IC card, IC chip for IC card, computer program, patch application management method, and patch operation management method.

Abstract

This allows for the management of patches related to insecure functions without compromising the security of IC cards. [Solution] The IC card 1 includes a first non-volatile memory 102 that stores a functional module 12 to which a security classification 121 indicating either a secure function or an insecure function is attached, a second non-volatile memory 103 that is rewritable and used to store a patch 16 to be applied to the functional module 12, and a patch application management unit 10 that, when a shipping flag 14 indicating that it is in the shipped state is set, stores the patch 16 in the second non-volatile memory 103 only when the security classification 121 of the functional module 12 to which the patch 16 is applied is an insecure function.

Description

Technical Field

[0001] This application relates to a technique for applying a patch for correcting program defects or vulnerabilities to an IC card.

Background Art

[0002] IC cards with an IC chip mounted on a card medium have been widely used in recent years in various applications that require high security, such as financial systems and login systems to a network. Conventional IC cards were configured to be able to apply a patch for correcting defects or vulnerabilities in the program mounted on the IC card in case a defect or vulnerability was found in the program mounted on the IC card (for example, Patent Document 1).

[0003] If a patch can be applied to an IC card, even after the IC card has been shipped, defects in the program mounted on the IC card can be corrected or the vulnerability of the IC card can be improved. However, if a patch can be applied to an IC card, there is a risk that a malicious patch may be applied to the IC card. For this reason, an IC card used in applications that require high security is made unable to apply a patch when information indicating that the IC card is in the shipped state is written.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] IC cards have functional modules implemented, which are programs that implement each function the IC card is intended to have. These functions include secure functions that require high security, and non-secure functions that do not. From an operational standpoint, even for IC cards used in applications requiring high security, it is desirable that non-secure functions can be patched after shipment.

[0006] For example, one non-secure function that should ideally be patchable even after shipment is the communication function with the reader / writer. IC cards are used with various reader / writers, but occasionally, due to differences in electrical characteristics or communication parameters, errors may occur frequently in communication between the reader / writer and the IC card, or the IC card may not be able to communicate at all. When it is difficult to replace the reader / writer, it is necessary to modify the functional module that implements the communication function with the reader / writer in order to resolve the communication problems.

[0007] Therefore, this invention aims to enable the management of patches related to insecure functions without compromising the security of IC cards. [Means for solving the problem]

[0008] The first invention, which solves the above-mentioned problems, is an IC card characterized by comprising: a first non-volatile memory that stores a functional module to which a security classification indicating either a secure function or an insecure function is attached; a second non-volatile memory that is rewritable and used to store patches to be applied to the functional module; and a patch application management unit that stores the patch in the second non-volatile memory only when the security classification of the functional module to which the patch is applied is an insecure function, when a shipping flag indicating that the card is in the shipping state is set. The IC card according to the first invention is configured so that when it is in the shipping state, only the functional module to which the security classification is set to an insecure function can be patched.

[0009] The second invention is characterized in that, in the first invention, the patch application management unit stores the patch in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied, when the shipping flag is not set. The IC card according to the first invention is configured so that, when not in the shipping state, patches can be applied not only to the functional module whose security classification is set to non-secure function, but also to the functional module whose security classification is set to secure function.

[0010] The third invention is characterized in that, in the first or second invention, it includes a patch operation management unit that prohibits the calling of a functional module whose security classification is secure from a patch applied to the functional module whose security classification is non-secure. The third invention is configured such that even if a malicious patch is applied to the functional module whose security classification is set to non-secure, the security of the IC card is not compromised.

[0011] The fourth invention is an IC chip for an IC card, characterized by comprising: a first non-volatile memory that stores a functional module to which a security classification indicating either a secure function or a non-secure function is attached; a second non-volatile memory that is rewritable and used to store patches to be applied to the functional module; and a patch application management unit that, as a function utilizing the processor, stores the patch in the second non-volatile memory only when the security classification of the functional module to which the patch is applied is a non-secure function, if a shipping flag indicating that it is in a shipped state is set.

[0012] The fifth invention is characterized in that, in the fourth invention, the patch application management unit stores the patch in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied, if the shipping flag is not set.

