JP4576894B2 - Information management apparatus and information management method - Google Patents

Description

  The present invention relates to an information management apparatus and an information management method for managing access to information stored in a relatively large memory area, and more particularly, to store electronic value information in a memory area for electronic settlement. The present invention relates to an information management apparatus and an information management method for exchanging secure information at the beginning.

  More specifically, the present invention relates to an information management device that allocates a file system for an individual service provider company on a memory area and manages information for service operation by the company in the file system, and The present invention relates to an information management method, and in particular, allocates a file system for each service provider on a single memory area, shares a single storage medium with multiple providers, and uses a single storage medium to The present invention relates to an information management apparatus and an information management method for providing a service.

  Non-contact / proximity communication systems represented by IC cards are widely used because of their ease of operation. For example, by storing PIN code, other personal authentication information, value information such as electronic tickets in an IC card, visitors and passengers at cash dispensers, entrances to concert venues, ticket gates at stations, etc. Authentication processing can be performed.

  This type of wireless communication is generally realized based on the principle of electromagnetic induction. That is, an IC card having a memory function and a card reader / writer that performs read / write access to the memory of the IC card, a loop coil on the IC card side as a primary coil and a card as a secondary coil The antenna on the reader / writer side forms one transformer as a system. Then, power and information are similarly transmitted from the card reader / writer side to the IC card by electromagnetic induction, and the IC card side is driven by the supplied power to generate an inquiry signal from the card reader / writer side. You can respond to it. Therefore, the IC card itself does not need to have a driving power source such as a battery.

  A general method of using an IC card is performed by a user holding the IC card over a card reader / writer. The card reader / writer side always polls the IC card, and when an external IC card is found, the communication operation between the two starts.

  Recently, IC cards having a relatively large capacity memory have appeared along with improvements in miniaturization technology. According to an IC card with a large-capacity memory, a single IC card can be used for a plurality of purposes by developing a file system in the memory space and storing a plurality of applications simultaneously. For example, by storing a plurality of applications such as electronic money for electronic payment and electronic ticket for entering a specific concert venue on a single IC card, It can be applied to various uses. The electronic money and electronic ticket mentioned here refer to a mechanism in which payment (electronic payment) is made through electronic data issued according to funds provided by a user, or such electronic data itself.

  A general method of using an IC card is performed by a user holding the IC card over a card reader / writer. The card reader / writer side always polls the IC card, and when an external IC card is found, the communication operation between the two starts.

  At this time, the user inputs the personal identification number to the IC card reader side and collates the input personal identification number with the personal identification number stored on the IC card, so that the IC card and the IC card reader / writer can be compared. The identity verification or authentication process is performed. (The personal identification number used when accessing the IC card is called a PIN (Personal Identification Number) in particular.) And, when the identity verification or authentication process is successful, for example, an application stored in the IC card. Use, that is, access to a service memory area allocated to an application is possible (in this specification, a memory area allocated to an application is referred to as a “service memory area”). Access to the service memory area is appropriately encrypted according to the security level of the application.

  Furthermore, the IC card and the card reader / writer (card read / write device) include a wired interface (not shown) for connecting to an external device in addition to a wireless / contactless interface, and a mobile phone, PDA (Personal Digital Assistance) By using it in each device such as a CE (Consumer Electronics) device or a personal computer, these devices can be equipped with either or both of an IC card and a card reader / writer. In such a case, the IC card technology can be used as a versatile bidirectional proximity communication interface.

  For example, when a proximity communication system is configured between devices such as computers and information home appliances, non-contact communication using an IC card is performed one-to-one. In addition, it is possible for a certain device to communicate with a partner device other than a device such as a non-contact IC card. In this case, an application that performs one-to-many communication between one device and a plurality of cards is also conceivable.

  In addition, various applications using an IC card, such as electronic value information exchange with the outside such as electronic payment, can be executed on the information processing terminal. For example, user interaction with an IC card can be performed on the information processing terminal using a user interface such as a keyboard or display on the information processing terminal. Further, since the IC card is connected to the mobile phone, the contents stored in the IC card can be exchanged via the telephone network. Furthermore, it is possible to pay the usage fee with an IC card by connecting to the Internet from a mobile phone.

  In this way, a file system for a certain service provider company is allocated to the built-in memory of the IC card, and information (for example, user identification / authentication information of the user) for service operation by the company in this file system is allocated. And the remaining value information, usage history (log), etc.) to realize useful services based on contactless / proximity communication that replace conventional prepaid cards and service cards for each store. Can do.

  Conventionally, an IC card is issued for each service provider, and is used for the user. For this reason, the user has to prepare and carry IC cards for each service he / she wants to use. On the other hand, according to the IC card having a relatively large memory space, it is possible to ensure a sufficient capacity for recording information related to a plurality of services in the built-in memory of a single IC card (for example, (See Non-Patent Document 1).

  However, if a single memory area is shared among multiple service providers, the memory area used by one service provider can be freely accessed by another provider sharing the memory. The value information set for each company may allow unauthorized use by other companies. As a result, the service provider cannot provide a sound service, and value information that is highly convertible for the user is exposed to a risk of leakage and suffers economic damage.

  Therefore, when the IC card is shared among a plurality of service provider companies, the user can ensure the usability as if the IC card was issued by the service provider when using each service, while the memory area It is necessary to have a mechanism for securely managing the information for each provider.

  In addition, in order to operate the IC card flexibly, it is necessary to adopt a mechanism capable of stopping the use of its own memory area for each service provider.

  However, if each service provider allows the service provider to resume using the memory area that has been temporarily stopped, regardless of the approval / approval of the IC card issuer. However, flexible operation may be hindered for IC card issuers.

“Business changes with sesame seed chips for all wireless IC tags” (pages 106-107, RFID Technology Editorial Department, Nikkei Business Publications, April 20, 2004)

  An object of the present invention is to provide an excellent information management apparatus and information management method capable of suitably storing secure information such as electronic payment by storing electronic value information in a memory area. There is.

  A further object of the present invention is to allocate a file system for a service provider company on a memory area and to suitably manage information for service operation by the company in the file system. Another object is to provide an information management apparatus and an information management method.

  A further object of the present invention is to allocate a file system for each service provider on a single memory area, share a single storage medium with a plurality of providers, and use a single storage medium for a plurality of services. It is an object to provide an excellent information management apparatus and information management method.

  It is a further object of the present invention to provide an IC card issuer and a service provider company to which individual memory areas are allocated when a memory area in an IC card or IC chip is shared among a plurality of service provider companies. It is an object of the present invention to provide an excellent information management apparatus and information management method capable of flexibly operating a memory area by allowing the use of each area to be stopped individually.

