JP2002304610A - Embedded type delegation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To transfer operation authority for an IC card to another trader and to perform operation for the card with the authority of the trader. SOLUTION: Information for authenticating the transfer-destination trader and information on operation authority to be allowed are recorded on the IC card and when the operation is done, execution control over the operation is performed by performing signature authentication of the transfer-destination or the authentication of the transfer-destination authentication.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system for transferring operation authority for an IC card to another business operator.

[0002]

2. Description of the Related Art In recent years, in the fields of public, finance, communication, transportation, medical care, electronic commerce on the Internet, and the like, the use of IC cards having security and large storage capacity has become widespread. A multi-application IC card system in which a plurality of applications are mounted on an IC card so that a plurality of services can be used has also appeared. In this type of IC card system, card users, service providers, and card issuers freely cooperate with each other, with a registration / authorization body for examining and guaranteeing the card issuer, service provider, and application at the core. For example, after an IC card is issued, the application can be downloaded to the card via a network, or the execution period and the number of executions of the application can be controlled.
Various operation controls, such as giving a warning to the user when the memory resources become low, can be easily and flexibly controlled, and various business models can be constructed. Thus, the demand for an IC card that can safely and reliably use many services with one card is rapidly increasing.

[0003] However, the operation authority for mounting an application on such an IC card, for example, is limited to an authorized business operator (usually an IC card issuer or an IC card system operator) that is a service provider. In the conventional authority transfer method in which the operation authority is given to such a service provider as another service provider, the operator who has the authority in the past signs and certifies the permission of the operation embedded in the application. The execution control is performed using a certificate. The competent business that issued the authorization certificate for this operation
Determined at the time of issuance of the IC card, it is registered in advance in the IC card, and this business with authority is added after the card is issued,
It could not be changed or deleted.

[0004]

SUMMARY OF THE INVENTION It is an object of the present invention to provide an embedded type which delegates the operation authority for an IC card to another business operator so that the operation for the card can be performed with the authority of another business operator. It is to provide an authority transfer method.

[0005]

SUMMARY OF THE INVENTION The present invention is a method for transferring the operation authority for an IC card to another business, and includes information for authentication of the transfer-destination business and information on the operation authority permitted to the IC card. The embedding type authority transfer method is characterized in that, during operation, the execution of the operation is controlled by verifying the signature of the transferee business or authenticating the transferee business.

[0006] In a preferred embodiment of the present invention, authentication information of another transferee business is recorded on the IC card.

In the authority transfer method according to the present invention, in order to lend the operation authority for the IC card to another business, the authentication information of the transfer business is embedded in the IC card. The user can operate the card with his / her own authority.
In addition, authority can be transferred to a third party using an operation permit.

[0008]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the accompanying drawings. FIG. 1 shows an example of a procedure for setting embedded information in an embedded authority delegation system according to the present invention.
Figure 2 shows the delegated company to which the operation authority has been delegated.
FIG. 6 is a diagram showing a procedure for executing an operation on an IC card.

As shown in FIG. 1, an IC card 1 is provided with an embedded information management unit 2, an authority judgment unit 3, and an operation execution unit 4. The IC card 1 has a plurality of applications for providing a plurality of services to the card user. For example, the IC card 1 can download these applications to the card 1, control the execution period and the number of executions of the applications, and use memory resources. The various operating authorities, such as issuing a warning to the user when the number of users has decreased, belong to the authority-holding business operator 5 (hereinafter, also referred to as "actor A"). Actor A with such authority
Later, the authority of other operators 6 (hereinafter, "Acta B"
In the authority transfer method according to the present invention, the public key of the actor B of the authority transfer destination is registered in the actor A having authority in advance.

When the authorized actor A transfers the permitted operating authority to the actor B, first, the actor A
Transmits an embedded authority transfer command as operation authority information permitted to the IC card 1. This command includes the public key of actor B to which the authority is to be transferred and the signature of actor A having the authority. The operation execution unit 4 of the IC card 1 analyzes the authority transfer command from the authorized actor A, and requests the authority determination unit 3 to verify the signature of the authorized actor A in the command. The public key of the actor A having the authority is registered in the embedded information management unit 2 in advance.

