Electronic information storage medium, IC chip, IC card, error code response method, and program

Abstract

To provide an electronic information storage medium, an IC chip, an IC card, an error code response method, and a program that can facilitate identification of the cause of an error.SOLUTION: An IC chip 1, when an error occurs in processing according to a predetermined command APDU from the outside, stores an error code corresponding to the error in a memory, according to a read-out command APDU from the outside after responding with a status word SW1SW2 to the predetermined command APDU, reads out the error code from the memory, and responds with the error code.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The present invention relates to the technical field of an IC (Integrated Circuit) chip or the like that executes command processing in response to a command from an external terminal and is capable of executing the command processing.

Background Art

[0002] In recent years, threats to information assets have been increasing, and when handling sensitive information, it has become necessary to implement security measures. For such security measures, a secure element composed of an IC chip capable of performing cryptographic operations is increasingly being used. Communication between the secure element and the system using it is often carried out using command APDUs (Application Protocol Data Units) and response APDUs defined in the international standard ISO / IEC 7816-4. ISO / IEC 7816-4 defines command APDUs and response APDUs for general functions used in secure elements, and these can be used as common commands in secure elements created in accordance with ISO / IEC 7816-4 without depending on manufacturers or the like.

[0003] Also, ISO / IEC 7816-4 stipulates that when an error occurs in the secure element, a response including a status word indicating the outline of the error is returned to the external terminal. Therefore, on the external terminal side, it is possible to take measures against the error according to the status word from the secure element. As a related technique, Patent Document 1 discloses an IC card that stores a command history including a type code indicating the type of the executed command and an execution result code corresponding to the response, and determines that an abnormal usage has occurred when the number of command histories of predetermined content exceeds the maximum allowable number.

Prior Art Documents

Patent Documents

[0004] Patent Document 1 Japanese Patent Application Laid-Open No. 2022-69184 Summary of the Invention Problems to be Solved by the Invention

[0005] However, according to ISO / IEC 7816-4, the status word indicating the outline of an error is only provided in a rough classification and is commonly used among a plurality of command APDUs with different command types. Therefore, system developers or system users who use a secure element cannot accurately identify the cause of the error from such a status word (in other words, they cannot identify what error occurred in the execution of what process). For this reason, it is difficult for system developers or system users to infer a method for avoiding the occurred error.

[0006] Therefore, the present invention has been made in view of such problems, and an example of the problem is to provide an electronic information storage medium, an IC chip, an IC card, an error code response method, and a program that can easily identify the cause of an error. Means for Solving the Problems

[0007] In order to solve the above problems, the invention according to claim 1 is an electronic information storage medium that responds with a status word that is commonly used among a plurality of commands with different command types and indicates the outline of an error when an error occurs in a process in response to a predetermined command from the outside. When the error occurs, a storage means for storing an error code indicating what error occurred in what process in a memory, and a response means for reading the error code from the memory and responding with the error code in response to a read command from the outside after the response of the status word to the command, characterized by comprising.

[0008] The invention according to claim 2 is the electronic information storage medium according to claim 1, wherein the electronic information storage medium stores in advance correspondence relationship information that defines a correspondence relationship between an error code indicating in what process what error has occurred and command identification information of a command for avoiding the error, and when the error occurs, the storage means refers to the correspondence relationship information, specifies the command identification information associated with the error code, associates the error code with the specified command identification information, and stores the association in a memory, and the response means reads out the error code and the command identification information from the memory in response to the read command, and responds with the error code and the command identification information.

[0009] The invention according to claim 3 is the electronic information storage medium according to claim 1, wherein the storage means stores the error code in a memory after the response of the status word.

[0010] The invention according to claim 4 is the electronic information storage medium according to claim 2, wherein the storage means stores the error code and the command identification information in a memory after the response of the status word.

