JP2022067721A - Ic card, logging information processing method of ic card, and program - Google Patents

Abstract

[Problem] To provide an IC card, an IC card logging information processing method, and a program that can reliably analyze the cause when the life cycle status of the IC card becomes an abolished state. [Solution] An IC card having an operational state, a locked state, and an abolished state as life cycle status, the IC card includes a detection unit that detects an abnormality due to an external attack, a storage unit that stores information related to the abnormality as logging information, a determination unit that determines the current life cycle status of the IC card, a selection unit that selects a first process that does not update the logging information stored in the storage unit if the determination result of the determination unit is the abolished state, and selects a second process that updates the logging information stored in the storage unit based on information indicating the abnormality if the determination result is not the abolished state, and a processing unit that executes either the first process or the second process preselected by the selection unit when the detection unit detects an abnormality. [Selected Figure] Figure 3

Description

The present invention relates to an IC card, an IC card logging information processing method, and a program.

Conventionally, there have been known a state management method for an IC card and an IC card that visually indicates a life cycle status indicating a specific state of the IC card in the life cycle of an IC (Integrated Circuit) card.

The Global Platform, an international organization that develops open standards for IC cards, defines five life cycle statuses and transition conditions as industry standard card specifications. The five life cycle statuses are the state initialized at the IC card manufacturing factory (OP READY), the state initialized by the IC card issuer (INITIALIZED), and the operational state (SECURED) that can be used safely. ), A locked state (CARD LOCKED) that is temporarily unusable, and an abolished state (TERMINATED) that is permanently unusable. Global Platform proposes life cycle management by writing these five life cycle statuses on an IC card.

For example, in Patent Document 1 below, when a transition of the life cycle status of an IC card occurs, the life cycle status of the IC card is printed on the printing unit of the IC card and displayed on the status display unit of the reader / writer for the IC card. The technology to be displayed is disclosed.
In the technique described in Patent Document 1 below, when an event that should change the life cycle status of the IC card occurs, the life cycle status and the date and time of the IC card are recorded in the state recording unit. However, Patent Document 1 does not describe whether or not the event itself for transitioning the life cycle status of the IC card is recorded in the state recording unit.
Therefore, if the event that should change the life cycle status of the IC card is not properly recorded in the state recording unit, it is not possible to properly analyze the event that should change the life cycle status of the IC card.

On the other hand, there is known a security management system that detects an illegal operation or a security attack on an IC card and makes a user or an administrator grasp the history.
For example, in Patent Document 2 below, EEPROM (Electrically Erasable Programmable Read Only Memory) of an IC card records (retains) a history of operations performed on the IC card (for example, a PIN authentication request command) as a log. The technology to be used is disclosed. In this technique, the log recorded in EEPROM is used for analysis of whether or not the IC card is used illegally.
In the technique described in Patent Document 2 below, when an attacker takes out another person's IC card, guesses a PIN code, and inputs it, the CPU (Central Processing Unit) of the IC card executes a PIN verification process. Specifically, in the technique described in Patent Document 2, in the PIN verification process, the CPU of the IC card determines whether the authentication information stored in the IC card and the input PIN code match, and if they do not match. Generates a log indicating that an authentication request has been made as a verification failure, and stores (writes) it in EEPROM.

Japanese Unexamined Patent Publication No. 2004-110087 Japanese Unexamined Patent Publication No. 2012-043208

However, in the technique described in Patent Document 2, when an unauthorized operation or security attack on an IC card is detected, a log already recorded in EEPROM is newly generated regardless of the life cycle status of the IC card. Will be overwritten with. For example, if an unauthorized operation or security attack is detected while the log when the life cycle status of the IC card transitions to the obsolete state is recorded in EEPROM, a new log is generated when the IC card transitions to the obsolete state. It will be overwritten by the log. Therefore, it becomes difficult to analyze the cause of the abolition of the life cycle status of the IC card due to an attack from the outside.

In view of the above problems, an object of the present invention is to provide an IC card, an IC card logging information processing method, and a program capable of reliably analyzing the cause of the abolition of the life cycle status of the IC card. To do.

In order to solve the above-mentioned problems, the IC card according to one aspect of the present invention is an IC card having an operating state, a locked state, and an abolished state as a life cycle status, and detects an abnormality due to an attack from the outside. When the detection unit, the storage unit that stores information about the abnormality as logging information, the determination unit that determines the current life cycle status of the IC card, and the determination result by the determination unit are in the abolished state. When the first process that does not update the logging information stored in the storage unit is selected and the result of the determination is not the abolished state, the logging information stored in the storage unit is stored based on the information indicating the abnormality. Either the selection unit that selects the second process to be updated and the first process or the second process that is preselected by the selection unit when the abnormality is detected by the detection unit. It includes a processing unit that executes processing.

