IC card

Abstract

To provide a portable electronic device capable of selecting an encryption method used for encryption processing from a plurality of encryption methods, and an IC card.SOLUTION: A portable electronic device includes an interface, a memory, and a processor. The interface communicates with an external device. The memory is provided with a storage area for storing data for executing encryption processing in each of a plurality of encryption methods for each encryption method. The processor selects one encryption method from the plurality of encryption methods, shares the selected encryption method with the external device, and executes processing using the encryption processing by the encryption method shared with the external device.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a portable electronic device and an IC card. [Background technology]

[0002] Conventionally, portable electronic devices such as IC cards are issued so that they can perform cryptographic processing using one cryptographic method that is pre-specified according to the system's operation policy. On the other hand, in recent years, there are more and more situations in which cryptographic processing using high-load cryptographic methods such as post-quantum cryptography is required to cope with the emergence of computers with high computing power such as quantum computers. Although post-quantum cryptography provides high security, it has a problem that it requires high processing load and calculation processing in an environment where high-speed processing is possible.

[0003] For this reason, even if an IC card compatible with post-quantum cryptography is issued, it is considered that in reality, it is often difficult for all IC card processing devices (IC card reader / writers) in the system to be used to support post-quantum cryptography. Also, depending on the security level required in actual operation, it may be sufficient to perform cryptographic processing using an encryption method with a light processing load, rather than cryptographic processing using a high-load encryption method such as post-quantum cryptography. In other words, even if an IC card as a portable electronic device is compatible with a high-load encryption method such as post-quantum cryptography, it is desired that it be able to perform low-load encryption processing depending on the situation.

[0004] Furthermore, when the communication state of an IC card as a portable electronic device with an IC card processing device becomes unstable, it may take a long time to execute a process that involves a large load, such as encryption processing. For example, a contactless IC card is prone to unstable communication with an IC card processing device, and it is likely that encryption processing or other processes will take a long time. If the processing time is longer than expected, the user may forcibly remove the IC card from the IC card processing device to stop the operation of the IC card. An IC card that is forcibly stopped during operation may have a problem in that data stored in the memory may be corrupted. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2017-126125 A Summary of the Invention [Problem to be solved by the invention]

[0006] In order to solve the above problems, the present invention provides a portable electronic device and an IC card that are capable of selecting an encryption method to be used for encryption processing from a plurality of encryption methods. [Means for solving the problem]

[0007] According to an embodiment, a portable electronic device includes an interface, a memory, and a processor. The interface communicates with an external device. The memory has a storage area for storing data for performing cryptographic processing in each of a plurality of cryptographic methods for each of the plurality of cryptographic methods. The processor selects one of the plurality of cryptographic methods, shares the selected cryptographic method with the external device, and performs processing using the cryptographic processing in the cryptographic method shared with the external device. [Brief description of the drawings]

[0008] [Figure 1]FIG. 1 is a block diagram showing an example of the configuration of an IC card as a portable electronic device according to an embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of the configuration of an IC card processing device that communicates with an IC card as a portable electronic device according to the embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example in which storage areas for a plurality of encryption methods are provided in the NVM of an IC card as a portable electronic device according to an embodiment. [Figure 4] FIG. 4 is a diagram showing a state in which data for a plurality of encryption methods is loaded into a RAM in an IC card as a portable electronic device according to an embodiment. [Diagram 5] FIG. 5 is a diagram showing an example of setting information used in a first operation example of an IC card as a portable electronic device according to the embodiment. [Figure 6] FIG. 6 is a flowchart for explaining the flow of a first operation example of an IC card as a portable electronic device according to the embodiment. [Figure 7] FIG. 7 is a diagram showing an example of setting information used in a second operation example of the IC card as the portable electronic device according to the embodiment. [Figure 8] FIG. 8 is a flowchart for explaining the flow of a registration process of setting information used in a second operation example of an IC card as a portable electronic device according to the embodiment. [Figure 9] FIG. 9 is a flowchart for explaining the flow of a second operation example of the IC card as the portable electronic device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 is a block diagram illustrating an example of the configuration of an IC card 1 according to an embodiment. An IC card 1 as a portable electronic device according to the embodiment constitutes an IC card processing system together with an IC card processing device 2 as an external device. The IC card 1 is a portable electronic device that is activated (made operable) by power supplied from the IC card processing device 2. The IC card 1 is also called a smart card.

[0010] The portable electronic device according to the embodiment is not limited to a card-like shape, and may be a booklet-like one (for example, a notebook such as a passport) having the same configuration and processing functions as the IC card 1 described later. The portable electronic device according to the embodiment may be a portable electronic device (for example, a smartphone, a mobile phone, a tablet PC, a dongle, etc.) having the same configuration and processing functions as the IC card 1 described later.

[0011] IC cards 1 can be broadly classified into contact-type IC cards and non-contact-type IC cards. For example, a contact-type IC card 1 is activated by receiving an operating power supply and an operating clock from an IC card processing device 2 via a contact section serving as a communication interface. A non-contact-type IC card 1 receives radio waves from the IC card processing device 2 via an antenna and a modulation / demodulation circuit serving as a communication interface, and is activated by generating an operating power supply and an operating clock from the radio waves.

