JP7600322B1 - IC Card - Google Patents

Abstract

A portable electronic device and an IC card are provided that are capable of selecting an encryption method to be used for encryption processing from a plurality of encryption methods.
According to an embodiment, a portable electronic device includes an interface, a memory, and a processor. The interface communicates with an external device. The memory has a storage area for storing data for executing cryptographic processing for each of a plurality of cryptographic methods. The processor selects one of the plurality of cryptographic methods, shares the selected cryptographic method with the external device, and executes processing using the cryptographic processing according to the cryptographic method shared with the external device.
[Selected Figure] Figure 1

Description

The present invention relates to an IC card .

Conventionally, portable electronic devices such as IC cards are issued so that they perform cryptographic processing using one cryptographic method that is pre-specified according to the system's operational policy. However, in recent years, to accommodate the emergence of computers with advanced computing power such as quantum computers, there are an increasing number of situations in which cryptographic processing using high-load cryptographic methods such as quantum-post cryptography is desired. While quantum-post cryptography provides a high level of security, it has the problem of being heavy in processing load and requiring computational processing in an environment where high-speed processing is possible.

For this reason, even if an IC card compatible with post-quantum cryptography is issued, it is considered that in reality, it is often difficult for all IC card processing devices (IC card reader/writers) in the operating system to be compatible with post-quantum cryptography. Furthermore, depending on the level of security required in actual operation, it may be sufficient to use an encryption method with a light processing load, rather than a high-load encryption method such as post-quantum cryptography. In other words, even if an IC card as a portable electronic device is compatible with a high-load encryption method such as post-quantum cryptography, it is desired that it be able to perform low-load encryption processing depending on the situation.

In addition, when an IC card as a portable electronic device becomes unstable in communication with an IC card processing device, it may take a long time to execute processing that involves a large load, such as encryption processing. For example, a contactless IC card is prone to unstable communication with an IC card processing device, and it is easy for encryption processing and other processing to take a long time. If the processing time is longer than expected, the user may forcibly remove the IC card from the IC card processing device and stop the operation of the IC card. There is a problem in that an IC card that is forcibly stopped during operation may cause data stored in the memory to be corrupted.

JP 2017-126125 A

In order to solve the above problems, the present invention provides an IC card that allows a user to select an encryption method to be used for encryption processing from a plurality of encryption methods.

According to an embodiment, an IC card includes an interface, a memory, and a processor. The interface communicates with a card reader/writer in a non-contact manner using a magnetic field. The memory has a storage area for storing data and magnetic field strength for executing encryption processing in each encryption method for each of a plurality of encryption methods. The processor acquires from the card reader/writer information indicating an encryption method permitted by the card reader/writer and information indicating a magnetic field strength generated at the interface, selects one encryption method from the plurality of encryption methods stored in the memory according to the acquired magnetic field strength, and when the selected encryption method is an encryption method permitted by the card reader/writer, shares the selected encryption method with the card reader/writer and executes communication processing using encryption processing according to the encryption method shared with the card reader/writer.

FIG. 1 is a block diagram showing an example of the configuration of an IC card as a portable electronic device according to an embodiment. FIG. 2 is a block diagram showing an example of the configuration of an IC card processing device that communicates with an IC card as a portable electronic device according to the embodiment. FIG. 3 is a diagram showing an example in which memory areas for a plurality of encryption methods are provided in the NVM of an IC card as a portable electronic device according to an embodiment. FIG. 4 is a diagram showing a state in which data for a plurality of encryption methods is loaded into a RAM in an IC card as a portable electronic device according to an embodiment. FIG. 5 is a diagram showing an example of setting information used in a first operation example of an IC card as a portable electronic device according to an embodiment. FIG. 6 is a flowchart for explaining the flow of a first operation example of an IC card as a portable electronic device according to the embodiment. FIG. 7 is a diagram showing an example of setting information used in a second operation example of the IC card as the portable electronic device according to the embodiment. FIG. 8 is a flowchart for explaining the flow of a registration process of setting information used in a second operation example of an IC card as a portable electronic device according to the embodiment. FIG. 9 is a flowchart for explaining the flow of a second operation example of an IC card as a portable electronic device according to the embodiment.

Hereinafter, embodiments will be described with reference to the drawings.
FIG. 1 is a block diagram illustrating an example of the configuration of an IC card 1 according to an embodiment.
An IC card 1 as a portable electronic device according to the embodiment constitutes an IC card processing system together with an IC card processing device 2 as an external device. The IC card 1 is a portable electronic device that is activated (made operable) by power supplied from the IC card processing device 2. The IC card 1 is also called a smart card.

The portable electronic device according to the embodiment is not limited to a card-like shape, but may be in the form of a booklet (for example, a notebook such as a passport) with the same configuration and processing functions as the IC card 1 described later. The portable electronic device according to the embodiment may be a portable electronic device (for example, a smartphone, mobile phone, tablet PC, dongle, etc.) with the same configuration and processing functions as the IC card 1 described later.

IC cards 1 can be broadly classified into contact IC cards and non-contact IC cards. For example, a contact IC card 1 is activated by receiving an operating power supply and an operating clock from the IC card processing device 2 via a contact section serving as a communication interface. A non-contact IC card 1 receives radio waves from the IC card processing device 2 via an antenna and a modulation/demodulation circuit serving as a communication interface, and activates itself by generating an operating power supply and an operating clock from the radio waves.

