Reader/writer secure module access control method

A secure module holder is (SH) capable of preventing an unauthorized reading of information on a secure module (SM). The SH holds one or more SM. The SH controls non-contact communication with a reader/writer RW of the SM and includes non-contact communication section, contact communication section with the SM, access controller performing authentication processing with the RW, and a control unit. The control unit performs a process for invalidating the non-contact communication means section of the SM inserted, a process for causing the access controller to perform an authentication process with the RW according to a card application selection request of the RW, and a process of permitting the RW to access the card application of the SM if the authentication is successful. The number of SM held by the SH and the card application stored in them cannot be known by the RW which has not completed the authentication process.

TECHNICAL FIELD

The present invention relates to a program for implementing a method of controlling access by a reader/writer (hereinafter, abbreviated as “RW”) to a secure module such as an IC card and an apparatus and secure module used to implement the method, and is intended to prevent information of the secure module from being illegally read.

BACKGROUND ART

In recent years, an IC card has been widely used as an electronic settlement card, commutation ticket, event ticket, credit card or the like. Recently, along with the improvement of miniaturization technologies, IC card having relatively large-volume memory capacity has been created and by storing a plurality of card applications executing card services, a single IC card can be used as a multi-application card corresponding to a plurality of applications.

There are two types of IC card communication schemes; a contact communication whereby recorded information is read and written with an RW contacting an electric contact of the IC card and a non-contact communication whereby information is exchanged through wireless communication and no physical contact with the RW is required. Recently, an IC card capable of both contact communication and non-contact communication is mounted in a mobile terminal apparatus and this mobile terminal is also used as a substitute for an electronic purse or commutation ticket.

FIG. 1schematically shows a configuration of secure module20such as an IC card and RW10performing a non-contact communication. Secure module (SM)20is provided with SM local wireless communication section21to perform a non-contact communication, a plurality of card applications23and control section22that controls the operation of secure module20, and RW10is provided with RW local wireless communication section11that performs a non-contact communication with SM local wireless communication section21.

RW10on standby periodically sends out a request signal from RW local wireless communication section11to detect approaching of secure module20to a communication area. When the user holds up secure module20over RW10, secure module20which has approached the communication area of RW10responds to a request signal through SM local wireless communication section21and a non-contact communication between RW local wireless communication section11and SM local wireless communication section21starts. Next, RW10selects card application23, and selected card application23and RW10proceed with processing of execution of a service.

Unlike a contact communication, however, a non-contact communication has a possibility that a plurality of secure modules20may go into the communication area of RW10and when a plurality of secure modules20communicate with RW10simultaneously, it is necessary to communicate by identifying cards. Therefore, ISO14443-3 defying the international standard for a non-contact and proximity type IC card prescribes an anticollision procedure as a processing procedure when a plurality of secure modules20exist simultaneously.

FIG.2shows an anticollision procedure on a B-type card and a card application selection procedure prescribed in ISO7816-4. An RW periodically transmits a request command (REQB) to detect approaching of an IC card to the communication area. Upon receiving the request command (REQB), the IC card which approached the communication area of the RW returns a response (ATQB) including the own identification number (PUPI) to this REQB. The apparatus on the RW side sets a card identifier (CID) to the IC card which responded, assigns PUPI to an ATTRIB command including CID information and transmits it. The IC card becomes active (activated state) when its identification number (PUPI) is included in the ATTRIB command and returns a response (ATQB) to the RW. After that, the IC card responds only to commands assigned the CID which has been set in the IC card.

The RW transmits a Select file which specifies a card application by an identification number (AID) to the IC card, and the IC card starts the selected card application and returns a response (ATQB) to the RW.

DISCLOSURE OF INVENTION

Problems to be Solved by the Invention

However, according to this procedure for anticollision and card application selection, a card application which is stored in the IC card may be known to the RW which has not been authenticated yet, and there is a fear that the privacy of the IC card user may be infringed and the user may suffer unexpected damage.

Also, in the near future, a mode will be considered where various services may be available by inserting a plurality of chip-shaped secure modules in a holder which functions as an electronic purse and holding up this holder to various RWs with the secure modules inserted in the electronic purse. In this case, however, the number of secure modules inserted in the electronic purse and card applications stored in each secure module may be known to the RW which has not been authenticated yet through the anticollision procedure and the card application selection procedure and there is a fear of privacy infringement.

The present invention is intended to solve such conventional problems and it is an object of the present invention to provide a program for implementing a method of preventing illegal reading of information on a secure module and an apparatus (holder) and secure module used for implementation of the method.

