JP2007034946A - Information processor and method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To rapidly access a service memory area imposed with access restriction. <P>SOLUTION: The service memory area accessed by one service is configured by at least one data block, and a definition block storing prescribed definition information for defining the service is associated. Inside the definition information of each the definition block, PIN setting ineffectiveness information showing that execution of the service is not restricted, or PIN setting effectiveness information showing that the execution of the service is restricted is set, and a secret code necessary for authentication of the execution of the service is also set when the PIN setting effectiveness information is set. The PIN setting information is referred to, and it is decided whether the access is restricted or not. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an information processing device and method, and a program, and more particularly, to an information processing device and method, and a program that enable quick access to a service memory area in an IC chip.

In recent years, cellular phones and the like in which a non-contact IC chip such as FeliCa (registered trademark) is incorporated have become widespread. For example, a user can simply hold an electronic money by holding the cellular phone over a terminal (reader / writer) installed in a store. You can easily make payments with.

  By the way, such processing in the IC chip (for example, payment processing by electronic money) is performed by accessing a predetermined memory area in the IC chip and appropriately reading and writing data stored therein. Although implemented, access to the memory area is restricted depending on the data to be handled.

  That is, when the process is actually started, the memory area to which access is restricted among the memory areas that need to be accessed first is transferred to the memory area based on a predetermined password assigned to the memory area. The process is started after the access is authenticated. During processing, the authentication result of access to the memory area is confirmed at any time, and the memory area is accessed.

  In the following, a memory area to be accessed (a memory area in which data to be accessed necessary for processing is stored) is referred to as a service memory area, and a processing operation for accessing the service memory area is referred to as a service.

  A service memory area accessed by one service is composed of one or more data blocks in which data to be read or written is stored. The service memory area is associated with a definition block storing predetermined definition information for defining a service.

  Access to the personal identification code is also one service (hereinafter referred to as PIN service), and the service memory area accessed by the PIN service is composed of data blocks in which personal identification data and the like are stored. Is associated with a definition block that defines a PIN service.

  Such definition blocks and data blocks are set by registering services. When there are a plurality of services, the services are registered hierarchically as shown in FIG. 1 (see Patent Document 1). .

  In this example, conceptual ranges of “system” and “area” are provided, and “area A0” is provided subordinate to “system”, and “area A1” and “area” are subordinate to “area A0”. Area A2 "is provided. In addition, a PIN service S1-1 (service required for authentication for using a service subordinate to "Area A1") and a service S1-2 subordinate to "Area A1" are registered respectively. .

  In the “area A2”, the service S2-1 and the PIN service S2-2 of the service S2-1 (services necessary for authentication of the execution of the service 2-1) are registered.

  By registering services hierarchically in this way, services executed in a series of transactions can be registered together in a predetermined “area”, so that service management can be facilitated.

  Here, the “area” and service registration (hereinafter abbreviated as “service registration” where appropriate) processing will be briefly described with reference to FIG.

  As shown in FIG. 2, a block (definition block, data block) corresponding to a service generated by assigning a predetermined block code is a predetermined memory area (hereinafter referred to as a data area) of a non-volatile memory in the IC chip. Stored in a predetermined physical address & of 1A.

  As shown in FIG. 2, for example, the block code of each block corresponding to the service is stored in a predetermined memory area (hereinafter referred to as management file 2) of the nonvolatile memory in the IC chip in a logical address in the order corresponding to the hierarchical structure. # Is associated.

  In the example of FIG. 2, the logical address # is associated with the definition block of each service in the hierarchical structure order from the top logical address #, and the data block is the last logical address in the hierarchical structure order. Corresponding from address #.

  That is, for the definition block, the top (first) logical block # 00 is associated with the block code of the topmost “system” definition block in the example of FIG. The block code of the definition block of “Area A0” is associated with the second logical block # 01, and the block code of the definition block of “Area A1” subordinate to “Area A0” Logical block # 02 is associated.

  Then, the fourth logical block # 03 and the fifth logical block # 04 are associated with the block codes of the definition blocks of the PIN service S1-1 and service S1-2 subordinate to “area A1”, respectively.

  The block code of the definition block of another “area A2” subordinate to “area A0” is associated with the sixth logical block # 05, and service S2-1 and PIN service subordinate to “area A2” The definition block of S2-2 is associated with the seventh logical block # 06 and the eighth logical block # 07, respectively.

