JP2002244868A - Data processing method, semiconductor circuit and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method of processing data to prevent each application program from receiving a bad influence from other application programs in an environment where a plurality of application programs are operated. SOLUTION: An SAM chip 108 protects each of a plurality of program modules constituting the application program by a fire wall previously allotted to each program module of a plurality of fire walls and registers the program module with relating to fire wall identification information for identifying the fire wall allotted to the program module and then executes the program module on condition that the module is registered.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a data processing method, a semiconductor circuit, and a program capable of preventing each application program from being tampered with and monitored in an environment in which a plurality of application programs operate.

[0002]

2. Description of the Related Art Currently, a communication system has been developed in which an IC card is used for transactions via a network such as the Internet. In such a communication system,
The server device that performs the settlement is, for example, an IC card reader / writer.
Upon receiving a processing request using an IC card from a writer or a PC (Personal Computer), it performs processing such as user authentication and data encryption and decryption. On the server device, for example, application programs of businesses such as a plurality of credit card companies are operating. Such an application program is created by each business operator and downloaded to a server device using a personal computer or the like.

[0003]

However, when the application programs of a plurality of business operators are operated on the server device as described above, the processing of each application program must be monitored and falsified by another application program. There is a need to.

[0004] The present invention has been made in view of the above-mentioned conventional technology, and when operating a plurality of application programs on the same semiconductor circuit, each application program is affected by another application program. Data processing methods that can be prevented,
It is an object to provide a semiconductor circuit and a program.

[0005]

In order to achieve the above-mentioned object, a data processing method according to the present invention is a data processing method performed by a semiconductor circuit executing an application program. Each of the program modules is protected by a firewall assigned to each program module in advance among a plurality of firewalls, and the program module is registered in association with firewall identification information for identifying the firewall assigned to the program module, The program module is executed on condition that the registration has been performed.

Further, the data processing method of the present invention preferably allows data exchange or data reference between a plurality of program modules registered in association with the same firewall identification information, and associates with different firewall identification information. Data transfer or data reference between a plurality of registered program modules is prohibited.

In the data processing method of the present invention, preferably, the program module is further associated with download key information used when downloading the program module from outside the semiconductor circuit to the semiconductor circuit. When receiving the download request for the program module, the download module uses the download key information registered corresponding to the program module to determine whether or not the download is possible. Download the program module.

Preferably, in the data processing method according to the present invention, when the download key information is not registered corresponding to the program module, the program module is not downloaded.

In the data processing method according to the present invention, preferably, mutual authentication is performed with the transmission source of the download request, and after confirming the legitimacy of the transmission source, it is determined whether the download is permitted.

In the data processing method of the present invention, preferably, the program module is further registered in association with key information used before the execution of the program module, and corresponds to the program module for which the execution request has been received. Using the key information, it is determined whether the program module has been altered or tampered with. If it is determined that the program module has not been altered or tampered with, the program module is executed.

In the data processing method of the present invention, preferably, when the program module is stored in a semiconductor memory circuit provided outside the semiconductor circuit, the semiconductor circuit scrambles the program module. Later, the semiconductor module writes to the semiconductor memory circuit, and the semiconductor circuit descrambles the program module read from the semiconductor memory circuit.

The data processing method according to the present invention is preferably arranged such that, when the application program specifies a procedural process using an integrated circuit for transmitting and receiving data to and from the semiconductor circuit, First key information used for operating the circuit is encrypted with second key information and stored in the semiconductor memory circuit, and the second key information is stored in the semiconductor circuit.

In the data processing method according to the present invention, preferably, the integrated circuit is mounted on a card.

In the data processing method of the present invention, preferably, the semiconductor circuit executes a plurality of the application programs respectively corresponding to a plurality of procedure providers for providing a procedure performed using the integrated circuit, A plurality of the program modules constituting the same application program are protected by the same firewall.

