Data processing apparatus and associated method

[0001] The present invention relates to a data processing method, its apparatus, its program, a semiconductor circuit, and an authentication apparatus useful in the case of conducting a transaction through a network using an IC (integrated circuit) built into a card or a mobile terminal apparatus.

[0002] At the present time, communication systems using IC cards etc. for transactions through the Internet and other networks are being developed.

[0003] In such a communication systems, a server receives from for example reader/writers of IC cards or PCs (personal computers) processing requests using the IC cards and performs user authentication, data encryption and decryption, and other processing.

[0004] In the above explained communication system, however, it is envisioned that processing requests for a large number of IC cards will be received simultaneously or in short time periods.

[0005] In this case, the server has to be able to efficiently handle such processing requests.

[0006] Further, a server sometimes executes a plurality of application programs for processing for procedures relating to a plurality of settlement businesses and performs processing using selected application programs in accordance with the processing requests. Such processing requests also have to be efficiently handled.

[0007] Further, in the above explained communication system, the application program executed by the server has to describe codes using key information for accessing IC cards and operational commands for operating the IC cards. Here, the key information and operational commands can be known only by the manager of the server if expecting security of transactions using the IC cards.

[0008] Therefore, in the past, the manager of the server produced and customized the application programs upon request from the above service providers.

[0009] With the manager of the server producing and customizing application programs in this way, however, there is the problem that the load on the manager becomes great.

[0010] Further, in the above explained server, for example, application programs of a plurality of credit card companies or other businesses run. Such application programs are produced by the individual businesses and downloaded to the server using personal computers etc.

[0011] As explained above, however, when the above explained server runs application programs of a plurality of businesses, it is necessary to ensure that the processing of each application program not be monitored or tampered with by another application program.

[0012] On the other hand, there is a demand for providing diverse services while transferring data between application programs.

[0013] Further, individual businesses download their application programs to the server, then debug them in accordance with need.

[0014] When individual businesses download application programs to the server or debug those application programs in this way, however, it is necessary to prevent programs in the server from being illicitly tampered with.

[0015] As a technique for realizing this, for example, there is the technique of authentication processing using key information when accessing the server. Usually, such key information is stored in the memory of a terminal apparatus (personal computer), however, so there is the possibility of illicit use and there is a problem in security.

[0016] Further, the LSI forming the above explained server has a built-in CPU. The CPU sometimes accesses a memory outside of the LSI chip.

[0017] In such a case, data flows over the bus provided between the LSI chip and external memory, so that data can be viewed by probing the bus.

[0018] When the above explained server performs e-commercial transactions, personal authentication, and other highly confidential processing, however, as explained above, there is a problem in security if the data is probed.

[0019] Further, the above explained server is sometimes comprised of a single computer.

[0020] In this case, a single computer runs a plurality of programs relating to a plurality of services provided by different businesses. When those services handle highly confidential data such as with settlements, there is the problem that there is a possibility of the highly confidential data owned by each business being illicitly acquired or tampered with by another business.

[0021] Further, there have been the following problems when using a conventional general computer as the above explained computer.

[0022] FIG. 133 shows the basic configuration of a general computer 601.

[0023] In the computer 601 shown in FIG. 133, a CPU 602 performs processing using the instructions and data of a program read from a memory 603.

[0024] The CPU 602 outputs an address for access in the memory 603 to an address bus 604.

[0025] Further, the CPU 602 reads from the memory 603 or writes in it according to a control signal S602.

[0026] The module A, module B, and module C stored in the memory 603 are processing units of a program having specific functions.

[0027] A debugger 605 checks the operation of the CPU 602 at the time of development of a program. It uses a HALT signal to temporarily halt the operation of the CPU 602, read internal information of the CPU 602, and inform that information to the program developer.

[0028] Here, in FIG. 133, it is assumed that the module A has a basic function used by the module B or the module C.

[0029] Here, assume that the routine of the basic function included in the module A is highly confidential. In such a case, since the module A is a basic function, it is necessary to provide an environment enabling the developer of the module B or module C to develop its program. As one means for this, there is the method of distributing a library.

[0030] This is expressed in an intermediate language between a higher language and machine language (normally called an “assembly language”), but analysis is relatively easy. There is a high possibility that the processing routine of a program desired to be kept confidential will end up becoming known.

[0031] Further, as another means, the basic module (in this example, the module A) is stored in the memory 603 in advance and, rather than using it as a library, the developer develops the software assuming that the basic module is present at a specific location.

[0032] Even with this means, however, there is the problem that it is not that hard for the developers of the modules B and C to read the module A stored in the memory 603. At this time, the read content is in a machine language of a level which the CPU 602 executes, but there are tools for converting this machine language to an assembly language. The routine can be analyzed relatively easily.

[0033] Further, there is the problem that the developers of the modules B and C can temporarily halt the execution by the CPU 602 in the middle of execution of the module A at the development stage of their programs so as to learn the data handled or the content of the same and thereby learn the entire processing routine of the program of the module A.

[0034] Further, an application program running on the above explained server handles key data, charging data, log data, and other high security data set by the service provider, so there has been a demand for protecting it from illicit tampering or monitoring.

[0035] A first object of the present invention is to provide a data processing method, semiconductor circuit, and program able to efficiently perform processing in accordance with a large number of processing requests.

[0036] A second object of the present invention is to provide a data processing method, semiconductor circuit, and program enabling a user to produce and customize an application program of the user to be executed by a server without allowing the user to learn highly confidential information.

[0037] A third object of the present invention is to provide a data processing method, semiconductor circuit, and program able to prevent each individual application program from being influenced by another application program when the same semiconductor circuit runs a plurality of application programs.

[0038] A fourth object of the present invention is to provide a data processing method, semiconductor circuit, and program allowing transfer of data between application programs in accordance with need while preventing each application program from being illicitly tampered with, monitored, etc. by the user of another application program when the same semiconductor circuit runs a plurality of application programs.

[0039] A fifth object of the present invention is to provide a data processing method, semiconductor circuit, authentication apparatus, and program enabling the content of access to a server or other semiconductor circuit to be restricted in accordance with rights to the same.

[0040] A sixth object of the present invention is to provide a semiconductor circuit and data processing method enabling the confidentiality of data to be maintained even when transmitting highly confidential data between the semiconductor circuit and a semiconductor storage circuit through an external bus.

[0041] A seventh object of the present invention is to provide a data processing apparatus enabling the confidentiality of instructions and data to be maintained between programs when executing a plurality of programs.

[0042] An eighth object of the present invention is to provide a semiconductor circuit enabling the confidentiality of a program to be executed to be improved.

[0043] A ninth object of the present invention is to provide a data processing apparatus, its method, and its program enabling the security of an application program running on the server to be improved when providing a service using an IC or other integrated circuit.

[0044] To achieve the above explained objects, the data processing method of the first aspect of the invention is a data processing method performed by a semiconductor circuit in accordance with a plurality of processing requests, comprising the steps of: generating job management data including job execution order data showing an order of execution of a plurality of jobs forming processing in accordance with a processing request and status data showing the state of progress of execution of the plurality of jobs for each of the plurality of processing requests, selecting one job management data from the generated plurality of job management data based on a predetermined rule, selecting a job to be executed next based on the status data and the processing order data of the selected job management data, executing the selected job, and updating the status data of the selected job management data in accordance with the execution of that job.

[0045] In the data processing method of the first aspect of the invention, first, the semiconductor circuit generates job management data including job execution order data showing an order of execution of a plurality of jobs forming processing in accordance with a processing request and status data showing the state of progress of execution of the plurality of jobs for each of the plurality of processing requests.

[0046] Next, the semiconductor circuit selects one job management data from the generated plurality of job management data based on a predetermined rule.

[0047] Next, the semiconductor circuit selects the job to be executed next based on the status data and the processing order data of the selected job management data.

[0048] Next, the semiconductor circuit executes the selected job.

[0049] Next, the semiconductor circuit updates the status data of the selected job management data in accordance with execution of that job.

[0050] Further, the data processing method of the first aspect of the invention preferably further comprises a step of updating the status data of the selected job management data, then selecting one job management data from the plurality of data modules.

[0051] Further, the data processing method of the first aspect of the invention preferably further comprises a step of selecting one job management data from the plurality of data modules after updating the status data of the selected job management data.

[0052] Further, the data processing method of the first aspect of the invention preferably further comprises a step of deleting the job management data when all jobs forming the processing in accordance with the processing request finish being executed.

[0053] Further, the data processing method of the first aspect of the invention preferably further comprises a step of receiving the processing requests from an integrated circuit having a storage unit storing data to be used for processing for a procedure performed with the semiconductor circuit or a communication apparatus inputting and outputting data with the integrated circuit.

[0054] A semiconductor circuit of a second aspect of the invention is a semiconductor circuit for processing data in accordance with a plurality of processing requests, comprising an interface for inputting the plurality of processing requests, a storage circuit for storing job management data including job execution order data showing an order of execution of a plurality of jobs forming processing in accordance with a processing request and status data showing a state of progress of execution of the plurality of jobs, and a control circuit for generating the job management data for each of the input plurality of processing requests and storing it in the storage circuit, selecting one job management data from the generated plurality of job management data, selecting and executing the job to be executed next based on the status data and the processing order data of the selected job management data, and updating the status data of the selected job management data in accordance with the execution of that job.

[0055] In the semiconductor circuit of the second aspect of the invention, the interface inputs a plurality of processing requests.

[0056] Next, the control circuit generates job management data including job execution order data showing an order of execution of a plurality of jobs forming processing in accordance with a processing request and status data showing a state of progress of execution of the plurality of jobs in accordance with the plurality of processing requests and stores them in the storage circuit.

[0057] Next, the control circuit selects one job management data from the plurality of job management data.

[0058] Next, the control circuit selects and executes the job to be executed next based on the status data and the processing order data of the selected job management data and updates the status data of the selected job management data in accordance with execution of that job.

[0059] A program of a third aspect of the invention is a program to be executed by a semiconductor circuit for processing data in accordance with a plurality of processing requests, comprising a routine for generating job management data including job execution order data showing an order of execution of a plurality of jobs forming processing in accordance with a processing request and status data showing the state of progress of execution of the plurality of jobs for each of the plurality of processing requests, a routine for selecting one job management data from the generated plurality of job management data, a routine for selecting the job to be executed next based on the status data and the processing order data of the selected job management data, a routine for executing the selected job, and a routine for updating the status data of the selected job management data in accordance with the execution of the job.

[0060] A data processing method of a fourth aspect of the invention is a data processing method performed by a semiconductor circuit running an application program for processing relating to a procedure using an integrated circuit, wherein the semiconductor circuit can view correspondence instructing data indicating correspondence between operation codes used for the application program to operate the integrated circuit and the names of the operations, that is, the operation names, having the semiconductor circuit receive as input an operation describing program describing the operations of the application program using the operation names, and having the semiconductor circuit obtain the operation codes corresponding to the operation names described in the operation describing program by viewing the correspondence instructing data and use the obtained operation codes to define the processing of the application program.

[0061] Further, the data processing method according to the fourth aspect of the invention preferably further comprises having the correspondence instructing data further show the correspondence between the operation names and key information used when the integrated circuit performs operations corresponding to those operation names and having the semiconductor circuit obtain the key information corresponding to the operation names described in the operation describing program by viewing the correspondence instructing data and use that obtained key information to define the processing of the application program.

[0062] Further, the data processing method of the fourth aspect of the invention preferably further comprises having the semiconductor circuit generate job management data including job execution order data showing an order of execution of a plurality of jobs forming processing of the application program and status data showing the state of progress of execution of the plurality of jobs, select the job to be executed next based on the status data and the processing order data of the job management data, execute the selected job, and update the status data of the selected job management data in accordance with the execution of that job.

[0063] A semiconductor circuit of a fifth aspect of the invention is a semiconductor circuit for running an application program for performing processing relating to a procedure using an integrated circuit, comprising a storage circuit for storing correspondence instructing data indicating correspondence between operation codes used for the application program to operate the integrated circuit and names of the operations, that is, operation names, an interface for inputting an operation describing program describing the operation of the application program using the operation names, and a control circuit for obtaining the operation codes corresponding to the operation names described in the input operation describing program by viewing the correspondence instructing data and using the obtained operation codes to define the processing of the application program.

[0064] In the semiconductor circuit of the fifth aspect of the invention, the interface inputs the operation describing program describing the operation of the application program using the operation names.

[0065] Next, the control circuit obtains the operation codes corresponding to the operation names described in the input operation describing program by viewing the correspondence instructing data.

[0066] Next, the control circuit uses the obtained operation codes to define the processing of the application program.

[0067] A program of a sixth aspect of the invention is a program to be executed by a semiconductor circuit running an application program for performing processing relating to a procedure using an integrated circuit, comprising: a routine for inputting an operation describing program describing an operation of the application program using names of operations for the integrated circuit, that is, operation names, a routine for viewing correspondence instructing data indicating correspondence between operation codes used by the application program for operating the integrated circuit and the operation names to obtain the operation codes corresponding to the operation names described in the operation describing program, and a routine for using the obtained operation codes to define processing of the application program.

[0068] A data processing method of a seventh aspect of the invention is a data processing method performed by a semiconductor circuit executing an application program, comprising the steps of: protecting each of a plurality of program modules forming the application program by a firewall allocated to the program module in advance in a plurality of firewalls, registering a program module linked with firewall identification information for identifying the firewall allocated to the program module, and executing the program module conditional on the registration being performed.

[0069] The data processing method of the seventh aspect of the invention preferably further comprises a step of allowing data transfer or data viewing among a plurality of program modules registered linked with the same firewall identification information and prohibiting data transfer or data viewing among a plurality of program modules registered linked with different firewall identification information.

[0070] The data processing method of the seventh aspect of the invention preferably further comprises the steps of: registering a program module further linked with download key information to be used when downloading the program module from the outside of the semiconductor circuit to the semiconductor circuit and, when receiving a download request for the program module, using the download key information registered linked with the program module to judge if download is possible and downloading the program module when judging that download is possible.

[0071] A semiconductor circuit of an eighth aspect of the invention is a semiconductor circuit for running an application program, protecting each of a plurality of program modules forming the application program by a firewall allocated to each program module in advance in a plurality of firewalls, registering a program module linked with firewall identification information for identifying the firewall allocated to the program module, and executing the program module conditional on the registration being performed.

[0072] A program of a ninth aspect of the invention is a program to be executed by a semiconductor circuit for executing an application program, comprising a routine for protecting each of a plurality of program modules forming the application program by a firewall allocated to each program module in advance in a plurality of firewalls, a routine for registering a program module linked with firewall identification information for identifying the firewall allocated to the program module, and a routine for executing the program module conditional on the registration being performed.

[0073] A data processing method of a 10th aspect of the invention is a data processing method performed by a semiconductor circuit for executing an application program, comprising the steps of: independently executing a plurality of application programs protected by firewalls, registering in advance a condition for allowing communication between the application programs performed through the firewalls, judging if a communication request satisfies the registered condition when an application program generates a request for communication with another application program, and executing communication between the application programs in accordance with the communication request when judging that it satisfies the registered condition.

[0074] A semiconductor circuit of an 11th aspect of the invention is a semiconductor circuit which independently executes a plurality of application programs protected by firewalls, registers in advance a condition for allowing communication between the application programs performed through the firewalls, judges if a communication request satisfies the registered condition when an application program generates a request for communication with another application program, and executes communication between the application programs in accordance with the communication request when judging that it satisfies the registered condition.

[0075] The semiconductor circuit of the 11th aspect independently executes a plurality of application programs protected by firewalls.

[0076] Further, that semiconductor circuit registers in advance a condition for allowing communication between the application programs performed through the firewalls.

[0077] Further, that semiconductor circuit judges if a communication request satisfies the registered condition when an application program generates a request for communication with another application program.

[0078] Further, that semiconductor circuit executes communication between the application programs in accordance with the communication request when judging that it satisfies the registered condition.

[0079] A program of the 12th aspect of the invention is a program for making a semiconductor circuit execute a routine for independently executing a plurality of application programs protected by firewalls, a routine for registering in advance a condition for allowing communication between the application programs performed through the firewalls, a routine for judging if a communication request satisfies the registered condition when an application program generates a request for communication with another application program, and a routine for executing communication between the application programs in accordance with the communication request when judging that it satisfies the registered condition.