[0011] The invention according to claim 5 is an IC chip that responds with a status word that is commonly used among a plurality of commands with different command types and indicates an outline of the error when an error occurs in a process in response to a predetermined command from the outside, and when the error occurs, the IC chip includes a storage means for storing an error code indicating in what process what error has occurred in a memory, and a response means for reading out the error code from the memory in response to a read command from the outside after the response of the status word to the command, and responding with the error code.

[0012] The invention according to claim 6 is an IC card that responds with a status word that is commonly used among a plurality of commands with different command types and indicates the outline of the error when an error occurs in processing in response to a predetermined command from the outside. When the error occurs, a storage means for storing an error code indicating in what process and what error has occurred in a memory, and in response to a read command from the outside after the response of the status word to the command, a response means for reading the error code from the memory and responding with the error code, characterized in that it comprises these.

[0013] The invention according to claim 7 is an error code response method executed by an electronic information storage medium that responds with a status word that is commonly used among a plurality of commands with different command types and indicates the outline of the error when an error occurs in processing in response to a predetermined command from the outside. When the error occurs, a step of storing an error code indicating in what process and what error has occurred in a memory, and in response to a read command from the outside after the response of the status word to the command, a step of reading the error code from the memory and responding with the error code, characterized in that it includes these.

[0014] The invention according to claim 8 is a computer included in an electronic information storage medium that responds with a status word that is commonly used among a plurality of commands with different command types and indicates the outline of the error when an error occurs in processing in response to a predetermined command from the outside. When the error occurs, a storage means for storing an error code indicating in what process and what error has occurred in a memory, and in response to a read command from the outside after the response of the status word to the command, functioning as a response means for reading the error code from the memory and responding with the error code, characterized in that it does this.

Advantages of the Invention

[0015] According to the present invention, it is possible to easily identify the cause of an error.

Brief Description of the Drawings

[0016]

Figure 1

Figure 2

Figure 3

Figure 4

Embodiments for Carrying Out the Invention

[0017] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0018] [1. Configuration and Function of IC Chip 1] First, with reference to FIG. 1, the configuration and function of the IC chip 1 according to the present embodiment will be described. The IC chip 1 is, for example, a secure element having tamper resistance and is an example of the electronic information storage medium of the present invention. The IC chip 1 is mounted on, for example, an IC card such as a credit card, a cash card, or a my number card, or a mobile device such as a smartphone. In the case of a mobile device such as a smartphone, the IC chip 1 may be mounted on a small IC card detachable from the mobile device, or may be mounted on an embedded board so as not to be easily removable or replaceable from the mobile device as an eUICC (Embedded Universal Integrated Circuit Card).

[0019] FIG. 1 is a diagram showing an example of the hardware configuration of the IC chip 1. As shown in FIG. 1, the IC chip 1 includes an I / O circuit 11, a RAM (Random Access Memory) 12, an NVM (Nonvolatile Memory) 13, a ROM (Read Only Memory) 14, a CPU (Central Processing Unit) 15 (an example of a computer), a coprocessor 16 that performs cryptographic operations, and the like. The I / O circuit 11 serves as an interface with the external terminal 2. Note that the communication between the IC chip 1 and the external terminal 2 may be non-contact communication or contact communication. In the case of non-contact communication, for example, communication between the IC chip 1 and the external terminal 2 is performed via an antenna (not shown) mounted on an IC card or a mobile device. Examples of the external terminal 2 include a transaction terminal (e.g., a payment terminal) installed in a store or the like, and an investigation terminal installed in a facility such as a factory. The investigation terminal is a terminal for investigating the cause of an error when an error occurs in the communication between the IC chip 1 and the transaction terminal.