As shown in FIG. 1, IC card 1 has a main body C. Main body C is formed into a card shape from plastic or the like. IC card 1 has a module M inside main body C. Module M is formed integrally with one or more IC chips Ca and an external interface (interface) for communication connected thereto, and is embedded inside main body C.

The portable electronic device according to the embodiment may be one in which the module M is provided in the main body C formed in a booklet shape, or one in which the module M is provided in the main body C forming a portable electronic device.

In the configuration example shown in FIG. 1, a module M of an IC card 1 includes a processor 11, a RAM 12, a ROM 13, an NVM 14, a communication control unit 15, an interface 16, and the like.
The processor 11 includes circuits that execute various processes. The processor 11 is, for example, a CPU (Central Processing Unit). The processor 11 controls the entire IC card 1. The processor 11 executes programs stored in the ROM 13 or the NVM 14 to realize various processing functions. However, some or all of the various functions executed by the processor 11, which will be described later, may be realized by a hardware circuit.

RAM 12 is a volatile memory that functions as a working memory. RAM 12 also functions as a buffer that temporarily stores data being processed by processor 11. For example, RAM 12 functions as a communication buffer that temporarily stores data sent and received between IC card processing device 2 via communication control unit 15 and interface 16.

ROM 13 is a non-volatile memory that functions as a program memory. Control programs and control data are stored in advance in ROM 13. ROM 13 is incorporated into IC card 1 during the manufacturing stage with the control programs and control data stored therein. In other words, the control programs and control data stored in ROM 13 are incorporated in advance according to the specifications of the IC card 1. For example, ROM 13 stores a program that causes processor 11 to execute processing in response to commands received from IC card processing device 2.

NVM14 is a non-volatile memory to which data can be written and rewritten. NVM14 is, for example, configured with an EEPROM (registered trademark) (Electrically Erasable Programmable Read Only Memory) or a flash ROM. In addition, NVM14 has a storage area in which some or all of its areas are tamper-resistant and data can be securely stored.

Programs and various data according to the operational use of the IC card 1 are written to the NVM 14. Program files and data files are defined in the NVM 14, and programs and various data are written to these files. For example, the NVM 14 is provided with a storage area for storing encryption processing programs and encryption processing data such as key data for each of a number of encryption methods. The NVM 14 also stores user data, data for network authentication for communicating with an external network, and application programs for executing various processes.

The communication control unit 15 connects to the interface 16. The interface 16 is an interface for communication connection to an external device. The communication control unit 15 and the interface 16 constitute a communication unit. The communication control unit 15 and the interface 16 realize a communication function using a communication method corresponding to the interface of the IC card processing device 2. In addition, the communication control unit 15 and the interface 16 may be configured to support multiple communication methods (for example, contact communication and contactless communication).

When the IC card 1 is realized as a contact-type IC card, the communication control unit 15 and the interface 16 constitute a communication unit that contacts and communicates with the IC card processing device 2. In this case, the interface 16 is constituted by a contact unit that makes physical and electrical contact with the contact unit of the IC card processing device 2, and the communication control unit 15 is constituted by a circuit that controls the transmission and reception of signals via the contact unit.

When the IC card 1 is realized as a contactless IC card, the communication control unit 15 and the interface 16 constitute a communication unit that communicates contactlessly (wirelessly) with the card reader/writer of the IC card processing device 2. In this case, the interface 16 is constituted by an antenna that transmits and receives radio waves, and the communication control unit 15 is constituted by a modulation circuit for generating radio waves to be transmitted and a demodulation circuit for generating a signal from the received radio waves.

FIG. 2 is a block diagram illustrating an example of the configuration of the IC card processing device 2 according to the embodiment.
2, the IC card processing device 2 is a device (R/W) that has a function of communicating with the IC card 1 via a card reader/writer 24. The IC card processing device 2 may be, for example, a device in which the card reader/writer 24 is connected to a control device such as a personal computer (PC).

As shown in FIG. 2, the IC card processing device 2 includes a control unit 21, a display unit 22, an operation unit 23, a card reader/writer 24, and the like.
The control unit 21 controls the operation of the entire IC card processing device 2. The control unit 21 is composed of a processor (CPU) 25, RAM 26, ROM 27, non-volatile memory 28, communication unit 29, etc. For example, the control unit 21 is composed of a personal computer. The processor 25 executes various processes by executing programs stored in the ROM 27 or non-volatile memory 28. The RAM 26 functions as a working memory that temporarily holds data. The ROM 27 is a non-volatile memory that stores programs, control data, etc. The non-volatile memory 28 is a rewritable non-volatile memory. The communication unit 29 is an interface for communicating with an external device.

The control unit 21 has a function of sending commands to the IC card 1 via the card reader/writer 24, and a function of performing various processes based on data received from the IC card 1. For example, the control unit 21 controls writing of data to the non-volatile memory in the IC card 1 by sending a data write command to the IC card 1 via the card reader/writer 24. The control unit 21 also controls reading of data from the IC card 1 by sending a read command to the IC card 1. The control unit 21 also controls the application selected in the IC card 1 by sending an application selection command to the IC card 1.

