Electronic information storage medium, IC chip, IC card, public key management method, and program

Abstract

To provide an electronic information storage medium, an IC chip, an IC card, a public key management method, and a program that allow appropriate management of a public key which is extracted from a public key certificate and stored.SOLUTION: When receiving a public key certificate from an external device 2, an IC chip 1 extracts a public key from the public key certificate, stores the extracted public key in an NVM 13, and sets the remaining number of times for use of the extracted public key.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to the technical field of IC (Integrated Circuit) cards and the like having a function of verifying public key certificates. [Background technology]

[0002] Conventionally, a public key infrastructure (PKI) is known as a technology used in many systems, such as Internet encryption communication (SSL / TSL) and IC card authentication. When certificate (public key certificate) chaining is used in the public key infrastructure, the IC card needs to temporarily store the public key extracted (taken out) from the public key certificate in the IC card in order to verify the public key certificate from the base point of the certificate chain from the external device. In this case, even if the public key certificate transmitted from the external device is the same for each session, the IC card needs to verify the public key certificate and extract the public key every time, which is a problem of unnecessary repeated processing. To address this problem, Non-Patent Document 1 defines a method of permanently storing the public key extracted from the public key certificate as an implementation option. By using this method, it is possible to omit receiving the public key certificate and use the permanently stored public key only while a new public key certificate is not received or the whitelist of the public key certificate is not updated. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] GlobalPlatform Technology, Secure Channel Protocol '11', Card Specification v2.3-Amendment F, Version 1.2, Public Release July 2018 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the IC card covered by Non-Patent Document 1 is a system that updates the certificate whitelist in response to a request from an external device, and therefore cannot send a public key certificate or a request for updating the whitelist by itself, which poses a problem that it is not guaranteed that the public key that is permanently stored is the latest one.

[0005] Therefore, the present invention has been made in consideration of these points and the like, and one example of an objective of the present invention is to provide an electronic information storage medium, an IC chip, an IC card, a public key management method, and a program that are capable of properly managing a public key extracted and stored from a public key certificate. [Means for solving the problem]

[0006] In order to solve the above problem, the invention described in claim 1 is an electronic information storage medium having a non-volatile memory, characterized in that it comprises a receiving means for receiving a public key certificate from an external device, an extracting means for extracting a public key from the public key certificate received by the receiving means, a storing means for storing the public key extracted by the extracting means in the non-volatile memory, and a setting means for setting the number of times the public key extracted by the extracting means can be used, which is subtracted each time the public key is used.

[0007] The invention described in claim 2 is characterized in that, in the electronic information storage medium described in claim 1, the electronic information storage medium further comprises a volatile memory, and a storage method for the public key is preset to one of a first storage method for temporarily storing the public key in the volatile memory, a second storage method for permanently storing the public key in the non-volatile memory, and a third storage method for storing the public key, the number of times it can be used being set, in the non-volatile memory, and the storage means stores the public key extracted by the extraction means in accordance with any one of the preset storage methods.

[0008] The invention described in claim 3 is characterized in that, in the electronic information storage medium described in claim 2, it further comprises a judgment means for judging whether or not any one of the storage methods is set in the received public key certificate, and when it is judged that any one of the storage methods is set in the public key certificate, the storage means stores the public key extracted by the extraction means in accordance with the storage method set in the public key certificate rather than the previously set storage method.

[0009] The invention described in claim 4 is characterized in that, in the electronic information storage medium described in any one of claims 1 to 3, it further comprises an erasure means for erasing the public key from the non-volatile memory when the number of times the public key can be used stored in the non-volatile memory becomes 0.

[0010] The invention described in claim 5 is an IC chip having a non-volatile memory, comprising: a receiving means for receiving a public key certificate from an external device; an extracting means for extracting a public key from the public key certificate received by the receiving means; a storing means for storing the public key extracted by the extracting means in the non-volatile memory; and a setting means for setting the number of times the public key extracted by the extracting means can be used, which is subtracted each time the public key is used.

[0011] The invention described in claim 6 is an IC card having a non-volatile memory, comprising: a receiving means for receiving a public key certificate from an external device; an extracting means for extracting a public key from the public key certificate received by the receiving means; a storing means for storing the public key extracted by the extracting means in the non-volatile memory; and a setting means for setting the number of times the public key extracted by the extracting means can be used, which is subtracted each time the public key is used.