[0013] The sixth invention is characterized in that, in the fourth or fifth invention, the fourth invention includes a patch operation management unit as a function that utilizes the processor, which prohibits the calling of a function module whose security classification is secure from a patch applied to the function module whose security classification is non-secure.

[0014] The seventh invention is a computer program that causes an IC card processor, which has a first non-rewritable non-volatile memory for storing a functional module with a security classification indicating either a secure function or a non-secure function, and a second rewritable non-volatile memory for storing patches to be applied to the functional module, to function as a patch application management unit when a shipping flag indicating that it is in a shipped state is set, and the security classification of the functional module to which the patch is applied is a non-secure function, to store the patch in the second non-volatile memory.

[0015] The eighth invention is characterized in that, in the seventh invention, the patch application management unit stores the patch in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied, if the shipping flag is not set.

[0016] The ninth invention is a computer program that causes an IC card processor, which has a first non-rewritable non-volatile memory for storing a functional module with a security classification indicating either a secure function or an insecure function, and a second rewritable non-volatile memory for storing patches applied to the functional module, to function as a patch operation management unit that prohibits the calling of a functional module with a security classification of a secure function from a patch applied to the functional module with a security classification of an insecure function.

[0017] The tenth invention is a patch application management method characterized in that, when an IC card having a non-rewritable first non-volatile memory storing a functional module with a security classification indicating either a secure function or a non-secure function, and a rewritable second non-volatile memory used for storing patches to be applied to the functional module, is set with a shipping flag indicating that it is in a shipped state, the patch is stored in the second non-volatile memory only when the security classification of the functional module to which the patch is applied is a non-secure function.

[0018] The eleventh invention is characterized in that, in the tenth invention, if the shipping flag is not set, the patch is stored in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied.

[0019] The twelfth invention is a patch operation management method characterized in that an IC card having a first non-rewritable non-volatile memory for storing a functional module to which a security classification indicating either a secure function or a non-secure function is attached, and a second rewritable non-volatile memory for storing patches applied to the functional module, prohibits the calling of a functional module to which the security classification is a secure function from a patch applied to the functional module to which the security classification is a non-secure function. [Effects of the Invention]

[0020] Thus, the invention disclosed in this application is configured to manage patches related to insecure functions without compromising the security of the IC card. [Brief explanation of the drawing]

[0021] [Figure 1] This figure illustrates the IC card according to this embodiment. [Figure 2] Block diagram of an IC card. [Figure 3] A diagram illustrating the patch management table. [Figure 4] Figure for explaining the operation of the patch application management unit. [Figure 5] Figure for explaining the operation of the patch operation management unit. [Figure 6] Figure for explaining the non-secure function execution process. [Figure 7] Figure for explaining the secure function execution process.

Mode for Carrying Out the Invention

[0022] Hereinafter, embodiments of the present invention disclosed in the present application will be described. This embodiment is for facilitating the understanding of the present invention. The present invention is not limited to this embodiment. Also, unless otherwise specified, the drawings are schematic diagrams drawn for facilitating the understanding of the present invention.

[0023] In the present application, an IC card or the like that can manage a patch related to a non-secure function without impairing security is disclosed. Managing a patch related to a non-secure function includes application management of a patch related to a non-secure function and operation management of a patch related to a non-secure function.

[0024] In FIG. 1, an IC card 1 according to this embodiment is illustrated. The IC card 1 is roughly classified into three types by a communication interface. The IC card 1 illustrated in FIG. 1 is a contact type that reads and writes data through metal contacts visible on the card surface. In addition to the contact type, the classification of the IC card 1 by a communication interface includes a non-contact type that reads and writes data using wireless communication, and a dual interface type that has both the characteristics of the contact type and the non-contact type. The present invention is applicable to any of the contact type, non-contact type, and dual interface type.

[0025] The IC card 1 shown in Figure 1 has a structure in which a contact terminal board 1a, on which an IC chip 100 for IC cards is mounted on the back surface, is embedded in a card medium 1b. The IC chip 100 for IC cards mounted on the back surface of the contact terminal board 1a has the hardware shown in Figure 1. In addition, the IC chip 100 for IC cards has hardware necessary for the operation of the IC chip 100, such as a clock generation circuit, a reset circuit that performs reset processing, and a random number generation circuit, which are not shown in Figure 1.