[0012] As shown in Fig. 1, the IC card 1 has a main body C. The main body C is formed into a card shape from plastic or the like. The IC card 1 has a module M in the main body C. The module M is formed integrally with one or more IC chips Ca and an external interface for communication in a connected state, and is embedded in the main body C.

[0013] In addition, the portable electronic device of the embodiment may be one that has a module M in a main body C formed in a booklet shape, or one that has a module M inside a main body C that forms a portable electronic device.

[0014] In the configuration example shown in FIG. 1, a module M of an IC card 1 includes a processor 11, a RAM 12, a ROM 13, an NVM 14, a communication control unit 15, an interface 16, and the like. The processor 11 includes circuits that execute various processes. The processor 11 is, for example, a CPU (Central Processing Unit). The processor 11 controls the entire IC card 1. The processor 11 executes programs stored in the ROM 13 or the NVM 14 to realize various processing functions. However, some or all of the various functions executed by the processor 11, which will be described later, may be realized by a hardware circuit.

[0015] The RAM 12 is a volatile memory that functions as a working memory. The RAM 12 also functions as a buffer that temporarily stores data being processed by the processor 11. For example, the RAM 12 functions as a communication buffer that temporarily stores data to be transmitted to and received from the IC card processing device 2 via the communication control unit 15 and the interface 16.

[0016] The ROM 13 is a non-volatile memory that functions as a program memory. The ROM 13 stores control programs and control data in advance. The ROM 13 is built into the IC card 1 in a state in which the control programs and control data are stored during the manufacturing stage. In other words, the control programs and control data stored in the ROM 13 are built in advance according to the specifications of the IC card 1. For example, the ROM 13 stores a program for the processor 11 to execute processing in response to a command received from the IC card processing device 2.

[0017] The NVM 14 is a non-volatile memory to which data can be written and rewritten. The NVM 14 is configured, for example, with an EEPROM (registered trademark) (Electrically Erasable Programmable Read Only Memory) or a flash ROM. In addition, the NVM 14 has a storage area in which some or all of the area is tamper-resistant and data can be securely stored.

[0018] In the NVM 14, programs and various data according to the operational use of the IC card 1 are written. In the NVM 14, program files or data files are defined, and programs and various data are written in those files. For example, the NVM 14 is provided with a storage area for storing encryption processing programs and encryption processing data such as key data for each of a plurality of encryption methods. The NVM 14 also stores user data, data for network authentication for communicating with an external network, and application programs for executing various processes.

[0019] The communication control unit 15 is connected to the interface 16. The interface 16 is an interface for communication connection to an external device. The communication control unit 15 and the interface 16 constitute a communication unit. The communication control unit 15 and the interface 16 realize a communication function by a communication method corresponding to the interface of the IC card processing device 2. In addition, the communication control unit 15 and the interface 16 may be configured to support multiple communication methods (for example, contact communication and contactless communication).

[0020] When the IC card 1 is realized as a contact-type IC card, the communication control unit 15 and the interface 16 constitute a communication unit that contacts and communicates with the IC card processing device 2. In this case, the interface 16 is constituted by a contact unit that makes physical and electrical contact with a contact unit of the IC card processing device 2, and the communication control unit 15 is constituted by a circuit that controls the transmission and reception of signals via the contact unit.

[0021] Furthermore, when the IC card 1 is realized as a contactless IC card, the communication control unit 15 and the interface 16 constitute a communication unit that communicates contactlessly (wirelessly) with a card reader / writer of the IC card processing device 2. In this case, the interface 16 is constituted by an antenna that transmits and receives radio waves, and the communication control unit 15 is constituted by a modulation circuit for generating radio waves to be transmitted and a demodulation circuit for generating a signal from the received radio waves.

[0022] FIG. 2 is a block diagram illustrating an example of the configuration of the IC card processing device 2 according to the embodiment. 2, the IC card processing device 2 is a device (R / W) having a function of communicating with the IC card 1 via a card reader / writer 24. The IC card processing device 2 may be, for example, a device in which the card reader / writer 24 is connected to a control device such as a personal computer (PC).

[0023] As shown in FIG. 2, the IC card processing device 2 includes a control unit 21, a display unit 22, an operation unit 23, a card reader / writer 24, and the like. The control unit 21 controls the operation of the entire IC card processing device 2. The control unit 21 is composed of a processor (CPU) 25, RAM 26, ROM 27, non-volatile memory 28, communication unit 29, etc. For example, the control unit 21 is composed of a personal computer. The processor 25 executes various processes by executing programs stored in the ROM 27 or non-volatile memory 28. The RAM 26 functions as a working memory that temporarily holds data. The ROM 27 is a non-volatile memory that stores programs, control data, etc. The non-volatile memory 28 is a rewritable non-volatile memory. The communication unit 29 is an interface for communicating with an external device.

