JP2001043323A - IC card issuing system and IC card issuing method - Google Patents

Abstract

(57) [Problem] To save a command group in which a command for requesting data to be encrypted from an IC card in advance corresponding to a command requiring encryption processing is saved, and a command group is stored. Storage capacity can be reduced. The present invention automatically transmits a command requesting random number data to an IC card before transmitting the issued command when the issued command requires encryption by random number data. When receiving the random number data from the card, using the received random number data and the encryption key stored in the encryption key file, generate encryption data, and store the generated encryption data in the issuance command. This is transmitted to an IC card.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an IC card issuing system and an IC card issuing method for recording and issuing predetermined information on an IC card.

[0002]

2. Description of the Related Art Conventionally, as a portable storage medium, an IC card having a built-in IC chip having a nonvolatile data memory and a CPU (Central Processing Unit) for controlling the data memory has been used in various industrial fields. This type of IC card is issued by a card issuing company that issues the card using an IC card issuing system.

In issuing such an IC card, an IC card issuing system stores in advance a command group to be transmitted in a file or the like. Today, due to security requirements, authentication using encryption processing may be performed at the time of issuance.

In this case, a command requesting generation of random number data and return of the generated random number data (hereinafter referred to as a random number request command) may be transmitted to the IC card as data to be encrypted. Such a random number request command is included in the issued command group in advance.

[0005] Also, in many cases, data serving as an encryption key required for the encryption processing does not normally exist in the issued command group. In such a case, the data serving as the encryption key is stored in a file or the like different from the issued command group.

However, in the above-described IC card issuing system, it takes time to include as many random number request commands as necessary in the issued command group for commands that require encryption processing using random numbers. .

In addition, when there are many commands that require encryption processing using random numbers, there is a problem that the capacity of the file storing the issued command group increases.

In addition, since data serving as an encryption key required for encryption processing is stored in a file or the like different from a file or the like in which issuance command groups are stored, files such as files related to the issuance of an IC card are stored. Management is complicated.

[0009]

As described above, it is troublesome to include a random number request command in an issued command group as needed, and the disadvantage of increasing the capacity of a file storing the issued command group has been eliminated. An IC card issuance system and an IC card issuance method which can eliminate the trouble of including a random number request command in an issuance command group as necessary and prevent the capacity of a file storing the issuance command group from increasing. The purpose is to provide.

In addition, it eliminates the disadvantage that management of files related to issuance of encryption key data and the like is complicated, and management of files related to issuance of encryption key data and the like is complicated. I can prevent
An object is to provide a C card issuing system and an IC card issuing method.

[0011]

According to the present invention, there is provided an IC card issuance system comprising a data memory and a control element.
In a device for issuing an IC card by performing data communication with a C card, a storage means for storing an encryption key used for performing an encryption process in the data communication, and issuing an issuance command before transmitting an issuance command to the IC card. Determining means for determining whether or not the command requires encryption processing; first transmitting means for transmitting the issued command when the determining means determines that the issued command does not require encryption processing; A second transmission for transmitting, from the IC card, a command requesting data to be encrypted, before transmitting the issued command when the determining unit determines that the issued command requires encryption processing; Means, corresponding to the command transmitted by the second transmitting means,
Generating means for generating encrypted data using the data which is the source of the encryption returned from the C card and the encryption key stored in the storage means, and adding the encrypted data generated by the generating means to the issuing command It comprises a third transmission means for setting and transmitting to the IC card.

An IC card issuance system according to the present invention is for issuing an IC card by performing data communication with an IC card having a data memory and a control element, wherein a first issuance command for sequentially transmitting a plurality of issuance commands to the IC card is provided.
Transmitting means, when the issued command transmitted by the first transmitting means is a command for requesting data to be encrypted, the data to be encrypted which is returned from the IC card in response to this command Generating means for generating encrypted data using an encryption key set in advance in an issuance command to be transmitted next, and an IC card which sets the encrypted data generated by the generation means in an issuance command to be transmitted next And a second transmitting means for transmitting the data to the server.

An IC card issuance system according to the present invention is for issuing an IC card by performing data communication with an IC card having a data memory and a control element. Determining means for determining whether or not encryption processing is required; first transmission means for transmitting the issued command when the determination means determines that the issued command does not require encryption processing; When the determining unit determines that the issued command requires an encryption process, before transmitting the issued command, a command requesting data to be encrypted from the IC card is transmitted to the IC card. (2) transmitting means, data that is a source of encryption transmitted from the IC card in response to the command transmitted by the second transmitting means, Generating means for generating encrypted data using an encryption key preset in a line command, and third transmitting means for setting the encrypted data generated by the generating means in the issuing command and transmitting the issued command to the IC card It is composed of

An IC card issuance system according to the present invention is for issuing an IC card by performing data communication with an IC card having a data memory and a control element. First storage means for storing, second storage means for storing an issuance command group used when issuing the IC card, and third storage for storing an encryption key used for performing encryption processing in the data communication. Means for reading issue data for an individual who issues an IC card from the first storage means, and combining each issue command transmitted to the IC card with each issue command stored in the second storage means. Setting means for setting, judging means for judging whether or not the issuance command set by the setting means requires encryption processing; The first transmitting means for transmitting the issued command set by the setting means when the issued command does not require the encryption processing by the determining means, and the issuing command requires the encryption processing by the determining means. When it is determined, before transmitting the issuance command, a second transmission unit for transmitting a command for requesting data to be encrypted from the IC card to the IC card, the second transmission unit Generating means for generating encrypted data by using the encryption data transmitted from the IC card in response to the transmitted command and the encryption key stored in the third storage means; The encryption data generated by the means is set to an issuance command which requires the encryption processing set by the setting means, and the IC card is transmitted by the transmission means. The third to be sent to the
Transmission means.