  As for the data block, the data block of the PIN service S1-1 belonging to “area A1” does not have a data block in “system”, “area A0”, and “area A1” higher than that, so Is associated with logical address # 20, and the data block of service S1-2 is associated with logical address # 19.

  Further, the logical address # 18 is associated with the data block of the PIN service S2-2 belonging to “area A2”.

  As described above, the logical address # is associated with the block code of each service in the order according to the hierarchical structure. However, as shown in FIG. 2, the physical address & of each block is stored in the nonvolatile memory in the IC chip. A predetermined memory area (hereinafter referred to as a management area) 1B (FIG. 2) is stored in the storage unit 11 at a position corresponding to the order of the logical address # associated with the block code.

  In the example of FIG. 2, for example, the physical address & 01 of “system” (its definition block) associated with the first logical address # 00 is stored in the first storage unit 11 of the management area 1B. Also, the physical address & 10 of “area A0” (its definition block) associated with the second logical address # 01 is stored in the second storage unit 11 of the management area 1B.

  In this way, a predetermined block (definition block, data block) is stored at a predetermined physical address & in the data area 1A. For example, a logical address # corresponding to a hierarchical structure is associated with a block code, and a physical address & Is stored in association with the logical address #, so that the service is registered.

  Next, access processing (service execution) to the service memory area will be described with reference to the flowchart of FIG. It is assumed that the service memory area to which access is restricted has already been authenticated.

  In step S1, a service memory area to be accessed (hereinafter referred to as a target service memory area) is detected. Details of this processing are shown in the flowchart of FIG.

  In step S21, for example, a service code of a service for accessing the target service memory area (hereinafter referred to as a target service) is input. The input service code is appropriately determined by executing a process (for example, a payment process using electronic money).

  In this case, the target service memory area is the data block of the service S1-2 in the registered service as shown in FIGS. 1 and 2, and here, the block code of the definition block of the service S1-2 is It is assumed that the service code is input as the service S1-2.

  In step S22, a logical address # corresponding to the block code of the input definition block is detected.

  Since the block code of the definition block of the service S1-2 is managed in the logical file 2 in association with the logical address # 04 as shown in FIG. 2, the logical address # 04 is detected.

  In step S23, the physical address & stored in the storage unit 11 at the position corresponding to the detected logical address # 04 in the management area 1B is detected.

  The fifth storage unit 11 corresponding to the logical address # 04 (fifth logical address #) in the management area 1B stores the physical address & 04 of the definition block of the service S1-2. Address & 04 is detected.

  In step S24, the detected block (definition block of service S1-2) stored in the physical address & 04 of the data area 1A is detected, and the definition information therein is read out.

  In step S25, the block code of the data block of the service S1-2 is detected from the read definition information of the service S1-2, and the logical address # 19 corresponding to the code is detected.

  In step S26, the information is stored in the storage unit 11 (the second storage unit 11 from the back) at the position corresponding to the detected logical address # 19 (the second logical block # from the back) in the management area 1B. The physical address & 17 of the current data block is detected.

  When a data block in the target service memory area is detected in this way (when its physical address & is detected), returning to FIG. 3, in step S2, access to the target service memory area (execution of service S1-2) It is determined whether or not is restricted.

  When execution of a service is restricted, authentication based on a personal identification code is required for execution of the service, so access to a memory area in which the authentication code is stored (PIN service) is registered.

  A predetermined code that can be derived from the service code of the service to be authenticated (block code of the definition block) is assigned to the service code of the PIN service (block code of the definition block).

  For example, when the block code of the service S1-2 is composed of 16 bits and is “1008”, a block code (service code) of “1028” in which the sixth bit is 1 is assigned to the PIN service.

  That is, here, it is determined whether the service code of the PIN service that can be derived from the service code input in step S21 is set in the logical file 2 (FIG. 2).

  In the present example, since the execution of the service S1-2 is not restricted, the PIN service code corresponding to the service code of the service S1-2 does not exist in the logical file 2.

  If it is determined in step S2 that access to the target service memory area (execution of the target service) is restricted, the process proceeds to step S3 to determine whether or not access is permitted.

