REMOTE ISSUANCE SYSTEM AND DATA GENERATION SERVER

According to an embodiment, a remote issuance system includes a portable electronic apparatus and a data generation server. The portable electronic apparatus includes a biometric sensor, a memory, a communication interface, and a first processor. The first processor generates authentication data for performing an issuance process in the portable electronic apparatus in a case where biometric authentication succeeds, outputs the authentication data to the reader/writer, and executes the issuance process based on issuance data supplied from the reader/writer. The data generation server includes a communication unit and a second processor. The second processor generates issuance data for causing the portable electronic apparatus to execute an issuance process based on application data corresponding to the contract ID and the authentication data to transmit the generated issuance data to the user terminal.

FIELD

Embodiments of the present invention relate to a remote issuance system and a data generation server.

BACKGROUND

In the related art, an IC card as a portable electronic apparatus requires a procedure called secondary issuance in which an operation institution writes information for operating as a credit card or the like and enables the credit card to be used. In addition, even in a case where a new function is added to the IC card, a predetermined procedure by the operation institution is required. In the related art, secondary issuance and function addition to an IC card are performed using a dedicated issuance machine after a person in charge of an operation institution or a handling store confirms identity confirmation of a user with an official certificate or the like.

In the procedure of an issuance process such as secondary issuance and function addition to the conventional IC card as described above, it is necessary for the user to go to a designated place such as an operation institution or a store, and for staff in the designated place to perform identity confirmation. In addition, in recent years, an IC card having a function of performing identity confirmation using biometric information such as a fingerprint has been developed, but even with such an IC card having a biometric authentication function, there is a problem that it is necessary to perform an issuance process such as secondary issuance and function addition by a procedure similar to that of the conventional IC card.

DETAILED DESCRIPTION

According to an embodiment, a remote issuance system includes a portable electronic apparatus and a data generation server. The portable electronic apparatus includes a biometric sensor, a memory, a communication interface, and a first processor. The biometric sensor acquires biometric information. The memory includes a storage area in which biometric information of a user is stored. The communication interface communicates with a reader/writer connected to a user terminal. The first processor generates authentication data for performing an issuance process in the portable electronic apparatus in a case where biometric authentication by collation between biometric information acquired by the biometric sensor and biometric information stored in the memory succeeds, outputs the authentication data to the reader/writer, and executes the issuance process based on issuance data corresponding to the authentication data supplied from the reader/writer. The data generation server includes a communication unit and a second processor. The communication unit communicates with the user terminal. The second processor generates, in a case where an issuance request including the authentication data generated by the portable electronic apparatus and a contract ID is received from the user terminal, issuance data for causing the portable electronic apparatus to execute an issuance process based on application data corresponding to the contract ID and the authentication data to transmit the generated issuance data to the user terminal.

Hereinafter, first and second embodiments will be described with reference to the drawings.

First Embodiment

First, an IC card issuance system1as a remote issuance system according to a first embodiment will be described.

FIG.1is a diagram schematically illustrating a configuration example of the IC card issuance system1as a remote issuance system according to a first embodiment.

In the configuration example illustrated inFIG.1, the IC card issuance system1includes an IC card2, a user terminal3, a data management system4, and an issuance control system5.

The IC card2is an example of a portable electronic apparatus having a function of executing biometric authentication. The IC card2according to the first embodiment includes a biometric sensor20configured to acquire biometric information as authentication information acquired from a person. For example, the biometric sensor20included in the IC card2is a fingerprint sensor that reads a fingerprint as an example of biometric information. The IC card2including a fingerprint sensor20as a biometric sensor executes fingerprint authentication (biometric authentication) as identity confirmation by collating a fingerprint of a person read by the fingerprint sensor with a fingerprint of a registrant (user, card holder) registered in advance in a memory in the IC card2.

In the first embodiment, the IC card2will be described as a fingerprint sensor card having a function of performing biometric authentication using a fingerprint as biometric information. However, the IC card2as the portable electronic apparatus according to the first embodiment is not limited to one that performs fingerprint (biometric) authentication by fingerprint as biometric information. For example, the portable electronic apparatus exemplified by the IC card2may perform biometric authentication by biometric information other than a fingerprint.

The user terminal3is an information processing apparatus possessed by the user. The user terminal3is, for example, a smartphone, a tablet PC, a personal computer, or the like. The user terminal3is only required to be operated by the user himself/herself and include a card reader/writer that communicates with the IC card2and a communication unit that communicates with each of the servers4A and5A via a network such as the Internet. In addition, the user terminal3may include an interface that is connected to a card reader/writer as external equipment instead of including a card reader/writer that communicates with the IC card2.

The data management system4is a system that remotely accepts an application for the issuance process (secondary issuance, function addition, or the like) of an IC card held by a user. The data management system4includes a contract management server4A and a data storage4B. The contract management server4A is configured by a server apparatus. The data storage4B is a device including a storage apparatus accessible from the contract management server4A. The contract management server4A has a function of accessing the data storage4B, a function of communicating with the user terminal3via the Internet, and a function of communicating with a data generation server5A of the issuance control system5.

The contract management server4A communicates with the user terminal3possessed by the user, and acquires application data related to the issuance process (contract) of an IC card possessed by the user from the user terminal3. Here, the issuance process of an IC card includes secondary issuance or function addition. The secondary issuance of the IC card is a process including a process (personalization) of writing personal data and the like to the IC card passed from the issuer to the user (card holder). In addition, the function addition is a process of adding an application or the like to the IC card. For example, the function addition includes a process of adding an applet to an IC card as a Java (registered trademark) card.

After acquiring the application data from the user terminal3, the contract management server4A issues the contract ID when the contract of the application content based on the application data from the user terminal3is allowed. When the contract ID is issued, the contract management server4A makes notification to the issued user terminal3to store application data and the like associated with the contract ID in the data storage4B. In response to an inquiry about application data based on the contract ID from the data generation server5A in the issuance control system5, the contract management server4A provides application data corresponding to the contract ID stored in the data storage4B.

The issuance control system5is a system for remotely causing the IC card to execute the issuance process (secondary issuance or function addition). The issuance control system5includes the data generation server5A and a hardware security module (HSM)5B. The data generation server5A is configured by a server apparatus. The HSM5B is a device that securely stores key information and performs an encryption process using the key information. The data generation server5A has a function of accessing the HSM5B, a function of communicating with the user terminal3via the Internet, and a function of communicating with the contract management server4A of the data management system4.

The data generation server5A performs secure communication with the IC card2via the user terminal3using the key stored in the HSM5B and the encryption processing function. The data generation server5A acquires an issuance request including card authentication data generated by the IC card2using the key information and the contract ID from the user terminal3.

The data generation server5A acquires application data managed by the contract management server4A of the data management system4in response to the issuance request from the user terminal3. The data generation server5A generates, based on the application data acquired in response to the issuance request, issuance data for causing the IC card possessed by the user to perform the issuance process using key information stored in the HSM5B, and supplies the generated issuance data to the user terminal3.

Next, a configuration of a control system of the IC card2as the portable electronic apparatus according to the first embodiment will be described.

FIG.2is a block diagram illustrating a configuration example of the IC card2as the portable electronic apparatus according to the first embodiment.

The IC card2is an example of a portable electronic apparatus that is activated (is operable) by power supplied from an external apparatus. The IC card2is also referred to as a smart card. As illustrated inFIG.2, the IC card2has a main body C. The main body C is formed in a card shape by plastic or the like. A control module M is disposed in the main body C of the IC card2. The control module M is integrally formed in a state where a communication interface is connected to one or a plurality of IC chips.

In the configuration example illustrated inFIG.2, the control module M includes a processor21, a ROM22, a RAM23, a data memory24, and a communication interface25. In addition, in the main body C of the IC card2, a display26and a fingerprint sensor27as a biometric sensor are connected to the control module M.

The processor21includes a circuit that executes various processes. The processor21is, for example, a central processing unit (CPU). The processor21controls the entire IC card2. The processor21implements various processing functions by executing programs stored in the ROM22or the data memory24. However, some or all of various functions executed by the processor21described later may be implemented by a hardware circuit.

The ROM22is a nonvolatile memory that functions as a program memory. The ROM22stores a control program, control data, and the like in advance. The ROM22is incorporated in the IC card2in a state where a control program, control data, and the like are stored at a manufacturing stage. The control program and the control data stored in the ROM22are incorporated in advance according to the specification of the IC card2. For example, the ROM22stores a program for the processor21to execute processing according to a command received from an external apparatus (card reader/writer).

The RAM23is a volatile memory that functions as a working memory. The RAM23also functions as a buffer that temporarily stores data and the like being processed by the processor21. For example, the RAM23functions as a communication buffer that temporarily stores data to be transmitted to and received from an external apparatus via the communication interface25.

