JPH0434788B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention provides an information storage unit that includes at least a reference number storage section and an information storage section made of a semiconductor storage circuit, and a method for mutually transferring data to the information storage unit. The present invention relates to an information processing apparatus comprising an information processing unit having means.

In recent years, information storage media using so-called IC-embedded storage media have been developed, in which a semiconductor chip is embedded in a card body made of plastic material, and information data is written and stored in the semiconductor storage circuit. Information processing systems using units are also beginning to be put into practical use. In an information processing system in which the above information storage unit is used as a so-called cash card for financial institutions such as banks, there is a need to prevent unauthorized use of cards that have been lost or stolen. In order to prevent this, a verification number (PIN, password) is set in advance, and only a specific person who knows the verification number can enter the verification number from an external source to confirm that the card is the legal holder. certify that the information is correct and control the processing such as predetermined transactions, or access the information data stored in the semiconductor memory circuit and extract and use the necessary information. It is possible to control the

However, the information storage unit using the conventional storage medium with a built-in IC as described above is easier to read the stored contents than the conventional information storage unit using the storage medium that uses magnetic storage writing, such as a magnetic card. Although it will be more difficult to falsify or falsify information, it is still possible for people who are familiar with this type of information processing technology to access the stored information with an appropriate reading device, read the contents, or falsify the information. It is possible to

In other words, even when used as a cash card as mentioned above, in the past, there were no checks on whether the structure of the card itself was valid or whether the identification number input from the outside corresponded to the card correctly. Because the system is configured to check only the information stored in the card, once the information stored in the card is accessed and the verification number stored in the card is read, or someone with very technical knowledge Therefore, if a card with a completely similar structure is forged, it will be impossible to completely prevent its unauthorized use, especially in the case of a cash card used offline. Since checks are completely relied on based on the memory contents written in the memory, the damage will be very great if a large number of cards with similar structure are counterfeited. On the other hand, in order to popularize the above-mentioned cards, it is important to lower the price of the cards, and for this purpose, it is also necessary to standardize the cards.
However, in conventional card systems, it is difficult to achieve both card standardization and a high level of security. For example, if you prepare one standard card and try to use it in multiple different groups, important information for ensuring security may be lost.
It is clear that this will have to be spread to each of the above groups, and as a result, the level of security will drop.

The present invention eliminates the drawbacks of the conventional information processing device described above, and a first object of the present invention is to
There is no risk of important information in information storage units such as IC cards being accessed by third parties, and the information processing unit can identify unauthorized information storage units. The objective is to provide a capable information processing device. A second object of the present invention is to provide conditions for making it possible to standardize information storage units without contradicting the first object.

Hereinafter, the present invention will be explained in detail with reference to the drawings.

1 and 2 are a schematic structural diagram and a system block diagram, respectively, of an information processing apparatus according to an embodiment of the present invention. The information processing device in this example is
The main unit 6 shown in a perspective view in FIG. 1a and FIG. 1b
It consists of an IC built-in card 19 shown in plan view in FIG. A master device 6 provided as an information processing unit has a display section 7 made of a dot matrix type liquid crystal display device, an input keyboard 8, and an IC built-in card insertion section 9. In addition, an IC built-in card (hereinafter referred to as
19 (simply referred to as a card) is one or more cards.
A circuit mounting section 29 including an IC chip, a data signal input/output terminal 28a, a control signal input/output terminal 28b, and two power input terminals 28c.
It has four connection terminals consisting of: Note that the four connection terminals are exposed from the card body made of plastic material, and the card 19 is connected to the base unit 6.
When inserted into the insertion portion 9, the device is configured to be connected to a corresponding connection terminal on the base device 6, which will be described later.

Next, FIG. 2 is a block diagram showing the outline of the system configuration of the information processing apparatus of this example, in which a indicates the base unit 6 side and b indicates the card 19 side.

