JPH07101444B2 - IC card - Google Patents

Description

DETAILED DESCRIPTION [Overview] When registering identification data such as a personal identification number used by a customer in a card, a temporary provisional identification stored in the card is correct or incorrect for the person who writes to the card. Unauthorized issuance is prevented by verifying the identity of the person using the data.

[Industrial application field]

The present invention relates to a card having a memory for storing identification data such as a personal identification number and a data processing device such as a micro CPU, that is, a so-called IC card.

In recent years, an identification card with a built-in data processing function, a so-called IC card, which is a portable size card such as a credit card or a bank card, has been used instead of the magnetic card.

In this IC card, the personal identification number given to the owner of the card is usually stored in the card, and the personal identification is performed by this number each time a transaction is made.

In addition, since such an IC card has a complicated integrated circuit formed inside the card, it cannot be forged, but it is possible for someone who has picked up the card to rewrite the personal identification number and forge it by fraudulent data. Therefore, it is desired to prevent this.

[Conventional technology]

FIG. 6 is an explanatory diagram of a card issuing system in the case of a conventional machine card.

In the figure, A is a first issuing office, which is, for example, a manufacturer of magnetic cards. The card issued by the first issuing department does not become a so-called credit card as it is, but it is sent to another department B such as a bank and issued as a card that can be handed to the user C at the other department B. To be done.

At this time, in order to prevent the fraudulent card from being issued in the department B, a technique more than usual is adopted.

That is, in the card issuing machine 2a, the code is written in the magnetic recording area of the card 1a before being sent from the department A to the department B.

In the department B, the code written in the department A is read by the issuing machine 3a, and the judging unit 3c judges whether or not the prescribed code is present. If it is a prescribed code, the gate means 3d is opened. When a personal identification number, an account number, and other necessary data are input from the keyboard 3b, the input data is recorded in the storage unit 1b via the gate means 3d.
Further, when adopting the above system, the issuing machines are arranged only in the places where a limited number of issuances are permitted.

As a result, if the card has been picked up, a code other than the code recorded in the department A can be detected in the department B, so that the illegal issuance can be prevented.

On the other hand, in recent years, in addition to magnetic cards, identification cards (called IC cards) in which ICs are embedded are also known. A conventional IC card will be described with reference to FIG.

The IC card 1 is provided with terminals 51 to 56. The terminal 51 is a power supply terminal of the nonvolatile memory 10, the terminal 52 is a terminal for transmitting and receiving a data signal between the data processing device (hereinafter referred to as CPU) 20 and an external device (not shown), and a terminal 53. Is CPU2
A reset signal input terminal to 0, a terminal 54 is a clock signal input terminal, a terminal 55 is a power supply terminal to the CPU 20 and the memory 10, and a terminal 56 is a ground terminal.

The memory 10 is composed of a non-volatile memory such as EPROM and EEPROM, and the identification data is stored in this memory 10.

The operation will be described.

The identification card 1 is set in a card access device (not shown). At this point, the card access device has each terminal 51
~ 56 are connected to the required circuits inside the card access device.

At this time, the card access device supplies power to the terminal 55,
A clock signal is supplied to terminal 54 and at the same time a reset signal is supplied to terminal 53.

An active logic circuit such as the CPU 20 is electrically unstable when supplied with a power supply and a clock signal, and can normally operate by being supplied with a reset signal, but an accumulator, a program counter, a register in the CPU 20. The active circuit etc. is in the clear state when the reset signal is supplied,
For example, data “0” is written in each state.

After that, the CPU 20 checks the contents of the memory 10, for example, performs a parity check on the stored data or the like, and shifts to an operation state in which data transmission with the data access device is possible.

Data exchange with the data access device is performed via the terminal 52, and is performed in advance according to an agreed procedure between the CPU 20 and the data access device. With respect to the memory 10, an access instruction is issued to the CPU 20 in the form of a command or the like during a data transfer period between an external device (data access device) and the CPU 20, and the CPU 20 accesses the memory 10.