The IC card logging information processing method according to one aspect of the present invention is an IC card logging information processing method having an operating state, a locked state, and an abolished state as life cycle status, and the detection unit attacks from the outside. The process of detecting an abnormality due to the above, the process of storing information about the abnormality as logging information, the process of determining the current life cycle status of the IC card by the determination unit, and the process of determining the current life cycle status of the IC card. If the result of the determination by the determination unit is the abolished state, the first process that does not update the logging information stored in the storage unit is selected, and if the result of the determination is not the abolished state, the abnormality is indicated. The process of selecting a second process for updating the logging information stored in the storage unit based on the information, and the processing unit are preselected by the selection unit when the abnormality is detected by the detection unit. The process of executing either the first process or the second process is included.

The program according to one aspect of the present invention is a program that causes a computer to function as an IC card having an operating state, a locked state, and an abolished state as life cycle status, and detects an abnormality caused by an attack from the outside of the computer. The means, a storage means for storing information related to the abnormality as logging information, a determination means for determining the current life cycle status of the IC card, and the above-mentioned when the result of the determination by the determination means is the abolished state. The first process that does not update the logging information stored by the storage means is selected, and if the result of the determination is not the abolished state, the logging information stored by the storage means is updated based on the information indicating the abnormality. A selection means for selecting a second process to be performed, and a process of either the first process or the second process preselected by the selection means when the abnormality is detected by the detection means. To function as a processing means to execute.

According to the present invention, it is possible to reliably analyze the cause of the life cycle status of the IC card being abolished.

It is a figure which shows an example of the hardware composition of the IC card which concerns on this embodiment. It is a figure which shows an example of the life cycle status of the IC card which concerns on this embodiment. It is a block diagram which shows an example of the functional structure of the IC card which concerns on this embodiment. It is a flowchart which shows an example of the flow of the process executed in the IC card which concerns on this embodiment. It is a flowchart which shows an example of the flow of the selection process of the interrupt processing method which concerns on this embodiment. It is a flowchart which shows an example of the flow of interrupt processing which concerns on this embodiment. It is a flowchart which shows an example of the processing flow in the execution of the VERIFY command of the IC card which concerns on this embodiment. It is a flowchart which shows an example of the flow of the process executed in the interrupt process during execution of a VERIFY command which concerns on this embodiment. It is a flowchart which shows an example of the flow of the process executed in the interrupt process during execution of a VERIFY command which concerns on this embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

<1. IC card hardware configuration>
The hardware configuration of the IC card according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of a hardware configuration of an IC card according to the present embodiment. The IC card 1 shown in FIG. 1 is, for example, a cash card, a credit card, a commuter pass, a ticket, a student ID card, a point card, a driver's license, or the like.

As shown in FIG. 1, the IC card 1 includes an I / O 10, a CPU 11 (Central Processing Unit), a ROM 12 (Read Only Memory), a RAM 13 (Random Access Memory), and an EEPROM 14 (Electrical Memory Element Memory).

(1) I / O10
The I / O 10 communicates with an external device (not shown) such as a reader / writer. For example, the I / O 10 receives a command from an external device. The communication with the external device by the I / O 10 may be a contact type or a non-contact type. That is, the I / O 10 may have only a configuration corresponding to the contact type or may have only a configuration corresponding to the non-contact type as the physical layer configuration. Further, the I / O 10 may have both a contact-type configuration and a non-contact-type configuration as the physical layer configuration.

(2) CPU11
The CPU 11 executes a program stored in the ROM 12 or the EEPROM 14 and performs various processes on the IC card 1. For example, the CPU 11 executes command processing according to a command received from an external device via the I / O 10.

(3) Register 15
As shown in FIG. 1, the CPU 11 includes a register 15. The register 15 is a storage device built in the CPU. The register 15 temporarily stores data related to the processing of the CPU 11, for example. As an example, information (hereinafter, also referred to as “processing information”) that specifies interrupt processing executed by the CPU 11 is written in the register 15. Details of the processing information will be described later.

(4) ROM 12
The ROM 12 is, for example, a non-writable non-volatile memory, and stores programs and data for executing various processes on the IC card 1. The ROM 12 is incorporated in the IC card 1 in a state where programs, data, and the like are stored in the manufacturing stage.

(5) RAM 13
The RAM 13 is, for example, a non-writable volatile memory, and temporarily stores data and the like used when performing various processes on the IC card 1.

(6) EEPROM 14
The EEPROM 14 is, for example, an electrically rewritable non-volatile memory. The EEPROM 14 stores, for example, a control program, control data, an application, personal information, security information such as an encryption key, data used for the application, and the like.

(Life cycle status)
Here, with reference to FIG. 2, the life cycle status of the IC card according to the present embodiment will be described. FIG. 2 is a diagram showing an example of the life cycle status of the IC card according to the present embodiment.