An IC card issuance system according to the present invention is for issuing an IC card by performing data communication with an IC card having a data memory and a control element. The first storage means for storing, the second storage means for storing an issuance command group used when issuing the IC card, and the issuance data for the individual who issues the IC card is read out from the first storage means. Setting means for setting each issue command to be transmitted to the IC card in combination with each issue command stored by the second storage means; and a first means for sequentially transmitting the issue commands set by the setting means to the IC card. Transmitting means, if the issued command transmitted by the transmitting means is a command requesting data to be encrypted. To, the I in response to this command
Generating means for generating encrypted data by using the encryption source data returned from the C card and an encryption key set in advance in an issuance command to be transmitted next; and generating encrypted data generated by the generating means. The second transmission means is configured to set the issuance command to be transmitted next set by the setting means and transmit the command to the IC card.

An IC card issuance system according to the present invention is for issuing an IC card by performing data communication with an IC card having a data memory and a control element. The first storage means for storing, the second storage means for storing an issuance command group used when issuing the IC card, and the issuance data for the individual who issues the IC card is read out from the first storage means. Setting means for setting each issue command to be transmitted to the IC card in combination with each issue command stored by the second storage means, and whether the issue command set by this setting means requires encryption processing Determining means for determining whether the issued command does not require encryption processing by the determining means. The first transmitting means for sequentially transmitting the issued commands set by the above-described method. When the determining means determines that the issued command requires an encryption process, the transmitting means issues the encryption command from the IC card before transmitting the issued command. Second transmitting means for transmitting a command requesting the original data to the IC card; data returned from the IC card corresponding to the command transmitted by the second transmitting means; Generating means for generating encrypted data using the set encryption key, and setting the encrypted data generated by the generating means to an issue command requiring the encryption processing set by the setting means, It comprises a third transmitting means for transmitting to the IC card.

[0017]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing the overall configuration of an IC card issuing system and the configuration of an IC card C according to the present invention.

The IC card C issued by this IC card issuing system is composed of a nonvolatile memory such as an EEPROM, and stores a data memory section Ca for storing various data and a CPU Cb as a control element for controlling these.
Have a built-in IC chip integrated into one IC chip.

When the IC card C is issued,
Data is written to the data memory Ca by a command message (described later) from the card issuing system, random number data as data to be encrypted is generated, and the generated random number data is converted into an IC by a response message (described later).
Reply to the card issuing system.

The IC card issuing system includes a host computer 1, an auxiliary storage device 2, a display device 3,
It comprises a keyboard 4, a reader / writer 5, a printer 6, and the like.

The host computer 1 controls the entire IC card issuing system.

The auxiliary storage device 2 (storage means) includes an IC
An issue data file 2 in which a control program (not shown) for controlling the card issuing system, a SingleDES algorithm used for encryption processing, and the like are stored, and data for issuing the IC card C is stored (stored).
a.

The display device 3 informs an operator of an operation procedure and a processing state when operating the IC card issuing system.

The keyboard 4 is operated by an operator.
The user issues an operation for issuing a C card C or inputs data.

The reader / writer 5 performs data communication with the IC card C under the control of the host computer 1 and writes issued data to the IC card.

The printer device 6 includes the IC card C
As an issuance record, date and time, issuance data, file name, card number, issuance number, etc. are printed out.

The issued data file 2a includes an issued data group 21, an issued command group 22, an issued data management information group 23, a table information group 24, an encryption key file 25, and the like.

The issuance data group 21 stores the issuance data for each individual. The issued command group 22
Stores one or a plurality of issuance commands transmitted to the IC card in combination with the issuance data when the IC card is issued. The issuance data management information group 23
Stores information indicating which issue command should be stored in which position in each issue command. The table information group 24 includes, as table information, data indicating a command that requires encryption processing from data (random number) serving as a source of encryption from the IC card C, that is, a value of a command that requires encryption processing using random numbers ( Code) is stored. The encryption key file 25 stores an encryption key used for encryption processing.

Next, FIG.
5 shows a format of a data transmission / reception message (command message) executed between the C card issuing system and the IC card C.

That is, as shown in FIG. 2, a message transmitted / received between the IC card issuing system and the IC card C includes a node address (NAD) section, a protocol control byte (PCB) section, and a length (LEN). ) Section as a control information section, an information field (INF) section in which the content of information to be transmitted is stored, and a last field as an error detection code (EDC) section. This format is compatible with ISO / IEC
7816-3.

FIG. 3 shows the data format of the issued command group 22 in the issued data file 2a stored in the auxiliary storage device 2.