Means for Solving the Problem

Thus, the present invention configures a program which prescribes operation of a control section of a secure module holder that holds one or a plurality of secure modules storing at least one card application and having a non-contact communication section and controls a non-contact communication with an RW of this secure module so as to cause this control section to execute a step of disabling the non-contact communication section of the secure module before access to the card application stored in the secure module is requested from the reader/writer, a step of selecting an authentication application according to a card application selection request of the reader/writer and executing authentication processing with the reader/writer and a step of permitting the RW to access the card application stored in the secure module only when this authentication processing succeeds.

Furthermore, as a step when the authentication processing succeeds, the present invention enables the non-contact communication section of the secure module which has been disabled so as to permit the RW to access the card application stored in the secure module through this non-contact communication section.

Furthermore, as a step when the authentication processing succeeds, the present invention permits the RW to access the card application stored in the secure module through the non-contact communication section of the secure module holder.

Therefore, an RW that has not completed the authentication processing yet cannot know the number of secure modules held in this secure module holder and the card applications stored in the secure module.

Furthermore, the present invention configures a program which prescribes operation of a control section of a secure module that stores at least one card application and has a non-contact communication section with an RW so as to cause this control section to execute a step of selecting an authentication application according to a card application selection request of the RW and executing authentication processing with the RW and a step of permitting the RW to access the card application stored in the secure module only when this authentication processing succeeds.

Therefore, an RW that has not completed the authentication processing yet cannot know the card application stored in this secure module.

Furthermore, the present invention provides a secure module holder that holds one or a plurality of secure modules storing at least one card application and having a non-contact communication section and controls a non-contact communication of this secure module with an RW, comprising the non-contact communication section that performs the non-contact communication with the RW, a contact communication section that performs a contact communication with the secure module, an access control section that performs authentication processing with the RW and a control section that controls operation of the secure module holder, and configures this control section so as to execute a step of disabling the non-contact communication section of the secure module before access to the card application stored in the secure module is requested from the RW, a step of causing the access control section to perform authentication processing with the RW according to a card application selection request of the RW and a step of permitting the RW to access the card application stored in the secure module only when this authentication processing succeeds.

Furthermore, before access to the card application stored in the secure module is requested from the RW, this control section is configured so as to execute a step of disabling the non-contact communication section of the secure module, a step of causing the access control section to perform authentication processing with the RW according to the card application selection request of the RW and a step of enabling the non-contact communication section of the secure module which has been disabled only when this authentication processing succeeds and permitting the RW to access the card application stored in the secure module through the non-contact communication section of the secure module.

Furthermore, before access to the card application stored in the secure module is requested from the RW, this control section is configured so as to execute a step of disabling the non-contact communication section of the secure module, a step of causing the access control section to perform authentication processing with the RW according to the card application selection request of the RW and a step of permitting the RW to access the card application stored in the secure module through the non-contact communication section and the contact communication section of the secure module holder only when this authentication processing succeeds.

Furthermore, the present invention sets an application ID which is different from that of the card application in the authentication application of the access control section that performs authentication processing with the RW or an application ID which is identical to that of the card application.

An RW that has not completed the authentication processing yet cannot know the number of secure modules stored in this secure module holder and the card application stored in the secure module.

Furthermore, the present invention provides a secure module that stores at least one card application, comprising a non-contact communication section that performs a non-contact communication with an RW, an access control section that performs authentication processing with the RW and a control section that controls operation of the secure module, and causes this control section to execute a step of causing the access control section to perform authentication processing with the RW according to a card application selection request of the RW and a step of permitting the RW to access the card application stored in the secure module only when this authentication processing succeeds.

Furthermore, the present invention sets an application ID which is different from that of the card application in the authentication application of the access control section that performs authentication processing with the RW or an application ID which is identical to that of the card application.

An RW that has not completed the authentication processing yet cannot know the card application stored in this secure module.

Advantageous Effect of the Invention

The program of the present invention can prevent the number of secure modules stored in a secure module holder and card applications stored in the secure modules from being known to an RW which has not been authenticated and can thereby protect privacy of the user.

Furthermore, the secure module holder of the present invention can prevent the number of secure modules stored and card applications stored in the secure modules from being known to an RW which has not been authenticated.

Furthermore, the secure module of the present invention can prevent card applications stored from being known to an RW which has not been authenticated.

BEST MODE FOR CARRYING OUT THE INVENTION

The following embodiments will describe disabling of a local wireless function provided for a secure module, but the present invention is also applicable when other communication functions such as Bluetooth, Wireless LAN, LAN and wireless public network are provided.

Embodiment 1 of the present invention will describe a method of preventing information of a secure module stored in an electronic purse (secure module holder) from being known to an RW which has not completed authentication yet.