Further, the semiconductor circuit of the present invention is a semiconductor circuit for executing an application program, wherein each of a plurality of program modules constituting the application program is assigned to each program module in advance among a plurality of firewalls. Protected by a firewall, the program module is registered in association with firewall identification information identifying a firewall assigned to the program module, provided that the registration is performed,
Execute the program module.

Further, according to the program of the present invention, each of a plurality of program modules constituting the application program is protected in a semiconductor circuit executing the application program by a firewall assigned to each program module in advance among a plurality of firewalls. And registering the program module in association with firewall identification information for identifying a firewall assigned to the program module, and executing the program module on condition that the registration has been performed. Let the procedure and execute.

[0017]

Embodiments of the present invention will be described below with reference to the accompanying drawings. FIG. 1 is an overall configuration diagram of a communication system 101 according to the present embodiment. As shown in FIG.
The communication system 101 includes a server device 102, an IC card 103 (an integrated circuit of the present invention), a card reader / writer 1
04, personal computer 105, ASP (Applica
Option Service Provider) server device 106, SAM (Sec
ure Application Module) unit 109, personal computers 116_1, 116_2, and 116_3, and authentication units 117_1, 117_2, and 117_.
Using the IC card 103, communication is performed via the Internet 110 to perform a procedural process such as a payment process using the IC card 103. The SAM unit 109 includes an external memory 107
(Semiconductor Storage Circuit of the Present Invention) and SAM Chip 108
(The semiconductor circuit of the present invention). SAM chip 108
Has a software configuration as shown in FIG.
As shown in FIG. 2, the SAM chip 108 has an HW (Hardware) layer, an OS layer, a lower handler layer, an upper handler layer, and an AP layer in order from a lower layer to an upper layer. The lower handler layer includes a driver layer. Where A
In the P layer, there are application programs AP_1, AP_2, and AP_3 that define procedures using the IC card 103 by the businesses 115_1, 115_2, and 115_3 such as the credit card companies shown in FIG. In the AP layer, application programs AP_1 and AP_
2, a firewall FW (the firewall of the present invention) is provided between the AP_3 and the upper handler layer.

The SAM chip 108 is a SCSI or E
It is connected to the ASP server device 106 via the Internet or the like. The ASP server device 106 is connected to the personal computer 105 of the end user and the operators 115_1, 115_2, and 115_ via the Internet 110.
3 personal computers 116_1, 116_2,
116_3 is connected to a plurality of terminal devices. The personal computer 105 is, for example, a serial or U
Dumb type card reader / writer 104 via SB
It is connected to the. If the card reader / writer 104
For example, wireless communication corresponding to a physical level with the C card 103 is realized. The operation command to the IC card 103 and the response packet from the IC card 103 are:
Generated and decrypted on the SAM unit 109 side. Therefore, the card reader / writer 104 interposed in the middle,
The personal computer 105 and the ASP server device 106 only play a role of storing and relaying commands and response contents in a data payload portion, and are involved in actual operations such as encryption and decryption of data in the IC card 103 and authentication. do not do.

Businesses 115_1, 115_2, 115_
3 is a personal computer 116_1, 116_
Application program A using 2,116_3
P_1, AP_2, and AP_3 are created, and the created application programs are sent to the SAM via the authentication units 117_1, 117_2, and 117_3, respectively.
The data is downloaded to a pre-allocated storage area in the external memory 107 via the chip 108. At this time, since the operators 115_1, 115_2, and 115_3 are not related to each other, the application program AP_
1, AP_2 and AP_3 are predetermined in a storage area in the external memory 107, and it is determined whether the user has the authority to download the storage area.
It is verified by the M chip 108. During the execution of the application programs AP_1, AP_2, and AP_3, transmission and reference of data between the application programs AP_1, AP_2, and AP_3 are restricted by the firewall FW. The authentication units 117_1, 117_2, and 117_3 are, as described later, the application programs AP_1 and AP_
When the AP_3 and AP_3 are downloaded to the SAM chip 108, mutual authentication is performed with the SAM chip 108, and signature verification key information for download is created.