That is, as shown in FIG. 3, each issued command stored (stored) in the issued command group includes a node address (NAD) portion and an information (I
It is composed of a set of combinations of NF) parts.

The NAD section stores data indicating the transmission source and destination of the transmission block as a part of the control information in the first field of the message.

The INF section stores commands and data to be transmitted. The INF section includes a command header (CMD) section, an Lc section, and data (Data).
Department.

The command header section stores, for example, a control command for writing the contents of the data section of the issued command to an address specified by the data memory in the IC card C. The Lc section indicates the data length of the entire data section in the INF section. The data section indicates the content of data to be transmitted.

Next, FIGS. 4 (a), (b) and (c) show I
FIG. 4 is a diagram illustrating a configuration of a message transmitted to the IC card C when the C card C is issued. When issuing the IC card C, the IC card issuing system prepares a command in which issue data is stored in the above-mentioned issue command as shown in FIG. When transmitting this command to the IC card C, the IC card issuing system converts the command into an NAD section and an INF section, and converts the command from the issuance command as shown in FIG. A command message is created and transmitted to the IC card C.

In the INF part of this command message, FIG.
The command is stored as shown in FIG.

Further, the command header section in the INF section of the command message has a CLA as shown in FIG.
(Class), INS (instruction), P1 (position 1), and P2 (position 2). The above CLA
And the data stored in INS are values indicating the type of command. The P1 and P2 indicate an area (position) where data is stored, and, for example, when the command is a command requiring encryption, indicates a location where an encryption key is stored.

Next, a specific example of the issuance command shown in FIG. 3 will be described with reference to FIGS.

FIG. 5 shows a specific example in the case where the data portion of the issued command requiring the encryption process is not recorded. That is, the data portion of the issued command which needs to be encrypted based on the data from the IC card C such as a random number, which is a random number, is not stored in advance in the data portion of the issued command. No issuance command itself such as a random number request command for requesting data to be encrypted from C is prepared.

For example, FIG. 5A shows that an IC card C is an IC card.
3 shows an external authentication command for performing processing for authenticating the card issuing system. The external authentication command means that the IC card issuing system requests the IC card C for data (random number) to be encrypted and the random number transmitted from the IC card C and the encryption key file 25 The encrypted data is transmitted to the IC card C using the existing encryption key. Further, the IC card C holds a random number transmitted to the IC card issuing system in response to the request, and performs encryption using the random number data and an encryption key stored in the data memory in advance. The IC card authenticates the IC card issuing system by determining whether the encrypted data matches the data transmitted from the IC card issuing system.

In the example shown in FIG. 5, as shown in FIG. 5A, the external authentication command (CLA / INS = 0X82 (X
= 0, 1, 2)), the encryption key is not stored in the data portion, and 00h is stored in the Lc portion.

Next, FIG. 6 shows that an encryption key is prepared in advance in a data portion of an issued command requiring encryption processing.
This shows a specific example in a case where a command for requesting transmission of data serving as a source of encryption to an IC card is prepared before an issued command requiring encryption processing.

In the example shown in FIG. 6, an external authentication command (CLA / INS = 0 × 82 (X =
A case where a random number request command to the IC card C as shown in FIG. 6A is stored before 0, 1, 2)).

FIG. 6B shows an encryption key (A1 E76C) for encryption processing in the data portion of the external authentication command.
42 F0 53 B98D), and 08h is stored in the Lc part as the data length of the encryption key.

Next, FIG. 7 shows that an encryption key is prepared in advance in the data portion of the issued command requiring the encryption process, but before the issued command requiring the encryption process, the base of the encryption to the IC card is performed. 9 shows a specific example in a case where a command for requesting data transmission is not prepared in advance.

In the example shown in FIG. 7, an external authentication command (CLA / INS = 0 × 82 (X =
The case where there is no random number request command to the IC card C before 0, 1, 2)) is shown. Also, as shown in FIG.
The data part of the external authentication command includes an encryption key for encryption processing (A1 E7 6C 42 F0 53 B98).
D) is stored, and 08h is stored in the Lc portion as the data length of the encryption key.

Next, (a), (b) and (c) of FIG.
I for command message from IC card issuing system
The format of a response message as a message returned from the C card C is shown.

As shown in FIG. 8A, the format of the response message is based on the format of the message shown in FIG. 2 described above.
It is specified in SO / IEC 7816-3 and 7816-4.

FIG. 8 (b) shows the I in the response message.
It shows a format in the NF section, and the INF section is composed of an Lc section, a data section, an STS1 section, and an STS2 section.

FIG. 8C shows an example of a response message in which random number data is stored in the data section as an example of a random number request command (data request command) from the IC card issuing system.

Next, FIG. 9 is a diagram showing a specific example of a command when transmitting encrypted data generated based on random number data. For example, in the case of the external authentication command shown in FIG. 5A described above, the IC
The encryption data is generated using the random number data from the card. Further, the generated encrypted data (B8 372C
F9 04 16 DA5E) is stored in the data part of the command, and the data length (0
8) is stored. In addition, in the case of a command as shown in FIG. 6B or FIG. 7A, encrypted data is generated with the random number data using an encryption key stored in advance in the data portion of the command, The generated encrypted data is overwritten on the encryption key stored in the data portion of the command, and the encrypted data is stored in the data portion and the Lc portion by overwriting the data length of the encrypted data in the Lc portion.