FIG. 3shows a configuration of secure module holder (SH)30and RW10which implement this method. Secure module holder30is provided with SH local wireless communication section31that is a non-contact communication section with RW10, SH communication section33that is a contact communication section with inserted secure module20, access control secure module34that stores an authentication card application to authenticate RW10that accesses card application23of secure module20and control section32that controls the operation of secure module holder30. Furthermore, one or a plurality of secure modules20inserted in secure module holder30is provided with SM local wireless communication section21that is a non-contact communication section, a plurality of card applications (service applications)23, SM communication section24that is a contact communication section with secure module holder30and control section22that controls the operation of secure module20.

Furthermore, RW10is provided with RW local wireless communication section11that is a non-contact communication section and service execution section12that specifies service application23of secure module20and executes a service.

This RW10performs mutual authentication processing with an authentication card application stored in access control secure module34of secure module holder30, and access to secure module20becomes possible only when the authentication succeeds.

Access control secure module34may be directly built in secure module holder30or may also be stored in a module which is physically removable from secure module holder30(a different module from secure module20inFIG. 3is assumed).

Furthermore, it is also possible to perform access control over a card application mounted in secure module20and stored in another secure module.

Moreover, when access control secure module34is removable, it is possible to perform access control in a pattern which differs according to the type of secure module20owned by the user. That is, when access control secure module34is built in secure module holder30in advance, it is possible to perform access control over only a card application set depending on the selection by the manufacturer of secure module holder30before shipment of secure module holder30, but if access control secure module34is removable, it is possible to change access control secure module34to be inserted in secure module holder30according to the card application to be used.

As another case of usage, when the user always carries around secure module holder30with a plurality of modules containing card applications inserted therein, it is possible to assume a case where the user has two access control secure modules34and puts only access control information for a company on a normal business day (for example, key of the house, commutation ticket, employee ID, authentication information of corporate credit card) in one access control secure module34while preventing other card applications from being used and puts only access control information for holidays (for example, private card application such as key of the house (common), personal credit card, video membership card, key of a cottage) in other access control secure module34while preventing other card applications from being used, and switches between two access control secure modules34according to an environment in which the user uses the card applications. It is also possible to include a calendar function in secure module holder30and automatically switch between the normal business day mode and night/holiday mode.

Furthermore, secure module holder30may also be provided with a reporting section (LED, speaker, liquid crystal screen may be assumed as example of specific members) to report the current mode to the user. For example, switching between modes may be reported by means of light, sound or color, and the current mode may be displayed using this reporting section. Furthermore, currently available card applications may also be displayed.

As shown inFIG. 10, access control secure module34of secure module holder30stores access control information in which RW authentication information used for authentication of RW10and authentication method in correspondence with AID of card application23of each secure module20and the authentication application authenticates RW10using the RW authentication information of the access control information. The method of setting access control information in access control secure module34will be described in detail in Embodiment 6.

Furthermore, SM local wireless communication section21of secure module20inserted in secure module holder30is disabled while it is inserted insecure module holder30(SH local wireless communication section31is given priority) and when RW10which has succeeded in authentication communicates with secure module20, communication is carried out through RW local wireless communication section11, SH local wireless communication section31, SH communication section33and SM communication section24.

Operations of such series are controlled by control section32composed of a CPU of secure module holder30, and control section32executes this control operation according to a program.

FIG. 4shows processing steps in this case. InFIG. 4, the order of the processing is shown by numbers in parentheses (the same will apply to other flow charts). Here, a case where AID of service application23and AID of the authentication application which performs authentication processing for the service application are set separately will be explained.

When secure module20is inserted in secure module holder30(a1), control section32of secure module holder30sends a local wireless disabling instruction for disabling the local wireless communication function of secure module20(gives priority to SH local wireless communication section31) to secure module20(a2) and control section22of secure module20disables SM local wireless communication section21.

Here, a case has been described in conjunction with an example where control section22of secure module20disables SM local wireless communication section21after receiving a local wireless disabling instruction, but in addition to this, control section22may disable SM local wireless communication section21when secure module20is connected to secure module holder30and receives a power supply from secure module holder30. As a result, after secure module20is connected to secure module holder30and the power supply is received, even if the power supply is stopped for some reason before a local wireless disabling instruction is received, it is possible to prevent service application23stored in secure module20from being known to outside RW10which has not been authenticated yet.

On the other hand, when the power supply stops after the disabling has been completed, even if an attempt is made to use secure module20as a single unit, SM local wireless communication section21remains disabled, and therefore SM local wireless communication section21cannot be used in that condition. Therefore, when control section22detects cutoff of power from secure module holder30, it is possible to use secure module20as a single unit even after the power cutoff by enabling SM local wireless communication section21.