The Global Platform, an international organization that develops open standards for IC cards, defines five life cycle statuses and transition conditions as industry standard card specifications. The five life cycle statuses are the state initialized at the IC card manufacturing factory (OP READY), the state initialized by the IC card issuer (INITIALIZED), and the operational state (SECURED) that can be used safely. ), A locked state (CARD LOCKED) that is temporarily unusable, and an abolished state (TERMINATED) that is permanently unusable. Global Platform proposes life cycle management by writing these five life cycle statuses on an IC card.

In the example shown in FIG. 2, the IC card 1 has, for example, an operating state, a locked state, and an abolished state as a life cycle status after passing through an initialized state. The operating state corresponds to the normal state of the IC card 1 (the state in which the user of the IC card 1 can use the IC card 1). The locked state corresponds to a state in which the user of the IC card 1 cannot use the IC card 1 temporarily. The abolished state corresponds to a state in which the user of the IC card 1 cannot use the IC card 1 permanently.

As shown by an arrow in FIG. 2, the operating state is a state that can transition to a locked state or an abolished state. The locked state is a state that can transition to an operating state or an obsolete state. The obsolete state is a state in which neither the operating state nor the locked state can be transitioned.
The transition from the operating state to the abolished state is performed, for example, when a serious abnormality occurs in the IC card 1 and the abnormality is detected. Further, the transition from the operating state to the locked state is performed, for example, when it is detected that an unauthorized access to the IC card 1 has been made from the outside.
The transition from the locked state to the operating state is performed, for example, when the authentication process required to release the locked state is normally completed. Further, the transition from the locked state to the abolished state is performed, for example, when a serious abnormality occurs in the IC card 1 and the abnormality is detected.

In another example, the IC card 1 may have five life cycle statuses: a minimal function activated state, an initialized state, an operational state, a locked state, and an obsolete state.

<2. IC card function configuration>
The functional configuration of the IC card 1 according to the present embodiment will be described with reference to FIG. FIG. 3 is a block diagram showing an example of the functional configuration of the IC card 1 according to the present embodiment. The IC card 1 includes a communication unit 100, a control unit 110, and a storage unit 120.

(1) Communication unit 100
The communication unit 100 has a function of transmitting and receiving various information. The function of the communication unit 100 is realized by, for example, the I / O 10 that the IC card 1 has as hardware. Specifically, the communication unit 100 receives a command from an external device. The communication unit 100 outputs the received command to the control unit 110.

(2) Control unit 110
The control unit 110 has a function of controlling the overall operation of the IC card 1. The function of the control unit 110 is realized, for example, by causing the CPU 11 provided as hardware in the IC card to execute a program.
As shown in FIG. 3, the control unit 110 includes a determination unit 111, a selection unit 112, a writing unit 113, a detection unit 114, and a processing unit 115.

(2-1) Judgment unit 111
The determination unit 111 determines the life cycle status of the IC card 1. Specifically, the determination unit 111 determines whether the life cycle status of the IC card 1 is of an operating state, a locked state, or an abolished state. The determination unit 111 outputs the type of the determination result to the selection unit 112.

In the present embodiment, the determination unit 111 determines the life cycle status of the IC card 1 between the time when the power of the IC card 1 is turned on and the time when the command reception is started. The timing at which the determination unit 111 determines the life cycle status of the IC card 1 can be considered other than the period from when the power of the IC card 1 is turned on to when the reception of the command is started.

For example, it is conceivable that the determination unit 111 determines the life cycle status of the IC card 1 in the interrupt process executed by the processing unit 115 (described later). However, for example, when the processing unit 115 executes the interrupt processing a plurality of times, the determination unit 111 determines the life cycle status of the IC card 1 each time the interrupt processing is executed. That is, the number of executions of interrupt processing increases, the number of executions of determination processing also increases, and the processing time increases. In addition, an increase in the execution time of interrupt processing may pose a security risk because there is a high possibility of being attacked from the outside during execution of interrupt processing.

On the other hand, in the case of the present embodiment, the determination process is performed by the determination unit 111 before the interrupt process is executed. Therefore, the processing unit 115 can use the result of the determination processing executed in advance by the determination unit 111 in the interrupt processing. The same applies when the processing unit 115 executes interrupt processing a plurality of times.

From the above, the determination unit 111 of the present embodiment executes the determination process by determining the life cycle status of the IC card 1 between the time when the power of the IC card 1 is turned on and the time when the command reception is started. The number of times can be reduced. As a result, the determination unit 111 can reduce the processing time and increase the processing speed. It is also possible to enhance security in interrupt processing.

(2-2) Selection unit 112
The selection unit 112 selects an interrupt processing method to be executed by the processing unit 115 (described later) when an abnormality due to an attack from the outside is detected. The selection unit 112 outputs the selected interrupt processing method to the writing unit 113.

The interrupt processing method according to the present embodiment is, for example, an interrupt process A (first process) that does not update the logging information stored in the storage unit 120, and an interrupt process B that updates the logging information stored in the storage unit 120. (Second process). The selection unit 112 selects either interrupt processing A or interrupt processing B, for example, based on the type of life cycle status determined by the determination unit 111.