[0020] In the communication between the IC chip 1 and the external terminal 2, the exchange of command APDUs and response APDUs defined in ISO / IEC 7816-4 etc. is performed. Here, the command APDU includes at least a header part consisting of a CLA indicating the command class, an INS indicating the command code (command type), P1 and P2 indicating the command parameters, and may also include a body part for storing a PIN (personal identification number), written data, etc. On the other hand, the response APDU includes at least a status word SW1SW2 indicating the processing result (normal completion or an outline of an error (abnormal completion)), and may also include read data, etc. The status word SW1SW2 indicating the outline of an error is expressed, for example, as "62XX h", "63XX h", "64XX h", "65XX h", "66XX h", "68XX h", "69XX h", "6AXX h" and "6CXX h" as defined in ISO / IEC 7816-4 etc., and is commonly used among a plurality of command APDUs with different command types (that is, INS). Here, "h" indicates that it is a hexadecimal number, and "X" indicates any value from "0" to "F". As an example, "6985 h" is a status word SW1SW2 indicating that the usage conditions are not satisfied.

[0021] For NVM13, for example, flash memory is applied. Note that NVM13 may be an "Electrically Erasable Programmable Read-Only Memory". Various programs such as an OS (Operating System) and one or more applications (including the program of the present invention) are stored in NVM13 or ROM14. Further, in NVM13, a correspondence table (an example of correspondence information) that defines the correspondence between an error code indicating what error has occurred in what process and an INS (an example of command identification information, hereinafter referred to as "avoidance INS") of a command APDU for avoiding the error is stored in advance. Such a correspondence table may be written to IC chip 1, for example, in the data issuance process at the manufacturing factory of IC chip 1. Note that an error code not associated with the avoidance INS may be registered in the correspondence table.

[0022] FIG. 2 is a diagram showing an example of a correspondence table indicating the correspondence between error codes and avoidance INSs. In the example of FIG. 2, the error code "01 h" indicates (i.e., is meant to indicate) that PIN authentication was not successful in the PIN authentication (PIN verification) process (for example, the process corresponding to the VERIFY command APDU). To such an error code "01 h", the INS "20 h" of the VERIFY command APDU is associated as the avoidance INS. Further, the error code "02 h" indicates that the secure channel (secure communication channel) between the IC chip 1 and the external terminal 2 was not established in the secure channel establishment process (for example, the processes corresponding to the INITIALIZE UPDATE command APDU and the EXTERNAL AUTHENTICATE command APDU). To such an error code "02 h", the INS "50 h" of the INITIALIZE UPDATE command APDU and the INS "82 h" of the EXTERNAL AUTHENTICATE command are associated as the avoidance INSs. Further, the error code "03 h" indicates that signature verification was not successful in the signature verification process of the public key certificate (for example, the process corresponding to the PERFORM SECURITY OPERATION command APDU). To such an error code "03 h", the INS "22 h" of the MANAGE SECURITY ENVIRONMENT command APDU is associated as the avoidance INS.

[0023] Note that in the example of FIG. 2, the error code "04 h" indicates that the structure of the data to be written in the data writing process is different from the predetermined format, but no avoidance INS is associated with such an error code "04 h". Similarly, the error code "05 h" indicates that encryption operation (for example, data encryption or decryption) was not successful in the encryption operation process, but no avoidance INS is associated with such an error code "05 h" either. Further, the correspondence between the error code and the avoidance INS may be described in a program.

[0024] The CPU 15 (an example of a computer) functions as storage means, response means, etc. in the present invention by executing the OS and applications stored in the NVM 13. When the CPU 15 receives a predetermined command APDU transmitted from the external terminal 2 via the I / O circuit 11, it executes processing corresponding to the command APDU and transmits a response APDU including status words SW1 and SW2 indicating the processing result to the external terminal 2. That is, at least the status words SW1 and SW2 are responded. Here, when the processing corresponding to the command APDU is executed normally, status words SW1 and SW2 (“9000 h”) indicating normal completion are responded. On the other hand, when an error occurs in the processing corresponding to the command APDU (when abnormal termination occurs), status words SW1 and SW2 indicating the outline of the error are responded.