The display unit 22 is a display device that displays various information under the control of the control unit 21. The operation unit 23 is composed of a keyboard, a numeric keypad, a pointing device, etc. The operation unit 23 is used by the operator of the IC card processing device 2 to input various operation instructions and data. The operation unit 23 also functions as an input unit for inputting the identification information of the user of the IC card 1 or authentication information such as a password.

The card reader/writer 24 is a communication unit (second communication unit) for communicating with the IC card 1. The card reader/writer 24 is configured with an interface according to the communication method of the IC card 1. For example, if the IC card 1 is a contact-type IC card, the card reader/writer 24 is configured with a contact unit for physically and electrically connecting to the contact unit of the IC card 1. Also, if the IC card 1 is a non-contact-type IC card, the card reader/writer 24 is configured with an antenna and communication control for wireless communication with the IC card 1. The card reader/writer 24 supplies power, supplies a clock, performs reset control, and transmits and receives data to the IC card 1. The card reader/writer 24 activates (starts up) the IC card 1, transmits various commands, and receives responses to the transmitted commands, based on the control by the control unit 21.

Next, the configuration of a file for storing data in the NVM 14 of the IC card 1 according to the embodiment will be described.
The NVM 14 in the IC card 1 stores data in each file of a file structure defined by, for example, ISO/IEC 7816-4, an international standard for IC cards. In such a defined file structure, a group of multiple files having a hierarchical structure including a Master File (MF), a Dedicated File (DF), and an Elementary File (EF) are defined.

The MF is at the top level, with one or more DFs defined at the next level below the MF, and one or more EFs defined at the next level below the DF. A single DF stores, for example, a set of data for implementing one application provided in the IC card 1. An IC card 1 that implements multiple functions through multiple applications has multiple DFs in the NVM 14 corresponding to each application. Each EF under a DF is a data file for storing various data used by the application serving as the DF at the higher level.

Fig. 3 is a diagram showing a schematic diagram of a storage area for each of a plurality of encryption methods provided in the NVM 14 of the IC card 1 according to the embodiment, and Fig. 4 is a diagram showing a schematic diagram of a storage area for each of a plurality of encryption methods loaded into the RAM 12 of the IC card 1 according to the embodiment.
The IC card 1 according to the embodiment supports a plurality of encryption methods and has a function of executing processing such as verification (authentication) using encryption processing of an encryption method selected from the plurality of encryption methods. For this reason, a storage area for each of the plurality of encryption methods is provided in the NVM 14 of the IC card 1. Fig. 3 shows an example in which a storage area for storing data used for encryption processing of the three encryption methods is provided in the storage area of the NVM 14 when the IC card 1 supports three encryption methods. As shown in Fig. 4, the IC card 1 can execute encryption processing in each encryption method by loading the data of the three encryption methods stored in the NVM 14 shown in Fig. 3 into the RAM 12.

The IC card 1 supports multiple encryption methods, such as quantum-resistant cryptography, RSA, and DES (Data Encryption Standard). Quantum-resistant cryptography is a general term for encryption methods that are considered difficult to decipher even using a quantum computer. Examples of quantum-resistant cryptography include lattice cryptography. RSA is an algorithm for data encryption using public key cryptography. DES is an algorithm for data encryption using common key cryptography.

Encryption methods such as quantum-resistant cryptography, RSA, and DES differ in the amount of calculation (processing load) required to execute encryption processing, and in encryption strength (security level). In general, the amount of calculation required for encryption processing increases in the order quantum-resistant cryptography, RSA, and DES, and the encryption strength also increases in the order quantum-resistant cryptography, RSA, and DES. Furthermore, even if the encryption method is the same type, the amount of calculation and encryption strength of the encryption processing differ depending on parameters such as the length of the key data used in the encryption processing. For this reason, in this embodiment, multiple encryption methods are not limited to encryption methods of different types, but also include encryption methods of the same type but with different lengths of key data used in the encryption processing.

Next, a first operation example will be described in which the IC card 1 serving as the portable electronic device according to the embodiment selects one encryption method from a plurality of encryption methods and executes encryption processing.
FIG. 5 is a diagram showing an example of setting information for selecting an encryption method to be stored in the NVM 14 of the IC card 1 operating in the first operation example.
The IC card 1 operating in the first operation example stores setting information for selecting one encryption method from a plurality of encryption methods included in the IC card 1 in a memory such as the NVM 14. In the setting information for selecting an encryption method, a selection order is set for a plurality of encryption methods supported (included) by the IC card 1. In the example of setting information shown in Fig. 5, it is assumed that the IC card 1 supports three encryption methods, namely, post-quantum encryption, RSA, and DES, and the selection order is set in the order of post-quantum encryption, RSA, and DES.

When the IC card 1 in the first operation example communicates with the IC card processing device 2, it identifies the encryption method that the IC card processing device 2 accepts (supports) in order to execute processing including encryption processing. In this embodiment, it is assumed that the IC card processing device 2, which is the communication partner of the IC card 1, does not have a unique encryption method set for use in encryption processing. In other words, in the embodiment, it is assumed that the encryption method accepted by the IC card processing device 2 with which the IC card 1 communicates (the encryption method that the IC card processing device 2 can execute) differs depending on the IC card processing device 2 or the processing that the IC card processing device 2 is attempting to execute.