[0012] The invention described in claim 7 is a public key management method executed by an electronic information storage medium having a non-volatile memory, comprising the steps of receiving a public key certificate from an external device, extracting a public key from the received public key certificate, storing the extracted public key in the non-volatile memory, and setting the number of times the extracted public key can be used, which is subtracted each time the public key is used.

[0013] The invention described in claim 8 is characterized in that it causes a computer included in an electronic information storage medium having a non-volatile memory to execute the steps of receiving a public key certificate from an external device, extracting a public key from the received public key certificate, storing the extracted public key in the non-volatile memory, and setting the number of times the extracted public key can be used, which is subtracted each time the public key is used. Effect of the Invention

[0014] According to the present invention, it is possible to appropriately manage a public key extracted from a public key certificate and stored. [Brief description of the drawings]

[0015] [Figure 1] 2 is a diagram illustrating an example of a hardware configuration of an IC chip 1. FIG. [Diagram 2] 13 is a diagram showing an example of information stored in a storage method etc. storage area AE1 and a public key storage area AE2 in NVM13. [Diagram 3] 13 is a flowchart showing an example of a public key storage process executed by a CPU 15 of the IC chip 1. [Figure 4] 13 is a flowchart showing an example of a process for setting the remaining number of times the public key can be used, which is executed by the CPU 15 of the IC chip 1. [Diagram 5] 13 is a flowchart showing an example of a public key management process executed by a CPU 15 of the IC chip 1. [Figure 6]11 is a flowchart showing an example of a process that uses a public key and is executed by a CPU 15 of the IC chip 1. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0017] [1. Configuration and Functions of IC Chip 1] First, the configuration and functions of an IC chip 1 according to this embodiment will be described with reference to Fig. 1. The IC chip 1 is an example of an electronic information storage medium of the present invention. The IC chip 1 is mounted on, for example, an IC card such as a credit card, a cash card, or a My Number card, or a mobile device such as a smartphone. In the case of a mobile device such as a smartphone, the IC chip 1 may be mounted on a small IC card that is detachable from the mobile device, or may be mounted on an embedded board as an eUICC (Embedded Universal Integrated Circuit Card) so that it cannot be easily removed or replaced from the mobile device.

[0018] FIG. 1 is a diagram showing an example of a hardware configuration of an IC chip 1. As shown in FIG. 1, the IC chip 1 includes an I / O circuit 11, a random access memory (RAM) 12 (volatile memory), a nonvolatile memory (NVM) 13 (nonvolatile memory), a read only memory (ROM) 14, a central processing unit (CPU) 15 (an example of a computer), and a coprocessor 16 that performs cryptographic operations. The I / O circuit 11 serves as an interface with an external device 2. Note that communication between the IC chip 1 and the external device 2 may be non-contact communication or contact communication. In the case of non-contact communication, the IC chip 1 and the external device 2 communicate with each other via an antenna (not shown) mounted on an IC card or a mobile device, for example. Note that an off card entity (OCE) that transmits a public key certificate is assumed as an example of the external device 2. In this embodiment, a choice is provided for a method of storing a public key extracted (taken out) from a public key certificate.

[0019] The public key extracted from the public key certificate (PK.KA-KLOC.ECDSA (Public key of the KA-KLOC used for verifying certificates) or PK.OCE.ECKA (Public key of the OCE used for key agreement)) can be stored in the public key storage (memory) area of ​​RAM 12 according to a public key storage method. Similarly, the public key extracted from the public key certificate (PK.KA-KLOC.ECDSA or PK.OCE.ECKA) can be stored in the public key storage area of ​​NVM 13 according to a public key storage method. Here, the public key storage method is set in advance and stored in the storage method etc. storage area of ​​NVM 13.

[0020] For example, a flash memory is applied to the NVM 13. The NVM 13 may be an "Electrically Erasable Programmable Read-Only Memory". The NVM 13 or the ROM 14 stores various programs such as an OS (Operating System), an SD (Security Domain), and applications (including the program of the present invention). The SD is a management program for managing applications. The SD is for enabling the CPU 15 to realize functions such as installing a new application under its own management and opening a secure channel (encrypted communication path) for an application under its own management. The applications include, for example, a public key management application and a payment application.

