IC card processing apparatus

Abstract: An IC card processing apparatus transmits that PIN information input thereto by the user, which needs to be kept secret, from a keyboard (30) to predetermined general purpose ports (43A, 43B) of a CPU (22) through a specific bus (32), without using a system data bus (24). The processing apparatus transmits the PIN information included in a collation command to be sent from the CPU (22) to an IC card (31), after changing the structure or representation of the PIN information in accordance with a program version stored in the IC card, thus increasing the number of kinds of IC cards which can be processed, and besides more reliably preventing the PIN information from being stolen even when the collation command is sent through the system data bus (24).

Description: The present invention relates to an IC card processing apparatus for receiving transaction information such as a PIN (Personal Identification Number), which needs to be kept secret. In general, an IC card processing apparatus determines whether or not an IC card loaded in the apparatus is effective for transaction, and determines whether or not the operator who is a customer is a real possessor of the IC card or makes the IC card determine whether or not the operator is the registered possessor of the IC card. At this time, the processing apparatus requests the operator to input PIN information by use of, e.g., a display device at an early stage of the transaction. The structure and operation of a conventional IC card processing apparatus will be explained with reference to FIG. 9 which is a system block diagram. Referring to FIG. 9, an IC card processing apparatus 1 comprises a control section 2 comprising a CPU, a system address bus 3, a system data bus 4, both connected to the control section 2, a program ROM 6, a general purpose RAM 7, an IC card interface 8, a keyboard interface 9, and a keyboard 10 connected to the keyboard interface 9. The IC card interface 8 allows an IC card 11 to be removably connected to the IC card interface 8. When a transaction is to be performed by use of the IC card processing apparatus 1, the operator first designates a desired kind of transaction on the keyboard 10, for example. As a result, a display section 5 displays an instruction thereon which requests the operator to load an IC card 11 into the processing apparatus 1. When the IC card 11 is loaded thereinto, its contact is brought into contact with a contact of the IC card interface 8, and electric power is supplied from the processing apparatus 1 to the IC card 11. Then, the display section 5 displays an instruction which requests the operator to input PIN information. PIN information consisting of, e.g., four figures is transmitted to the control section 2 through the keyboard interface 9 and the system bus 4, when it is input from the keyboard 10 by the operator. When receiving the PIN information, the control section 2 produces a PIN collation command including the PIN information, and transmits the PIN collation command to the IC card 11 through the system data bus 4 and IC card interface 8. In the IC card 11, the transmitted PIN information is compared with PIN information registered in advance in the IC card 11. Then, when the transmitted PIN information is identical to the registered PIN information, the fact is transmitted to the control section 2. As a result, the control section 2 determines that the operator is a real possessor of the IC card 11. However, in the above conventional IC card processing apparatus 1, PIN information which is transaction information to be kept secret is transmitted as key input information from the keyboard 10 to the control section 2 through the keyboard interface 9 and the system data bus 4. The data structure of the key input information is simple, and the timing at which the information passes through the system data bus 4 is also simple. Thus, it is considerably easy to wrongfully obtain the PIN information when it is transmitted through the system data bus 4, since the connection position of the system data bus 4 can be easily known from the specification of the processing apparatus 1. Moreover, it is relatively easy to obtain the PIN information from the PIN collation command also, which is transmitted from the control section 2 to the IC card 11. This is because the structure of the PIN information in the PIN collation command is fixed, and the representation of the PIN information is also fixed. In addition, the kinds of IC cards which can be processed are limited since the representation of the PIN information in the PIN collation command is fixed. EP 0 763 791 A1 discloses an apparatus according to the preamble of claim 1. US 5 365 045 discloses an IC card processing apparatus including a display, a keyboard, an IC card reader/writer, a printer and a disk drive, each connected to a controller. EP 0 284 351 A1 discloses a security device for IC cards serving as a safe preventing unauthorized physical access to the IC card, wherein no data transfer with the IC card is possible and a keyboard is provided for inputting a pin authorizing the physical access to the IC card. In view of the foregoing, the object of the present invention is to provide an IC card processing apparatus having a structure in which secret information such as PIN information cannot easily be stolen, and a larger number of kinds of IC cards ca be processed. This object is achieved by an apparatus according to claim 1. Further developments of the invention are given in the dependent claims. By virtue of the above structure, in