Specifically, when the result of the determination by the determination unit 111 is in the abolished state, the selection unit 112 selects the interrupt process A. On the other hand, when the result of the determination by the determination unit 111 is not in the abolished state (that is, in the operating state or the locked state), the selection unit 112 selects the interrupt process B. In the interrupt process B, the logging information stored in the storage unit 120 is updated based on the information indicating the abnormality due to the attack from the outside (hereinafter, also referred to as “abnormal information”).

Note that the selection unit 112 is either interrupt processing A or interrupt processing B based on the type of the result of the determination by the determination unit 111 between the time when the power of the IC card 1 is turned on and the time when the command reception is started. Select one. The timing at which the selection unit 112 selects the process (interrupt process method) to be executed in the interrupt process can be considered other than the period from when the power of the IC card 1 is turned on to when the command reception is started.

For example, in the interrupt processing executed by the processing unit 115 (described later), the selection unit 112 may select the processing executed by the interrupt processing. However, for example, when the processing unit 115 executes the interrupt processing a plurality of times, the selection unit 112 selects the processing executed by the interrupt processing each time the interrupt processing is executed. That is, the number of executions of interrupt processing increases, the number of executions of selection processing also increases, and the processing time increases. In addition, an increase in the execution time of interrupt processing may pose a security risk because there is a high possibility of being attacked from the outside during execution of interrupt processing.

On the other hand, in the case of the present embodiment, the selection process is performed by the selection unit 112 before the interrupt process is executed. Therefore, the processing unit 115 can use the result of the selection processing executed in advance by the selection unit 112 in the interrupt processing. The same applies when the processing unit 115 executes interrupt processing a plurality of times.

From the above, the selection unit 112 of the present embodiment selects a process (interrupt processing method) executed by interrupt processing between the time when the power of the IC card 1 is turned on and the time when the command reception is started. Therefore, the number of executions of the determination process can be reduced. As a result, the selection unit 112 can reduce the processing time and increase the processing speed. It is also possible to enhance security in interrupt processing.

(2-3) Writing unit 113
Based on the result of selection by the selection unit 112, the writing unit 113 writes processing information indicating which processing of the interrupt processing A or the interrupt processing B is executed by the processing unit 115 to the storage unit 120.

In this embodiment, the writing unit 113 writes the processing information to the register 15. For example, the register 15 has a flag bit for setting a process to be executed by the processing unit 115. The writing unit 113 sets whether the processing unit 115 executes interrupt processing A or interrupt processing B according to the information written in the flag bit.
As an example, when the selection unit 112 selects interrupt processing A, the writing unit 113 writes 1 for the flag bit. On the other hand, when the selection unit 112 selects interrupt processing B, the writing unit 113 writes 0 to the flag bit. The combination of the type of interrupt processing and the number written by the writing unit 113 to the flag bit is not limited to this example, and may be the reverse combination. Further, the information written by the writing unit 113 to the flag bit of the register 15 is not limited to this example.

(2-4) Detection unit 114
The detection unit 114 detects an abnormality caused by an attack from the outside. The external attack on the IC card 1 is, for example, a physical attack, a side channel attack, a failure utilization attack, or the like. The detection unit 114 outputs the detection result of the abnormality due to the attack from the outside to the processing unit 115.

(2-5) Processing unit 115
The processing unit 115 executes various processes. For example, the processing unit 115 executes preset processing according to a command transmitted from an external device (for example, an external device). The command transmitted from the outside is, for example, a read command. By executing the read command, the processing unit 115 reads data from, for example, the storage unit 120 and transmits it to an external device.

When an abnormality due to an attack from the outside is detected by the detection unit 114 while receiving a command or executing a command process, the processing unit 115 either performs interrupt processing A or interrupt processing B previously selected by the selection unit 112. One process is executed as interrupt process. As a result, the processing unit 115 does not have to execute the processing for selecting the content of the processing to be executed in the interrupt processing at the time of executing the interrupt processing, so that the processing time in the interrupt processing can be reduced and the processing speed can be increased. Can be done. In addition, security in interrupt processing can be enhanced by reducing the processing time in interrupt processing.

When an abnormality is detected by the detection unit 114, the processing unit 115 executes either interrupt processing A or interrupt processing B based on the processing information written in the register 15. For example, the processing unit 115 reads the information written in the flag bit of the register 15 and selects interrupt processing according to the information. As an example, when 1 is written to the flag bit of the register 15, the processing unit 115 executes the interrupt processing A. On the other hand, when 0 is written in the flag bit of the register 15, the processing unit 115 executes the interrupt processing B. The combination of the type of interrupt processing executed by the processing unit 115 and the number written in the flag bit of the register 15 is not limited to this example, and may be the reverse combination.