[0024] The control unit 21 has a function of transmitting commands to the IC card 1 via the card reader / writer 24, a function of performing various processes based on data received from the IC card 1, and the like. For example, the control unit 21 controls writing of data to a non-volatile memory in the IC card 1 by transmitting a data write command to the IC card 1 via the card reader / writer 24. The control unit 21 also controls reading of data from the IC card 1 by transmitting a read command to the IC card 1. The control unit 21 also controls an application selected in the IC card 1 by transmitting an application selection command to the IC card 1.

[0025] The display unit 22 is a display device that displays various information under the control of the control unit 21. The operation unit 23 is composed of a keyboard, a numeric keypad, a pointing device, etc. The operation unit 23 is used by an operator of the IC card processing device 2 to input various operation instructions, data, etc. The operation unit 23 also functions as an input unit for inputting identification information of the user of the IC card 1 or authentication information such as a password.

[0026] The card reader / writer 24 is a communication unit (second communication unit) for communicating with the IC card 1. The card reader / writer 24 is configured with an interface according to the communication method of the IC card 1. For example, if the IC card 1 is a contact type IC card, the card reader / writer 24 is configured with a contact unit for physically and electrically connecting to a contact unit of the IC card 1. If the IC card 1 is a non-contact type IC card, the card reader / writer 24 is configured with an antenna for wireless communication with the IC card 1 and communication control. The card reader / writer 24 supplies power, supplies a clock, performs reset control, and transmits and receives data to the IC card 1. The card reader / writer 24 activates (starts up) the IC card 1, transmits various commands, and receives responses to the transmitted commands, based on the control by the control unit 21.

[0027] Next, the structure of a file for storing data in the NVM 14 of the IC card 1 according to the embodiment will be described. The NVM 14 in the IC card 1 stores data in each file having a file structure defined, for example, in ISO / IEC 7816-4, an international standard for IC cards. In this defined file structure, a group of files having a hierarchical structure including a Master File (MF), a Dedicated File (DF), and an Elementary File (EF) are defined.

[0028] The MF is at the top level, and one or more DFs are defined at the next level below the MF, and one or more EFs are defined at the next level below the DF. A single DF stores, for example, a set of data for implementing one application provided in the IC card 1. In an IC card 1 that implements multiple functions through multiple applications, multiple DFs corresponding to each application are provided in the NVM 14. Each EF under a DF is a data file for storing various data used for an application serving as a DF at a higher level.

[0029] Fig. 3 is a diagram showing a schematic diagram of a storage area for each of a plurality of encryption methods provided in the NVM 14 of the IC card 1 according to the embodiment, and Fig. 4 is a diagram showing a schematic diagram of a storage area for each of a plurality of encryption methods loaded into the RAM 12 of the IC card 1 according to the embodiment. The IC card 1 according to the embodiment supports a plurality of encryption methods and has a function of executing processes such as verification (authentication) using encryption processing of an encryption method selected from the plurality of encryption methods. For this purpose, a storage area for each of the plurality of encryption methods is provided in the NVM 14 of the IC card 1. Fig. 3 shows an example in which a storage area for storing data used for encryption processing of the three encryption methods is provided in the storage area of ​​the NVM 14 when the IC card 1 supports three encryption methods. As shown in Fig. 4, the IC card 1 becomes able to execute encryption processing of each encryption method by loading the data of the three encryption methods stored in the NVM 14 shown in Fig. 3 into the RAM 12.

[0030] The IC card 1 supports multiple encryption methods, such as quantum-poster cryptography, RSA, and DES (Data Encryption Standard). Quantum-poster cryptography is a general term for encryption methods that are considered difficult to decrypt even using a quantum computer. Quantum-poster cryptography includes, for example, lattice cryptography. RSA is one of the algorithms for data encryption using public key cryptography. DES is one of the algorithms for data encryption using common key cryptography.

[0031] Encryption methods such as post-quantum cryptography, RSA, and DES differ in the amount of calculation (processing load) required to execute encryption processing, and in encryption strength (security level). In general, the amount of calculation required for encryption processing increases in the order of post-quantum cryptography, RSA, and DES, and the encryption strength also increases in the order of post-quantum cryptography, RSA, and DES. Even if the encryption method is the same type, the amount of calculation and encryption strength of the encryption processing differ depending on parameters such as the length of key data used in the encryption processing. For this reason, in this embodiment, multiple encryption methods include not only encryption methods of different types, but also encryption methods of the same type but with different lengths of key data used in the encryption processing.

[0032] Next, a first operation example will be described in which the IC card 1 serving as the portable electronic device according to the embodiment selects one encryption method from a plurality of encryption methods and executes encryption processing. FIG. 5 is a diagram showing an example of setting information for selecting an encryption method to be stored in the NVM 14 of the IC card 1 operating in the first operation example. The IC card 1 operating in the first operation example stores setting information for selecting one encryption method from a plurality of encryption methods included in the IC card 1 in a memory such as the NVM 14. In the setting information for selecting an encryption method, a selection order is set for a plurality of encryption methods supported (included) by the IC card 1. In the example of setting information shown in Fig. 5, it is assumed that the IC card 1 supports three encryption methods, namely, post-quantum encryption, RSA, and DES, and the selection order is set in the order of post-quantum encryption, RSA, and DES.