[0026] The processor 101 is an integrated circuit that performs complex calculations and data processing. The first non-volatile memory 102 and the second non-volatile memory 103 are non-volatile memories that can permanently store data. The first non-volatile memory 102 is a non-volatile memory used to store programs. Here, the first non-volatile memory 102 is an electrically unrewritable ROM (Read Only Memory), but the first non-volatile memory 102 may also be a code flash memory for storing program code. The second non-volatile memory 103 is an electrically rewritable non-volatile memory mainly used to store data. The second non-volatile memory 103 can be an EEPROM or a data flash memory for storing data. The volatile memory 104 is a memory called RAM (Random Access Memory), which cannot permanently store data but is a high-speed rewritable memory.

[0027] The Crypto Engine 106 is a circuit specialized for specific cryptographic operations. In the case of IC card 1, the Crypto Engine 106 is a circuit that supports symmetric-key cryptographic operations such as DES (Data Encryption Standard) and public-key cryptographic operations such as RSA.

[0028] The UART105 (Universal Asynchronous Receiver-Transmitter) is a circuit for communicating with an external reader / writer. In the contact type, the UART105 is a serial interface compliant with ISO / IEC 7816 part 3.

[0029] Figure 2 is a block diagram of IC card 1. As shown in Figure 2, IC card 1 includes a patch application management unit 10 that manages the application of patch 16 and a patch operation management unit 11 that manages the operation of patch 16, as functions implemented using the processor 101. Details of these will be described later.

[0030] The first non-volatile memory 102 of the IC card 1 stores function modules 12, which are computer programs that implement the functions of the IC card 1, for each function of the IC card 1. Each function module 12 stored in the first non-volatile memory 102 of the IC card 1 is assigned a module ID 120, which is information that identifies the function module 12. In addition, each function module 12 is assigned a security classification 121 that indicates whether it is a secure function requiring security or a non-secure function not requiring security. In this embodiment, a function module 12 belonging to a secure function is described as a secure function module 12S, and a function module 12 belonging to a non-secure function is described as a non-secure function module 12N. There may be more than one secure function module 12S implemented in the IC card 1, but for convenience, only one secure function module 12S is shown in Figure 2. Similarly, there may be more than one non-secure function module 12N implemented in the IC card 1, but for convenience, only one non-secure function module 12N is shown in Figure 2.

[0031] The secure features of IC card 1 include, for example, a user authentication function that verifies the user's identity using a password or biometric authentication (fingerprint, facial recognition, etc.), an access control function that sets access rights to files and allows access only to specific users, and an encryption function that encrypts data using the encryption engine 106 to protect data from unauthorized access.

[0032] The non-secure functions of IC card 1 include, for example, a communication control function that controls the UART 105 to control communication with the reader / writer. The communication control function that controls communication with the reader / writer includes data transmission control to ensure that data is accurately sent and received between the reader / writer and IC card 1. Data transmission control includes flow control to adjust the data transfer rate between the reader / writer and IC card 1, and error control to detect errors that occur during data transmission. Furthermore, the communication control that controls communication with the reader / writer also includes protocol control to exchange data with the reader / writer according to the communication protocol. ISO / IEC 7816 part 3, for example, defines T=0 and T=1 as contact-type communication protocols.

[0033] The second non-volatile memory 103 is provided with a shipping flag 14 that indicates the IC card 1 is in a shipped state. In this embodiment, the flag is represented by a Boolean value. The default value of the flag is a Boolean value (here, False) that indicates the condition corresponding to the flag is not met. Setting the flag means changing the flag, which is currently False, to a Boolean value (here, True) that indicates the condition corresponding to the flag is met. Resetting the flag means changing the flag, which is currently True, back to False. The shipping flag 14 is rewritten from False to True during either the zero-stage issuance performed by the card manufacturer, the primary issuance performed by the card issuer, or the secondary issuance performed by the card issuer. The zero-stage issuance is an issuance process that writes the minimum data necessary for the operation of the IC card 1 to the IC card 1. The primary issuance is an issuance process that writes application-related data to the IC card 1. The secondary issuance is an issuance process that writes data related to the owner of the IC card 1 to the IC card 1. In some cases, the card manufacturer undertakes both the primary and secondary issuance on behalf of the card issuer.