When the IC card 1 identifies an encryption method permitted by the IC card processing device 2, it selects one encryption method from those permitted by the IC card processing device 2 in accordance with the selection priority set by the configuration information as shown in FIG. 5. This allows the IC card 1, which has multiple encryption methods, to select one encryption method from those permitted (supported) by the IC card processing device 2 and perform encryption processing using the selected encryption method.

The selection order for multiple encryption methods is set, for example, in the order of security level. If the selection order is set in the order of increasing security level, the IC card 1 can perform encryption processing using an encryption method with a higher security level among the encryption methods permitted by the IC card processing device 2. The selection order for multiple encryption methods may also be set in the order of the estimated processing time required for the encryption processing. If the selection order is set in the order of shortest processing time required for the encryption processing, the IC card 1 can perform encryption processing using an encryption method with the shortest processing time among the encryption methods permitted by the IC card processing device 2.

Next, a first operation example will be described in which the IC card 1 according to the embodiment selects one encryption method from a plurality of encryption methods and executes encryption processing.
FIG. 6 is a flowchart for explaining the flow of a first operation example of the IC card 1 as a portable electronic device according to the embodiment.
The IC card 1 is communicatively connected to the IC card processing device 2 via the interface 16 by the communication control unit 15. When the processor 11 of the IC card 1 is communicatively connected to the IC card processing device 2, the processor 11 obtains, from the IC card processing device 2, information indicating the encryption method permitted by the IC card processing device 2.

For example, the IC card processing device 2 notifies the IC card 1 of information indicating encryption methods that can be executed as permitted encryption methods. As a specific example, if the IC card processing device 2 does not support post-quantum cryptography and supports RSA and DES, the IC card processing device 2 notifies the IC card 1 of information indicating that the permitted encryption methods are RSA and DES.

The IC card processing device 2 may also specify the encryption method that is permitted depending on the security level required for the process to be executed. As a specific example, when the IC card processing device 2 is about to execute a process that requires post-quantum cryptography or RSA encryption processing, it notifies the IC card 1 of information indicating that the permitted encryption method is post-quantum cryptography or RSA. Also, when an IC card processing device 2 that is not compatible with post-quantum cryptography is about to execute a process that requires post-quantum cryptography or RSA encryption processing, the IC card processing device 2 may notify the IC card 1 of information indicating that the permitted encryption method is RSA.

When the processor 11 of the IC card 1 receives the information indicating the permitted encryption method from the IC card processing device 2, it identifies the encryption method permitted by the IC card processing device (hereinafter also referred to as terminal) 2 (step ST11).
When the processor 11 of the IC card 1 identifies the encryption method permitted by the IC card processing device 2, it selects one encryption method from the encryption methods permitted by the IC card processing device 2. In a first operation example, the processor 11 selects one encryption method from the encryption methods permitted by the IC card processing device 2 in accordance with the selection order set in the setting information as shown in FIG.

When the processor 11 of the IC card 1 identifies the encryption methods permitted by the IC card processing device 2, it determines whether the IC card processing device 2 is incompatible with the first encryption method, which is the first encryption method in the selection order (step ST12). In other words, the processor 11 determines whether the encryption methods permitted by the IC card processing device 2 include the first encryption method.

If the encryption methods permitted by the IC card processing device 2 include the first encryption method, the processor 11 of the IC card 1 determines that the IC card processing device 2 supports the first encryption method (step ST12, NO). If the IC card processing device 2 supports the first encryption method (step ST12, NO), the processor 11 selects the first encryption method as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST13).

If the first encryption method is not included in the encryption methods permitted by the IC card processing device 2, the processor 11 of the IC card 1 determines that the IC card processing device 2 is not compatible with the first encryption method (step ST12, YES). If the IC card processing device 2 is not compatible with the first encryption method (step ST12, YES), the processor 11 determines whether the IC card processing device 2 is not compatible with the second encryption method, which is second in the selection order (step ST14). In other words, the processor 11 determines whether the second encryption method is included in the encryption methods permitted by the IC card processing device 2.

If the second encryption method is included in the encryption methods permitted by the IC card processing device 2, the processor 11 of the IC card 1 determines that the IC card processing device 2 supports the second encryption method (step ST14, NO). If the IC card processing device 2 supports the second encryption method (step ST14, NO), the processor 11 selects the second encryption method as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST15).

If the second encryption method is not included in the encryption methods permitted by the IC card processing device 2, the processor 11 of the IC card 1 determines that the IC card processing device 2 is incompatible with the second encryption method (step ST14, YES). If the IC card processing device 2 is incompatible with the second encryption method (step ST14, YES), the processor 11 determines whether the IC card processing device 2 is incompatible with the third encryption method, which is third in the selection order (step ST16). In other words, the processor 11 determines whether the third encryption method is included in the encryption methods permitted by the IC card processing device 2.

If the encryption methods permitted by the IC card processing device 2 include the third encryption method, the processor 11 of the IC card 1 determines that the IC card processing device 2 supports the third encryption method (step ST16, NO). If the IC card processing device 2 supports the third encryption method (step ST16, NO), the processor 11 selects the third encryption method as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST13).