[0033] When the IC card 1 in the first operation example communicates with the IC card processing device 2, it identifies an encryption method that the IC card processing device 2 allows (supports) in order to execute processing including encryption processing. In this embodiment, it is assumed that the encryption method used for encryption processing is not uniquely set for the IC card processing device 2 with which the IC card 1 communicates. In other words, in the embodiment, it is assumed that the encryption method allowed by the IC card processing device 2 with which the IC card 1 communicates (encryption method that the IC card processing device 2 can execute) differs depending on the IC card processing device 2 or the processing that the IC card processing device 2 is to execute.

[0034] When the IC card 1 identifies an encryption method permitted by the IC card processing device 2, it selects one encryption method from among the encryption methods permitted by the IC card processing device 2 in accordance with the selection priority set by the setting information as shown in Fig. 5. This allows the IC card 1, which has multiple encryption methods, to select one encryption method from among the encryption methods permitted (supported) by the IC card processing device 2, and to perform encryption processing using the selected encryption method.

[0035] The selection order for multiple encryption methods is set, for example, in the order of security level. If the selection order is set in the order of highest security level, the IC card 1 can execute encryption processing using an encryption method with a highest security level among the encryption methods permitted by the IC card processing device 2. The selection order for multiple encryption methods may also be set in the order of the estimated processing time required for the encryption processing. If the selection order is set in the order of shortest processing time required for the encryption processing, the IC card 1 can execute encryption processing using an encryption method with the shortest processing time among the encryption methods permitted by the IC card processing device 2.

[0036] Next, a first operation example will be described in which the IC card 1 according to the embodiment selects one encryption method from a plurality of encryption methods and executes encryption processing. FIG. 6 is a flowchart for explaining the flow of a first operation example of the IC card 1 as the portable electronic device according to the embodiment. The IC card 1 is communicatively connected to the IC card processing device 2 via an interface 16 by a communication control unit 15. When the processor 11 of the IC card 1 is communicatively connected to the IC card processing device 2, the processor 11 obtains, from the IC card processing device 2, information indicating an encryption method permitted by the IC card processing device 2.

[0037] For example, the IC card processing device 2 notifies the IC card 1 of information indicating executable encryption methods as permitted encryption methods. As a specific example, if the IC card processing device 2 does not support post-quantum cryptography and supports RSA and DES, the IC card processing device 2 notifies the IC card 1 of information indicating that the permitted encryption methods are RSA and DES.

[0038] Furthermore, the IC card processing device 2 may specify an allowed encryption method according to a security level required for the process to be executed. As a specific example, when the IC card processing device 2 is about to execute a process that requires post-quantum cryptography or RSA encryption processing, it notifies the IC card 1 of information indicating that the allowed encryption method is post-quantum cryptography or RSA. Furthermore, when an IC card processing device 2 that does not support post-quantum cryptography is about to execute a process that requires post-quantum cryptography or RSA encryption processing, the IC card processing device 2 may notify the IC card 1 of information indicating that the allowed encryption method is RSA.

[0039] When the processor 11 of the IC card 1 receives information indicating an allowed encryption method from the IC card processing device 2, it specifies the encryption method allowed by the IC card processing device (hereinafter also referred to as terminal) 2 (step ST11). When the processor 11 of the IC card 1 identifies an encryption method permitted by the IC card processing device 2, the processor 11 selects one encryption method from the encryption methods permitted by the IC card processing device 2. In a first operation example, the processor 11 selects one encryption method from the encryption methods permitted by the IC card processing device 2 in accordance with the selection order set in the setting information as shown in FIG.

[0040] When the processor 11 of the IC card 1 identifies the encryption methods permitted by the IC card processing device 2, it determines whether the IC card processing device 2 is incompatible with the first encryption method, which is the first encryption method in the selection order (step ST12). In other words, the processor 11 determines whether the encryption methods permitted by the IC card processing device 2 include the first encryption method.

[0041] If the encryption methods permitted by the IC card processing device 2 include the first encryption method, the processor 11 of the IC card 1 determines that the IC card processing device 2 supports the first encryption method (step ST12, NO). If the IC card processing device 2 supports the first encryption method (step ST12, NO), the processor 11 selects the first encryption method as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST13).

[0042] If the encryption methods permitted by the IC card processing device 2 do not include the first encryption method, the processor 11 of the IC card 1 determines that the IC card processing device 2 is incompatible with the first encryption method (step ST12, YES). If the IC card processing device 2 is incompatible with the first encryption method (step ST12, YES), the processor 11 determines whether the IC card processing device 2 is incompatible with the second encryption method, which is second in the selection order (step ST14). In other words, the processor 11 determines whether the encryption methods permitted by the IC card processing device 2 include the second encryption method.

[0043] If the second encryption method is included in the encryption methods permitted by the IC card processing device 2, the processor 11 of the IC card 1 determines that the IC card processing device 2 supports the second encryption method (step ST14, NO). If the IC card processing device 2 supports the second encryption method (step ST14, NO), the processor 11 selects the second encryption method as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST15).

