JPH0634264B2 - Identification card unauthorized access prevention method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Outline] In an identification card having a built-in data processing device, identification data stored in a memory of the identification card is stored only when a signal pattern of an initialization signal for the data processing device is a constant pattern. By making it accessible, unauthorized access to identification data is prevented.

[Industrial application field]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an identification card having a memory element and a data processing device incorporated therein, and more particularly to an identification card unauthorized access prevention system for restricting reading of an identification number or the like stored in a memory element.

As a credit card, a portable card such as a bank card, an identification card having a built-in data processing function inside, a so-called IC card is used instead of the magnetic card.

In this IC card, identification data such as a personal identification number given to the owner of the card or a card manufacturing number, a manufacturer number, a card issuer number, etc. are usually stored in the card. Alternatively, each time the card is manufactured, sold, or otherwise handled, the area in which the identification data is stored is configured to be accessed by a data processing device such as a CPU built in the card based on an external instruction.

It is desired that such identification data be kept secret except for a specific person, or that the identification data be inaccessible.

[Conventional technology]

 FIG. 5 shows a conventional identification card.

The identification card 1 is provided with terminals 51 to 56.

The terminal 51 is a power supply terminal of the non-volatile memory 3, and the terminal 5
Reference numeral 2 denotes a terminal for transmitting and receiving a data signal between a data processing device (hereinafter referred to as CPU) 2 and an external device (not shown), terminal 53 is an input terminal for a reset signal to the CPU, terminal 5
Reference numeral 4 is an input terminal for a clock signal, terminal 55 is a power supply terminal for the CPU 2 and memory 3, and terminal 56 is a ground terminal.

The memory 3 is an E.M. P. It is composed of a non-volatile memory such as a ROM or an EEPROM, and the identification data is stored in the memory 3.

The operation will be described.

The identification card 1 is set in a card access device (not shown). At this point, the card access device has
Each 56 is connected to a predetermined circuit built in the card access device.

At this time, the card access device supplies power to the terminal 55, supplies a clock signal to the terminal 54, and at the same time supplies a reset signal to the terminal 53.

An active logic circuit such as the CPU 2 becomes electrically unstable when supplied with a power supply and a clock signal, and can operate normally by being supplied with a reset signal.
A reset signal is supplied to active circuits such as an accumulator, a program counter, and a register in U2, so that the circuit is cleared, for example, data "0" is written.

After that, the CPU 2 performs a content check of the memory 3, for example, a parity check of stored data and the like, and shifts to an operation state in which data transmission with the data access device is possible.

Data exchange with the data access device is performed via the terminal 52, and is performed according to a procedure previously agreed between the CPU 2 and the data access device.

With respect to the identification data stored in the memory 3, an access instruction is given to the CPU 2 in the form of a command or the like during a data transfer period between an external device (data access device) and the CPU 2, and the CPU 2 causes the memory 3 to access the identification data. To access.

[Problems to be solved by the invention]

In the above conventional identification card 1, as a method of storing identification data to be kept secret in a specific area of the memory 3 and restricting access to the identification data by an external device,
Attach a certain condition to the command given from the terminal 52,
Only when this command satisfies a specific condition, access to the identification data stored in a specific area of the memory is permitted.

However, according to the conventional method, a specific area is logically protected when the CPU 2 exchanges data with the external device. Therefore, a small electronic computer such as a personal computer is used as the external device to remove the protection. There is a drawback that such fraud cannot be prevented.

An object of the present invention is to enable or disable access to a storage area of identification data by an external device, that is, a specific area before the external device and the CPU enter into a communication state, or access of the CPU to the specific area according to an instruction from the external device. It is to be able to decide whether or not to accept.

[Means for solving problems]

Referring to FIG. 1, in the present invention, a detection means 4 for detecting a signal pattern of an initialization signal for initialization of the CPU supplied from an external device 6 through a terminal 5 is provided in the identification card 1, and the CPU 2 operates. When the state is reached, the area accessible by the CPU 2 of the memory 3 is limited according to the pattern of the initialization signal.

[Action]

As described above, since the validity of the access to the specific area of the external device 6 is checked immediately before the CPU transfers to the normal operation and before the data transmission / reception with the external device 6, the memory 2 is not affected by the subsequent logical processing. The specific area of can be protected and fraud prevention can be ensured.

〔Example〕

 FIG. 2 is a block diagram of an embodiment of the present invention.

In the figure, the same parts as those used in FIGS. 5 and 1 are designated by the same reference numerals.

Further, 41 and 42 are D-type flip-flops, 43, 44 and 46 are NAND gate circuits, 45 is a flip-flop, and 47 is a counter.

FIG. 3 is a time chart of essential parts of the embodiment shown in FIG.

The operation until the CPU 2 is initialized will be described with reference to FIGS. 2 and 3.

When the identification card 1 is connected to an external device (not shown) at time t ₀ , a prescribed signal is supplied to each of the terminals 51 to 56 as in the conventional case.

In this embodiment, if the external device has a right to access, it has a function of generating a reset signal having a signal pattern corresponding to the right.