[0080] A data processing method of a 13th aspect of the invention is a data processing method by which a semiconductor circuit or a semiconductor storage apparatus accessible by the semiconductor circuit downloads a program running in the semiconductor circuit, comprising the steps of: having the semiconductor circuit have a software structure comprised of a plurality of layers and having download signature verification key information corresponding to each layer able to be viewed by the semiconductor circuit, having the semiconductor circuit verify download signature information generated in accordance with a download request using the download signature verification key information when receiving the download request, and having the semiconductor apparatus allow the issuer of the download request to download a program of a layer corresponding to the download signature verification key information used for that verification conditional on the download signature information being legitimate.

[0081] Further, the data processing method of the 13th aspect of the invention further comprises a steps of: having an authentication apparatus store access master key information corresponding to a layer to which a program allowed to be downloaded belongs, having the authentication apparatus transmit the download request to the semiconductor circuit, and having the authentication apparatus use that access master key information to generate the download signature information and transmit that download signature information to the semiconductor circuit.

[0082] Further, the data processing method of the 13th aspect of the invention further comprises a steps of: having an authentication apparatus store identification information of the semiconductor circuit and having the authentication apparatus encrypt use the identification information as plain text using the access master key information to generate download master key information and use that download master key information to generate the download signature information.

[0083] A semiconductor circuit of a 14th aspect of the invention is a semiconductor circuit having a software structure comprised of a plurality of layers, wherein the semiconductor circuit is able to view download signature verification key information corresponding to each layer, verifies download signature information generated in accordance with a download request using the download signature verification key information when receiving a download request, and allows the issuer of the download request to download a program of a layer corresponding to the download signature verification key information used for that verification to that semiconductor circuit or a semiconductor storage circuit accessible by the semiconductor circuit conditional on the download signature information being legitimate.

[0084] The semiconductor circuit of the 14th aspect of the invention, when receiving a download request, verifies the download signal information generated corresponding to that download request using download signature verification key information.

[0085] Further, that semiconductor circuit allows the issuer of the download request to download a program of a layer corresponding the download signature verification key information used for that verification to that semiconductor circuit or a semiconductor storage circuit accessible by the semiconductor circuit conditional on the download signature information being legitimate.

[0086] An authentication apparatus of a 15th aspect of the invention is an authentication apparatus used for authentication when downloading a program running in a semiconductor circuit to a semiconductor circuit having a software structure comprised of a plurality of layers or a semiconductor storage apparatus accessible by that semiconductor circuit, storing access master key information corresponding to a layer to which a program allowed to be downloaded belongs, transmitting the download request to the semiconductor circuit, and using that access master key information to generate the download signature information and transmitting that download signature information to the semiconductor circuit.

[0087] The authentication apparatus of the 15th aspect of the invention first transmits the download request to the semiconductor circuit.

[0088] Further, the authentication apparatus uses access master key information to generate download signature information.

[0089] Further, the authentication apparatus transmits the download signature information to the semiconductor circuit.

[0090] A program of a 16th aspect of the invention is a program to be executed by a semiconductor circuit having a software structure comprised of a plurality of layers, comprising a routine for verifying download signature information generated in accordance with a download request when receiving such a download request using the download signature verification key information of a corresponding layer in the plurality of layers, and a routine for allowing the issuer of the download request to download a program of a layer corresponding to the download signature verification key information used for that verification to that semiconductor circuit or a semiconductor storage circuit accessible by the semiconductor circuit conditional on the download signature information being legitimate.

[0091] A semiconductor circuit of a 17th aspect of the invention is a semiconductor circuit having a data processing circuit and data input/output processing circuit, wherein the data processing circuit inputs and outputs data with a bus outside of that semiconductor circuit through the data input/output processing circuit, and the data input/output circuit encrypts data input from the data processing circuit in units of predetermined data lengths and outputs the same to the bus, decrypts data input from the bus and outputs the same to the data processing circuit, and performs data input/output transactions through the bus in units of m number of data input/output transactions when Nc/Nb=n where the bus width of the bus is Nb and the data length is Nc and the smallest whole number of n or more is m.

[0092] The semiconductor circuit of the 17th aspect of the invention inputs and outputs data with a bus outside of the semiconductor circuit through the data input/output processing circuit.

[0093] At this time, the data input/output circuit encrypts the data input from the data processing circuit in units of predetermined data lengths and outputs the same to the bus.

[0094] Further, the data input/output circuit decrypts data input from the bus and outputs it to the data processing circuit.

[0095] At this time, that data input/output apparatus performs data input/output transactions through the outside bus in units of m number of data input/output transactions when Nc/Nb=n where the bus width of the bus is Nb and the data length is Nc and the smallest whole number of n or more is m.

[0096] Further, in the semiconductor circuit of the 17th aspect of the invention, preferably the data input/output circuit, when accessing a semiconductor storage circuit based on a first address input from the data processing circuit, converts the first address to a second address so as to access the semiconductor storage circuit in units of storage areas in which the data of Nc is stored and uses that second address to access the semiconductor storage circuit.

[0097] A data processing method of an 18th aspect of the invention is a data processing method performed by a semiconductor circuit when accessing a semiconductor storage circuit when a semiconductor circuit and the semiconductor storage circuit are connected through a bus, comprising the steps of: encrypting data to be written in the semiconductor storage circuit in units of predetermined data lengths and outputting the same to the bus, decrypting data input from the bus, and performing data input/output transactions through the bus in units of m number of data input/output transactions when Nc/Nb=n where the bus width of the bus is Nb and the data length is Nc and the smallest whole number of n or more is m.

[0098] A data processing apparatus of a 19th aspect of the invention comprises a storage circuit for storing instructions and data of a plurality of programs, a computation circuit for accessing the storage circuit through a transmission line and using the instructions and data of the plurality of programs to execute the plurality of programs, a connection switching circuit interposed between the transmission line and the storage circuit for setting the transmission line and the storage circuit to one of a connection state and disconnection state based on a control signal, a connection control circuit for generating the control signal for control to set the transmission line and the storage circuit to one of a connection state and disconnection state based on access range defining data defining an address range in the storage circuit able to be accessed while the computation circuit is executing the plurality of programs for each of the plurality of programs, an address in the storage circuit for which the computation circuit issues an access request, and executing program instructing information which which program in a plurality of programs the computation circuit is executing, and an input/output interface circuit for inputting and outputting data with the computation circuit through the transmission line and inputting and outputting data with the outside of that data processing apparatus.

[0099] Further, in the data processing apparatus of the 19th aspect of the invention, preferably the connection control circuit generates the control signal indicating to set the transmission line and the storage circuit in a connection state when the address in the storage circuit for which the computation circuit issues an access request is inside the address range corresponding to a program being executed defined by the access range defining data and generates the control signal indicating to set the transmission line and the storage circuit in a disconnection state when it is not inside that address range.

[0100] Further, a semiconductor circuit of a 20th aspect of the invention is a semiconductor circuit for executing a program, comprising a first transmission line, a storage circuit for storing instructions or data for executing the program, a computation circuit for operating based on the instructions read through the first transmission line from the storage circuit, a first connection switching circuit for setting the first transmission line and the storage circuit in one of a connection state and disconnection state based on a first control signal, a second connection switching circuit for setting a second transmission line outside of that semiconductor circuit and the first transmission line in one of a connection state and disconnection state based on a second control signal, and a connection control circuit for outputting the second control signal instructing disconnection to the second connection switching circuit when outputting the first control signal instructing connection to the first connection switching circuit and outputting the second control signal instructing connection to the second connection switching circuit when outputting the first control signal instructing disconnection to the first connection switching circuit.

[0101] Further, in the semiconductor circuit of the 20th aspect of the invention, the second connection switching circuit is connected through the second transmission line to a storage apparatus at the outside of the semiconductor circuit.

[0102] Further, in the semiconductor circuit of the 20th aspect of the invention, when the computation circuit reads instructions from the storage circuit, the connection control circuit outputs the first control signal instructing connection to the first connection switching circuit and outputs the second control signal instructing disconnection to the second connection switching circuit.

[0103] A semiconductor circuit of a 21st aspect of the invention is a semiconductor circuit for executing a program, comprising an encryption/decryption circuit for storing encrypted instructions or data of the program, encrypting data to be output through a first transmission line outside of that semiconductor circuit to a storage apparatus, and decrypting encrypted instructions or data input through the first transmission line from the storage apparatus, a computation circuit for performing computation using the decrypted instructions or data, a selection circuit for selecting whether to allow communication between a second transmission line outside of the semiconductor circuit and the computation circuit based on a control signal, and a control circuit for outputting to the selection circuit the control signal for instructing to disallow communication between the second transmission line and the computation circuit while the computation circuit is performing processing using instructions or data of the program.

[0104] A data processing apparatus of a 22nd aspect of the invention is a data processing apparatus comprising a storage circuit for storing in predetermined storage areas a plurality of application programs each comprised of a plurality of data modules including processing routine data describing processing routines for communicating with an integrated circuit to provide a service and storing management data showing linked together a data module, first key data used for using another data module in processing according to that data module, and second key data used for transferring data with the integrated circuit in processing according to that data module and a semiconductor circuit performing processing relating to a service based on a data modules, viewing the management data in that processing, using the first key data corresponding to that data module to use another data module, and using the second key data corresponding to that data module to transfer data with the integrated circuit.

[0105] Further, in the data processing apparatus of the 22nd aspect of the invention, preferably the storage circuit stores as a data module at least one of log data of processing performed performed using the data module, program data showing a routine for registering the data module in a storage area, program data showing a routine for deleting registration of the data module from the storage area, and program data showing a routine for defining the storage area for storing the application program.

[0106] Further, in the data processing apparatus of the 22nd aspect of the invention, preferably when processing in accordance with another data module is to be executed by a semiconductor circuit, the semiconductor circuit uses the management data to obtain first key data corresponding to the predetermined data module and the first key data corresponding to the other data module and uses the other data module from the predetermined data module being executed conditional on the obtained two first key data matching.

[0107] A data processing method of a 23rd aspect of the invention is a data processing method whereby a semiconductor circuit for communicating with an integrated circuit to perform processing to provide a service transfers data with a storage circuit, comprising the steps of: when the storage circuit stores in predetermined storage areas a plurality of application programs each comprised of a plurality of data modules including processing routine data describing processing routines for communicating with an integrated circuit to providing a service and stores management data showing linked together a data module, first key data used for using another data module in processing in accordance with that data module, and second key data used for transferring data with the integrated circuit in processing according to that data module, having the semiconductor circuit perform processing relating to a service based on the data modules, having the semiconductor circuit view the management data in the processing relating to the service and use the first key data corresponding to a data module to use another data module, and having the semiconductor circuit use the second key data corresponding to the data module in processing relating to the service to transfer data with the integrated circuit.

[0108] A program of a 24th aspect of the invention is a program to be executed by a semiconductor circuit for communicating with an integrated circuit to perform processing for providing services and transferring data with a storage circuit, comprising, when the storage circuit stores in predetermined storage areas a plurality of application programs each comprised of a plurality of data modules including processing routine data describing processing routines for communicating with an integrated circuit to provide services and stores management data showing linked together a data module, first key data used for using another the data module in processing according to that data module, and second key data used for transfer of data with the integrated circuit in processing according to that data module, a routine for performing processing relating to the service based on the data module, a routine for viewing the management data in processing relating to the service and using the first key data corresponding to that data module to use the other data module, and a routine for using the second key data corresponding to that data module in processing relating to the service to transfer data with the integrated circuit.

[0109] According to the above explained present invention, the following effects can be achieved.

[0110] That is, according to the first to third aspects of the invention, it is possible to provide a data processing method, semiconductor circuit, and program able to efficiently perform processing in accordance with a large number of processing requests.

[0111] According to the fourth to sixth aspects of the invention, it is possible to provide a data processing method, semiconductor circuit, and program enabling a user to produce and customize an application program of the user to be executed by the server without informing the user of highly confidential information.

[0112] According to the seventh to ninth aspects of the invention, it is possible to provide a data processing method, semiconductor circuit, and program able to prevent each application program from being influenced by another application program when running a plurality of application programs on the same semiconductor circuit.

[0113] According to the 10th to 12th aspects of the invention, it is possible to provide a data processing method, semiconductor circuit, and program made in consideration of the above explained prior art and allowing the transfer of data among application programs in accordance with need while preventing each application program from being illicitly tampered with, monitored, etc. by a user of another application program when running a plurality of application programs on the same semiconductor circuit.

[0114] According to the 13th to 16th aspects of the invention, it is possible to provide a data processing method, semiconductor circuit, authentication apparatus, and program able to restrict the content of access to a semiconductor circuit of a server etc. in accordance with its right.

[0115] According to the 17th and 18th aspects of the invention, it is possible to provide a semiconductor circuit and data processing method able to maintain the confidentiality of data even when transmitting highly confidential data between the semiconductor circuit and semiconductor storage circuit through an external bus.

[0116] According to a 19th aspect of the invention, it is possible to provide a data processing apparatus able to maintain the confidentiality of instructions and data between programs when executing a plurality of programs.

[0117] According to the 20th and 21st aspects of the invention, it is possible to provide a semiconductor circuit able to improve the confidentiality of the program executed.

[0118] According to the 22nd to 24th aspects of the invention, it is possible to provide a data processing apparatus, method, and program able to improve the security of an application program running on a server when providing a service using an IC or other integrated circuit.

[0252] Next, embodiments of the present invention will be explained with reference to the attached drawings.

[0253] First Embodiment

[0254] The present embodiment is an embodiment corresponding to the first to sixth aspects of the invention.

[0255] FIG. 1 is a view of the overall configuration of a communication system 1 of the present embodiment.

[0256] As shown in FIG. 1, the communication system 1 uses a server 2, IC card 3, card reader/writer 4, personal computer 5, ASP (application service provider) server 6, and SAM (secure application module) unit 9 to communicate through the Internet 10 and perform settlement processing or processing for other procedures using the IC card 3 (integrated circuit of the present invention).

[0257] The SAM unit 9 has an external memory 7 and a SAM chip (semiconductor circuit of the present invention) 8.

[0258] The SAM chip 8 has the software configuration as shown in FIG. 2.

[0259] As shown in FIG. 2, the SAM chip 8 has, from a bottom layer toward a top layer, an HW (hardware) layer, OS layer, lower handler layer, higher handler layer, and AP layer.

[0260] The lower handler layer includes a driver layer.

[0261] Here, the AP layer includes application programs AP_1, AP_2, and AP_3 defining procedures for use of the IC card 3 by credit card companies or other businesses 15_1, 15_2, and 15_3 shown in FIG. 1.

[0262] In the AP layer, the application programs AP_1, AP_2, and AP_3 and the higher handler layer are provided between them with firewalls FW.

[0263] The application program AP_1 is defined by a later explained service definition table data (correspondence instructing data) 20_1 and script program (operation describing program) 21_1 stored in an external memory 7.

[0264] The application program AP_2 is defined by a later explained service definition table data (correspondence instructing data) 20_2 and script program (operation describing program) 21_2 stored in the external memory 7.

[0265] The application program AP_3 is defined by a later explained service definition table data (correspondence instructing data) 20_3 and script program (operation describing program) 21_3 stored in the external memory 7.

[0266] The SAM chip 8 is connected through a SCSI port, the Ethernet, etc. to the ASP server 6. The ASP server 6 is connected through the Internet 10 to a plurality of terminal apparatuses including a personal computer 5 of the end user and personal computers 16_1, 16_2, and 16_3 of the businesses 15_1, 15_2, and 15_3.

[0267] The personal computer 5, for example, is connected through a serial port or USB port to a Dumb type card reader/writer 4. The card reader/writer 4 realizes for example wireless communication corresponding to the physical level with the IC card 3.

[0268] Operational commands to the IC card 3 and response packets from the IC card 3 are generated and analyzed at the SAM unit 9 side. Therefore, the card reader/writer 4, personal computer 5, and ASP server 6 interposed between them only act to store the commands or response content in data payload portions and relay the same. They are not involved in encryption or decryption of data, authentication, and other actual operations in the IC card 3.

[0269] The personal computers 16_1, 16_2, and 16_3 can download the later explained script program to the SAM chip 8 to customize their application programs AP_1, AP_2, and AP_3.

[0270] Next, the components shown in FIG. 1 will be explained.

[0271] [IC Card 3]

[0272] FIG. 3 is a functional block diagram of an IC card 3.

[0273] As shown in FIG. 3, the IC card 3 has an IC (integrated circuit) 3a provided with a storage unit 50 and processing unit 51.