[0021] FIG. 2 is a diagram showing an example of information stored in the storage method etc. storage area AE1 and the public key storage area AE2 in the NVM 13. The storage method etc. storage area AE1 and the public key storage area AE2 are managed by a public key management application. For example, the storage method etc. storage area AE1 stores one of the following storage methods (default value): (i) a storage method for temporarily storing a public key in the RAM 12, (ii) a storage method for permanently storing a public key in the NVM 13 (without use limit), and (iii) a storage method for storing a public key in the NVM 13, the remaining number of uses of which is set (with use limit). Here, temporarily storing means that, for example, when the power supply to the IC chip 1 is cut off or the session is reset, the stored public key is erased. On the other hand, permanently storing means that, for example, when the power supply to the IC chip 1 is cut off or the session is reset, the stored public key is not erased. In addition, the storage method (iii) may be a storage method in which the public key for which the remaining number of uses is set is permanently stored in NVM13. In this case, the stored public key does not need to be erased from NVM13.

[0022] FIG. 2 shows an example in which the storage method (iii) among the storage methods (i) to (iii) is stored in the storage method storage area AE1. In this case, as shown in FIG. 2, the storage method storage area AE1 stores the upper limit value of the number of times the public key can be used (upper limit of use: default value) and the remaining number of times the public key can be used in association with the public key. Here, the remaining number of times is the number of times the public key can be used that is subtracted every time the public key is used. In the example of FIG. 2, the public key storage area AE2 stores a public key PKA (PK.OCE.ECKA) extracted from the first public key certificate and a public key PKB (PK.OCE.ECKA) extracted from the second public key certificate. The public key PKA is, for example, a public key extracted from the last public key certificate in the first certificate chain. On the other hand, the public key PKB is, for example, a public key extracted from the last public key certificate in the second certificate chain. The public keys PKA and PKB are different from each other, and can be distinguished by a key identifier that is assigned in advance. In the example of FIG. 2, the storage method etc. storage area AE1 stores the remaining number of times that public key PKA can be used and the remaining number of times that public key PKB can be used.

[0023] Furthermore, in the example of FIG. 2, the public key storage area AE2 stores a root public key RPKA (a public key serving as the base of authentication) corresponding to the public key PKA, and a root public key RPKB corresponding to the public key PKB. The root public key (PK.CA-KLOC.ECDSA) RPKA is, for example, a public key serving as the base of a first certificate chain. On the other hand, the root public key RPKB is, for example, a public key serving as the base of a second certificate chain. The root public key RPKA and the root public key RPKB are different from each other, and can be distinguished by a key identifier assigned in advance. Although not shown, the NVM13 stores a public key certificate of the SD's private key (SK.SD.ECKA (Private key of the SD used for key agreement)) and the public key (PK.SD.ECKA (Public key of the SD used for key agreement)) that forms a key pair with the private key. In addition, the storage method and the upper limit of the number of times of use of any one of the storage methods (i) to (iii) may be set in the public key certificate received from the external device 2.

[0024] The CPU 15 (an example of a computer) functions as a receiving means, an extracting means, a storing means, a setting means, a determining means, an erasing means, and the like in the present invention according to the SD and a public key management application. Specifically, when the CPU 15 receives a command including a public key certificate from the external device 2, it extracts a public key (PK.KA-KLOC.ECDSA or PK.OCE.ECKA) from the received public key certificate. Then, the CPU 15 stores the extracted public key according to a storage method (for example, any one of the storage methods (i) to (iii)) preset in the NVM 13. That is, the extracted public key is stored in a public key storage area in the RAM 12 or a public key storage area in the NVM 13.

[0025] When the public key certificate is received, CPU 15 may determine whether or not a storage method (e.g., any one of the storage methods (i) to (iii)) is set in the public key certificate. If CPU 15 determines that a storage method is set in the public key certificate, it stores the extracted public key according to the storage method set in the public key certificate (i.e., the storage method set in the public key certificate takes precedence) rather than the storage method previously set in NVM 13. Here, if the extracted public key (PK.OCE.ECKA) is stored in the public key storage area in NVM 13 according to storage method (iii), CPU 15 sets the remaining number of uses for the extracted public key (PK.OCE.ECKA) and stores it in the storage method, etc. storage area in NVM 13.

[0026] Thereafter, when CPU 15 receives a command from external device 2 to use the stored public key (PK.OCE.ECKA), it executes processing according to the command using the stored public key (PK.OCE.ECKA). Here, when the public key (PK.OCE.ECKA) stored in NVM 13 is used, CPU 15 may erase (delete) the public key (PK.OCE.ECKA) from the public key storage area in NVM 13 when the remaining number of uses of the public key becomes 0. Furthermore, CPU 15 may erase the remaining number of uses from the storage method, etc. storage area in NVM 13 when the remaining number of uses of the public key becomes 0.