In this embodiment, times t _{1 to} t ₂ in FIG.
The falling period T up to this point is made meaningful.

The reset signal (shown in FIG. 3 (a)) is the falling time t ₁ to CPU 2, the chip is reset as described in the prior art, reset is released at the falling time t _2, CPU 2 sequentially executed according to the program To do. The falling period is measured by the detecting means 4 to detect the signal pattern.

That is, when the Q outputs and outputs of the D-type flip-flops 41 and 42 are supplied to the NAND gate circuits 43 and 44 by the connections as shown in the figure, the NAND gate circuit 43 corresponds to one clock cycle at the falling time t ₁ of the reset signal. A pulse is generated (see FIG. 3B), and the NAND gate circuit 44 generates a pulse for one clock cycle at the rising time t ₂ of the reset signal (see FIG. 3C).

The outputs of the NAND gate circuits 43 and 44 are supplied as a set signal and a reset signal to the flip-flop 45 composed of a NAND gate. The output pulse signal of the NAND gate 43 clears the counter 47 at the same time. As a result, the output of the flip-flop 45 generates a signal of logic level "1" only during the set signal idle period T.

The NAND gate 46 receives the output of the flip-flop 45 at one input terminal and the clock signal supplied from the external device through the terminal 54 at the other input terminal. Therefore, the NAND gate 46 supplies to the counter 47 only the clock signal in the period in which the output of the flip-flop 45 is at the logic level "1" among the clock signals supplied to the terminal 54.

Incidentally, the signal waveforms at time t ₃ of FIG. 3 shows a state at the time of release the identification card from an external device.

FIG. 4 is an operation flowchart of the CPU 2. In the figure,
S1 to S9 are program execution steps. Hereinafter, the processing operation of the CPU 2 of FIG. ₂ after the time t _{2 of} FIG. 3 will be described with reference to FIG.

When the reset signal explained in FIG. 3 rises at time t2, the CPU ₂ starts from the value "0" of the program counter.

Initialization processing step S1; In this step S1, the CPU 2 checks the memory 3 and checks whether another operation can be started. For example, it is confirmed by checking the parity data whether or not the memory 3 has a failure portion, and further the data in the area used as the work area of the memory 2 is cleared.

Initialization completion confirmation step S1; In this step S2, it is confirmed whether or not the above initialization operation is normally performed. In this case, when an inconvenient fault is found in the operation such as the fault in the memory, the termination process is performed.
As a result, the CPU 2 becomes inoperative, and becomes unresponsive to access from an external device, for example.

Counter reading step S3: When it is confirmed in the initialization completion confirmation step S2 that the identification card can operate normally, the second step is performed in step S3.
The count value which is the signal pattern of the reset signal is read from the counter 47 of the detecting means 4 shown in the figure.

That is, this count value is a value obtained by counting the rest period of the reset signal with the clock signal from the external device.

Step S4: In this step S4, it is a step of inspecting whether or not the count value of the counter read in step S3 is set in the permitted external device.

That is, the memory 3 in FIG. 2 is configured to include the memories 31 to 33 shown in FIG.

The memory 31 stores, as information, the accessibility of the areas a, b, c, d of the memory 33 corresponding to the count values A, B, C, D of the counter. In the figure, the mark “◯” indicates that access is possible, and the mark “x” indicates that access is impossible. For example, when the count value is the value "A", the information indicating that the area a of the memory 33 can be accessed and the other areas b, c, and d are inaccessible is provided. .

The count value is one specific value, such as "A", "B",
It is not necessary to use "C" and "D", and the upper and lower limits of the value are set in consideration of the measurement error range, and the count value is "10" to "15".
In the case of, the memory availability information of each area corresponding to the count value “A” is stored in the same figure, and in the case of “30” to “40”, the count value “B” corresponds to the memory value 31 of the same figure. A range may be provided for each count value such as whether or not each area is accessible.

Further, as the information indicating whether or not the access is possible, it is not only simply indicating whether or not the access is possible, but also indicating that “read-only access is possible and write is not possible” or “read and write is not possible”.
It is also possible to set each for a plurality of types of access, such as "reading is not possible but writing is possible" ...

In step S4, it is searched whether the count value of the counter 47 shown in FIG.

If the count value is not registered in the memory 31 as a result of the search, the processing of the CPU 2 ends. As a result, there is no response even when accessed from an external device.

Step S5: As a result of the search in Step S4, the corresponding count value is the memory 3
If it is registered as 1, the process proceeds to step S5.

In step S5, the access permission / prohibition information of each area corresponding to the count value obtained by the search of the memory 31 is registered in the memory 32.

The memory 32 is composed of flag setting areas corresponding to the specific areas a, b, c, and d in the memory 33 that are different in type to be protected.

If the count value is the value "B", CP
U2 is the access permission information of each area of the area corresponding to the value "B" of the memory 31, that is, the information of "○, ×, ×, ×" in FIG. 4 is stored in the memory 32 as "a, b, c, d". Write to each position in turn.