The data memory24is a nonvolatile memory capable of writing and rewriting data. The data memory24includes, for example, an electrically erasable programmable read only memory (EEPROM) (registered trademark). Programs and various pieces of data according to the operation application of the IC card2are written to the data memory24. In the data memory24, a program file, a data file, or the like is defined, and a control program and various pieces of data are written in these files. In addition, the data memory24has tamper resistance in part of or all of the area, and can securely store data.

The data memory24includes a first recording area24athat stores key information and a second storage area24bthat stores biometric information. The first storage area24ais a tamper-resistant memory capable of securely storing data. Key information is written in the first storage area24ain a process (primary issuance) of making the IC card2usable. In the present IC card issuance system1, key information corresponding to key information written in the first storage area24aof the IC card2that has been primarily issued is stored in the HSM5B in the issuance control system5.

In addition, the second storage area24bstores biometric information of the user who is the owner of the IC card2. For example, it is assumed that the IC card2is a fingerprint sensor card that performs biometric information using a fingerprint as biometric information. In a case where the IC card2is a fingerprint sensor card, fingerprint information as biometric information of the user who is the owner is written in the second storage area24bof the IC card2. Note that, in the first embodiment described below, it is assumed that the IC card2is possessed by the user in a state in which fingerprint information as biometric information of the user is written in the second storage area before the secondary issuance or the function addition is executed.

The communication interface25includes a communication control unit and an interface unit, and constitutes a communication unit. The communication interface25is an interface for communication connection with a card reader/writer (RW) included in the user terminal3or a card reader/writer connected to the user terminal3via the interface. The communication interface25realizes a communication function by a communication method conforming to the interface of the card RW. Furthermore, the communication interface25may be configured to support a plurality of communication methods (for example, contact communication and non-contact communication).

In a case where the IC card2is realized as a contactless IC card, the communication interface25constitutes a communication unit that communicates with the card RW included in the user terminal3or the card RW connected to the user terminal3via the interface in a contactless (wireless) manner. In this case, the communication interface25includes an antenna that transmits and receives a radio wave, and includes a modulation circuit configured to generate a radio wave to be transmitted from the antenna, a demodulation circuit configured to generate a signal from the radio wave received by the antenna, and the like.

Furthermore, in a case where the IC card2is realized as a contact type IC card, the communication interface25constitutes a communication unit that communicates in contact with the card RW included in the user terminal3or the card RW connected to the user terminal3via the interface. In this case, the communication interface25includes a contact unit physically and electrically contacting a contact unit provided in the card RW, and includes a communication control circuit or the like that controls transmission and reception of a signal via the contact unit.

The biometric sensor20is an example of an authentication information acquisition unit that acquires authentication information. The biometric sensor20is a sensor that acquires biometric information of a person as authentication information used for the authentication process. In the first embodiment, the biometric sensor20is a fingerprint sensor that reads fingerprint information (fingerprint image) of the user. The fingerprint sensor as the biometric sensor20is provided such that a sensor configured to read a fingerprint is exposed on the surface of the card main body C, and reads a fingerprint of a finger of a person held over the exposed sensor portion. The fingerprint authentication is executed when the fingerprint information read by the biometric sensor20is collated with the fingerprint information stored in the second storage area24bof the data memory24.

Note that the biometric sensor20is not limited to the fingerprint sensor, and may be a sensor that acquires biometric information (for example, palm print, vein, iris, and the like) other than the fingerprint. In the case of including a sensor that acquires biometric information other than a fingerprint, the IC card2may have a function (for example, an IC chip that executes palm print matching, vein matching, iris matching, and the like) of performing biometric authentication corresponding to the biometric information acquired by the sensor.

Next, a configuration of the user terminal3in the IC card issuance system1according to the first embodiment will be described.

FIG.3is a block diagram illustrating a configuration example of the user terminal3in the IC card issuance system1according to the first embodiment.

The user terminal3is an electronic apparatus in which various application programs are executed on an operating system (OS). The user terminal3is only required to be an electronic apparatus used by a user as a card holder carrying the IC card2. For example, the user terminal3is a mobile terminal including a card RW such as a smartphone, a tablet terminal, or a mobile phone, or a mobile terminal including an interface that is connected to the card RW. Further, the user terminal3may be a personal computer (PC) including the card RW or a PC including an interface that is connected to the card RW.

In the configuration example illustrated inFIG.3, the user terminal3includes a processor31, a ROM32, a RAM33, a data memory34, a network (NW) communication unit35, a card reader/writer (RW)36, a display unit37, an input unit38, and the like.

The processor31executes various processes by executing a program. The processor31is, for example, a central processing unit (CPU). The processor31is connected to each unit in the user terminal3via a system bus to transmit and receives data to and from each unit. The processor31executes operations such as control and data processing in the user terminal3in cooperation with the ROM32and the RAM33. For example, the processor31realizes various processing functions by executing an application program stored in the ROM32or the data memory34. However, some or all of various functions executed by the processor31described later may be implemented by a hardware circuit.

The read only memory (ROM)32is a nonvolatile memory that stores programs, control data, and the like for realizing basic operations of the user terminal3. For example, the ROM32stores a program that manages basic operations such as an operating system (OS). Further, the ROM32may store an application program or the like for realizing the function of the user terminal3. The ROM32may be configured by a rewritable nonvolatile memory. For example, the rewritable ROM32is realized by an electrically erasable programmable ROM (EEPROM), a flash ROM, or the like.

The random access memory (RAM)33is a volatile memory that temporarily stores data. The RAM33functions as a working memory in a case where the processor31executes a program.

The data memory34is a storage unit that stores various pieces of data. The data memory34is configured by a nonvolatile memory in which data is rewritable. For example, the data memory34includes a semiconductor element memory such as a flash ROM or a solid state drive (SSD), or a storage apparatus such as a hard disc drive (HDD). The data memory34stores an application program, an operation setting value, personal information, and the like. The data memory34may store an OS program.

The NW communication unit35is a communication interface for communicating with an external apparatus. The NW communication unit35may perform wireless communication or may perform wired communication. In the IC card issuance system1, the NW communication unit35is only required to communicate with the contract management server4A and the data generation server5A via the interface.

The card reader/writer36has a function of communicating with the IC card2. The card reader/writer36performs power supply, clock supply, reset control, and data transmission/reception with respect to the IC card2. After activating the IC card2, the card reader/writer36transmits various commands and receives responses to the transmitted commands under the control of the processor31. Note that the user terminal3may include an interface connected to a card reader/writer as external equipment.

The card reader/writer36has a configuration corresponding to a communication method included in the IC card2. For example, in a case where the IC card2is realized as a contactless IC card, the card reader/writer36communicates with the IC card2in a contactless (wireless) manner using a communication protocol conforming to a communication method of the contactless IC card. Furthermore, in a case where the IC card2is realized as a contact type IC card, the card reader/writer36includes a contact unit that is physically and electrically in contact with a contact unit (interface) of the IC card2to transmit and receives data via the contact unit.

The display unit37is a display device such as a liquid crystal panel. The input unit38is an operation device that receives an operation instruction to the user terminal3. The input unit38includes, for example, a touch panel. The display unit37and the input unit38may be configured by a display apparatus with a touch panel (hereinafter, referred to as a touch screen). Furthermore, the input unit38may include an operation key including a button switch, a touch sensor that detects a touch of the operator's finger based on a change in electrostatic capacitance, and the like.

Next, a configuration of the contract management server4A in the IC card issuance system1according to the first embodiment will be described.

FIG.4is a block diagram illustrating a configuration example of the contract management server4A in the IC card issuance system1according to the first embodiment.

As illustrated inFIG.4, the contract management server4A includes a processor41, a ROM42, a RAM43, a data memory44, an interface45, a network (NW) communication unit46, and a communication unit47.

The processor41executes various processes by executing a program. The processor41is, for example, a central processing unit (CPU). The processor41is connected to each unit in the server4A via a system bus to transmit and receives data to and from each unit. The processor41executes operations such as control and data processing in the contract management server4A in cooperation with the ROM42and the RAM43.

The read only memory (ROM)42is a nonvolatile memory that stores programs, control data, and the like for realizing the basic operation of the contract management server4A.

The random access memory (RAM)43is a volatile memory that temporarily stores data. The RAM43functions as a working memory in a case where the processor41executes a program.

The data memory44is a storage unit that stores various pieces of data. The data memory44is configured by a nonvolatile memory in which data is rewritable. For example, the data memory44stores an OS program, an application program, operation setting information, and the like.

The interface45is an interface configured to access the data storage4B. In a case where the data storage4B is a storage apparatus as an external device, the interface45is only required to conform to the interface standard included in the storage apparatus as the data storage4B. In a case where the data storage4B is a data server or the like, the interface may be configured by a communication interface for communicating with a server as the data storage4B.

The network (NW) communication unit46is a communication interface for communicating with an external apparatus. The NW communication unit46may perform wireless communication or may perform wired communication. In the IC card issuance system1according to the first embodiment, the NW communication unit46is only required to communicate with the user terminal3used by the user via a wide area network such as the Internet.