Next, in the above-described configuration, the I-command based on the command message including the issued command requiring the encryption process is used.
The issuing operation of the C card C will be described with reference to the flowchart shown in FIG.

First, when a personal ID is input through the keyboard 4, the host computer 1 sets the input personal ID.
The personal issue data corresponding to D is read from the issue data group 21 in the issue data file 2a in the auxiliary recording device 2 (step 1).

The host computer 1 transmits the issued data group 2
The issue data read from No. 1 is stored at a predetermined position in a predetermined issue command in the issue command group 22 according to the contents of the issue data management information group 23 (step 2).

Up to this point, the information of the NAD portion and the INF portion of each issued command concerning a specific individual is prepared, except for the random number request command and the data portion of the command requiring encryption processing.

Here, the operator sends the I / O to the reader / writer 5.
Insert C card C (step 3).

Then, these prepared issuing commands are sequentially created as command messages by the host computer 1 and transmitted to the IC card C via the reader / writer 5.

When transmitting a command message, the host computer 1 determines whether the issued command is a command requiring encryption processing (step 4). At this time, the host computer 1 stores, in the table information group 24, command data (CLA / INS value) that needs to be encrypted by data (random number data) that is the source of encryption from the IC card and the CLA unit. Since it is stored in the INS section,
Based on the contents stored in the table information group 24, it is determined whether or not the issued command requires encryption processing.

When the host computer 1 determines that the issued command requires encryption processing, the host computer 1 automatically transmits the issued command requiring encryption processing via the reader / writer 5 before transmitting the issued command requiring encryption processing. A command message of the random number request command is transmitted to the IC card C (step 5).

Thereafter, upon receiving a response message from the IC card C in response to the random number request command transmitted to the IC card C, the host computer 1 determines whether or not the response message is normal (step 6). If it is determined that the response message is normal, the host computer 11 extracts the random number data stored in the INF section of the response message. The host computer 1 uses the random number data extracted from the response message and the encryption key stored in the encryption key file 25 to generate encrypted data by, for example, the Sing1eDES algorithm (step 7).

When the encrypted data is generated in this manner, the host computer 1 converts the encrypted data obtained as described above, together with the size of the encrypted data, into an encrypted data such as an external authentication command shown in FIG. It is set in the data section and the Lc section of the issued command requiring processing (step 8).

As a result, an issuance command in which encryption processing is set and in which encryption processing is required is transmitted as shown in FIG.
Completed as NF part. After that, the host computer 1, as shown in FIG.
A command message to which the copy has been added is transmitted to the IC card C via the reader / writer 5 (step 9).

When a response message corresponding to the command message transmitted to the IC card C is received via the reader / writer 5, the host computer 1 determines whether the transmitted command message is normal in the IC card C based on whether the response message is normal. (Step 1)
0).

When the host computer 1 determines that the processing has been normally performed, the host computer 1 determines whether the transmission of the command message has been completed based on whether the next issued command has been prepared (step 11). ). If it is determined that the next issuance command is prepared, the process returns to step 3 and the above process is repeated. Also, if all of the prepared command message issuing commands are sent,
That is, when it is determined that the transmission of the command message has been completed (step 11), the IC card C is ejected (step 1).
2), end the process.

If it is determined in step 6 or step 10 that the response message from the IC card is not normal, the host computer 1 ejects the IC card (step 12) and terminates the processing.

For the above processing, for example, as an issued command requiring encryption processing in the table information group 24, 0X82 (X = 0, 1,.
The case where (2) is stored will be described.

In this case, the host computer 1
CLA / INS of the CMDn portion as indicated by A in FIG.
82 (hex) issuance command is prepared, I
The command is interpreted as a command that requires encryption processing using random number data from the C card C.

When the host computer 1 determines that the issued command is an external authentication command such as that shown in FIG. 5A that requires encryption processing using random number data from the IC card C, the host computer 1 transmits the external authentication command. And IC
A random number request command (I
NF = 00 84 00 00 08) is automatically transmitted.

In response to the transmitted random number request command, I
Upon receiving a response message storing random number data as shown in FIG. 8 from the C card C, the host computer 1 sends the random number data (1C 245D F0 789) recorded in the data section of the INF section of the response message.
Take out B3A E6).

The host computer 1 determines from the encryption key file 25 the encryption key indicated by the latter part P1, P2 (0081) of the command header portion of the issued command as shown in FIG. Using the encryption key and the random number data extracted from the response message, the host computer 1 generates encrypted data by the Sing1eDES algorithm.

When such encrypted data is generated, the host computer 1 issues an issuance command as shown in FIG. 9 in which the encrypted data is stored in the data portion of the issued command shown in FIG. 5A and the data length of the encrypted data is stored in the Lc portion. Set the command. The issuing command in which the encrypted data is set is created as a command message by the host computer 1 and transmitted to the IC card.