the present invention, transaction information such as PIN information is transmitted from the keyboard to the control section without passing through the system data bus. In addition, PIN information included in a collation command to be transmitted from the control section to the IC card is transmitted thereto after the structure or representation of the PIN information is changed or rearranged in accordance with the kind of the IC card. Due to the above features, a larger number of kinds of IC cards can be processed, and the PIN information is more reliably prevented from being stolen even when the collation command is transmitted through the system data bus. This summary of the invention does not necessarily describe all necessary features so that the invention may also be a sub-combination of these described features. The invention can be more fully under stood from the following detailed description when taken in conjunction with the accompanying drawings, in which: FIG. 1 is a block diagram of the structure of a system according to the first embodiment of the present invention. FIG. 2 is a block diagram of the structure of a system according to the second embodiment of the present invention. FIG. 3 is a circuit diagram of the structure of a key input section. FIGS. 4A, 4B and 4C are views for illustrating the transmission and structure of information which is transmitted between a control section and an IC card. FIG. 5 is a flowchart of the operation performed in the case of selecting a desired representation as a representation of PIN information included in a PIN collation command to be transmitted to the IC card. FIGS. 6A to 6C are views for showing examples of representations of PIN information in PIN collation commands. FIGS. 7A to 7F are views for showing examples of structures of PIN information in PIN collation commands. FIG. 8 is a flowchart of the operation performed in the case of selecting a desired structure as a structure of PIN information included in a PIN collation command to be transmitted to the IC card. FIG. 9 is a block diagram of a conventional IC card system. The embodiments of the present invention will be explained with reference to the accompanying drawings. FIG. 1 is a block diagram of an IC card processing apparatus 21 according to the first embodiment of the present invention. The IC card processing apparatus 21 comprises; a control section 22 comprising a CPU; a system address bus 23 connected to the control section 22; a system data bus 24 connected to the control section 22; a liquid crystal display section 25; a program ROM 26; a general purpose RAM 27; and an IC card interface 28, the liquid crystal display section 25; the program ROM 26, the general purpose RAM 27, and the IC card interface 28 being connected to the system address buses 23 and 24; a keyboard interface 29 connected to general purpose ports P of the control section 22 by an input bus 32 specific to the keyboard interface 29, not by the system data bus 24; and a keyboard 30 connected to the keyboard interface 29. The IC card interface 28 has a contact for allowing an IC card 31 to be removably connected to the IC card processing apparatus. In the first embodiment, the control section 22 is constituted by a CPU; however, needless to say, it may be constituted by a control board having general purpose ports, instead of the CPU. The IC card 31 has a program ROM 31A storing an operation program of the IC card 31, and besides an RAM and a CPU for use in control, both not shown. The specific input bus 32 may be a serial or parallel structure. Furthermore, the CPU of the control section 22 of the first embodiment is designed to control the operation of the entire apparatus 21. The operation program of the CPU is stored in the program ROM 26, and various data for use in transaction is input to and read out from the general purpose RAM 27 by use of the IC card 31 in accordance with the control of the CPU. In the case where the operator who is a customer makes a transaction with the IC card processing apparatus 21, he or she first designates a desired transaction by a designation key (not shown), for example. The display section 25 displays an instruction for requesting the operator to load the IC card 31. Accordingly, the operator inserts his or her IC card 31 into the IC card processing apparatus 21. In response to insertion of the IC card 31, electric power is supplied from the IC card processing apparatus 21 to the contact of the IC card 31 through the IC card interface 28, thereby activating the IC card 31. In this state, the display section 25 displays an instruction for requesting the operator to input his or her PIN (Personal Identification Number). When he or she inputs his or her PIN by use of the keyboard 30, the PIN is transmitted as PIN information from the keyboard interface 29 to the general purpose ports P of the CPU (control section 22) through the specific input bus 32; it is not transmitted through the data bus 24. It is not seen by the outsider what purpose the general purpose ports P of the CPU are used for, since an ordinary CPU has a plurality of general purpose ports P which can be applied to various uses. Nor is it seen from the package of the keyboard interface 29 that the keyboard interface 29 is a keyboard interface. Therefore, it is impossible to steal PIN information which is transmitted to the CPU of the control section 22 from the keyboard interface 29. Also, it is considerably difficult to steal PIN information which is transmitted from the keyboard 30 to keyboard interface 29. This is because the