The communication unit47is a communication interface for communicating with the data generation server. The communication unit47may perform wireless communication or may perform wired communication. In the IC card issuance system1according to the first embodiment, the communication unit47is only required to be able to securely communicate with the data generation server5A.

Note that the NW communication unit46and the communication unit47may be implemented by one communication interface. Furthermore, the interface45may also be configured as a communication interface common to the NW communication unit46or the communication unit47.

Next, a configuration of the data generation server5A in the IC card issuance system1according to the first embodiment will be described.

FIG.5is a block diagram illustrating a configuration example of the data generation server5A in the IC card issuance system1according to the first embodiment.

As illustrated inFIG.5, the data generation server5A includes a processor51, a ROM52, a RAM53, a data memory54, an interface55, a network (NW) communication unit56, and a communication unit57.

The processor51executes various processes by executing a program. The processor51is, for example, a central processing unit (CPU). The processor51is connected to each unit in the server5A via a system bus to transmit and receives data to and from each unit. The processor51executes operations such as control and data processing in the data generation server5A in cooperation with the ROM52and the RAM53.

The read only memory (ROM)52is a nonvolatile memory that stores programs, control data, and the like for realizing the basic operation of the data generation server5A.

The random access memory (RAM)53is a volatile memory that temporarily stores data. The RAM53functions as a working memory in a case where the processor51executes a program.

The data memory54is a storage unit that stores various pieces of data. The data memory54is configured by a nonvolatile memory in which data is rewritable. For example, the data memory54stores an OS program, an application program, operation setting information, and the like.

The interface55is an interface configured to access the HSM5B. The interface55is only required to conform to the interface standard included in the HSM5B.

The network (NW) communication unit56is a communication interface for communicating with an external apparatus. The NW communication unit56may perform wireless communication or may perform wired communication. In the IC card issuance system1according to the first embodiment, the NW communication unit56is only required to communicate with the user terminal3used by the user via a wide area network such as the Internet.

The communication unit57is a communication interface for communicating with the contract management server4A. The communication unit57may perform wireless communication or may perform wired communication. In the IC card issuance system1according to the first embodiment, the communication unit57is only required to be able to securely communicate with the contract management server4A.

Note that the NW communication unit56and the communication unit57may be implemented by one communication interface.

Next, an application procedure and an issuance procedure of the issuance process of the IC card2in the IC card issuance system1according to the first embodiment will be described.

As a precondition of the operation described below, it is assumed that the IC card2is passed to the user (card holder) after primary issuance (card manufacturing and initialization) processing is performed. In addition, it is assumed that a key (key information) related to generation of card authentication data in primary issuance is written in the IC card2passed to the user. The key information written in the IC card2is stored in the HSM5B in the issuance control system5. Further, it is assumed that, in the IC card2possessed by the user (card holder), fingerprint information of the user (the person himself/herself) is written after personal authentication of the user is performed.

First, an application procedure of the issuance process of the IC card2in the IC card issuance system1according to the first embodiment will be described.

FIG.6is a sequence for describing an operation example of an application procedure of the issuance process of the IC card2in the IC card issuance system1.

For the card holder, the processor31of the user terminal3receives the input of the application data by the input unit38according to the operation by the user as the card holder (ST21). The application data is assumed to include, for example, information necessary for the issuance process (secondary issuance or function addition), personal information of the user who is the card holder, information about the IC card2possessed by the card holder (user), and the like.

In addition, the user terminal3may receive the application data by an application program, or may receive the application data on a web site for inputting the application data provided on the Internet. In the former case, the user terminal3installs an application program in the data memory34. The processor31of the user terminal3activates the application program according to the operation by the user, and the user inputs the application data according to the input format of the application data presented in the application program. In the latter case, the processor31of the user terminal3accesses the application data input site provided on the Internet by the NW communication unit35, and the user inputs the application data according to the input format of the application data presented at the input site.

Further, the user terminal3may read information related to the IC card2possessed by the card holder (user) from the IC card2. The information (card data) related to the IC card2includes, for example, unique identification information (ID) for identifying the IC card2. In addition, in a case where the personal information of the user himself/herself who is the card holder is stored in the IC card2, the user terminal3may read the personal information of the user from the IC card2. In the operation example illustrated inFIG.6, it is assumed that the IC card2outputs the card data after the identity confirmation in the biometric (fingerprint) authentication succeeds in response to a request from the card reader/writer36of the user terminal3.

That is, the processor31of the user terminal3transmits a fingerprint authentication request as biometric authentication and a card data request to the IC card2by the card RW36(ST22). The processor21of the IC card2executes fingerprint authentication using fingerprint data stored in the data memory24in response to a request from the user terminal3(ST11). The processor21of the IC card2outputs the information about the IC card2to the user terminal3after the identity confirmation by the fingerprint authentication succeeds (ST12).

When the input of the application data is completed, the processor31of the user terminal3creates an examination request for requesting examination regarding the issuance process (contract) by the input application data (ST23). The examination request requests examination as to whether the IC card2possessed by the card holder is allowed to execute (contract) the issuance process (secondary issuance or function addition) according to the application content input as the application data.

When the examination request is created, the processor31of the user terminal3transmits the examination request to the contract management server4A of the data management system4(ST24). The processor31accesses the contract management server4A via the Internet by the NW communication unit35to transmit the examination request to the contract management server4A.

The contract management server4A receives the examination request from the user terminal3by the NW communication unit46(ST31). Upon receiving the examination request from the user terminal3, the processor41of the contract management server4A examines whether to permit the issuance process applied in accordance with the received examination request. For example, the contract management server4A examines whether there is a problem in the application content indicated by the application data and whether there is a problem in the contract for performing the issuance process with respect to the card holder as the applicant. The content and procedures of the examination are not limited to specific forms as long as they conform to the operation form. It is sufficient that the examination result corresponding to the examination request is input to the contract management server4A.

In a case where the examination result for the examination request indicates that the contract is not allowed (issuance process is not allowed), the processor41of the contract management server4A notifies the user terminal3, which is the transmission source of the examination request, that the contract is not allowed as the examination result (ST34). In addition, the processor41may notify the contact address specified by the card holder in the application data of the examination result.

When the processor31of the user terminal3receives a notification indicating that the contract is not allowed as the examination result for the examination request from the contract management server4A, the processor31notifies the card holder of the fact that the examination result is that the contract is not allowed by displaying the fact on the display unit37(ST25).

When the examination result for the examination request indicates that the contract is allowed (issuance process is allowed), the processor41of the contract management server4A issues the contract ID (ST32). When the contract ID is issued, the processor41registers the application data included in the examination request the examination result for which indicates that the contract is allowed in the data storage4B in association with the contract ID that has been issued (ST33). The data storage4B stores the application data from the contract management server4A and the contract ID as contract information (ST41).

When the application data and the contract ID are registered in the data storage4B, the processor41of the contract management server4A notifies the user terminal3, which is the transmission source of the examination request, of the examination result and the contract ID (ST34).

When the processor31of the user terminal3receives a notification indicating that the contract is allowed as the examination result for the examination request from the contract management server4A, the processor31displays the contract ID on the display unit37together with a guidance indicating that the contract is allowed as the examination result (ST25). Furthermore, in a case where the examination result is acceptable, the processor31of the user terminal3may display, on the display unit37, guidance regarding the procedure of the issuance process, and the like.

Through the application procedure as described above, when the result for the examination request from the user terminal is that the contract is allowed, the contract management server can store the application data from the card holder that has made the examination request and the contract ID in the data storage in association with each other. As a result, the IC card2possessed by the card holder is ready to be able to perform the issuance process in remote by an operation as described later can be performed. As a result, after a state in which the issuance process can be performed, that is, after receiving the notification of the contract ID, the card holder executes an issuance procedure described later for causing the IC card2to perform the issuance process in remote using the user terminal3.

Next, an issuance procedure for causing the IC card2in the IC card issuance system1according to the first embodiment to perform the issuance process will be described.

FIGS.7and8are sequences for describing an operation example of an issuance procedure for causing the IC card2in the IC card issuance system1to perform the issuance process.

The user as the card holder activates an application program (hereinafter, referred to as an issuance application) for the issuance process on the IC card2in the user terminal3. The issuance application may be stored in the data memory24in advance, or may be downloaded from the contract management server4A or the data generation server5A.

The processor31of the user terminal3activates the issuance application in response to the instruction to activate the issuance application input to the input unit38by the card holder (ST120). When the issuance application is activated, the processor31requests the card holder to input a contract ID (ST121). The card holder inputs the contract ID acquired together with the examination result for the application data by the input unit38. When the contract ID is input to the input unit38, the processor31accesses the IC card2with the card RW36and requests the IC card2to perform fingerprint authentication as biometric authentication for identity confirmation (ST122).

The IC card2is activated by power supplied from the card RW36. When the IC card2is activated, the processor21executes a fingerprint authentication process in response to a fingerprint authentication request supplied from the card RW36(ST111). The processor21acquires a fingerprint of the user by the fingerprint sensor20. The processor21performs fingerprint authentication by comparing fingerprint information acquired by the fingerprint sensor20with fingerprint data stored in the data memory24.