[Problems to be solved by the invention]

However, with the recent spread of small electronic computers such as personal computers, it becomes easy to write card data as described above, and such a conventional system has a drawback that an illegal code can be registered and an illegal card can be issued.

It is an object of the present invention to provide an IC card that can be illegally issued to eliminate the conventional drawbacks.

[Means for solving problems]

In order to achieve the above object, in the principle diagram of FIG. 1, the present invention provides, from the first card issuing machine 2, identification information necessary for judging the validity of the first card issuing machine 2, and The second card issuing machine 3 having the input means 31 receives the temporary identification data necessary for determining whether the identification data for identifying the user can be registered,
Identification information necessary for determining the holy control of the card issuing machine 3 and the temporary identification data input from the input means 31.
An IC card for receiving identification data, the memory 10 storing temporary identification data and identification data.
And a control means 11 for judging whether or not writing to the IC card of each issuing machine is possible based on the received identification information received from the first card issuing machine 2 and the second card issuing machine 3. The means 11 writes the received temporary identification data in the memory 10 when it judges that the temporary identification data is not stored in the memory 10 with respect to the received temporary identification data and identification data. When it is determined that the data is stored and the identification data is not stored, the stored temporary identification data is collated with the received temporary identification data,
Writing the received identification data into the memory 10, and if the temporary identification data is stored in the memory 10 and it is determined that the identification data is stored, the stored identification data and the received identification data The feature is that only the collation is performed.

[Work]

That is, in the present invention, since the IC card 1 checks the validity of the card issuing machines 2 and 3, the fraudulent device can prevent the issuance, and the identification number or the like to be stored in the issuing IC card 1 can be identified. The data PIN will not be written in the memory 10 unless the temporary identification data PIN1 previously stored at the location A and the input temporary identification data PIN1 match, so that the password NO. Will not be issued by an illicit person. If the identification data PIN2 has already been written in the memory 10, only the verification of the input identification data PIN2 and the registered identification data PIN2 is performed without the verification of the temporary identification data PIN1. Therefore, the identification data PIN2 is prevented from being rewritten.

〔Example〕

 FIG. 2 is a card block diagram of an embodiment of the present invention.

In the figure, the same parts as those used in FIGS. 5 and 1 are designated by the same reference numerals.

Further, 41 and 42 are D-type flip-flops, 43, 44 and 46 are NAND gate circuits, 45 is a flip-flop, and 47 is a counter.

FIG. 3 is a time chart of essential parts of the embodiment shown in FIG.

The operation until the CPU 20 is initialized will be described with reference to FIGS. 2 and 3.

When the identification card 1 is connected to an external device (not shown) at time t ₀ , a prescribed signal is supplied to each of the terminals 51 to 56 as in the conventional case.

In this embodiment, if the external device has a right to access as its own identification information, the external device has a function of generating a reset signal having a signal pattern corresponding to the right.

In this embodiment, the times t _{1 to} t ₂ in FIG.
The falling period T up to this point is made meaningful.

This reset signal (shown in FIG. 3 (a)) is in the reset state described above for the CPU 20 at the falling time point t ₁ , the reset is released at the rising time point t ₂ , and the CPU ₂ sequentially executes according to the program. .

The falling period is measured by the detecting means 4 to detect the signal pattern.

That is, when the Q outputs and outputs of the D-type flip-flops 41 and 42 are supplied to the NAND gate circuits 43 and 44 by the connections as shown in the figure, the NAND gate circuit 43 receives one clock cycle at the falling time t ₁ of the reset signal. A pulse is generated (see FIG. 3B), and the NAND gate circuit 44 generates a pulse for one clock cycle at the rising time t ₂ of the reset signal (see FIG. 3C).

The outputs of the NAND gate circuits 43 and 44 are supplied as a set signal and a reset signal to the flip-flop 45 composed of a NAND gate.