  When execution of the target service is permitted, the service code of the corresponding PIN service is stored in a predetermined memory area (hereinafter referred to as an authenticated service storage area) of the volatile memory in the IC chip. Therefore, in this case, it is determined whether the service code of the PIN service obtained in step S2 is stored in the authenticated service storage area.

  If it is determined in step S2 that the PIN service of the target service does not exist, or if it is determined in step S3 that access is permitted, the process proceeds to step S4.

  In step S4, it is determined whether or not the “parent area” exists in the target service (determining whether or not the target service is registered depending on a predetermined “area”).

  Specifically, when a service is registered subordinate to a predetermined “area”, the definition information (definition information read in step S24) of the definition block of the service includes the code “parent area” ( Since the block code of the definition block of “parent area” is set, it is determined whether the code of “parent area” is set in the definition information.

  In the example of FIG. 1, since the service S1-2 is registered subordinate to the “area A1”, the “parent area” exists, and the definition information of the definition block of the service S1-2 includes “A1 area”. "Is set.

  If it is determined in step S4 that the “parent area” exists, the process proceeds to step S5 to determine whether or not access to the “parent area” is restricted. That is, it is determined whether or not the PIN service code that can be derived from the “parent area” code is set in the logical file 2.

  In this case, access to “Area A1” is restricted, and the PIN service S1-1 of “Area A1” exists.

  At this time, the logical address # is obtained from the code of the “parent area”, and the physical address & of the definition block is detected from the logical address # and stored in the detected physical address & of the data area 1A. The definition information of the “parent area” is read.

  If it is determined in step S5 that access to the “parent area” is restricted, the process proceeds to step S6, and whether or not the access is permitted (the PIN service S1-1 code is an authenticated service storage area). Or not) is determined.

  If it is determined in step S5 that access to the “parent area” is not restricted, or if it is determined in step S6 that access is permitted, the process proceeds to step S7, where the access restriction is confirmed. It is determined whether or not a “parent area” that does not exist still exists. If it is determined that the “parent area” still exists, the process returns to step S5, and the same processing is performed on the upper “parent area”.

  In the example of FIG. 1, since “area A1” is subordinate to “area A0” and “system”, is access restricted to “area A0” and “system” (step S5)? If it is restricted, it is determined whether it is permitted (step S6). At this time, definition information of “area A0” and “system” is also read.

  If it is determined in step S3 that the target service is not permitted, or if it is determined in step S6 that access to the “parent area” is not permitted, the process proceeds to step S8, for example, that the access has failed. Error processing as presented to the user is executed.

  If it is determined in step S4 that the “parent area” does not exist, or if it is determined in step S7 that access restrictions for all “parent areas” have been confirmed (when all restrictions are authenticated). In step S9, the data block detected in step S1 (step S26 in FIG. 4) is accessed.

  When an error process is performed in step S8, or when a service memory area is accessed in step S9, the process ends.

  In this way, access to the target service memory area is performed.

JP 2004-310557 A

  However, in the method described above, the access restriction of “area” is confirmed (step S5). If the restriction is made, the PIN service code derived from the “area” code is set in the logical file 2. This is done by determining whether or not. That is, when the hierarchy becomes deeper and the number of times of searching for the logical file 2 increases, the search takes time, and the access processing cannot be performed quickly.

  The present invention has been made in view of such a situation, and makes it possible to perform access processing quickly even when services are registered hierarchically.

The information processing apparatus according to the present invention includes access restriction information indicating whether access to a service memory area is restricted in a memory space and a service memory area in which data to be accessed secured in the memory space is stored. Definition means for associating definition information to be included; authentication means for authenticating access to a service memory area where access to the service memory area is restricted;
Execution means for executing access to the service memory area, and the execution means determines whether or not access to the service memory area is restricted based on the access restriction information included in the definition information. When the access is restricted, it is determined whether or not the access is permitted. When the access is permitted, the service memory area is accessed.

  The service memory area is secured in the memory space depending on the area, and the definition means associates the area with definition information including access restriction information indicating whether or not access to the area is restricted, and performs authentication. When access to the area is restricted, the means authenticates access to the area, and the execution means restricts access to the service memory area and the area based on the access restriction information included in the definition information. If the access is restricted, it is judged whether the access is permitted. If the access is permitted, the service memory area and the area are accessed.