The present invention has been made in view of the above problems, and is an information management apparatus that includes a memory space and manages the memory space by dividing it into one or more file systems,
A key management unit for registering and changing the collective key for all file systems, registering and changing the individual key for each file system, and managing the change history of the collective key and each individual key;
An authentication key generator for generating an authentication key for the file system based on a combination of the collective key and the individual key of the file system;
An access control unit that controls access to the corresponding file system based on authentication by the authentication key of the file system and the change history of the collective key and the individual key of the file system;
It is an information management device characterized by comprising.

  The information management device mentioned here is the same as a wireless communication unit, a non-contact IC card containing an IC chip having a data transmission / reception function and a data processing unit, a contact IC card having a terminal on the surface, and a contact / non-contact IC card. It is a device in which an IC chip having a function is incorporated in an information communication terminal device such as a mobile phone, a PHS (Personal Handyphone System), or a PDA (Personal Digital Assistance). Hereinafter, these may be collectively referred to simply as an “IC card”.

  This information management apparatus has a memory area including a data storage memory such as an EEPROM and a data processing unit, and also has a data communication function. In the case of a mobile phone or the like, an external storage medium such as an IC card incorporating an IC chip may be detachable. Further, a SIM (Subscriber Identity Module) function that records subscriber information issued by a mobile phone company may be mounted on the IC chip. The information management device may perform data communication via an information communication network such as the Internet, or may directly perform data communication with an external terminal device in a wired or wireless manner.

  The present invention relates to the provision of a service that requires security including exchange of value information using tamper resistance and an authentication function of an IC card. Specifically, a file system for each service provider is allocated on a single memory area, a single information management device is shared by multiple operators, and multiple services are provided by a single data communication device. To offer. By dividing the memory area into file systems, the boundary between the file systems functions as a firewall, and access from other file systems (that is, other service providers) is preferably excluded.

  Once the memory area is divided, access to the file system requires authentication not to the original IC card issuer but to the service provider of the file system itself. Therefore, it is possible for the user to ensure usability as if the IC card was issued by the operator when using each service.

  Here, in order to realize the flexible operation of the IC card, it is necessary to adopt a mechanism capable of stopping the use of the file system for each service provider. On the other hand, if the service provider can arbitrarily stop and restart the use of the memory area allocated to itself, it prevents the IC card issuer from operating the entire file system flexibly.

  In the present invention, the IC card issuer can stop the memory area once allocated to other service provider companies by dividing the memory area by changing the collective key. In addition, by restoring the changed aggregate key, the use of the memory area of the IC card issuer itself and the area allocated to each service provider is resumed.

  On the other hand, each service provider can also stop using its own area by dividing the memory area by changing the individual key. Here, simply reverting the individual key cannot resume the use of the corresponding memory area, and with the approval or consent of the IC card issuer, update it with the collective key, and update the new authentication key. It was made impossible to resume use without obtaining it.

  Accordingly, it is possible to operate the IC card more flexibly for all file systems while avoiding the situation of controlling the suspension and restart of the memory area for each service provider.

  According to the present invention, a file system for each service provider is allocated on a single memory area, a single storage medium is shared by a plurality of providers, and a plurality of services are provided by a single storage medium. An excellent information management apparatus and information management method that can be provided can be provided.

  According to the present invention, when a memory area in an IC card or an IC chip is shared among a plurality of service provider companies, the service provider company to which the IC card issuer and the individual memory areas are allocated is provided. However, it is possible to provide an excellent information management apparatus and information management method capable of flexibly operating the memory area by individually enabling the use of each area.

  According to the present invention, the issuer of the original IC card and each service provider that uses the memory area in the IC card separately use the IC card by stopping the use of the memory area individually. Flexible operation can be realized.

  Here, the IC card issuer can stop its own memory area and the area once approved for use by another service provider by dividing the memory area by changing the aggregate key. At the same time, by returning the changed collective key, the use of the memory area of the IC card issuer itself and the area allocated to each service provider is resumed.

  Also, each service provider can also stop using its own area by dividing the memory area by changing the individual key. On the other hand, the use of the corresponding memory area cannot be resumed simply by returning the individual key to the original one, and with the approval or consent of the IC card issuer, it is updated together with the collective key to obtain a new authentication key. You can't resume using it without it. Therefore, it is possible to operate the IC card more flexibly while avoiding the situation of stopping and restarting the use of the memory area for each service provider.

  Other objects, features, and advantages of the present invention will become apparent from more detailed description based on embodiments of the present invention described later and the accompanying drawings.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

A. Non-contact data communication system 1 by the IC card, and the applicable non-contact IC card communication system constituting the present invention is schematically shown.

  This contactless card system is composed of a card reader / writer 1, an IC card 2, and a controller 3. The card reader / writer 1 and the IC card 2 are contactless using electromagnetic waves, Data is transmitted and received. That is, the card reader / writer 1 transmits a predetermined command to the IC card 2, and the IC card 2 performs processing corresponding to the received command. Then, the IC card 2 transmits response data corresponding to the processing result to the card reader / writer 1.

  The card reader / writer 1 is connected to the controller 3 via a predetermined interface (for example, one that conforms to the RS-485A standard or the like). The controller 3 supplies a control signal to the card reader / writer 1 to perform a predetermined process.

  FIG. 2 shows a configuration example of the card reader / writer 1 shown in FIG.

  The IC chip module 21 includes a data processing unit (DPU) 31 that processes data, a signal processing unit (SPU) 32 that processes transmission signals to the IC card 2 and reception signals from the IC card 2, and a controller. A memory including an SCC (Serial Communication Controller) 33 that communicates with the CPU 3, a ROM unit 41 that stores information necessary for data processing in advance, and a RAM unit 42 that temporarily stores work data being processed These functional modules are interconnected via a bus. A flash memory 22 for storing predetermined data is also connected to this bus.

  The DPU 31 outputs a transmission command to the IC card 2 to the SPU 32, receives response data received from the IC card 2 from the SPU 32, and performs predetermined data processing.

  The SPU 32 performs a modulation process such as BPSK (BiPhase Shift Keying) on the transmission command to the IC card 2, and then outputs it to the modulation circuit 23 and receives response data from the IC card 2 from the demodulation circuit 25. Then, predetermined demodulation processing such as BPSK is performed on the data.

  The modulation circuit 23 performs ASK (Amplitude Shift Keying) modulation of a carrier wave having a predetermined frequency (for example, 13.56 MHz) supplied from the oscillator 26 with data supplied from the SPU 32, and generates a modulated wave from the antenna 27 as an electromagnetic wave. Is output to the IC card 2 as follows. At this time, the modulation circuit 23 performs ASK modulation with the degree of modulation less than 1. That is, the maximum amplitude of the modulated wave is prevented from becoming zero even when the data is at a low level.