As described above, based on the table information in which the data indicating the command requiring the encryption by the random number is stored, the issued command needs to be encrypted by the random number data as the source data of the encryption processing. If the command is a command, the host computer automatically transmits a command requesting random number data to the IC card before transmitting the issued command as a command message. Then, when receiving the random number data from the IC card, the host computer generates encrypted data using the received random number data and the encryption key stored in the encryption key file, and generates the generated encrypted data. , Stored in the above issue command and transmitted to the IC card.

As a result, it is possible to omit the step of setting in advance a command for requesting data to be encrypted from the IC card corresponding to a command requiring encryption processing, and to reduce the storage capacity when storing a command group. be able to.

Further, an IC card for issuing an IC card for each individual by writing issue data of each individual to the portable memory medium having a data memory and a control element in the data memory. In the card issuing system, the issued data of each individual is configured as a set of a NAD (node address) portion and an INF (information) portion of a command message transmitted to an IC card or a reader / writer, and each command is encrypted using a random number. Identify whether it is a command that requires processing, and if it is identified as a command that requires encryption processing using random numbers, automatically send a random number request command before sending the command, Encryption is performed by using the random number data included in the response message for the transmitted command. After generating the data were the encrypted data set in the command that requires encryption, IC
Send to card or reader / writer.

As a result, it is possible to save the trouble of setting in advance a random number request command for requesting random number data from the IC card in response to a command requiring encryption processing, and to reduce the storage capacity when storing issued command groups. it can.

Next, a case where a random number request command is stored in advance as an issue command in an issue operation of the IC card C will be described with reference to a flowchart shown in FIG.

In this case, as shown in the flowchart of FIG. 10, the random number request command is not automatically transmitted, but the command next to the random number request command is
Processing is performed by regarding the command as requiring encryption processing. In this case, the table information group 24 for determining whether or not the command requires an encryption process and the encryption key file 25 in which an encryption key is separately stored are not required as data relating to issuance.

That is, when the issue data of the individual who issues the IC card C is read from the issue data group 21 (step 21), the host computer 1 stores the issue data at a predetermined position in each issue command of the issue command group 22. (Step 22). At this time, a random number request command is set in the issued command group 22 immediately before the command requiring encryption processing, and data serving as an encryption key is stored and issued in the data portion of the command requiring encryption processing. Prepared as a command.

When these issuing commands are prepared and the operator inserts the IC card into the reader / writer 5 (step 23), the host computer 1 first creates the first issuing command as a command message, and To the IC card C via the
4).

Upon receiving a response message from the IC card C for the transmitted command message, the host computer 1 determines whether the response message is normal (step 25). When determining that the response message is normal, the host computer 1 determines whether the command of the transmitted command message is a random number request command (step 26).

If it is determined that the transmitted command is a random number request command, the host computer 1
Regards the issued command to be transmitted next as a command requiring encryption processing, and extracts random number data from the response message. Then, the host computer 1 compares the random number data extracted from the response message with the INF of the command prepared as the next command to be transmitted.
The encrypted data is generated using the data of the copy and the encryption key (step 27).

When the encrypted data is obtained in this manner, the host computer 1 overwrites the encrypted data with the encryption key (external authentication key) recorded in the data section of the issued command, and converts the PCB section, the LEN section, and the EDC section. (Step 28).

The host computer 1 executes step 2
If it is determined in step 6 that the transmitted command message is not a random number request command, or if the generated encrypted data is set in the command message, whether the transmission of the command message has been completed depends on whether the next command is prepared or not. Is determined (step 29).

When the host computer 1 determines that the transmission of the command message has been completed, the host computer 1 ejects the IC card from the reader / writer 5 (step 30).
The C card issuing process ends. When the next command message is prepared, that is, when it is determined that the transmission of the command message has not been completed, the host computer 1
Returns to step 24 and repeats the process.

As a specific example of the above issuance processing, for example,
A case where the issuing command shown in FIG. 6 is prepared will be described. In this case, the host computer 1 determines in step 25 that the transmitted command is a random number request command (INF = 00 84 00 00 00) as shown in FIG.
08), the next issued command is regarded as an issued command requiring encryption processing.

Then, in response to the random number request command, I
When a response message as shown in FIG. 8 is received from the C card, the random number data stored in the INF section is extracted. The host computer 1 uses the random number data extracted from the response message and the encryption key stored in the data portion of the external authentication command as shown in FIG. 6B, which is a command requiring encryption processing using the random number data. Then, encrypted data (8 bytes) is obtained by the Sing1eDES algorithm.

As shown in FIG. 9, the encrypted data thus obtained is stored in the data part of the external authentication command by overwriting the encryption key (external authentication key), and the data length is stored in the Lc part. Overwritten and stored. The issuance commands set in this way include the PCB section, LEN
And an EDC unit are added to form a command message, which is transmitted to the IC card.

As described above, an encryption key is stored in a command that requires encryption processing using a random number, and a command issued next to the random number request command is determined to be a command that requires encryption processing. When data is received,
Using the received random number data and an encryption key stored in the data portion of the command requiring the encryption process, generate encrypted data, store the generated encrypted data in the issued command, Send to

Thus, the encryption key required for the encryption processing can be included in the issued command group and stored in advance, and it is not necessary to store the encryption key as a separate file, and the key related to the issuance is not required. The management of various files can be prevented from becoming complicated.