[0027] [2. Operation of IC chip 1] Next, the operation of the IC chip 1 according to this embodiment will be described.

[0028] (2-1. Operation of IC chip 1 when storing public key) First, the operation of the IC chip 1 when storing a public key will be described with reference to Fig. 3 and Fig. 4. Fig. 3 is a flowchart showing an example of a public key storage process executed by the CPU 15 of the IC chip 1. Fig. 4 is a flowchart showing an example of a remaining number of uses setting process for the public key executed by the CPU 15 of the IC chip 1.

[0029] The process shown in FIG. 3 is started when a command including a public key certificate is received from the external device 2, for example. The command is, for example, a PERFORM SECURITY OPERATION command, and is configured by a command APDU (Application Protocol Data Unit) including a header portion including CLA, INS, P1, and P2, and a body portion including Lc, Data, and Le. Here, a public key certificate (Certificate) is set in Data. Note that the PERFORM SECURITY OPERATION command may or may not use a certificate chain. When a certificate chain is used, multiple PERFORM SECURITY OPERATION commands are sequentially transmitted from the external device 2 to the IC chip 1. One public key certificate is set in Data of one PERFORM SECURITY OPERATION command. Also, P2 of one PERFORM SECURITY OPERATION command includes a flag indicating whether it is the last public key certificate or not, and a key identifier of the root public key.

[0030] 3 starts, the IC chip 1 verifies (signature verifies) the public key certificate included in the received command (step S1). Here, the first public key certificate received is verified using a root public key (PK.CA-KLOC.ECDSA) identified from the NVM 13 by a key identifier. If a certificate chain is used, the public key certificate received following the first public key certificate is verified using a public key (PK.KA-KLOC.ECDSA) extracted from the public key certificate received immediately before.

[0031] Next, the IC chip 1 determines whether or not the verification of the public key certificate has been successful (step S2). If it is determined that the verification of the public key certificate has not been successful (step S2: NO), error processing is performed (step S3). In the error processing, for example, a response indicating an error is transmitted to the external device 2. On the other hand, if it is determined that the verification of the public key certificate has been successful, for example, by decrypting the signature data with the public key (step S2: YES), the process proceeds to step S4.

[0032] In step S4, the IC chip 1 extracts the public key from the public key certificate included in the received command. Next, the IC chip 1 determines whether or not a storage method for the extracted public key is set (i.e., specified on the external device 2 side) in the public key certificate included in the received command (step S5). If it is determined that a storage method for the public key is set in the public key certificate (step S5: YES), the process proceeds to step S6. On the other hand, if it is determined that a storage method for the public key is not set in the public key certificate (step S5: NO), the process proceeds to step S7.

[0033] In step S6, the IC chip 1 acquires the public key storage method from the public key certificate, and proceeds to step S8. Meanwhile, in step S7, the IC chip 1 acquires the public key storage method from the storage method etc. storage area in NVM 13, and proceeds to step S8. In step S8, the IC chip 1 checks the storage method acquired in step S6 or step S7, and proceeds to processing according to the storage method. For example, if the storage method is (i), the processing proceeds to step S9. If the storage method is (ii), the processing proceeds to step S10. If the storage method is (iii), the processing proceeds to step S11.

[0034] In step S9, the IC chip 1 temporarily stores the public key extracted in step S4 in a public key storage area in RAM 12, and proceeds to step S12. In step S10, the IC chip 1 permanently stores the public key extracted in step S4 in a public key storage area in NVM 13, and proceeds to step S12. In step S11, the IC chip 1 stores the public key extracted in step S4 in a public key storage area in NVM 13, and proceeds to step S13.

[0035] In step S12, the IC chip 1 transmits a response to the PERFORM SECURITY OPERATION command to the external device 2. If a certificate chain is used, the IC chip 1 waits for the next PERFORM SECURITY OPERATION command to be received. If the received PERFORM SECURITY OPERATION command is the last PERFORM SECURITY OPERATION command, the process ends. In step S13, the IC chip 1 executes a process for setting the remaining number of uses of the public key stored in step S11.