When it is determined that the fingerprint information acquired by the fingerprint sensor20and the fingerprint data stored in the data memory24are fingerprints of the same person, the processor21determines that the fingerprint authentication is successful. When it is determined that the fingerprint information acquired by the fingerprint sensor20and the fingerprint data stored in the data memory24are not fingerprints of the same person, the processor21determines that the fingerprint authentication has failed.

When the fingerprint authentication in the IC card2fails, the processor21notifies the card RW36that the fingerprint authentication fails. When the card RW36receives a notification indicating that the fingerprint authentication has failed from the IC card2, the processor31of the user terminal3cancels the issuance procedure for causing the IC card2to execute the issuance process. In this case, the processor31notifies the user of the cancellation of the issuance procedure by displaying, on the display unit37, the fact that the IC card2is not allowed to perform the issuance process due to failure of the identity confirmation.

When the fingerprint authentication in the IC card2is successful, the processor21notifies the card RW36that the fingerprint authentication is successful. When the card RW36receives a notification indicating that the fingerprint authentication has succeeded from the IC card2, the processor31of the user terminal3requests the IC card2via the card RW36for the card authentication data for executing the issuance process. In response, the processor21of the IC card2generates card authentication data and supplies the generated card authentication data to the card RW36.

That is, when the fingerprint authentication is successful, the processor21of the IC card2generates card authentication data (authentication data) (ST112). The card authentication data is authentication data generated in a case where the biometric authentication succeeds with the IC card2, and includes information for the IC card2to perform the issuance process such as function addition (for example, adding an applet) or secondary issuance.

The card authentication data is generated using the key information stored in the storage area24aof the data memory24that is the secure memory. In addition, the card authentication data includes, for example, CPLC (information indicating a product cycle of the IC card), an INITIALIZE UPDATE command, response data, and the like as information for performing the issuance process.

When the card authentication data is generated after the fingerprint authentication succeeds, the processor21of the IC card2outputs the generated card authentication data to the card RW36of the user terminal3(ST113). After outputting the card authentication data, the processor21of the IC card2is ready to be able to execute the issuance process based on the issuance data generated by the data generation server5A according to the card authentication data is executable.

When acquiring the card authentication data from the IC card2with which fingerprint authentication has succeeded by the card RW36, the processor31of the user terminal3generates an issuance request for requesting the IC card2for the issuance process to transmit the generated issuance request to the data generation server5A (ST124).

For example, the processor31generates an issuance request including the card authentication data and the contract ID. When the issuance request is generated, the processor31accesses the data generation server5A in the issuance control system5via the Internet by the NW communication unit35. When accessing the data generation server5A, the processor31transmits an issuance request including the card authentication data and the contract ID to the data generation server5A.

The data generation server5A receives the issuance request from the user terminal3by the NW communication unit56. When the issuance request is received, the processor51of the data generation server5A extracts the contract ID included in the issuance request. When extracting the contract ID included in the issuance request, the processor51accesses the contract management server4A via the communication unit57. When accessing the contract management server4A, the processor51transmits a request (request) for application data corresponding to the contract ID included in the issuance request to the contract management server4A (ST131).

The contract management server4A communicates with the data generation server5A via the communication unit47. When receiving the request for requesting the application data corresponding to the contract ID from the data generation server5A, the processor41of the contract management server4A searches the data storage4B for the application data corresponding to the contract ID (ST141). When detecting the application data corresponding to the contract ID requested from the data generation server5A, the processor41transmits the application data corresponding to the contract ID to the data generation server5A via the communication unit47(ST142).

When the application data corresponding to the contract ID included in the issuance request is received from the contract management server4A, the processor51of the data generation server5A generates the issuance data for the IC card2executing the issuance process based on the application data (ST132). The issuance data includes a command to be executed by the IC card2in a series of issuance processes based on the application data and data to be written to the IC card2in a series of issuance processes.

For example, in a case where an applet as the issuance process is added to the IC card2, the issuance data includes an install (INSTALL) command as a command to be executed by the IC card2. In addition, in a case where an applet is added according to a certain credit card standard, the issuance data includes an external authentication (EXTERNAL AUTHENTICATE) command and a store data (STORE DATA) command as commands to be executed by the IC card2.

Further, the processor51processes the issuance data using the key information stored in the HSM5B in order to securely supply the issuance data to the IC card2(ST133). Here, the HSM5B stores key information corresponding to key information held in the IC card2. As a result, the issuance data can be securely supplied to the IC card2by encryption using the HSM5B. For example, the processor51encrypts data included in the issuance data using key information shared with key information stored in the IC card2by the HSM5B.

After the issuance data is encrypted using the key information stored in the HSM5B, the processor51transmits the issuance data encrypted using the HSM5B to the user terminal3that is the transmission source of the issuance request (ST134).

After transmitting the issuance request to the data generation server5A, the user terminal3waits to receive the issuance data as a response to the issuance request. In this state, the user terminal3receives the issuance data transmitted from the data generation server5A by the NW communication unit354(ST125). When the issuance data is received, the processor31of the user terminal3outputs the issuance data to the IC card2by the card RW36(ST126).

The processor21of the IC card2acquires, from the card RW36of the user terminal3, issuance data corresponding to card authentication data generated after the biometric authentication succeeds. When the issuance data is acquired, the processor21executes the issuance process according to the acquired issuance data (ST113).

For example, the processor21writes, in the data memory24, data to be written as an issuance process by executing a command included in the issuance data. In addition, the processor21decrypts the encrypted data included in the issuance data supplied in the issuance process using the key information stored in the first storage area24athat is the secure memory in the data memory24.

When the issuance process based on the supplied issuance data is completed, the processor21of the IC card2notifies the card RW36of the user terminal3of the completion of the issuance process (ST114).

After outputting the issuance data to the IC card2by the card RW36, the user terminal3receives a notification indicating that the issuance process is completed from the IC card2. Upon receiving the completion notification of the issuance process from the IC card2by the card RW36, the processor31of the user terminal3displays, on the display unit37, guidance indicating that the IC card2completed the issuance process (function addition or secondary issuance) (ST127).

When receiving the notification that the IC card2has completed the issuance process based on the issuance data is, the processor31notifies the data generation server5A that is the transmission source of the issuance data of the completion of the issuance process by the NW communication unit35(ST128).

When the NW communication unit56receives the completion notification of the issuance process in the IC card2from the user terminal3, the processor51of the data generation server5A transfers (transmits) the completion notification of the issuance process by the IC card2to the contract management server4A by the communication unit57.

The contract management server4A receives the completion notification of the issuance process in the IC card2via the data generation server5A by the communication unit47. When receiving the completion notification of the issuance process in the IC card2via the data generation server5A, the processor41of the contract management server4A records the completion of the issuance process corresponding to the application data in the data storage4B (ST143).

Through the issuance procedure as described above, the IC card issuance system according to the first embodiment can securely and remotely cause the IC card to perform the issuance process such as function addition or secondary issuance after personal authentication by biometric authentication has succeeded in the IC card2including the fingerprint sensor as the biometric sensor.

Second Embodiment

Hereinafter, a second embodiment will be described with reference to the drawings.

First, an IC card issuance system201as a remote issuance system according to a second embodiment will be described.

FIG.9is a diagram schematically illustrating a configuration example of the IC card issuance system201as a remote issuance system according to the second embodiment.

In the configuration example illustrated inFIG.9, the IC card issuance system201includes an IC card202, a user terminal203, a data management system204, and an issuance control system205.

The IC card202is an example of a portable electronic apparatus having a function of executing biometric authentication. The IC card202according to the second embodiment includes a biometric sensor220configured to acquire biometric information as authentication information acquired from a person. For example, the biometric sensor220included in the IC card202is a fingerprint sensor that reads a fingerprint as an example of biometric information. The IC card202including the fingerprint sensor220as a biometric sensor executes fingerprint authentication (biometric authentication) as identity confirmation by collating a fingerprint of a person read by the fingerprint sensor with a fingerprint of a registrant (user, card holder) registered in advance in a memory in the IC card202.

In addition, the IC card202as the portable electronic apparatus according to the present embodiment has a function of outputting physical unclonable function (PUF) data as unique individual device information. The PUF indicates information (ID) unique to an object from a variation in physical characteristics of the object, such as a variation in a silicon crystal pattern of a semiconductor chip. The PUF data is obtained from an electronic circuit included in the IC card202such as an IC chip. Since the PUF is caused by variations in individual devices constituting the electronic circuit, even when the circuit pattern is incorrectly copied, the PUF itself is difficult to copy. The PUF data is information unique to each IC card202.

In the second embodiment, the IC card202will be described as a fingerprint sensor card having a function of performing biometric authentication using a fingerprint as biometric information. However, the IC card202as the portable electronic apparatus according to the second embodiment is not limited to one that performs fingerprint (biometric) authentication by fingerprint as biometric information. For example, the portable electronic apparatus exemplified by the IC card202may perform biometric authentication by biometric information other than a fingerprint.