  The demodulation circuit 25 demodulates the modulated wave (ASK modulated wave) received via the antenna 27 and outputs the demodulated data to the SPU 32.

  FIG. 3 shows a configuration example of the IC card 2 shown in FIG. This IC card includes an IC chip module 51 and an antenna 53 on a loop.

  The IC chip module 51 receives the modulated wave transmitted from the card reader / writer 1 via the antenna 53. The capacitor 52 constitutes an LC circuit together with the antenna 53, and is tuned (resonated) with an electromagnetic wave having a predetermined frequency (carrier frequency).

  The IC chip module 51 includes an RF interface unit 61, a calculation unit 64, and the like. The RF interface unit 61 includes an ASK demodulation unit 81, a voltage regulator 82, an oscillation circuit 83, and an ASK modulation unit 84. The ASK demodulator 81 detects and demodulates the modulated wave (ASK modulated wave) received via the antenna 53, and outputs the demodulated data to a BPSK demodulator circuit 62 and a PLL (Phase Locked Loop) 63. The voltage regulator 82 stabilizes the signal detected by the ASK demodulator 81 and supplies it to each circuit as DC power.

  Further, the RF interface unit 61 oscillates a signal having the same frequency as the data clock frequency by the oscillation circuit 83 and outputs the signal to the PLL unit 63. Then, the ASK modulation unit 84 changes the load of the antenna 53 as the power source of the IC card 2 corresponding to the data supplied from the calculation unit 64 (for example, turns on / off a predetermined switching element corresponding to the data) And a predetermined load is connected in parallel to the antenna 53 only when the switching element is in an ON state), whereby the modulated wave received through the antenna 53 is ASK-modulated, and the modulation component is transmitted through the antenna 53. To the card reader / writer 1. When transmitting data from the IC card 2, the card reader / writer 1 keeps the maximum amplitude of the modulated wave output from the card reader / writer 1, and this modulated wave is ASK-modulated by fluctuations in the load of the antenna 53. . Further, the terminal voltage of the antenna 27 of the card reader / writer 1 varies with the data transmission.

  The PLL unit 63 generates a clock signal synchronized with the data from the data supplied from the ASK demodulation unit 81 and outputs the clock signal to the BPSK demodulation circuit 62 and the BPSK modulation circuit 68.

  When the data demodulated by the ASK demodulator 81 is BPSK modulated, the BPSK demodulator circuit 62 demodulates the data according to the clock signal supplied from the PLL unit 63 and outputs the demodulated data to the arithmetic unit 64. To do.

  When the data supplied from the BPSK demodulation circuit 62 is encrypted, the arithmetic unit 64 decrypts the data with the encryption / decryption unit 92 and then processes the data with the sequencer 91. If the data is not encrypted, the data supplied from the BPSK demodulation circuit 62 is directly supplied to the sequencer 91 without going through the encryption / decryption unit 92.

  The sequencer 91 performs processing corresponding to data as a command supplied thereto. For example, the sequencer 91 performs processing such as writing and reading of data with respect to an EEPROM (Electrically Erasable & Programmable ROM) 66.

  The parity calculation unit 93 of the calculation unit 64 calculates a Reed-Solomon code as parity from the data stored in the EEPROM 66 or the data stored in the EEPROM 66. Further, the arithmetic unit 64 performs predetermined processing by the sequencer 91 and then outputs response data (data to be transmitted to the card reader / writer 1) corresponding to the processing to the BPSK modulation circuit 68.

  The BPSK modulation circuit 68 performs BPSK modulation on the data supplied from the calculation unit 64, and outputs the modulated data to the ASK modulation unit 84 of the RF interface unit 61.

  The ROM 65 permanently stores a processing program to be executed by the sequencer 91 and other necessary data. The RAM 67 temporarily stores work data when the sequencer 91 performs processing.

  The EEPROM 66 is a non-volatile memory for storing a large number of applications such as electronic money for making an electronic payment on the IC card 2 and an electronic ticket for entering a specific concert venue. Used. Since the IC card 2 itself does not basically have a driving power source such as a battery, the IC card 2 retains data even after the communication with the card reader / writer 1 is terminated and the power supply is stopped or no power is supplied. A non-volatile memory such as EEPROM 66 that can continue is used.

  Next, data transmission / reception processing between the card reader / writer 1 and the IC card 2 will be described.

  The card reader / writer 1 emits a predetermined electromagnetic wave from the antenna 27, monitors the load state of the antenna 27, and waits until a change in the load state due to the approach of the IC card 2 is detected. Note that the card reader / writer 1 emits an ASK-modulated electromagnetic wave with a predetermined short pattern of data, and repeats a call to the IC card 2 until a response from the IC card 2 is obtained within a predetermined time. (Polling) may be performed.

  When the approach of the IC card 2 is detected in the card reader / writer 1, the SPU 32 of the R / W 1 uses the rectangular wave of a predetermined frequency (for example, a frequency twice as high as the data clock frequency) as a carrier wave. BPSK modulation is performed using data to be transmitted to 2 (commands corresponding to processing to be executed by the IC card 2 or data to be written to the IC card 2), and the generated modulated wave (BPSK modulation signal) is output to the modulation circuit 23.

  In BPSK modulation, data can be made to correspond to a change in the phase of the modulated wave by using differential conversion. In this case, even if the BPSK modulation signal is inverted, it is demodulated to the original data, so that it is not necessary to consider the polarity of the modulated wave when demodulating.

  The modulation circuit 23 performs ASK modulation on a predetermined carrier wave with an input BPSK modulation signal with a modulation factor of less than 1 (for example, 0.1) (= maximum amplitude of data signal / maximum amplitude of carrier wave), and generated modulation A wave (ASK modulated wave) is transmitted to the IC card 2 via the antenna 27.

  When transmission is not performed, the modulation circuit 23 generates a modulated wave at a high level, for example, of two levels (high level and low level) of the digital signal.

  In the IC card 2, in the LC circuit composed of the antenna 53 and the capacitor 52, a part of the electromagnetic wave radiated by the antenna 27 of the card reader / writer 1 is converted into an electric signal, and the electric signal (modulated wave) is converted into an IC. It is output to the RF interface 61 of the chip module 51. Then, the ASK demodulator 81 of the RF interface 61 performs envelope detection by rectifying and smoothing the modulated wave, and supplies the generated signal to the voltage regulator 82 and suppresses the DC component of the signal. The data signal is extracted, and the data signal is output to the BPSK demodulation circuit 62 and the PLL unit 63.

  The voltage regulator 82 stabilizes the signal supplied from the ASK demodulator 81, generates DC power, and supplies it to each circuit.

At this time, the terminal voltage V ₀ of the antenna 53 is, for example, as follows.