Hereinafter, the components shown in FIG. 1 will be described. [IC Card 103] FIG. 3 is a functional block diagram of the IC card 103. As shown in FIG.
3 is an IC (I / O) including a storage unit 150 and a processing unit 151.
integrated circuit) 103a. Storage unit 150
Has a storage area 155_1 used by an operator 115_1 such as a credit card company, a storage area 155_2 used by the operator 115_2, and a storage area 155_3 used by the operator 115_3, as shown in FIG. The storage unit 150 includes key information used to determine the presence or absence of authority to the storage area 155_1, key information used to determine access authority to the storage area 155_2, and access authority to the storage area 155_3. The key information used to determine the key information is stored. The key information is specifically used for mutual authentication, data encryption and decryption, and the like. In addition, the storage unit 150
The identification information of the IC card 103 or the user of the IC card 103 is stored.

Hereinafter, the SAM unit 109 will be described in detail. [External Memory 107] FIG. 5 is a diagram for explaining a storage area of the external memory 107. As shown in FIG. 5, in the storage area of the external memory 107, an AP storage area 120_1 in which the application program AP_1 of the operator 115_1 is stored, and an AP storage area 120 in which the application program AP_2 of the operator 115_2 is stored.
_2, AP storage area 120_3 in which application program AP_3 of company 115_3 is stored, SAM
AP management storage area 1 used by the administrator of chip 108
21 and a key information storage area 122.

The application program AP_1 stored in the AP storage area 120_1 is composed of a plurality of program modules. Access to the AP storage area 120_1 is performed by the firewall FW_1
Limited by The application program AP_2 stored in the AP storage area 120_2 is
It is composed of a plurality of program modules.
Access to the AP storage area 120_2 is restricted by the firewall FW_2. AP storage area 1
The application program AP_3 stored in 20_3 is composed of a plurality of program modules. Access to the AP storage area 120_3 is as follows.
Limited by firewall FW_3. In the present embodiment, the program module is, for example,
This is the minimum unit downloaded from the outside of the SAM unit 109 to the external memory 107. The number of program modules constituting each application program can be arbitrarily determined by the corresponding business operator.

The application programs AP_1, AP_2, AP_3 stored in the external memory 107
Are scrambled, and are descrambled when read into the SAM chip 108. Also, application programs AP_1, AP_2, AP_3
Are created by the operators 115_1, 115_2, and 115_3 using the personal computers 116_1, 116_2, and 116_3 shown in FIG. 1, respectively, and downloaded to the external memory 107 via the SAM chip 108.

Access to the AP management storage area 121 is restricted by the firewall FW_4. Note that the firewalls FW_1, FW_2, and FW
_3 and FW_4 correspond to the firewall FW shown in FIG. The AP management storage area 121 stores module management data 130 shown in FIG.
In the module management data 130, the module names of the program modules downloaded from the personal computers 116_1, 116_2, and 116_3 and the signature verification key information for download (download key information of the present invention) are registered in advance. That is, the download of the program module is permitted on condition that the download signature verification key information is registered in the module management data 130 in advance. In the module management data 130, the module name of the program module executed by the SAM chip 108 and the execution signature verification key information are registered. That is, on condition that the execution signature verification key information is registered in the module management data 130 in advance, the program module
The execution right for the M chip 108 is obtained.

As shown in FIG. 6, the module management data 130 includes the AP storage areas 120_1, 120_2, 1
Application program AP stored in 20_3
_1, AP_2, AP_3, the firewall number of the firewall that restricts access to the program module (firewall identification information of the present invention), start address, address length, download signature verification key information, execution signature verification The correspondence between the key information and the module name is shown. Here, the firewall number indicates the number of a firewall whose access to the program module is restricted. The start address indicates the start address of the storage area whose access is restricted by the firewall.
The address length indicates the address length of a storage area whose access is restricted by the firewall. The signature verification key information for download indicates that the program module is S
This is key information used for signature verification performed when downloading to the external memory 107 via the AM chip 108. The execution signature verification key information is used to verify signature information attached to the program module when the SAM chip 108 executes the program module. In the present embodiment, for example, signature information indicating the validity is attached to each program module, and when the program module is tampered or falsified, the signature information is used using the execution signature verification key information. Is verified, the validity of the program module can be confirmed. The module name is a name given to the program module.