The start of power supply and power cutoff can be detected from a specific pin terminal for connection with secure module holder30provided for secure module20.

Furthermore, a pressure sensor may be provided for secure module20to execute disabling processing when a pressure of a predetermined threshold or higher is applied.

RW10periodically transmits a request command (REQB) to detect approaching of the secure module to the communication area (1). When the user holds up secure module holder30over RW10and SH local wireless communication section31receives REQB, control section32of secure module holder30replies through SH local wireless communication section31in accordance with an anticollision procedure (2).

When RW10specifies AID of a service application and requests a selection of a card application (3), control section32of secure module holder30returns an error (4) as authentication processing for RW10has not been completed yet.

RW10specifies AID of an authentication application which corresponds to the service application, sends a card application selection request (5), and control section32returns a response to RW10(6) after starting the authentication application stored in access control secure module34. The authentication application that has started refers to the access control information and executes mutual authentication processing with RW10using the RW authentication information which is specified for the corresponding service application (7). When the authentication processing succeeds, RW10specifies AID of service application23and requests a card application selection (8). The authentication processing has succeeded, so that control section32of secure module holder30transmits this card application selection request to secure module20in which specified service application23is stored. In this way, when data received from SH local wireless communication section31is sent to secure module20through SH communication section33, control section32of secure module holder30converts the data format of the data from a non-contact communication data format (ISO14443-3 Block Format) to a contact communication data format (ISO7816-3-3 Block Format) Conversely, control section32performs reverse data format conversion for data to be sent from secure module20to RW10.

Control section22of secure module20which has received the card application selection request for service application23starts specified service application23and then returns a response to RW10(9)

Next, processing of executing a service is performed between service execution section12of RW10and specified service application23(10).

Here, description has been given assuming that AID of an authentication card application which corresponds to a service application differs from one application to another, but when identical RW authentication information and authentication method are used to all service applications, AID of an authentication card application may be common to all service applications.

Furthermore, when secure module20is removed from secure module holder30, the local wireless communication function of secure module20is enabled.

In this way, this scheme differentiates AID of a service application from AID of an authentication application and when a service application selection request is received from RW10, the service application selection request from RW10is not responded until authentication processing succeeds.

Furthermore, a communication between RW10and secure module20after the authentication processing succeeds is executed through secure module holder30.

The program of secure module holder30prescribes that control section32should execute a step of disabling the non-contact communication section of secure module20, a step of causing the authentication application to perform authentication processing with RW10and a step of permitting RW10to access service application23only when this authentication processing succeeds.

As a feature of this scheme, secure module holder30rewrites a command, and therefore the workload imposed on secure module holder30is large. However, there is a merit in that it is clear and easily understandable to RW10up to what part the RW authentication processing and service processing have been completed.

When a battery is mounted in secure module20, secure module holder30may start charging the battery in accordance with timing at which the local communication function is disabled.

In Embodiment 2 of the present invention, a scheme will be described whereby a communication between an RW and a secure module after authentication processing has succeeded is carried out through a non-contact communication section of the secure module.

The configurations of the secure module holder and RW in this case are identical to those in Embodiment 1 (FIG. 3). Furthermore, this embodiment is also the same as Embodiment 1 in that access of RW10to service application23is permitted only when authentication with an authentication application stored in access control secure module34succeeds. However, unlike Embodiment 1, when RW10succeeds in authentication with an authentication application, SM local wireless communication section21of secure module20is enabled and a communication between secure module20and RW10is performed through a non-contact communication between SM local wireless communication section21and RW local wireless communication section11.

FIG. 5shows processing steps in this case Here, a case will be described where AID of service application23and AID of an authentication card application which performs authentication processing for the service application are different.

Steps (a1) and (a2) in which the local communication function of secure module20inserted in secure module holder30is disabled and steps (1), (2), (5), (6) and (7) until RW10performs authentication processing with the authentication application stored in access control secure module34are the same as those in Embodiment 1 (FIG. 4).

Upon succeeding in the authentication processing, control section32of secure module holder30enables the local communication function of secure module20in which service application23corresponding to the authentication application is stored (8).

At this time, a reporting section provided for above described secure module holder30may report the user that the local communication function has been enabled.

RW10transmits a request command (REQB) again (9) and secure module20replies through SM local wireless communication section21(10). RW10specifies AID of service application23and sends a card application selection request (11). Control section22of secure module20which has received this card application selection request through SM local wireless communication section21starts specified service application23and then returns a response to RW10through SM local wireless communication section21(12).

Next, the processing of executing a service is performed between service execution section12of RW10and specified service application23through RW local wireless communication section11and SM local wireless communication section21(13).