[0034] The second non-volatile memory 103 is used to store the patch 16 applied to the functional module 12. When patch 16 is applied to the secure functional module 12S, the secure functional patch 16S, which is the patch 16 for the secure functional module 12S, is stored in the second non-volatile memory 103. When patch 16 is applied to the non-secure functional module 12N, the non-secure functional patch 16N, which is the patch 16 for the non-secure functional module 12N, is stored in the second non-volatile memory 103.

[0035] The second non-volatile memory 103 stores a patch management table 13, which is a data table used for managing the patch 16 applied to the IC card 1. In this embodiment, the second non-volatile memory 103 stores a secure function patch management table 13S that stores patch management information 130 used for managing the secure function patch 16S, and a non-secure function patch management table 13N that stores patch management information 130 used for managing the non-secure function patch 16N.

[0036] Next, we will describe the patch management table 13 stored in the second non-volatile memory 103. Figure 3 is a diagram illustrating the patch management table 13. In this embodiment, the secure function patch management table 13S and the non-secure function patch management table 13N are stored in the second non-volatile memory 103, but there is no difference in their structure, and their structures are the same as in Figure 3.

[0037] The patch management table 13 is a data table that stores patch management information 130 for the functional modules 12 implemented in the IC card 1, and is generated in the second non-volatile memory 103 during the initial issuance of the IC card 1. The secure function patch management table 13S stores the patch management information 130 for each secure function module 12S implemented in the IC card 1. The non-secure function patch management table 13N stores the patch management information 130 for each non-secure function module 12N implemented in the IC card 1.

[0038] The patch management information 130 stored in the patch management table 13 includes a patch management module ID 1300 used to identify the patch management information 130, an application flag 1301, a call address 1302 for patch 16, and a patch size 1303. The patch management module ID 1300 corresponds to the module ID 120 for the patch management information 130. The application flag 1301 indicates whether or not patch 16 has been applied. The call address 1302 indicates the starting address of patch 16, and the patch size 1303 indicates the size of patch 16.

[0039] When the IC card 1 is activated, the volatile memory 104 is set with an insecure flag 15 used by the patch operation management unit 11. The condition for setting the insecure flag 15 is that the insecure function patch 16N is being executed. When the insecure function patch 16N is executed, the insecure flag 15 is set by the patch operation management unit 10, and when the insecure function patch 16N is completed, the insecure flag 15 is reset by the patch operation management unit 10.

[0040] Next, the patch application management unit 10 provided in IC card 1 will be described. Before shipment, that is, when IC card 1 is not in the shipping state, it is desirable that patches 16 can be applied to all functional modules 12 regardless of security classification 121 in order to correct defects and vulnerabilities in the programs implemented in IC card 1. After shipment, that is, when IC card 1 is in the shipping state, it is desirable that patches 16 can be applied to functional modules 12 to the extent that security is not compromised. To achieve this, the patch application management unit 10 according to this embodiment permits the application of patches 16 to all functional modules 12 regardless of security classification 121 when IC card 1 is not in the shipping state, and permits the application of patches 16 only to non-secure functional modules 12N when IC card 1 is in the shipping state.

[0041] Figure 4 is a diagram illustrating the operation of the patch application management unit 10. The explanation of Figure 4 also serves as an explanation of the patch application management method according to the present invention.

[0042] When patch 16 is applied to IC card 1, IC card 1 receives a patch storage command (step S1). In the field of IC card 1, it is common practice that only the administrator of IC card 1 can execute the patch storage command. The patch storage command includes the module ID 120 of the functional module 12 to which patch 16 will be applied, the size of the patch 16 to be applied to functional module 12, and the body of the patch 16 to be applied to functional module 12.

