Abstract:
A system is presented for installing a valid application in an IC card without newly issuing an IC card and without an application installation privilege certificate.  
     A terminal device forwards to a confirmation card an application and pre-calculated tamper-free confirmation information derived from the application obtained from a server. The confirmation card re-calculates tamper-free confirmation information from the forwarded application. The presence of tampering in the forwarded application is determined by comparing the pre-calculated tamper-free confirmation information with the tamper-free confirmation information re-calculated from the forwarded application. The result of the determination is sent to the terminal device. If the application has not been tampered with, the terminal device installs the application in the execution card.

Description:
CROSS-REFERENCES TO RELATED APPLICATIONS  
         [0001]    This applications claims the benefit of priority to Japanese Patent Application No. 2001-365794, which has the same inventors as the present application and was filed on Nov. 30, 2001 by Hitachi, LTD. and assigned to Hitachi, LTD. Hitachi, LTD. is also the assignee of the present application.  
         STATEMENT AS TO RIGHTS TO INVENTIONS MADE UNDER FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT  
         [0002]    NOT APPLICABLE  
         REFERENCE TO A “SEQUENCE LISTING,” A TABLE, OR A COMPUTER PROGRAM LISTING APPENDIX SUBMITTED ON A COMPACT DISK  
         [0003]    NOT APPLICABLE  
         BACKGROUND OF THE INVENTION  
         [0004]    Recent years have seen the growing use of “multi-application integrated circuit (IC) cards” in which multiple applications can be installed. When issued, these cards require card activation data created by a card administrator or a card issuer. Also, installing an application requires an installation permission certificate created by a card administrator or a card issuer. As a result of requiring the participation of a card administrator or a card issuer, the process of issuing new cards and installing applications involves significant time and effort as well as associated expenses.  
           [0005]    In addition, providing different IC card application execution privileges for different users requires the installation of applications that have been customized for individual users. Installation of such customized applications also involves significant time and effort as well as associated expenses.  
           [0006]    Japanese laid-open patent publication number 2000-29996 describes execution privilege management for functions shared by a group of IC cards.  
           [0007]    The object of the present invention is to install a valid application to a card without card activation data or an installation permission certificate provided by a card administrator or a card issuer.  
           [0008]    Another object of the present invention is to allow application execution privileges to be set up for individual card users without installing newly customized applications or issuing new cards.  
         BRIEF SUMMARY OF THE INVENTION  
         [0009]    The present invention is a method for installing an application from a terminal device to a first card. An application and tamper-free confirmation information calculated from the application are sent from the terminal device to a second card. The second card calculates the tamper-free confirmation information from the application and checks for tampering of the application by comparing a calculation result and the received tamper-free confirmation information. The application is installed in the first card via the terminal device if there is no tampering in the application.  
           [0010]    Also, when an application installed in the first card is to be executed on the first card, execution privilege confirmation information installed in the second card is sent to the first card via the terminal device. The first card performs execution of the application in a branching manner depending on this received execution privilege confirmation information.  
           [0011]    A further understanding of the nature and advantages of the present invention may be realized by reference to the remaining portions of the specification and the drawings. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0012]    [0012]FIG. 1 is a generalized diagram of the system architecture of a first embodiment of the present invention;  
         [0013]    [0013]FIG. 2 is a flowchart showing operations performed in the first embodiment;  
         [0014]    [0014]FIG. 3 is a generalized diagram of the system architecture of a second embodiment of the present invention;  
         [0015]    [0015]FIG. 4 is a flowchart showing the operations performed when installing an application in the second embodiment; and  
         [0016]    [0016]FIG. 5 is a flowchart showing the operations performed when executing an application in the second embodiment. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0017]    Various embodiments of the present invention will be described in detail using the drawings.  
         [0018]    [0018]FIG. 1 is a generalized diagram showing the architecture of an IC card system according to the first embodiment of the present invention. This system includes a terminal device  101 , an execution card  102 , and a confirmation card  103 . The terminal device  101  is a general-purpose computer such as a personal computer, a dedicated computer performing predetermined tasks, or another type of dedicated terminal device. The terminal device  101  is equipped with a processor, memory, an input device, a display device, and a card reader/writer for reading data from and writing data to the execution card  102  and the confirmation card  103 . Application programs for predetermined tasks using the card are stored in the memory and are executed by the processor of the terminal device.  