V ₀ = V ₁₀ (1 + k × V _s (t)) cos (ωt)

However, V ₁₀ cos (ωt) represents a carrier wave, k represents a modulation degree, and V _s (t) represents data output from the SPU 32.

The low level value V _LR of the voltage V ₁ after rectification by the ASK demodulator 81 is, for example, as follows.

V _LR = V ₁₀ (1 + k × (−1)) − V _f

Here, V _f indicates a voltage drop in a diode constituting a rectifier circuit for performing rectification and smoothing in the ASK demodulator 81, and is generally about 0.7 volts.

  When the voltage regulator 82 receives the signal rectified and smoothed by the ASK demodulator 81, the voltage regulator 82 stabilizes the signal and supplies it as DC power to each circuit including the arithmetic unit 64. Since the modulation degree k of the modulated wave is less than 1, the voltage fluctuation after rectification (difference between high level and low level) is small. Therefore, DC power can be easily generated in the voltage regulator 82.

For example, when a modulated wave having a modulation degree k of 5% is received so that V ₁₀ is 3 volts or more, the low level voltage V _LR after rectification is 2.15 (= 3 × (1-0.05) −0.7) volts or more, and the voltage regulator 82 can supply each circuit with a voltage sufficient as a power source. In this case, the amplitude 2 × k × V ₁₀ (Peak-to-Peak value) of the AC component (data component) of the voltage V ₁ after rectification becomes 0.3 (= 20.05 × 3) volts or more, and ASK The demodulator 81 can demodulate data with a sufficiently high S / N ratio.

  In this way, by using an ASK modulated wave having a modulation degree k of less than 1, communication is performed with a low error rate (in a high S / N ratio), and a sufficient DC voltage as a power source is applied to the IC card 2. Supplied.

  When receiving the data signal (BPSK modulated signal) from the ASK demodulator 81, the BPSK demodulator 62 demodulates the data signal in accordance with the clock signal supplied from the PLL unit 63, and outputs the demodulated data to the calculator 64. .

  When the data supplied from the BPSK demodulation circuit 62 is encrypted, the arithmetic unit 64 decrypts the data with the encryption / decryption unit 92 and then supplies the data (command) to the sequencer 91 for processing. It should be noted that the card reader / writer 1 is on standby while transmitting data having a value of 1 after the data is transmitted to the IC card 2 until a response is received. Therefore, during this period, the IC card 2 receives a modulated wave having a constant maximum amplitude.

  When the processing is completed, the sequencer 91 outputs data to be transmitted to the card reader / writer 1 to the BPSK modulation circuit 68. The BPSK modulation circuit 68 BPSK-modulates the data, like the SPU 32 on the card reader / writer 1 side, and then outputs the data to the ASK modulation unit 84 of the RF interface unit 61.

  The ASK modulation unit 84 can vary the load connected to both ends of the antenna 53 using a switching element. That is, by changing the load in accordance with the data from the BPSK modulation circuit 68, the received modulated wave is ASK modulated in accordance with the data to be transmitted, whereby the terminal voltage of the antenna 27 of the card reader / writer 1 is changed. The data is changed and transmitted to the card reader / writer 1.

  On the other hand, the modulation circuit 23 on the card reader / writer 1 side continues to transmit data having a value of 1 (high level) when receiving data from the IC card 2. Then, in the demodulation circuit 25, the data transmitted by the IC card 2 from the minute fluctuation (for example, several tens of microvolts) of the terminal voltage of the antenna 27 electromagnetically coupled to the antenna 53 of the IC card 2 is obtained. Detected.

  Further, in the demodulation circuit 25, the detected signal (ASK modulated wave) is amplified and demodulated by a high gain amplifier, and the resulting digital data is output to the SPU 32. The SPU 32 demodulates the data (BPSK modulation signal) and outputs it to the DPU 31. The DPU 31 processes the data from the SPU 32 and determines whether or not to end the communication according to the processing result.

  If it is determined that communication is to be performed again, communication is performed between the card reader / writer 1 and the IC card 2 in the same manner as described above. On the other hand, if it is determined that the communication is to be terminated, the card reader / writer 1 terminates the communication process with the IC card 2.

  As described above, the card reader / writer 1 transmits data to the IC card 2 by using the ASK modulation whose modulation degree k is less than 1. The IC card 2 receives the data, performs processing corresponding to the data, and returns data corresponding to the processing result to the card reader / writer 1.

B. File System Sharing FIG. 4 schematically shows the overall configuration of a service providing system that uses electronic money, electronic tickets, and other value information realized using an IC card.

  The illustrated system 100 includes, for example, an issuer communication device 111 used by the IC card issuer 121, an operator communication device 112 used by the card storage area operator 122, and a manufacturer used by the device manufacturer 123. Communication device 113, storage area dividing device 114 used by card storage area user 124, and operation file registration device 115.

  When the IC card issuer 121 issues the IC card 116 to the card holder 126, the file data related to the service provided by the card storage area user 124 is registered in the IC card 16 based on a predetermined condition. The card holder 126 can receive services of both the IC card issuer 121 and the card storage area user 124 by using a single IC card 116.

  As shown in FIG. 4, in the system 100, an issuer communication device 111, an operator communication device 112, a manufacturer communication device 113, a storage area dividing device 114, and an operation file registration device 115 are connected via a network 117. Connected.

  The IC card issuer 121 is a person who issues the IC card 116 and provides its own service using the IC card 116.

  In response to a request from the IC card issuer 121, the card storage area operator 122, among the storage areas configured in the storage unit (semiconductor memory) in the IC card 116 issued by the IC card issuer 121, is an IC card. A person who provides a service for lending a storage area not used by the issuer 121 to the card storage area user 124.

  The device manufacturer 123 is a person who receives a request from the card storage area operator 122, manufactures the storage area dividing device 114, and delivers it to the card storage area user 124.

  The card storage area user 124 makes a request to the card storage area operator 122 and provides his / her own service using the storage area of the IC card 116, and divides the memory area into a new file. -Corresponds to a service provider that creates a system (described above), and provides its own service using its own file system.

  The card holder 126 is a person who receives an IC card 116 issued from the IC card issuer 121 and receives a service provided by the IC card issuer 121. When the card holder 126 wishes to receive the service provided by the card storage area user 124 after the IC card 116 is issued, the card owner 126 uses the storage area dividing device 114 and the operation file registration device 115 to store the card. The file data related to the service of the area user 124 is stored in the IC card 116, and thereafter, the service of the card storage area user 124 can be received.

  The system 100 provides the services of the IC card issuer 121 and the card storage area user 124 when providing the service of the IC card issuer 121 and the service of the card storage area user 124 using the single IC card 116. It has a configuration that makes it difficult for an unauthorized person to write or rewrite data in a storage area for storing such file data.