[0043] Upon receiving a patch storage command, the patch application management unit 10 of the IC card 1 checks the shipping flag 14 stored in the second non-volatile memory 103 (step S2). If the shipping flag 14 is not set, i.e., the shipping flag 14 is False, the patch application management unit 10 of the IC card 1 proceeds to step S4 in Figure 4. In step S4, the patch application management unit 10 stores the patch 16 included in the patch storage command in the second non-volatile memory 103, and then in step S5, updates the patch management information 130, which includes a patch management module ID 1300 that matches the module ID 120 included in the patch storage command, and terminates the procedure in Figure 4.

[0044] In step S5, when updating the patch management information 130, the patch application management unit 10 searches for patch management information 130 that includes a patch management module ID 1300 that matches the module ID 120 included in the patch storage command, and then sets the application flag 1301 of this patch management information 130, that is, sets the application flag 1301 to True. The patch application management unit 10 also writes the address of the second non-volatile memory 103, where writing of patch 16 was started in step S4 of Figure 4, to the call address 1302. Furthermore, the patch application management unit 10 writes the size included in the patch storage command to the patch size 1303 of the patch management information 130.

[0045] In step S2 of Figure 4, the patch application management unit 10 of IC card 1 checks the security classification 121 of the functional module 12 to which the patch 16 included in the patch storage command will be applied when the shipping flag 14 is set, i.e., when the shipping flag 14 is True (step S3). The module ID 120 included in the patch storage command is used to check the security classification 121. The patch application management unit 10 searches for a functional module 12 with the module ID 120 included in the patch storage command attached from among the functional modules 12 implemented in the first non-volatile memory 102, and checks the security classification 121 of the functional module 12 with the module ID 120 included in the patch storage command attached.

[0046] In step S3, if the security classification 121 of the functional module 12 to which patch 16 is applied is a secure function, the patch application management unit 10 terminates the procedure in Figure 4 without writing patch 16 included in the patch storage command to the second non-volatile memory 103. In step S3, if the security classification 121 of the functional module 12 to which patch 16 included in the patch storage command is applied is a non-secure function, the patch application management unit 10 proceeds to step S4 in Figure 4, writes patch 16 included in the patch storage command to the second non-volatile memory 103, and then in step S5, updates patch management information 130 including a patch management module ID 1300 that matches the module ID 120 included in the patch storage command, and terminates the procedure in Figure 4.

[0047] Thus, the patch application management unit 10 of the IC card 1 according to this embodiment allows the storage of patch 16 when the IC card 1 is in its shipped state, regardless of whether the functional module 12 to which patch 16 is applied is a secure function or an insecure function. The patch application management unit 10 of the IC card 1 according to this embodiment allows the storage of patch 16 only when the shipping flag 14 is set, that is, when the IC card 1 is in its shipped state, if the functional module 12 to which patch 16 is applied is an insecure function. As a result, when the IC card 1 is in its shipped state, patch 16 of the secure function module 12S cannot be applied, and therefore the security of the IC card 1 is not compromised.

[0048] Next, the patch operation management unit 11 of the IC card 1 will be described. As mentioned above, the patch application management unit 10 according to this embodiment permits the application of patch 16 only in the case of the non-secure function module 12N, even after the IC card 1 has been shipped. For this reason, it is conceivable that a malicious non-secure function patch 16N may be applied after the IC card 1 has been shipped. Therefore, the patch operation management unit 11 of the IC card 1 according to this embodiment manages the operation of the non-secure function patch 16N so that the secure function module 12S is not affected by the non-secure function patch 16N, even if a malicious non-secure function patch 16N is applied.

[0049] Figure 5 is a diagram illustrating the operation of the patch operation management unit 11. Figure 6 is a diagram illustrating the non-secure function execution process. Figure 7 is a diagram illustrating the secure function execution process. The explanations of Figures 5, 6, and 7 also serve as an explanation of the patch operation management method according to the present invention.