[0025] In such an exchange of command APDUs and response APDUs, when an error occurs, the CPU 15 writes and stores an error code indicating in which process and what kind of error has occurred in a dedicated area (record) of a memory (for example, the RAM 12 or the NVM 13). For example, an error code in the case where an error occurs for each type of processing corresponding to the command APDU (for example, PIN authentication processing, secure channel establishment processing, signature verification processing, etc.) is determined in advance (for example, described in a program), and when an error occurs in any type of processing, the determined error code is specified and written into the dedicated area. Then, the CPU 15 transmits a response APDU including status words SW1 and SW2 indicating the outline of the occurred error to the external terminal 2. More preferably, when the above error occurs (that is, when an error occurs in any type of processing), the CPU 15 refers to a correspondence table as shown in FIG. 2, specifies an avoidance INS associated with the error code corresponding to the error, associates the error code with the specified avoidance INS, writes and stores them in a dedicated area of a memory (for example, the RAM 12 or the NVM 13), and transmits a response APDU including status words SW1 and SW2 indicating the outline of the error to the external terminal 2.

[0026] FIG. 3 is a diagram showing an example of a pair of an error code stored in association with a memory and an avoidance INS. In storage example 1 of FIG. 3(A), a pair of an error code "01 h" and an avoidance INS "20 h" is stored. Note that the pair of the error code and the avoidance INS may be stored in a predetermined record in, for example, TLV format. In storage example 1 of FIG. 3(A), the pair of the error code stored in the memory and the avoidance INS is erased each time it is read later, or overwritten by a pair of an error code and an avoidance INS corresponding to an error occurring after the reading. On the other hand, in storage example 2 of FIG. 3(B), a pair of an error code "01 h" and an avoidance INS "20 h" and a pair of an error code "02 h" and avoidance INSs "50 h" and "82 h" are stored (that is, a plurality of pairs are stored). In storage example 2 of FIG. 3(B), the pair of the error code stored in the memory and the avoidance INS is not erased even after being read. However, when an error occurs after a predetermined number (for example, 5) of pairs are stored, the pair of the oldest error code and the avoidance INS may be erased.

[0027] Then, when the CPU 15 receives, via the I / O circuit 11, a read command APDU transmitted from the external terminal 2 after the response of the status word SW1SW2 (that is, the status word for the predetermined command) indicating the outline of the error, in response to the read command APDU, the CPU 15 reads the stored error code from the dedicated area of the memory, and transmits a response APDU including the read error code and the status word SW1SW2 indicating normal termination to the external terminal 2. That is, the error code read from the memory by the execution of the read command APDU is responded. Thereby, based on the responded error code, a command APDU for avoiding an error can be inferred on the external terminal 2 side, and error handling can be quickly performed.

[0028] Alternatively, when the CPU 15 receives, via the I / O circuit 11, the read command APDU transmitted from the external terminal 2 after the response of the status word SW1SW2 indicating the outline of the error, in response to the read command APDU, the CPU 15 reads out the set of the stored error code and the INS for avoidance from the dedicated area of the memory, and transmits a response APDU including the read set of the error code and the INS for avoidance and the status word SW1SW2 indicating normal completion to the external terminal 2. That is, the set of the error code and the INS for avoidance read from the memory by the execution of the read command APDU is responded. Thereby, based on the responded error code and the INS for avoidance, the external terminal 2 can quickly identify the command APDU for avoiding the error, and can more quickly take error countermeasures.

[0029] Examples of the read command APDU include a GET DATA command APDU and a READ RECORD command APDU. The header part of the read command APDU may include a tag capable of specifying the stored error code (or the set of the error code and the INS for avoidance) or the record number of the dedicated area which is the storage destination. When the external terminal 2 that transmitted the predetermined command APDU that caused the error and the external terminal 2 that transmits the read command APDU are the same transaction terminal, error countermeasures can be taken more quickly. However, the external terminal 2 that transmitted the predetermined command APDU that caused the error and the external terminal 2 that transmits the read command APDU may be different from each other. For example, it is assumed that the external terminal 2 that transmitted the predetermined command APDU is a transaction terminal and the external terminal 2 that transmits the read command APDU is an investigation terminal.