The key information storage area 122 stores an IC shown in FIG. 4 by executing the application program AP_1.
The encrypted key information K_C1 used for accessing the storage area 155_1 of the card 103 and the IC shown in FIG.
The encrypted key information K_C2 used when accessing the storage area 155_2 of the card 103 and the encrypted key information K_C2 used when accessing the storage area 155_3 of the IC card 103 shown in FIG. 4 by executing the application program AP_3. Key information K_C3 is stored. The key information K_C1, K_C2, and K_C3 are encrypted with the key information K_X. Key information storage area 122
Only the administrator of the SAM chip 108 is permitted to access.

[SAM chip 8] FIG.
FIG. 3 is a functional block diagram of an AM chip 108. As shown in FIG. 7, the SAM chip 108 includes an ASPS communication interface unit 160, an external memory communication interface unit 16
1, bus scramble unit 162, signature processing unit 163, authentication processing unit 164, encryption / decryption unit 165, storage unit 166,
It has a CPU 167. The SAM chip 108 is a tamper-resistant module.

The ASPS communication interface unit 160
This is an interface used for data input / output with the ASP server device 106 shown in FIG. The external memory communication interface unit 161 is an interface used for data input / output with the external memory 107. When inputting / outputting data via the external memory communication interface 161, the bus scrambler 162 scrambles output data and descrambles the input data. The signature processing unit 163 performs signature creation and signature verification when downloading an application program to the external memory 107 via the Internet 110 and executing the application program as described later. The authentication processing unit 164 performs mutual authentication with the other party when downloading an application program to the external memory 107 via the Internet 110 as described later. The encryption / decryption unit 165
It performs data encryption and decrypts the encrypted data. The storage unit 166 stores, for example, the external memory 10 described above.
Key information K_C stored in the key information storage area 122 of No. 7
Key information K_X for decrypting 1, K_C2 and K_C3
Is stored. The CPU 167 executes a task as described later, and executes the designated application program according to the execution of the task.

FIG. 8 is a diagram for explaining a task executed by the CPU 167. As shown in FIG.
67 is a download task 170, a system task 1
71, an AP task 172 (program of the present invention) and a settlement processing procedure task 173 are executed. As will be described later, the download task 170 is executed by the external memory 10 via the SAM chip 108 from outside the SAM unit 109.
7, a process for downloading the application program is performed. The system task 171 includes driver management,
This is a task for performing processing such as an operation specific to the IC card 103. The AP task 172 is, for example, an AS
Application programs AP_1, AP_2, and A executed when the SAM chip 108 receives a processing request from outside the SAM chip 108 such as the P server device 106
The execution of P_3 is comprehensively managed. For example, when the SAM chip 108 receives a processing request related to the IC card 103 from the ASP server device 106, the payment processing procedure task 173 executes the application program AP_1, A
It is determined which of P_2 and AP_3 is used.

Hereinafter, an operation example of the communication system 101 will be described. [Operation of Downloading AP to External Memory] FIG. 9 is a flowchart for explaining an operation of downloading the application program AP_1 from the personal computer 116_1 shown in FIG. 1 to the external memory 107. Step ST101: The personal computer 116_1 shown in FIG. 1 is connected via the authentication unit 117_1
A download request designating the module name of the program module to be downloaded is transmitted to the SAM chip 108.