[0050] In this embodiment, the patch operation management unit 11 of the IC card 1, when one of the function modules 12 implemented in the first non-volatile memory 102 is called (step S10), checks the security classification 121 of the called function module 12 (step S11). If the called function module 12 is a secure function module 12S, the patch operation management unit 11 of the IC card 1 proceeds to step S13 in Figure 5 and executes a secure function execution process to manage the execution of the secure function module 12S, and the procedure in Figure 5 ends. If the called function module 12 is a non-secure function module 12N, the patch operation management unit 11 of the IC card 1 proceeds to step S12 in Figure 5 and executes a non-secure function execution process to manage the execution of the non-secure function module 12N, and the procedure in Figure 5 ends.

[0051] The non-secure function execution process will be explained with reference to Figure 6. When the non-secure function module 12N is executed, the patch operation management unit 11 of the IC card 1 searches the non-secure function patch management table 13N stored in the second non-volatile memory 103 for patch management information 130 that includes a patch management module ID 1300 that matches the module ID 120 of the function module 12 called in step S10 of Figure 5 (step S120).

[0052] Next, the patch operation management unit 11 of the IC card 1 checks the application flag 1301 included in the patch management information 130 retrieved in step S120 of Figure 6 (step S121). If the application flag 1301 is not set, that is, if the application flag 1301 is False, the patch operation management unit 11 executes the non-secure function module 12N called in step S10 of Figure 5 from among the function modules 12 implemented in the first non-volatile memory 102 (step S122), and the procedure in Figure 6 ends.

[0053] In step S121 of Figure 6, if the application flag 1301 is set, that is, if the application flag 1301 is True, the patch operation management unit 11 sets the non-secure flag 15 provided in the volatile memory 104, that is, sets the non-secure flag 15 to True (step S123), and then uses the call address 1302 contained in the patch management information 130 retrieved in step S120 of Figure 6 to execute the non-secure function patch 16N applied to the non-secure function module 12N called in step S10 of Figure 5 (step S124). When the processing related to the non-secure function patch 16N executed in step S124 of Figure 6 is completed, the patch operation management unit 11 resets the non-secure flag 15 provided in the volatile memory 104, that is, sets the non-secure flag 15 to False (step S125), and the procedure in Figure 6 ends.

[0054] The secure function execution process will be explained with reference to Figure 7. When executing the secure function module 12S, the patch operation management unit 11 of the IC card 1 checks the non-secure flag 15 set in the volatile memory 104 (step S130). If the non-secure flag 15 set in the volatile memory 104, that is, if the non-secure flag 15 is True, it is possible that the secure function module 12S was called by a malicious non-secure function patch 16N. Therefore, the patch operation management unit 11 of the IC card 1 stops the execution of the secure function module 12S that was called in step S10 of Figure 5 (step S131), and the procedure in Figure 7 ends.

[0055] If the non-secure flag 15 set in the volatile memory 104 is not set, that is, if the non-secure flag 15 is False, the patch operation management unit 11 of the IC card 1 searches the secure function patch management table 13S stored in the second non-volatile memory 103 for patch management information 130 that includes a patch management module ID 1300 that matches the module ID 120 of the function module 12 called in step S10 of Figure 5 (step S132).

[0056] Next, the patch operation management unit 11 of the IC card 1 checks the application flag 1301 included in the patch management information 130 retrieved in step S132 of Figure 7 (step S133). If the application flag 1301 is not set, that is, if the application flag 1301 is False, the patch operation management unit 11 executes the secure function module 12S called in step S10 of Figure 5 from among the function modules 12 implemented in the first non-volatile memory 102 (step S134), and the procedure in Figure 7 ends.

[0057] In step S133 of Figure 7, if the application flag 1301 is set, that is, if the application flag 1301 is True, the patch operation management unit 11 uses the call address 1302 contained in the patch management information 130 retrieved in step S132 of Figure 7 to execute the secure function patch 16S applied to the secure function module 12S called in step S10 of Figure 5, and the procedure in Figure 7 ends.