The output pulse signal of the NAND gate 43 also clears the counter 47 at this time.

As a result, the output of the flip-flop 45 generates a signal of logic level "1" only during the reset signal rest period T.

The NAND gate 46 has a flip-flop 45 at one input terminal.
, And the clock signal supplied from the external device through the terminal 54. Because of this Nand Gate
Among the clock signals supplied to the terminal 54, 46 supplies to the counter 47 only the clock signal in the period when the output of the flip-flop 45 is at the logic level "1".

Incidentally, the signal waveforms at time t ₃ of FIG. 3 shows a state at the time of release the identification card from an external device.

FIG. 4 is an operation flowchart of the CPU 20. S1 in the figure
~ S9 is the execution step of the program.

Thereafter, with reference to FIG. 4, the second diagram the time t ₂ after the third view
The processing operation of the CPU 20 will be described.

When the reset signal explained in FIG. 3 rises at time t ₂ ,
The CPU 20 starts from the value of the program counter, for example "0".

Initialization processing step S1; in this step S1, the CPU 20 checks the memory 10,
Besides, it is checked whether or not the operation can be started.

For example, it is confirmed whether or not the memory 10 has a failure portion by checking the parity data in the memory 10, and further the data in the area used as the work area of the memory 10 is cleared.

Initialization completion confirmation step S2; In this step S2, it is confirmed whether or not the above initialization operation is normally performed. In this case, if an inconvenient fault is found during operation, such as when the memory 10 has a fault, termination processing is performed. As a result, the CPU 20 becomes inoperative, and becomes unresponsive to, for example, access from an external device.

Counter reading step S3; When it is confirmed in the initialization completion confirmation step S2 that the identification card can operate normally, in this step S3, a signal of a reset signal from the counter 47 of the detection means 4 shown in FIG. A count value that is a pattern is read.

That is, this count value is a value obtained by counting the rest period of the reset signal with the clock signal from the external device.

Step S4 This step S4 is a step of checking whether or not the count value of the counter read in step S3 is set by the permitted external device.

That is, the memory 10 shown in FIG. 2 corresponds to the memories 31 'and 31 shown in FIG.
It is configured to include ~ 33. In addition, the memory 31 ', 31, 32,
The area c of the memory 33 is written by the card maker when the card creation is completed.

The memory 31 stores, as information, whether or not write access to the areas a, b, c, d of the memory 33 corresponding to the count values A, B, C, D of the counter is performed. In addition, the memory 31 'stores information indicating whether or not it can be read. In the figure, the mark "0" indicates that access is possible, and "X" indicates that access is impossible. For example, when the count value is the value "B", information indicating that the area b of the memory 33 is writable and the other areas b, c, d are not writable is stored. . Memory as well
Also in 31 ', information indicating that the areas a, b, and c of the memory 33 can be read and accessed, and d is inaccessible is stored.

The count value is one specific value such as "A", "B",
It is not necessary to use "C" and "D", and the upper and lower limits of the value are set considering the measurement error range, and the count value is "10" to "15".
In the case of, the memory availability information of each area corresponding to the count value “A” is stored in the memory 31 in the figure, and in the case of “30” to “40”, the count value “B” corresponds to the memory 31 in the figure. A range may be set for each count value, such as whether or not each area is accessible.

In the case of the present invention, each card is issued so that the signal pattern of the first card issuing machine in FIG. 1 becomes the count value “B” and the signal pattern of the second card issuing machine 3 becomes the count value “A”. Machine is configured.

In this step S4, it is searched whether the count value of the counter 47 of FIG. 2 exists in the memory 31 and the memory 31 '.

If the count value is not registered in the memory 31 as a result of the search, the processing of the CPU 20 ends. As a result, there is no response even when accessed from an external device.

Step S5; As a result of the search in step S4, if the corresponding count value is registered in the memory 31, the process proceeds to step S5.

In this step S5, the accessibility information of each area corresponding to the count value obtained by the search of the memory 31 is registered in the memory 32.