[0030] [2. Operation of the IC chip 1] Next, with reference to FIG. 4, the operation of the IC chip 1 according to the present embodiment will be described. FIG. 4(A) is a flowchart showing an example of processing executed by the CPU 15 of the IC chip 1 when a predetermined command APDU is received. FIG. 4(B) is a flowchart showing an example of processing executed by the CPU 15 of the IC chip 1 when a read command APDU is received after an error has occurred. In the operation example described below, the case where a pair of an error code and an INS for avoidance is stored in the memory is taken as an example, and the case where the predetermined command APDU and the read command APDU are transmitted from the same external terminal 2 (for example, a transaction terminal) is taken as an example.

[0031] The process shown in FIG. 4(A) starts when a predetermined command APDU is received. When the process shown in FIG. 4(A) starts, the CPU 15 executes a process corresponding to the predetermined command APDU (step S1), and determines whether or not the process has ended normally (step S2). Note that it may be determined whether or not an error has occurred. When it is determined that the process has ended normally (step S2: YES), the process proceeds to step S3. On the other hand, when it is determined that the process has not ended normally (in other words, an error has occurred) (step S2: NO), the process proceeds to step S4.

[0032] In step S3, the CPU 15 transmits a response APDU including status words SW1 and SW2 indicating normal termination to the external terminal 2 and ends the process. On the other hand, in step S4, the CPU 15 identifies an error code corresponding to the occurred error, identifies an avoidance INS associated with the identified error code, associates the error code and the identified avoidance INS, and writes and stores them in a dedicated area of the memory. Next, the CPU 15 transmits a response APDU including status words SW1 and SW2 indicating the outline of the error to the external terminal 2 (step S5) and ends the process. Note that the CPU 15 may write and store the error code in a dedicated area of the memory after transmitting a response APDU including status words SW1 and SW2 indicating the outline of the error to the external terminal 2 (that is, after the response of the status words SW1 and SW2 to a predetermined command APDU). Thereby, by storing the error code after transmitting the response APDU, the time until the response APDU is transmitted is made equal to that of the conventional implementation that does not store the error code, and the process can proceed without delay.

[0033] The process shown in FIG. 4(B) is started when a read command APDU designating a tag or a storage destination of an error code is received. When the process shown in FIG. 4(B) is started, the CPU 15 reads out a set of the error code and the avoidance INS stored in the dedicated area of the memory according to the read command APDU (step S11). Next, the CPU 15 transmits a response APDU including the set of the error code and the avoidance INS read out in step S11 and status words SW1 and SW2 indicating normal termination to the external terminal 2 (step S12) and ends the process. Thereby, the external terminal 2 identifies a command APDU to be transmitted next based on the received avoidance INS and transmits the command APDU to the IC chip 1.

[0034] For example, when a VERIFY command APDU is specified based on the avoidance INS, the VERIFY command APDU including the PIN is transmitted to the IC chip 1 (retry of PIN authentication processing). Alternatively, when an INITIALIZE UPDATE command APDU and an EXTERNAL AUTHENTICATE command APDU are specified based on the avoidance INS, the INITIALIZE UPDATE command APDU is transmitted to the IC chip 1, and when a response APDU including a status word SW1SW2 indicating normal completion is returned for the INITIALIZE UPDATE command APDU, the EXTERNAL AUTHENTICATE command APDU is transmitted to the IC chip 1 (retry of secure channel establishment processing). Alternatively, when a MANAGE SECURITY ENVIRONMENT command APDU is specified based on the avoidance INS, the MANAGE SECURITY ENVIRONMENT command APDU including a control reference template (CRT) is transmitted to the IC chip 1, and when a response APDU including a status word SW1SW2 indicating normal completion is returned for the INITIALIZE UPDATE command APDU, the PERFORM SECURITY OPERATION command APDU is transmitted to the IC chip 1 (retry of public key certificate signature verification processing).

