JP3884963B2 - IC card with shared access monitoring function - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an IC card having a function of managing shared access between applications.
[0002]
[Prior art]
In a multi-application IC card equipped with a plurality of applications, in order to effectively use a limited memory resource, applications can access each other and share functions, data, etc., that is, shared access is possible.
However, since shared access is prone to security problems, shared access was made between authorized applications in a controlled environment to prevent unauthorized access and maintain security. . In addition, in a multi-application IC card, since new applications can be added or deleted, the newly added application cannot be pre-approved, so the above method cannot be applied. In Japanese Patent Application No. 2000-268676, a method for solving this problem has been proposed, and shared access with a newly added application has become possible.
[0003]
[Problems to be solved by the invention]
However, even if safety measures are increased, unauthorized use cannot be completely prevented. For example, a software insufficiency of an IC card security system is found and intruded, or parameters for authenticating a user or an application, such as an ID or a PIN (Personal Identification Number) There is always a possibility that an unauthorized sharing access right can be acquired by changing the number of times and trying access many times. If the shared access authority is acquired by an unauthorized means, unauthorized shared access between applications is permitted to the card OS and executed normally.
In addition, abnormal application access may occur due to an application bug, or a failure may occur in legitimate application access.
As a result, even if it is determined that an unauthorized access has been made, there is no means for knowing what access was made between which applications after the access is completed.
[0004]
The present invention has been made in view of the above problems, and an object thereof is to provide an IC card capable of detecting unauthorized access.
[0005]
[Means for Solving the Problems]
In order to achieve the above object, an IC card according to the present invention can be equipped with a plurality of rewritable applications, and is an IC card that can be shared between applications, and can be shared between the applications. A log file that records the history of the first application, and the first application identifies at least the first application and the second application when accessing the second application among the plurality of applications Each authentication information to be recorded is recorded in the log file.
Preferably, when the first application accesses the second application and calls a function of the second application, the function of the called second application is recorded in the log file. To do.
Preferably, the history data of shared access between the applications recorded in the log file is automatically deleted from the oldest.
[0006]
As described above, a log file that records the history of shared access between applications is provided in the IC card. When there is shared access between both applications, authentication information that identifies both applications, such as an ID number, PIN, etc. Are recorded in the log file, and when a function is called, the function is also recorded in the log file. Therefore, if there is an unauthorized access, the unauthorized access can be detected by reading the log file from the outside and analyzing it after the access is completed.
Recording all shared accesses results in a huge log file size. Therefore, the shared access history data recorded in the log file is automatically deleted from the oldest.
[0007]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of an IC card according to the present invention will be described below with reference to the accompanying drawings.
FIG. 1 is a schematic configuration diagram of an IC card 10 according to an embodiment of the present invention.
1, the IC card 10 includes, for example, a CPU 11, an interface (I / F) 12, a random access memory (RAM) 14, a read only memory (ROM) 15, and a rewritable nonvolatile memory EEPROM 16. .
The above IC card 10 communicates with a reader / writer and a host computer, which are external devices, via an interface (I / F) 12, for example, and transmits and receives data, based on instructions from the host computer. Various processes are performed on the IC card 10.
[0008]
The CPU 11 appropriately communicates with the external device via the interface (I / F) 12 based on an application stored in the EEPROM 16 according to a command transmitted from the external device or a command set in the IC card 10 in advance. The desired processing is performed while performing, for example, authentication of the owner and the IC card, and settlement of the price.
Data temporarily generated when the CPU 11 performs processing is stored in the RAM 14.
[0009]
When the IC card 10 is inserted into an external device via the interface (I / F) 12, the power and clock are supplied and signals are transmitted to and received from the external device. That is, the interface (I / F) 12 outputs a signal received from the external device to the CPU 11 and transmits a signal input from the CPU 11 to the external device.
The RAM 14, ROM 15, and EEPROM 16 constitute a memory system of the IC card 10. The ROM 15 stores a card OS (or an OS kernel section), and system programs that run on the OS, application programs that provide services, and the like are arranged in the EEPROM 16.
[0010]
The IC card 10 having such a configuration is equipped with the software shown in FIG.
FIG. 2 is a schematic diagram showing an example of the software configuration of the IC card 10 according to the embodiment of the present invention.
The core of this hierarchical structure is an OS kernel unit 21 stored in the ROM 15. The OS kernel unit 21 manages hardware resources of the IC card and provides an interface for accessing the IC card hardware from an upper layer program. The OS kernel unit 21 controls the operation of the upper layer program.