The main unit 6 side includes a CPU 10 consisting of an arithmetic unit, a control unit, etc., and a CPU 10 for storing data and programs loaded from outside.
A RAM 11, a ROM 12 that stores monitor programs, routine programs, etc., an I/O port 13 for input/output control, and the RAM 11.
Video RAM 11 occupies part of the address area of
A display control controller 14 connected to section a and including a driver section of the display section 7 described above, etc.
and a display unit 7 connected to the controller 14.
, an input keyboard 8 connected to the I/O port 13, and a power supply circuit 16 for supplying power to each of the aforementioned blocks. Note that 17 is a bus line connecting the CPU 10 and each block. In addition, the I/O port 1
A data signal input/output terminal 18a and a control signal input/output terminal 18b are also connected to the power supply circuit 16, and a power supply terminal 18c is also connected to the power supply circuit 16.

On the other hand, the card 19 side has a so-called microcomputer type configuration, and includes a CPU 20 consisting of an arithmetic unit, a control unit, etc.
A ROM 21 that stores programs, an information storage circuit 22 consisting of a so-called non-volatile semiconductor storage circuit such as MNOS for storing verification data such as verification numbers, information data, etc., and the base unit 6. an I/O port 23 for input/output control between the two, and a driver 24 for applying a driving voltage for memory writing and memory erasing to the information storage circuit 22;
It is composed of a power supply circuit 26 and the like for supplying power to each block on the card 19 side. Also
CPU20 and RM21, information storage circuit 22, I/O
A bus line 27 is provided between the I/O port 23, and the aforementioned data signal input/output terminal 28a and control signal input/output terminal 28b are connected to the I/O port 23, and the power supply circuit 26
The above-mentioned power input terminal 28c is connected to.

Note that when writing new memory into the information storage circuit 22, erasing memory, or changing memory contents, control signals sent from the CPU 20 via the control bus of the bus line 27 are used. In response to the signal, the driver 24
A write drive signal or an erase drive signal is formed, and these signals are applied to a specified address in the information storage circuit 22 (the address specified by the address bus of the bus line 27). It is configured as follows. However, in the following description, when writing, erasing, changing, etc. of the memory of the information storage circuit 22 is mentioned, the operation of the driver 24 and the like will not be explained each time.

In addition, in FIGS. 2a and 2b, the power supply circuit 16,
The power supply lines from 26 to each other block are shown by broken lines, and the bus lines 17 and 27 actually consist of a data bus, an address bus, and a control bus, but the diagram is simplified. For this reason, illustration of the distinction between each bus is omitted.

Further, when the card 19 is inserted into the insertion section 9 of the base unit 6, the data signal input/output terminal 28a
is electrically connected to the data signal input/output terminal 18a, the control signal input/output terminal 28b is electrically connected to the control signal input/output terminal 18b, and the power input terminal 28c is electrically connected to the power supply terminal 18c. It is configured as follows. Therefore, in this example, control signals and data signals are transferred between the base unit 6 side and the card 19 side via the I/O ports 13 and 23 of both, and also via the data signal input/output terminal 18a. and 28a and control signal input/output terminals 18b and 2.
This is done through the connection with 8b. Note that when the above-mentioned signals are transferred between each other, the I/O port on the data sending side converts the signal from parallel to serial before sending it out, and the I/O port on the data receiving side converts the signal before sending it out. Performs serial/parallel conversion of signals. However, in the following, when explaining the specific signal transfer between the base unit 6 side and the card 19 side, we will explain the route through which the signal is transferred in each case. The following shall be omitted. Also, in this example, card 1
The 9 side is configured to be supplied with power from the parent device 6 side via the power supply terminal 18c and the power input terminal 28c.

Next, FIG. 3 is a flowchart of a routine program regarding the information processing device of this example,
a shows a flowchart of the program stored in the ROM 12 on the base unit 6 side, and b
shows a flowchart of a program stored in the ROM 21 on the card 19 side. The operation of the information storage device of this example will be described below with reference to the drawings.