Step ST102: The download task 170 operating on the CPU 167 of the SAM chip 108 shown in FIG. 8 performs mutual authentication with the authentication unit 117_1 connected to the personal computer 116_1. When mutual validity is confirmed by mutual authentication, the process of step ST103 is performed. In the present embodiment, various methods can be used as the mutual authentication method. For example, the following method is used. Authentication unit 117_1 and SAM
Both the chips 108 hold SAM_ID, which is identification information of the SAM chip 108, and original key information for mutual authentication. Then, in the authentication unit 117_1, the SA
The M_ID is encrypted with the mutual authentication original key information and transmitted to the SAM chip 108. The SAM chip 108 decrypts the received encrypted SAM_ID with the mutual authentication original key, compares it with the SAM_ID held by itself, and confirms the validity of the authentication unit 117_1 if it matches.
On the contrary, in the SAM chip 108, S
The AM_ID is encrypted with the mutual authentication original key information, and transmitted to the authentication unit 117_1. Authentication unit 117
In _1, the received encrypted SAM_ID is decrypted with the mutual authentication original key, and is compared with its own SAM_ID, and if they match, the validity of the SAM chip 108 is confirmed.

Step ST103: The download task 170 determines whether the module name specified by the download request in step ST101 is registered in the module management data 130 stored in the AP management storage area 121 of the external memory 107. I do.

Step ST104: The download task 170 terminates the process without performing the download process when it is determined in step ST103 that it has not been registered, or skips the process of step ST105 when it is determined that it has been registered. Do.

Step ST105: Authentication unit 11
7_1 is an AP original key KEY using SAM_ID as plain text.
-A is used to generate download signature verification key information. The signature verification key information for download or the signature information created using the signature verification key information for download is transmitted to the SAM chip 108.

Step ST106: If the download signature verification key information is received in step ST105, the download task 170 stores the received download signature verification key information in the module management data 130.
It is determined whether or not the information matches the download signature verification key information of the corresponding module name in. Further, when the signature information is received in step ST105, the download task 170 determines the validity of the signature information by using the signature verification key information for download of the corresponding module name in the module management data 130.

Step ST107: If the download task 170 determines in step ST106 that they match, or if the signature information is determined to be valid, the process proceeds to step ST108, otherwise, the download task 170 proceeds to step ST108. finish.

Step ST108: The download task 170 specifies the address in the external memory 107 corresponding to the module name specified in step ST101 by referring to the module management data 130, and specifies the address on the specified external memory 107. Then, the program module received from the personal computer 116_1 is downloaded.

[Execution Operation of Application Program] FIG. 10 is a flowchart for explaining the operation of executing the application program AP_1 by the SAM chip 108 shown in FIG. Step ST111: The SAM chip 108
When receiving an execution request for the application program AP_1 from the ASP server device 106, the AP task 172 shown in FIG. 8 executes the process of step ST112.

Step ST112: AP task 172
Before executing each program module of the application program AP_1, the execution signature verification key information corresponding to the module name of the program module is obtained by referring to the module management data 130.

Step ST113: AP task 172
Verifies the validity of the signature information of the program module using the execution signature verification key information obtained in step ST112. That is, it is determined whether the program module has been tampered with or altered.

Step ST114: AP task 172
If the signature information is verified to be valid in step ST113, the process proceeds to step ST115, and if it is determined that the signature information is not valid, the process ends.

Step ST115: AP task 172
Executes the program module whose signature information is determined to be valid.

The execution of the program module may be executed by CPU 167 shown in FIG. 7 as a subroutine in the program.

[Operation During Execution of Application Program] FIG. 11 is a diagram for explaining the operation during execution of the application program. Step ST121: When the AP task 172 executes each code in the program module through the processing shown in FIG. 10, the next executed code instructs data transfer or data reference with another program module. It is determined whether the code is to be executed.

Step ST122: AP task 172
If it is determined that the code to be executed next does not instruct data transfer or data reference with another program module, the process proceeds to step ST124,
If it is determined that the instruction has been given, the process proceeds to step ST123.

Step ST123: AP task 172
Executes the code.

Step ST124: AP task 172
Does not execute the code, but performs error processing, for example.