The interrupt process when an abnormality is detected is a process for protecting the assets (password, encryption key, etc.) inside the IC card 1 from damage such as falsification and exposure. The interrupt processing executed by the processing unit 115 may be software or hardware.

In the interrupt process A and the interrupt process B, the processing unit 115 executes, for example, error processing. The error processing is, for example, a processing for transmitting an error response indicating that the command processing cannot be normally executed, a processing for permanently disabling the IC card 1 itself, and the like.

In the interrupt process B, the process unit 115 executes, for example, a process of logging abnormality information to the storage unit 120. The abnormality information logged in the storage unit 120 is used for error analysis and the like.

After executing the interrupt processing, the processing unit 115 executes post-processing (for example, reset processing as shown in FIG. 6 of JP-A-7-271926).

Further, the processing unit 115 responds to the result of an abnormality processing in which the target processing is not performed, for example, when a command execution error occurs or an abnormality due to an external attack is detected by the detection unit 114. Then, for example, a process of transitioning the life cycle status of the IC card 1 from the operating state to the locked state or the obsolete state is executed. As an example of the abnormality handling, there is a case where a program corresponding to another command is executed instead of a program corresponding to the command received from the IC card reader / writer.
It should be noted that there are a plurality of life cycle status state transition patterns when an abnormality due to an attack from the outside is detected by the detection unit 114. In this embodiment, among a plurality of state transition patterns, a pattern for transitioning to the locked state and a pattern for transitioning to the abolished state will be described.

(3) Storage unit 120
The storage unit 120 has a function of storing various types of information. The function of the storage unit 120 is realized by, for example, a ROM 12, a RAM 13, an EEPROM 14, a register 15, or the like provided as hardware in the IC card 1. The storage unit 120 stores, for example, logging information, processing information, and the like.

<3. Processing flow>
The flow of processing in the IC card 1 according to the present embodiment will be described with reference to FIGS. 4 to 9.

(1) Flow of Processing in IC Card 1 First, the flow of processing in IC card 1 according to the present embodiment will be described with reference to FIGS. 4 to 6. FIG. 4 is a flowchart showing an example of the flow of processing executed in the IC card according to the present embodiment.

As shown in FIG. 4, first, the power supply (not shown) of the IC card 1 is turned on by the electric power supplied from the outside, and the operation of the IC card 1 is started (step S1).
Next, the control unit 110 of the IC card 1 executes the interrupt processing method selection process (step S2). Details of the interrupt processing method selection processing will be described later.

After the interrupt processing method selection process, the communication unit 100 of the IC card 1 receives a command from the outside (step S3).
When the detection unit 114 of the control unit 110 does not detect an abnormality due to an attack from the outside while the command is being received (including the state where the communication unit 100 is waiting for the reception of a command from the outside) (when the attack is not detected). ), Proceed to step S4.
On the other hand, if the detection unit 114 of the control unit 110 detects an abnormality due to an attack from the outside (in the case of attack detection) while receiving a command, the process proceeds to step S5.

In step S4, the processing unit 115 of the control unit 110 executes command processing. If the detection unit 114 detects an abnormality due to an attack from the outside during command processing (in the case of attack detection), the process proceeds to step S5.
On the other hand, if the detection unit 114 does not detect an abnormality due to an attack from the outside during command processing (when no attack is detected), the process proceeds to step S7.

In step S5, the processing unit 115 calls the interrupt processing function (transitions the processing to the interrupt processing function) and executes the interrupt processing. That is, in the example shown in FIG. 4, when the detection unit 114 detects an abnormality due to an attack from the outside while receiving a command or executing command processing, the processing unit 115 executes interrupt processing. The details of interrupt processing will be described later.

After the interrupt processing, the processing unit 115 executes post-processing (step S6). After executing the post-processing, the process proceeds to step S7.

In step S7, for example, the processing unit 115 determines whether or not the processing of step S6 is continued from step S3.
When continuing the processing of step S6 from step S3 (step S7 / YES), the process returns to step S2.
On the other hand, if the processing of step S6 is not continued from step S3 (step S7 / NO), the process proceeds to step S8.
In step S8, the power supply (not shown) of the IC card 1 is turned off by the power supply from the outside being stopped, and the operation of the IC card 1 is terminated.

Here, with reference to FIG. 5, the details of the interrupt processing method selection process (step S2) according to the present embodiment will be described. FIG. 5 is a flowchart showing an example of the flow of the interrupt processing method selection process according to the present embodiment.

As shown in FIG. 5, first, the determination unit 111 of the control unit 110 determines the life cycle status of the IC card 1 (step S21).
When the life cycle status of the IC card 1 is in the abolished state (step S21 / YES), the selection unit 112 of the control unit 110 selects interrupt processing A that does not update the logging information (step S22).
On the other hand, when the life cycle status of the IC card 1 is not in the abolished state, that is, in the operating state or the locked state (step S21 / NO), the selection unit 112 of the control unit 110 selects the interrupt process B for updating the logging information. (Step S23).