keyboard 30 has wirings provided in a matrix manner. The keyboard interface 29 is connected to the general purpose ports P of the CPU by the specific bus 32. However, any type of bus may be used as the bus 32, except the system data bus 24. In addition, data other than PIN information may also be transmitted by use of the bus 32 as long as it does not interfere with input of PIN information from the keyboard 30. When receiving PIN information, the control section 22 produces a PIN collation command, and transmits the PIN collation command to the IC card 31 through the system data bus 32 and the IC card interface 28. In addition, in both the first and second embodiments, the format of the PIN collation command may by changed in order to prevent the PIN information from being stolen when the PIN information collation command is transmitted through the system data bus 24. This will be explained in detail later. The IC card 31 of the first embodiment compares transmitted PIN information with PIN information registered in advance in the IC card 31, and then, informs the control section 22 that the transmitted PIN information is identical to the registered PIN information, if so. Accordingly, the control section 22 determines that the operator is a legitimate possessor of the IC card 31, and then performs a predetermined transaction operation with the operator. In the first embodiment, unlike the conventional processing apparatus, input PIN information is transmitted from the keyboard interface 29 to the general purpose ports P of the CPU of the control section 22 through the specific bus 32; it is not transmitted through the system data bus 24. The positions of the general purpose ports P is hardly known since in general, the specification of the CPU does not describe the ports P as ports for receiving information input by use of keys. Furthermore, the bus 32 is provided independently of the system data bus 24. Therefore, the PIN information is hard to detect even if it is known on the system data bus 24 that data for requesting input of the PIN information is transmitted to the display section 25. This is because the PIN information input in response to the request of the data does not pass through the system data bus 24. According to the above explanation, an instruction for requesting the operator to input PIN information is given by use of the display section 25. However, needless to say, it may be given by use of voice, light or the like. FIGS. 2 and 3 are block diagrams for showing the second embodiment of the present invention. In the first embodiment shown in FIG. 1, a key input signal input from the keyboard 30 is supplied from the keyboard interface 29 to the CPU of the control section 22 through the specific bus 32. On the other hand, in the second embodiment shown in FIGS. 2 and 3, a key matrix provided in the keyboard 43, which serves as a PIN input section for inputting PIN information, uses a specific input/output port section 42A provided in advance in a CPU constituting a control section 42. In the second embodiment, as shown in FIGS. 2 and 3, the input/output port section 42A comprises four input ports P00 to P03 and four output ports P04 to P07. The input ports P00 to P03 are respectively connected to row lines x1 to x4 constituting an input port section 43A for use in inputting PIN or the like. The output ports P04 to P07 are respectively connected to column lines y1 to y4 constituting an output port section 43B. Number keys "1", "2", "3" ... "8", "9", "0" and function keys such as an "OK" key for use in confirmation, an "NO" key for use in cancel, and movement keys (indicating movement directions by use of upward, downward, leftward and rightward arrows) are arranged in a matrix manner at the intersections of the lines x1 to x4 and lines y1 to y4. As shown in FIG. 3, all key sections respectively corresponding to the keys are normal open type of switches. When a desired key is pushed, its key section enters a closed state, connecting an associated one of the row lines x1 to x4 and an associated one of the column lines y1 to y4. The CPU of the control section 42 scans the input ports P00 to P03 and the output ports P04 to P07, detecting which one of the keys is pushed. To be more specific, when one of the output ports P04 to P07 is set at "0", and the others are set at "1", the pushed key can be specified by detecting one of the input ports P00 to P03 which is set at "0". For example, it is detected that the "1" key is pushed, in the case where "0" is output to the output port P04, "1" is output to the output ports P05 to P07, and it is detected that only the input port P00 is set at "0", and the other input ports, i.e., the input ports P01 to P03 are set at "1". In the case where the key input section has the above structure, the keyboard interface 29 shown in FIG. 1 can be omitted. Furthermore, no specific bus is needed to be provided between the key input section 43 and the CPU of the control section 42, since the key input section comprises a key matrix by using the input/output ports P00 to P07 provided in advance in the CPU of the control section 42. By virtue of this feature, it is more difficult to steal the PIN information input by use of the keys than in the first embodiment. Furthermore, in the second embodiment, the same structural elements will be denoted by the same reference numerals as in the first embodiment, and the detailed explanations therefor will be omitted. With respect to the first and second embodiments, the above explanations refer to the structures designed to prevent PIN information