The memory 32 is composed of flag setting areas corresponding to specific areas a, b, c, d of different types to be protected in the memory 33.

If the count value is the value "B", the CPU2
0 is the accessibility information of each area of the areas corresponding to the values “B” of the memories 31 and 31 ′, that is, “×, ◯, ×,
Information “x” and “x, o, o, x” is stored in the memory 32 as “a, b,
c, d "are sequentially written in the respective positions. When the writing is completed, the process proceeds to the next step S9 '.

Step S9 ': This step will be described later with reference to FIG. 5, but it is inspected whether or not the provisional personal identification number or the personal identification number is already registered in the memory 33 of the card 1, and the program route is accordingly determined. Is the step of changing.

When this step S9 'is completed, information can be transmitted between the CPU 20 and the external device via the terminal 52.

Steps S6, S7 and S8 are present after this step S9 '. In this step S9 ', the exit of the flow is 3 as described later.
Although it is a route, steps S6, S7, and S8 will be described above because they are provided at any route exit.

When step S9 'is completed, information can be transmitted between the CPU 20 and the external device via the terminal 52.

Step S6; This step S6 calls from an external device via the terminal 52,
Alternatively, it is in a state of waiting for whether or not there is data transmission, and a process of returning data indicating completion of preparation as a response signal when a specific polling signal used in a data transmission procedure comes from an external device, for example. To do.

Step S7: The external device gives an operation instruction to the CPU 20 via the terminal 52 by a command.

Therefore, the identification card 1 analyzes this command and determines whether or not the command requires memory access.

For example, if the command is the write command of the temporary password, the write destination address is the area “b” of the memory 33, and
If the secret code No. write command, the area to be stored is the area a of the memory 33 in FIG. 3, so the command itself is judged.

Step S8; the area determined in step S7 is the memory 32,
In this step, it is judged whether or not the access is permitted.

This limits the accessible areas. For example, if the external device is provided inside the bank and is assigned as the second card issuing machine 3 in FIG. 1 for writing the personal identification number, the count value becomes “A” and the accessibility information indicated by the memory 31. Area 33 of memory 33 is set to allow writing, and other areas b to
d is set to be inaccessible for writing. Therefore, storing the PIN in area a from the correct external device is allowed in this step. However, an unauthorized writing device can be detected in step S4 or this step S7.

Also, an external device is provided in the card manufacturer or the card transport manufacturer, and the first card issuing machine 2 for writing the temporary secret code No.
In this case, the count value becomes "B", and writing is permitted in the area b of the memory 33 according to the memory 32 as shown in the figure.

Also in step S7, if the access area requested by the external device is not permitted in the memory 32, the process proceeds to the end process END, and the CPU 20 of the identification card 1 becomes a non-responsive state to the external device.

Step S9; If the access area is permitted by the memory 32 in step S8, the corresponding processing is executed using the permitted area of the memory in step S9. The result of this execution responds to the external device via the terminal 52 in FIG.

FIG. 5 shows details of step S9 'and this step S9.

In step S9 ', first, the areas a and b of the memory 33 shown in FIG. 4, that is, the areas in which the temporary personal identification number and the personal identification number are stored or are respectively searched.

Next, it is checked whether the temporary personal identification number has already been stored.

If the temporary personal identification number is not stored in the area b, following steps Ra, S6, S7, and S8, and then step S9a.
To execute.

Step S9a is a step of storing the temporary personal identification number in the area b of the memory 33.

In step S9a, first, the CPU 20 shown in FIG. 2 is put into the inactive state when the write command of the temporary personal identification number does not come from the external writing device.

Further, if the temporary secret code and the temporary secret code registration command have been received, the received temporary secret code is stored in the area b.
In step S9 ', if the temporary personal identification number is stored in the area b of the memory 33, it is next determined whether or not the personal identification number is registered in the area a of the memory 33.