If the third encryption method is not included in the encryption methods permitted by the IC card processing device 2, the processor 11 of the IC card 1 determines that the IC card processing device 2 does not support the third encryption method (step ST16, YES). If the IC card processing device 2 does not support the third encryption method (step ST16, YES), the processor 11 determines that there is no encryption method supported by the IC card processing device 2 if the IC card 1 does not have an encryption method ranked fourth or higher in the selection order.

When the processor 11 of the IC card 1 determines that the IC card processing device 2 does not support an encryption method, it notifies the IC card processing device 2 that there is no corresponding encryption method (step ST18). In this case, the processor 11 of the IC card 1 ends the communication process with the IC card processing device 2 because it cannot perform mutual authentication with the IC card processing device 2 using encryption processing.

When the processor 11 of the IC card 1 selects one of the encryption methods permitted by the IC card processing device 2, it shares the selected encryption method with the IC card processing device 2 (step ST19). For example, when the processor 11 selects post-quantum cryptography from the encryption methods permitted by the IC card processing device 2, it notifies the IC card processing device 2 that it will perform encryption processing using post-quantum cryptography. When the processor 11 shares the selected encryption method with the IC card processing device 2, it executes processing including encryption processing using the selected encryption method in response to a command from the IC card processing device 2 (step ST20).

As described above, the IC card as a portable electronic device according to the first operation example has multiple encryption methods, selects one encryption method from among the encryption methods permitted by the IC card processing device, and executes communication processing with the IC card processing device by encryption processing using the selected encryption method. In addition, the IC card as a portable electronic device according to the first operation example stores setting information in memory indicating the selection order for the multiple encryption methods, and selects one encryption method from among the encryption methods permitted by the IC card processing device according to the selection order.

As a result, according to the first operation example, the IC card as a portable electronic device can select an encryption method permitted by the IC card processing device from among multiple encryption methods and perform encryption processing. Furthermore, even if all IC card processing devices (potential communication partners) in the entire system do not support a specific encryption method, the IC card can perform encryption processing using an encryption method selected from the encryption methods supported by each IC card processing device.

Moreover, according to the first operation example, an IC card as a portable electronic device can not only perform cryptographic processing using a high-security, high-load cryptographic method such as quantum-resistant cryptography required by some IC card processing devices or specific processes, but can also selectively perform cryptographic processing with IC card processing devices that do not support high-load cryptographic methods, or cryptographic processing using a high-speed cryptographic method with a light processing load when high-load cryptographic processing is not required.

Next, a second operation example will be described in which the IC card 1 according to the embodiment selects an encryption method from a plurality of encryption methods according to the communication situation and executes encryption processing.
In the second operation example, the IC card 1 is a contactless IC card. When the IC card 1, which is a contactless IC card, communicates with the IC card processing device 2 (card reader/writer 24), it measures the strength of the magnetic field generated between the interface 16 and the card reader/writer 24.

That is, the processor 11 (or the communication control unit 15) of the IC card 1 operating in the second operation example has a function of identifying the magnetic field strength generated in the interface 16. For example, the IC card 1 may further include a sensor for measuring the magnetic field strength, and the processor 11 may acquire the magnetic field strength detected by the sensor. The processor 11 may also measure the magnetic field strength based on the state (damage status) of the data from the IC card processing device. However, the method by which the processor 11 acquires the magnetic field strength is not limited to a specific method.

FIG. 7 is a diagram showing setting information for selecting one encryption method by an IC card stored in the NVM 14 of the IC card 1 operating in the second operation example.
The IC card 1 operating in the second operation example stores setting information for selecting one encryption method from a plurality of encryption methods included in the IC card 1 according to the magnetic field strength in a memory such as the NVM 14. In the example of setting information shown in Fig. 7, the IC card 1 is assumed to support three encryption methods, namely, post-quantum cryptography (first encryption method), RSA (second encryption method), and DES (third encryption method). For each encryption method, a magnetic field strength range and a magnetic field strength confirmation level required for executing encryption processing are set.

In the example shown in Figure 7, the magnetic field strength range for quantum-resistant cryptography is 7.5 to 5.0 (A/m), and the magnetic field strength confirmation level is set to a strong magnetic field. The magnetic field strength range for RSA is 7.5 to 3.0 (A/m), and the magnetic field strength confirmation level is set to a medium magnetic field. The magnetic field strength range for DES is 7.5 to 1.5 (A/m), and the magnetic field strength confirmation level is set to a weak magnetic field.

When the IC card 1 communicates with the card reader/writer 24 of the IC card processing device 2, it acquires the magnetic field strength generated in the interface 16. When the IC card 1 acquires the magnetic field strength, it selects an encryption method based on the magnetic field strength. For example, the processor 11 of the IC card 1 selects one encryption method in descending order of magnetic field strength confirmation level in the setting information as shown in FIG. 7. This allows the IC card 1, which has multiple encryption methods, to select one encryption method according to the magnetic field strength and execute encryption processing using the selected encryption method.