The user terminal203is an information processing apparatus possessed by the user. The user terminal203is, for example, a smartphone, a tablet PC, a personal computer, or the like. The user terminal203is only required to be operated by the user himself/herself and is only required to include a card reader/writer that communicates with the IC card202and a communication unit that communicates with each of the servers4A and5A via a network such as the Internet. Furthermore, the user terminal203may include an interface that is connected to a card reader/writer as external equipment instead of including a card reader/writer that communicates with the IC card202.

The data management system204is a system that remotely accepts an application for the issuance process (secondary issuance, function addition, or the like) in an IC card held by a user. The data management system204includes a contract management server204A and a data storage204B. The contract management server204A is configured by a server apparatus. The data storage204B is a device including a storage apparatus accessible from the contract management server204A. The contract management server204A has a function of accessing the data storage204B, a function of communicating with the user terminal203via the Internet, and a function of communicating with a data generation server205A of the issuance control system205.

The contract management server204A communicates with the user terminal203possessed by the user, and acquires application data related to the issuance process (contract) in an IC card possessed by the user from the user terminal203. Here, the issuance process of an IC card includes secondary issuance or function addition. The secondary issuance of the IC card is a process including a process (personalization) of writing personal data and the like to the IC card passed from the issuer to the user (card holder). In addition, the function addition is a process of adding an application or the like to the IC card. For example, the function addition includes a process of adding an applet to an IC card as a Java Card (registered trademark).

After acquiring the application data from the user terminal203, the contract management server204A issues the contract ID when the contract of the application content based on the application data from the user terminal203is allowed. When the contract ID is issued, the contract management server204A makes notification to the issued user terminal203to store the application data associated with the contract ID and the PUF data of the IC card202possessed by the card holder in the data storage204B. In response to an inquiry about the application data based on the contract ID from the data generation server205A in the issuance control system205, the contract management server204A provides the application data corresponding to the contract ID and the PUF data stored in the data storage204B.

The issuance control system205is a system for remotely causing the IC card to execute the issuance process (secondary issuance or function addition). The issuance control system205includes a data generation server205A, a hardware security module (HSM)205B, and a PUF storage205C.

The data generation server205A is configured by a server apparatus. The HSM205B is a device that securely stores key information and performs an encryption process using the key information. The HSM205B stores key information corresponding to key information, held by the IC card202, that makes the issuance process remotely executable in the IC card issuance system201. In addition, the PUF storage205C is a storage apparatus that holds PUF data, of an IC card, that makes the issuance process remotely executable in the IC card issuance system201. In the PUF storage205C, for example, PUF data of the IC card202issued (manufactured) by an authorized manufacturer of the IC card by which the issuance process in the IC card issuance system201is to be performed is registered.

The data generation server205A has a function of accessing the HSM205B, a function of accessing the PUF storage205C, a function of communicating with the user terminal203via the Internet, and a function of communicating with the contract management server204A of the data management system204.

The data generation server205A performs secure communication with the IC card202via the user terminal203using a key stored in the HSM205B and an encryption processing function. The data generation server205A acquires an issuance request including card authentication data generated by the IC card202using the key information and the contract ID from the user terminal203.

The data generation server205A acquires application data and PUF data managed by the contract management server204A of the data management system204in response to the issuance request from the user terminal203. The data generation server205A checks whether the PUF data included in the issuance request is registered in the PUF storage and whether the PUF data included in the issuance request matches the PUF data acquired together with the application data from the contract management server204A.

After confirming that the PUF data included in the issuance request is registered in the PUF storage and matches the PUF data acquired at the time of application, the data generation server205A generates the issuance data for causing the IC card to perform the issuance process on based on the application data. The data generation server processes the issuance data based on the application data using the key information stored in the HSM205B, and then supplies the processed issuance data to the user terminal203.

Next, a configuration of a control system in the IC card202as the portable electronic apparatus according to the second embodiment will be described.

FIG.10is a block diagram illustrating a configuration example of the IC card202as a portable electronic apparatus according to the second embodiment.

The IC card202is an example of a portable electronic apparatus that is activated (is operable) by power supplied from an external apparatus. The IC card202is also referred to as a smart card. As illustrated inFIG.10, the IC card202has a main body C. The main body C is formed in a card shape by plastic or the like. The control module M is disposed in the main body C of the IC card202. The control module M is integrally formed in a state where a communication interface is connected to one or a plurality of IC chips.

In the configuration example illustrated inFIG.10, the control module M includes a processor221, a ROM222, a RAM223, a data memory224, and a communication interface225. In addition, in the main body C of the IC card202, a display26and a fingerprint sensor220as a biometric sensor are connected to the control module M.

The processor221includes a circuit that executes various processes. The processor221is, for example, a central processing unit (CPU). The processor221controls the entire IC card202. The processor221implements various processing functions by executing programs stored in the ROM222or the data memory224. However, some or all of various functions executed by the processor221described later may be implemented by a hardware circuit.

The ROM222is a nonvolatile memory that functions as a program memory. The ROM222stores a control program, control data, and the like in advance. The ROM222is incorporated into the IC card202in a state where a control program, control data, and the like are stored at a manufacturing stage. The control program and the control data stored in the ROM222are incorporated in advance according to the specification of the IC card202. For example, the ROM222stores a program for the processor221to execute processing according to a command received from an external apparatus (card reader/writer).

The RAM223is a volatile memory that functions as a working memory. The RAM223also functions as a buffer that temporarily stores data and the like being processed by the processor221. For example, the RAM223functions as a communication buffer that temporarily stores data to be transmitted to and received from an external apparatus via the communication interface225.

The data memory224is a nonvolatile memory capable of writing and rewriting data. The data memory224includes, for example, an electrically erasable programmable read only memory (EEPROM) (registered trademark). Programs and various pieces of data according to the operation application of the IC card202are written to the data memory224. In the data memory224, a program file, a data file, or the like is defined, and a control program and various pieces of data are written in these files. In addition, the data memory224has tamper resistance in a part or the entire area, and can securely store data.

The data memory224includes a first storage area224athat stores key information, a second storage area224bthat stores biometric information, and a third storage area224cthat holds PUF data. The first storage area224ais a tamper-resistant memory capable of securely storing data. Key information is written in the first storage area224ain a process (primary issuance) of making the IC card202available. In the IC card issuance system201, the key information corresponding to the key information written in the first storage area224aof the IC card202having been issued primarily is stored in the HSM205B of the issuance control system205.

In addition, the second storage area224bstores biometric information of the user who is the owner of the IC card202. For example, it is assumed that the IC card202is a fingerprint sensor card that performs biometric information using a fingerprint as biometric information. In a case where the IC card202is a fingerprint sensor card, fingerprint information as biometric information of the user who is the owner is written in the second storage area224bof the IC card202. Note that, in the second embodiment described below, it is assumed that the IC card202is possessed by the user in a state in which fingerprint information as biometric information of the user is written in the second storage area before the secondary issuance or the function addition is executed.

The PUF data is stored in the third storage area224c. The PUF data stored in the third storage area224cis an example of identification information unique to the IC card202. The PUF data stored in the third storage area224cis information obtained from an electronic circuit (IC chip or the like) present in the IC card202. For example, it is assumed that the PUF data is stored in the third storage area at the time of manufacturing the IC card202or the like.

The PUF data is not limited to data stored in the data memory224in advance, and may be acquired by the processor221in the application procedure and the issuance procedure. For example, instead of storing the PUF data in the data memory224, the IC card202may be provided with a PUF circuit as hardware that outputs the PUF data. In this case, the processor221may acquire the PUF data from the PUF circuit.

The communication interface225includes a communication control unit and an interface unit, and constitutes a communication unit. The communication interface225is an interface for communication connection with a card reader/writer (RW) included in the user terminal203or a card reader/writer connected to the user terminal203via the interface. The communication interface225realizes a communication function by a communication method conforming to the interface of the card RW. Furthermore, the communication interface225may be configured to support a plurality of communication methods (for example, contact communication and non-contact communication).

In a case where the IC card202is realized as a contactless IC card, the communication interface225constitutes a communication unit that communicates with the card RW included in the user terminal203or the card RW connected to the user terminal203via the interface in a contactless (wireless) manner. In this case, the communication interface225includes an antenna that transmits and receives a radio wave, and includes a modulation circuit configured to generate a radio wave to be transmitted from the antenna, a demodulation circuit configured to generate a signal from the radio wave received by the antenna, and the like.

Furthermore, in a case where the IC card202is realized as a contact type IC card, the communication interface225constitutes a communication unit that communicates in contact with the card RW included in the user terminal203or the card RW connected to the user terminal203via the interface. In this case, the communication interface225includes a contact unit physically and electrically contacting a contact unit provided in the card RW, and includes a communication control circuit or the like that controls transmission and reception of a signal via the contact unit.