[0058] As described above, the patch operation management unit 11 of the IC card 1 according to this embodiment is configured to prohibit the secure function module 12S from being called from the non-secure function patch 16N. As a result, even if a malicious non-secure function patch 16N is applied to the IC card 1 after it has been shipped, the secure function module 12S cannot be called from the malicious non-secure function patch 16N, and therefore the security of the IC card 1 is not compromised. [Explanation of Symbols]

[0059] 1 IC card 1a Contact terminal board 1b Card media 10 Patch Application Management Department 11 Patch Operations Management Department 12 Function Modules 120 Module ID 121 Security Classification 12S Secure Function Module 12N Non-Secure Function Module 13 Patch Management Table 13S Secure Function Patch Management Table 13N Non-Secure Function Patch Management Table 130 Patch Management Information 1300 Patch management module ID 1301 Applicable flag 1302 Calling address 1303 Patch Size 14. Shipping Flag 15. Non-secure flag 16 Patch 16S Secure Feature Patch 16N Insecure Functionality Patch 100 IC chips for IC cards 101 Processors 102 First Non-Volatile Memory 103 Second Non-Volatile Memory 104 Volatile memory 105 UART 106 Cryptographic Engines

Claims

1. A first non-volatile memory that is not rewritable and stores a functional module to which a security classification indicating either a secure function or a non-secure function has been added, A rewritable second non-volatile memory used for storing patches applied to the aforementioned functional module, If the shipping flag indicating that it is in the shipping state is set, the patch application management unit that stores the patch in the second non-volatile memory will only be used when the security classification of the functional module to which the patch is applied is a non-secure function. An IC card characterized by having the following features.

2. The IC card according to claim 1, characterized in that, if the shipment flag is not set, the patch application management unit stores the patch in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied.

3. A patch operation management unit that prohibits the calling of a functional module whose security classification is secure from a patch applied to the functional module whose security classification is non-secure, An IC card as described in claim 1 or claim 2, characterized by having the following features.

4. A first non-volatile memory that is not rewritable and stores a functional module to which a security classification indicating either a secure function or a non-secure function has been added, A rewritable second non-volatile memory used for storing patches applied to the aforementioned functional module, As a function that utilizes the processor, if the shipping flag indicating that it is in the shipping state is set, the patch application management unit stores the patch in the second non-volatile memory only when the security classification of the function module to which the patch is applied is a non-secure function, An IC chip for IC cards characterized by having the following features.

5. The IC chip for an IC card according to claim 4, characterized in that, if the shipment flag is not set, the patch application management unit stores the patch in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied.

6. An IC chip for an IC card according to claim 4 or 5, characterized in that, as a function utilizing the processor, it includes a patch operation management unit that prohibits the calling of a function module whose security classification is secure from a patch applied to the function module whose security classification is non-secure.

7. An IC card processor comprising a first non-volatile memory that stores a functional module with a security classification indicating either a secure or non-secure function, and a second non-volatile memory that is rewritable for storing patches applied to the functional module, A computer program that functions as a patch application management unit, storing the patch in the second non-volatile memory only when the security classification of the functional module to which the patch is applied is non-secure, if the shipping flag indicating that the device is in a shipped state is set.

8. The computer program according to claim 7, characterized in that, if the shipment flag is not set, the patch application management unit stores the patch in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied.

9. An IC card processor comprising a first non-volatile memory that stores a functional module with a security classification indicating either a secure or non-secure function, and a second non-volatile memory that is rewritable for storing patches applied to the functional module, A computer program that functions as a patch operation management unit, which prohibits the calling of a functional module whose security classification is secure from a patch applied to the functional module whose security classification is non-secure.

10. A patch application management method characterized in that, when an IC card having a non-rewritable first non-volatile memory storing a functional module with a security classification indicating either a secure function or a non-secure function, and a rewritable second non-volatile memory used for storing patches to be applied to the functional module, has a shipping flag set to indicate that it is in the shipping state, the patch is stored in the second non-volatile memory only when the security classification of the functional module to which the patch is applied is a non-secure function.

11. The patch application management method according to claim 10, characterized in that, if the shipping flag is not set, the patch is stored in the second non-volatile memory regardless of the security classification of the functional module to which the patch is applied.

12. A patch operation management method characterized in that an IC card having a first non-rewritable non-volatile memory for storing a functional module with a security classification indicating either a secure function or a non-secure function, and a second rewritable non-volatile memory for storing patches applied to the functional module, prohibits the functional module having a security classification of secure function from being called from a patch applied to the functional module having a security classification of non-secure function.

Images