[0035] As described above, according to the above embodiment, when an error occurs in the processing corresponding to the APDU for a predetermined command from the outside, the IC chip 1 stores an error code corresponding to the error in the memory, and after the response of the status word SW1SW2 for the predetermined command APDU, in response to a read command APDU from the outside, the error code is read from the memory and configured to respond with the error code. Therefore, it is possible to easily identify the cause of the error (that is, identify what error occurred in the execution of what processing), and the error response can be accelerated.

[0036] Furthermore, according to the above embodiment, when an error occurs in the process of the IC chip 1 responding to an APDU for a predetermined command from the outside, a pair of an error code corresponding to the error and an INS for avoidance is stored in the memory, and after the response of the status word SW1SW2 to the predetermined command APDU, in response to a read command APDU from the outside, the pair of the error code and the INS for avoidance is read from the memory, and the pair of the error code and the INS for avoidance is configured to be responded, so that an error avoidance command APDU can be quickly identified and error handling can be achieved more quickly.

Description of Signs

[0037] 1 IC chip 2 External terminal 11 I / O circuit 12 RAM( 13 NVM 14 ROM 15 CPU 16 Coprocessor

Claims

1. In an electronic information storage medium that responds with a status word that is commonly used among a plurality of commands with different command types and indicates the outline of the error when an error occurs in processing according to a predetermined command from the outside, storage means for storing an error code indicating in what process and what error has occurred in the memory when the error occurs; response means for reading the error code from the memory in response to a read command from the outside after responding with the status word to the command, and responding with the error code; An electronic information storage medium characterized by comprising:

2. The electronic information storage medium stores in advance correspondence relationship information that defines a correspondence relationship between an error code indicating in what process and what error has occurred and command identification information of a command for avoiding the error, When the error occurs, the storage means refers to the correspondence relationship information, specifies the command identification information associated with the error code, associates the error code with the specified command identification information, and stores them in the memory, The response means reads the error code and the command identification information from the memory in response to the read command, and responds with the error code and the command identification information. The electronic information storage medium according to claim 1, characterized in that.

3. The electronic information storage medium according to claim 1, characterized in that the storage means stores the error code in the memory after responding with the status word.

4. The electronic information storage medium according to claim 2, characterized in that the storage means stores the error code and the command identification information in the memory after responding with the status word.

5. In an IC chip that responds with a status word that is commonly used among a plurality of commands with different command types and indicates an overview of the error when an error occurs in processing in response to a predetermined command from the outside, a storage means for storing, in a memory, an error code indicating in what process and what error has occurred when the error occurs; a response means for reading the error code from the memory in response to a read command from the outside after responding with the status word to the command, and responding with the error code; An IC chip characterized by comprising the above.

6. In an IC card that responds with a status word that is commonly used among a plurality of commands with different command types and indicates an overview of the error when an error occurs in processing in response to a predetermined command from the outside, a storage means for storing, in a memory, an error code indicating in what process and what error has occurred when the error occurs; a response means for reading the error code from the memory in response to a read command from the outside after responding with the status word to the command, and responding with the error code; An IC card characterized by comprising the above.

7. An error code response method executed by an electronic information storage medium that responds with a status word that is commonly used among a plurality of commands with different command types and indicates an overview of the error when an error occurs in processing in response to a predetermined command from the outside, a step of storing, in a memory, an error code indicating in what process and what error has occurred when the error occurs; a step of reading the error code from the memory in response to a read command from the outside after responding with the status word to the command, and responding with the error code; An error code response method characterized by including the above. Claim 8 In a process in response to a predetermined command from the outside, when an error occurs, a computer included in an electronic information storage medium that responds with a status word that is commonly used among a plurality of commands having different command types and indicates the outline of the error, storage means for storing an error code indicating in what process and what error has occurred in the memory when the error occurs; A program characterized in that, after responding with the status word to the command, in response to a read command from the outside, the error code is read from the memory and made to function as response means for responding with the error code.

Images