[0036] 4, in the process of setting the remaining number of uses of the public key, the IC chip 1 determines whether or not an upper limit on the number of uses is set in the public key certificate included in the received command (i.e., specified by the external device 2) (step S131). If it is determined that an upper limit on the number of uses is set in the public key certificate (step S131: YES), the process proceeds to step S132. On the other hand, if it is determined that an upper limit on the number of uses is not set in the public key certificate (step S131: NO), the process proceeds to step S133.

[0037] In step S132, the IC chip 1 acquires the upper limit of the number of uses from the public key certificate, and the process proceeds to step S134. Meanwhile, in step S133, the IC chip 1 acquires the upper limit of the number of uses from the storage area of ​​the storage method, etc. in the NVM 13, and the process proceeds to step S134. In step S134, the IC chip 1 sets the same value as the upper limit of the number of uses acquired in step S132 or step S133 as the remaining number of uses of the public key stored in step S11, and stores the remaining number of uses in the storage area of ​​the storage method, etc. Then, returning to the process of FIG. 4, the IC chip 1 transmits a response to the PERFORM SECURITY OPERATION command to the external device 2 (step S14). Here, if a certificate chain is used, the process waits for reception of the next PERFORM SECURITY OPERATION command, as in step S12.

[0038] In addition, when a certificate chain is used, the storage method (i) is set in the public key certificates included in each of the PERFORM SECURITY OPERATION commands from the first PERFORM SECURITY OPERATION command to the PERFORM SECURITY OPERATION command just before the last PERFORM SECURITY OPERATION command, and the public key storage method is not set in the public key certificate included in the last PERFORM SECURITY OPERATION command, while the storage method (iii) is stored in the storage area for storage method, etc. in NVM 13. This makes it possible to store only the public key (PK.OCE.ECKA) extracted from the public key certificate included in the last PERFORM SECURITY OPERATION command in the public key storage area in NVM 13 according to the storage method (iii) stored in the storage area for storage method, etc. in NVM 13. In other words, the public key (PK.KA-KLOC.ECDSA) extracted from the public key certificate included in the intermediate PERFORM SECURITY OPERATION commands is temporarily stored in the public key storage area in RAM 12.

[0039] Alternatively, a configuration may be adopted in which no public key storage method is set in the public key certificate included in any of the PERFORM SECURITY OPERATION commands from the first PERFORM SECURITY OPERATION command through the one before the last PERFORM SECURITY OPERATION command, and the storage method (iii) is set in the public key certificate included in the last PERFORM SECURITY OPERATION command, while the storage method (i) is stored in the storage area for storage method, etc. in NVM 13. This makes it possible to store only the public key (PK.OCE.ECKA) extracted from the public key certificate included in the last PERFORM SECURITY OPERATION command in the public key storage area in NVM 13 in accordance with the storage method (iii) set in the public key certificate.

[0040] (2-2. Operation of IC chip 1 when using public key) Next, the operation of the IC chip 1 when a public key is used will be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of public key management processing executed by the CPU 15 of the IC chip 1. Fig. 6 is a flowchart showing an example of processing using a public key (secure channel establishment processing) executed by the CPU 15 of the IC chip 1. Note that, as a prerequisite for the operation of the IC chip 1 when a public key is used, it is assumed that the external device 2 has acquired the SD public key certificate (including the public key (PK.SD.ECKA)) from the IC chip 1 by the GET DATA command.

[0041] The process shown in Fig. 5 is started when a command to use the stored public key (PK.OCE.ECKA) is received from the external device 2. Such a command is, for example, a MUTUAL AUTHENTICATE command, and is configured by a command APDU including a header portion consisting of CLA, INS, P1, and P2, and a body portion consisting of Lc, Data, and Le. Here, Data is, for example, data conforming to SCP (Secure Channel Protocol) 11a, and includes the temporary public key (ePK.OCE.ECKA) generated by the external device 2. Note that when the public key (PK.OCE.ECKA) is stored using the storage method (i), a PERFORM SECURITY OPERATION command must be executed immediately before the MUTUAL AUTHENTICATE command. On the other hand, if the public key (PK.OCE.ECKA) is stored using the (ii) or (iii) storage method, the PERFORM SECURITY OPERATION command does not need to be executed immediately before the MUTUAL AUTHENTICATE command, and the public key (PK.OCE.ECKA) stored in NVM13 can be used in future secure channel sessions.