After the processing of step S22 or step S23, the writing unit 113 of the control unit 110 writes the processing information indicating the interrupt processing selected by the selection unit 112 to the register 15 (step S24). After writing, the control unit 110 ends the interrupt processing method selection process.

Here, with reference to FIG. 6, the details of the interrupt processing (step S5) according to the present embodiment will be described. FIG. 6 is a flowchart showing an example of the flow of interrupt processing according to the present embodiment.

As shown in FIG. 6, first, the processing unit 115 of the control unit 110 confirms the interrupt processing selected by the selection unit 112 based on the processing information written in the register 15 (step S51).
If the interrupt process selected by the selection unit 112 is the interrupt process A, the process proceeds to step S52.
On the other hand, if the interrupt process selected by the selection unit 112 is the interrupt process B, the process proceeds to step S53.

In step S52, the processing unit 115 executes error processing (error analysis). After error processing, the processing unit 115 ends interrupt processing A.
In step S53, the processing unit 115 executes error processing (error analysis). After error processing, the processing unit 115 updates the logging information (step S54). After updating the logging information, the processing unit 115 ends the interrupt processing B.
That is, in interrupt processing A, only error processing is performed, and logging information is not updated. Further, in interrupt processing B, error processing and logging information update are performed.

Although not shown in FIG. 6, when an abnormality occurs in which the processing unit 115 cannot normally execute the command processing due to an attack received by the IC card 1 from the outside, and the abnormality is detected by the detection unit 114. , The processing unit 115 shifts the life cycle status to the locked state or the obsolete state based on the abnormality information during the execution of the error processing.

If, in a conventional IC card, the IC card is attacked again from the outside after being attacked from the outside and the life cycle status of the IC card is abolished, the logging information stored in the storage unit is stored. Is updated. In this case, the logging information indicating the cause of the obsolete life cycle status is overwritten by new information (that is, information indicating an abnormality due to the second attack from the outside). As a result, it is difficult to analyze the cause of the abolition of the life cycle status of the conventional IC card (specifically, the cause of the abolition of the life cycle status of the IC card due to the first attack from the outside). There was a risk of becoming.

Therefore, in the IC card 1 of the present embodiment, as described above, the interrupt processing executed by the processing unit 115 when the detection unit 114 detects an abnormality due to an attack from the outside is selected in advance by the interrupt processing method selection processing. do. Specifically, when the determination unit 111 determines that the life cycle status of the IC card 1 is in the abolished state, the selection unit 112 selects the interrupt process A that does not update the logging information. The writing unit 113 writes the processing information indicating that the interrupt processing A is selected to the register 15. On the other hand, when the determination unit 111 determines that the life cycle status of the IC card 1 is in the operating state or the locked state, the selection unit 112 selects the interrupt process B for updating the logging information. The writing unit 113 writes the processing information indicating that the interrupt processing B has been selected to the register 15.
Then, when the detection unit 114 detects an abnormality due to an attack from the outside and the processing information indicates interrupt processing A, the processing unit 115 executes interrupt processing A that does not update the logging information. On the other hand, when the detection unit 114 detects an abnormality due to an attack from the outside and the processing information indicates interrupt processing B, the processing unit 115 executes interrupt processing B for updating the logging information.

That is, when the detection unit 114 detects a serious error (abnormality due to the first attack from the outside) that causes the life cycle status of the IC card 1 to transition to the abolished state, the IC card 1 is sent from the outside for the second time or later. Even if the attack is received, the processing unit 115 does not update the logging information, and the logging information indicating the cause of the life cycle status of the IC card 1 being abolished by the first attack from the outside is overwritten. It is left in the storage unit 120.

Therefore, in the IC card 1 according to the present embodiment, after the life cycle status of the IC card 1 is abolished, the logging information is not updated when the IC card 1 is attacked from the outside, so that the life of the IC card 1 is not updated. It is possible to suppress the risk that it will be difficult to analyze the cause of the cycle status becoming obsolete.
That is, in the IC card 1 of the present embodiment, it is possible to suppress the possibility that it becomes difficult to analyze the cause of the life cycle status of the IC card 1 being abolished.
Further, in the IC card 1 of the present embodiment, it is possible to suppress the possibility that the logging information indicating the cause of the life cycle status of the IC card 1 being abolished is falsified by an external attacker.

(2) Flow of Processing During Execution of VERIFY Command Next, the flow of processing during execution of the VERIFY (write verification) command of the IC card 1 will be described with reference to FIGS. 7 to 9. FIG. 7 is a flowchart showing an example of the processing flow during execution of the VERIFY command of the IC card according to the present embodiment.