[0274] The storage unit 50, as shown in FIG. 4, has a storage area 55_1 used by a credit card company or other business 15_1, a storage area 55_2 used by a business 15_2, and a storage area 55_3 used by a business 15_3.

[0275] Further, the storage unit 50 stores key information used for judging the access right to the storage area 55_1, key information used for judging the access right to the storage area 55_2, and key information used for judging the access right to the storage area storage area 55_3. That key information is used for mutual authentication, encryption and decryption of data, etc.

[0276] Further, the storage unit 50 stores identification information of the IC card 3 or the user of the IC card 3.

[0277] Next, the SAM unit 9 will be explained in detail.

[0278] [External Memory 7]

[0279] FIG. 5 is a view for explaining the data and programs stored in the external memory 7 shown in FIG. 1.

[0280] As shown in FIG. 5, the external memory 7 stores service definition table data 20_1 and IC card operation macro command script program 21_1 of the business 15_1.

[0281] Further, the external memory 7 stores service definition table data 20_2 and IC card operation macro command script program 21_2 of the business 15_2.

[0282] Further, the external memory 7 stores service definition table data 20_3 and IC card operation macro command script program 21_3 of the business 15_3.

[0283] The service definition table data 20_1, 20_2, and 20_3 have the same format.

[0284] Further, the IC card operation macro command script programs 21_1, 21_2, and 21_3 are written using common macro commands.

[0285] Further, the service definition table data 20_1, 20_2, and 20_3 and IC card operation macro command script programs 21_1, 21_2, and 21_3 are scrambled to be stored in the external memory 7. The scrambled data and programs are descrambled at the SAM chip 8.

[0286] In the present embodiment, the script programs 21_1, 21_2, and 21_3 are produced using the personal computers 16_1, 16_2, and 16_3 shown in FIG. 1 by the businesses 15_1, 15_2, and 15_3 and are downloaded through the SAM chip 8 to the external memory 7.

[0287] Further, the service definition table data 20_1, 20_2, and 20_3 are produced by the manager of the SAM unit 9 upon instruction from the businesses 15_1, 15_2, and 15_3.

[0288] FIG. 6 is a view for explaining the service definition table data 20_1.

[0289] As shown in FIG. 6, the service definition table data 20_1 has entries of service type elements (operation names), addresses, service numbers (operation codes), key version information, and key information.

[0290] The “service type element” shows the name assigned to the service provided by the application program of the business 15_1. The service type element is an identifier viewed instead of the service number of the service which the application program of the business 15_1 can use.

[0291] In the present embodiment, as shown in FIG. 6, “Rc”, “Rd”, “Wd”, and “Wc” are used as the service type elements of the service definition table data 20_1 corresponding to the business 15_1.

[0292] In the present embodiment, the IC card operation macro command script program 21_1 define service content combining a plurality of service type elements and reflects this into the later explained IC card entity data (job management data) so as to be able to provide a service combining services corresponding to a plurality of service type elements.

[0293] For example, a service combining a service for reading data from the IC card 3 and a service for writing data in the server 2 can be defined in the IC card entity data.

[0294] The service number in the service definition table data 20_1 is an operational command issued to the IC card 3 and analyzable by the IC card 3 when performing a service provided by the business 15_1.

[0295] The “address” in the service definition table data 20_1 indicates the address at which data relating to a procedure relating to the corresponding service type element is stored.

[0296] The “key version information” in the service definition table data 20_1 shows the version of the key information used when providing that service.

[0297] The “key information” in the service definition table data 20_1 is the key information used when providing that service.

[0298] For example, key information used when accessing the storage area 55_1 of the IC 3a of the IC card 3 shown in FIG. 3 by the service definition table data 20_1 is set.

[0299] Further, in the service definition table data 20_2, key information used when accessing the storage area 55_2 of the IC 3a is set.

[0300] Further, in the service definition table data 20_3, key information used when accessing the storage area 55_3 of the IC 3a is set.

[0301] Next, the IC card operation macro command script program 21_1 will be explained.

[0302] The script program 21_1 is a program for defining the application program of the business 15_1 running on the SAM chip 8 and the procedure of processing performed by the IC card 3 when executing that application program.

[0303] In the present embodiment, as explained later, as shown in FIG. 7, the SAM chip 8 uses the service definition table data 20_1 and script program 21_1 to generate IC card entity template data 30_1, an input data block 31_x1, output data block 32_x2, log data block 33_x3, and computation defining data block 34_x4 used for the procedure relating to the business 15_1.

[0304] FIG. 8 is a view for explaining the commands used for describing the IC card operation macro command script programs 21_1, 21_2, and 21_3.

[0305] In the commands, commands for the SAM chip 8 itself are given the first letter “S”, while commands relating to operation of the IC card 3 are given the first letter “C”.

[0306] Further, the second letter is selectively used in accordance with the application. For example, for an issuer setting declaration of the IC card 3, it is “I”, for a service type element declaration, it is “S”, for a simple read declaration from the IC card 3, it is “R”, for a simple write declaration to the IC card 3, it is “W”, and for a service type element computation definition, it is “F”.

[0307] The commands used for describing the script programs 21_1, 21_2, and 21_3 include an SC command, SO command, SI command, SL command, SF command, CI command, CS command, CR command, and CW command.

[0308] The SC command is a command declaring the number of the maximum number of IC card entity data which the SAM chip 8 can process simultaneously.

[0309] For example, when the SAM chip 8 can simultaneously process 1000 IC card entity data, “SC:1000” is described.

[0310] The SO command is a command for declaring the data block for forming the output data block 32_x2 in which the data read from the IC card 3 is stored among the data blocks provided in the SAM chip 8 when performing processing using the IC card 3 based on the later explained IC card entity data.

[0311] For example, when the data blocks 1 to 10 are provided, when storing the data read from the IC card 3 in the data block 1, “SO:1” is described.

[0312] The SI command is a command for declaring the data block for forming the input data block 31_x1 in which the data to be written in the IC card 3 is stored among the data blocks provided in the SAM chip 8 when performing processing using the IC card 3 based on the later explained IC card entity data.

[0313] For example, when the data blocks 1 to 10 are provided, when storing the data to be written in the IC card 3 in the data blocks 2, 3, “SI:2,3” is described.

[0314] The SL command is a command for declaring the data block forming the log data block 33_x3 for storing the log data relating to an operation among the data blocks provided in the SAM chip 8 when performing processing using the IC card 3 based on the later explained IC card entity data.

[0315] For example, when the data blocks 1 to 10 are provided, when storing the log data in the data block 4, “SL:4” is described.

[0316] The SF command is a command for providing the data block forming the computation defining data block 34_x4 describing the definition of the relation between the service type elements relating to the IC card 3.

[0317] The content of the computation defining data block 34_x4 becomes the pre-processing information of the IC card entity data.

[0318] The CI command is a command for declaring the issuer of the IC card 3 (business).

[0319] The information specifying the business defined by the CI command becomes the IC card type information of the IC card entity data.

[0320] The CS command is a command for declaring simultaneous operation of a plurality of services to the IC card 3 by citing service type elements. The CS command can also declare a function defining processing among service type elements.

[0321] For example, it is possible to declare
“CS:“Rc”+“Wc”+“Wd””.

[0322] Based on the content of the CS command, service type element designating information of the IC card entity data and processing order information are determined.

[0323] The CR command declares to store data read from the IC card 3 in a designated data block when the relation among service type elements is not defined (when SF command is not described).

[0324] For example, when storing the data read from the IC card 3 in the data block 1, “CR:SO:1=“Rc”” is described.

[0325] The CW command declares to write data stored in a designated data block to the IC card 3 when the relation among service type elements is not defined.

[0326] For example, when writing data stored in the data block 2 in the IC card 3, “CW:SI:2=“Wc”” is described.

[0327] The CF command declares the data block describing computation content spanning services.

[0328] For example, when describing computation content spanning services in the SF data block 1, “CF:CES_FUNC=SF:1” is described.

[0329] Further, the SF data block 1 has described in it, for example, ““Wc”=If (“Wc”>10) then (“Wc”−10; “Wd”=“Wc”*0.08+“Wd”)”. This formula expresses the operation of subtracting 10 from the value of Wc when the remaining number of services Wc is larger than 10 and adding a number of points corresponding to 8% of Wc as cumulative points to Wd.

[0330] [SAM Chip 8]

[0331] FIG. 9 is a functional block diagram of the SAM chip 8 shown in FIG. 1.

[0332] As shown in FIG. 9, the SAM chip 8 has an ASPS communication interface unit 60, external memory communication interface unit 61, bus scramble unit 62, random number generation unit 63, encryption/decryption unit 64, storage unit 65, and CPU 66.

[0333] The SAM chip 8 is a tamper-resistant module.

[0334] The ASPS communication interface unit 60 is an interface used for input and output of data with the ASP server 6 shown in FIG. 1.

[0335] The external memory communication interface unit 61 is an interface used for input and output of data with the external memory 7.

[0336] The bus scramble unit 62 scrambles output data and descrambles input data when inputting and outputting data through the external memory communication interface unit 61.

[0337] The random number generation unit 63 generates random numbers used at the time of authentication processing.

[0338] The encryption/decryption unit 64 encrypts data and decrypts encrypted data.

[0339] The storage unit 65, as explained later, stores tasks, programs, and data used by the CPU 66.

[0340] The CPU 66 executes a predetermined program (program of the present invention) to execute the later explained script download task, script interpretation task, entity generation task (job management data production task) and IC card procedure management task (job management data management task), and other tasks.

[0341] Next, the tasks, programs, and data stored in the storage unit 65 will be explained.

[0342] FIG. 10 is a view for explaining the tasks, programs, and data stored in the storage unit 65.

[0343] As shown in FIG. 10, it stores a script download task 69, script interpretation task 70, entity generation task 71, IC card procedure management task 72, IC card operation macro command script programs 21_1 to 21_3, service definition tables 20_1 to 20_3, IC card entity template data 30_1 to 30_3, IC card entity data 73_x, an input data block 31_x1, output data block 32_x2, log data block 33_x3, and computation defining data block 34_x4.

[0344] The script download task 69, as shown in FIG. 7, downloads the service definition table data 20_1 to 20_3 from, for example, the computers of businesses and loads them in the SAM chip 8.

[0345] The script interpretation task 70 uses the service definition table data and script program to generate the IC card entity plate data, an input data block, output data block, log data block, and computation defining data block for each business.

[0346] The number of data blocks generated for each business is not particularly limited.

[0347] When the entity generation task 71 receives from, for example, the ASP server 6 an entity production request, it conducts polling with the IC card 3, then generates the IC card entity data used for processing of a procedure between that IC card 3 and a business using the IC card entity plate data corresponding to that business. At this time, the IC card entity plate data becomes the class, and IC card entity data is generated as an instance of that class.

[0348] The processing for generation of the IC card entity data by the entity generation task 71 will be explained in detail later.

[0349] The IC card procedure management task 72 uses the one or more IC card entity data 73_x present in the storage unit 65 to execute processing for a procedure between the IC card 3 and businesses 15_1 to 15_3.

[0350] In the present embodiment, a plurality of processing for procedures performed between a plurality of IC cards 3 and the businesses 15_1 to 15_3 proceed simultaneously.

[0351] The IC card procedure management task 72 executes the plurality of processing for procedures in parallel.

[0352] The IC card procedure management task 72 deletes the IC card entity data 73_x when the series of procedures have been completed.

[0353] The processing of the IC card procedure management task 72 will be explained in detail later.

[0354] The script programs 21_1 to 21_3 are input by the script download task 69 from, for example, the external memory 7 to the storage unit 65.

[0355] The service definition table data 20_1 to 20_3 are input by the script download task 69 from, for example, the external memory 7 and stored in the storage unit 65.

[0356] The IC card entity template data 30_1 to 30_3 are generated by the script interpretation task 70 and used as templates (classes) when generating the IC card entity data 73_x of the procedures relating to the respective businesses.

[0357] The IC card entity data 73_x is generated by the entity generation task 71 using the IC card entity template data 30_1 to 30_3 as for example classes as an instance of the classes.

[0358] The input data block 31_x1, output data block 32_x2, log data block 33_x3, and computation defining data block 34_x4 are generated by the script interpretation task 70.

[0359] Next, the IC card entity data 73_x will be explained.

[0360] The IC card entity data 73_x is generated using IC card entity template data of a corresponding business already generated by entity generation task 71 in the SAM chip 8 when for example the SAM chip 8 receives a processing request for processing using the IC card 3 and the application program of a predetermined business from the ASP server 6.

[0361] FIG. 11 is a view for explaining the format of the IC card entity data 73_x.

[0362] As shown in FIG. 11, the IC card entity data 73_x has management pointer information 80, entity ID information 81, entity status information (status data) 82, IC card type information 83, service type element designating information 84, processing order information (processing order data) 85, pre-processing information 86, and post-processing information 87.

[0363] The management pointer information 80 is a bidirectional pointer for managing the IC card entity data 73_x in the storage unit 65.

[0364] The entity ID information 81 is used for a request for generation of IC card entity data 73_x, confirmation of the state of progress, deletion, or the rest of a series of processing using the IC card entity data 73_x. The entity ID information 81 also becomes a return value given to the end user. The entity ID information 81 corresponds to the descriptor when opening a file in a general file system.

[0365] The entity status information 82 shows the state of progress of a procedure relating to an IC card 3.

[0366] The basic states of the IC card entity data 73_x include, as shown in FIG. 12, the state of processing for investigating the services which the IC card 3 can use (RS), the state of processing by which the SAM chip 8 authenticates the IC card 3 (A1), the state of processing by which the IC card 3 authenticates the SAM chip 8 (A2), the state of processing for reading data from the IC card 3 (R), and the state of processing for writing data in the IC card 3 (W).

[0367] In the present embodiment, the processing for investigating the business, the processing for the SAM chip 8 to authenticate the IC card 3, the processing for the IC card 3 to authenticate the SAM chip 8, the processing for reading data from the IC card 3, and the processing for writing data in the IC card 3 correspond to jobs.

[0368] A “job”, as explained later, is a unit of processing for which an order of execution is determined by the IC card procedure management task 72.

[0369] Note that A1 and A2 form the mutual authentication processing between the IC card 3 and SAM chip 8.

[0370] Further, in the present embodiment, considering the communication time on the Internet 10, the above-mentioned basic states are, as shown in the state transition chart of FIG. 12, managed divided into post-startup (after issuance of command) states and completed (after receiving response) states.

[0371] Specifically, the state of processing using the IC card entity data 73_x is managed by the instance generation (IC card entity data generation) state, RS post-startup state, RS completed state, A1 post-startup state, A1 completed state, A2 post-startup state, A2 completed state, R post-startup state, R completed state, W post-startup state, W completed state, and instance (IC card entity data) deletion state.

[0372] The IC card type information 83 is information for specifying the business issuing that IC card 3.

[0373] The IC card type information 83 is set with information defined by the CI command in the above-mentioned script program at the time of generation of the IC card entity data 73_x.

[0374] The service type element designating information 84 shows the service type elements of the service defined in the service definition table data used in processing using the IC card entity data 73_x.

[0375] The service type element designating information 84 is set with one or more service type elements designated by the CS command in the above-mentioned script program at the time of generation of the IC card entity data 73_x.

[0376] The processing order information 85 shows the order of execution of services (jobs) used in the processing using the IC card entity data 73_x, that is, the state transition shown in FIG. 12.

[0377] That is, the processing order information 85 uses the service type elements to show the order of execution of jobs corresponding to the basic operations of the IC card 3.

[0378] Here, the jobs, as explained earlier, correspond to the RS, A1, A2, R, and W shown in FIG. 12. Specific operations on the IC card 3 are realized by the order of processing designated using the jobs. For example, for processing using an IC card 3 with only reading with no mutual authentication, the processing order information 85 is set with “RS->R”. Further, in the case of reading and writing with mutual authentication, the processing order information 85 is set with “RS->A1->A2->R->W”.

[0379] The processing order information 85 is set with the order of jobs shown in FIG. 12 corresponding to the order of service elements designated in the CS command in the above-mentioned script program when generating the IC card entity data 73_x.

[0380] The pre-processing information 86 is set from the ASP server 6 side with management data for performing processing using the IC card entity data 73_x.

[0381] For example, the pre-processing information 86 is set with points of a computation formula of a service designated in the SF data block.

