to the file 3, the encryption algorithm information used by the data written in the area of the data name 17 to the area of the encryption algorithm name 16.

FIG. 4 is a flowchart showing the operation when reading data from an IC card to an external device.

The external device 6 first issues, for example, an instruction to read the file 4 to the IC card 1. The IC card 1 transmits A (Data 4) stored in the data name 17 area of the file 4 to the external device 6 according to a command from the external device 6. The external device 6 stores the received A (Data 4) in the area of the memory 8 of the external device 6. External device 6
Generates a random number, and selects an arbitrary encryption algorithm according to the generated random number 2. In the example of FIG. 4, B is selected as the encryption algorithm. The external device 6 encrypts the random number 2 according to the encryption algorithm B, and generates B (random number 2) as discrimination data. The external device 6 transmits the generated B (random number 2) to the IC card 1.

According to the encryption algorithm A indicated by the encryption algorithm name 16 in the file 4, the IC card 1
(Random number 2) is encrypted to generate A (B (random number 2)),
The data is transmitted to the external device 6.

The external device 6 performs decryption according to the order of the three types of encryption algorithms A, B, and C, and determines whether the decrypted result matches B (random number 2). As a result of the determination, if A (B (random number 2)) is decrypted according to the encryption algorithm A, it matches B (random number 2).
The external device 6 can determine that A (Data 4) existing in the data 17 area is data encrypted by the encryption algorithm A. The external device 6 is provided with A (Data
4) is decrypted according to the encryption algorithm A, and Data4 which is original data can be obtained.

According to the IC card system of the present invention, the IC card system has a plurality of encryption algorithms, arbitrarily selects an encryption algorithm between the IC card 1 and the external device 6, and determines which encryption algorithm is selected. Since the IC card 1 has means capable of performing the above operations, the IC card 1 can hold data generated by a plurality of encryption algorithms, and the external device 6 can read data generated by the plurality of encryption algorithms. As a result, the security of the secret data in the IC card 1 can be further improved.

The present invention is not limited to the above-described embodiment, but can be variously modified within the scope of the technical matters described in the claims.

For example, in the embodiment of the present invention, three types of encryption algorithms are used, but a plurality of other types of encryption algorithms may be used.

[0034]

According to the present invention, the IC card and the external device have a plurality of encryption algorithms, an encryption algorithm is arbitrarily selected between the IC card and the external device, and which encryption algorithm is selected. Therefore, the IC card can hold data generated by a plurality of encryption algorithms, and the external device can read data generated by the plurality of encryption algorithms. As a result, the security of the secret data in the IC card can be further improved.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an IC card system of the present invention.

FIG. 2 is a configuration diagram of a data file used in the IC card system of the present invention.

FIG. 3 is a flowchart showing an operation when writing data from an external device to an IC card.

FIG. 4 is a flowchart showing an operation when data is read from an IC card to an external device.

FIG. 5 is a configuration diagram showing a conventional IC card.

FIG. 6 is a configuration diagram showing a conventional IC card system.

[Explanation of symbols]

 1: IC card 2: CPU 3: Memory 4: Memory 5: Interface 6: External device 7: CPU 8: Memory 9: Memory 10: Interface

Claims (5)

[Claims] 1. An IC card system having an IC card and an external device and capable of transmitting and receiving data to and from each other, the IC card comprising: a storage unit for storing a plurality of encryption algorithms; An encrypted data generation unit that generates encrypted data by using an encryption algorithm stored in the storage unit; a decryption unit that decrypts encrypted data by using an encryption algorithm stored in the storage unit; Data storage means for storing encrypted data, and identification data encrypted by the external device using the same encryption algorithm as used for transmitting the identification data to the external device and encrypting the received encrypted data. Is received, the received encrypted identification data is decrypted by the decrypting means, and the transmitted identification data is decrypted. Determining whether or not the received encrypted data has been encrypted by comparing the received encrypted data with the external device. The external device stores a plurality of encryption algorithms. Storage means; encrypted data generation means for generating encrypted data using an encryption algorithm stored in the storage means; decryption means for decoding encrypted data using the encryption algorithm stored in the storage means; Data storage means for storing the encrypted data received from the IC card; and transmitting the discrimination data to the IC card and encrypting the received encrypted data with the IC card using the same encryption algorithm as used for encrypting the received encrypted data. The encrypted identification data is received, and the received encrypted identification data is decrypted by the decryption means. And determining whether the received encrypted data has been encrypted by comparing the received encrypted data with the transmitted determination data to determine whether or not the data is identical to the transmitted determination data. IC card system. 2. The encrypted data generating means according to claim 1, wherein said encrypted data generating means generates encrypted data by using an encryption algorithm arbitrarily selected from encryption algorithms stored in said storage means. IC card system. 3. The IC card system according to claim 1, wherein said discrimination data is a random number encrypted by an encryption algorithm arbitrarily selected. 4. The apparatus according to claim 1, wherein said determination means sequentially decrypts the encrypted determination data using an encryption algorithm stored in said storage means. 2. The IC card system according to 1. 5. An IC card used in the IC card system according to claim 1.