  The IC card 116 may be a card-type data communication device as its meaning, or embodied as a mobile phone (or other mobile terminal or CE device) incorporating a semiconductor chip on which a so-called 1 IC card function is mounted. Sometimes it is done.

  4 illustrates the case where there is a single IC card issuer 121, a card storage area user 24, and a card holder 26, respectively, these may be plural.

  By utilizing the tamper resistance and authentication function of the IC card, it is possible to provide a service requiring security including exchange of value information. Specifically, a single memory area in an IC card is shared among a plurality of service provider companies, which reduces the burden of card issuance at the service provider operators and manages them for the user to carry. The number of IC cards to be reduced is reduced.

  Here, when a single memory area is shared among multiple service providers, the memory area used by one service provider can be freely accessed by another provider sharing the memory. Then, there is a problem that value information set for each business operator allows unauthorized use by other business operators.

  Thus, in this embodiment, a file system for each service provider is allocated on a single memory area, a single IC card is shared by a plurality of providers, and a plurality of services are provided by a single IC card. To offer. By dividing the memory area into file systems, the boundary between the file systems functions as a firewall, and unauthorized access from other file systems can be suitably eliminated.

  In the initial state of the memory area in the IC card, the IC card issuer manages the entire memory area. When a service provider other than the IC card issuer divides a new file system from the memory area, both authority to divide the memory area and authentication to the IC card issuer are required.

  Once divided, access to the file system requires authentication not to the original IC card issuer but to the service provider of the file system itself. Therefore, it is possible for the user to ensure usability as if the IC card was issued by the operator when using each service. By repeating the division operation, the memory area in the IC card has a structure in which a plurality of file systems coexist. The division of the file system is the issue of a virtual IC card.

  Here, an operation mode of the memory area in the IC card will be described with reference to FIGS.

  FIG. 5 shows the state of the memory area where the original card issuer manages only its own file system. The system code SC1 of the original card issuer is given by the system code management mechanism. When the external device or program accesses the file system of the card issuer, SC1 is set as an identification code (that is, an argument of the request command).

  FIG. 6 shows that the card issuer can permit a certain range of memory to be lent (or transferred) to the area manager within the free area of his file system. At this stage, the file system in the memory area is not yet divided. The card issuer can permit a plurality of area managers to lend memory as long as there is a free area in his file system. For example, in an implementation in which a file system is identified by a 4-bit system code, a maximum of 16 divisions (up to 15 divisions) can be performed.

  FIG. 7 shows a state where another service provider has divided the memory area in the area permitted by the card issuer and created a new file system. The new file system is assigned the system code SC2 from the system code management mechanism. When the external device or program accesses the file system operated by the memory area manager (service provider), SC2 is used as an identification code (request command argument).

  FIG. 8 shows a state where the common area manager divides the memory with the system code SC0 of the common area in the area permitted by the card issuer. When an external device or program accesses the file system which is the operation area of the common area manager, the system code SC0 is used as an identification code (request command argument).

  The memory area of the IC card has a structure in which a plurality of file systems coexist as shown in FIG. 9 by repeating the dividing operation. The original card issuer and the service provider that has acquired its own file system on the IC card with the permission of the card issuer, use their own file system to arrange areas and services. (Described later), can be used for own business development.

  Here, an operation mode in one file system will be described. Basically, the same operation is realized in any file system. In order to operate the file system, it is assumed that an area ID request by polling and a procedure of mutual authentication (described above) have been performed.

  In the file system, one or more applications such as electronic value information exchange with the outside such as electronic payment are allocated. A memory area allocated to an application is called a “service memory area”. The use of an application, that is, a processing operation for accessing a corresponding service / memory area is referred to as a “service”. Services include read access to memory, write access, value addition and subtraction for value information such as electronic money.

  In order to limit the use of the application, that is, the activation of the service depending on whether the user has the access right or not, a password or PIN is assigned to the application, and a PIN verification process is performed when the service is executed. Access to the service memory area is appropriately encrypted according to the security level of the application.

  In this embodiment, a hierarchical structure similar to a “directory” is introduced for each file system set in the memory area in the IC card. Each application assigned to the memory area can be registered in an “area” of a desired hierarchy.

  For example, multiple applications used for a series of transactions or applications that are closely related are registered as service memory areas in the same area (and areas that are closely related are registered in the same parent area). As a result, the applications of the memory area and the arrangement of the areas are orderly, and the classification and organization of the applications is efficient for the user.

  In addition, in order to hierarchically control access rights to the file system, in addition to setting a PIN for each application, a PIN can be set for each area. For example, by inputting a PIN corresponding to a certain area, it is possible to give access rights to all applications (and subareas) in the area through verification processing and mutual authentication processing. Therefore, since the access right of all applications used in a series of transactions can be obtained by performing only one PIN input for the corresponding area, access control is made efficient and the usability of the device is improved. .

  Further, it is allowed that the access authority for a certain service memory area is not single, and a password can be set for each access authority, that is, for each service content to be executed in the service memory area. For example, different PINs are set for services “read” and “read and write” to be activated for the same service memory area. Separate PINs are set for “increase” and “decrease” for electronic money and other value information. In addition, PIN input is not required for reading from a certain memory area, but PIN input can be required for writing.

  FIG. 10 schematically shows an example of the data structure in the file system. In the illustrated example, a hierarchical structure similar to a “directory” is introduced into the storage space of the file system. That is, each application assigned to the memory area can be registered as a service memory area in a desired hierarchical area. For example, applications that are closely related such as applications used in a series of transactions can be registered in the same area (and areas that are closely related are registered in the same parent area).

  In addition, an application (that is, a service memory area) and an area allocated in the file system include a code definition block. Therefore, a PIN can be set for each application or for each area. Further, the access right to the file system can be performed in units of applications and in units of areas.

  Further, the access authority for a certain service memory area is not single, and a PIN can be set for each service content to be executed. For example, when the services activated for the same service memory area are “read” and “read and write”, different PINs are set, and “increase” and “decrease” for electronic money and other value information , Different PINs are set.

  The verification unit, for example, a PIN code sent via a protocol interface such as non-contact data communication using an IC card in the area assigned to each application or directory or the service memory area. And access to the matching memory area is permitted. The memory area to which access is permitted can be read and written via the protocol interface.

  As described above, various service memory areas allocated to applications are allocated in the file system, and one or more services applicable to each service memory area are provided. In the present embodiment, in addition to restricting access in area units and application units, it is possible to set a PIN for each type of service applied to an application and perform access restriction in service units.