from being stolen when the PIN information is transmitted from the keyboard to the CPU. Therefore, the following explanation will be given of how the PIN information is prevented from being stolen when the PIN collation command is transmitted from the CPU to the IC card 31, i.e., it passes through the system data bus 24. In the first and second embodiments, in the case where the PIN collation command is sent from the CPU to the IC card 31, the structure or representation of the PIN information included in the command is changed to make the PIN information hard to read out. In both those embodiments, the same operation is performed when the PIN collation command is transmitted through the system data bus 24. Therefore, the following explanation will be given with reference to the first embodiment only. Referring to FIG. 1, when the CPU of the control section 22 receives PIN information input by the operator through the specific bus 32, IC card PIN collation instruction information, i.e., a PIN collation command, which is produced in such a manner as to include the PIN information, is transmitted through the system data bus 24. The PIN collation command is received by the IC card interface 28, and then supplied to the IC card 31 as instruction information, as shown in FIG. 4A. When receiving the instruction information, the IC card 31, as mentioned above, fetches the PIN information from the instruction information, and checks whether or not the PIN information is identical to the PIN information registered in advance in the IC card 31. The IC card 31, as shown in FIG. 4A, sends answer information representing a result of checking to the IC card interface 28, and then the answer information is sent to the CPU of the control section 22 through the system data bus 24. FIG. 4B shows an example of the structure of instruction information produced as a PIN collation command. The instruction information comprises a PIN collation instruction code 51, length information 52, a PIN information portion 53, and an information confirmation code 54, which are arranged in that order. The length information 52 is information representing the information amount of the entire PIN information portion 53 in the number of bytes. Therefore, when receiving the instruction information, the IC card 31 fetches the PIN information portion 53 from the instruction information by referring to the length information 52, and collates the PIN information portion 53 with the PIN information registered in advance in the IC card 31. On the other hand, the answer information sent from the IC card 31 has a structure shown in FIG. 4C, and comprises a PIN collation answer code 55, length information 56, an instruction execution result code 57, and information confirmation code 58, which are arranged in that order. With reference to FIGS. 5 and 6, the following explanation will be given for a method of changing the representation of the PIN information portion 53 included in the PIN collation command shown in FIG. 4B in accordance with the kind of an IC card inserted. Before the "start" specified in the flowchart of FIG. 5, the IC card 31 to be processed is inserted into the IC card interface 28, and a reset signal necessary for the operation of the IC card 31 is supplied thereto, thereby to obtain an initial answer-to-reset signal from the IC card 31. Then, the operation is shifted to step S1 shown in FIG. 5, and information, e.g., a program version is obtained as information representing the kind of the IC card 31. The program version is contained in the IC card 31, and means a program version of a ROM 31A storing an operation program of the IC card 31. When the initial answer-to-reset signal is sent from the IC card 31 to the CPU of the control section 22 through the system data bus 24, the CPU checks the program version of the IC card 31 on the basis of the initial answer-to-reset signal, and regards the program version as information representing the kind of the IC card 31. The CPU of the control section 22 has a number of information indicating representations one of which is to be applied to the PIN information portion of the PIN collation command, and is selected in accordance with, e.g., the contents of the program version of the IC card 31. In step S2, as shown in FIG. 5, one of the representations is selected as a representation of PIN information to be sent to the IC card 31 in accordance with version information. As the above representations, an ASCII representation, a binary representation, a pack representation, and an unpack representation are provided. One of those representations is selected in accordance with the program version. In step S3, a display section 25 displays, e.g., characters which requests the operator to input his or her PIN. In step S4, the PIN information obtained from the keyboard interface 29 via the specific bus 32 is modified in accordance with the selected representation, thereby producing instruction information as a PIN collation command to be transmitted to the IC card 31. In step S5, the produced instruction information is sent from the CPU of the control section 22 to the IC card 31 through the system data bus 24, and is subjected to PIN collation in the IC card 31. In step S6, information representing a result of collation is sent as answer information from the IC card 31 to the CPU of the control section 22. In step S7, the CPU checks an instruction execution result code in the answer information, and then, for example, information indicating that the operation is normally ended (normal end) or it is abnormally ended (abnormal