The biometric sensor220is an example of an authentication information acquisition unit that acquires authentication information. The biometric sensor220is a sensor that acquires biometric information of a person as authentication information used for the authentication process. In the second embodiment, the biometric sensor220is a fingerprint sensor that reads fingerprint information (fingerprint image) of the user. The fingerprint sensor as the biometric sensor220is provided such that a sensor configured to read a fingerprint is exposed on the surface of the card main body C, and reads a fingerprint of a finger of a person held over the exposed sensor portion. The fingerprint authentication is executed when the fingerprint information read by the biometric sensor220is collated with the fingerprint information stored in the second storage area224bof the data memory224.

Note that the biometric sensor220is not limited to the fingerprint sensor, and may be a sensor that acquires biometric information (for example, palm print, vein, iris, and the like) other than the fingerprint. In the case of including a sensor that acquires biometric information other than a fingerprint, the IC card202may have a function (for example, an IC chip that executes palm print matching, vein matching, iris matching, and the like.) of performing biometric authentication corresponding to the biometric information acquired by the sensor.

Next, a configuration of the user terminal203in the IC card issuance system201according to the second embodiment will be described.

FIG.11is a block diagram illustrating a configuration example of the user terminal203in the IC card issuance system201according to the second embodiment.

The user terminal203is an electronic apparatus in which various application programs are executed on an operating system (OS). The user terminal203is only required to be an electronic apparatus used by a user as a card holder carrying the IC card202. For example, the user terminal203is a mobile terminal including a card RW such as a smartphone, a tablet terminal, or a mobile phone, or a mobile terminal including an interface that is connected to the card RW. Further, the user terminal203may be a personal computer (PC) including the card RW or a PC including an interface that is connected to the card RW.

In the configuration example illustrated inFIG.11, the user terminal203includes a processor231, a ROM232, a RAM233, a data memory234, a network (NW) communication unit235, a card reader/writer (RW)236, a display unit237, an input unit238, and the like.

The processor231executes various processes by executing a program. The processor231is, for example, a central processing unit (CPU). The processor231is connected to each unit in the user terminal203via a system bus to transmit and receives data to and from each unit. The processor231executes operations such as control and data processing in the user terminal203in cooperation with the ROM232and the RAM233. For example, the processor231realizes various processing functions by executing an application program stored in the ROM232or the data memory234. However, some or all of various functions executed by the processor231described later may be implemented by a hardware circuit.

The read only memory (ROM)232is a nonvolatile memory that stores programs, control data, and the like for realizing basic operations of the user terminal203. For example, the ROM232stores a program that manages basic operations such as an operating system (OS). Further, the ROM232may store an application program or the like for realizing the function of the user terminal203. The ROM232may be configured by a rewritable nonvolatile memory. For example, the rewritable ROM232is realized by an electrically erasable programmable ROM (EEPROM), a flash ROM, or the like.

The random access memory (RAM)233is a volatile memory that temporarily stores data. The RAM233functions as a working memory in a case where the processor231executes a program.

The data memory234is a storage unit that stores various pieces of data. The data memory234is configured by a nonvolatile memory in which data is rewritable. For example, the data memory234includes a semiconductor element memory such as a flash ROM or a solid state drive (SSD), or a storage apparatus such as a hard disc drive (HDD). The data memory234stores an application program, an operation setting value, personal information, and the like. The data memory234may store an OS program.

The NW communication unit235is a communication interface for communicating with an external apparatus. The NW communication unit235may perform wireless communication or may perform wired communication. In the IC card issuance system201, the NW communication unit235is only required to communicate with the contract management server204A and the data generation server205A via the interface.

The card reader/writer236has a function of communicating with the IC card202. The card reader/writer236performs power supply, clock supply, reset control, and data transmission/reception with respect to the IC card202. After activating the IC card202, the card reader/writer236transmits various commands and receives responses to the transmitted commands under the control of the processor231. Note that the user terminal203may include an interface connected to a card reader/writer as external equipment.

The card reader/writer236has a configuration corresponding to a communication method included in the IC card202. For example, in a case where the IC card202is realized as a contactless IC card, the card reader/writer236communicates with the IC card202in a contactless (wireless) manner using a communication protocol conforming to a communication method of the contactless IC card. Furthermore, in a case where the IC card202is realized as a contact type IC card, the card reader/writer236includes a contact unit that is physically and electrically in contact with a contact unit (interface) of the IC card202to transmit and receives data via the contact unit.

The display unit237is a display device such as a liquid crystal panel. The input unit238is an operation device that receives an operation instruction to the user terminal203. The input unit238includes, for example, a touch panel. The display unit237and the input unit238may be configured by a display apparatus with a touch panel (hereinafter, referred to as a touch screen). Furthermore, the input unit238may include an operation key including a button switch, a touch sensor that detects a touch of the operator's finger based on a change in electrostatic capacitance, and the like.

Next, a configuration of the contract management server204A in the IC card issuance system201according to the second embodiment will be described.

FIG.12is a block diagram illustrating a configuration example of a contract management server204A in the IC card issuance system201according to the second embodiment.

As illustrated inFIG.12, the contract management server204A includes a processor241, a ROM242, a RAM243, a data memory244, an interface245, a network (NW) communication unit246, and a communication unit247.

The processor241executes various processes by executing a program. The processor241is, for example, a central processing unit (CPU). The processor241is connected to each unit in the server4A via a system bus to transmit and receives data to and from each unit. The processor241executes operations such as control and data processing in the contract management server204A in cooperation with the ROM242and the RAM243.

The read only memory (ROM)242is a nonvolatile memory that stores programs, control data, and the like for realizing the basic operation of the contract management server204A.

The random access memory (RAM)243is a volatile memory that temporarily stores data. The RAM243functions as a working memory in a case where the processor241executes a program.

The data memory244is a storage unit that stores various pieces of data. The data memory244is configured by a nonvolatile memory in which data is rewritable. For example, the data memory244stores an OS program, an application program, operation setting information, and the like.

The interface245is an interface configured to access the data storage204B. In a case where the data storage204B is a storage apparatus as an external device, the interface245is only required to conform to the interface standard included in the storage apparatus as the data storage204B. In addition, in a case where the data storage204B is a data server or the like, the interface may be configured by a communication interface for communicating with a server as the data storage204B.

The network (NW) communication unit246is a communication interface for communicating with an external apparatus. The NW communication unit246may perform wireless communication or may perform wired communication. In the IC card issuance system201according to the second embodiment, the NW communication unit246is only required to communicate with the user terminal203used by the user via a wide area network such as the Internet.

The communication unit247is a communication interface for communicating with the data generation server205A. The communication unit247may perform wireless communication or may perform wired communication. In the IC card issuance system201according to the second embodiment, the communication unit247is only required to be able to securely communicate with the data generation server205A.

Note that the NW communication unit246and the communication unit247may be implemented by one communication interface. Furthermore, the interface245may also be configured as a communication interface common to the NW communication unit246or the communication unit247.

Next, a configuration of the data generation server205A in the IC card issuance system201according to the second embodiment will be described.

FIG.13is a block diagram illustrating a configuration example of the data generation server205A in the IC card issuance system201according to the second embodiment.

As illustrated inFIG.13, the data generation server205A includes a processor251, a ROM252, a RAM253, a data memory254, an interface255, a network (NW) communication unit256, a communication unit257, and an interface258.

The processor251executes various processes by executing a program. The processor251is, for example, a central processing unit (CPU). The processor251is connected to each unit in the server5A via a system bus to transmit and receives data to and from each unit. The processor251executes operations such as control and data processing in the data generation server205A in cooperation with the ROM252and the RAM253.

The read only memory (ROM)252is a nonvolatile memory that stores programs, control data, and the like for realizing the basic operation of the data generation server205A.

The random access memory (RAM)253is a volatile memory that temporarily stores data. The RAM253functions as a working memory in a case where the processor251executes a program.

The data memory254is a storage unit that stores various pieces of data. The data memory254is configured by a nonvolatile memory in which data is rewritable. For example, the data memory254stores an OS program, an application program, operation setting information, and the like.

The interface255is an interface configured to access the HSM205B. The interface255is only required to conform to the interface standard included in the HSM205B.

The network (NW) communication unit256is a communication interface for communicating with an external apparatus. The NW communication unit256may perform wireless communication or may perform wired communication. In the IC card issuance system201according to the second embodiment, the NW communication unit256is only required to communicate with the user terminal203used by the user via a wide area network such as the Internet.

The communication unit257is a communication interface for communicating with the contract management server204A. The communication unit257may perform wireless communication or may perform wired communication. In the IC card issuance system201according to the second embodiment, the communication unit257is only required to be able to securely communicate with the contract management server204A.

Note that the NW communication unit256and the communication unit257may be implemented by one communication interface.

The interface258is an interface configured to access the PUF storage205C. The interface258is only required to conform to the interface standard included in the PUF storage205C. The processor251checks the PUF data registered in the PUF storage205C via the interface258.