First, when the card 19 is inserted into the insertion section 9 of the base unit 6, the base unit 6 side is activated by a process such as an emergency interrupt, and the card 19 side is activated by a process such as a reset interrupt. and the card 19 side are both controlled at the start stage shown in FIG.

First, the card 19 side checks whether the value of M indicating the number of consecutive failures in number matching is 3 or more (step b-1), and if it is 3 or more, the card 19 side sends a standby state signal. memory
Clear - Transfer the warning signal to the base unit 6 (step b)
-2), and if it is less than 3, the normal standby state signal is transferred to the main unit 6 side as a standby state signal (step b-3). The process proceeds to a stage (step b-4) of data transfer of R and S values, which will be described later. Note that the value M indicating the number of consecutive failures in number verification is stored in a predetermined address of the information storage circuit 22 mentioned above, and as will be described later, verification can be performed by inputting an incorrect verification number using a key. If it fails, the value is counted up (step b-11), but
If the correct verification number is keyed in and verification is successful, it is cleared to 0 at that point (step b-8).
be done.

On the other hand, the base unit 6 side receives a standby state signal from the card 19 side (step a-1), and if it is a memory clear warning signal (step a-1).
2), a warning is displayed on the display unit 7 to the effect that if any further number verification fails, the information data stored in the information storage circuit 22 will be cleared (step a-3).
However, if the standby state signal is a normal standby state signal, the process continues as is and in any case proceeds to the stage (step a-4) of waiting for input of the personal reference number X from the next input keyboard 8. When the personal identification number is input here, a random number R is generated (step a-5), and then a function S is generated.
Calculation of =f(A,X,R) (step a-6),
Operation of function T=g(A,X,R) (step a-
7) and put the values of R and S of the calculation result on card 1.
9 side (step a-8), and then the process advances to the step of waiting for the judgment signal to be returned from the next card 19 side (step a-9). Note that A above
is a type of group identification number that is uniquely assigned to a certain group related to a specific company or financial institution, etc., when the information storage device of this example is used within a certain group related to a specific company or financial institution. This is quasi-constant secret verification data used to more completely protect against unauthorized access.

On the other hand, on the card 19 side, R,
From the stage of waiting for the data transfer of the value of S (step b-4), when the data is actually received, the function S'=f(A', X', R) is calculated (step b-15). Do this. Here, A' and X' are a group identification number and an individual identification number, respectively, which are stored and written in advance in predetermined addresses of the information storage circuit 22. If the same intra-group card corresponds correctly to a predetermined intra-group master unit, the group identification number of both, that is, the value of A′ stored in the card 19 and the master unit 6 The value of A stored on the side is the same as the value of A. In addition, if the above-mentioned personal identification number The value of personal identification number X' is the same as that of Therefore, if the correspondence between the base unit 6 and the card 19 is correct, and the key-input personal identification number is also correct, the same data value can be input to the same function f on the base unit 6 side and the card 19 side. Since the calculation is performed by substituting it as a variable, the calculated value S of the function f on the base unit 6 side and the calculated value S' of the function f on the card 19 side should naturally be equal.

That is, on the card 19 side, in the next step, it is checked whether the above-mentioned two calculated values S and S' are equal to each other (step b-6), and if they are equal,
First, since the card 19 side recognizes that the base unit 6 is legitimate, it determines that the verification has been performed correctly and transmits a memory access permission signal as a determination signal to the base unit 6 side ( After clearing the value of M to 0 (step b-8), the function T' = (A', X',
R) is calculated (step b-9), and the above calculation and other T' are transferred to the base unit 6 side (step b-10).
Note that from the perspective of the card 19, the above has already provided grounds for acknowledging that the base unit 6 is legitimate, so from now on, the data will be transferred to the information storage section of the information storage circuit 22. This means that the memory access is permitted, and preparations are made for normal work in the memory access permitted state.