Hereinafter, the overall operation of the communication system 101 shown in FIG. 1 will be described. FIG. 12 is a diagram for explaining the overall operation of the communication system 101 shown in FIG. Step ST131: The application programs AP_1 and A for the businesses 115_1 to 115_3 or those who have received the requests of these businesses to perform the processing for the transactions performed by the businesses using the IC card 103.
P_2 and AP_3 are created on the personal computers 116_1, 116_2 and 116_3 shown in FIG.
Further, the administrator of the SAM chip 108 generates the module management data 130 shown in FIG. 5, scrambles the data, and stores it in the external memory 107.

Step ST132: The application programs AP_1, AP_2, AP_3 are transmitted to the personal computers 116_1, 116_2, 116 via the authentication units 117_1, 117_2, 117_3.
_3 to the SAM chip 108. At this time, the processing described with reference to FIG. 9 is performed.

Step ST133: The IC card 103 is issued to the user. As shown in FIG.
The IC 103a of 03 stores key information used for dealings with the business operator with whom the user has made a contract. Note that the contract between the user and the business operator is based on the IC card 103
May be performed via the Internet 110 or the like.

Step ST134: For example, when the user uses the personal computer 105 to connect to the Internet 1
When the user accesses the server 102 via the server 10 and tries to purchase a product, the server 102 issues a processing request to the ASP server 106 via the Internet 110. The ASP server device 106 is a server device 1
When a processing request is received from the personal computer 105, the personal computer 105 is accessed via the Internet 110. Then, the IC issued by the card reader / writer 104
A processing request for the card 103 is transmitted to the SAM chip 108 via the personal computer 105, the Internet 110, and the ASP server device 106.

Step ST135: SAM chip 108
However, according to the processing request received in step ST134,
An application program is selected by the settlement processing procedure task 173, and the selected application program is executed. In the execution of the application program, the processing described with reference to FIGS. 10 and 11 is performed.

Step ST136: SAM chip 108
Outputs the execution result of the application program to the ASP server device 106.

As described above, the communication system 101
According to the above, as described with reference to FIG. 9, the SAM chip 108 includes the authentication units 117_1, 117_2, and 1
17_3, the download source of the application program is authenticated, and only the authorized storage area in the external memory 107 is allowed to download the application program. It is possible to prevent unauthorized exchange or tampering.

According to the communication system 101, the SA
When the M chip 108 operates a plurality of application programs, the firewall FW_1, FW_2, and FW_3 restrict data transmission and reception between the application programs by the firewalls FW_1, FW_2, and FW_3. Unauthorized interference and tampering with a program can be prevented. Further, the confidentiality of each application program can be improved.

According to the communication system 101, FIG.
As described with reference to 0, when the application program is executed, by verifying whether the application program has been tampered with, it is possible to prevent improper operations such as impersonation based on the tampered application program. Can be avoided.

According to the communication system 101, each application program is composed of a plurality of program modules, so that the program can be downloaded to the external memory 107 in units of program modules.

Further, according to the communication system 101, the key information used for the operation on the highly confidential IC card 103 is encrypted and stored in the external memory 107 in addition to the scrambling which is normally performed. Thus, the security level of the key information can be improved.

Also, according to the Internet 101, the application program executes the encryption / decryption at the time of code access by the bus scramble function, so that the application program is stored in the external memory 107 while the processing of the SAM chip 108 is stopped. It is possible to prevent the application program from being illegally analyzed.

FIG. 13 shows the SAM chip 108 shown in FIG.
FIG. 3 is a functional block diagram in which the functional blocks of FIG. As shown in FIG. 13, the SAM chip 108 is connected to the ASPS communication interface unit 16 via the internal bus 90.
0, external memory communication interface unit 161, bus scramble unit 162, encryption / decryption unit 165, storage unit 166
And the CPU 167 are connected. The signature processing unit 163 and the authentication processing unit 164 shown in FIG.
U167 implements some of the functions.