Next, an application procedure and an issuance procedure of the issuance process in the IC card202in the IC card issuance system201according to the second embodiment will be described.

As a precondition of the operation described below, it is assumed that the IC card202is passed to the user (card holder) after primary issuance (card manufacturing and initialization) processing is performed. In addition, it is assumed that a key (key information) related to generation of card authentication data in primary issuance is written in the IC card202passed to the user. The key information written in the IC card202is stored in the HSM205B in the issuance control system205. Further, it is assumed that, in the IC card202possessed by the user (card holder), fingerprint information of the user (person himself/herself) is written after personal authentication of the user is performed.

First, an application procedure of the issuance process in the IC card202in the IC card issuance system201according to the second embodiment will be described.

FIG.14is a sequence for describing an operation example of an application procedure of the issuance process in the IC card202in the IC card issuance system201.

For the card holder, the processor231of the user terminal203receives the input of the application data by the input unit238according to the operation by the user as the card holder (ST221). The application data is assumed to include, for example, information necessary for the issuance process (secondary issuance or function addition), personal information of the user who is the card holder, information about the IC card202possessed by the card holder (user), and the like.

In addition, the user terminal203may input the application data by an application program, or may input the application data on a web site for inputting the application data provided on the Internet. In the former case, the user terminal203installs an application program in the data memory234. The processor231of the user terminal203activates the application program according to the operation by the user, and the user inputs the application data according to the input format of the application data presented in the application program. In the latter case, the processor231of the user terminal203accesses the application data input site provided on the Internet by the NW communication unit235, and the user inputs the application data according to the input format of the application data presented at the input site.

In addition, the processor231of the user terminal203reads, from the IC card202, information related to the IC card202possessed by the card holder (user) in addition to the information about the application data input by the input unit238. Here, the information related to the IC card202includes PUF data as unique identification information (ID) for identifying the IC card202.

Furthermore, in a case where the personal information of the user himself/herself who is the card holder is stored in the IC card202, the processor231of the user terminal203may read the personal information of the user from the IC card202.

In the operation example illustrated inFIG.14, the IC card202outputs information related to the IC card including the PUF data after the identity confirmation in the biometric authentication succeeds in response to the request from the card RW236of the user terminal203.

In this case, the processor231of the user terminal203transmits a fingerprint authentication request as biometric authentication and a PUF data output request to the IC card202by the card RW236(ST222). The processor221of the IC card202executes fingerprint authentication using fingerprint data stored in the data memory224in response to a request from the user terminal203(ST211). The processor221of the IC card202outputs the card data including the 0PUF data of the IC card202to the user terminal203after the identity confirmation by the fingerprint authentication succeeds (ST212).

When the input of the application data and the acquisition of the PUF data are completed, the processor231of the user terminal203creates an examination request for requesting examination regarding the issuance process (contract) in the input application data (ST223). The examination request requests examination as to whether the IC card202possessed by the card holder is allowed to execute (contract) an issuance process (secondary issuance or function addition) according to the application content input as the application data. In addition, the examination request includes the PUF data acquired from the IC card202.

When the examination request including the application data and the PUF data is created, the processor231of the user terminal203transmits the examination request to the contract management server204A of the data management system204(ST224). The processor231accesses the contract management server204A via the Internet by the NW communication unit235to transmit an examination request to the contract management server204A.

The contract management server204A receives an examination request from the user terminal203by the NW communication unit246(ST231). Upon receiving the examination request from the user terminal203, the processor241of the contract management server204A examines whether to permit the issuance process applied in accordance with the received examination request.

For example, the contract management server204A examines whether there is a problem in the application content indicated by the application data and whether there is a problem in the contract for performing the issuance process with respect to the card holder that is the applicant. The content and procedures of the examination are not limited to specific forms as long as they conform to the operation form. That is, the examination procedure may be any procedure as long as the examination result for the examination request is input to the contract management server204A.

In a case where the examination result for the examination request indicates that the contract is not allowed (issuance process is not allowed), the processor241of the contract management server204A notifies the user terminal203, which is the transmission source of the examination request, that the contract is not allowed as the examination result (ST234). In addition, the processor241may notify the contact address specified by the card holder in the application data of the examination result.

When the processor231of the user terminal203receives a notification indicating that the contract is not allowed as the examination result for the examination request from the contract management server204A, the processor231notifies the card holder of the fact that the examination result is that the contract is not allowed by displaying the fact on the display unit237(ST225).

In a case where the examination result for the examination request indicates that the contract is allowed (issuance process is allowed), the processor241of the contract management server204A issues the contract ID (ST232). When the contract ID is issued, the processor241registers the application data and the PUF data included in the examination request the examination result for which indicates that the contract is allowed in the data storage204B in association with the issued the contract ID (ST233). As a result, the data storage204B stores information in which the application data from the contract management server204A, the PUF data, and the contract ID are associated with each other (ST241).

When the application data, the PUF data, and the contract ID are registered in the data storage204B, the processor241of the contract management server204A notifies the user terminal203, which is the transmission source of the examination request, of the contract ID together with the examination result (ST234).

When the processor231of the user terminal203receives a notification indicating that the examination result for the examination request is that the contract is allowed from the contract management server204A, the processor displays the contract ID on the display unit237together with a guidance indicating that the contract is allowed as the examination result (ST225). Here, in a case where the examination result is acceptable, the processor231of the user terminal203may display, on the display unit237, guidance regarding the procedure of the issuance process, and the like. Note that the contract ID is only required to be notified to the user serving as the card holder in a case where the examination result indicates that the contract is allowed. For example, the contract management server204A may notify the contact address (for example, an email address) of the card holder included in the application data of the contract ID.

Through the application procedure as described above, when the result for the examination request from the user terminal is that the contract is allowed, the contract management server can store, in the data storage, the application data from the card holder that has made the examination request, the PUF data of the IC card subject to the issuance process, and the contract ID. As a result, the IC card202possessed by the card holder is ready to be able to perform the issuance process in remote by operation as described later. That is, after a state in which the issuance process can be performed, the card holder executes an issuance procedure described later for remotely causing the IC card202to perform the issuance process using the user terminal203.

Next, an issuance procedure for causing the IC card202in the IC card issuance system201to perform the issuance process according to the second embodiment will be described.

FIGS.15and16are sequences for describing an operation example of an issuance procedure for causing the IC card202in the IC card issuance system201to perform the issuance process on.

The user as the card holder activates an application program (hereinafter, referred to as an issuance application) for the issuance process in the IC card202in the user terminal203. The issuance application may be stored in the data memory224in advance, or may be downloaded from the contract management server204A or the data generation server205A.

The processor231of the user terminal203activates the issuance application in response to the instruction to activate the issuance application input by the card holder to the input unit238(ST320). When the issuance application is activated, the processor231requests the card holder to input a contract ID (ST321). The card holder inputs the contract ID acquired together with the examination result for the application data by the input unit238. When the contract ID is input to the input unit238, the processor231accesses the IC card202with the card RW236, and requests the IC card202to perform fingerprint authentication as biometric authentication for identity confirmation (ST322).

The IC card202is activated by power supplied from the card RW236. When the IC card202is activated, the processor221executes a fingerprint authentication process in response to a request for biometric (fingerprint) authentication supplied from the card RW236(ST311). When performing fingerprint authentication, the processor221acquires a fingerprint of the user (card holder) by the fingerprint sensor220. The processor221performs fingerprint authentication by comparing fingerprint information acquired by the fingerprint sensor220with fingerprint data stored in the second storage area224bof the data memory224.

When it is determined that the fingerprint information acquired by the fingerprint sensor220and the fingerprint data stored in the second storage area224bof the data memory224are fingerprints of the same person, the processor221determines that the fingerprint authentication is successful. When it is determined that the fingerprint information acquired by the fingerprint sensor220and the fingerprint data stored in the second storage area224bare not fingerprints of the same person, the processor221determines that fingerprint authentication has failed.

When the fingerprint authentication in the IC card202fails, the processor221notifies the card RW236that the fingerprint authentication fails. When the card RW236receives a notification of fingerprint authentication failure from the IC card202, the processor231of the user terminal203cancels the issuance procedure for causing the IC card202to execute the issuance process. In this case, the processor231notifies the user of the cancellation of the issuance procedure by displaying, on the display unit237, the fact that the IC card202is not allowed to perform the issuance process due to failure of the identity confirmation.

When the fingerprint authentication in the IC card202is successful, the processor221notifies the card RW236that the fingerprint authentication is successful. When the card RW236receives a notification indicating that the fingerprint authentication is successful from the IC card202, the processor231of the user terminal203requests the IC card202via the card RW236for the card authentication data and the PUF data for executing the issuance process. In response, the processor221of the IC card202generates the card authentication data and acquires the PUF data, and supplies the generated card authentication data and the PUF data to the card RW236.