On the other hand, if the calculated values S and S' are not equal, it is determined that the entered verification number is not correct or that the base unit 6 is not valid, so verification may not be performed correctly. As a result of the determination, the value of M is incremented by 1 (step b-11), and then the process proceeds to the step of checking whether the value of M is 4 or more (step b-12). If the value of M is 4 or more, at least a part of the information data stored in the information storage circuit 22 is cleared (step b-13), and a memory clear execution signal is sent as a determination signal. After the data is transferred to the base unit 6 (step b-14), the process proceeds to a stage where special work is performed at the time of determining non-compliance. If the value of M is less than 4, a verification number re-input designation signal is transferred to the base unit 6 as a determination signal (step b-15), and the process returns to the starting stage.

On the other hand, on the base unit 6 side, if the judgment signal transferred from the card 19 side is a verification number re-input designation signal (step a-10), the user is prompted to re-enter the personal verification number from the keyboard. After the designation is made on the display section 7 (step a-11), the process returns to the starting stage. Furthermore, if the determination signal is not the reference number re-input designation signal but a memory clear execution signal (step a-12), it is determined that the memory of the information data in the information storage circuit 22 has been cleared. is displayed on the display section 7 (step a-13), and then the process proceeds to a stage for performing special work at the time of checking and determining non-conformity. Further, if the determination signal is neither the collation number re-input designation signal nor the memory clear execution signal but a memory access permission signal, the step of waiting for the transfer of the calculated value T' from the card 19 side. (Step a
-14), and then when the calculated value T' is actually sent, the process proceeds to the step (step a-15) of checking whether the calculated value T' is equal to the above-mentioned calculated value T.

Here, the above T and T' indicate that the correspondence between the base unit 6 and the card 19 is correct, and the key-input personal identification number is also correct, as in the case of the relationship between S and S' described above. If there is, the same data value will be assigned as a variable to the same function g on both the base unit 6 side and the card 19 side, so it is natural that the base unit 6
The calculated value T of the function g on the card 19 side is equal to the calculated value T' of the function g on the card 19 side.

Therefore, when the above T and T' are equal, even from the perspective of the base unit 6, it is possible to confirm that the entered personal identification number is correct and that the card 19 is legitimate. Since the evidence for admitting this has been obtained, as a result of the judgment that the collation has been performed correctly, the normal work in the memory access permission state, for example, the information storage circuit 2
The controller 2 is controlled so that it can display and confirm the contents of the information data stored in the controller 2, write or correct new information data, perform calculations and judgments based on the information data, make transactions, and perform other tasks.

If T and T' are not equal, the memory access permission signal, which is transferred only when the input verification number is determined to be correct, has already been transferred from the card 19 (step b- Despite 7), the fact that it is no longer possible to match the card at this stage means that it can be immediately recognized that card 19 is not legitimate, so the next step is to immediately judge the match as non-conforming. The process then proceeds to a stage where special tasks such as sending an alarm to a predetermined location to notify that an unauthorized card is being used are performed.

As described above, in this example, if the act of failing number verification using an incorrect verification number is performed four times in a row, the storage of information data in the information storage circuit 22 of the card 19 is automatically erased. Therefore, access to the information data and unauthorized use by a person who does not know the reference number is completely prevented.

Furthermore, even if you obtain a card with a known personal identification number and try to access the information data in the information storage circuit 22 to check the data contents and data structure, it will be impossible to use a card other than the authorized information processing unit. In this case, the above-mentioned S and S' are compared on the card 19 side (step b-6).
As a result, access will be refused from the card 19 side. In other words, an attempt was made to investigate the data content and structure of the card by creating an information processing unit that is functionally similar to the official base machine, or by using a base machine for another group. However, as long as the group verification number A, function f, etc. mentioned above are different, it is impossible to access even if only the personal verification number is entered correctly. Therefore, when the card 19 as in the above-mentioned embodiment is used as a cash card, the data in the card 19 will not be processed at all unless a formal information processing unit owned by a financial institution belonging to the same group is used. Because it is impossible to access and investigate in detail,
It is also possible to completely prevent the data contents, data structure, etc. in the cash card from being read by someone outside the financial institution and forgery.