  According to the information processing method of the present invention, definition information including access restriction information indicating whether or not access to a service memory area is restricted in a service memory area in which data to be accessed secured in a memory space is stored. A definition step for associating, an authentication step for authenticating access to the service memory area where access to the service memory area is restricted, and an execution step for executing access to the service memory area, wherein the execution step includes definition information On the basis of the access restriction information included in the file, it is determined whether or not access to the service memory area is restricted, and if the access is restricted, it is determined whether or not the access is permitted. If it is, the service memory area is accessed.

  The program of the present invention is a definition for associating definition information including access restriction information indicating whether or not access to a service memory area is restricted with a service memory area in which data to be accessed secured in a memory space is stored. An authentication step for authenticating access to the service memory area where access to the service memory area is restricted; and an execution step for executing access to the service memory area. The execution step is included in the definition information On the basis of the access restriction information, whether or not access to the service memory area is restricted. If the access is restricted, whether or not the access is permitted is permitted. If it is, the service memory area is accessed.

  In the information processing apparatus and method and the side-by-side program of the present invention, access restriction indicating whether or not access to the service memory area is restricted in the service memory area in which data to be accessed secured in the memory space is stored Definition information including information is associated, access to the service memory area to which access to the service memory area is restricted is authenticated, and access to the service memory area is performed based on the access restriction information included in the definition information. It is determined whether or not the access is restricted. If the access is restricted, it is determined whether or not the access is permitted. If the access is permitted, the service memory area is accessed.

  According to the present invention, for example, access to a service memory area in an IC chip can be speeded up.

  Embodiments of the present invention will be described below. Correspondences between constituent elements described in the claims and specific examples in the embodiments of the present invention are exemplified as follows. This description is to confirm that specific examples supporting the invention described in the claims are described in the embodiments of the invention. Therefore, even if there are specific examples that are described in the embodiment of the invention but are not described here as corresponding to the configuration requirements, the specific examples are not included in the configuration. It does not mean that it does not correspond to a requirement. On the contrary, even if a specific example is described here as corresponding to a configuration requirement, this means that the specific example does not correspond to a configuration requirement other than the configuration requirement. not.

  Further, this description does not mean that all the inventions corresponding to the specific examples described in the embodiments of the invention are described in the claims. In other words, this description is an invention corresponding to the specific example described in the embodiment of the invention, and the existence of an invention not described in the claims of this application, that is, in the future, a divisional application will be made. Nor does it deny the existence of an invention added by amendment.

An information processing apparatus according to claim 1 is provided.
A memory space (for example, the data area 41A in FIG. 5);
Definition information including access restriction information (for example, PIN setting information) indicating whether or not access to the service memory area is restricted is associated with the service memory area in which the access target data secured in the memory space is stored. Defining means (for example, the control unit 21 in FIG. 5);
Authentication means (for example, the authentication unit 24 in FIG. 5) for authenticating access to the service memory area where access to the service memory area is restricted;
Execution means for executing access to the service memory area (for example, the control unit 21 in FIG. 5),
The execution means determines whether access to the service memory area is restricted based on the access restriction information included in the definition information. If the access is restricted, whether the access is permitted If it is permitted, the service memory area is accessed (for example, step S53 in FIG. 8).
It is characterized by that.

The information processing apparatus according to claim 2
The service memory area is secured in the memory space depending on the area (for example, FIG. 6 and FIG. 7),
The definition unit associates definition information including access restriction information indicating whether or not access to the area is restricted (for example, FIGS. 6 and 7),
The authentication means authenticates access to the area when access to the area is restricted,
The execution means determines whether or not access to the service memory area and the area is restricted based on the access restriction information included in the definition information. If the access is restricted, the access is permitted. If it is permitted, the service memory area and the area are accessed.

The information processing method according to claim 3 and the program according to claim 4 are:
A definition step of associating definition information including access restriction information indicating whether or not access to the service memory area is restricted with a service memory area in which data to be accessed secured in the memory space is stored;
An authentication step for authenticating access to the service memory area where access to the service memory area is restricted;
An execution step for performing access to the service memory area, and
The execution step determines whether or not access to the service memory area is restricted based on the access restriction information included in the definition information. If the access is restricted, whether or not the access is permitted If it is permitted, the service memory area is accessed (for example, step S53 in FIG. 8).
It is characterized by that.