[0044] If the second encryption method is not included in the encryption methods permitted by the IC card processing device 2, the processor 11 of the IC card 1 determines that the IC card processing device 2 is incompatible with the second encryption method (step ST14, YES). If the IC card processing device 2 is incompatible with the second encryption method (step ST14, YES), the processor 11 determines whether the IC card processing device 2 is incompatible with the third encryption method, which is the third encryption method in the selection order (step ST16). In other words, the processor 11 determines whether the third encryption method is included in the encryption methods permitted by the IC card processing device 2.

[0045] If the encryption methods permitted by the IC card processing device 2 include the third encryption method, the processor 11 of the IC card 1 determines that the IC card processing device 2 supports the third encryption method (step ST16, NO). If the IC card processing device 2 supports the third encryption method (step ST16, NO), the processor 11 selects the third encryption method as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST13).

[0046] If the third encryption method is not included in the encryption methods permitted by the IC card processing device 2, the processor 11 of the IC card 1 determines that the IC card processing device 2 does not support the third encryption method (step ST16, YES). If the IC card processing device 2 does not support the third encryption method (step ST16, YES), the processor 11 determines that there is no encryption method supported by the IC card processing device 2 if the IC card 1 does not have an encryption method ranked fourth or higher in the selection order.

[0047] When the processor 11 of the IC card 1 determines that the IC card processing device 2 does not support an encryption method, it notifies the IC card processing device 2 of the absence of a corresponding encryption method (step ST18). In this case, the processor 11 of the IC card 1 ends the communication process with the IC card processing device 2 because it cannot perform mutual authentication with the IC card processing device 2 using encryption processing.

[0048] When the processor 11 of the IC card 1 selects one of the encryption methods permitted by the IC card processing device 2, it shares the selected encryption method with the IC card processing device 2 (step ST19). For example, when the processor 11 selects post-quantum cryptography from the encryption methods permitted by the IC card processing device 2, it notifies the IC card processing device 2 that it will execute encryption processing using post-quantum cryptography. When the processor 11 shares the selected encryption method with the IC card processing device 2, it executes processing including encryption processing using the selected encryption method in response to a command from the IC card processing device 2 (step ST20).

[0049] As described above, the IC card as a portable electronic device according to the first operation example has a plurality of encryption methods, selects one encryption method from among the encryption methods permitted by the IC card processing device, and executes communication processing with the IC card processing device by encryption processing using the selected encryption method. Also, the IC card as a portable electronic device according to the first operation example stores setting information indicating a selection order for the plurality of encryption methods in a memory, and selects one encryption method from among the encryption methods permitted by the IC card processing device according to the selection order.

[0050] As a result, according to the first operation example, the IC card as a portable electronic device can select an encryption method permitted by the IC card processing device from among a plurality of encryption methods and perform encryption processing. Also, even if all IC card processing devices (potential communication partners) in the entire system do not support a specific encryption method, the IC card can perform encryption processing using an encryption method selected from the encryption methods supported by each IC card processing device.

[0051] Furthermore, according to the first operation example, an IC card as a portable electronic device can not only perform cryptographic processing using a high-security, high-load cryptographic method such as quantum-resistant cryptography required by some IC card processing devices or specific processes, but can also selectively perform cryptographic processing with IC card processing devices that do not support high-load cryptographic methods, or cryptographic processing using a high-speed cryptographic method with a light processing load when high-load cryptographic processing is not required.

[0052] Next, a second operation example will be described in which the IC card 1 according to the embodiment selects an encryption method from a plurality of encryption methods according to communication conditions and executes encryption processing. In the second operation example, the IC card 1 is a contactless IC card. When the IC card 1, which is a contactless IC card, communicates with the IC card processing device 2 (card reader / writer 24), it measures the strength of the magnetic field generated between the interface 16 and the card reader / writer 24.

[0053] That is, the processor 11 (or the communication control unit 15) of the IC card 1 operating in the second operation example has a function of identifying the magnetic field strength generated in the interface 16. For example, the IC card 1 may further include a sensor for measuring the magnetic field strength, and the processor 11 may acquire the magnetic field strength detected by the sensor. The processor 11 may also measure the magnetic field strength based on the state (damage status) of the data from the IC card processing device. However, the method by which the processor 11 acquires the magnetic field strength is not limited to a specific method.

[0054] FIG. 7 is a diagram showing setting information for selecting one encryption method by the IC card stored in the NVM 14 of the IC card 1 operating in the second operation example. The IC card 1 operating in the second operation example stores setting information in a memory such as the NVM 14 for selecting one encryption method from a plurality of encryption methods included in the IC card 1 according to the magnetic field strength. In the example of setting information shown in Fig. 7, it is assumed that the IC card 1 supports three encryption methods, namely, post-quantum cryptography (first encryption method), RSA (second encryption method), and DES (third encryption method). For each encryption method, a magnetic field strength range and a magnetic field strength confirmation level required for executing encryption processing are set.

[0055] In the example shown in Fig. 7, the magnetic field strength range for quantum-resistant cryptography is 7.5 to 5.0 (A / m), and the magnetic field strength confirmation level is set to a strong magnetic field. The magnetic field strength range for RSA is 7.5 to 3.0 (A / m), and the magnetic field strength confirmation level is set to a medium magnetic field. The magnetic field strength range for DES is 7.5 to 1.5 (A / m), and the magnetic field strength confirmation level is set to a weak magnetic field.