The authority determining unit 3 includes an operation executing unit 4
Is verified using the public key of the authorized actor A registered in the embedded information management unit 2. If the signature is correct, the authorized actor A transmits the signature to the IC card 1. It is determined that the user has the execution authority of the embedded authority delegation command transmitted to.

In this way, when the authority judging unit 3 in the IC card 1 judges that the command execution right is present, the operation executing unit 4 sends the embedded information managing unit 2 the public key of the actor B to which the authority is transferred. Is registered as authentication information. As a result, the public key of the actor B to which the authority is transferred is set in the IC card 1.

When the actor B to which the authority has been delegated performs an operation on the IC card 1, the actor B to which the authority has been delegated transmits a command of the IC card 1 to the actor B, as shown in FIG. The signature is attached with a key and transmitted to the operation execution unit 4 of the IC card 1. The operation execution unit 4 analyzes the command from the actor B to which the authority is transferred, and requests the authority judging unit 3 to verify the signature of the actor B to which the authority is transferred in the command. In the authority judging unit 3, the authority transfer destination actor B (set by the embedding type authority transfer command) transmitted from the actor A having the authority to the IC card 1 and registered in the embedded information management unit 2 of the card.
The signature from the operation execution unit 4 is verified by using the public key of (1), and if the signature is correct, it is determined that the command execution right is granted.

In the present invention, the public key of the delegated actor C is stored in the current authority holder so that the delegated actor B can further delegate the authority to the third delegated actor C later. Is registered in advance in the embedded information management unit 2 by additionally registering the public key of the actor C to which the authority is delegated to the embedded information management unit 2 of the IC card 1 in the manner described above. It is also possible to delegate authority to actor C that has been granted.

[0015]

As described above, according to the present invention,
By additionally registering the public key of the actor to which the authority is delegated to the embedded information management unit of the IC card 1, it is possible to cause the actor to be delegated to the authority registered in the embedded information management unit to execute an operation with its own authority. Environment can be provided. Further, in the present invention, the actor to which the authority has been delegated can further delegate the authority to a third party.

[Brief description of the drawings]

FIG. 1 is a diagram showing a procedure for setting embedded information in an embedded authority transfer method according to the present invention.

FIG. 2 is a diagram illustrating a procedure in a case where a transferee company to which operation authority has been transferred performs an operation on an IC card.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 IC card 2 Embedded information management part 3 Rights judgment part 4 Operation execution part 5 Authority possessed company 6 Authority transferee company

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Katsuhiko Suzuki, Inventor 2-3-1 Otemachi, Chiyoda-ku, Tokyo Inside Nippon Telegraph and Telephone Corporation (72) Ryutaro Taji 2-3, Otemachi, Chiyoda-ku, Tokyo No. 1 F-term in Nippon Telegraph and Telephone Corporation (reference) 2C005 MA40 SA30 5B017 AA01 AA06 BA09 BB09 CA14 5B035 AA14 BB09 5B058 CA25 KA11 KA40

Claims (4)

[Claims] 1. A method for transferring the operation authority for an IC card to another business operator, wherein information for authentication of the transfer destination business operator and operation permission information to be permitted are recorded on the IC card, and the transfer is performed at the time of operation. An embedding-type authority transfer method characterized in that the execution of the operation is controlled by verifying the signature of the transferee or authenticating the transferee. 2. The embedded authority delegation method according to claim 1, wherein the authentication information is used as a public key of a delegation destination company. 3. The embedded authority delegation method according to claim 1, wherein the permitted operation authority information includes a public key of the authority transfer destination company and a signature of the authority holding company. 4. The embedded authority transfer method according to claim 1, wherein authentication information of another transferee business is recorded on the IC card.