That is, when the fingerprint authentication is successful, the processor221of the IC card202generates card authentication data (authentication data) (ST312). The card authentication data is authentication data generated in a case where the biometric authentication succeeds with the IC card202, and includes information for causing the IC card202to perform the issuance process such as function addition (for example, adding an applet) or secondary issuance.

The card authentication data is generated using the key information stored in the storage area224aof the data memory224that is the secure memory. In addition, the card authentication data includes, for example, CPLC (information indicating a product cycle of the IC card), an INITIALIZE UPDATE command, response data, and the like as information for performing the issuance process.

When the fingerprint authentication is successful, the processor221of the IC card202acquires the PUF data which is information unique to the IC card202. When the PUF data is held in a third storage area224cof the data memory224as illustrated inFIG.10, the processor221acquires the PUF data from the third storage area in the data memory224. However, in a case where the IC card202includes a PUF circuit as a device that outputs PUF data, the processor221may acquire the PUF data from the PUF circuit.

When the card authentication data is generated and the PUF data is acquired after the fingerprint authentication succeeds, the processor221of the IC card202outputs the generated card authentication data and the PUF data to the card RW236of the user terminal203(ST313). After outputting the card authentication data and the PUF data, the processor221of the IC card202is ready to be able to execute the issuance process based on the issuance data generated by the data generation server205A according to the card authentication data can be executed.

When acquiring the card authentication data and the PUF data from the IC card202with which fingerprint authentication has succeeded by the card RW236, the processor231of the user terminal203generates an issuance request for requesting the IC card202for the issuance process to transmit the generated issuance request to the data generation server205A (ST324).

For example, the processor231generates an issuance request including the contract ID input by the input unit238in addition to the card authentication data and the PUF data acquired from the IC card202. When the issuance request including the card authentication data, the PUF data, and the contract ID is generated, the processor231accesses the data generation server205A in the issuance control system205via the Internet by the NW communication unit235. When accessing the data generation server205A, the processor231transmits an issuance request including the card authentication data, the PUF data, and the contract ID to the data generation server205A.

The data generation server205A receives the issuance request from the user terminal203by the NW communication unit256. When the issuance request is received, the processor251of the data generation server205A extracts the contract ID included in the issuance request. When extracting the contract ID included in the issuance request, the processor251accesses the contract management server204A via the communication unit257. When accessing the contract management server204A, the processor251transmits a request (request) for application data corresponding to the contract ID included in the issuance request to the contract management server204A (ST331).

The contract management server204A communicates with the data generation server205A via the communication unit247. When receiving the request for requesting the application data corresponding to the contract ID from the data generation server205A, the processor241of the contract management server204A searches the data storage204B for the application data corresponding to the contract ID (ST341). When detecting the application data corresponding to the contract ID requested from the data generation server205A, the processor241transmits the application data corresponding to the contract ID and the PUF data to the data generation server205A via the communication unit247(ST342).

When the application data corresponding to the contract ID and the PUF data are received from the contract management server204A, the processor251of the data generation server205A checks whether the PUF data included in the issuance request from the user terminal203is registered in the PUF storage205C and matches the PUF data corresponding to the application data (ST332).

For example, the processor251checks whether the PUF data included in the issuance request is registered in the PUF storage205C. That is, the processor251checks (true/false determination) whether the PUF data (the PUF data of the IC card requesting the issuance process) included in the issuance request is registered in the PUF storage205C and is the PUF data of the authorized IC card. As a result, the processor251can confirm that the IC card requesting the issuance process is an authorized product.

When the PUF data included in the issuance request is registered in the PUF storage205C, the processor251further checks whether the PUF data included in the issuance request matches the PUF data acquired from the contract management server204A. That is, the processor251checks whether the PUF data included in the issuance request (the PUF data of the IC card requesting the issuance process) matches the PUF data of the IC card for which the issuance process has been applied. As a result, the processor251can confirm that the IC card requesting the issuance process is the same as the IC card for which the application for the issuance process has been made.

When receiving the issuance request from the user terminal203, the processor251of the data generation server205A may check whether the PUF data included in the issuance request is registered in the PUF storage. That is, the processor251may acquire the application data and the PUF data from the contract management server204A after confirming that the PUF data included in the issuance request is registered in the PUF storage.

In a case where it is confirmed by checking the PUF data that the IC card202to be subjected to the issuance process is an authorized product and matches the IC card for which the application has been made, the processor251of the data generation server205A generates the issuance data for causing the IC card202to execute the issuance process based on the application data (ST333). The issuance data includes a command to be executed by the IC card202in a series of issuance processes based on the application data and data to be written to the IC card202in a series of issuance processes.

For example, in a case where an applet as the issuance process is added to the IC card202, the issuance data includes an install (INSTALL) command as a command to be executed by the IC card202. Furthermore, in a case where an applet is added according to a certain credit card standard, the issuance data includes an external authentication (EXTERNAL AUTHENTICATE) command and a store data (STORE DATA) command as commands to be executed by the IC card202.

In addition, the processor251processes the issuance data using key information stored in the HSM205B in order to securely supply the issuance data to the IC card202(ST334). Here, the HSM205B stores key information corresponding to key information held in the IC card202. As a result, the issuance data can be securely supplied to the IC card202by encryption using the HSM205B. For example, the processor251encrypts data included in the issuance data using key information shared with key information stored in the IC card202by the HSM205B.

After the issuance data is encrypted using the key information stored in the HSM205B, the processor251transmits the issuance data encrypted using the HSM205B to the user terminal203that is the transmission source of the issuance request (ST335).

After transmitting the issuance request to the data generation server205A, the user terminal203waits to receive the issuance data as a response to the issuance request. In this state, the user terminal203receives the issuance data transmitted from the data generation server205A by the NW communication unit2354(ST325). When the issuance data is received, the processor231of the user terminal203outputs the issuance data to the IC card202by the card RW236(ST326).

As a result, the processor221of the IC card202acquires the issuance data corresponding to the card authentication data generated after the biometric authentication succeeds from the card RW236of the user terminal203. When the issuance data is acquired, the processor221executes the issuance process according to the acquired issuance data (ST314).

For example, the processor221writes, in the data memory224, data to be written as the issuance process by executing a command included in the issuance data. In addition, the processor221decrypts the encrypted data included in the issuance data supplied in the issuance process using the key information stored in the first storage area224athat is the secure memory in the data memory224.

When the issuance process based on the supplied issuance data is completed, the processor221of the IC card202notifies the card RW236of the user terminal203of the completion of the issuance process (ST315).

After outputting the issuance data to the IC card202by the card RW236, the user terminal203receives a notification indicating that the issuance process is completed from the IC card202. Upon receiving the completion notification of the issuance process from the IC card202by the card RW236, the processor231of the user terminal203displays, on the display unit237, a guidance indicating that the issuance process (function addition or secondary issuance) on the IC card202is completed (ST327).

When receiving the notification that the issuance process on the IC card202based on the issuance data is completed, the processor231notifies the data generation server205A that is the transmission source of the issuance data of the completion of the issuance process by the NW communication unit235(ST328).

When the NW communication unit256receives the completion notification of the issuance process on the IC card202from the user terminal203, the processor251of the data generation server205A transfers (transmits) the completion notification of the issuance process on the IC card202to the contract management server204A by the communication unit257.

The contract management server204A receives the completion notification of the issuance process on the IC card202via the data generation server205A by the communication unit247. When receiving the completion notification of the issuance process on the IC card202via the data generation server205A, the processor241of the contract management server204A records the completion of the issuance process corresponding to the application data in the data storage204B (ST343).

Through the issuance procedure as described above, the IC card issuance system according to the second embodiment can check, using the PUF data, whether the IC card is an authorized product and matches the IC card at the time of application after personal authentication by biometric authentication has succeeded in the IC card including the fingerprint sensor as the biometric sensor. As a result, in the IC card issuance system according to the second embodiment, an IC card that is an authorized product and matches an IC card at the time of application can perform an issuance process such as function addition or secondary issuance in remote

The IC card issuance system according to the second embodiment uses the PUF data. This eliminates the need for an operation of artificially generating unique data for each LSI and writing the data in the LSI when generating an IC card as in the related art. This is because the PUF can be automatically generated by a specific algorithm using a physical unique variation such as a crystal pattern of an electronic circuit or a semiconductor.

In addition, in a case where unique data such as an identification code individually attached to the IC card is required, it is necessary that the data is always different from data issued in the past. In this respect, the PUF is always unique data and is not duplicated, and thus is suitable for the invention according to the second embodiment as an ID.

Furthermore, in order to create data specific to the LSI, a creation form or format is generally different depending on the LSI vendor. In this regard, according to the invention of the second embodiment, generation and format of unique data can be unified by using a PUF.

The functions described in the above-described embodiments can be implemented not only by using hardware but also by causing a computer to read a program describing the functions by using software. Furthermore, each function may be configured by appropriately selecting either software or hardware.

Although some embodiments of the present invention have been described, these embodiments have been presented as examples, and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and changes can be made without departing from the gist of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalent scope thereof.