[0011]
Although not shown in FIG. 2, a processing module that is OS level software is arranged in the upper layer of the OS kernel unit 21. The processing module allows the application program to conveniently use various functions of the OS kernel. As such a processing module, for example, an interpreter for processing a program language, a program loader for adding or updating a program, an application programming interface, a cryptographic processing library, particularly a plurality of applications mounted on the IC card 10 are included. A card manager 24 to be managed is installed. For example, the card manager 24 has authority to add and delete applications.
Furthermore, it has a shared access log file 25 which is managed by the card manager 24 and records a history of shared access between a plurality of applications installed in the IC card 10. The card manager 24 can read, rewrite, and delete the shared access log file 25.
These processing modules are recorded in the EEPROM 16 or the ROM 15. Here, the case where the card manager 24 and the shared access log file 25 are recorded in the EEPROM 16 is taken as an example.
[0012]
An application program that operates while referring to the processing module and provides various services is arranged in an upper layer of the card OS 21. Here, it is assumed that two applications (application A22 and application B23) are arranged.
[0013]
FIG. 3 shows an example of a file storage image in the EEPROM 16 of the IC card 10. In FIG. 3, the absolute address of the memory increases from above to below.
In FIG. 3, the top of the EEPROM 16 is a system area, in which information such as the configuration of the entire IC card 10 is recorded, and a card manager 24 is also recorded. Subsequently, a shared access log file 25 that records a history of shared access between applications is recorded.
Subsequently, the program part of the application A22, the function 1 and data to be referred to when the application A22 executes are recorded. And the program part of application B23, the function 2 and data which are referred when application B23 performs are recorded. For example, when performing shared access, data such as ID and PIN for authenticating the application is stored in the data area of each application.
Next, an application management table for managing application information collectively is recorded. For example, when shared access is requested among the applications installed in the IC card 10, the application management table is referred to by the calling application to obtain information on the called application.
[0014]
FIG. 4 is a flowchart illustrating processing for managing shared access between applications using the IC card according to the embodiment of the present invention.
The IC card 10 is processed by an external device, and the application B in the IC card 10 is executed. When executing the application B, there are cases where the function or data required at a certain stage is not possessed by the application B itself, that is, does not exist in the memory area allocated to the application B. On the other hand, the application A stored in another area of the memory of the IC card 10 has functions and data.
In this case, the application B accesses the memory area of the application A and refers to functions and data necessary for the application B. By so-called shared access between applications, even if the application B does not have the function and data, it continues. Can execute and continue processing.
[0015]
When the program of the application B progresses to the point where the function or data of the application A is referred to, the processing of this example starts.
Step 41:
Application B calls application A to the card OS, that is, requests shared access.
Step 42:
Specifically, the card OS receives a request from the application B, searches the application management table stored in the memory, and confirms the presence of the application A in the IC card 10.
Step 43:
If the application A does not exist in the IC card 10, the card manager outputs an error message to the application B.
At the same time, the card manager records in the shared access log file the authentication information of application A and application B, the contents of the application A not present, and the access failure from the application B, and updates the contents of the log file. The process is terminated (step 47).
[0016]
Step 44:
When the application A exists in the IC card 10, the application B accesses the memory area of the function (referred to as function 1) of the application A to be referred to and calls the function 1.
Step 45:
In the memory area of the application A, the function 1 is started and executed by the application A.
Step 46:
If the execution of the function 1 fails due to program compatibility or a bug, the application A outputs an error message to the card manager and the application B. Then, the card manager records in the shared access log file the authentication information of application A and application B, function 1 and the content of the error that occurred while function 1 is being executed, updates the content of the log file, Is finished (step 47).
Step 47:
When function 1 is executed normally, the card manager records the authentication information of application A and application B and the contents referring to function 1 in the shared access log file, updates the contents of the log file, and updates application B. The shared access processing is terminated, and the processing by the application B is continued in the IC card 10.
[0017]
FIG. 5 is a diagram showing an example of the contents of the shared access log file in the IC card according to the embodiment of the present invention.
In FIG. 5, the contents of the application B accessed twice from the application B and the function 1 of the application A called twice, and the contents of the application A accessed once from the application A and the function 2 of the application B called once. Is recorded.
Although not shown in FIG. 5, when an error occurs as described above, the type of error and the reason are also recorded.
[0018]
Next, a specific example to which the above processing method is applied will be described.
In this example, for example, an employee ID application is installed in the IC card 10, and a network login application for logging in via a network and using a predetermined function is also installed in the IC card. .
The employee ID application is an application that manages personal information such as employee numbers and names of employees, for example, and is executed when, for example, a facility in a company is used to confirm the identity of an employee who is a card holder.
The network login application is used, for example, when logging in to a PC, and after confirming the identity of the employee, login and use of the PC are permitted.
Further, for example, when using a service by logging in via a network in order to use a contracted service on the network, it is convenient to use a network login application.