end) is displayed on a display section 25 based on a result of checking. When the operation is normally ended, it means that it is determined that the PIN input by the operator is identical to the PIN stored in the IC card 31, and thus the operator is a legitimate possessor of the IC card 31. Thereafter, a transaction designated by the operator is performed. In contrast, when the operation is abnormally ended, various cases are considerable. For example, when the input PIN is not identical to the stored PIN, a message requesting the operator to re-input his or her PIN is displayed. In another case, a message is displayed which indicates that the transaction is impossible due to occurrence of abnormality in the IC card. Consequently, the IC card is ejected from the interface 28. FIGS. 6A, 6B and 6C show examples of the structures of PIN collation commands which use the ASCII representation, the binary representation, and the pack representation, respectively. FIG. 6A shows a PIN collation command produced according to the ASCII representation. The PIN collation command contains information of four figures as PIN information, which are obtained, for example from the "1" key, the "2" key, the "3" key and the "4" key of the keyboard 30, respectively. Therefore, a length information portion 62 is represented by length information of 1 byte "04h". PIN information portions 63, 64, 65 and 66 are respectively represented by information of 1 byte "31h", "32h", "33h" and "34h" of the ASCII representation. The "h" indicates that the data is hexadecimally represented. As shown in FIG. 6B, when the binary representation is selected, the length information of a length information portion 72, as well as that of the length information portion 62, is "04". However, PIN information portions 73, 74, 75 and 76 are respectively represented by "01h", "02h", "03h" and "04" of hexadecimal binary representation. When the pack representation is selected as shown in FIG. 6C, the length information of a length information portion 82 is "02h" which is half that of each of the above length information portions 62 and 72. PIN information portions 83 and 84 are represented by "12h" and "34h" of the pack representation, respectively, which are obtained by packing "1" and "2" and packing "3" and "4". For example, when an IC card newly inserted in the IC card interface 28 differs from that of the previously inserted IC card regarding the program version and the representation of the PIN information portion, a PIN collation command is produced in accordance with the representation selected in step S2 shown in FIG. 5, and PIN collation processing is executed in the same manner as in the previously inserted IC card. The above explanation and FIGS. 5, 6A, 6B and 6C refer to the case where a desired representation is selected as a representation of PIN information from among the ASCII representation, the binary representation, the pack representation, and the unpack representation. However, after the desired representation is selected, the order may be changed in which PIN information portions of PIN information produced in accordance with the selected representation are arranged. In this case, the PIN information is more reliably prevented from being stolen when being sent through the system data bus 24. FIGS. 7A to 7F show examples of various modifications of the structure of the PIN collation command. More specifically, FIG. 7A shows a PIN collation command obtained by selecting the forward structure after the ASCII representation is selected as in the PIN collation command shown in FIG. 6A. Therefore, the PIN collation command shown in FIG. 7A is the same as that shown in FIG. 6A in structure. FIG. 7B shows a PIN collation command obtained by selecting the reverse structure after the binary representation is selected. In the PIN collation command, PIN information portions 63, 64, 65 and 66 are represented by "04h", "03h", "02h" and "01h", respectively. FIGS. 7C to 7F respectively show four PIN collation command pieces each obtained by selecting the 1 byte structure, which are necessary for transmission of PIN information of 4 bytes of ASCII representation. FIG. 7C shows the structure of the first PIN collation command piece indicating the first one of four figures constituting PIN. The first PIN collation command piece consists of a PIN collation instruction code 61, length information 62 represented by "01h", a PIN information portion 63 represented by "31h" which is the first one of 4 bytes of the PIN information, and an information confirmation code 67. The second PIN collation command piece, as shown in FIG. 7D, has a PIN information portion 64 which is the second information portion of the command piece from left, and which is represented by "32h" which is the second one of the 4 bytes of the PIN information. The third PIN collation command piece, as shown FIG. 7E, has a PIN information portion 65 which is the third information portion of the command piece from left, and which is represented by "33h" which is the third one of the 4 bytes of the PIN information. The fourth PIN collation command piece, as shown in FIG. 7F, has a PIN information portion 66 which is the fourth information portion of the command piece from left, and which is represented by "34h" which is the fourth one of the 4 bytes of the PIN information. FIG. 8 is a flowchart of the operation of the IC card processing apparatus which includes a step of selecting the structure of a PIN collation command in the above manner, and illustrates steps which are carried out after reception of an