         [0019]    The execution card  102  and the confirmation card  103  are IC cards equipped with at least one semiconductor chip with a processor, memory, and an I/O interface feature for communicating with the terminal device  101 . A control program and application programs are stored in the memory and executed by the processor. The confirmation card  103  contains a program that sends specified information to the terminal device  101  when execution permission confirmation information is requested by the terminal device  101 . The execution card  102  contains at least one application that works with an application program of the terminal device  101  to support tasks of the terminal device  101 . The confirmation card  103  is an official IC card issued by a card issuer. The execution card  102  is either an IC card issued by the card issuer or, as similar to the execution card  302  of the second embodiment described later, an IC card for which there is no card issuer. Such a card with no card issuer may be a blank card that is purchased with no pre-installed application programs.  
         [0020]    [0020]FIG. 2 is a flowchart showing operations performed by the terminal device  101 , the execution card  102 , and the confirmation card  103 . Note that each operation is graphically presented as a block positioned beneath the apparatus (terminal device  101 , execution card  102 , or confirmation card  103 ) that performs the operation. The terminal device  101  receives from a user (the operator of the input device of the terminal device  101  or an application in the terminal device  101 ) an execution instruction for a specific application (AP) stored in the execution card  102  (step  201 ). The terminal device  101  sends the execution card  102  an execution instruction for the application specified by the user (step  202 ). The execution card  102  receives the instruction from the terminal device  101  and activates the specified application. The activated application sends the terminal device  101  a request for execution privilege confirmation information that is needed to run the application (step  203 ). The terminal device  101  sends the confirmation card  103  the execution privilege confirmation information request received from the execution card  102  (step  204 ).  
         [0021]    The confirmation card  103  receives this execution privilege confirmation request and sends the requested execution privilege confirmation information stored in the memory of the confirmation card  103  to the terminal device  101  (step  205 ). If the confirmation card  103  stores values for multiple data fields, e.g., date of birth and age, tags indicating the desired data fields can be used to make the execution privilege confirmation information request. In this case, these data field values would be the execution privilege confirmation information. The terminal device  101  sends the execution privilege confirmation information received from the confirmation card  103  to the execution card  102  (step  206 ). Based on this execution privilege confirmation information, the execution card  102  determines whether or not to continue to run the application (step  207 ). If so, the application continues until completion and then ends operation (step  208 ). Otherwise, the terminates and ends operation (step  209 ). In other words, the operations branch out between step  208  and step  209  depending on the execution privilege confirmation information.  
         [0022]    The transfer of information between the execution card  102  and the confirmation card  103  via the terminal device  101  takes place using a system that prevents eavesdropping and tampering.  
         [0023]    Next, a method for disabling scrambling when receiving a pay television broadcast will be described as a specific example of the first embodiment. The execution card  102  is an IC card containing an application for disabling scrambling. The confirmation card  103  is a card storing information proving the date of birth and age of the user (card holder), e.g., an identification IC card or driver&#39;s license IC card. The terminal device  101  is a television receiver. When a descrambling application for programs or channels that have restrictions on the viewer&#39;s age, the descrambling application on the execution card  102  confirms the viewer&#39;s age by requesting and obtaining the date of birth or age confirmation information stored in the confirmation card  103 . The execution card  102  then determines whether or not to execute the descrambling function.  
         [0024]    In accordance with the first embodiment, application execution privileges can be set up by the card user without requiring the loading of customized applications or issuing of new cards.  
         [0025]    [0025]FIG. 3 shows the architecture of an IC card system according to a second embodiment of the present invention. This system is formed from a terminal device  301 , an execution card  302 , a confirmation card  303 , and a server  304 . The terminal device  301  is a terminal device similar to the terminal device  101  and executes applications for predetermined tasks that use a card. The execution card  302  is similar to the execution card  102  and stores at least one application for supporting the tasks of the terminal device  301 . In this case, the execution card  302  does not require an installation privilege certificate provided by a card administrator or a card issuer to install applications and is an IC card for which there is no card issuer. The confirmation card  303  is an IC card with an application for confirming the validity of an application installed in the execution card  302 . The confirmation card  303  can also contain an application for supporting tasks of the terminal device  301  or the like, as in the execution card  302 . The confirmation card  303  is similar to the confirmation card  103  and is an official IC card issued by a card issuer. The server  304  is a computer connected to the terminal device  301  via a network and provides applications to be installed on the execution card  302 .  