As shown in FIG. 7, first, the processing unit 115 starts VERIFY command processing (step S101). The VERIFY command is a command for performing password authentication.
Next, the processing unit 115 executes the processing 1: func1 () (step S102).
If the detection unit 114 does not detect an abnormality due to an attack from the outside during the execution of the process 1, the process proceeds to step S103.
On the other hand, if the detection unit 114 detects an abnormality due to an attack from the outside during the execution of the process 1, the process proceeds to step S105.

In step S103, the processing unit 115 executes the processing 2: func2 ().
If the detection unit 114 does not detect an abnormality due to an attack from the outside during the execution of the process 2, the process proceeds to step S104.
On the other hand, if the detection unit 114 detects an abnormality due to an attack from the outside during the execution of the process 2, the process proceeds to step S106.

In step S104, the processing unit 115 executes the processing 3: func3 ().
If the detection unit 114 does not detect an abnormality due to an attack from the outside during the execution of the process 3, the VERIFY command shown in FIG. 7 ends normally and returns to the state of waiting for command reception.
On the other hand, if the detection unit 114 detects an abnormality due to an attack from the outside during the execution of the process 3, the process proceeds to step S107.

In step S105, the processing unit 115 stops the execution of the processing 1, confirms the processing information stored in the register 15, and calls the interrupt processing function of the interrupt processing indicated by the processing information (transitions the processing to the interrupt processing function). Let) and execute interrupt processing. The details of interrupt processing will be described later.

In step S106, the processing unit 115 stops the execution of the processing 2, confirms the processing information stored in the register 15, and calls the interrupt processing function of the interrupt processing indicated by the processing information (transitions the processing to the interrupt processing function). Let) and execute interrupt processing. The details of interrupt processing will be described later.

In step S107, the processing unit 115 stops the execution of the processing 3, confirms the processing information stored in the register 15, and calls the interrupt processing function of the interrupt processing indicated by the processing information (transitions the processing to the interrupt processing function). Let) and execute interrupt processing. The details of interrupt processing will be described later.

Here, the flow of interrupt processing during execution of the VERIFY command will be described with reference to FIGS. 8 and 9. 8 and 9 are flowcharts showing an example of the flow of processing executed in the interrupt processing during execution of the VERIFY command according to the present embodiment. FIG. 8 shows an example of the processing flow in the interrupt processing A. FIG. 9 shows an example of the processing flow in the interrupt processing B. 8 and 9 show an example of interrupt processing in step S102 of FIG. 7.

When the detection unit 114 detects an abnormality due to an attack from the outside during the execution of the process 1, the process unit 115 shifts the process to the interrupt process (step S105). When the processing information indicates interrupt processing A, the processing unit 115 executes interrupt processing A: funcA () in step S105. As shown in FIG. 8, the processing unit 115 executes error processing in interrupt processing A: funcA () (step S1050).
Next, the processing unit 115 executes post-processing (specifically, post-processing corresponding to the attack received by the IC card 1) in a step (not shown).
In the interrupt process A, the processing unit 115 does not update the logging information stored in the storage unit 120, so that the storage unit 120 continues to store the logging information.

When the processing information indicates interrupt processing B, the processing unit 115 executes interrupt processing B: funcB () in step S105. As shown in FIG. 9, the processing unit 115 executes error processing in the interrupt processing B: funcB () (step S1051).
Next, the processing unit 115 updates the logging information stored in the storage unit 120 based on the abnormality information indicating the abnormality due to the attack from the outside detected by the detection unit 114 (step S1052).
Next, the processing unit 115 executes post-processing in a step (not shown).

Although an example of the interrupt processing in step S102 has been described with reference to FIGS. 8 and 9, the same applies to the interrupt processing in steps S103 and S104. Further, in the example shown in FIG. 7, the interrupt processing shown in FIGS. 8 and 9 is executed even when an execution error occurs during the execution of the processing 1, the processing 2, and the processing 3.

As described above, in the IC card 1 according to the present embodiment, when an abnormality due to an attack from the outside is detected by the detection unit 114, the processing unit 115 executes interrupt processing previously selected by the selection unit 112. do. The interrupt process is either interrupt process A that does not update the logging information stored in the storage unit 120, or interrupt process B that updates the logging information stored in the storage unit 120. The selection unit 112 selects interrupt processing A when the result of the determination by the determination unit 111 for determining the life cycle status of the IC card 1 is in the obsolete state, and when the determination result is not in the obsolete state, it is due to an attack from the outside. The interrupt process B that updates the logging information stored in the storage unit 120 based on the information indicating the abnormality is selected.

With this configuration, when the life cycle status of the IC card 1 is in the abolished state, the processing unit 115 does not update the logging information stored in the storage unit 120, but the logging information stored in the storage unit 120. Is saved as is without being overwritten. The logging information that is saved as it is without being overwritten is information that indicates the cause of the obsolete life cycle status.