  FIG. 5 shows a configuration example of the IC chip 11 to which the present invention is applied. The IC chip 11 is used by being incorporated in, for example, an IC card or a mobile phone.

  The RF unit 22 performs wireless communication with a reader / writer (not shown) via an antenna (not shown).

  The memory 23 includes a nonvolatile memory 31 and a volatile memory 32. The nonvolatile memory 31 stores a data area 41A in which each block constituting the service is stored, and a management in which a physical address & of the block is stored. An area 41B and a logical file 42 in which, for example, a block code of a block is set in association with a logical address # are provided.

  The volatile memory 32 is provided with an authenticated service storage area 51 in which, for example, a service code of a service permitted to be executed is stored.

  The authentication unit 24 executes authentication of the service whose execution is restricted based on the password assigned to the service, and stores the service code of the authenticated service in the authenticated service storage area 51 of the memory 23. .

  The control unit 21 controls each unit.

  Also in the present invention, the service memory area accessed by one service is composed of one or more data blocks as in the conventional case, and predetermined definition information for defining the service is stored in the service memory area. Stored definition blocks are associated.

  However, a conventional PIN service is not provided, and information indicating that the execution of the service is not restricted in the definition information of each definition block (hereinafter referred to as PIN setting invalid information) or service execution Is set (hereinafter referred to as PIN setting valid information) (hereinafter referred to as PIN setting information if there is no need to distinguish between PIN setting invalid information and PIN setting valid information) When the setting valid information is set, a password code required for authentication of the execution of the service is also set.

  That is, according to the present invention, each service is registered hierarchically as shown in FIG. In this example, the service registered as shown in FIG. 1 is registered according to the present invention, but the PIN service definition block and its data block in FIG. PIN setting information is set in the definition information.

  PIN setting invalid information is set in the definition information of the definition blocks of “system”, “area A0”, service S1-2, and “area A2”. For "Area A1" and service S2-1, the PIN service S2-1 and PIN service S2-2 in FIG. 1 do not exist, and PIN setting valid information and a password are set in its definition information.

  FIG. 7 shows an example of data stored in the data area 41A, the management area 41B, and the logical file 42 in the IC chip 11 when the service is registered as shown in FIG.

  In the data area 41A, for example, “system”, “area A0”, “area A1”, service S1-2, “area A2”, service S2-1 (FIG. 1) generated by allocating a predetermined block code are generated. The block corresponding to the PIN services S1-1 and S2-2 does not exist) is stored at a predetermined physical address &.

  The block code of each block corresponding to the service is set in the logical file 42 in association with the logical address # in the order corresponding to the hierarchical structure.

  In the example of FIG. 7, the logical address # is associated with, for example, the block code of each service definition block in the order of the hierarchical structure from the top logical address #, and the hierarchical code is included in the block code of the data block. In this order from the last logical address #.

  For the definition block, the first logical block # 00 is associated with the block code of the definition block of the highest “system”, and the block code of the definition block of “area A0” subordinate to “system” The second logical block # 01 is associated, and the third logical block # 02 is associated with the block code of the definition block of “area A1” subordinate to “area A0”.

  Then, the fourth logical block # 03 is associated with the block code of the definition block of the service S1-2 subordinate to “area A1”.

  The block code of another definition block of “area A2” subordinate to “area A0” is associated with the fifth logical block # 04, and the definition block of service S2-1 subordinate to “area A2” Is associated with the sixth logical block # 05.

  For the data block, the last logical address # 20 is associated with the data block of the service S1-2 belonging to “area A1”.

  The physical address & of each block is stored in the management area 41B in the IC chip 11, for example, in the storage unit 61 at a position corresponding to the order of the logical address # associated with the block code.

  In the example of FIG. 7, for example, the physical address & 01 of “system” (its definition block) associated with the first logical address # 00 is stored in the storage unit 61 at the first position in the management area 41B. The Also, the physical address & 10 of “area A0” (its definition block) associated with the second logical address # 01 is stored in the second storage unit 61 of the management area 41B.

  In this way, a predetermined block (definition block, data block) is stored at a predetermined physical address & in the data area 41A. For example, a logical address # corresponding to a hierarchical structure is associated with a block code, and a physical address & Is stored in association with the logical address #, so that the service is registered.