[0019]
When logging in via the network, the identity of the employee is verified, so personal information such as the employee number and name of the employee is required. Since the employee ID application already has the employee's personal information, having the employee's personal information in the network login application is a wasteful use of memory resources of the IC card.
Therefore, by using shared access, the employee ID card application is accessed from the network login application and the employee ID data of the employee ID application is called without having the employee ID personal information in the network login application. Thus, memory resources can be used effectively.
[0020]
Next, this example will be described with reference to FIG.
FIG. 6 is a flowchart showing a specific example of the operation of the IC card according to the embodiment of the present invention.
When the network login application proceeds to the point where it refers to the personal information data held by the employee ID application, the shared access process of this example starts.
Step 61:
The network login application calls the employee ID application to the card OS, that is, requests shared access.
Step 62:
Specifically, the card OS receives a request from the network login application, searches the application management table stored in the memory, and confirms the presence of the employee card application in the IC card 10.
Step 63:
If the employee ID application does not exist in the IC card 10, the card manager outputs an error message to the network login application, and at the same time, the card manager has the employee ID application in the shared access log file. The contents of the access failure from the network login application are recorded, the contents of the log file are updated, and the process is terminated (step 67).
[0021]
Step 64:
When the employee ID application exists in the IC card 10, the network login application accesses a memory area of a function (referred to as function 1) of the employee ID application to be referred to and calls the function 1.
Step 65:
Then, the function 1 is activated and executed by the employee ID application in the memory area of the employee ID application, and the personal information data of the employee is called.
[0022]
Step 66:
If the personal information data of the employee cannot be called correctly due to compatibility between the two applications or a bug, the employee ID application outputs an error message to the card manager and the network login application. Then, the card manager records in the shared access log file the contents of the execution of the function 1 of the employee ID application failed and the data of the employee ID application could not be called, updates the contents of the log file, The process ends (step 67).
Step 67:
If function 1 is executed normally and the employee's personal information data is called correctly, the card manager records the contents referring to function 1 of the employee ID application from the network login application in the shared access log file. Then, the contents of the log file are updated, the shared access processing of the network login application is terminated, and the processing by the network login application is continued in the IC card 10.
[0023]
As described above, each time there is shared access between applications, the call destination application, the call source application, and the call function are recorded in the shared access log file.
In the unlikely event of unauthorized access, this log file is read from the external device and analyzed, and the unauthorized access source, the access destination, and the contents of the unauthorized access can be determined.
However, if all shared accesses are recorded in the shared access log file, the size of the log file becomes enormous. Therefore, for example, the log access history data may be automatically deleted in the oldest order with the log file size kept constant.
[0024]
Although the present invention has been described based on the preferred embodiments, the present invention is not limited to the embodiments described above, and various modifications can be made without departing from the gist of the present invention.
For example, information such as date may be entered in the shared access log file. Further, in the case of failure, for example, the reason for failure may be recorded.
[0025]
【The invention's effect】
According to the present invention, a log file for recording a history of shared access between applications is provided in the IC card. When there is shared access between both applications, authentication information for identifying both applications, for example, an ID number, The PIN or the like is recorded in the log file, and when a function is called, the function is also recorded in the log file. For this reason, if there is an unauthorized access, the unauthorized access can be detected and the security of the IC card can be improved by reading and analyzing the log file from the outside after the access is completed.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram of an IC card according to an embodiment of the present invention.
FIG. 2 shows an example of a file configuration in the IC card according to the embodiment of the present invention.
FIG. 3 is an example of a memory map of the IC card according to the embodiment of the present invention.
FIG. 4 is a flowchart for explaining the operation of the IC card according to the embodiment of the present invention.
FIG. 5 shows an example of the contents of a shared access log file of an IC card according to an embodiment of the present invention.
FIG. 6 is a flowchart showing a specific example of the operation of the IC card according to the embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 ... IC card, 11 ... CPU, 12 ... I / F, 14 ... RAM, 15 ... ROM, 16 ... EEPROM, 21 ... Card OS, 22 ... Application A, 23 ... Application B, 24 ... Card manager, 25 ... Sharing Access log file.

Claims (3)

An IC card that can be equipped with a plurality of rewritable applications and can be shared and accessed between the applications.
A log file for recording a history of shared access between the applications;
Among the plurality of applications, when the first application accesses the second application, at least the respective authentication information for identifying the first application and the second application is recorded in the log file. IC card to do. The first application records the function of the called second application in the log file when the second application accesses the second application and calls the function of the second application. IC card of description. 2. The IC card according to claim 1, wherein the history data of shared access between the applications recorded in the log file is automatically deleted from the oldest.

Images