[0056] When communicating with the card reader / writer 24 of the IC card processing device 2, the IC card 1 acquires the magnetic field strength generated in the interface 16. When the IC card 1 acquires the magnetic field strength, it selects an encryption method based on the magnetic field strength. For example, the processor 11 of the IC card 1 selects one encryption method in descending order of magnetic field strength confirmation level in the setting information as shown in Fig. 7. This allows the IC card 1, which has multiple encryption methods, to select one encryption method according to the magnetic field strength and execute encryption processing using the selected encryption method.

[0057] According to the setting example shown in Fig. 7, when the magnetic field strength is 5.0 (A / m) or more, the IC card 1 determines that the magnetic field strength confirmation level is a strong magnetic field, and selects post-quantum cryptography as the encryption method. When the magnetic field strength is less than 5.0 (A / m) and greater than or equal to 3.0 (A / m), the IC card 1 determines that the magnetic field strength confirmation level is a medium magnetic field, and selects RSA as the encryption method. When the magnetic field strength range is less than 3.0 (A / m) and 1.5 (A / m), the IC card 1 determines that the magnetic field strength confirmation level is a weak magnetic field, and selects DES as the encryption method. This allows the IC card 1 to select an encryption method with more complex encryption processing and a higher security level the stronger the magnetic field is.

[0058] The IC card 1 may select one encryption method according to the magnetic field strength from among the encryption methods permitted by the IC card processing device 2. The IC card 1 is not limited to selecting encryption methods in order of increasing magnetic field confirmation level strength or increasing security level, so long as the magnetic field strength is within the magnetic field strength range and the encryption method is supported (allowed) by the IC card processing device 2. For example, the IC card 1 may select encryption methods in order of shortest processing time required for encryption processing from among the encryption methods permitted by the IC card processing device 2, so long as the magnetic field strength is within the magnetic field strength range.

[0059] FIG. 8 is a flowchart for explaining a process for registering, in the IC card 1, setting information for selecting an encryption method depending on the magnetic field strength. For example, in the IC card 1 according to the second operation example, setting information for selecting an encryption method is registered in a process for making the IC card operable (IC card issuing process). In the IC card issuing process, the processor 11 of the IC card 1 creates a data file (EF) for magnetic field strength confirmation for the multiple encryption methods provided in the IC card 1 (step ST41). For example, the processor 11 stores information indicating a magnetic field strength confirmation level to be set for each encryption method in the EF for magnetic field strength confirmation.

[0060] When the processor 11 of the IC card 1 creates the EF for magnetic field strength confirmation, it sets the magnetic field strength range in which encryption processing can be executed for each encryption method (step ST42). For example, the processor 11 stores information indicating the magnetic field strength range in which encryption processing can be executed for each encryption method.

[0061] After setting the magnetic field strength range for each encryption method, the processor 11 judges whether the magnetic field strength range has been set for all encryption methods (step ST43). If there is an encryption method for which the magnetic field strength range has not been set among the encryption methods provided in the IC card 1 (step ST43, NO), the processor 11 returns to step ST42 and sets the magnetic field strength range for the encryption method for which the magnetic field strength range has not been set. If the magnetic field strength range has been set for all encryption methods provided in the IC card 1 (step ST43, YES), the processor 11 ends the registration of the setting information for selecting an encryption method according to the magnetic field strength.

[0062] Next, a flow of a second operation example in which the IC card 1 according to the embodiment selects one encryption method from a plurality of encryption methods in accordance with the magnetic field strength will be described. FIG. 9 is a flowchart for explaining the flow of a second operation example of the IC card 1 as the portable electronic device according to the embodiment. When the processor 11 of the IC card 1 is communicatively connected to the card reader / writer 24 of the IC card processing device 2 via the interface 16, the processor 11 acquires information indicating the magnetic field strength generated at the interface 16 (step ST51).

[0063] If the magnetic field strength generated in the interface 16 is 0, that is, if the magnetic field strength cannot be acquired (step ST52, NO), the processor 11 of the IC card 1 determines that the magnetic field strength is 0. If the magnetic field strength generated in the interface 16 is 0, the IC card 1 does not operate because it cannot obtain power for operation from the magnetic field. In this case, the IC card 1 does not respond to the IC card processing device 2, and the process ends after a predetermined time has elapsed as a timeout.

[0064] Furthermore, when the processor 11 of the IC card 1 is able to acquire the magnetic field strength generated in the interface 16 (step ST52, YES), it determines the magnetic field strength confirmation level based on the acquired magnetic field strength. Here, it is assumed that the magnetic field strength confirmation levels are set in order of the largest minimum value of the magnetic field strength range. Furthermore, the magnetic field strength range when the magnetic field strength confirmation level is a strong magnetic field is set as the first magnetic field strength range, the magnetic field strength range when the magnetic field strength confirmation level is a medium magnetic field is set as the second magnetic field strength range, and the magnetic field strength range when the magnetic field strength confirmation level is a weak magnetic field is set as the third magnetic field strength range.