initial answer-to-reset signal from the IC card 31 as in the flowchart of FIG. 5. More specifically, after reception of the initial answer-to-reset signal from the IC card 31, the operation is shifted to step S11 which is the first step, and information of a program version is obtained as information representing the kind of the IC card 31, as shown in FIG. 8. The CPU of the control section 22 has information representing structures one of which is to be applied to the PIN information portions of a PIN collation command, and selects one of the structure in step S12 in accordance with the program version. As shown in FIGS. 7A to 7F, the forward structure, the reverse structure, the 1 byte structure, and the like are provided, and one of them is selected as a structure of the PIN information portions. Thereafter, in step S13, for example, the display section 25 displays characters which request the operator to input his or her PIN. In step S14, the PIN information obtained from the keyboard interface 29 through the specific bus 32 is modified in accordance with the representation of the selected structure, thereby producing instruction information as a PIN collation command to be sent to the IC card 31. In step S15, the produced instruction information is sent from the control section 22 to the IC card 31, and its PIN is collated with the PIN registered in the IC card 31. In step S16, information representing a result of collation is sent to the control section 22 as answer information. In step S17, the control section 22 checks an instruction execution result code included in the answer information, and then, for example, the display section 25 displays a normal end or an abnormal end. As explained in detail above, the IC card processing apparatus of the present invention has a structure which has the following features and advantages: Transaction information such as PIN information which needs to be kept secret is sent from a keyboard to a control section such as a CPU without passing through a system data bus, thus reliably preventing the information from being stolen. Moreover, the structure or representation of PIN information to be processed by an IC card can be selected, as a result of which the PIN information can be kept secret more reliably. Thus, the information is prevented from being stolen even when a collation command including the secret information is sent to the IC card through the system data bus. In addition, a larger number of kinds of IC cards can be processed.

Claims: IC card processing apparatus, comprising a control section (22) for processing IC card information, a system bus (24) connected to said control section, an IC card interface (28) to which an IC card (31) is to be removably connected, said IC card interface being connected to said system bus, and information inputting means (29, 30; 43) for inputting information to said control section, a data bus (32), provided separately from said system bus and connected to said information inputting means and said control section, through which the information input by said information inputting means is transmitted to said control section, or specific input/output ports (43A, 43B) of said control section, which are connected to said information inputting means, for receiving the information input by said information inputting means, the control section further comprising producing means (22) for producing a PIN collation command on the basis of a PIN information input by said information inputting means, transmitting means (24) for transmitting the PIN collation command to said IC card through said system bus and said IC card interface, and means (22) for arranging data constituting the PIN information in a predetermined data format on the basis of information representing a kind of the IC card, the information being the program version of the IC card (31). The IC card processing apparatus according to claim 1, characterized in that said data bus (32) is provided and said information inputting means (29, 30) includes a keyboard (30) and a keyboard interface (29) provided between said keyboard and said control section. The IC card processing apparatus according to claim 1, characterized in that said specific input/output ports (43A, 43B) are provided and said information inputting means comprises a key matrix circuit (43) having a plurality of key switches, and means (X1 to X4, Y1 to Y4) for connecting said key matrix circuit and said input/output ports. The IC card processing apparatus according to one of claims 1 to 3, characterized in that the apparatus further comprises operation instructing means (25), connected to said control section by said system bus, for giving an instruction for an input operation of transaction information including PIN, when a transaction is performed by use of said IC card. The IC card processing apparatus according to claim 4, characterized in that said operation instructing means (25) is a display device (25) for giving an instruction for an operation including input of the PIN, by use of one of an image and characters, when the transaction is performed. The IC card processing apparatus according to one of claims 1 to 5, characterized in that said arranging means (22) includes means (22) for converting the PIN information into PIN data represented according to a predetermined representation selected in accordance with the program version of the IC card.

Inventors: NIIMURA TAKASHI, NIIMURA, TAKASHI
Applicants: TOSHIBA KK, KABUSHIKI KAISHA TOSHIBA
Application year: 1998
Main classification: G07F7
IPC codes: G06F1, G06K17, G07F7