  Next, access processing (service execution) to the service memory area will be described with reference to the flowchart of FIG. It is assumed that the service memory area to which access is restricted has already been authenticated.

  In step S51, the target service memory area is detected. This process is shown in the flowchart of FIG.

  In step S71, the control unit 21 inputs a service code of a service (target service) for accessing a service memory area (target service memory area) to be accessed. The input service code is appropriately determined by executing a process (for example, a payment process using electronic money).

  In this case, the target service memory is a data block of the service S1-2 in the registered service as shown in FIGS. 6 and 7, and here, the block code of the definition block of the service S1-2 is the service It is assumed that the service code is input as S1-2.

  In step S72, the control unit 21 detects a logical address # corresponding to the block code of the input definition block.

  Since the block code of the definition block of the service S1-2 is set in the logical file 42 in association with the logical address # 03 as shown in FIG. 7, the logical address # 03 is detected.

  In step S73, the control unit 21 detects the physical address & stored in the storage unit 61 at the position corresponding to the detected logical address # 03 in the management area 41B.

  The fourth storage unit 61 corresponding to the logical address # 03 (fourth logical address #) in the management area 41B stores the physical address & 03 of the definition block of the service S1-2. Address & 03 is detected.

  In step S74, the control unit 21 detects the definition block of the service S1-2 that is stored in the detected physical address & 03 of the data area 41A, and reads the definition information therein.

  In step S75, the control unit 21 reads the block code of the data block of the service S1-2 from the read definition information of the service 1-2, and detects the corresponding logical address # 20 from the logical file 42.

  In step S76, the control unit 21 is stored in the storage unit 61 (the last storage unit 61) at the position corresponding to the detected logical address # 20 (the last logical address #) in the management area 41B. The physical address & 19 of the data block is detected.

  When the data block in the target service memory area is detected in this way (when its physical address & is detected), returning to FIG. 8, in step S52, the control unit 21 accesses the target service memory area (service S1). -2 execution) is restricted.

  In the present invention, since any PIN setting information of PIN setting valid information or PIN setting invalid information is set in the definition information, any PIN setting information is set in the definition information read in step S74. Whether or not access to the target service memory area is restricted is determined.

  In the present example, since the execution of the service S1-2 is not restricted, PIN definition invalid information (FIG. 6) indicating that the service S1-2 is not restricted is set in the definition information.

  If it is determined in step S52 that access to the target service memory area (execution of the target service) is restricted, the process proceeds to step S53, where it is determined whether access is permitted.

  If execution of the service is permitted, the service code of the service is stored in the authenticated service storage area 51 of the IC chip 11, so the service of the target service is stored in the authenticated service storage area 51. It is determined whether the code is stored.

  If it is determined in step S52 that the execution of the target service is not restricted, or if it is determined in step S53 that access is permitted, the process proceeds to step S54.

  In step S54, the control unit 21 determines whether or not the “parent area” exists in the target service (determines whether or not the target service is registered depending on the predetermined “area”).

  If there is a “parent area” in the service, the “parent area” code (the block code of that definition block) is set in the definition information of the service definition block, so the “parent area” code in the definition information It is determined whether or not is set.

  In the case of the example in FIG. 6, since the service S1-2 is registered subordinate to the “area A1”, the “parent area” exists, and the definition information of the definition block of the service S1-2 includes “area A1”. "Is set.

  If it is determined in step S54 that the “parent area” exists, the process proceeds to step S55, and the control unit 21 determines whether or not access to the “parent area” is restricted.

  Specifically, the logical address # (logical address # 02) corresponding to the code of the “parent area” (for example, “area A1”) is obtained, and from the logical address #, the physical address & (Physical address & 18) is detected. Then, the definition information of the “parent area” at the detected physical address & in the data area 41A (definition information of the area A1) is read, and based on the PIN setting information set therein, the “parent” It is determined whether access to “Area” (area A1) is restricted.

  Since access to “area A1” is restricted, PIN setting valid information is set in the definition information (FIGS. 6 and 7).

  When it is determined in step S55 that access to the “parent area” is restricted, the process proceeds to step S56, and the control unit 21 determines whether or not the access is permitted.