When non-contact communication is not carried out for a predetermined time or more by secure module20whose local communication function is enabled, control section32of secure module holder30disables the local communication function again (time-out).

As another method of re-disabling, it is also possible to disable the local communication function when control section32receives a processing completion report from service application23.

Furthermore, it is possible to disable the local communication function when secure module holder30periodically performs polling on secure module20and control section32detects that the processing of service application23has been completed.

Moreover, the reporting section provided for above described secure module holder30may also report the disabling to the user.

In this way, this scheme differentiates AID of a service application from AID of an authentication application and when an authentication application selection request is received from RW10, the service application selection request from RW10cannot be made until authentication processing succeeds.

Furthermore, a communication between RW10and service application23after the authentication processing succeeds is performed using the local communication function of secure module20.

The program of secure module holder30prescribes that control section32should execute a step of disabling the non-contact communication section of secure module20, a step of causing the authentication application to perform authentication processing with RW10and a step of enabling the non-contact communication section of secure module20only when this authentication processing succeeds.

As a feature of this scheme, secure module holder30need not rewrite a command so that the workload imposed on secure module holder30is small. Further, there is a merit that it is clear and easily understandable to RW10up to what part the RW authentication and service processing have been completed. On the other hand, RW10must request card detection twice.

However, when control section32of secure module holder30enables the local communication function of secure module20(8), it is possible to omit the steps of requesting second card detections (9) and (10) by sending the results of the card detection processing (1) and (2) executed between secure module holder30and RW10to secure module20and transmitting CID assigned by RW10to secure module20.

In Embodiment 3 of the present invention, a case will be described where AID of a service application is set to be identical to AID of an authentication application which performs authentication processing for the service application. Here, a case will be described where a communication between an RW and a secure module after the authentication processing succeeds is carried out through a secure module holder.

The configurations of this secure module holder and RW are identical to those in Embodiment 1 (FIG. 3).

FIG. 6shows processing steps in this case.

Steps (a1) and (a2) of disabling the local communication function of secure module20inserted in secure module holder30, and steps (1) and (2) until control section32of secure module holder30responds to a card detection request of RW10are the same as those of Embodiment 1 (FIG. 4).

When RW10specifies AID of a service application and requests a selection of a card application (3), control section32of secure module holder30transmits the card application selection request to secure module20which stores the specified service application (4). In the case where RW10transmits received data to secure module20or secure module20transmits received data to RW10, this embodiment is the same as Embodiment 1 in that control section32of secure module holder30converts the data format.

Control section22of secure module20which has received a card application selection request starts specified service application23and then returns a response to control section32of secure module holder30(5). Control section32of secure module holder30saves this response, starts the authentication application of AID specified by RW10from access control secure module34(or starts a dummy authentication application when there is no corresponding authentication application) and returns a response to RW10(6).

The started authentication application performs authentication processing with RW10using the RW authentication information of the access control information (7). It should be noted that when the dummy authentication application carries out authentication processing, the authentication fails and the processing stops at that point.

When the authentication with RW10succeeds, a service processing command is transmitted from RW10(8). Control section32of secure module holder30transmits this command (9) to secure module20which replied at (5). Started service application23responds to this command (10), service execution section12of RW10and specified service application23communicate with each other through secure module holder30and carry out processing of executing a service (11).

Even if there is a response from secure module20when a card application selection is requested, control section32of this secure module holder30does not relay the communication between RW10and secure module20until the authentication of RW10is completed. Furthermore, even when the card application whose selection is requested does not exist in any secure module20, control section32behaves such that the fact is not known to RW10which has not been authenticated yet.

Steps (4) and (5) of transmitting the card application selection request to secure module20may also be performed after the authentication processing succeeds (7) and a service processing command is received from RW10(8).

In this way, according to this scheme, AID of a service application is set to be identical to AID of an authentication application, the authentication application of the identical AID is started when a selection of a service application is requested from RW10and a communication between service application23and RW10cannot be performed until the authentication processing succeeds.

Furthermore, a communication between RW10and secure module20after the authentication processing succeeds is carried out through secure module holder30.

The program of secure module holder30prescribes that control section32should execute a step of disabling the non-contact communication section of secure module20, a step of starting an authentication application of the identical AID in response to a card application selection request of RW10and causing it to perform authentication processing with RW10and a step of supporting a communication between RW10and service application23only when this authentication processing succeeds.

As a feature of this scheme, the workload on secure module holder30of rewriting a command is large. However, there is an advantage that RW10need not be aware of secure module holder30and secure module20, and RW10can be used without changing the program of conventional RW10.

In Embodiment 4 of the present invention, a case will be described where AID of a service application is set to be identical to AID of an authentication card application which performs authentication processing for the service application and a communication between an RW and a secure module after the authentication processing succeeds is carried out through a non-contact communication section of the secure module.