If the personal identification number is not registered, it is determined in this step that the card should undergo personal identification registration processing, and the process proceeds to route Rb. In the route Rb, after executing steps S6, S7, S8 described above, step S9b is executed.

In step S9b, the CPU 20 of the card 1 waits whether or not to receive the provisional personal identification number from the writing device. When received, the received provisional personal identification number and the provisional personal identification number read from the area b of the memory 33 are stored. The password is compared with the personal identification number to determine whether or not they correspond.

If the verification results do not match, the CPU 2 will be in a non-operational state.
If they match, it waits for the new password.

When the new personal identification number is supplied from the second card issuing machine 3 shown in FIG. 1, or if it is supplied, the received personal identification number is stored in the personal identification number storage area a of the memory 33.

If the password is already registered in step S9 ′, the route
After shifting to Rc, step S9c of normal transaction processing is executed through steps S6, S7, S8. In this step S9c, for example, the secret identification number in the area a of the memory 33 is read out and compared with the personal identification number supplied to the IC card from the so-called transaction device.

If the comparison results in a match, the data is exchanged with the transaction device, the transaction is executed, and the process returns to step S6.

Incidentally, in step S9c, not only personal identification verification but also ordinary publicly known transaction processing may be performed.

As described above, the IC card 1 shown in FIG. 1 is configured to operate.

Therefore, the issuing machine 2 provided in the manufacturer or the like in FIG. 1 notifies its own identification information by the reset signal,
After that, the temporary password and the temporary password registration command are supplied to the terminal 52 in FIG.

As a result, as described above, the determination means 11 for the IC card 1
However, it is determined in step S4 and step S7 in FIG. 4 that the card is the valid first card issuing machine 2 and the temporary PIN is stored in the memory 10 in FIG. 1 (area b of the memory 33 in FIG. 4). Store.

In FIG. 1, the card 1 in which the temporary personal identification number is stored by the first card issuing machine 2 is transported to the second issuing office, that is, the issuing office directly contacting the customer such as a bank or a credit company.

In the second card issuing machine 3 provided in the second issuing place, the identification information waiting for the signal pattern such that the counter 47 explained in FIG. 2 becomes the value “A” explained in FIG. 4 is provided. appear.

Even when the card 1 is connected to the second card issuing machine 3, the validity of the second issuing machine 3 is similarly judged by the judging means 11, that is, the steps S4 and S7 in FIG.

After that, the temporary PIN number PIN1 'and the PIN code PIN2 presented by the customer are supplied to the card 1 from the key 3 of the second card issuing machine 3.

In the card, the authentication means 12 in FIG. 1, that is,
According to step S9b described in FIG.
Compare IN1 and PIN1 '.

If this comparison is in agreement, the card then stores the received personal identification number PIN2 in the area a of the memory 33 in the card 1 and ends the issuing process.

The card 2 issued in this way is then handed to the customer and used for transactions.

When the customer makes a transaction, the person is authenticated in step S9c in FIG. 5, and the transaction is possible only when the person is authenticated.

Further, the program of the flow chart shown in FIG. 4 and the memories 31 and 32 are set in an area c which cannot be accessed by almost anyone. In this case, the memory 32 is set so as to be a write accessible area only in step S5.

According to the above embodiment, in step S4, the specific areas a, b, c, d
Is determined based on the pattern of the reset signal which is the initialization signal, so that the external device can access only the correct one. Moreover, since the count value of the counter is determined by the combination of the reset signal pattern and the clock signal, it can be more complicated.

In addition, the rough removal of unauthorized external devices is performed before the external device and the CPU actually exchange data, and since the complicated types of checks result in inactivity, what should be done by the person handling the external device? It has the advantage of not being able to determine whether it was wrong at the time.

In the above embodiment, only the reset signal and the clock signal have been described as the initialization signal, but the present invention is not limited to this, and when initialization is performed by the signal of the transmission line of the data signal, this may be used. .