  For example, it is determined whether or not the code of “area A1” is stored in the authenticated service storage area 51.

  If it is determined in step S55 that access to the “parent area” is not restricted, or if it is determined in step S56 that access is permitted, the process proceeds to step S57, and the control unit 21 It is determined whether or not the “parent area” for which the restriction has not been confirmed still exists. If it is determined that the restriction exists, the process returns to step S55, and the same processing is performed on the higher-order “parent area”.

  In the example of FIG. 6, since “area A1” is subordinate to “area A0” and “system”, is access restricted to “area A0” and “system” (step S55)? If it is restricted, it is determined whether it is permitted (step S56).

  If it is determined in step S53 that the target service is not permitted, or if it is determined in step S56 that access to the “parent area” is not permitted, the process proceeds to step S58, and the control unit 21 Error processing is performed so that the user is notified that the access has failed.

  When it is determined in step S57 that access restrictions for all “parent areas” have been confirmed (when all restrictions are authenticated), the process proceeds to step S59, and the control unit 21 detects the data detected in step S51. Access the block.

  As described above, access to the service memory area is executed, and whether or not access is restricted is determined based on the PIN setting information. Therefore, it is not necessary to search the logical file 42 to detect the presence of the PIN service in the “area”, and the service memory area can be quickly accessed.

  In addition, since the service hierarchy can be simplified, the storage capacity can be saved.

  In the present specification, the steps described in the flowcharts are executed in parallel or individually even if they are not necessarily processed in time series, as well as processes performed in time series in the described order. It also includes processing.

It is a figure explaining the conventional service registration. It is another figure explaining the conventional service registration. It is a flowchart explaining the access process to the conventional service memory area. It is a flowchart explaining the process of step S1 of FIG. It is a block diagram which shows the structural example of the IC chip to which this invention is applied. It is a figure explaining the service registration in this invention. It is a figure which shows the data structure of the memory 31 of FIG. It is a flowchart explaining the access process to the service memory area concerning this invention. It is a flowchart explaining the process of step S51 of FIG.

Explanation of symbols

  11 IC chip, 21 control unit, 22 RF unit, 23 memory, 24 authentication unit, 41A data area, 41B management area, 42 logical file

Claims (4)

Memory space,
Definition means for associating definition information including access restriction information indicating whether or not access to the service memory area is restricted with a service memory area in which data to be accessed secured in the memory space is stored;
Authentication means for authenticating access to the service memory area to which access is restricted;
Execution means for executing access to the service memory area,
The execution means determines whether or not access to the service memory area is restricted based on the access restriction information included in the definition information. If the access is restricted, the access is permitted. The information processing apparatus is characterized by determining whether or not the service memory area has been permitted and, if permitted, accessing the service memory area. The service memory area is secured in the memory space depending on the area,
The definition means associates the area with definition information including access restriction information indicating whether or not access to the area is restricted;
The authentication means authenticates access to the area where access is restricted,
The execution means determines whether or not access to the service memory area and the area is restricted based on the access restriction information included in the definition information, and if the access is restricted, The information processing apparatus according to claim 1, wherein it is determined whether or not access is permitted, and when the access is permitted, the service memory area and the area are accessed. A definition step of associating definition information including access restriction information indicating whether or not access to the service memory area is restricted with a service memory area in which data to be accessed secured in the memory space is stored;
An authentication step of authenticating access to the service memory area where access to the service memory area is restricted;
An execution step of executing access to the service memory area,
The execution step determines whether or not access to the service memory area is restricted based on the access restriction information included in the definition information. If the access is restricted, the access is permitted. The information processing method is characterized in that it is determined whether or not the service memory area has been permitted and, if permitted, the service memory area is accessed. A program executed by a processor that controls an information processing apparatus that accesses a service memory area in which data to be accessed secured in a memory space is stored,
A definition step of associating definition information including access restriction information indicating whether or not access to the service memory area is restricted with a service memory area in which data to be accessed secured in the memory space is stored;
An authentication step of authenticating access to the service memory area where access to the service memory area is restricted;
An execution step of executing access to the service memory area,
The execution step determines whether or not access to the service memory area is restricted based on the access restriction information included in the definition information. If the access is restricted, the access is permitted. A program for determining whether or not the service memory area is permitted and, if permitted, accessing the service memory area.

Images