The configurations of this secure module holder and RW are identical to those in Embodiment 1 (FIG. 3).

FIG. 7shows processing steps in this case.

Steps (a1) and (a2) of disabling the local communication function of secure module20inserted in secure module holder30and steps (1), (2), (3), (6) and (7) from a card detection request of RW10until authentication processing is carried out are identical to those in Embodiment 3 (FIG. 6).

Upon succeeding in the authentication processing, control section32of secure module holder30enables (gives priority to) the local communication function of secure module20in which service application23of AID identical to that of the authentication application is stored (8).

RW10transmits a request command (REQB) again (9) and secure module20replies through SM local wireless communication section21(10). RW10specifies AID of service application23and requests a card application selection (11). Control section22of secure module20which has received this card application selection request through SM local wireless communication section21starts specified service application23and then returns a response to RW10through SM local wireless communication section21(12).

Next, the processing of executing a service through RW local wireless communication section11and SM local wireless communication section21is carried out between service execution section12of RW10and specified service application23(13).

In this way, according to this scheme, AID of a service application is set to be identical to AID of an authentication application, and the authentication application of the identical AID is started when a service application selection is requested from RW10, but communication between service application23and RW10cannot be carried out until authentication processing succeeds.

Furthermore, a communication between RW10and secure module20after the authentication processing succeeds is carried out through the non-contact communication section of secure module20.

The program of secure module holder30prescribes that control section32should execute a step of disabling the non-contact communication section of secure module20, a step of starting an authentication application of the identical AID in response to a card application selection request of RW10and causing it to perform authentication processing with RW10and a step of enabling the non-contact communication section of secure module20only when this authentication processing succeeds.

As a feature of this scheme, secure module holder30need not rewrite a command, so that the workload imposed on secure module holder30is small. Furthermore, conventional secure module20inserted in secure module holder30can be used as it is. On the other hand, however, RW10needs to request card detection twice.

As with Embodiment 4, in Embodiment 5 of the present invention, a case will be described where AID of a service application is set to be identical to AID of an authentication card application which performs authentication processing for the service application and a communication between an RW and a secure module after the authentication processing succeeds is carried out through the non-contact communication section of the secure module and a conventional RW can be used for the RW as it is.

The configurations of this secure module holder and RW are the same as those of Embodiment 1 (FIG. 3).

FIG. 8shows processing steps in this case.

Steps (a1) and (a2) of disabling the local communication function of secure module20inserted in secure module holder30and steps (1), (2), (3), (6) and (7) from a card detection request of RW10until authentication processing is carried out are identical to those in Embodiment 3 (FIG. 6).

Upon succeeding in the authentication processing, control section32of secure module holder30transmits an instruction for enabling the local communication function to secure module20in which service application23with AID identical to that of the authentication application is stored (8). At this time, control section32of secure module holder30transmits CID information acquired in the “card detection” processing (1) and (2) with RW10and the AID information specified in the “card application selection” processing (3) and (6) to secure module20concurrently with the enabling processing.

Control section22of secure module20which has received this enabling processing instruction enables SM local wireless communication section21, starts service application23of the specified AID and moves to a mode of responding to a case where a service command including the specified CID information in the header is received.

When a service processing command is transmitted from RW10(9), control section22of secure module20receives this at SM local wireless communication section21, sends it to service application23which has already been started and service application23replies to this command (10), and service execution section12of RW10and specified service application23perform processing of executing a service (11).

In this case, the program of secure module holder30prescribes that control section32should execute a step of disabling the non-contact communication section of secure module20, a step of starting an authentication application of the identical AID in response to a card application selection request of RW10and causing it to perform authentication processing with RW10and a step of enabling the non-contact communication section of secure module20only when this authentication processing succeeds and providing the information on CID and AID acquired from RW10to secure module20.

This scheme takes an advantage that the conventional program used in RW10need not be changed.

In Embodiment 6 of the present invention, a method will be described where authentication information used for authentication of an RW or the like is set in an access control secure module of a secure module holder.

In the case of a well-known service that has been widely spreading, authentication information used for authentication of RW (authentication information with which RW could be authenticated and a response may be returned to that RW if corresponding AID is found) is preset in an access control secure module of a secure module holder.

However, in the case of a service where authentication information is not set in the access control secure module, it is necessary to set the authentication information in the access control secure module. For that reason, the processing of inserting a secure module in which the service application and the authentication information are stored in the secure module holder and writing the authentication information stored in this secure module into the access control secure module is performed.