Further, there is no need for table information for determining whether or not a command is a command that requires encryption processing, so that it is possible to prevent complicated management of various files related to issuance.

Further, an IC card that issues an IC card for each individual is written in each of the portable storage media having a data memory and a control element by writing issuance data of each individual to the data memory. In the card issuing system, the issued data of each individual is configured as a set of a NAD (node address) portion and an INF (information) portion of a command message transmitted to an IC card or a reader / writer, and each command requires an encryption process. In the case of the command, the encryption key is stored in the data part in the INF part of the command, and when performing the encryption processing before transmitting the command, the encryption data is created using the encryption key. After storing this encrypted data in place of the encryption key stored in the command, the IC card or reader / To send to.

Thus, the encryption key required for the encryption processing can be included in the issued command group and stored in advance, and it is not necessary to store the encryption key as a separate file. Since there is no need for table information for determining whether the command is a simple command, it is possible to prevent an increase in the type and data amount of files related to issuance, and to prevent complicated management of those files. .

Next, an encryption key is stored in advance in a command message requiring encryption processing using random numbers, and a random number request command is automatically transmitted before a command message requiring encryption processing using random numbers. The issuing operation of the IC card in this case will be described with reference to the flowchart shown in FIG. In this case, the encryption key file 25 in which the encryption key is separately stored is unnecessary as the data relating to the issuance.

That is, when the issued data of the individual who issues the IC card C is read from the issued data group 21 (step 31), the host computer 1 stores the issued data at a predetermined position in each issued command of the issued command group 22. (Step 32). At this time, the issued command group 22 does not include a random number request command, and data serving as an encryption key is stored and prepared in a data portion of a command requiring encryption processing.

When an issuance command is prepared and an IC card is inserted into the reader / writer 5 by the operator (step 33), the issuance command is sequentially created as a command message by the host computer 1 and is read.
Is transmitted to the IC card C via.

When transmitting a command message in this way, the host computer 1 determines whether the command to be transmitted requires an encryption process (step 34). In this case, the host computer 1 transmits the table information group 2
4 stores data (CLA / INS value) indicating a command that requires an encryption process using a random number. Therefore, based on the contents stored in the table information group 24, the command needs an encryption process. Is determined.

If it is determined that the command to be transmitted requires encryption processing, the host computer 1
Transmits the command message of the random number request command to the IC card C via the reader / writer 5 before transmitting the command (step 35).

Upon receiving a response message from the IC card C for the transmitted command message, the host computer 1 determines whether or not the response message is normal (step 36). If it is determined that the response message is normal, the host computer 1 extracts the random number data stored in the INF section of the response message. Then, the host computer 1 uses the random number data extracted from the response message and the encryption key stored in the data section of the command message, for example,
Encrypted data is generated by the Sing1eDES algorithm (step 37).

After generating the encrypted data, the host computer 1 overwrites the generated encrypted data with the encryption key,
Along with the size of the encrypted data, it is set in the data portion and the Lc portion of the command message requiring encryption such as the external authentication command shown in FIG. 7A (step 38).

The command that requires the encryption processing in which the encrypted data is set is sent by the host computer 1 to the host computer 1 as shown in FIG.
As shown in FIG. 3, after being completed as an INF section, as shown in FIG. 3, a command message to which a PCB section, a LEN section, and an EDC section are added is transmitted to the IC card C via the reader / writer 5 ( Step 39).

Upon receiving a response message corresponding to the command message transmitted to the IC card C, the host computer 1 determines whether the response message is normal (step 40). If it is determined that the response message is normal, the host computer 1 determines whether the transmission of the command message has been completed based on whether a command message to be transmitted next is prepared (step 41). . If it is determined that the transmission of the command message has not been completed, the host computer 1 returns to step 34 and repeats the above processing. Also,
If it is determined that the transmission of the command message has been completed,
The host computer 1 ejects the IC card from the reader / writer 5 (Step 42), and ends the processing.

As a specific example of the above issuance processing, for example,
A case where the host computer 1 automatically transmits a random number request command before transmitting the external authentication command as shown in FIG. 7A will be described.

In this case, before the external authentication command is transmitted, the automatically transmitted random number request command is
When the host computer 1 receives the response message as shown in (1), the host computer 1 generates the random number data (1C 245D F0) recorded in the data section of the INF section of the response message.
Remove 789B 3A E6).

Then, the host computer 1 generates encrypted data by the Sing1eDES algorithm using the random number data extracted from the response message and the encryption key stored in the data portion of the issued command as shown in FIG. 7A. I do.

The host computer 1 converts the encrypted data obtained as described above into the size of the encrypted data (0
8h), the data part of the external authentication command shown in FIG.
Set by overwriting the section.

After the issuance command in which the encrypted data is set is completed as an INF section as shown in FIG.
It is transmitted to the IC card C via the reader / writer 5 as a command message to which the PCB section, the LEN section, and the EDC section are added.

As described above, an encryption key is stored in a command that requires encryption processing using a random number, and based on the contents of table information in which data indicating a command that requires encryption processing using a random number is stored. It is determined whether the issued command is a command that requires encryption processing by using a random number. If it is determined that the command requires encryption processing, a random number request that requests the IC card for random number data before transmitting the command. When a command is automatically transmitted and random number data is received from the IC card, the received random number data and the encryption key stored in the data portion of the command requiring the above-described encryption processing are used to encrypt data. Is generated, and the generated encrypted data is stored in the above issue command and transmitted to the IC card.