[0065] For example, according to the setting information shown in FIG. 7, the processor 11 determines that if the magnetic field strength is 5.0 (A / m) or more, the magnetic field strength confirmation level is a strong magnetic field, which is within the first magnetic field strength range, if the magnetic field strength is 5.0 to 3.0 (A / m) or more, the processor 11 determines that the magnetic field strength confirmation level is a medium magnetic field, which is within the second magnetic field strength range, and if the magnetic field strength is 3.0 to 1.5 (A / m) or more, the processor 11 determines that the magnetic field strength confirmation level is a weak magnetic field, which is within the third magnetic field strength range.

[0066] When the processor 11 of the IC card 1 acquires the magnetic field strength generated in the interface 16, it determines whether or not the magnetic field strength is outside the first magnetic field strength range, which is the magnetic field strength range in which the magnetic field strength confirmation level is determined to be a strong magnetic field (step ST53). If the magnetic field strength is within the first magnetic field strength range (step ST53, NO), the processor 11 selects an encryption method (first encryption method) in which the magnetic field strength confirmation level is set to a strong magnetic field as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST54).

[0067] If the magnetic field strength is outside the first magnetic field strength range (step ST53, YES), the processor 11 of the IC card 1 determines whether the magnetic field strength is outside the second magnetic field strength range, which is a magnetic field strength range in which the magnetic field strength confirmation level is determined to be a medium magnetic field (step ST55). If the magnetic field strength is within the second magnetic field strength range (step ST55, NO), the processor 11 selects an encryption method (second encryption method) in which the magnetic field strength confirmation level is set to a medium magnetic field as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST56).

[0068] If the magnetic field strength is outside the second magnetic field strength range (step ST55, YES), the processor 11 of the IC card 1 determines whether the magnetic field strength is outside the third magnetic field strength range, which is the magnetic field strength range in which the magnetic field strength confirmation level is determined to be a weak magnetic field (step ST57). If the magnetic field strength is within the third magnetic field strength range (step ST57, NO), the processor 11 selects an encryption method (third encryption method) in which the magnetic field strength confirmation level is set to a weak magnetic field as the encryption method to be used for encryption processing with the IC card processing device 2 (step ST58).

[0069] If the magnetic field strength is outside the third magnetic field strength range (step ST57, YES), the processor 11 of the IC card 1 determines that the magnetic field strength is insufficient since the magnetic field strength is outside the magnetic field strength ranges of all encryption methods. When the processor 11 determines that the magnetic field strength is insufficient, it notifies the IC card processing device 2 that the magnetic field strength is insufficient (step ST59). In this case, the processor 11 of the IC card 1 ends the communication process with the IC card processing device 2 because the encryption process cannot be executed due to the insufficient magnetic field strength. When the control unit 21 of the IC card processing device 2 receives a message from the IC card 1 that the magnetic field strength is insufficient, the control unit 21 may display on the display unit 22 a guide for encouraging the user to adjust the communication environment.

[0070] When the processor 11 of the IC card 1 selects one encryption method based on the magnetic field strength, it notifies the IC card processing device 2 of information indicating the selected encryption method (step ST60). After notifying the IC card processing device 2 of the selected encryption method, the IC card 1 determines whether the encryption method selected by the IC card processing device 2 is supported based on the information from the IC card processing device 2 (step ST61).

[0071] For example, when the control unit 21 of the IC card processing device 2 receives information indicating the encryption method selected by the IC card 1, the control unit 21 checks whether encryption processing is possible using the encryption method selected by the IC card 1. If encryption processing is possible using the encryption method selected by the IC card 1 (if the encryption method is supported), the control unit 21 of the IC card processing device 2 transmits to the IC card 1 a message indicating that encryption processing will be performed using the selected encryption method.

[0072] As a result, the IC card 1 and the IC card processing device 2 share the encryption method selected by the IC card 1 in response to the magnetic field strength. When the processor 11 of the IC card 1 shares with the IC card processing device 2 that encryption processing is possible using the selected encryption method, the processor 11 executes processing including encryption processing using the selected encryption method in response to a command from the IC card processing device 2 (step ST62).

[0073] In addition, if encryption processing using the encryption method selected by the IC card 1 is not possible (if the IC card 1 is not compatible with the selected encryption method) (step ST61, NO), the control unit 21 of the IC card processing device 2 transmits a message to the IC card 1 indicating that encryption processing using the selected encryption method is not possible.

[0074] The processor 11 of the IC card 1 determines that the IC card processing device 2 is incompatible with the encryption method selected based on the magnetic field strength upon receiving a notification from the IC card processing device 2 that the selected encryption method is incompatible (step ST61, NO). If the IC card processing device 2 is incompatible with the encryption method selected according to the magnetic field strength (step ST61, NO), the processor 11 changes the selection of the encryption method (step ST63). After changing the selection of the encryption method, the processor 11 of the IC card 1 returns to step ST60 and executes the above-mentioned process.

[0075] For example, according to the setting example shown in Figure 7, if the IC card processing device 2 is not compatible with the first encryption method selected when the magnetic field strength confirmation level is a strong magnetic field, the processor 11 changes the selection of the encryption method to the second encryption method, the magnetic field confirmation level of which is set to a medium magnetic field.