In this case, it is also possible to consider registering a mode about each piece of authentication information (e.g., for normal business day and for holiday) so that the user switches between modes when used. Furthermore, when a calendar function is provided inside secure module holder30, it is possible to automatically switch over to, for example, a normal business day mode or night/holiday mode.

FIG. 9shows the configuration of secure module holder30and secure module20that perform this processing. In addition to SM local wireless communication section21, a plurality of card applications (service applications)23, SM communication section24and control section22, secure module20is also provided with access control information26that prescribes RW authentication information and the authentication method carried out using this RW authentication information on each card application23as shown inFIG. 10and access limitation information application25that carries out processing of writing this access control information26into secure module holder30.

Access control secure module34may be directly built in secure module holder30or may be stored as a physically removable module (a different secure module from secure module20inFIG. 9is assumed) insecure module holder30.

Furthermore, it is also possible to perform access control over a card application mounted in secure module20and stored in another secure modules.

Furthermore, identity authentication information input section36and access control secure module34may also be mounted on a physically identical module and made removal. In this case, the user can select preferred identity authentication information input means (PIN, iris, dactylogram or the like) and attach it to secure module holder30.

Furthermore, in addition to SH local wireless communication section31, SH communication section33and control section32, secure module holder30is also provided with access control secure module34that holds access limitation information application35carrying out processing during writing of access control information26and identity authentication information input section36to which information to authenticate the identity of the user is input.

FIG. 11shows steps in which when secure module20is inserted in secure module holder30, access control information26stored in secure module20is written into access control secure module34of secure module holder30.

When secure module20is inserted in secure module holder30(1), control section32turns on power of secure module holder30and demands a PIN input for identity authentication at secure module holder30. When the user inputs a PIN from identity authentication information input section36(2), control section32requires access limitation information application35of access control secure module34to verify the PIN (3). Access limitation information application35compares the input PIN with the PIN registered in advance in access control secure module34and informs the verification result of the PIN to control section32(4). Upon succeeding in this verification, control section32demands a PIN input of secure module20for identity authentication. When the user inputs the PIN from identity authentication information input section36(5), control section32requires access limitation information application25of secure module20to verify the PIN (6). Access limitation information application25compares the input PIN with the PIN registered in advance in secure module20and informs the verification result of the PIN to control section32(7). Upon also succeeding in this verification, control section32mediates the communication between access limitation information application25of secure module20and access limitation information application35of access control secure module34. Both access limitation information applications35and25authenticate each other using PKI (public key infrastructure) (8), exchange the PIN information (or personal information on registered dactylogram or the like) used for the verification using their respective public keys and confirm that the person whom secure module holder30verified is identical to the person whom secure module20verified (9). Next, access limitation information application25of secure module20reports access control information26to access limitation information application35of access control secure module34(10) and access limitation information application35stores this access control information26in access control secure module34.

Furthermore,FIG. 12shows steps for simply writing access control information26stored in secure module20into access control secure module34of secure module holder30.

When secure module20is inserted in secure module holder30(1), control section32turns on power of secure module holder30and demands a PIN input for identity authentication. When the user inputs a PIN from identity authentication information input section36(2), control section32requires access limitation information application35of access control secure module34to verify the PIN (3) and also requires access limitation information application25of secure module20to verify the input PIN (5). Control section32obtains the verification result from access limitation information application35and access limitation information application25(4) and (6), and when both verifications succeed, control section32requests access limitation information application25of secure module20for access control information26(7), obtains access control information from access limitation information application25(8) and stores this in access control secure module34(9).

For identity authentication, living body information such as dactylogram and palm pattern or the like may also be input.

In this way, by performing mutual identity authentication at both secure module holder30and secure module20, it is possible to prevent acts like inserting own secure module20in secure module holder30of a stranger and using it or inserting secure module20of a stranger in own secure module holder30and using it.

FIG. 13shows, when access control information26of card application (service application)23of secure module20is written in access control secure module34of secure module holder30, an example of processing steps when holding up secure module holder30in which this secure module20is inserted over the RW and using the service of service application23.

As with Embodiment 3 (FIG. 6), this procedure is an example of a pattern that AID of a service application is set to be identical to AID of an authentication application and a communication between RW10and secure module20is carried out through secure module holder30.

The local communication function of secure module20inserted in secure module holder30is disabled (a1) and (a2). Control section32of secure module holder30replies to a card detection request of RW10(1) and (2) and when RW10specifies AID of the service application and requests a card application selection (3), control section32starts an authentication application with the AID and then returns a response to RW10(4). The authentication application refers to the access control information stored in access control secure module34and authenticates the RW using the RW authentication information specified in correspondence with the AID according to the specified authentication method (5).