In the SAM chip 108 shown in FIG. 13, for example, as shown in FIG. 14, a card I / F unit 91 connected to the internal bus 90 is connected to an RF signal outside the SAM chip 108.
The antenna 9 of the RF transceiver 92 is connected to the transceiver 92.
Data may be transmitted / received to / from the IC card 103 in a non-contact manner via the 2a.

[0062]

As described above, according to the present invention,
When a plurality of application programs are operated on the same semiconductor circuit, a data processing method, a semiconductor circuit, and a program that can prevent each application program from being affected by another application program can be provided.

[Brief description of the drawings]

FIG. 1 is an overall configuration diagram of a communication system according to an embodiment of the present invention.

FIG. 2 is a diagram for explaining a software configuration of the SAM chip shown in FIG. 1;

FIG. 3 is a functional block diagram of an IC of the IC card shown in FIG. 1;

FIG. 4 is a diagram for explaining information stored in a storage unit illustrated in FIG. 3;

FIG. 5 is a diagram for explaining an external memory of the SAM unit shown in FIG. 1;

FIG. 6 is a diagram for explaining a format of module management data shown in FIG. 5;

FIG. 7 is a functional block diagram of the SAM chip shown in FIG. 1;

FIG. 8 is a diagram for explaining a task executed by the CPU shown in FIG. 7;

FIG. 9 is a flowchart illustrating an operation of downloading an application program from the personal computer shown in FIG. 1 to an external memory.

FIG. 10 is a flowchart for explaining an operation in which the SAM chip shown in FIG. 1 executes an application program.

FIG. 11 is a diagram for explaining an operation during execution of an application program;

FIG. 12 is a diagram for explaining an overall operation of the communication system shown in FIG. 1;

FIG. 13 is a more detailed functional block diagram of the functional blocks of the SAM chip shown in FIG. 7;

FIG. 14 is a diagram for explaining another usage pattern of the SAM chip;

[Explanation of symbols]

101 communication system, 102 server device, 103
IC card, 104 ... Card reader / writer, 105 ...
Personal computer, 106 ... ASP server device,
107: external memory, 108: SAM chip, 109 ...
SAM unit, 110 ... Internet, 115_
1,115_2,115_3 ... Credit card operator, 116_1,116_2,116_3 ... Personal computer 117_1,117_2,117_3 ...
Authentication unit

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI theme coat ゛ (reference) G06K 19/07 G06K 19/00 NF term (reference) 5B017 AA07 BA06 BB03 CA15 5B035 AA14 BB09 BC01 CA23 5B076 BB06 FA00 FB00 5B089 GB02 GB03 JA34 JB07 KA17 KB09 KB13 KC47 KC58 KE02 5B098 AA10 GC16

Claims (22)