As a result, there is no need to set in advance a random number request command corresponding to a command requiring encryption processing, so that it is not necessary to set the random number request command, and the storage capacity for storing a command group can be reduced. Can be.

Further, by storing the data of the encryption key required for the encryption process in the issuance command group in advance, it is not necessary to store the encryption key as a separate file, and the data related to the issuance can be obtained. The management of various files can be prevented from becoming complicated.

[0112] Further, by writing issuance data of each individual in the data memory for each portable storage medium having a data memory and a control element, an IC card for issuing an IC card for each individual is provided. In the card issuing system, the issued data of each individual is configured as a set of a NAD (node address) portion and an INF (information) portion of a command message transmitted to an IC card or a reader / writer, and each command is an encryption using a random number. Identify whether the command needs to be
If it is identified as a command that requires encryption using random numbers, it automatically sends a random number request command before sending the command and encrypts it using the random number data included in the response message. At the time of processing, an encryption key is stored in the data part in the INF part of the command, encrypted data is created using the encryption key, and the actual encrypted data is stored instead of the encryption key stored in the command. Then, it transmits to the IC card or the reader / writer.

As a result, it is possible to save the trouble of setting in advance a random number request command corresponding to a command requiring encryption processing, and to reduce the storage capacity for storing a command group.

Also, an encryption key required for the encryption process can be stored in advance in the issued command group.
It is not necessary to store the encryption key as a separate file, and it is possible to prevent management of various files related to issuance from becoming complicated.

[0115]

As described above in detail, according to the present invention, it is possible to eliminate the trouble of including a random number request command in the issued command group as necessary, and to increase the capacity of the file storing the issued command group. IC that can prevent
A card issuing system and an IC card issuing method can be provided.

Further, according to the present invention, by temporarily storing the data of the encryption key in the data portion of the related issuance command, that is, in the location where the encrypted data is to be stored, the file related to the issuance is issued. An IC card issuing system and an IC card issuing method that can prevent the management of the IC card from becoming complicated can be provided.

[Brief description of the drawings]

FIG. 1 is a diagram showing an overall configuration of an IC card system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a message format.

FIG. 3 is a diagram showing a format of an issue command.

FIG. 4 is a diagram showing a format of a command message.

FIG. 5 is a diagram showing a specific example of an issue command.

FIG. 6 is a diagram showing a specific example of an issue command.

FIG. 7 is a diagram showing a specific example of an issue command.

FIG. 8 is a diagram showing a format of a response message.

FIG. 9 is a diagram showing a specific example of an issued command requiring encryption processing.

FIG. 10 is a flowchart for explaining the operation of an IC card issuing process.

FIG. 11 is a flowchart for explaining the operation of an IC card issuing process.

FIG. 12 is a flowchart for explaining the operation of an IC card issuing process.

[Explanation of symbols]

 C: IC card Ca: Data memory section Cb: CPU 1: Host computer 2: Auxiliary storage device 2a: Issued data file 4: Keyboard 5: Reader / writer 21: Issued data group 22: Issued command group 23: Issued data management information group 24: table information group 25: encryption key file

Claims (9)