[0042] 5 is started, the IC chip 1 judges whether or not a target public key (PK.OCE.ECKA) (for example, a target identified by a key identifier) ​​is stored in the public key storage area in the RAM 12 (step S21). If it is judged that the target public key (PK.OCE.ECKA) is stored in the public key storage area in the RAM 12 (step S21: YES), the target public key (PK.OCE.ECKA) is extracted from the public key storage area in the RAM 12, and a process using the target public key (PK.OCE.ECKA) is executed (step S22). An example of the process in step S22 will be described later. On the other hand, if it is judged that the target public key (PK.OCE.ECKA) is not stored in the public key storage area in the RAM 12 (step S21: NO), the process proceeds to step S23.

[0043] In step S23, the IC chip 1 determines whether or not the target public key (PK.OCE.ECKA) is stored in the public key storage area in the NVM 13. If it is determined that the target public key (PK.OCE.ECKA) is not stored (step S23: NO), error processing is performed (step S24). In the error processing, for example, a response indicating an error is transmitted to the external device 2. On the other hand, if it is determined that the target public key (PK.OCE.ECKA) is stored (step S23: YES), the processing proceeds to step S25.

[0044] In step S25, the IC chip 1 determines whether or not the remaining number of uses of the target public key (PK.OCE.ECKA) is stored in the storage method, etc. storage area in NVM 13. If it is determined that the remaining number of uses of the target public key (PK.OCE.ECKA) is not stored (step S25: NO), the target public key (PK.OCE.ECKA) is retrieved from the public key storage area in NVM 13, and a process using the target public key (PK.OCE.ECKA) is executed (step S22). On the other hand, if it is determined that the remaining number of uses of the target public key (PK.OCE.ECKA) is stored (step S25: YES), the process proceeds to step S26.

[0045] In step S26, the IC chip 1 determines whether the remaining number of uses of the target public key (PK.OCE.ECKA) is 1 or more. If it is determined that the remaining number of uses of the target public key (PK.OCE.ECKA) is not 1 or more (i.e., 0) (step S26: NO), the process proceeds to step S27. On the other hand, if it is determined that the remaining number of uses of the target public key (PK.OCE.ECKA) is 1 or more (step S26: YES), the process proceeds to step S29.

[0046] In step S27, the IC chip 1 erases (deletes) the remaining number of uses of the target public key (PK.OCE.ECKA) from the storage method, etc. storage area in the NVM 13. Next, the IC chip 1 performs error processing (step S28). For example, even though the remaining number of uses is 0, the remaining number of uses has not been deleted, so a response indicating the error is sent to the external device 2.

[0047] In step S29, the IC chip 1 updates the remaining number of uses (current number) of the target public key (PK.OCE.ECKA) in the storage method etc. storage area in NVM 13 to a number obtained by subtracting 1. Next, the IC chip 1 retrieves the target public key (PK.OCE.ECKA) from the public key storage area in NVM 13, and executes a process that uses the target public key (PK.OCE.ECKA) (step S30). An example of the process in step S30 will be described later.

[0048] Next, the IC chip 1 determines whether the remaining number of uses of the target public key (PK.OCE.ECKA) is 1 or more (step S31). If it is determined that the remaining number of uses of the target public key (PK.OCE.ECKA) is not 1 or more (step S31: NO), the process proceeds to step S32. On the other hand, if it is determined that the remaining number of uses of the target public key (PK.OCE.ECKA) is 1 or more (step S31: YES), the process ends.

[0049] In step S32, the IC chip 1 erases the target public key (PK.OCE.ECKA) from the public key storage area in NVM 13. Next, the IC chip 1 erases the remaining number of uses of the target public key (PK.OCE.ECKA) from the storage method, etc. storage area in NVM 13 (step S33), and ends the process.

[0050] Next, in the process of step S22 or step S30, as shown in Fig. 6, the IC chip 1 generates a temporary key pair of the SD's temporary private key (eSK.SD.ECKA) and temporary public key (ePK.SD.ECKA) (step S101). Next, the IC chip 1 calculates a shared secret (ShSss) from the target public key (PK.OCE.ECKA) and the private key (SK.SD.ECKA) stored in the NVM 13 (step S102). Next, the IC chip 1 calculates a temporary shared secret (ShSee) from the temporary public key (ePK.OCE.ECKA) included in the MUTUAL AUTHENTICATE command and the temporary private key (eSK.SD.ECKA) generated in step S101 (step S103).