  FIG. 11 shows the basic configuration of the file system. As already described with reference to FIG. 10, a hierarchical structure similar to “directory” is introduced to the file system, and a service memory area allocated to the application is registered in an area of a desired hierarchy. be able to. In the example shown in FIG. 11, one service memory area is registered in the area 0000 defined by the area 0000 definition block.

  The illustrated service memory area is composed of one or more user blocks. A user block is a minimum data unit for which an access operation is guaranteed. For this service memory area, one service defined in the service 0108 definition block, that is, the service 0108 can be applied.

  In addition to restricting access in area units and application units, a security code can be set for each service type to restrict access in service units. The code setting information regarding the service subject to the access restriction is defined as a service dedicated to the code (that is, “code service”). In the example shown in FIG. 11, the code related to the service 0108 is defined as a code code service 0128 definition block. The contents of the password service are stored in the password service data block.

  If the security code service for service 0108 is enabled, the security code must be verified using security code service 0128 before activating service 0108 and performing a read or write operation on that user block. Become. Specifically, when a read / write command with encryption is used, a password, that is, a PIN is checked against the service 0108 before mutual authentication.

  In addition, the service memory area allocated to the application can be registered in an area of a desired hierarchy, and the areas can be hierarchized (areas that are closely related are registered in the same parent area). In this case, by setting a PIN for each area, the area can be used as an access restriction unit. FIG. 12 shows a state in which areas are hierarchized in the memory space of the IC card. In the example shown in the figure, another area 1000 defined by the area 1000 definition block is registered in the area 0000 defined by the area 0000 definition block.

  In the example shown in FIG. 12, two service memory areas are registered in the area 1000. The service 1108 defined in the service 1108 definition block and the service 110B defined in the service 110B definition block can be applied to one service memory area. In this specification, defining a plurality of services having different service contents for one service memory area is referred to as “overlap service” in this specification. In the overlap service, different services are applied to the same service area according to the entered PIN. The service 110C defined in the service 110C definition block can be applied to the other service memory area.

  A service set in each service memory area can be activated to perform a read or write operation on the user block. Of course, as described with reference to FIG. 11, a code code service can be defined for each service. In this case, when the personal identification code service for the service is valid, the service is permitted to be activated after collating the PIN using the personal identification code service.

  When a common PIN is set for a plurality of services, an area including these services can be created, and a common password service can be applied to this area.

  In the example shown in FIG. 12, the personal identification code for the area 1000 is defined as a personal identification code service 1020 definition block. The contents of the password service are stored in the password service data block.

  If the password service for the area 1000 is valid (described later), after verifying the password using the password service 1020, each service in the area 1000 is activated and the user block is activated. A read or write operation can be performed.

  FIG. 13 schematically shows a functional configuration of firmware in an IC card in which a plurality of file systems can be provided in the internal memory.

  The interface control unit is a protocol such as communication with a card reader / writer via a contactless IC card interface, communication as a card reader / writer, communication via a wired interface, communication via other I / O interfaces, etc. Take control.

  The command control unit performs processing of commands received from the outside via the interface control unit, issuance of commands to the outside, inspection of commands, and the like.

  The security control unit realizes security processing such as authentication processing when accessing a memory area or each file system in the memory area, and PIN verification when using a directory or service in the file system.

  The file system control unit performs file system management such as division (and cancellation of division) from the memory area to the file system as described above, and management of the directory structure in the file system.

  The mode management unit manages the modes of all file systems and individual file systems. The mode mentioned here includes states such as suspension of use and resumption of use of the file system.

  In addition, firmware for hardware control in the IC card such as start control, ROM management, parameter management, nonvolatile memory management, patch control, and the like is also included.

C. Suspension and resumption of use of file system As described above, a file system for each service provider is allocated on a single memory area built in the IC card, and a single IC card is assigned to a plurality of companies. And a plurality of services can be provided by a single IC card. By performing access control using a different authentication key for each file system, the boundary between file systems functions as a firewall, and unauthorized access from other file systems can be suitably eliminated. .

  Here, in order to realize the flexible operation of the IC card, it is necessary to adopt a mechanism capable of stopping the use of the file system for each service provider.

  When the IC card issuer manages the authentication key for accessing the file system, each service provider that has been assigned a file system by splitting uses the file system according to their business development. Since it cannot be stopped, it lacks flexibility. On the other hand, if each service provider can individually generate an authentication key that controls access to its own file system, the IC card issuer stops and restarts the use of each file system. Since it becomes impossible to grasp at all, it is inflexible from the viewpoint of the operation of all file systems.

  Therefore, in this embodiment, the IC card issuer holds a collective key for managing the operation of all file systems, and at the same time a file system for each service provider that is assigned a file system by memory division. Introduces a mechanism to hold individual keys for managing individual items.

  FIG. 14 illustrates a mechanism for generating an authentication key for accessing the file system.

  As shown in the figure, the authentication key generation unit inputs the collective key held by the IC card issuer and the individual key held by the service provider that is assigned the file system, and a predetermined key is assigned to these two keys. An arithmetic process (for example, multiplication) is performed to generate an authentication key, which is used as an access key to the file system.

  FIG. 15 illustrates a mechanism for controlling access to individual file systems in an IC card.

  A service provider assigned with a file system is given an aggregate key held by the IC card issuer or an authentication key obtained by computing the aggregate key and the individual key. Therefore, when accessing the user's file system, authentication can be performed using a combination of the collective key and the individual key held by the user, or an authentication key obtained therefrom.

  The access control unit in the IC card inputs an aggregate key held by the IC card issuer and an individual key held by the service provider assigned to the file system, and performs a predetermined operation on these two keys. Processing (for example, multiplication) is performed to generate an authentication key, and this is compared with the authentication key input at the time of access to determine whether access is possible. Alternatively, when a combination of an aggregate key and an individual key is input at the time of access, an authentication key is generated by performing the same operation on these keys, and collation with the authentication key held inside is performed.

  According to such an authentication key mechanism, the IC card issuer can stop using the entire file system by changing the aggregate key. Also, the service provider can individually stop using the file system by changing the individual key, and does not affect the use of other file systems.

For example, the collective key held by the IC card issuer is _KU1 , the individual key held by the service provider obtained by dividing the i-th file system is KP _{(i) 1} , and the authentication key generation unit It is assumed that an authentication key K _{AUTH (i) 1} = f (K _U1 , K _{P (i) 1} ) is generated using the function f.

In this case, when the IC card issuer changes the collective key to _KU2 , the authentication keys of all the file systems are changed, so that the use of all the file systems is stopped. On the other hand, when the service provider to which the j-th file system is assigned changes the individual key from K _{P (j) 1} to K _{P (j) 2} , only this file system is authenticated. Therefore, the usage can be stopped individually for each file system.