         [0026]    In the second embodiment, if additional applications cannot be installed in the confirmation card  303  due to insufficient memory, the additional application is installed in the execution card  302  and the confirmation card  303  is used to confirm its validity.  
         [0027]    The execution card  302  is equipped with the following functions:  
         [0028]    (1) A function for securely exchanging data with the confirmation card  303 , e.g., storing an encryption key and encrypting with the key.  
         [0029]    (2) A function for creating information used to confirm that an application has not been tampered with. This information can be, for example, a hash value such as SHA-1.  
         [0030]    It is assumed that a user downloading an application from the terminal device  301  to the execution card  302  already owns a card issued by the card issuer. This card corresponds to the confirmation card  303 . The confirmation card  303  has the following requirements.  
         [0031]    (1) The presence of a function for creating information used to confirm that an application has not been tampered with, e.g., a hash value such as SHA-1.  
         [0032]    (2) The ability to exchange data securely with the server  304 , e.g., using encryption with an encryption key.  
         [0033]    (3) The ability to store a list of application of identification information installed in the execution card  302 .  
         [0034]    (4) The ability to exchange data securely with the execution card  302 , e.g., using encryption with an encryption key.  
         [0035]    Since applications can be installed in the execution card  302  without an installation privilege certificate provided by a card administrator or a card issuer, it is important for the application provider that the provided application is installed in the execution card  302  without tampering. When an application is installed in the execution card  302 , the confirmation card  303  is used to check that the application has not been tampered with. A list of installed applications is stored in the confirmation card  303 . When an application is executed, the execution is performed using the confirmation card  303 . Thus, applications are executed after confirmation that the applications have been installed without any tampering.  
         [0036]    [0036]FIG. 4 is a flowchart showing the operations performed by the terminal device  301 , the execution card  302 , the confirmation card  303 , and the server  304  when an application is installed in the execution card  302 . Note that each operation is graphically presented as a block positioned beneath the apparatus (terminal device  301 , execution card  302 , or confirmation card  303 ) that performs the operation.  
         [0037]    The terminal device  301  receives an instruction to install a specific application from the user (step  401 ). The terminal device  301  sends a request via the network to the server  304  for (1) the application to be installed and (2) tamper-free confirmation information that can later be used by the confirmation card to confirm that the application has not been tampered with (step  402 ). An example of such tamper-free confirmation information is a hash value of the application program that has been encrypted with an encryption key and can only be decrypted by the confirmation card.  
         [0038]    The server  304  sends the terminal device  301  the requested application and tamper-free confirmation information (step  403 ). The terminal device  301  sends the confirmation-card  303  the application program sent at step  403  and the tamper-free confirmation information (step  404 ).  
         [0039]    The confirmation card  303  independently calculates the tamper-free confirmation information using the received application. The result of this calculation is compared with the received tamper-free confirmation information to confirm whether or not the received application has been tampered with (step  405 ). If step  405  confirms that the application has not been tampered with, an instruction to install the application in the execution card  302  is sent to the terminal device  301  (step  406 ). If step  405  confirms that the application has been tampered with, an instruction to cancel installation of the application in the execution card  302  is sent to the terminal device  301 .  
         [0040]    The terminal device  301  receives the application installation instruction and sends the application to the execution card  302  (step  407 ). The execution card  302  installs the received application in memory and creates information used to confirm that the installed application has not been tampered with (step  408 ). Next, the execution card  302  sends the terminal device  301  the tamper-free confirmation information generated at step  408  (step  409 ). The terminal device  301  receives application and the tamper-free confirmation information for the application that was sent by the execution card  302  at step  409 , and sends these to the confirmation card  303  (step  410 ).  
         [0041]    The confirmation card  303  compares the tamper-free confirmation information received from the terminal device  301  at step  410  and the tamper-free confirmation information calculated at step  405  to confirm that the application installed in the execution card  302  has not been tampered with (step  411 ). If the confirmation card  303  is able to confirm at step  411  that the application installed in the execution card  302  has not been tampered with, identification information for the application is added to the execution card installed applications list of the confirmation card  303  (step  412 ).  
         [0042]    Along with the application identification information, the confirmation card  303  can register the card number of the execution card  302  in the application list. Such a card number can allow the confirmation card  303  to uniquely identify the execution card  302  so that is not confused with other cards. Also, the server  304  can be eliminated if the terminal device  301  itself stores the application and the tamper-free confirmation information.  