[0382] Further, when an inter-service computation function is not defined, the pre-processing information 86 is set with the requested processing charge.

[0383] For example, in the case of settlement, the state relating to the amount of charge or number of points given etc. is set.

[0384] The post-processing information 87 is set with data of the processing result of the IC card entity data 73_x required at the ASP server 6 side. For example, in the case of settlement, it is set with data showing the existence of a normal end to the settlement.

[0385] Next, a routine for processing by the IC card procedure management task 72 shown in FIG. 10 relating to a plurality of IC cards 3 using a plurality of IC card entity data 73_x will be explained.

[0386] The IC card procedure management task 72 is for example constantly being started up on the CPU 66 of the SAM chip 8 shown in FIG. 9.

[0387] FIG. 13 is a flow chart of the processing performed by the IC card procedure management task 72.

[0388] Step ST1:

[0389] The IC card procedure management task 72 selects one IC card entity data 73_x for executing the next processing out of the plurality of IC card entity data 73_x present in the storage unit 65.

[0390] The method of selection of that IC card entity data 73_x may be to successively select IC card entity data 73_x present in the storage unit 65 or to assign a priority order and select by priority in the order of the highest priority.

[0391] Step ST2:

[0392] The IC card procedure management task 72 judges if the job of the IC card entity data 73_x selected at step ST1 has already been started up. When judging that it has been started up, it proceeds to the processing of step ST5, while when judging that it has not been started up, proceeds to the processing of step ST3.

[0393] Step ST3:

[0394] The IC card procedure management task 72 judges from the entity status information 82 shown in FIG. 11 of the IC card entity data 73_x selected at step ST1 which state of the state transition chart shown in FIG. 12 the processing relating to that entity data is in and decides on the job to be executed next from the processing order information 85.

[0395] At this time, the processing order information 85 defines the order of execution of jobs using the service elements set in the service definition table data as explained earlier.

[0396] Step ST4:

[0397] The IC card procedure management task 72 starts up the job selected at step ST3.

[0398] The IC card procedure management task 72 executes the job using the data blocks relating to that job in the above-mentioned input data block 31_x1, output data block 32_x2, log data block 33_x3, and computation defining data block 34_x4.

[0399] At this time, the IC card procedure management task 72, when issuing a command to the IC card 3 in execution of a job, uses the service element corresponding to that job as a key to search through the service definition table data to obtain the service number corresponding to that service element (operational command of IC card 3 able to be analyzed by the IC card 3). Further, the IC card procedure management task 72 uses the obtained service number to issue a command to the IC card 3.

[0400] Further, the IC card procedure management task 72, as explained using FIG. 4, when key information is required for accessing a storage area of the IC card 3a, uses the service element corresponding to that job to search through the service definition table data and obtain the key information corresponding to that service element. Further, the IC card procedure management task 72 uses that key information to perform mutual authentication with the IC card 3, encryption and decryption of data, and other processing and obtain the right to access a predetermined storage area of the IC card 3.

[0401] Step ST5:

[0402] Step ST5 is performed when the IC card procedure management task 72 issues a command to the IC card 3 and is waiting for the processing result of the IC card 3.

[0403] When the IC card procedure management task 72 receives the processing result from the IC card 3, it sets this in

[0404] Step ST6:

[0405] The IC card procedure management task 72 updates the entity status information 82 of the IC card entity data 73_x shown in FIG. 11.

[0406] In this way, in the present embodiment, the IC card procedure management task 72 performs processing for a plurality of IC cards 3 present in the SAM chip 8 in parallel while selecting in order the IC card entity data 73_x for the plurality of IC cards 3. Therefore, the SAM chip 8 can simultaneously proceed with the processing even when receiving processing requests for procedures using a plurality of IC cards 3.

[0407] Next, the overall operation of the communication system shown in FIG. 1 will be explained.

[0408] FIG. 14 and FIG. 15 are views for explaining the overall operation of the communication system 1 shown in FIG. 1.

[0409] Step ST21:

[0410] The businesses 15_1 to 15_3 or a party requested by those businesses produce script programs 21_1, 21_2, and 21_3 describing processing for transactions performed by the businesses using the IC card 3 for example on the personal computers 16_1, 16_2, and 16_3 shown in FIG. 1.

[0411] Further, the manager of the SAM chip 8 produces service definition table data 20_1, 20_2, and 20_3 corresponding to the businesses 15_1 to 15_3.

[0412] Step ST22:

[0413] The service definition table data 20_1, 20_2, and 20_3 produced in step ST21 are stored in the external memory 7.

[0414] Further, the script programs 21_1, 21_2, and 21_3 produced at step ST21 are downloaded from the personal computers 16_1, 16_2, and 16_3 through the Internet 10, ASP server 6, and SAM chip 8 to the external memory 7. That download processing is managed, as shown in FIG. 7, by the script download task 69 in the SAM chip 8.

[0415] Step ST23:

[0416] The script interpretation task 70 in the SAM chip shown in FIG. 7 uses the service definition table data and script program to generate the IC card entity plate data, input data block, output data block, log data block, and computation defining data block for each business.

[0417] The generated data is stored in the storage unit 65 of the SAM chip 8 shown in FIG. 9.

[0418] Step ST24:

[0419] The user is issued the IC card 3.

[0420] As shown in FIG. 4, the storage unit 50 of the IC 3a of the IC card 3 stores key information used for transactions with the business the user contracts with.

[0421] Note that the user and a business may also contract with each other after issuance of the IC card 3 through the Internet 10 etc.

[0422] Step ST25:

[0423] For example, when the user uses the personal computer to access the server 2 through the Internet 10 to try to purchase a product, the server 2 issues a processing request through the Internet, 10 to the ASP server 6.

[0424] When the ASP server 6 receives a processing request from the server 2, it accesses the personal computer 5 through the Internet 10. Further, as shown in FIG. 16 segment A, a processing request issued by the card reader/writer 4 for the IC card 3 is transmitted through the personal computer 5, Internet 10, and ASP server 6 to the SAM chip 8.

[0425] Step ST26:

[0426] The ASP server 6 outputs to the SAM chip 8 an entity production request.

[0427] That entity production request stores information showing the issuer of the IC card 3.

[0428] Step ST27:

[0429] When the SAM chip 8 receives an entity production request, as shown in FIG. 16 segment B, it conducts polling with the IC card 3.

[0430] Step ST28:

[0431] The entity generation task 71 of the SAM chip 8 judges if the number of the IC card entity data 73_x present in the SAM chip 8 after the end of the polling is within the maximum number defined by the SC command of the script program. If within the maximum number, it proceeds to the processing of step ST29, while if not, it ends the processing.

[0432] Step ST29:

[0433] The entity generation task 71 specifies which business' IC card entity plate data to use based on the information showing the issuer of the IC card 3 stored in the entity production request for example and uses that specified IC card entity plate data to generate the IC card entity data 73_x.

[0434] This corresponds to the instance generation shown in FIG. 12.

[0435] Step ST30:

[0436] The SAM chip 8 outputs to the ASP server 6 the entity ID of the IC card entity data 73_x generated at step ST29.

[0437] Step ST31:

[0438] The IC card procedure management task 72 of the SAM chip 8 investigates the services which the IC card 3 can use.

[0439] This is processing corresponding to the job RS shown in FIG. 12.

[0440] Step ST32:

[0441] The IC card procedure management task 72 of the SAM chip 8 authenticates the legitimacy of the IC card 3.

[0442] This is processing corresponding to the job A1 shown in FIG. 12.

[0443] Step ST33:

[0444] The IC card 3 authenticates the legitimacy of the SAM chip 8.

[0445] This is processing corresponding to the job A2 shown in FIG. 12.

[0446] By steps ST32 and ST33, the IC card 3 and SAM chip 8 mutually authenticate each other. This corresponds to FIG. 16 segment C.

[0447] Step ST34:

[0448] The IC card procedure management task 72 of the SAM chip 8 reads and writes data necessary for the procedure with the IC card 3.

[0449] This is processing corresponding to the jobs R and W shown in FIG. 12 and FIG. 16 segments D and E.

[0450] Further, the IC card procedure management task 72 uses a computation formula specified based on the pre-processing information 86 of the IC card entity data 73_x to perform predetermined processing for computation using the data read from the IC card 3.

[0451] Step ST35:

[0452] As shown in FIG. 16 segment F, the IC card procedure management task 72 of the SAM chip 8 outputs the processing result of step ST34 to the ASP server 6.

[0453] Step ST36:

[0454] For example, the IC card procedure management task 72 deletes the IC card entity data 73_x.

[0455] As explained above, according to the communication system 1, it is possible to generate the IC card entity data 73_x for each processing for a procedure occurring with the IC card 3 and to have the IC card procedure management task 72 use the plurality of IC card entity data 73_x to simultaneously proceed with processing for a plurality of IC cards 3.

[0456] Further, according to the authentication system 1, since it is sufficient to store the IC card entity data 73_3 actually used for the processing of the IC cards 3 in the storage unit 65, it is possible to use the storage areas of the storage unit 65 efficiently.

[0457] Further, according to the authentication system 1, as shown in FIG. 12, since the IC card procedure management task 72 manages the states of execution of the jobs processed divided into post-startup states and completed states, it is possible to start the execution of one job, then start the processing relating to another job in the state while waiting for data from the IC card 3. Therefore, it is possible to eliminate the wait time caused by transfer of data with the IC card 3 through the Internet 10.

[0458] Further, according to the authentication system 1, the service definition table data describes a name showing the type of service provided by each business, that is, the service type element, the number of that service used in the IC card 3, and the key information used when providing that service. This is held in the external memory 7. Therefore, businesses 15_1 to 15_3 not developers of the SAM chip 8 can produce their own application programs for running on the SAM chip 8 by the script programs 21_1, 21_2, and 21_3 and download them through the SAM chip 8 into the external memory 7 for customization. That is, without being informed of key information, operational commands for directly operating the IC card 3, or other highly confidential information to the businesses 15_1 to 15_3, these businesses can customize their own application programs. Further, when a business customizes its application program, it does not need to know the key information or card operational commands, so the load on the business is lightened.

[0459] Further, according to the authentication system 1, since it is possible to define computation content spanning a plurality of services, it is possible to provide diverse services combining a plurality of services in a range of services executed simultaneously with approval at the IC card 3 side.

[0460] Further, according to the authentication system 1, by introducing the concept of a data block, the data input and output with the IC card 3 and the log data can be easily managed.

[0461] FIG. 17 is a functional block diagram showing more specifically the function blocks of the SAM chip 8 shown in FIG. 9.

[0462] As shown in FIG. 9, the SAM chip 8 is connected through an internal bus 90 to an ASPS communication interface unit 60, external memory communication interface unit 61, bus scramble unit 62, random number generation unit 63, encryption/decryption unit 64, storage unit 65, and CPU 66.

[0463] In the SAM chip 8 shown in FIG. 17, for example as shown in FIG. 18, it is also possible to connect a card I/F unit 91 connected to the internal bus 90 to an RF reception/transmission unit 92 outside of the SAM chip 8 and transfer data with the IC card 3 by a noncontact system through an antenna 92a of the RF reception/transmission unit 92.

[0464] Second Embodiment

[0465] The present embodiment is an embodiment corresponding to the seventh to ninth aspects of the invention.

[0466] FIG. 19 is a view of the overall configuration of a communication system 101 of the present embodiment.

[0467] As shown in FIG. 19, the communication system 101 uses the server 102, IC card 103 (integrated circuit of the present invention), card reader/writer 104, personal computer 105, ASP (application service provider) server 106, SAM (secure application module) unit 109, personal computers 116_1, 116_2, and 116_3, and authentication units 117_1, 117_2, and 117_3 to communicate through the Internet 110 and perform settlement processing or other processing for a procedure using an IC card 103.

[0468] The SAM unit 109 has an external memory 107 (semiconductor storage circuit of the present invention) and SAM chip 108 (semiconductor circuit of the present invention).

[0469] The SAM chip 108 has the software configuration shown in FIG. 20.

[0470] As shown in FIG. 20, the SAM chip 108 has, from the bottom layer toward the top layer, an HW (hardware) layer, OS layer, lower handler layer, higher handler layer, and AP layer in that order.

[0471] The lower handler layer includes a driver layer.

[0472] Here, the AP layer has application programs AP_1, AP_2, and AP_3 defining procedures using the IC card 103 by the credit card companies or other businesses 115_1, 115_2, and 115_3 shown in FIG. 19.

[0473] In the AP layer, the application programs AP_1, AP_2, and AP_3 and the higher handler layer are provided between them with firewalls FW (firewalls of the present invention).

[0474] The SAM chip 108 is connected through a SCSI port, the Ethernet, etc. to the ASP server 106. The ASP server 106 is connected through the Internet 110 to a plurality of terminal apparatus including a personal computer 105 of an end user and personal computers 116_1, 116_2, and 116_3 of businesses 115_1, 115_2, and 115_3.

[0475] The personal computer 105, for example, is connected through a serial port or USB port to a Dumb type card reader/writer 104. The card reader/writer 104 realizes for example wireless communication corresponding to the physical level with the IC card 103.

[0476] The operational commands to the IC card 103 and response packets from the IC card 103 are generated and analyzed at the SAM unit 109 side. Therefore, the card reader/writer 104, personal computer 105, and ASP server 106 between them only act to store the commands and response content in the data payload portion and relay the same and are not involved in the encryption or decryption of data, authentication, or other actual operations in the IC card 103.

[0477] The businesses 115_1, 115_2, and 115_3 use their personal computers 116_1, 116_2, and 116_3 to produce the application programs AP_1, AP_2, and AP_3 and download the produced application programs through the authentication units 117_1, 117_2, and 117_3 through the SAM chip 108 to predetermined storage areas in the external memory 107.

[0478] At this time, since the businesses 115_1, 115_2, and 115_3 have no relation with each other, the storage areas in the external memory 107 where the application programs AP_1, AP_2, and AP_3 can be downloaded to are decided in advance and whether one has the right to download to such a storage area is verified by the SAM chip 108.

[0479] Further, while the application programs AP_1, AP_2, and AP_3 are being executed, the firewalls FW restrict the transfer and viewing of data among the application programs AP_1, AP_2, and AP_3.

[0480] When downloading the application programs AP_1, AP_2, and AP_3 to the SAM chip 108, the authentication units 117_1, 117_2, and 117_3, as explained later, perform mutual authentication with the SAM chip 108, produce the download signature verification key information, etc.

[0481] Next, the components shown in FIG. 19 will be explained.

[0482] [IC Card 103]

[0483] FIG. 21 is a functional block diagram of the IC card 103.

[0484] As shown in FIG. 21, the IC card 103 has an IC (integrated circuit) 103a provided with a storage unit 150 and processing unit 151.

[0485] The storage unit 150, as shown in FIG. 22, has a storage area 155_1 used by a credit card company or other business 115_1, a storage area 155_2 used by a business 115_2, and a storage area 155_3 used by a business 115_3.

[0486] Further, the storage unit 150 stores key information used for judging the existence of the right to the storage area 155_1, key information used for judging the access right to the storage area 155_2, and key information used for judging the access right to the storage area 155_3. That key information is specifically used for mutual authentication, encryption and decryption of data, etc.

[0487] Further, the storage unit 150 stores identification information of the IC card 103 or IC card 103 user.

[0488] Next, the SAM unit 109 will be explained in detail.

[0489] [External Memory 107]

[0490] FIG. 23 is a view for explaining the storage areas of the external memory 107.

[0491] As shown in FIG. 23, the storage areas of the external memory 107 include an AP storage area 120_1 storage area for storing the application program AP_1 of the business 115_1, an AP storage area 120_2 for storing the application program AP_2 of the business 115_2, an AP storage area 120_3 for storing the application program AP_3 of the business 115_3, an AP management storage area 121 used by the manager of the SAM chip 108, and a key information storage area 122.

[0492] The application program AP_1 stored in the AP storage area 120_1 is comprised of a plurality of program modules. Access to the AP storage area 120_1 is restricted by the firewall FW_1.

[0493] The application program AP_2 stored in the AP storage area 120_2 is comprised of a plurality of program modules. Access to the AP storage area 120_2 is restricted by the firewall FW_2.

[0494] The application program AP_3 stored in the AP storage area 120_3 is comprised of a plurality of program modules. Access to the AP storage area 120_3 is restricted by the firewall FW_3.

[0495] In the present embodiment, the above program module is the minimum unit downloaded for example from the outside of the SAM unit 109 to the external memory 107. The number of the program modules forming each application program can be freely determined by the corresponding business.