According to the mechanism shown in FIG. 15, the IC card issuer changes his collective key to use his own file system, and the use of a file system that has been once approved for use by another service provider by division. Then, the use of the memory area of the IC card issuer itself and the area allocated to each service provider is resumed by returning the changed aggregate key. That is, after the IC card issuer has changed the set key to K _U2, in the case of back to the original set key K _U1 is, because the authentication key for all of the file system becomes restored, use the system as a whole Is resumed.

Further, in the mechanism shown in FIG. 15, the service provider can stop and restart the use of individual file systems without permission. That is, after the service provider to which the j-th file system is assigned changes the individual key from K _{P (j) 1} to K _{P (j) 2} , the original individual key K _{P (j) 1} is changed. When it returns, the use of the file system is resumed.

  However, if the service provider is free to stop and restart the use for each file system in this way, it becomes an obstacle for the IC card issuer to operate the entire file system flexibly.

  Therefore, each service provider can also stop using its own file system by changing the individual key. However, if the individual key is restored, the corresponding memory area is resumed. It is not possible to do so, and with the approval or consent of the IC card issuer, it is updated together with the collective key so that the use cannot be resumed without obtaining a new authentication key.

  As a result, it is possible to more flexibly operate the IC card for all file systems while avoiding the situation where access authority is controlled for each business operator.

  FIG. 16 illustrates a mechanism for controlling access to individual file systems in an IC card. According to the illustrated configuration, unlike the case shown in FIG. 15, the key management unit is provided. The key management unit registers and changes the collective key of the IC card issuer and registers and changes individual keys for each file system. In addition, the key management unit manages the change of individual keys and the change history of aggregate keys, and the individual service provider is a file system that has been suspended once it has been approved by the IC card issuer. Can be resumed.

Authentication key generation unit, a set key K _U of the IC card issuer, type the individual key K _{P (i)} of each service provider company i the file system assigned using a predetermined function f These two keys are subjected to predetermined arithmetic processing to generate an authentication key K _{AUTH (i)} = f (K _U , K _{P (i)} ), which is used as an individual access key to the file system.

When an access to the file system in the IC card is performed from the outside, the access control unit collates the authentication key K _AUTH managed by itself with the authentication key K _AUTH ′ input from the access request source. Alternatively, when the collective key K _U ′ and the individual key K _{P (i)} ′ are input from the access request source, verification is performed by actually generating the authentication key K _AUTH ′ using the function f.

Here, when the IC card issuer changes the collective key from _KU1 to _KU2 , the authentication keys of all the file systems are changed, and the use of all the file systems is stopped. Further, when the original aggregate key _KU1 is restored, the authentication keys for all the file systems are restored, and the use of the entire system is resumed. Modes such as use suspension and use resumption are managed by the mode management unit (described above).

On the other hand, if the service provider to whom the jth file system is assigned changes the individual key from K _{P (j) 1} to K _{P (j) 2} , the authentication key is changed only for this file system. Therefore, the use can be stopped individually for each file system. Modes such as use suspension and use resumption are managed by the mode management unit (described above).

  The key management unit manages the aggregate key and each individual key, but retains the state that the jth individual key has been changed. This state is recorded in, for example, a nonvolatile memory (flash memory 22) that is the substance of the memory area.

The access control unit refers to the change history of the aggregate key and the individual key when an access request is made using the authentication key. When only the individual key is changed, it can be detected that the resumption of use of the file system has been performed without the approval of the IC card issuer. Therefore, the access control unit does not permit access to the corresponding file system. In other words, after the service provider changes the individual key from K _{P (j) 1} to K _{P (j) 2} , it returns to the original individual key K _{P (j) 1} without the approval of the IC card issuer. However, since only the individual key is changed, the use of the file system is not resumed.

Here, the service provider changed the individual key from K _{P (j) 1} to K _{P (j) 2} for the IC card issuer and stopped using the file system. Report to that effect. When the IC card issuer approves the notification, the IC card issuer changes the collective key from _KU1 to _KU2 .

The key management unit accepts the new aggregate key _{KU2 and} individual key K _{P (j) 2} and holds a history that the aggregate key has also been changed (or resets the state that only the individual key has been changed) To do).

By changing these keys, a new authentication key K _{AUTH (j) 2} = f (K _U2 , K _{P (j) 2} ) for the file system is generated.

When an access request is made with an authentication key, the access control unit refers to the change history of the aggregate key and the individual key, and both the aggregate key and the individual key are changed (or only the individual key is It is possible to detect that the resumption of the use of the file system has been approved by the IC card issuer. Then, with the new authentication key K _{AUTH (j) 2} = f (K _U2 , K _{P (j) 2} ) for the file system, the same authentication process as described above for the access to the file system Execute.

  Note that the key change processing as described above may be limited to be executed only via a wired interface from the viewpoint of security. However, even in this case, if the individual key is changed, authentication cannot be performed from any interface such as a wireless or non-contact IC card as well as a wired interface.

  FIG. 17 shows the operation procedure of the IC card file system based on the key management as described above. In the illustrated example, it is assumed that the service provider has just obtained a file system divided from the memory area.

  In the initial state, any file system in the IC card cannot be used.

The service provider, for example, accesses the IC card via a wired interface, for example, and changes (sets) the individual key K _P1 of its own file system in the key management unit.

When the IC card issuer authenticates the use of the file system by the service provider, the IC card issuer changes (sets) the collective key _KU1 . As a result, the file system can be used, and the access control unit starts authenticating access to the file system.

  FIG. 18 shows an operation procedure in which the IC card issuer stops using the entire file system.

  As a premise of this operation procedure, all the file systems in the IC card can be normally used, and the access control unit authenticates the access to each file system.

Here, the IC card issuer changes the collective key _KU1 to _KU2 . As a result, the authentication keys of all the file systems are changed, so that all the file systems cannot be normally used, that is, the use of the IC card itself is stopped.

Then, IC card issuer returns the set key to the original K _U1. As a result, since the authentication keys of all the file systems are restored, the state where all the file systems can be normally used, that is, the use of the IC card itself is resumed.

  FIG. 19 shows an operation procedure for the service provider to individually stop using the file system.

  As a premise of this operation procedure, all the file systems in the IC card can be normally used, and the access control unit authenticates the access to each file system.

When the service provider to which the jth file system is assigned changes the individual key from K _{P (j) 1} to K _{P (j) 2} , the authentication key is changed only for this file system. Individually, the use of the file system is stopped. Other file systems that do not change the individual key remain available for normal use.

At this time, the key management unit holds a state that the j-th individual key has been changed. Then, when an access request is made with an authentication key, the access control unit refers to the change history of the collective key and the individual key, and does not perform the authentication operation when only the individual key has been changed. For this reason, even if it is returned to the original individual key K _{P (j) 1} without the approval of the IC card issuer, the use of the file system is not resumed because only the individual key is not changed.