Upon succeeding in this authentication, a service processing command is transmitted from RW10(8). Control section32of secure module holder30transmits the card application selection request to secure module20in which the service application with the specified AID is stored (7). After starting service application23, control section22of secure module20returns a response to control section32of secure module holder30(8). Control section32of secure module holder30transmits the service processing command (9) to secure module20which replied at (8). Service application23which has already been started replies to this command (10) and service execution section12of RW10and specified service application23communicate with each other through secure module holder30and perform processing of executing a service (11).

In this way, if access control information26together with card application23is stored in secure module20, access control information26is written into secure module holder30when this secure module20is inserted in secure module holder30, so that secure module20can be used while being inserted in secure module holder30.

Therefore, for example, even at a small-scale store, by storing card application23which provides a service with a RW installed at the store and access control information26thereof in secure module20it is possible to easily issue secure module20available at secure module holder30.

Embodiment 7 of the present invention will describe a method of preventing information of a card application stored in a card-shaped secure module to be used as a single unit from being known to an RW which has not been authenticated yet.

FIG. 14shows a configuration of secure module20that implements this method.

This secure module20is provided with SM local wireless communication section21which is a non-contact communication section, a plurality of card applications (service applications)23, access control section27that authenticates RW10that accesses card application23and control section22that controls the operation of secure module20. Control section22is composed of a CPU, and the operation thereof is prescribed by a program.

Access control section27has an application similar to the authentication application which is stored in access control secure module34of secure module holder30shown inFIG. 3and also has access control information about each card application23as shown inFIG. 10. When authenticating RW10, the authentication application with refers to this access control information and performs authentication processing using RW authentication information corresponding to card application23according to a specified authentication method.

AID of this authentication application may also be set apart from the card application as in Embodiments 1 and 2 or may also be set to be identical to that of the card application as in Embodiments 3 and 4.

FIG. 15shows processing steps when AID of the authentication application is different from AID of the card application.

RW10periodically transmits a request command (REQB) to detect approaching of the secure module to the communication area (1). When the user holds up secure module20over RW10and SM local wireless communication section21receives REQB, control section22replies through SM local wireless communication section21in accordance with an anticollision procedure (2).

RW10specifies AID of the authentication application corresponding to the service application, sends a card application selection request (3), and control section22starts a specified authentication application stored in access control section27and then returns a response to RW10(4). The started authentication application refers to the access control information and executes mutual authentication processing with RW10using the RW authentication information specified for the corresponding service application (5). When the authentication processing succeeds, RW10specifies AID of target service application23and requests a card application selection (6). The authentication processing has succeeded so that control section22of secure module20starts the service application specified by this card application selection request (7) and returns, when there is a response from the started service application (8), a response of the card application selection to RW10(9).

Next, processing of executing a service is performed between service execution section12of RW10and specified service application23(10).

Furthermore,FIG. 16shows processing steps when AID of the authentication application is identical to AID of the card application.

RW10periodically transmits a request command (REQB) to detect approaching of the secure module to the communication area (1). When the user holds up secure module20over RW10and SM local wireless communication section21receives REQB, control section22replies through SM local wireless communication section21according to an anticollision procedure (2).

RW10specifies AID of a service application and sends a card application selection request (3), control section22starts the authentication application of the identical AID stored in access control section27and then returns a response to RW10(4). The started authentication application refers to the access control information and executes mutual authentication processing with RW10using the specified RW authentication information (5). Upon succeeding in the authentication processing, RW10transmits a service processing command to secure module20(6). The authentication processing has succeeded, so that control section22of secure module20starts the service application specified by the card application selection request (7). When there is a response from the started service application (8), a service command is sent to the service application (9) and the service application returns a response to RW10(10).

Next, the processing of executing a service is performed between service execution section12of RW10and specified service application23(11).

The program of this secure module20prescribes that control section22should execute a step of performing authentication processing with RW10and a step of permitting RW10to access service application23only when this authentication processing succeeds.

In this way, if RW10succeeds in the authentication with access control section27, access to card application23becomes possible. Therefore, only legitimate RW10can know card application23stored in secure module20.

The present application is based on Japanese Patent Application No. 2004-152943 filed on May 24, 2004, entire content of which is expressly incorporated by reference herein.

INDUSTRIAL APPLICABILITY

The secure module of the present invention can be used as a non-contact IC card used in many fields such as service industry, sales industry, circulation industry, production industry, manufacturing or the like and can be used not only in the card shape but also in various shapes such as chip shape or stick shape.

Furthermore, the secure module holder of the present invention can be used as an electronic purse holding one or a plurality of secure modules and can also be applied to devices having other functions together such as a cellular phone and PDF in which secure modules can be mounted.

The program of the present invention can be used to prescribe the operation of such a secure module holder and secure module.