According to the setting example shown in FIG. 7, when the magnetic field strength is 5.0 (A/m) or more, the IC card 1 determines that the magnetic field strength confirmation level is a strong magnetic field, and selects resistant quantum cryptography as the encryption method. When the magnetic field strength is less than 5.0 (A/m) and greater than or equal to 3.0 (A/m), the IC card 1 determines that the magnetic field strength confirmation level is a medium magnetic field, and selects RSA as the encryption method. When the magnetic field strength range is less than 3.0 (A/m) and 1.5 (A/m), the IC card 1 determines that the magnetic field strength confirmation level is a weak magnetic field, and selects DES as the encryption method. This allows the IC card 1 to select an encryption method with more complex encryption processing and a higher security level the stronger the magnetic field is.

The IC card 1 may select one encryption method according to the magnetic field strength from among the encryption methods permitted by the IC card processing device 2. Furthermore, the IC card 1 is not limited to selecting an encryption method in order of the magnetic field confirmation level with the highest magnetic field strength or the highest security level, so long as the magnetic field strength is within the magnetic field strength range and the encryption method is compatible (allowed) by the IC card processing device 2. For example, the IC card 1 may select an encryption method in order of the shortest processing time required for encryption processing from among the encryption methods permitted by the IC card processing device 2, so long as the magnetic field strength is within the magnetic field strength range.

FIG. 8 is a flow chart for explaining a process for registering, in the IC card 1, setting information for selecting an encryption method depending on the magnetic field strength.
For example, in the IC card 1 according to the second operation example, setting information for selecting an encryption method is registered in a process for making the IC card operational (IC card issuing process). In the IC card issuing process, the processor 11 of the IC card 1 creates a data file (EF) for magnetic field strength confirmation for the multiple encryption methods provided in the IC card 1 (step ST41). For example, the processor 11 stores information indicating the magnetic field strength confirmation level to be set for each encryption method in the EF for magnetic field strength confirmation.

When the processor 11 of the IC card 1 creates the EF for magnetic field strength confirmation, it sets the magnetic field strength range in which encryption processing can be performed for each encryption method (step ST42). For example, the processor 11 stores information indicating the magnetic field strength range in which encryption processing can be performed for each encryption method.

After setting the magnetic field strength range for each encryption method, processor 11 determines whether or not the magnetic field strength range has been set for all encryption methods (step ST43). If there is an encryption method for which the magnetic field strength range has not been set among the multiple encryption methods provided by IC card 1 (step ST43, NO), processor 11 returns to step ST42 and sets the magnetic field strength range for the encryption method for which the magnetic field strength range has not been set. If the magnetic field strength range has been set for all encryption methods provided by IC card 1 (step ST43, YES), processor 11 ends the registration of the setting information for selecting an encryption method according to the magnetic field strength.

Next, a flow of a second operation example in which the IC card 1 according to the embodiment selects one encryption method from a plurality of encryption methods in accordance with the magnetic field strength will be described.
FIG. 9 is a flowchart for explaining the flow of a second operation example of the IC card 1 as the portable electronic device according to the embodiment.
When the processor 11 of the IC card 1 is communicatively connected to the card reader/writer 24 of the IC card processing device 2 via the interface 16, the processor 11 obtains information indicating the magnetic field strength generated at the interface 16 (step ST51).

If the magnetic field strength generated at the interface 16 is 0, that is, if the magnetic field strength cannot be acquired (step ST52, NO), the processor 11 of the IC card 1 will not operate if the magnetic field strength generated at the interface 16 is 0, since the IC card 1 cannot obtain power for operation from the magnetic field. In this case, the IC card 1 will not respond to the IC card processing device 2, and after a predetermined time has elapsed, the process will end as a timeout.

When the processor 11 of the IC card 1 is able to acquire the magnetic field strength generated in the interface 16 (step ST52, YES), the processor 11 determines the magnetic field strength confirmation level based on the acquired magnetic field strength. Here, it is assumed that the magnetic field strength confirmation levels are set in order of the largest minimum value of the magnetic field strength range. Furthermore, the magnetic field strength range when the magnetic field strength confirmation level is a strong magnetic field is set as the first magnetic field strength range, the magnetic field strength range when the magnetic field strength confirmation level is a medium magnetic field is set as the second magnetic field strength range, and the magnetic field strength range when the magnetic field strength confirmation level is a weak magnetic field is set as the third magnetic field strength range.

For example, according to the setting information shown in FIG. 7, if the magnetic field strength is 5.0 (A/m) or more, the processor 11 determines that the magnetic field strength confirmation level is a strong magnetic field within the first magnetic field strength range, if the magnetic field strength is 5.0 to 3.0 (A/m) or more, the processor 11 determines that the magnetic field strength confirmation level is a medium magnetic field within the second magnetic field strength range, and if the magnetic field strength is 3.0 to 1.5 (A/m) or more, the processor 11 determines that the magnetic field strength confirmation level is a weak magnetic field within the third magnetic field strength range.

When the processor 11 of the IC card 1 acquires the magnetic field strength generated in the interface 16, it determines whether the magnetic field strength is outside the first magnetic field strength range, which is the magnetic field strength range in which the magnetic field strength confirmation level is determined to be a strong magnetic field (step ST53).
If the magnetic field strength is within the first magnetic field strength range (step ST53, NO), the processor 11 selects an encryption method (first encryption method) in which the magnetic field strength confirmation level is set to a strong magnetic field as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST54).