[0496] Further, the application programs AP_1, AP_2, and AP_3 stored in the external memory 107 are scrambled. They are descrambled when read into the SAM chip 108.

[0497] Further, the application programs AP_1, AP_2, and AP_3 are., for example, produced by the businesses 115_1, 115_2, and 115_3 using the personal computers 116_1, 116_2, and 116_3 shown in FIG. 19 and are downloaded through the SAM chip 108 to the external memory 107.

[0498] Access to the AP management storage area 121 is restricted by the firewall FW_4.

[0499] Note that the firewalls FW_1, FW_2, FW_3, and FW_4 correspond to the firewalls FW shown in FIG. 20.

[0500] The AP management storage area 121 stores the module management data 130 shown in FIG. 24.

[0501] The module management data 130 registers the module names of the program modules downloaded from the personal computers 116_1, 116_2, and 116_3 in advance and the download signature verification key information (download key information of the present invention).

[0502] That is, download of a program module is allowed conditional on the module management data 130 having the download signature verification key information registered in it in advance.

[0503] Further, the module management data 130 has the module names of the program modules executed by the SAM chip 108 and the execution signature verification key information registered in it.

[0504] That is, the right for a program module to be executed by the SAM chip 108 is obtained conditional on the module management data 130 having the execution signature verification key information registered in it in advance.

[0505] The module management data 130, as shown in FIG. 24, shows the correspondence of the firewall number of the firewall restricting access to the program module (firewall identification information of the present invention), start address, address length, download signature verification key information, execution signature verification key information, and module name for each program module of the application programs AP_1, AP_2, and AP_3 stored in the AP storage areas 120_1, 120_2, and 120_3.

[0506] Here, the firewall number shows the number of the firewall by which access to that program module is restricted.

[0507] The start address shows the start address of the storage area for which access is restricted by that firewall.

[0508] The address length shows the address length of the storage area for which access is restricted by that firewall.

[0509] The download signature verification key information is the key information used for the signature verification performed when downloading a program module through the SAM chip 108 to the external memory 107.

[0510] The execution signature verification key information is used for verifying the signature information given to a program module when executing that program module by the SAM chip 108. In the present embodiment, for example, each program module is given signature information showing its legitimacy. When that program module has been illicitly modified or tampered with, it is possible to use the execution signature verification key information to verify that signature information to confirm the legitimacy of that program module.

[0511] The module name is the name assigned to that program module.

[0512] The key information storage area 122 stores the encrypted key information K_C1 used when accessing the storage area 155_1 of the IC card 103 shown in FIG. 22 by execution of the application program AP_1, the encrypted key information K_C2 used when accessing the storage area 155_2 of the IC card 103 shown in FIG. 22 by execution of the application program AP_2, and the encrypted key information K_C3 used when accessing the storage area 155_3 of the IC card 103 shown FIG. 22 by execution of the application program AP_3.

[0513] The key information K_C1, K_C2, and K_C3 are encrypted by the key information K_X.

[0514] Access to the key information storage area 122 is allowed only by the manager of the SAM chip 108.

[0515] [SAM Chip 108]

[0516] FIG. 25 is a functional block diagram of the SAM chip 108 shown in FIG. 19.

[0517] As shown in FIG. 25, the SAM chip 108 has an ASPS communication interface unit 160, external memory communication interface unit 161, bus scramble unit 162, signature processing unit 163, authentication processing unit 164, encryption/decryption unit 165, storage unit 166, and CPU 167.

[0518] The SAM chip 108 is a tamper-resistant module.

[0519] The ASPS communication interface unit 160 is an interface used for input and output of data with the ASP server 106 shown in FIG. 19.

[0520] The external memory communication interface unit 161 is an interface used for input and output of data with the external memory 107.

[0521] The bus scramble unit 162 scrambles output data and descrambles input data when inputting and outputting data through the external memory communication interface unit 161.

[0522] The signature processing unit 163 as explained later produces a signature and verifies a signature when downloading an application program through the Internet 110 in the external memory 107 and when executing the application program.

[0523] The authentication processing unit 164 as explained later performs mutual authentication with the other party when downloading an application program through the Internet 110 to the external memory 107.

[0524] The encryption/decryption unit 165 encrypts data and decrypts encrypted data.

[0525] The storage unit 166 for example stores the key information K_X for decrypting the key information K_C1, K_C2, and K_C3 stored in the key information storage area 122 of the above-mentioned external memory 107.

[0526] The CPU 167 executes tasks as explained later based on a predetermined program (program of the present invention) and executes a designated application program in accordance with execution of the tasks.

[0527] FIG. 26 is a view for explaining the tasks executed by the CPU 167.

[0528] As shown in FIG. 26, the CPU 167 executes the download task 170, system task 171, AP task 172 (program of the present invention), and settlement processing routine task 173.

[0529] The download task 170, as explained later, performs processing for downloading tan application program from outside of the SAM unit 109 through the SAM chip 108 to the external memory 107.

[0530] The system task 171 is a task for performing driver management, operations unique to the IC card 103, and other processing.

[0531] The AP task 172 comprehensively manages the execution of the application programs AP_1, AP_2, and AP_3 performed when the SAM chip 108 receives a processing request from the ASP server 106 or elsewhere outside of the SAM chip 108.

[0532] The settlement processing routine task 173 decides which of the application programs AP_1, AP_2, and AP_3 to use when for example the SAM chip 108 receives a processing request relating to the IC card 103 from the ASP server 106.

[0533] Next, examples of the operation of the communication system 101 will be explained.

[0534] [Operation for Downloading AP to External Memory]

[0535] FIG. 27 is a flow chart for explaining the operation of downloading an application program AP_1 from the personal computer 116_1 shown in FIG. 19 to the external memory 107.

[0536] Step ST101:

[0537] The personal computer 116_1 shown in FIG. 19 transmits to the SAM chip 108 a download request designating the module name of each program module to be downloaded through the authentication unit 117_1.

[0538] Step ST102:

[0539] The download task 170 running on the SAM chip 108 shown in FIG. 26 performs mutual authentication with the authentication unit 117_1 connected to the personal computer 116_1. Further, when each others legitimacy is confirmed by the mutual authentication, the processing of step ST103 is performed.

[0540] Note that, in the present embodiment, it is possible to use various techniques as the technique for that mutual authentication, but for example the following technique is used.

[0541] Both of the authentication unit 117_1 and SAM chip 108 hold identification information of the SAM chip 108, that is, the SAM_ID, and the mutual authentication master key information.

[0542] Further, the authentication unit 117_1 encrypts the SAM_ID by the mutual authentication master key information and transmits it to the SAM chip 108. The SAM chip 108 decrypts the received encrypted SAM_ID by the mutual authentication master key and compares it with the SAM ID it holds itself. If matching, it confirms the legitimacy of the authentication unit 117_1. Further, reverse to this, the SAM chip 108 encrypts the SAM_ID by the mutual authentication master key information and transmits it to the authentication unit 117_1. The authentication unit 117_1 decrypts the received encrypted SAM_ID by the mutual authentication master key and compares it with the SAM_ID it holds itself. If matching, it confirms the legitimacy of the SAM chip 108.

[0543] Step ST103:

[0544] The download task 170 judges whether each module name designated by the download request at step ST101 is registered in the module management data 130 stored in the AP management storage area 121 of the external memory 107.

[0545] Step ST104:

[0546] The download task 170, when judging at step ST103 that it is not registered, ends the processing without performing the download processing, while when judging that it is registered, performs the processing of step ST105.

[0547] Step ST105:

[0548] The authentication unit 117_1 encrypts the SAM_ID as plain text using the AP master key KEY-A to generate the download signature verification key information.

[0549] Further, it transmits that download signature verification key information or signature information produced using that download signature verification key information to the SAM chip 108.

[0550] Step ST106:

[0551] The download task 170, when receiving the download signature verification key information at step ST105, judges if the received download signature verification key information matches with the download signature verification key information of the corresponding module name in the module management data 130.

[0552] Further, the download task 170, when receiving the signature information at step ST105, uses the download signature verification key information of the corresponding module name in the module management data 130 to judge the legitimacy of that signature information.

[0553] Step ST107:

[0554] The download task 170 proceeds to the processing of step ST108 when judging that they match at step ST106 or when judging that the signature information is legitimate and ends the processing in other cases.

[0555] Step ST108:

[0556] The download task 170 specifies the address in the external memory 107 corresponding to the module name designated at step ST101 by viewing the module management data 130 and downloads the program module from the personal computer 116_1 to the specified address on the external memory 107.

[0557] [Operation for Execution of Application Program]

[0558] FIG. 28 is a flow chart for explaining the operation by which the SAM chip 108 shown in FIG. 19 executes the application program AP_1.

[0559] Step ST111:

[0560] When the SAM chip 108 receives a request for execution of the application program AP_1 for example from the ASP server 106, the AP task 172 shown in FIG. 26 executes the processing of step ST112.

[0561] Step ST112:

[0562] Before the AP task 172 executes a program module of the application program AP_1, it can obtain execution signature verification key information corresponding to the module names of the program module by referring to the module management data 130.

[0563] Step ST113:

[0564] The AP task 172 uses the execution signature verification key information obtained at step ST112 to verify the legitimacy of the signal information of that program module.

[0565] That is, it judges if the program module has been illicitly altered or tampered with.

[0566] Step ST114:

[0567] When the AP task 172 verifies at step ST113 that the signature information is legitimate, it proceeds to the processing of step ST115, while when it judges it is not legitimate, it ends the processing.

[0568] Step ST115:

[0569] The AP task 172 executes the program module for which the signature information has been judged to be legitimate.

[0570] Note that, the program module may also be executed by the CPU 167 shown in FIG. 25 as a subroutine in the program.

[0571] [Operation During Execution of Application Program]

[0572] FIG. 29 is a view for explaining the operation for execution of an application program.

[0573] Step ST121:

[0574] When the AP task 172 executes a code in a program module through the processing shown in FIG. 28, it judges whether the code to be executed next is a code instructing data transfer or data viewing with another program module.

[0575] Step ST122:

[0576] When the AP task 172 judges that the code to be executed next does not instruct data transfer or data viewing with another program module, it proceeds to the processing of step ST124, while when it judges that it does instruct the same, proceeds to the processing of step ST123.

[0577] Step ST123:

[0578] The AP task 172 executes that code.

[0579] Step ST124:

[0580] The AP task 172 for example performs error processing without executing that code.

[0581] Next, the overall operation of the communication system 101 shown in FIG. 19 will be explained.

[0582] FIG. 30 is a view for explaining the overall operation of the communication system 101 shown in FIG. 19.

[0583] Step ST131:

[0584] The businesses 115_1 to 115_3 or a party requested by these businesses produces the application programs AP_1, AP_2, and AP_3 for enabling the businesses to perform processing relating to transactions performed using the IC card 103 on the personal computers 116_1, 116_2, and 116_3 shown in FIG. 19.

[0585] Further, the manager of the SAM chip 108 generates the module management data 130 shown in FIG. 23, scrambles it, and stores it in the external memory 107.

[0586] Step ST132:

[0587] The application programs AP_1, AP_2, and AP_3 are downloaded through the authentication units 117_1, 117_2, and 117_3 from the personal computers 116_1, 116_2, and 116_3 to the SAM chip 108.

[0588] At this time, the processing explained using FIG. 27 is performed.

[0589] Step ST133:

[0590] The user is issued the IC card 103.

[0591] As shown in FIG. 22, the storage unit 150 of the IC 103a of the IC card 103 stores the key information used for transactions by the user with the contracting business.

[0592] Note that, the user and a business may also conclude a contract through the Internet 110 etc. after issuance of the IC card 103.

[0593] Step ST134:

[0594] For example, when the user uses the personal computer 105 to access the server 102 through the Internet 110 to try to purchase a product, the server 102 sends a processing request through the Internet 110 to the ASP server 106.

[0595] The ASP server 106, when receiving a processing request from the server 102, accesses the personal computer 105 through the Internet 110. Further, the processing request for the IC card 103 issued by the card reader/writer 104 is transmitted through the personal computer 105, Internet 110, and ASP server 106 to the SAM chip 108.

[0596] Step ST135:

[0597] The SAM chip 108 selects an application program by the settlement processing routine task 173 in accordance with the processing request received at step ST134 and executes that selected application program.

[0598] The processing explained using FIG. 28 and FIG. 29 in the execution of that application program is then performed.

[0599] Step ST136:

[0600] The SAM chip 108 outputs the result of execution of the application program to the ASP server 106.

[0601] As explained above, according to the communication system 101, as explained using FIG. 27, since the SAM chip 108 uses the authentication units 117_1, 117_2, and 117_3 to authenticate the downloader of the application program and allows the download of the application program only to an authorized storage area in the external memory 107, it is possible to prevent an unauthorized party from illicitly exchanging or tampering with an application program in the external memory 107.

[0602] Further, according to the communication system 101, when the SAM chip 108 runs a plurality of application programs, since data transfer and data and code viewing among application programs are restricted by the firewalls FW_1, FW_2, and FW_3, it is possible to prevent processing of each application program from being illicitly interfered with or tampered with by another application program. Further, it is possible to improve the confidentiality of each application program.

[0603] Further, according to the communication system 101, as explained using FIG. 28, when executing an application program, by verifying whether that application program is being tampered with, it is possible to avoid identity theft or other illicit acts based on an illicitly tampered with application program.

[0604] Further, according to the communication system 101, by comprising each application program by a plurality of program modules, it is possible to download to an external memory 107 in units of program modules.

[0605] Further, according to the communication system 101, by performing the usual scrambling on the highly confidential key information used for operations on an IC card 103 to encrypt it and storing it in the external memory 107, it is possible to improve the security level of that key information.

[0606] Further, according to the communication system 101, since the application program performs encryption and decryption at the time of code access by a bus scramble function, it is possible to prevent an application program stored in the external memory 107 from being illicitly analyzed etc. while halting the processing of the SAM chip 108.

[0607] FIG. 31 is a functional block diagram showing more specifically the function blocks of the SAM chip 108 shown in FIG. 25.

[0608] As shown in FIG. 31, the SAM chip 108 is connected through an internal bus 190 to the ASPS communication interface unit 160, external memory communication interface unit 161, bus scramble unit 162, encryption/decryption unit 165, storage unit 166, and CPU 167.

[0609] Part of the functions of the signature processing unit 163 and authentication processing unit 164 shown in FIG. 25 are realized by, for example, the CPU 167.

[0610] In the SAM chip 108 shown in FIG. 31, for example as shown in FIG. 32, it is also possible to connect the card I/F unit 191 connected to the internal bus 190 to an RF reception/transmission unit 192 outside of the SAM chip 108 and transfer data with the IC card 103 by a noncontact system through an antenna 192a of the RF reception/transmission unit 192.

[0611] Third Embodiment

[0612] The present embodiment is an embodiment corresponding to the 10th to 12th aspects of the invention.

[0613] FIG. 33 is a view of the overall configuration of a communication system 201 of the present embodiment.

[0614] As shown in FIG. 33, the communication system 201 uses a server 202, IC card 203, card reader/writer 204, personal computer 205, ASP (application service provider) server 206, SAM (secure application module) unit 209, personal computers 216_1, 216_2, and 216_3, and authentication units 217_1, 217_2, and 217_3 to communicate through the Internet 210 and perform settlement processing or other processing for a procedure using the IC card 203.

[0615] The SAM unit 209 has an external memory 207 and SAM chip 208.

[0616] The SAM chip 208 has the software configuration shown in FIG. 34.

[0617] As shown in FIG. 34, the SAM chip 208 has, from the bottom layer toward the top layer, an HW (hardware) layer, OS layer, lower handler layer, higher handler layer, and AP layer in that order.

[0618] The lower handler layer includes a driver layer.

[0619] Here, AP layer includes application programs AP_1, AP_2, and AP_3 defining procedures using the IC card 203 by the credit card companies or other businesses 215_1, 215_2, and 215_3 shown in FIG. 33.

[0620] In the AP layer, the application programs AP_1, AP_2, and AP_3 and the higher handler layer are provided between them with firewalls FW.

[0621] The SAM chip 208 is connected through a SCSI port, the Ethernet, etc. to the ASP server 206. The ASP server 206 is connected through the Internet 210 to a plurality of terminal apparatuses including the personal computer 205 of the end user and personal computers 216_1, 216_2, and 216_3 of the businesses 215_1, 215_2, and 215_3.