Further, the signal pattern detecting means is not limited to the circuit of the embodiment, but may be a circuit that records so that the signal pattern can be discriminated when the CPU 20 is in an operating state, for example, another circuit such as a shift register.

Furthermore, as a method of prohibiting access to the memory 10,
Although the CPU 20 is in the inoperative state in the above embodiment, another method may be used. For example CPU2 of terminal 52
If an AND gate is provided on the 0 side and the CPU 20 closes it, the subsequent transmission and reception of data can be closed by this gate. Further, in this case, an AND gate is provided between the reset terminal 53 of FIG. 2 and the branch point P so that the CPU 20 closes this gate at the same time when the CPU 20 becomes inoperative, so that the power is not turned off once. , Re-access to the CPU 20 is impossible, and it becomes more effective against further prohibition.

Further, in the above embodiment, the pattern of the reset signal is used as the identification information of the self, but the present invention is not limited to this, and the code assigned to the self device from the card 1 is a normal code through the terminal 52 of FIG. 2, for example. May be transmitted as.

〔The invention's effect〕

As described in detail above, according to the present invention, since the IC card determines the validity of the issuing device based on the identification information of the issuing device, it is possible to prevent the issuing of the IC card by an unauthorized device. Further, since the identification data is written after the temporary identification data is collated, it is possible to prevent the illegal registration of the identification code by an unauthorized person. Moreover, if the identification code is already registered in the IC card, the operation shifts to checking the input identification data without collating the temporary identification data, so the identification data once registered can be reliably maintained. Thus, it is possible to prevent the identification data from being rewritten by an unauthorized person who knows the temporary identification data. Moreover, the second card issuing machine also serves as a transaction device for processing deposits, withdrawals, etc. If the identification data is already registered in the IC card, the identification data will be collated promptly for transaction processing. Can be migrated.

[Brief description of drawings]

FIG. 1 is a diagram explaining the principle of the present invention, FIG. 2 is a block diagram of an embodiment, FIG. 3 is a time chart of the embodiment, FIGS. 4 and 5 are flowcharts of the embodiment, and FIGS. The figure is a block diagram of a conventional issuing system and a card. In the figure, 1 is an identification card, 2 is a first issuing machine, 3 is a second issuing machine, 31 is a keyboard, 4, 10 is a memory, and 11 is a control means.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Toshihiko Taguchi 1015 Kamiodanaka, Nakahara-ku, Kawasaki City, Kanagawa Prefecture, Fujitsu Limited (72) Inventor Nobuhiko Nishio 1015, Kamiodanaka, Nakahara-ku, Kawasaki City, Kanagawa Prefecture, Fujitsu Limited ( 72) Inventor Junji Seki 1015 Kamiodanaka, Nakahara-ku, Kawasaki City, Kanagawa Prefecture, Fujitsu Limited (56) References JP 62-17870 (JP, A) JP 60-207963 (JP, A) JP Sho 60-207961 (JP, A) JIII Open Technical Bulletin No. 82-1937

Claims (1)

[Claims] 1. To determine whether or not the first card issuing machine can register the identification information necessary for judging the legitimacy of the first card issuing machine and the identification data for identifying the user. Identification information necessary for receiving the temporary identification data required for the second card issuing machine having an input means and determining the validity of the second card issuing machine,
And an IC card for receiving the temporary identification data and the identification data input from the input means, the memory storing the temporary identification data and the identification data, the first card issuing machine, the second card And a control unit that determines whether or not writing to the IC card of each issuing machine is possible based on the identification information received from the card issuing machine, and the control unit stores the received temporary identification data and identification data in the memory. When it is determined that the temporary identification data is not stored, the received temporary identification data is written in the memory, and the temporary identification data is stored in the memory, and when it is determined that the identification data is not stored, The stored temporary identification data is collated with the received temporary identification data, the received identification data is written in the memory, the temporary identification data is stored in the memory, and the identification data is An IC card characterized by only comparing stored identification data with received identification data when it is determined to be stored.