[Claims] 1. An I / O having a data memory and a control element.
In an IC card issuing system that issues an IC card by performing data communication with a C card, a storage unit that stores an encryption key used when performing an encryption process in the data communication, and transmits an issue command to the IC card. A determining means for determining whether the issued command requires the encryption processing; and a transmitting means for transmitting the issued command when the determining means determines that the issued command does not require the encryption processing. And when the issuing command determines that the issued command requires an encryption process, and before transmitting the issued command,
A second transmitting means for transmitting a command requesting data to be a source of encryption from the IC card; and a source of encryption returned from the IC card in response to the command transmitted by the second transmitting means. Means for generating encrypted data using the data and the encryption key stored in the storage means; and setting the encrypted data generated by the generating means in the issuing command and transmitting the issued command to the IC card. 3. An IC card issuing system comprising: (3) transmitting means. 2. An IC having a data memory and a control element.
In an IC card issuing system for issuing an IC card by performing data communication with a C card, a first transmitting means for sequentially transmitting a plurality of issuing commands to the IC card, and an issuing command transmitted by the first transmitting means. Is a command requesting the data to be encrypted, the data to be encrypted is returned from the IC card corresponding to this command, and the encryption is set in advance in the issuance command to be transmitted next. Generating means for generating encrypted data using the key; and second transmitting means for setting the encrypted data generated by the generating means as an issue command to be transmitted next and transmitting the issued command to the IC card. Characterized IC card issuing system. 3. An I memory having a data memory and a control element.
In an IC card issuing system for issuing an IC card by performing data communication with a C card, a determination unit for determining whether or not the issued command requires an encryption process before transmitting the issued command to the IC card. A first transmitting unit for transmitting the issued command when the determining unit determines that the issued command does not require the encryption process; and determining that the issued command requires the encrypting process by the determining unit. Before sending the issued command,
A second transmitting means for transmitting a command for requesting data to be encrypted from the IC card to the IC card; and a second transmitting means for transmitting the command transmitted by the second transmitting means.
Generating means for generating encrypted data by using the encryption source data transmitted from the C card and an encryption key preset in the issued command; And a third transmitting means for transmitting the information to the IC card. 4. An I-type memory having a data memory and a control element.
In an IC card issuing system for issuing an IC card by performing data communication with a C card, a first storage means for storing issue data for issuing the IC card for each individual; A second storage unit for storing an issuance command group to be used for encryption, a third storage unit for storing an encryption key used for performing an encryption process in the data communication, and an IC card issued from the first storage unit. Issuance data for an individual to be read and combined with each of the issuance commands stored by the second storage means,
Setting means for setting each issued command to be transmitted to the card; determining means for determining whether or not the issued command set by the setting means requires encryption processing; A first transmitting unit for transmitting the issued command set by the setting unit when it is determined that the issuing command is not required; and Before sending
A second transmitting means for transmitting a command for requesting data to be encrypted from the IC card to the IC card; and a second transmitting means for transmitting the command transmitted from the IC card in response to the command transmitted by the second transmitting means. Generating means for generating encrypted data using data as a source of encryption and an encryption key stored in the third storage means; and setting the encrypted data generated by the generating means by the setting means. And a third transmitting means for setting the issued command requiring an encryption process and transmitting the command to the IC card by the transmitting means. 5. An I-type memory having a data memory and a control element.
In an IC card issuing system for issuing an IC card by performing data communication with a C card, a first storage means for storing issue data for issuing the IC card for each individual; A second storage unit for storing a group of issuance commands to be used for reading the issuance data for the individual who issues the IC card from the first storage unit, and combining with the issuance commands stored in the second storage unit Together with the above IC
Setting means for setting each issue command to be transmitted to the card;
A first transmitting means for transmitting to the C card; and, when the issued command transmitted by the transmitting means is a command for requesting data to be encrypted, a cipher returned from the IC card in response to the command. Generating means for generating encrypted data by using the original data of the data and an encryption key which is set in advance in an issue command to be transmitted next; and the setting means sets the encrypted data generated by the generating means by the setting means. And a second transmission means for setting an issue command to be transmitted next and transmitting the command to the IC card. 6. I / O having a data memory and a control element
In an IC card issuing system for issuing an IC card by performing data communication with a C card, a first storage means for storing issue data for issuing the IC card for each individual; A second storage unit for storing a group of issuance commands to be used for reading the issuance data for the individual who issues the IC card from the first storage unit, and combining with each of the issuance commands stored in the second storage unit. Together with the above IC
Setting means for setting each issued command to be transmitted to the card; determining means for determining whether or not the issued command set by the setting means requires encryption processing; A first transmitting means for sequentially transmitting the issued command set by the setting means when it is determined that the issued command does not need to be issued; Before sending the command,
A second transmitting means for transmitting a command requesting data to be encrypted from the IC card to the IC card; and a reply from the IC card corresponding to the command transmitted by the second transmitting means. Generating means for generating encrypted data by using the data and an encryption key preset in the issued command; and requiring the encryption processing generated by the generating means to perform the encryption processing set by the setting means. And a third transmission unit that sets the command to be issued and transmits the command to the IC card. 7. I / O having a data memory and a control element
In an IC card issuing system that issues an IC card by performing data communication with a C card, an encryption key used for performing an encryption process in the data communication is stored in a storage unit, and an issue command is transmitted to the IC card. Before determining whether the issued command requires encryption processing, if the determined that the issued command does not require encryption processing, transmitting the issued command, and issuing based on the determination When it is determined that the command requires an encryption process, before transmitting the issued command, a command for requesting data to be encrypted from the IC card is transmitted, and a command corresponding to the transmitted command is transmitted. Generating encrypted data using the encryption source data returned from the IC card and the encryption key stored in the storage means; The resulting encrypted data is set to the issued command transmitted to the IC cards, IC card issuing method, characterized in that. 8. I / O having a data memory and a control element
In an IC card issuance system for issuing an IC card by performing data communication with a C card, a plurality of issuance commands are sequentially transmitted to the IC card, and the transmitted issuance command is a command for requesting data as a source of encryption. In the case of, the encrypted data is generated using the data that is the source of the encryption returned from the IC card in response to this command, and the encryption key that is set in advance in the issued command to be transmitted next, A method of issuing an IC card, wherein the generated encrypted data is set as an issue command to be transmitted next and transmitted to an IC card. 9. An I memory having a data memory and a control element.
In an IC card issuing system for issuing an IC card by performing data communication with a C card, it is determined whether or not the issued command requires encryption before transmitting the issued command to the IC card. When it is determined that the issued command does not require the encryption processing, the above-mentioned issued command is transmitted. When it is determined that the issued command requires the encryption processing, the above-mentioned issued command is transmitted. A command for requesting data to be ciphered from the IC card is transmitted to the IC card, and the data to be ciphered transmitted from the IC card in response to the transmitted command and the issued command Generating encrypted data by using a predetermined encryption key; setting the generated encrypted data in the issued command; IC card issuing method comprising transmitting to it.