[0076] Furthermore, if the IC card processing device 2 does not support the selected encryption method, and if the selection of the encryption method cannot be changed, the processor 11 of the IC card 1 proceeds to step ST59 to notify the IC card processing device 2 of insufficient magnetic field strength. For example, according to the setting example shown in Fig. 7, if the IC card processing device 2 does not support the third encryption method selected when the magnetic field strength confirmation level is a weak magnetic field, the processor 11 cannot change the selection of the encryption method to be used in the encryption process, so notifies the IC card processing device 2 of insufficient magnetic field strength and ends the communication process.

[0077] In the IC card according to the embodiment, the process of selecting one encryption method from a plurality of encryption methods according to the magnetic field strength is not limited to the above-mentioned procedure. For example, the IC card may implement the above-mentioned second operation example and the first operation example in combination. In the second operation example shown in FIG. 9, it is determined whether the IC card processing device supports the encryption method selected according to the magnetic field strength, but as described in the first operation example, it is also possible to specify the encryption methods permitted by the IC card processing device 2 and then select an encryption method according to the magnetic field strength from the encryption methods permitted by the IC card processing device 2.

[0078] As described above, the IC card as a portable electronic device according to the second operation example has a plurality of encryption methods, selects one of the plurality of encryption methods according to the communication state with the IC card processing device, and executes communication processing with the IC card processing device by encryption processing with the selected encryption method. The IC card as a portable electronic device according to the second operation example is a contactless IC card, and selects one encryption method according to the magnetic field strength generated in the interface. The IC card as a portable electronic device according to the second operation example stores setting information indicating the magnetic field strength ranges for the plurality of encryption methods in a memory, and selects one encryption method according to the magnetic field strength generated in the interface.

[0079] According to the second operation example, the IC card as a portable electronic device can select an encryption method from a plurality of encryption methods according to communication conditions such as magnetic field strength, and perform encryption processing. As a result, even when a specific encryption method is not being executed, the IC card can perform encryption processing using the encryption method according to the magnetic field strength.

[0080] Furthermore, according to the second operation example, even if an IC card as a portable electronic device has a function for performing cryptographic processing using a high-security, high-load encryption method such as quantum-resistant cryptography, if the magnetic field strength is outside a predetermined magnetic field strength range, it can be configured to perform cryptographic processing using an encryption method corresponding to the magnetic field strength.

[0081] The functions described in the above embodiments can be realized not only by hardware but also by software, by loading a program that describes each function into a computer. Also, each function may be realized by selecting either software or hardware as appropriate.

[0082] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0083] 1...IC card (portable electronic device), C...main body, Ca...IC chip, M...module, 2...IC card processing device (external device), 11...processor, 12...RAM, 13...ROM, 14...non-volatile memory, 15...communication control unit, 16...interface, 21...control unit, 22...display unit, 23...operation unit, 24...card reader / writer.

Claims

1. an interface for communicating with an external device; a memory having a storage area for storing data for executing encryption processing in each of a plurality of encryption methods; a processor that selects one encryption method from the plurality of encryption methods, shares the selected encryption method with the external device, and executes a process using encryption processing according to the encryption method shared with the external device; A portable electronic device comprising:

2. the memory further stores information indicating a selection order for selecting one encryption method from the plurality of encryption methods; the processor selects one encryption method from among the encryption methods permitted by the external device in accordance with the selection order; 2. The portable electronic device of claim 1.

3. The processor selects one encryption method depending on a communication state with the external device through the interface.

2. The portable electronic device of claim 1.

4. the interface is an interface for performing non-contact communication using a magnetic field, the memory stores information indicating a magnetic field strength range for each of the plurality of encryption methods; The processor acquires information indicating a magnetic field strength generated in the interface, and selects one encryption method from among encryption methods in which the acquired magnetic field strength falls within a magnetic field strength range.

4. The portable electronic device of claim 3.

5. the processor selects encryption methods in order of decreasing minimum value of the magnetic field strength range from encryption methods in which the magnetic field strength generated at the interface falls within the magnetic field strength range; 5. The portable electronic device of claim 4.

6. When the external device is incompatible with the selected encryption method, the processor changes the selection to another encryption method in which the magnetic field strength generated at the interface falls within a magnetic field strength range.

5. The portable electronic device of claim 4.

7. the processor notifies the external device of insufficient magnetic field strength when there is no encryption method in which the magnetic field strength generated at the interface falls within the magnetic field strength range; 5. The portable electronic device of claim 4.

8. The plurality of cryptographic methods include a post-quantum cryptographic method and a non-post-quantum cryptographic method, A portable electronic device according to any one of the preceding claims.

9. a module having an interface for communicating with an IC card processing device, a memory having a storage area for storing data for executing cryptographic processing in each of a plurality of cryptographic methods, and a processor for selecting one cryptographic method from the plurality of cryptographic methods, sharing the selected cryptographic method with the IC card processing device, and executing processing using cryptographic processing in accordance with the cryptographic method shared with the IC card processing device; a main body having the module; An IC card comprising:

Images