[0051] Next, the IC chip 1 generates a session key to be used in the secure channel from the shared secret (ShSss) generated in step S102 and the temporary shared secret (ShSee) generated in step S103 (step S104). Next, the IC chip 1 transmits a response including the temporary public key (ePK.SD.ECKA) generated in step S101 to the external device 2 (step S105). When the external device 2 receives the response from the IC chip 1, it generates a session key common to the IC chip 1 using the same algorithm as that of the IC chip 1. As a result, in this secure channel session, encrypted communication using the generated session key (i.e., communication involving encryption and decryption of messages) is performed between the external device 2 and the IC chip 1.

[0052] As described above, according to the above embodiment, when the IC chip 1 receives a public key certificate from the external device 2, it extracts a public key from the public key certificate, stores the extracted public key in NVM 13, and is configured to set the remaining number of times the extracted public key can be used. This makes it possible to prevent the public key extracted from the public key certificate and stored in NVM 13 from being used permanently, and therefore makes it possible to properly manage the stored public key.

[0053] Furthermore, according to the above embodiment, the storage method for the public key extracted from the public key certificate is stored in advance in the IC chip 1, and if the storage method for the public key is not set in the public key certificate (i.e., not specified on the external device 2 side), the extracted public key is stored in accordance with the storage method in the IC chip 1, thereby improving convenience for the provider or user of the IC chip 1.

[0054] In the above embodiment, the secure channel establishment process shown in FIG. 6 has been used as an example of the process using the public key extracted and stored from the public key certificate. However, the present invention can also be applied to processes using the public key other than the secure channel establishment process (e.g., processes such as signature verification and processes used to refer to the public key). [Explanation of symbols]

[0055] 1 IC chip 2 External device 11 I / O circuit 12 RAM ( 13 NVM 14 ROM 15 CPU 16 Coprocessors

Claims

1. An electronic information storage medium having a non-volatile memory, A receiving means for receiving a public key certificate from an external device; an extracting means for extracting a public key from the public key certificate received by the receiving means; a storage means for storing the public key extracted by the extraction means in the non-volatile memory; a setting means for setting the number of times the public key extracted by the extracting means can be used, the number being subtracted each time the public key is used; An electronic information storage medium comprising:

2. The electronic information storage medium further comprises a volatile memory; As a method for storing the public key, any one of a first storage method for temporarily storing the public key in the volatile memory, a second storage method for permanently storing the public key in the non-volatile memory, and a third storage method for storing the public key, the number of times of use of which is set, in the non-volatile memory is preset; 2. The electronic information storage medium according to claim 1, wherein the storage means stores the public key extracted by the extraction means in accordance with any one of the previously set storage methods.

3. The method further includes a determination unit for determining whether or not any one of the storage methods is set in the received public key certificate, The electronic information storage medium described in claim 2, characterized in that when it is determined that any one of the storage methods is set in the public key certificate, the storage means stores the public key extracted by the extraction means in accordance with the storage method set in the public key certificate rather than the previously set storage method.

4. 4. The electronic information storage medium according to claim 1, further comprising an erasure means for erasing the public key from the non-volatile memory when the number of times the public key can be used stored in the non-volatile memory becomes 0.

5. An IC chip having a non-volatile memory, A receiving means for receiving a public key certificate from an external device; an extracting means for extracting a public key from the public key certificate received by the receiving means; a storage means for storing the public key extracted by the extraction means in the non-volatile memory; a setting means for setting the number of times the public key extracted by the extracting means can be used, the number being subtracted each time the public key is used; An IC chip comprising:

6. An IC card having a non-volatile memory, A receiving means for receiving a public key certificate from an external device; an extracting means for extracting a public key from the public key certificate received by the receiving means; a storage means for storing the public key extracted by the extraction means in the non-volatile memory; a setting means for setting the number of times the public key extracted by the extracting means can be used, the number being subtracted each time the public key is used; An IC card comprising:

7. 1. A public key management method executed by an electronic information storage medium having a non-volatile memory, comprising: receiving a public key certificate from an external device; extracting a public key from the received public key certificate; storing the extracted public key in the non-volatile memory; setting a number of times the extracted public key can be used, the number being reduced each time the public key is used; 1. A method for managing a public key, comprising:

8. A computer included in an electronic information storage medium having a non-volatile memory, receiving a public key certificate from an external device; extracting a public key from the received public key certificate; storing the extracted public key in the non-volatile memory; setting a number of times the extracted public key can be used, the number being reduced each time the public key is used; A program characterized by executing the above.

Images