Here, the service provider changed the individual key from K _{P (j) 1} to K _{P (j) 2} for the IC card issuer and stopped using the file system. Make a notification to the effect. When the IC card issuer approves the notification, the IC card issuer changes the collective key from _KU1 to _KU2 .

The key management unit accepts the new aggregate key _{KU2 and the} individual key K _{P (j) 2} and holds a history that the aggregate key has also been changed. Then, the access management unit detects that the resumption of use of the file system has been approved by the IC card issuer by changing both the collective key and the individual key, and performs an authentication operation for the file system. Will come to do. As a result, each file system can be normally used, and the use is resumed.

  The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiment without departing from the gist of the present invention.

  In this specification, a file space in which a plurality of file systems are developed on a memory built in an IC card or an IC chip is taken as an example, and in the case where the authority is different for each file system, the entire file system Although the embodiment for suitably managing the suspension and resumption of use and the suspension and resumption of use of individual file systems has been described, the gist of the present invention is not limited to this. For example, when performing access management to the same type of file system on a memory device other than an IC card or IC chip, the present invention can be applied to obtain the same operation and effect.

  In short, the present invention has been disclosed in the form of exemplification, and the description of the present specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims section described at the beginning should be considered.

FIG. 1 is a diagram schematically showing a configuration of a contactless IC card communication system to which the present invention can be applied. FIG. 2 is a diagram showing a configuration example of the card reader / writer 1. FIG. 3 is a diagram illustrating a configuration example of the IC card 2. FIG. 4 is a diagram schematically showing the overall configuration of a service providing system that uses electronic money, electronic tickets, and other value information realized using an IC card. FIG. 5 is a diagram showing the state of the memory area in which the original card issuer manages only its own file system. FIG. 6 is a diagram showing that the card issuer can permit a certain range of memory to be lent (or transferred) to the area manager within the free area of his file system. FIG. 7 is a diagram showing a state in which another service provider company divides the memory area in the area permitted by the card issuer and generates a new file system. FIG. 8 is a diagram illustrating a state where the memory is divided by the common area system code SC0 in the area permitted by the card issuer by the common area manager. FIG. 9 is a diagram showing a structure in which a plurality of file systems coexist by repeating the division operation of the memory area of the IC card. FIG. 10 is a diagram schematically showing an example of the data structure in the file system. FIG. 11 is a diagram showing the basic configuration of the file system. FIG. 12 is a diagram showing a state in which areas are hierarchized in the memory space of the IC card. FIG. 13 is a diagram schematically illustrating a functional configuration of firmware in an IC card in which a plurality of file systems can be provided in the internal memory. FIG. 14 is a diagram for explaining a mechanism for generating an authentication key for controlling access to the file system. FIG. 15 is a diagram for explaining a mechanism for controlling access to individual file systems in an IC card. FIG. 16 is a diagram for explaining a mechanism for controlling access to individual file systems in an IC card. FIG. 17 is a sequence diagram showing the operation procedure of the IC card file system. FIG. 18 is a sequence diagram showing the operation procedure of the IC card file system. FIG. 19 is a sequence diagram showing the operation procedure of the IC card file system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Card reader / writer 2 ... IC card 3 ... Controller 21 ... IC chip module 23 ... Modulation circuit 25 ... Demodulation circuit 27 ... Antenna 51 ... IC chip module 52 ... Capacitor 53 ... Antenna 61 ... RF interface part 62 ... BPSK demodulating circuit 63 ... PLL section 64 ... computing section 65 ... ROM
66… EEPROM
67 ... RAM
68 ... BPSK modulation circuit 81 ... ASK demodulation unit 82 ... Voltage regulator 83 ... oscillation circuit 84 ... ASK modulation unit 91 ... sequencer 92 ... encryption / decryption unit 93 ... parity calculation unit 111 ... issuer communication device 112 ... operator communication Device 113 ... Manufacturer communication device 114 ... Storage area division registration device 115 ... Operation file registration device 116 ... IC card 117 ... Network 121 ... Card issuer 122 ... Card storage area operator 123 ... Device manufacturer 124 ... Card storage area User

Claims (6)

An information management device comprising a memory space and managing the memory space by dividing it into one or more file systems,
A key management unit for registering and changing the collective key for all file systems, registering and changing the individual key for each file system, and managing the change history of the collective key and each individual key;
An authentication key generator for generating an authentication key for the file system based on a combination of the collective key and the individual key of the file system;
In response to an authentication request to the file system, refer to the change history of the collective key and the individual key of the file system. If only the collective key is changed, authentication processing is performed and the file system is normally used. An access control unit to enable it;
An information management apparatus comprising: An information management device comprising a memory space and managing the memory space by dividing it into one or more file systems,
A key management unit for registering and changing the collective key for all file systems, registering and changing the individual key for each file system, and managing the change history of the collective key and each individual key;
An authentication key generator for generating an authentication key for the file system based on a combination of the collective key and the individual key of the file system;
In response to the authentication request to the file system, the change history of the collective key and the individual key of the file system is referred to. When only the individual key is changed, the authentication process is stopped and the file system is An access control unit that is normally unavailable,
An information management apparatus comprising: The access control unit resumes the authentication process when both the individual key and the collective key are changed, and makes the file system normally available.
The information management apparatus according to claim 2. An information management method for dividing and managing the memory space into one or more file systems on a computer having a memory space,
The key management means provided in the computer registers and changes the collective key for all file systems, registers and changes the individual keys for each file system, and manages the collective key and the change history of each individual key. Key management steps;
An authentication key generation means for generating an authentication key for the file system based on a combination of the collective key and the individual key of the file system;
In response to the authentication request to the file system, the access control means provided in the computer refers to the change history of the collective key and the individual key of the file system, and if only the collective key is changed, an authentication process is performed. An access control step to make the file system normally available;
An information management method characterized by comprising: An information management method for dividing and managing the memory space into one or more file systems on a computer having a memory space,
The key management means provided in the computer registers and changes the collective key for all file systems, registers and changes the individual keys for each file system, and manages the collective key and the change history of each individual key. Key management steps;
An authentication key generation means for generating an authentication key for the file system based on a combination of the collective key and the individual key of the file system;
In response to an authentication request to the file system, the access control means provided in the computer refers to the collective key and the change history of the individual key of the file system, and if only the individual key is changed, an authentication process is performed. And an access control step that makes the file system normally unavailable ,
An information management method characterized by comprising: In the access control step, when both the individual key and the collective key are changed, the authentication process is resumed, and the file system is brought into a normally usable state.
The information management method according to claim 5, wherein:

Images