If the magnetic field strength is outside the first magnetic field strength range (step ST53, YES), the processor 11 of the IC card 1 determines whether the magnetic field strength is outside the second magnetic field strength range, which is the magnetic field strength range in which the magnetic field strength confirmation level is determined to be a medium magnetic field (step ST55).
If the magnetic field strength is within the second magnetic field strength range (step ST55, NO), the processor 11 selects an encryption method (second encryption method) in which the magnetic field strength confirmation level is set to a medium magnetic field as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST56).

If the magnetic field strength is outside the second magnetic field strength range (step ST55, YES), the processor 11 of the IC card 1 determines whether the magnetic field strength is outside the third magnetic field strength range, which is the magnetic field strength range in which the magnetic field strength confirmation level is determined to be a weak magnetic field (step ST57).
If the magnetic field strength is within the third magnetic field strength range (step ST57, NO), the processor 11 selects an encryption method (third encryption method) in which the magnetic field strength confirmation level is set to a weak magnetic field as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST58).

If the magnetic field strength is outside the third magnetic field strength range (step ST57, YES), the processor 11 of the IC card 1 determines that the magnetic field strength is insufficient since the magnetic field strength is outside the magnetic field strength ranges of all encryption methods.
If the processor 11 determines that the magnetic field strength is insufficient, it notifies the IC card processing device 2 that the magnetic field strength is insufficient (step ST59). In this case, the processor 11 of the IC card 1 ends the communication process with the IC card processing device 2 because the encryption process cannot be executed due to the insufficient magnetic field strength.
When the control unit 21 of the IC card processing device 2 receives a message from the IC card 1 indicating that the magnetic field strength is insufficient, the control unit 21 may display on the display unit 22 a message urging the user to adjust the communication environment.

When the processor 11 of the IC card 1 selects one encryption method based on the magnetic field strength, it notifies the IC card processing device 2 of information indicating the selected encryption method (step ST60). After notifying the IC card processing device 2 of the selected encryption method, the IC card 1 determines whether the IC card processing device 2 supports the selected encryption method based on the information from the IC card processing device 2 (step ST61).

For example, when the control unit 21 of the IC card processing device 2 receives information indicating the encryption method selected by the IC card 1, it checks whether encryption processing is possible using the encryption method selected by the IC card 1. If encryption processing is possible using the encryption method selected by the IC card 1 (if the encryption method is supported), the control unit 21 of the IC card processing device 2 transmits a message to the IC card 1 indicating that encryption processing will be performed using the selected encryption method.

As a result, the IC card 1 and the IC card processing device 2 share the encryption method selected by the IC card 1 in response to the magnetic field strength. When the processor 11 of the IC card 1 shares with the IC card processing device 2 that encryption processing is possible using the selected encryption method, it executes processing including encryption processing using the selected encryption method in response to a command from the IC card processing device 2 (step ST62).

In addition, if encryption processing using the encryption method selected by the IC card 1 is not possible (if the IC card 1 is not compatible with the selected encryption method) (step ST61, NO), the control unit 21 of the IC card processing device 2 transmits to the IC card 1 a message indicating that encryption processing using the selected encryption method is not possible.

The processor 11 of the IC card 1 determines that the IC card processing device 2 is not compatible with the encryption method selected based on the magnetic field strength upon receiving notification from the IC card processing device 2 that the selected encryption method is not compatible (step ST61, NO). If the IC card processing device 2 is not compatible with the encryption method selected according to the magnetic field strength (step ST61, NO), the processor 11 changes the selection of the encryption method (step ST63). After changing the selection of the encryption method, the processor 11 of the IC card 1 returns to step ST60 and executes the above-mentioned process.

For example, according to the setting example shown in FIG. 7, if the IC card processing device 2 is not compatible with the first encryption method selected when the magnetic field strength confirmation level is a strong magnetic field, the processor 11 changes the selection of the encryption method to the second encryption method, the magnetic field confirmation level of which is set to a medium magnetic field.

In addition, if the IC card processing device 2 does not support the selected encryption method, and if the selection of the encryption method cannot be changed, the processor 11 of the IC card 1 proceeds to step ST59 and notifies the IC card processing device 2 of insufficient magnetic field strength. For example, according to the setting example shown in FIG. 7, if the IC card processing device 2 does not support the third encryption method selected when the magnetic field strength confirmation level is a weak magnetic field, the processor 11 cannot change the selection of the encryption method to be used in the encryption process, so notifies the IC card processing device 2 of insufficient magnetic field strength and ends the communication process.

In the IC card according to the embodiment, the process of selecting one encryption method from multiple encryption methods according to the magnetic field strength is not limited to the process performed according to the procedure described above. For example, the IC card may perform the process by combining the second and first operation examples described above. In the second operation example shown in FIG. 9, it is determined whether the IC card processing device supports the encryption method selected according to the magnetic field strength, but as described in the first operation example, it is also possible to identify the encryption methods permitted by the IC card processing device 2 and then select an encryption method according to the magnetic field strength from the encryption methods permitted by the IC card processing device 2.

As described above, the IC card as a portable electronic device according to the second operation example has multiple encryption methods, selects one encryption method from the multiple encryption methods depending on the communication state with the IC card processing device, and executes communication processing with the IC card processing device by encryption processing with the selected encryption method. The IC card as a portable electronic device according to the second operation example is also a contactless IC card, and selects one encryption method depending on the magnetic field strength generated in the interface. The IC card as a portable electronic device according to the second operation example stores setting information in memory indicating the magnetic field strength ranges for the multiple encryption methods, and selects one encryption method depending on the magnetic field strength generated in the interface.