Further, according to the configuration of the above-described embodiment, it is possible to easily identify a counterfeit card even when viewed from the standpoint of the base unit 6. In other words, even if a functionally similar card is counterfeited,
Card 19 unless you know the function g, group verification number A, etc. when calculating the calculation value for verification.
The above function g, which should be set as part of the program in the side ROM 21, or the group verification number A', which should be stored and written in the information storage circuit 22 in advance, cannot be made correct and valid. Therefore, T and T on the regular base unit 6 side
The verification with T' (step a-15) will fail, making it impossible to use the counterfeit card.

Note that FIG. 4 shows a modification of a part of the flowchart shown in FIG. 3, and in FIG. . However, the parts other than those shown are completely the same as those in FIG. 3 described above.

In this example, two random numbers R ₁ and R ₂ are generated on the base unit 6 side (step a-5), and the calculated value S is calculated by the function f (A, X, R ₁ ) (step a-6). The calculated value T is calculated by the function _f ( _{S ,} Step a-8) is carried out. Meanwhile card 19
On the other hand, the calculated value S' is calculated by the function f (A', X', R ₁ ) (step b-5), and the calculated value T' is calculated by the function f (A', X', R ₂ ). (Step b-9).

That is, in this example, the calculated values S and T are calculated by substituting two different random numbers R ₁ and R ₂ to the same function f, but even with this configuration, , In addition to whether the input personal identification number is correct, from the standpoint of the base unit 6, it is important to check whether the group verification number A′ and function f on the card 19 side are correct, and from the standpoint of the card 19, it is important to check whether the base unit It is clear that it is possible to determine whether the group verification number A on the 6 side and the function f are normal.

As described above, according to the present invention, from the perspective of the information processing unit (base unit), it is possible to check whether the information storage unit (card) being used is legitimate. In addition, information storage units (cards)
Even when viewed from the side's perspective, it is important that important information data is accessed and read by an unauthorized information processing unit (base unit), etc.
You will be completely protected.

Furthermore, in the present invention, in order to mutually determine authenticity between the information processing unit and the information storage unit, a verification number is not directly transmitted, but a random number and a calculated value based on the random number are transmitted. Therefore, even if mutually transmitted data is monitored in some way, it is impossible to illegally learn important reference numbers.

Therefore, even when a built-in IC card as in the above-described embodiment is used as a so-called cash card for a financial institution such as a bank, the risk of the card being forged is eliminated. In other words, even if you forge a card that is functionally similar, regardless of the data corresponding to the group verification number A mentioned above or the data content related to calculations such as the calculation functions f and g, it will not be possible to process legitimate information. It is clear that it can be easily identified from the side of the unit. Furthermore, even if you obtain a legitimate card with a known personal identification number and attempt to counterfeit the same card by examining its data contents and data structure, if you do not obtain a legitimate information processing unit, the information on the card 19 will be completely lost. Since it is not possible to access and examine the data in detail, it is impossible to forge a card that can be used fraudulently. Further, according to the present invention, even if different groups operate IC cards with the same configuration, each group can operate the cards without reducing the level of security. In other words, since what effectively guarantees security is the group identification number unique to each group, it is impossible for even a technically savvy person to break the security of another group's card system. It is. For example, even if there is an unscrupulous person in one group who is knowledgeable about technology and attempts to attack the card system of another group, there will be no problem as long as he or she does not know the group identification number of the target of the attack. It is clear that there is no such thing. In other words, even if the above-mentioned unscrupulous person obtains a legitimate card operated by another group and attempts to tamper with the data on that card using his or her own group's information processing unit, the card itself will not tamper with the data on the card. It is possible to identify that an information processing unit is not in the own group and deny access. On the other hand, even if the above-mentioned unscrupulous person falsifies data on his own group's card using his own group's information processing unit and then tries to use it illegally on another group's information processing unit, , the information processing unit can identify that the card does not belong to its group and refuse acceptance.