         [0043]    It would also be possible to immediately register the application in the application list (previously performed in step  412 ) if no tampering of the application is found at step  405 . In addition, step  410  may be modified such that the terminal device  301  does not send the tamper-free confirmation information received from the execution card  302  to the confirmation card  303 , but instead compares it to the tamper-free confirmation information received from the server  304  at step  404 . Here, the modified step  410  requires the terminal device  301  to be able to decrypt the tamper-free confirmation information received from the server  304 , if such information is encrypted.  
         [0044]    If the validity of the application cannot be confirmed at step  410 , the terminal device  301  passes the confirmation card  303  through the card reader/writer of the terminal device  301  and instructs the confirmation card  303  to remove the application registered at step  406  from the list. If the application registered in the execution card  302  is valid, the lists does not need to be modified, and the confirmation card need only be passed through the card reader/writer once. Alternatively, assuming that the validity of the application was confirmed at step  406 , the application can be registered in the application list as in step  412 , the terminal device  301  can install the application in the execution card  302  at step  407 , and step  408  through step  411  can be omitted.  
         [0045]    [0045]FIG. 5 shows a flowchart of the operations performed by the terminal device  301 , the execution card  302 , and the confirmation card  303  when an application installed in the execution card  302  is to be executed and confirmation is to be made that the application has been registered in the application list in the confirmation card  303 . Again note that each operation is graphically presented as a block positioned beneath the apparatus (terminal device  301 , execution card  302 , or confirmation card  303 ) that performs the operation. The terminal device  301  receives from the user an instruction to execute a particular application stored in the execution card  302  (step  501 ). The terminal device  301  sends an instruction to execute the indicated application to the execution card  302  (step  502 ). The execution card  302  sends the terminal device  301  a request for application registration confirmation information, in order to query whether the application is registered in the confirmation card  303  (step  503 ). This application registration confirmation information request includes an identifier for the indicated application. A card number for the execution card  302  can also be included. The terminal device  301  sends to the confirmation card  303  the application registration confirmation information request received from the execution card  302  (step  504 ).  
         [0046]    The confirmation card  303  receives this application registration confirmation information request, determines whether the application contained in this request is registered in the application list in the execution card, and sends the result to the terminal device  301  (step  505 ). Based on whether the application is registered in the confirmation card  303 , the terminal device  301  instructs the execution card  302  to continue or cancel execution (step  506 ). The execution card  302  receives this instruction and continues or cancels the application (step  507 ). Alternatively, the execution card  302  performs a different branching operation (other than continue or cancel) in response to this instruction. It would also be possible to eliminate step  502  and step  503  and to instead have the terminal device  301  itself send the execution privilege confirmation request to the confirmation card  303  at step  504 . In this case, at step  506  the terminal device  301  determines whether or not send an application execution instruction to the execution card  302 . As a result, the execution card  302  need only be passed through the card reader/writer once.  
         [0047]    According to the second embodiment, if the IC card belonging to the card user has insufficient memory for installing an additional application, the application can be installed in an execution card that was not officially issued, and the validity of the application can be confirmed by using the card user&#39;s original IC card (as a confirmation card). Also, the validity of the application can be confirmed each time the application is executed. As a result, tampering of applications can be prevented even if a card has not been officially issued or there is no application installation privilege certificate. The second embodiment can also be used if the execution card  302  has insufficient memory to install an additional application.  
         [0048]    With the present invention as described above, valid applications can be installed in a card even without a card being issued or an installation privilege certificate provided by a card administrator or a card issuer. Thus, the time and expenses required by the conventional technology to have a card issued and to obtain an installation privilege certificate can be eliminated. Also, if a card has insufficient memory to install an additional application, the time and expenses required in issuing a new card can be eliminated. Furthermore, application execution privileges can be customized on a per-user basis without requiring a new application to be installed or a new card to be issued, and the associated time and expenses can be eliminated.  
         [0049]    Although the present invention has been described in terms of specific embodiments, it should be apparent to those skilled in the art that the scope of the present invention is not limited to the described specific embodiments. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. It will, however, be evident that additions, subtractions, substitutions, and other modifications may be made without departing from the broader spirit and scope of the invention as set forth in the claims.