Therefore, in the IC card 1 of the present embodiment, the cause of the transition of the IC card 1 to the abolished state can be easily analyzed based on the logging information stored in the storage unit 120 without deteriorating the security strength. Can be done.
Further, in the IC card 1 of the present embodiment, since the logging information stored in the storage unit 120 is not updated after the IC card 1 has transitioned to the obsolete state, logging indicating the cause of the transition of the IC card 1 to the obsolete state is shown. Information can be suppressed from being tampered with by an external attacker.

That is, in the IC card 1 of the present embodiment, even if the attacker makes a new attack in order to conceal the cause of the transition of the IC card 1 to the abolished state after the IC card 1 has transitioned to the abolished state, the IC The logging information indicating the cause of the transition of the card 1 to the obsolete state is continuously stored without being tampered with.

Therefore, the IC card 1 according to the present embodiment can reliably analyze the cause of the abolition of the life cycle status of the IC card.

The embodiment of the present invention has been described above. It should be noted that a computer may realize a part or all of the functions of each part of the IC card 1 in the above-described embodiment. In that case, a program for realizing this function may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read by a computer system and executed. The term "computer system" as used herein includes hardware such as an OS and peripheral devices. Further, the "computer-readable recording medium" refers to a portable medium such as a flexible disk, a magneto-optical disk, a ROM, or a CD-ROM, and a storage device such as a hard disk built in a computer system. Further, a "computer-readable recording medium" is a communication line for transmitting a program via a network such as the Internet or a communication line such as a telephone line, and dynamically holds the program for a short period of time. It may also include a program that holds a program for a certain period of time, such as a volatile memory inside a computer system that is a server or a client in that case. Further, the above program may be for realizing a part of the above-mentioned functions, and may be further realized for realizing the above-mentioned functions in combination with a program already recorded in the computer system. It may be realized by using a programmable logic device such as FPGA (Field Programmable Gate Array).

Although the embodiments of the present invention have been described in detail with reference to the drawings, the specific configuration is not limited to the above, and various design changes and the like can be made without departing from the gist of the present invention. It is possible to do.

1 IC card 10 I / O
11 CPU
12 ROM
13 RAM
14 EEPROM
15 Register 100 Communication unit 110 Control unit 111 Judgment unit 112 Selection unit 113 Writing unit 114 Detection unit 115 Processing unit 120 Storage unit

Claims (6)

An IC card that has an operational status, a locked status, and an obsolete status as its life cycle status.
A detector that detects abnormalities caused by external attacks,
A storage unit that stores information related to the abnormality as logging information,
A determination unit for determining the current life cycle status of the IC card,
If the result of the determination by the determination unit is the abolished state, the first process that does not update the logging information stored in the storage unit is selected, and if the result of the determination is not the abolished state, the abnormality is detected. A selection unit that selects a second process for updating the logging information stored in the storage unit based on the indicated information, and a selection unit.
A processing unit that executes either the first process or the second process preselected by the selection unit when the abnormality is detected by the detection unit.
IC card. The determination unit determines the life cycle status of the IC card between the time when the power of the IC card is turned on and the time when the reception of a command is started.
The IC card according to claim 1. When the detection unit detects the abnormality while receiving a command or executing a command process, the processing unit executes either one of the first processing and the second processing as an interrupt processing. do,
The IC card according to claim 1 or 2. A register in which processing information indicating whether the processing unit executes the first processing or the second processing is written.
Based on the result of selection by the selection unit, a writing unit that writes the processing information to the register and a writing unit.
Further prepare
When the abnormality is detected by the detection unit, the processing unit executes either the first processing or the second processing based on the processing information written in the register. do,
The IC card according to any one of claims 1 to 3. It is a logging information processing method for IC cards that have an operating state, a locked state, and an obsolete state as life cycle status.
The process by which the detector detects anomalies caused by external attacks,
The process in which the storage unit stores information related to the abnormality as logging information,
The process in which the determination unit determines the current life cycle status of the IC card, and
When the selection unit selects the first process that does not update the logging information stored in the storage unit when the result of the determination by the determination unit is in the abolished state, and the result of the determination is not in the abolished state. Is a process of selecting a second process for updating the logging information stored in the storage unit based on the information indicating the abnormality, and
A process in which the processing unit executes either the first process or the second process previously selected by the selection unit when the abnormality is detected by the detection unit.
IC card logging information processing methods, including. A program that makes a computer function as an IC card that has an operating state, a locked state, and an obsolete state as a life cycle status.
Detection means to detect abnormalities due to external attacks,
A storage means for storing information related to the abnormality as logging information,
A determination means for determining the current life cycle status of the IC card, and
If the result of the determination by the determination means is the abolished state, the first process that does not update the logging information stored by the storage means is selected, and if the result of the determination is not the abolished state, the abnormality is detected. A selection means for selecting a second process for updating the logging information stored by the storage means based on the indicated information.
A processing means that executes either the first process or the second process preselected by the selection means when the abnormality is detected by the detection means.
A program that functions as.

Images