Upon completion of step S5, information can be transmitted between the CPU 2 and the external device via the terminal 52.

Step S6: This step S6 is a state of waiting for a call from the external device through the terminal 52 or data transmission.
For example, when a specific boring signal used in the data transmission procedure arrives from an external device, data indicating the completion of preparation is returned as a response signal.

Step S7: The external device issues an operation instruction to the CPU 2 via the terminal 52 via a command.

Therefore, the identification card 1 analyzes this command and determines whether or not the command requires memory access.
For example, it is determined whether or not the command is a data write command and the write destination address is an area for storing the secret code NO (for example, area a of the memory 33 in FIG. 3).

Step S8: It is determined in this step whether or not the area determined in step S7 is an area in the memory 32 to which access is permitted. This limits the accessible areas.

For example, if the external device is provided inside the bank and is assigned as a device for writing the personal identification number, it is set that the writing is permitted in the area a of the memory 33 as the access permission / inhibition information indicated by the count value. b to d are set to be inaccessible. Therefore, it is permitted in this step to store the personal identification number from the correct external device, but in the case of an unauthorized external device, it is detected in step S4 or this step S7.

Also in step S7, if the access area requested by the external device is not permitted in the memory 32, the process proceeds to the end process END, and the CPU 2 of the identification card 1 becomes a non-responsive state to the external device.

Step S9: If the access area is permitted by the memory 32 in step S8, the corresponding processing is executed using the permitted area of the memory in step S9. The execution result responds to the external device via the terminal 52 in FIG. Also in this step S9, the memory 33
When accessing the memory, the memory 32 is always referred to. If the memory 32 permits, the memory 32 is accessed, and if the memory 32 does not permit, the inoperative state occurs.

When the memory 3 including the memories 31 to 33 is accessed for reading or writing, a subroutine call is made to the main program of the CPU, and an address is given to the subroutine.
Whether the access is made or inoperable according to whether or not the subroutine is configured to instruct the type of access (write or read, etc.) and the address obtained by referring to this memory 32 is permitted. May be selected.

The programs and memories 31 and 32 of the flow chart shown in FIG. 4 are set in an area C which is inaccessible to almost anyone. In this case, the memory 32 has the step S
It is set so that only 5 can be used for write access.

According to the embodiment described above, the specific areas a, b, c,
Since it is determined whether or not d can be accessed by the pattern of the reset signal which is the initialization signal, the external device can access only the correct one. Moreover, since the count value of the counter is determined by the combination of the reset signal pattern and the clock signal, it can be more complicated.

Moreover, a rough exclusion of an unauthorized external device is performed before the external device and the CPU actually exchange data, and since a plurality of types of checks result in an inoperable state, what should the external device operator do? It has the advantage that it is not possible to find out if it was wrong at the time.

In the above embodiment, only the reset signal and the clock signal have been described as the initialization signal, but the present invention is not limited to this, and when initialization is performed by the signal of the transmission line of the data signal, this is used. Is also good. Further, the signal pattern detecting means is not limited to the circuit of the embodiment, but may be a circuit which stores the signal pattern so that the signal pattern can be discriminated when the CPU is in an operating state, for example, another circuit such as a shift register.

Furthermore, as a method of prohibiting access to the memory 3,
In the above embodiment, the CPU is in the inoperative state, but other methods may be used. For example, the terminal 52
If an AND gate is provided on the side of the CPU 2 and the CPU 2 closes the AND gate, the subsequent transmission and reception of data can be closed by this gate. Further, in this case, an AND gate is provided between the reset terminal 53 of FIG. 2 and the branch point P, and when the CPU becomes inoperative, the CPU closes this gate at the same time, so that the power source is temporarily turned on. As long as it does not fall, re-access to the CPU 2 will be impossible and it will be more effective against the prohibition.

〔effect〕

As described above, according to the present invention, it is possible to prevent unauthorized access to an external device.

[Brief description of drawings]

FIG. 1 is a principle diagram of the present invention, FIG. 2 is a block diagram of an embodiment, FIG. 3 is an operation time chart of main parts, FIG. 4 is a flowchart of the embodiment, and FIG. 5 is a block diagram of a conventional identification card. Is. In the figure, 1 is an identification card, 2 is a data processing device, 3 is a memory, 4
Is a detecting means, 5 is a terminal, and 6 is an external device.

Claims (1)

[Claims] 1. A data processing device comprising an integrated circuit (2)
In addition, a non-volatile memory (3) in which identification data is stored in a specific area is embedded inside, and signal transmission between the external device (6) and the data processing device (2) is possible on the surface. By having the terminal 5 to be turned on and the initialization signal being supplied from the external device (6),
A data processing device (2) is an identification card that the data processing device (2) accesses to the specific area by a signal supplied after transition to an operating state, and an initialization signal received by the identification card. The detection means (4) for detecting the signal pattern of (1) is provided, and the data processing device (2) makes the unauthorized access by correlating the detection result of the detection means (4) with a predetermined result after shifting to the operating state. A method for preventing unauthorized access to an identification card, which is characterized by determining