[0622] The personal computer 205, for example, is connected through the serial port or USB port to a Dumb type card reader/writer 204. The card reader/writer 204 realizes for example wireless communication corresponding to the physical level with the IC card 203.

[0623] The operational commands to the IC card 203 and the response packets from the IC card 203 are generated and analyzed at the SAM unit 209 side. Therefore, the card reader/writer 204, personal computer 205, and ASP server 206 interposed between them only act to store the commands or response contents in data payload portions and relay the same. They are not involved in the encryption or decryption of data, authentication, or other actual operations in the IC card 203.

[0624] The businesses 215_1, 215_2, and 215_3 use the personal computers 216_1, 216_2, and 216_3 to produce the application programs AP_1, AP_2, and AP_3 and download the produced application programs through the authentication units 217_1, 217_2, and 217_3 and through the SAM chip 208 to predetermined storage areas in the external memory 207.

[0625] At this time, since the businesses 215_1, 215_2, and 215_3 have no relation with each other, the storage areas in the external memory 207 where the application programs AP_1, AP_2, and AP_3 can be downloaded are predetermined. Whether they have the right to download to those storage areas is verified by the SAM chip 208.

[0626] Further, the transfer and viewing of data among the application programs AP_1, AP_2, and AP_3 are restricted by the firewalls FW. The authentication units 217_1, 217_2, and 217_3, as explained later, perform mutual authentication with the SAM chip 209, produce download signature verification key information, etc. when downloading application programs AP_1, AP_2, and AP_3 to the SAM chip 208.

[0627] Next, the components shown in FIG. 33 will be explained.

[0628] [IC Card 203]

[0629] FIG. 35 is a functional block diagram of the IC card 203.

[0630] As shown in FIG. 35, the IC card 203 has an IC (integrated circuit) 203a provided with a storage unit 250 and processing unit 251.

[0631] The storage unit 250, as shown in FIG. 36, has a storage area 255_1 used by a credit card company or other business 215_1, a storage area 255_2 used by a business 215_2, and a storage area 255_3 used by a business 215_3. Further, the storage unit 250 stores key information used for judging the existence of a right to the storage area 255_1, key information used for judging an access right to the storage area 255_2, and key information used for judging an access right to the storage area 255_3. That key information is specifically used for mutual authentication, encryption and decryption of data, etc.

[0632] Further, the storage unit 250 stores the identification information of the IC card 203 or the user of the IC card 203.

[0633] Next, the SAM unit 209 will be explained in detail.

[0634] [External Memory 207]

[0635] FIG. 37 is a view for explaining the storage areas of the external memory 207.

[0636] As shown in FIG. 37, the storage areas of the external memory 207 include a storage area 220_1 in which the application program AP_1 of the business 215_1 is stored, a storage area 220_2 in which the application program AP_2 of the business 215_2 is stored, a storage area 220_3 in which the application program AP_3 of the business 215_3 is stored, and an AP management storage area 221 used by the manager of the SAM chip 208.

[0637] The application program AP_1 stored in the AP storage area 220_1 is comprised of a plurality of program modules. Access to the AP storage area 220_1 is restricted by the firewall FW_1.

[0638] The application program AP_2 stored in the AP storage area 220_2 is comprised of a plurality of program modules. Access to the AP storage area 220_2 is restricted by the firewall FW_2.

[0639] The application program AP_3 stored in the AP storage area 220_3 is comprised of a plurality of program modules. Access to the AP storage area 220_3 is restricted by the firewall FW_3.

[0640] In the present embodiment, the above program module is the minimum unit downloaded for example from the outside of the SAM unit 209 to the external memory 207. The number of the program modules forming each application program can be freely determined by the corresponding business.

[0641] Further, the application programs AP_1, AP_2, and AP_3 stored in the external memory 207 are scrambled. They are descrambled when read into the SAM chip 208.

[0642] Further, the application programs AP_1, AP_2, and AP_3 are, for example, produced by the businesses 215_1, 215_2, and 215_3 using the personal computers 216_1, 216_2, and 216_3 shown in FIG. 33 and are downloaded through the SAM chip 208 to the external memory 207.

[0643] Access to the AP management storage area 221 is restricted by the firewall FW_4.

[0644] Note that the firewalls FW_1, FW_2, FW_3, and FW_4 correspond to the firewalls FW shown in FIG. 34.

[0645] The AP management storage area 221 stores the AP selection data 231 and the inter-AP communication data 232 as shown in FIG. 37.

[0646] Here, AP selection data 231 and inter-AP communication data 232 are, for example, registered in advance at the time of setting up the SAM chip 208. Further, the AP selection data 231 and inter-AP communication data 232 can only be rewritten by the manager of the SAM chip 208.

[0647] FIG. 38 is a view for explaining the AP selection data 231.

[0648] As shown in FIG. 38, the AP selection data 231 shows the IC card type information and AP identification information linked together.

[0649] The IC card type information shows the type of the IC card 203 shown in FIG. 33 and, for example, is identification information of the credit card company performing the settlement for a transaction using the IC card 203.

[0650] The AP identification information, as shown in FIG. 34, is identification information of the application program operating at the AP layer of the SAM chip 208.

[0651] FIG. 39 is a view for explaining the inter-AP communication data 232.

[0652] The inter-AP communication data 232 shows whether communication among the application programs AP_1, AP_2, and AP_3 shown in FIG. 34 is possible

[0653] Specifically, this shows if the communication request to an application program at a row item issued by an application program at a column item shown in FIG. 39 is allowed or not.

[0654] For example, a communication request by the application program AP_3 to the application program AP_1 is allowed, but a communication request to the application program AP_2 is rejected.

[0655] Further, as shown in FIG. 37, the AP management storage area 221 has an inter-AP communication storage area 233 used for communication (transfer of data) with an application program.

[0656] [SAM Chip 208]

[0657] FIG. 40 is a functional block diagram of the SAM chip 208 shown in FIG. 33.

[0658] As shown in FIG. 40, the SAM chip 208 has an ASPS communication interface unit 260, external memory communication interface unit 261, bus scramble unit 262, signature processing unit 263, authentication processing unit 264, encryption/decryption unit 265, storage unit 266, and CPU 267.

[0659] The SAM chip 208 is a tamper-resistant module.

[0660] The ASPS communication interface unit 260 is an interface used for input and output of data with the ASP server 206 shown in FIG. 33.

[0661] The external memory communication interface unit 261 is an interface used for input and output of data with the external memory 207.

[0662] The bus scramble unit 262 scrambles output data and descrambles input data when inputting and outputting data through the external memory communication interface unit 261.

[0663] That is, the external memory 207 stores data in a scrambled state.

[0664] The signature processing unit 263, as explained later, produces a signature and verifies a signature when downloading an application program through the Internet 210 to the external memory 207 and when executing an application program.

[0665] The authentication processing unit 264, as explained later, performs mutual authentication with the other party when downloading an application program through the Internet 210 to the external memory 207.

[0666] The encryption/decryption unit 265 encrypts data and decrypts encrypted data.

[0667] The storage unit 266 stores the data required for the processing of the CPU 267.

[0668] The CPU 267 executes later explained tasks based on a predetermined program (program of the present invention) and executes an application program designated in accordance with execution of the tasks.

[0669] FIG. 41 is a view for explaining tasks executed by the CPU 267.

[0670] As shown in FIG. 41, the CPU 267 executes a download task 270, system task 271, AP task 272, settlement processing routine task 273, inter-AP communication task 274, and inter-SAM communication task 275.

[0671] The download task 270, as explained later, performs processing for downloading an application program from outside of the SAM unit 209 through the SAM chip 208 to the external memory 207.

[0672] The system task 271 is a task performing driver management, operations unique to the IC card 203, or other processing.

[0673] The AP task 272, for example, comprehensively manages the execution of the application programs AP_1, AP_2, and AP_3 performed when a program request is received by the SAM chip 208 from the ASP server 206 or other place outside of the SAM chip 208.

[0674] As shown in FIG. 42, when the SAM chip 208 receives a processing request relating to the IC card 203 from the ASP server 206, the settlement processing routine task 273 obtains identification information of the AP corresponding to the IC card type information included in that processing request based on the AP selection data 231 shown in FIG. 38 and selects and executes the application programs AP_1, AP_2, and AP_3 corresponding to that AP identification information.

[0675] The inter-AP communication task 274 manages communication among the application programs.

[0676] FIG. 43 is a flow chart for explaining the processing of the inter-AP communication task 274.

[0677] Here, the explanation will be given illustrating the case of the application program AP_1 issuing a communication request for writing data in the AP_2.

[0678] Step ST201:

[0679] When an application program AP_1 being executed issues a communication request for writing data to AP_2, the processing of step ST202 is performed.

[0680] Step ST202:

[0681] The communication request issued at step ST201 is received by the inter-AP communication task 274.

[0682] Step ST203:

[0683] The inter-AP communication task 274 views the inter-AP communication data 232 shown in FIG. 39 and judges if the application program AP_1 can communicate with the AP_2.

[0684] Step ST204:

[0685] When the inter-AP communication task 274 judges at step ST203 that communication is possible, it executes the processing of step ST205 while when it does not, it ends the processing.

[0686] In this example, from FIG. 39, the application program AP_1 can communicate with the AP_2, so the processing of step ST205 is executed.

[0687] Step ST205:

[0688] Under the control of the inter-AP communication task 274, the application program AP_1 writes data in the inter-AP communication storage area 233 shown in FIG. 37.

[0689] Step ST206:

[0690] The inter-AP communication task 274 notifies the fact of the data being written to the application program AP_2.

[0691] Step ST207:

[0692] The application program AP_2 reads data from the inter-AP communication storage area 233 in accordance with the notification received at step ST206.

[0693] Due to this, communication between the application programs AP_1 and AP_2 relayed through the firewalls is completed.

[0694] The inter-SAM communication task 275, as shown in FIG. 44, in accordance with need, can for example start up the inter-SAM communication task 275 of an SAM chip 208x outside of the SAM chip 208 and issue a remote command to the inter-SAM communication task 275 of that SAM chip 208x.

[0695] Such a remote command is issued by the inter-SAM communication task 275 of the SAM chip 208 to the inter-SAM communication task 275 of the SAM chip 208x to request that the SAM chip 208x execute at least part of the processing assigned to the SAM chip 208 when for example the processing load of the SAM chip 208 becomes large and it cannot suitably perform the processing.

[0696] Next, the overall operation of the communication system 201 shown in FIG. 33 will be explained.

[0697] FIG. 45 is a view for explaining the overall operation of the communication system 201 shown in FIG. 33.

[0698] Step ST231:

[0699] The businesses 215_1 to 215_3 or a party requested by these businesses produce application programs AP_1, AP_2, and AP_3 for those businesses to perform processing for transactions using the IC card 203 on the personal computers 216_1, 216_2, and 216_3 shown in FIG. 33.

[0700] Step ST232:

[0701] The application programs AP_1, AP_2, and AP_3 are downloaded through the authentication units 217_1, 217_2, and 217_3 from the personal computers 216_1, 216_2, and 216_3 to the SAM chip 208.

[0702] Step ST233:

[0703] The user is issued the IC card 203.

[0704] As shown in FIG. 36, the IC 203a of the IC card 203 stores the key information used for transactions with a business which the user has contracted with.

[0705] Note that the contract between the user and a business may be concluded after issuance of the IC card 203 through the Internet 210 etc.

[0706] Step ST234:

[0707] For example, when a user desires to use the personal computer 205 to access the server 202 through the Internet 210 and purchase a product, the server 202 issues a processing request through the Internet 210 to the ASP server 206.

[0708] When the ASP server 206 receives a processing request from the server 202, it accesses the personal computer 205 through the Internet 210. Further, the processing request for the IC card 203 issued by the card reader/writer 204 is sent through the personal computer 205, Internet 210, and ASP server 206 to the SAM chip 208.

[0709] Step ST235:

[0710] The SAM chip 208, in accordance with the processing request received at step ST234, selects the application program by the settlement processing routine task 273 and executes the selected application program.

[0711] In the execution of that application program, any communication performed between application programs is performed by the inter-AP communication task 274 as shown in the above-mentioned FIG. 43.

[0712] Step ST236:

[0713] The SAM chip 208 outputs the results of execution of the application program to the ASP server 206.

[0714] As explained above, according to the communication system 201, as shown in FIG. 34 and FIG. 37, the application programs AP_1, AP_2, and AP_3 are restricted from accessing each other by firewalls, so it is possible to prevent application programs from being illicitly monitored and tampered with. Further, it is possible to improve the confidentiality of each application program.

[0715] Further, according to the communication system 201, by the inter-AP communication task 274 shown in FIG. 41 using the AP management storage area 221 of the external memory 207 shown in FIG. 37 to perform the processing shown in FIG. 43, communication between application programs is allowed in a preallowed range.

[0716] Therefore, it is possible to provide diverse services by synchronization and cooperation of a plurality of application programs.

[0717] As such a diverse service, for example, there is the automatic selection of application programs by the settlement processing routine task 273 shown in FIG. 41. That is, while the same level of computation content, for settlement processing differing in settlement protocol according to the issuer of the IC card 203, if the type of the IC card 203 is known, the corresponding application program can be automatically determined. Therefore, by registering the settlement processing at the level of the settlement processing routine task 273, the type of the IC card 203 and the corresponding application program can be automatically determined. Due to this, the load on the developer of the application program can be lightened.

[0718] Further, according to the communication system 201, since the information stored in the external memory 207 is scrambled by the bus scramble unit 262 of the SAM chip 208 shown in FIG. 40, there is confidentiality with respect to analysis from the outside.

[0719] Further, according to the communication system 201, by the provision of the inter-SAM communication task 275 shown in FIG. 41, it is possible to disperse the processing load of the SAM chip 208 to other SAM chips. Therefore, when mounting the SAM chip 208 in a store server etc. which has to simultaneously handle processing requests for settlement processing from a plurality of terminal apparatuses, it is possible to use the function of the inter-SAM communication task 275 to improve the settlement processing capability using a plurality of SAM chips 208.

[0720] FIG. 46 is a functional block diagram showing more specifically the function blocks of the SAM chip 208 shown in FIG. 40.

[0721] As shown in FIG. 46, the SAM chip 208 is connected through an internal bus 290 to the ASPS communication interface unit 260, external memory communication interface unit 261, bus scramble unit 262, encryption/decryption unit 265, storage unit 266, and CPU 267.

[0722] Part of the functions of the signature processing unit 263 and authentication processing unit 264 shown in FIG. 40 are for example realized by the CPU 267.

[0723] The SAM chip 208 shown in FIG. 46, for example as shown in FIG. 47, may also connect the card I/F unit 291 connected to the internal bus 290 to an RF reception/transmission unit 292 outside of the SAM chip 208 and transfer data with the IC card 203 by a noncontact system through an antenna 292a of the RF reception/transmission unit 292.

[0724] Fourth Embodiment

[0725] This embodiment is an embodiment corresponding to the 13th to 16th aspects of the invention.

[0726] FIG. 48 is a view of the overall configuration of the communication system 301 of the present embodiment.

[0727] As shown in FIG. 48, the communication system 301 uses the server 302, IC card 303 (integrated circuit of the present invention), card reader/writer 304, personal computer 305, ASP (application service provider) server 306, SAM (secure application module) unit 309, personal computers 316_1, 316_2, 316_3, 316_4, and 316_5, authentication units 317_1, 317_2, 317_3, 317_4, and 317_5 (authentication apparatuses of the present invention), and the ICE (in-circuit emulator) 318 to communicate through the Internet 310 and develop or customize software of the SAM chip 308, perform settlement processing using the IC card 303, etc.

[0728] The SAM unit 309 has an external memory 307 (semiconductor storage circuit of the present invention) and SAM chip 308 (semiconductor circuit of the present invention).

[0729] The SAM chip 308 has a software configuration such as shown in FIG. 49.

[0730] As shown in FIG. 49, the SAM chip 308 has, from the lower layer to the upper layer, an HW (hardware) layer, OS layer, lower handler layer, higher handler layer, and application (AP) layer in that order.

[0731] The lower handler layer is a layer defining the processing not dependent on the application program and corresponds to the transport layer, network layer, and data link layer in the OSI protocol.

[0732] The lower handler layer includes a driver layer.

[0733] The driver layer is a layer performing processing relating to the operation of the LSI.