As described above, in the present invention, since both the information processing unit and the information storage unit can check each other's authenticity regarding the operational group, the information storage unit can be standardized without reducing the security level. can do.

In the above-mentioned embodiment, the personal identification number X' stored in the identification number storage section in the storage circuit and the personal identification number X inputted from the outside are configured to be equal; It is not necessary to configure the system as being equal; for example, it is also possible to configure the system so that the two have a certain correspondence relationship, and based on the correlation between the two, it is possible to determine the actual matching between the two. It is. Similarly, when using the aforementioned group verification numbers, the group verification number A on the base unit 6 side and the group verification number A' on the card 19 side do not necessarily have to be the same; It is possible to configure such that a substantial match between the two is determined based on the correlation between the two.

Furthermore, in the case of the embodiments shown in FIGS. 3 and 4, the calculated value S,
The function for determining T and the function for determining the calculated values S' and T' on the card 19 side are set as the same functions f and g (only f in Fig. 4), respectively, but they are not necessarily the same. It is clear that there is no need to set them as the same function. In other words, it is clear that in this case as well, it is sufficient that the two functions have a certain correlation and are configured so that matching can be substantially determined.

In the above embodiment, when the card 19 side finally refuses access, the information storage circuit 2
Although it is configured to clear the memory within 2, it is not necessary to clear the memory.
It is only necessary that access can be reliably prevented within the card 19 side. Also, even when clearing the memory, the group reference number in the information storage circuit 22
In addition to storing data such as A', personal identification number Even if you delete important information such as the function part for calculating the calculated value,
It is clear that it is effective.

In addition, in the above-mentioned embodiment, the reference number storage unit, information storage unit, etc. are capable of electrical memory writing and erasing.
Although it is composed of so-called non-volatile semiconductor memory circuits such as MNOS, the reference number storage section and information storage section are composed of RAM, which is a so-called volatile memory circuit, and this RAM is always backed up energetically with an auxiliary battery. It is also possible to configure it so that.

It is also possible to use the information processing unit according to the present invention by connecting it to another large computer or the like online.

[Brief explanation of drawings]

1 to 3 show an information storage device according to an embodiment of the present invention.
FIG. 3 is a schematic structural diagram and a system block diagram, respectively, and FIG. 3 is a flowchart diagram of a routine program. FIG. 4 shows a partial modification of the flowchart shown in FIG. In all of Figures 1 to 4, a indicates the base unit side, and b indicates the IC built-in card side.
Each is shown below. 6...Base unit, 7...Display section, 8...Input keyboard, 9...IC built-in card insertion section, 10,2
0...CPU, 11...RAM, 11a...Video
RAM section, 12, 21...ROM, 13, 23...
...I/O port, 14...controller, 16,
26...power supply circuit, 17,27...bus line,
18a, 28a...Data signal input/output terminal, 1
8b, 28b...Terminal for control signal input/output, 18c...Terminal for power supply, 19...IC card with built-in IC, 22...Information storage circuit, 24...Driver, 28c...Terminal for power input.

Claims (1)

[Claims] 1 Consists of an information storage unit that includes a reference number storage section and an information storage section made of a semiconductor storage circuit, and an information processing unit that has means for mutually transferring data to the information storage unit. In the information processing device, at least one of the information storage unit and the information processing unit includes a random number generating means and a means for transferring the generated random number to the other, and the information processing unit computing means for computing first and second computed values based on the random number and a group reference number given to a specific group operating the system; and computing means for computing first and second computed values to the information storage unit. and the information storage unit has a calculation means for calculating third and fourth calculation values based on the group verification number and the random number stored in the verification number storage section, and 3 to the information processing unit, and further, the information processing unit transfers the second calculation value to the third calculation value transferred from the information storage unit. and the information storage unit compares the fourth calculated value with the first calculated value transferred from the information processing unit. An information processing device characterized by comprising a determining means for determining a match based on a comparison result.