[Claims] 1. A data processing method performed by a semiconductor circuit executing an application program, wherein each of a plurality of program modules constituting the application program is controlled by a firewall assigned to each program module in advance among a plurality of firewalls. Protecting and registering the program module in association with firewall identification information for identifying a firewall assigned to the program module; and a data processing method for executing the program module on condition that the registration has been performed. . 2. A plurality of program modules registered in association with the same firewall identification information,
2. The data processing method according to claim 1, wherein data transfer or data reference is permitted, and data transfer or data reference is prohibited between a plurality of program modules registered in association with different firewall identification information. 3. The program module further registers the program module in association with download key information used when downloading the program module from outside the semiconductor circuit to the semiconductor circuit, and receives a download request for the program module. And determining whether the download is possible by using the download key information registered corresponding to the program module, and downloading the program module when the download is determined to be possible.
The data processing method described in 1. 4. The data processing method according to claim 3, wherein when the download key information is not registered corresponding to the program module, the download of the program module is not performed. 5. The data processing method according to claim 3, wherein mutual authentication is performed with the transmission source of the download request, and the validity of the transmission source is confirmed, and then whether the download is permitted is determined. 6. The program module further registers the program module in association with key information used before execution of the program module, and uses the key information corresponding to the program module requested to execute the program module to register the program module. 2. The data processing method according to claim 1, wherein it is determined whether or not the program module has been altered or falsified, and when it is determined that the program module has not been altered or falsified, the program module is executed. 7. When the program module is stored in a semiconductor storage circuit provided outside the semiconductor circuit, the semiconductor circuit writes the program module into the semiconductor storage circuit after scrambling the program module. 2. The data processing method according to claim 1, wherein the program module descrambles a program module read from the semiconductor memory circuit. 8. The first key information used for operating the integrated circuit when the application program specifies a procedural process using an integrated circuit that transmits and receives data to and from the semiconductor circuit. The second
8. The data processing method according to claim 7, wherein the second key information is stored in the semiconductor circuit after being encrypted with the key information. 9. The data processing method according to claim 8, wherein said integrated circuit is mounted on a card. 10. The semiconductor module executes a plurality of application programs respectively corresponding to a plurality of procedure providers who provide procedures to be performed using the integrated circuit, and a plurality of the program modules constituting the same application program. The data processing method according to claim 8, wherein the data is protected by the same firewall. 11. A semiconductor circuit for executing an application program, wherein each of a plurality of program modules constituting the application program is protected by a firewall assigned to each program module in advance among a plurality of firewalls. A semiconductor circuit which registers a module in association with firewall identification information for identifying a firewall assigned to the program module, and executes the program module on condition that the registration has been performed. 12. A plurality of program modules registered in association with the same firewall identification information allow data transfer or data reference, and a plurality of program modules registered in association with different firewall identification information. 12. The semiconductor circuit according to claim 11, wherein data transfer or data reference is prohibited. 13. The program module further registers the program module in association with download key information used when downloading the program module from outside the semiconductor circuit to the semiconductor circuit, and receives a download request for the program module. And determining whether the download is possible using the download key information registered corresponding to the program module, and downloading the program module when the download is determined to be possible.
2. The semiconductor circuit according to 1. 14. The semiconductor circuit according to claim 13, wherein when the download key information is not registered corresponding to the program module, the download of the program module is not performed. 15. After performing mutual authentication with the transmission source of the download request and confirming the validity of the transmission source,
14. The semiconductor circuit according to claim 13, wherein whether the download is permitted or not is determined. 16. The program module further registers the program module in association with key information used before the execution of the program module, and uses the key information corresponding to the program module requested to execute the program module to register the program module. 12. The semiconductor circuit according to claim 11, wherein it is determined whether or not the program module has been altered or falsified, and when it is determined that the program module has not been altered or falsified, the program module is executed. 17. When storing the program module in a semiconductor memory circuit provided outside the semiconductor circuit, the semiconductor circuit writes the program module in the semiconductor memory circuit after scrambling the program module. Descrambling a program module read from the semiconductor memory circuit.
3. The semiconductor circuit according to claim 1. 18. The first key information used for operating the integrated circuit when the application program specifies a procedural process using an integrated circuit that transmits and receives data to and from the semiconductor circuit. The second
8. The semiconductor circuit according to claim 7, wherein the second key information is stored in the semiconductor circuit after being encrypted with the key information. 19. The semiconductor circuit according to claim 8, wherein said integrated circuit is mounted on a card. 20. The semiconductor circuit, wherein the semiconductor circuit executes a plurality of application programs respectively corresponding to a plurality of procedure providers for providing a procedure to be performed using the integrated circuit, and a plurality of the program modules constituting the same application program. 18. The semiconductor circuit according to claim 18, wherein the same is protected by the same firewall. 21. A semiconductor circuit for executing an application program, wherein each of a plurality of program modules constituting the application program is protected by a firewall assigned to each program module in advance among a plurality of firewalls; A procedure for registering a module in association with firewall identification information for identifying a firewall assigned to the program module, and a procedure for executing the program module on condition that the registration has been performed. Program. 22. A plurality of program modules registered in association with the same firewall identification information permit data transfer or data reference, and a plurality of program modules registered in association with different firewall identification information. A program for causing the semiconductor circuit to further execute a procedure for inhibiting data transfer or data reference.