[0734] The higher handler layer is a layer defining the processing dependent on the application program and corresponds to a layer higher than the transport layer in OSI protocol.

[0735] Here, the OS layer corresponds to the first layer of the present invention, the lower handler layer, driver layer, and higher handler layer correspond to the second layer of the present invention, and the AP layer corresponds to the third layer of the present invention.

[0736] The AP layer includes the application programs AP_1, AP_2, and AP_3 defining the procedures for use of the IC card 303 by credit card companies and other businesses 315_AP1, 315_AP2, and 315_AP3 shown in FIG. 48.

[0737] In the AP layer, the application programs AP_1, AP_2, and AP_3 and the higher handler layer are provided between them with firewalls FW (firewalls of the present invention).

[0738] In the software configuration shown in FIG. 49, the AP layer defines processing specific to each business, for example, the content of settlement processing using the IC card 303. The processing for directly operating the IC card 303 is defined by the layers of the higher handler layer on down.

[0739] The SAM chip 308 is connected with the ASP server 306 through a SCSI port, the Ethernet, etc.

[0740] The ASP server 306 is connected through the Internet 310 with the personal computers 305, 316_1, 316_2, 316_3, 316_4, and 316_5.

[0741] The personal computer 316_1 is used by the business 315_AP1 of the application program AP_1 executed by the SAM chip 308.

[0742] The personal computer 316_2 is used by the business 315_AP2 of the application program AP_1 executed by the SAM chip 308.

[0743] The personal computer 316_3 is used by the business 315_AP3 of the application program AP_1 executed by the SAM chip 308.

[0744] The personal computer 316_4 is used by the software developer 315_MID able to develop a higher handler layer and lower handler layer including the driver layer shown in FIG. 49 of the SAM chip 308.

[0745] The personal computer 316_5 is used by the manufacturer of the SAM chip 308, that is, the software developer 315_SUP having the right to manage the SAM chips 308 as a whole.

[0746] The businesses 315_AP1, 315_AP2, and 315_AP3 use the personal computers 316_1, 316_2, and 316_3 to produce the application programs AP_1, AP_2, and AP_3 and download the produced application programs through the authentication units 317_1, 317_2, and 317_3 to storage areas allocated in advance in the external memory 307 through the SAM chip 308.

[0747] At this time, the businesses 315_AP1, 315_AP2, and 315_AP3 are parties with no relation with each other, so the storage areas in the external memory 307 to which the application programs AP_1, AP_2, and AP_3 can be downloaded are determined in advance. Whether or not one has the right to download to such a storage area is verified by the SAM chip 308.

[0748] Further, during execution of the application programs AP_1, AP_2, and AP_3, the firewalls FW restrict the transfer and viewing of data between the application programs AP_1, AP_2, and AP_3.

[0749] The software developer 315_MID downloads a predetermined program into the SAM chip 308 through the authentication unit 317_4 in accordance with need to customize the higher handler layer and lower handler layer including the driver layer shown in FIG. 49 of the SAM chip 308 etc.

[0750] Further, the software developer 315_SUP_downloads a predetermined program into the SAM chip 308 through the authentication unit 317_5 to customize all of the layers shown in FIG. 49.

[0751] The authentication units 317_1 to 317_5, as explained later, mutually authenticate and produce download signature verification key information etc. with the SAM chip 308 when downloading a predetermined program from the personal computers 316_1 to 316_5 to the SAM chip 308.

[0752] The personal computer 305, for example, is used by the owner of the IC card 303, that is, the end user.

[0753] The personal computer 305, for example, is connected through a serial port or USB port to a Dumb type card reader/writer 304. The card reader/writer 304 realizes for example wireless communication corresponding to the physical level with the IC card 303.

[0754] The operational commands to the IC card 303 and the response packets from the IC card 303 are generated and analyzed at the SAM unit 309 side. Therefore, the card reader/writer 304, personal computer 305, and ASP server 306 interposed between them only act to store the commands or response contents in the data payload portions and relay the same. They are not involved in the encryption or decryption of data, authentication, or other operations in the IC card 303.

[0755] Further, the ICE 318 is an emulator used when debugging a program running on the SAM chip 308.

[0756] Next, the components shown in FIG. 48 will be explained.

[0757] IC Card 303

[0758] The IC card 303 stores the key information etc. necessary for the settlement processing using the SAM chip 308.

[0759] Authentication Units 317_1 to 317_5

[0760] FIG. 50 is a functional block diagram of the authentication unit 317_1.

[0761] As shown in FIG. 50, the authentication unit 317_1 has a storage unit 350_1 and processing unit 351_1.

[0762] As shown in FIG. 50, the storage unit 350_1 stores a SAM_ID, mutual authentication master key information K1, and access master key information KA.

[0763] The SAM_ID is identification information of the SAM chip 308.

[0764] The mutual authentication master key information K1 is, as explained later, used for generating mutual authentication key information K2.

[0765] The access master key information KA, as explained later, is used for generating download signature information used when downloading a program in the external memory 307.

[0766] The access master key information KA is key information necessary for downloading to the external memory 307 a program of the AP layer of the software structure of the SAM chip 308 shown in FIG. 49.

[0767] The processing unit 351_1, as shown in FIG. 50, has a mutual authentication unit 352_1 and download processing unit 353_1.

[0768] The mutual authentication unit 352_1, as shown in FIG. 51, when downloading a program to the external memory 307, encrypts the SAM_ID as plain text using the mutual authentication master key information K1 to generate the mutual authentication key information K2 and uses that mutual authentication key information K2 for mutual authentication with the SAM chip 308.

[0769] The download processing unit 353_1, when downloading a program to the external memory 307, as shown in FIG. 52, encrypts the SAM_ID as plain text using the access master key information KA to generate the download key information K_DA. Further, the download processing unit 353_1 uses the download key information K_DA to generate the download signature information and transmits it to the SAM chip 308.

[0770] The authentication units 317_2 and 317_3 are configured the same as the above explained authentication unit 317_1. However, for example, the content of the access master key information KA differs for each authentication unit.

[0771] FIG. 53 is a functional block diagram of the authentication unit 317_4.

[0772] As shown in FIG. 53, the authentication unit 317_4 has a storage unit 350_4 and processing unit 351_4.

[0773] As shown in FIG. 53, the storage unit 350_4 stores a SAM_ID, mutual authentication master key information K1, and access master key information KA and KM.

[0774] The SAM_ID, mutual authentication master key information K1, and access master key information KA are the same as those explained above.

[0775] The access master key information KM is key information for downloading a program of the higher handler layer and the lower handler layer including the driver layer of the software structure of the SAM chip 308 shown in FIG. 49 to the external memory 307 or SAM chip 308.

[0776] The processing unit 351_4, as shown in FIG. 53, has a mutual authentication unit 352_4 and download processing unit 353_4.

[0777] The mutual authentication unit 352_4 is the same as the mutual authentication unit 352_1 explained in FIG. 51.

[0778] The download processing unit 353_4, when downloading a program to the external memory 307, as shown in FIG. 54, encrypts the SAM_ID as plain text using the access master key information KA to generate the download key information K_DA. Next, the download processing unit 353_4 encrypts the download key information K_DA as plain text using the access master key information KM to generate the download key information K_DM. Next, the download processing unit 353_4 uses the download key information K_DM to generate the download signature information and transmits it to the SAM chip 308.

[0779] FIG. 55 is a functional block diagram of the authentication unit 317_5.

[0780] As shown in FIG. 55, the authentication unit 317_5 has a storage unit 350_5 and processing unit 351_5.

[0781] As shown in FIG. 55, the storage unit 350_5 stores a SAM_ID, mutual authentication master key information K1, and access master key information KA, KM, and KS.

[0782] The SAM_ID, mutual authentication master key information K1, and access master key information KA and KM are the same as those explained above.

[0783] The access master key information KS is the key information required for downloading a program of the OS layer of the software structure of the SAM chip 308 shown in FIG. 49 to the external memory 307 or SAM chip 308.

[0784] The processing unit 351_5, as shown in FIG. 55, has a mutual authentication unit 352_5 and download processing unit 353_5.

[0785] The mutual authentication unit 352_5 is the same as the mutual authentication unit 352_1 shown in the above-mentioned FIG. 51.

[0786] The download processing unit 353_5, when downloading a program to the external memory 307, as shown in FIG. 56, encrypts the SAM_ID as plain text using the access master key information KA to generate the download key information K_DA. Next, the download processing unit 353_5 encrypts the download key information K_DA as plain text using the access master key information KM to generate the download key information K_DM. Next, the download processing unit 353_5 encrypts the download key information K_DM as plain text using the access master key information KS to generate the download key information K_DS. Next, the download processing unit 353_5 uses the download key information K_DS to generate the download signature information and transmits this to the SAM chip 308.

[0787] In the present embodiment, the authentication units 317_1, 317_4, and 317_5 store information in the storage units 350_1, 350_4, and 350_5 in a secure state. When these units are destroyed by outside factors or forced open, this is detected by a detection unit and the information stored in the storage units 350_1, 350_4, and 350_5 is deleted.

[0788] SAM Unit 309

[0789] [External Memory 307]

[0790] FIG. 57 is a view for explaining the storage areas of the external memory 307.

[0791] As shown in FIG. 57, the storage areas of the external memory 307 include an AP storage area 320_1 in which the application program AP_1 of the business 315_1 is stored, an AP storage area 320_2 in which the application program AP_2 of the business 315_2 is stored, an AP storage area 320_3 in which the application program AP_3 of the business 315_3 is stored, and an AP management storage area 321 used by the manager of the SAM chip 308.

[0792] The application program AP_1 stored in the AP storage area 320_1 is comprised of a plurality of program modules. Access to the AP storage area 320_1 is restricted by the firewall FW_1.

[0793] The application program AP_2 stored in the AP storage area 320_2 is comprised of a plurality of program modules. Access to the AP storage area 320_2 is restricted by the firewall FW_2.

[0794] The application program AP_3 stored in the AP storage area 320_3 is comprised of a plurality of program modules. Access to the AP storage area 120_3 is restricted by the firewall FW_3.

[0795] In the present embodiment, the above program module is the minimum unit downloaded for example from the outside of the SAM unit 309 to the external memory 307. The number of the program modules forming each application program can be freely determined by the corresponding business.

[0796] Further, the application programs AP_1, AP_2, and AP_3 stored in the external memory 307 are scrambled. They are descrambled when read into the SAM chip 308.

[0797] Further, the application programs AP_1, AP_2, and AP_3 are, for example, produced by the businesses 315_1, 315_2, and 315_3 using the personal computers 316_1, 316_2, and 316_3 shown in FIG. 48 and are downloaded through the SAM chip 308 to the external memory 307.

[0798] Access to the AP management storage area 321 is restricted by the firewall FW_4.

[0799] Note that the firewalls FW_1, FW_2, FW_3, and FW_4 correspond to the firewalls FW shown in FIG. 49.

[0800] The AP management storage area 321 stores the AP management data 330.

[0801] The AP management data 330 includes for example the SAM_ID, mutual authentication key information K2 (or mutual authentication master key information K1), and download signature verification key information K_DA, KDVM, and KDVS.

[0802] Here, the download signature verification key information K_DVA is key information for verifying the legitimacy of the signature information generated using the download key information K_DA.

[0803] The download signature verification key information K_DVM is key information for verifying the legitimacy of the signature information generated using the download key information K_DM.

[0804] The download signature verification key information K_DVS is key information for verifying the legitimacy of the signature information generated using the download key information K_DS.

[0805] The download signature verification key information is key information used for signature verification performed when downloading that program module through the SAM chip 308 to the external memory 307.

[0806] [SAM Chip 308]

[0807] FIG. 58 is a functional block diagram of the SAM chip 308 shown in FIG. 48.

[0808] As shown in FIG. 58, the SAM chip 308 has an ASPS communication interface unit 360, external memory communication interface unit 361, bus scramble unit 362, encryption/decryption unit 363, storage unit 364, and CPU 365.

[0809] The SAM chip 308 is a tamper-resistant module.

[0810] The ASPS communication interface unit 360 is an interface used for input and output of data with the ASP server 306 shown in FIG. 48.

[0811] The external memory communication interface unit 361 is an interface used for input and output of data with the external memory 307.

[0812] The bus scramble unit 362 scrambles output data and descrambles input data when inputting and outputting data through the external memory communication interface unit 361.

[0813] The encryption/decryption unit 363 encrypts data and decrypts encrypted data.

[0814] The storage unit 364 stores data used for the processing by the CPU 365.

[0815] The CPU 365 executes various processing including execution of an application program by the SAM chip 308 based on a predetermined program (program of the present invention) in the form of tasks etc.

[0816] The CPU 365, for example, executes a download task 365a for performing processing for downloading program modules through the Internet 310.

[0817] Next, the download operation of program modules by the download task 365a of the CPU 365 will be explained.

[0818] FIG. 59 is a flow chart for explaining that download operation.

[0819] In the following embodiment, the explanation will be given of the operation when a business 315_AP1 downloads program modules of the application program AP_1 shown in FIG. 49 and FIG. 57.

[0820] Step ST301:

[0821] The personal computer 316_1 shown in FIG. 48 transmits a download request designating the module name of each program module to be downloaded comprising the application program AP_1 through the authentication unit 317_1, Internet 310, ASP server 306, and ICE 318 to the SAM chip 308.

[0822] Step ST302:

[0823] The mutual authentication unit 352_1 of the processing unit 351_1 of the authentication unit 317_1, as shown in FIG. 51, encrypts the SAM_ID as plain text using the mutual authentication master key information K1 to generate the mutual authentication key information K2.

[0824] Step ST303:

[0825] The mutual authentication unit 352_1 of the processing unit 351_1 of the authentication unit 317_1 performs mutual authentication with the download task 365a of the CPU 365 of the SAM chip 308 using the mutual authentication key information K2 generated at step ST302.

[0826] Step ST304:

[0827] When the mutual legitimacy in the mutual authentication of step ST303 is confirmed, the unit proceeds to the processing of step ST305, while when not, it ends the processing.

[0828] Step ST305:

[0829] The download processing unit 353_1 of the processing unit 351_1 of the authentication unit 317_1 shown in FIG. 50, as shown in FIG. 52, encrypts the SAM_ID as plain text using the access master key information KA to generate the download key information K_DA.

[0830] Step ST306:

[0831] The download processing unit 353_1 uses the download key information K_DA generated at step ST305 to generate the download signature information.

[0832] Step ST307:

[0833] The download processing unit 353_1 transmits the download signature information generated at step ST306 to the SAM chip 308.

[0834] Step ST308:

[0835] The download task 365a of the CPU 365 of the SAM chip 308 shown in FIG. 58 uses the download signature verification key information K_DVA shown in FIG. 57 to judge the legitimacy of the download signature information received at step ST307.

[0836] At this time, the download task 365a judges if the download request has been made at the AP layer based on the module names received at step ST301 and specifies the download signature verification key information K_DVA.

[0837] Step ST309:

[0838] If it is judged at step ST308 that the download signature information is legitimate, the task proceeds to the processing of step ST310, while if not, it ends the processing.

[0839] Step ST310:

[0840] The download task 365a of the CPU 365 of the SAM chip 308 shown in FIG. 58 specifies the address in the external memory 307 corresponding to a module name designated at step ST301 by viewing the module management data 330 and downloads the program module received from the personal computer 316_1 to that specified address on the external memory 307.

[0841] Note that when the software developer 315_MID downloads program modules of the higher handler layer and lower handler layer shown in FIG. 49 to the external memory 307, at step ST305, the download key information K_DM is generated by the routine explained using FIG. 54. Using this, at step ST306, the download signature information is generated. Further, at step ST308, in the SAM chip 308, the download signature verification key information K_DVM shown in FIG. 57 is used to verify the download signature information.

[0842] Further, when the software developer 315_SUP downloads a program module of the OS layer shown in FIG. 49 to the external memory 307, at step ST305, the routine explained using FIG. 56 is used to generate the download key information K_DS. Using this, at step ST306, the download signature information is generated. Further, at step ST308, in the SAM chip 308, the download signature verification key information K_DVS shown in FIG. 57 is used to verify the download signature information.

[0843] Note that the software developers 315_MID and 315_SUP can use the access master key information KA to download the program module of the AP layer to the external memory 307.

[0844] Further, the software developer 315_SUP can use the access master key information KA and KM to download program modules of the higher handler layer and lower handler layer to the external memory 307.