Therefore, according to the second operation example, the IC card as a portable electronic device can select an encryption method from a plurality of encryption methods according to the communication state such as magnetic field strength, and perform encryption processing. As a result, even when a specific encryption method is not being executed, the IC card can perform encryption processing using an encryption method according to the magnetic field strength.

Furthermore, according to the second operation example, even if an IC card as a portable electronic device has a function for performing cryptographic processing using a high-security, high-load cryptographic method such as quantum-resistant cryptography, if the magnetic field strength is outside a predetermined magnetic field strength range, it can perform cryptographic processing using an encryption method according to the magnetic field strength.

The functions described in each of the above embodiments can be realized not only by using hardware, but also by loading a program that describes each function into a computer using software. Also, each function may be configured by selecting either software or hardware as appropriate.

Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims.
The following is an appended summary of the contents of the claims as originally filed.
[1]
an interface for communicating with an external device;
a memory having a storage area for storing data for executing encryption processing in each of a plurality of encryption methods;
a processor that selects one encryption method from the plurality of encryption methods, shares the selected encryption method with the external device, and executes a process using encryption processing according to the encryption method shared with the external device;
A portable electronic device comprising:
[2]
the memory further stores information indicating a selection order for selecting one encryption method from the plurality of encryption methods;
the processor selects one encryption method from among the encryption methods permitted by the external device in accordance with the selection order;
The portable electronic device according to [1].
[3]
The processor selects one encryption method depending on a communication state with the external device through the interface.
The portable electronic device according to [1].
[4]
the interface is an interface for performing non-contact communication using a magnetic field,
the memory stores information indicating a magnetic field strength range for each of the plurality of encryption methods;
The processor acquires information indicating a magnetic field strength generated in the interface, and selects one encryption method from among encryption methods in which the acquired magnetic field strength falls within a magnetic field strength range.
The portable electronic device according to [3].
[5]
the processor selects encryption methods in order of decreasing minimum value of the magnetic field strength range from encryption methods in which the magnetic field strength generated at the interface falls within the magnetic field strength range;
The portable electronic device according to [4].
[6]
When the external device is incompatible with the selected encryption method, the processor changes the selection to another encryption method in which the magnetic field strength generated at the interface falls within a magnetic field strength range.
The portable electronic device according to [4].
[7]
the processor notifies the external device of insufficient magnetic field strength when there is no encryption method in which the magnetic field strength generated at the interface falls within the magnetic field strength range;
The portable electronic device according to [4].
[8]
The portable electronic device according to any one of [1] to [7], wherein the plurality of cryptographic methods include a post-quantum cryptographic method and a non-post-quantum cryptographic method.
[9]
a module having an interface for communicating with an IC card processing device, a memory having a storage area for storing data for executing cryptographic processing in each of a plurality of cryptographic methods, and a processor for selecting one cryptographic method from the plurality of cryptographic methods, sharing the selected cryptographic method with the IC card processing device, and executing processing using cryptographic processing in accordance with the cryptographic method shared with the IC card processing device;
a main body having the module;
An IC card comprising:

1...IC card (portable electronic device), C...main body, Ca...IC chip, M...module, 2...IC card processing device (external device), 11...processor, 12...RAM, 13...ROM, 14...non-volatile memory, 15...communication control unit, 16...interface, 21...control unit, 22...display unit, 23...operation unit, 24...card reader/writer.

Claims (7)

an interface that performs contactless communication with a card reader/writer using a magnetic field;
a memory having a storage area for storing data and magnetic field strength for executing encryption processing in each of a plurality of encryption methods;
a processor that acquires from the card reader/writer information indicating an encryption method permitted by the card reader/writer and information indicating a magnetic field strength generated at the interface, selects one encryption method from a plurality of encryption methods stored in the memory according to the acquired magnetic field strength, and when the selected encryption method is an encryption method permitted by the card reader/writer, shares the selected encryption method with the card reader/writer and executes communication processing using encryption processing according to the encryption method shared with the card reader/writer;
An IC card comprising: the memory stores information indicating a magnetic field strength range for each of the plurality of encryption methods;
the processor selects one encryption method from among encryption methods in which the acquired magnetic field strength falls within a magnetic field strength range;
2. The IC card according to claim 1. the processor selects encryption methods in order of decreasing minimum value of the magnetic field strength range from encryption methods in which the magnetic field strength generated at the interface falls within the magnetic field strength range;
3. The IC card according to claim 2. when the card reader/writer is incompatible with the selected encryption method, the processor changes the selection to another encryption method whose magnetic field strength generated at the interface falls within a magnetic field strength range.
3. The IC card according to claim 2. the processor notifies the card reader/writer of insufficient magnetic field strength when there is no encryption method in which the magnetic field strength generated at the interface falls within a magnetic field strength range.
3. The IC card according to claim 2. The plurality of cryptographic methods include a post-quantum cryptographic method and a non-post-quantum cryptographic method,
2. The IC card according to claim 1. a module having the interface, the memory, and the processor;
a body having the module;
7. An IC card according to claim 1.