[0845] Next, the processing for a transaction using the IC card 303 by the communication system 301 shown in FIG. 48 will be explained.

[0846] FIG. 60 is a view for explaining the overall operation of the communication system 301 shown in FIG. 48.

[0847] Step ST331:

[0848] The businesses 315_1 to 315_3 or a part requested by these businesses produce application programs AP_1, AP_2, and AP_3 for those businesses to perform processing for transactions using the IC card 303 on the personal computers 316_1, 316_2, and 316_3 shown in FIG. 48.

[0849] At this time, download processing explained using FIG. 59 is performed.

[0850] Step ST332:

[0851] The application programs AP_1, AP_2, and AP_3 are downloaded through the authentication units 317_1, 317_2, and 317_3 from the personal computers 316_1, 316_2, and 316_3 to the SAM chip 308.

[0852] At this time, the processing explained using FIG. 56 is performed.

[0853] Step ST333:

[0854] The user is issued the IC card 303.

[0855] The IC card 303 stores the key information used for transactions with a business which the user has contracted with.

[0856] Note that the contract between the user and a business may be concluded after issuance of the IC card 303 through the Internet 310 etc.

[0857] Step ST334:

[0858] For example, when a user desires to use the personal computer 305 to access the server 302 through the Internet 310 to purchase a product, the server 302 issues a processing request through the Internet 310 to the ASP server 306.

[0859] When the ASP server 306 receives a processing request from the server 302, it accesses the personal computer 305 through the Internet 310. Further, the processing request for the IC card 303 issued by the card reader/writer 304 is sent through the personal computer 305, Internet 310, and ASP server 306 to the SAM chip 308.

[0860] Step ST335:

[0861] The SAM chip 308, in accordance with the processing request received at step ST334, selects an application program by the settlement processing routine task and executes the selected application program.

[0862] Step ST336:

[0863] The SAM chip 308 outputs the result of execution of the application program to the ASP server 306.

[0864] As explained above, according to the communication system 301, by the authentication units 317_1, 317_2, and 317_3 holding the access master key information KA, the authentication unit 317_4 holding the access master key information KM, the authentication unit 317_5 holding the access master key information KS, and, as explained above, performing processing for downloading a program module to the external memory 307, it becomes possible to download a program modules in accordance with rights given in accordance with the software hierarchy shown in FIG. 49. Therefore, it is possible to prevent an unauthorized party from illicitly exchanging or tampering with program modules to be executed by the SAM chip 308.

[0865] Further, according to the communication system 301, as explained earlier, the authentication units 317_1, 317_4, and 317_5 store information in a secure state in the storage units 350_1, 350_4, and 350_5. When such a unit is destroyed by an external factor or forced open, this is detected by a detection unit and the stored information in the storage units 350_1, 350_4, and 350_5 is deleted. Therefore, illicit use of the key information used for downloading to the SAM chip 308 can be avoided.

[0866] Further, according to the communication system 301, when the SAM chip 308 operates a plurality of application programs, since data transfer or viewing of data and codes between application programs is restricted by the firewalls FW_1, FW_2, and FW_3, illicit interference or tampering with the processing of each application program by another application program can be prevented. Further, it is possible to enhance the secrecy of each application program.

[0867] Further, according to the communication system 301, by configuring each application program by a plurality of program modules, it is possible to download to the external memory 307 in program modules units.

[0868] Further, according to the communication system 301, by encrypting the highly confidential key information used for operation of the IC card 303 in addition to the usual scrambling and storing it in the external memory 307, it is possible to improve the security level of the key information.

[0869] Further, according to the Internet 301, the application program can execute encryption and decryption when accessing codes by the bus scramble function, so it is possible to prevent an application program stored in the external memory 307 from being illicitly analyzed etc. while processing of the SAM chip 308 is halted.

[0870] FIG. 61 is a functional block diagram showing more specifically the function blocks of the SAM chip 308 shown in FIG. 58.

[0871] As shown in FIG. 61, the SAM chip 308 is connected through an internal bus 390 to the ASPS communication interface unit 360, external memory communication interface unit 361, bus scramble unit 362, encryption/decryption unit 365, storage unit 364, and CPU 366.

[0872] In the SAM chip 308 shown in FIG. 61, for example as shown in FIG. 62, it is also possible to connect the card I/F unit 391 connected to the internal bus 390 to an RF reception/transmission unit 392 outside of the SAM chip 308 and transfer data with the IF card 303 by a noncontact system through an antenna 392a of the RF reception/transmission unit 392.

[0873] The present invention is not limited to the above explained embodiment.

[0874] For example, in the above explained embodiment, the case of downloading program modules from the personal computers 316_1 to 316_5 through the SAM chip 308 to the external memory 307 was illustrated, but the present invention can similarly be applied using the function of the above explained download task 365a even when downloading program modules from the personal computers 316_1 to 316_5 to a storage unit 364 in the SAM chip 308.

[0875] Further, in the above explained embodiment, the case of providing the authentication units 317_1 to 317_5 for the Internet 310 at the personal computer 316_1 to 316_6 side was illustrated, but as shown in FIG. 63, it is also possible to provide the authentication units 317_1 to 317_5 in the SAM chip 308 and allow access to the authentication units 317_1 to 317_5 to the corresponding personal computers 316_1 to 316_5.

[0876] Fifth Embodiment

[0877] The present embodiment is an embodiment corresponding to the 17th and 18th aspects of the invention.

[0878] FIG. 64 is a view of the overall configuration of the communication system 401 of the present embodiment.

[0879] As shown in FIG. 64, the communication system 401 uses the server 402, IC card 403, card reader/writer 404, personal computer 405, ASP (application service provider) server 406, SAM (secure application module) unit 409, personal computers 416_1, 416_2, and 416_3, and authentication units 417_1, 417_2, and 417_3 to communicate through the Internet 410 and perform settlement processing or other processing for a procedure using the IC card 403.

[0880] The SAM unit 409 has an external memory 407 and SAM chip 408.

[0881] The SAM chip 408 has a software configuration shown in FIG. 65. As shown in FIG. 65, the SAM chip 408 has, from a bottom layer toward a top layer, an HW (hardware) layer, OS layer, lower handler layer, higher handler layer, and AP layer.

[0882] The lower handler layer includes a driver layer.

[0883] Here, the AP layer includes application programs AP_1, AP_2, and AP_3 defining procedures for use of the IC card 403 by credit card companies or other businesses 415_1, 415_2, and 415_3 shown in FIG. 64.

[0884] In the AP layer, the application programs AP_1, AP_2, and AP_3 and the higher handler layer are provided between them with firewalls FW.

[0885] The SAM chip 408 is connected through a bus 419 using a SCSI port, the Ethernet, etc. to the ASP server 406. The ASP server 406 is connected through the Internet 410 to a plurality of terminal apparatuses including a personal computer 405 of the end user and personal computers 416_1, 416_2, and 416_3 of the businesses 415_1, 415_2, and 415_3.

[0886] The personal computer 405, for example, is connected through a serial port or USB port to a Dumb type card reader/writer 404. The card reader/writer 404 realizes for example wireless communication corresponding to the physical level with the IC card 403.

[0887] Operational commands to the IC card 403 and response packets from the IC card 403 are generated and analyzed at the SAM unit 409 side. Therefore, the card reader/writer 404, personal computer 405, and ASP server 406 interposed between them only act to store the commands or response content in data payload portions and relay the same. They are not involved in encryption or decryption of data, authentication, and other actual operations in the IC card 403.

[0888] The businesses 415_1, 415_2, and 415_3 use the personal computers 416_1, 416_2, and 416_3 to produce the application programs AP_1, AP_2, and AP_3 and download the produced application programs through the authentication units 417_1, 417_2, and 417_3 through the SAM chip 408 to preassigned storage areas in the external memory 407.

[0889] At this time, since the businesses 415_1, 415_2, and 415_3 have no relation with each other, the storage areas in the external memory 407 where the application programs AP_1, AP_2, and AP_3 can be downloaded are decided in advance and whether one has the right to download to such a storage area is verified by the SAM chip 408.

[0890] Further, the transfer and viewing of data among the application programs AP_1, AP_2, and AP_3 are restricted by the firewalls FW.

[0891] When downloading the application programs AP_1, AP_2, and AP_3 to the SAM chip 408, the authentication units 417_1, 417_2, and 417_3, as explained later, perform mutual authentication with the SAM chip 408, produce the download signature verification key information, etc.

[0892] Next, the SAM unit 409 shown in FIG. 64 will be explained in detail.

[0893] External Memory 407

[0894] FIG. 66 is a view for explaining the storage areas of the external memory 407.

[0895] As shown in FIG. 66, the storage areas of the external memory 407 include an AP storage area 420_1 for storing the application program AP_1 of the business 415_1, an AP storage area 420_2 for storing the application program AP_2 of the business 415_2, an AP storage area 420_3 for storing the application program AP_3 of the business 415_3, and an AP management storage area 421 used by the manager of the SAM chip 408.

[0896] The application program AP_1 stored in the AP storage area 420_1 is comprised of a plurality of program modules. Access to the AP storage area 420_1 is restricted by the firewall FW_1.

[0897] The application program AP_2 stored in the AP storage area 420_2 is comprised of a plurality of program modules. Access to the AP storage area 420_2 is restricted by the firewall FW_2.

[0898] The application program AP_3 stored in the AP storage area 420_3 is comprised of a plurality of program modules. Access to the AP storage area 420_3 is restricted by the firewall FW_3.

[0899] In the present embodiment, the above program module is the minimum unit downloaded for example from the outside of the SAM unit 409 to the external memory 407. The number of the program modules forming each application program can be freely determined by the corresponding business.

[0900] Further, the application programs AP_1, AP_2, and AP_3 are, for example, produced by the businesses 415_1, 415_2, and 415_3 using the personal computers 416_1, 416_2, and 416_3 shown in FIG. 64 and are downloaded through the SAM chip 408 to the external memory 407.

[0901] Access to the AP management storage area 421a is allowed only by the manager of the SAM chip 408 by the firewall FW_4.

[0902] Note that the firewalls FW_1, FW_2, FW_3, and FW_4 correspond to the firewalls FW shown in FIG. 65.

[0903] The AP management storage area 421 stores the module management data 421 shown in FIG. 66.

[0904] Here, the AP management data 421 is used by the SAM chip 408 for managing execution of the application programs AP_1, AP_2, and AP_3.

[0905] In the present embodiment, the application programs AP_1, AP_2, and AP_3 and AP management data 421 stored in the external memory 407 are, as explained later, scrambled by the bus scramble unit 461 in the SAM chip 408 using the scramble key K. When read into the SAM chip 408, they are descrambled using the scramble key K.

[0906] SAM Chip 408

[0907] FIG. 67 is a functional block diagram of the SAM chip 408 shown in FIG. 64.

[0908] As shown in FIG. 67, the SAM chip 408 has an ASPS communication interface unit 460, bus scramble unit 461, signature processing unit 462, authentication processing unit 463, encryption/decryption unit 464, storage unit 465, and CPU 466.

[0909] The SAM chip 408 is a tamper-resistant module.

[0910] Here, the CPU 466 corresponds to the data processing circuit of the present invention, while the bus scramble unit 461 corresponds to the data input/output circuit of the present invention.

[0911] Further, the SAM chip 408 corresponds to the semiconductor circuit of the present invention, while the external memory 407 corresponds to the semiconductor storage circuit of the present invention.

[0912] The ASPS communication interface unit 460 is an interface used for input and output of data with the ASP server 406 shown in FIG. 64.

[0913] The bus scramble unit 461 scrambles data to be written in the external memory 407 and descrambles data read from the external memory 407.

[0914] That is, the external memory 407 stores data in a scrambled state.

[0915] The processing of the bus scramble unit 461 will be explained in detail later.

[0916] The signature processing unit 462, as explained later, produces a signature and verifies a signature when downloading an application program through the Internet 410 and when executing an application program.

[0917] The authentication processing unit 463 as explained later performs mutual authentication with the other party when downloading an application program through the Internet 410 to the external memory 407.

[0918] The encryption/decryption unit 464 encrypts data and decrypts encrypted data.

[0919] The storage unit 465 for example stores the data necessary for the processing of the CPU 466.

[0920] The CPU 466 executes the application programs AP_1, AP_2, and AP_3 while accessing the external memory 407 through the bus scramble unit 461 and performs various processing corresponding to the services of the SAM chip 408.

[0921] Next, the processing of the bus scramble unit 461 will be explained in detail.

[0922] Note that, in the present embodiment, the case of use of the bus scramble unit 461 when accessing the external memory 407 is illustrated, but the bus scramble unit 461 can also be applied in the case of inputting and outputting data with the outside by another SAM chip 408 through an I/O bus etc.

[0923] The bus scramble unit 461 encrypts the data input from the CPU 466 using a predetermined scramble key K, then writes it through the bus 419 in the external memory 407.

[0924] Further, the bus scramble unit 461 decrypts the data read through the bus 419 from the external memory 407 using the scramble key K and outputs it to the CPU 466.

[0925] [Address Space]

[0926] The encryption block length of the encryption algorithm used by the bus scramble unit 461 is made Nc, while the data bus width of the bus 419 is made Nb. In the following example, consider the case where Nc is a whole multiple of Nb, that is, a whole number n (=Nc/Nb).

[0927] Note that the address space of the CPU 466 (address space in SAM chip 408) and the address space used when the bus scramble unit 461 accesses the external memory 407 (hereinafter also referred to as the “external memory address space”) differ due to the addition of parity and scrambling of the address.

[0928] Therefore, the bus scramble unit 461, as shown in FIG. 68, converts an address CPU_ADR input from the CPU 466 (first address of the present invention) to an address MEM_ADR of the external memory address space (second address of the present invention) using a predefined map f (address conversion algorithm). The bus scramble unit 461 uses the address MEM_ADR to access the external memory 407.

[0929] This map f, for example, as shown in FIG. 69, is defined only when the address a1, which is an address CPU_ADR, is “a1 mod Nc/Nb=0”. For the other address a2, the external memory 407 is accessed by f (a2−(a2 mod Nc/Nb)).

[0930] Here, “x mod y” is the remainder after dividing x by y.

[0931] That is, the bus scramble unit 461 reads and writes data with the external memory 407 in units of the encryption block length Nc.

[0932] Here, when Nc/Nb=n and the smallest whole number of n or more is m, the bus scramble unit 461 performs transactions accessing the external memory 407 through the bus 419 (data input/output transactions of the present invention) in units of m number of transactions.

[0933] [Configuration of Bus Scramble Unit 461]

[0934] FIG. 70 is a functional block diagram of the bus scramble unit 461.

[0935] As shown in FIG. 70, the bus scramble unit 461 has an encryption unit 431, decryption unit 432, address management unit 433, scramble key management unit 434, parity processing unit 435, pipeline processing control unit 436, work memory 437, and control unit 438.

[0936] The encryption unit 431 encrypts data input from the CPU 466 using a predetermined scramble key K.

[0937] The decryption unit 432 decrypts data read from the external memory 407 using the predetermined scramble key K.

[0938] The address management unit 433 converts the address CPU_ADR input from the CPU 466 to the address MEM_ADR explained above.

[0939] The scramble key management unit 434 manages the scramble key K used at the encryption unit 431 and decryption unit 432 and suitably switches the scramble key K.

[0940] The parity processing unit 435 adds parity data to the data to be written in the external memory 407 and verifies the parity data added to data read from the external memory 407.

[0941] The pipeline processing control unit 436 divides the processing of the bus scramble unit 461 into a plurality of stages and controls the system so that the pipeline processing is performed in units of stages.

[0942] The work memory 437 is used for the processing of the bus scramble unit 461.

[0943] The control unit 438 comprehensively controls the processing of the bus scramble unit 461.

[0944] [Write Operation to External Memory 407]

[0945] FIG. 71 is a view for explaining the operation of the bus scramble unit 461 when the CPU 466 shown in FIG. 67 writes data in the external memory 407.

[0946] FIG. 72 is a flow chart for explaining the operation shown in FIG. 71.

[0947] Step ST401:

[0948] The CPU 466 outputs to the bus scramble unit 461 the data DATA to be written, that is, “d32”, and the address CPU_ADR, that is, “a3”.

[0949] That data “d32” is written in the work memory 437 shown in FIG. 70 of the bus scramble unit 461.

[0950] Step ST402:

[0951] When Nc>Nb, the address management unit 433 shown in FIG. 70 uses the address “a3” to find the map f (a3−(a3 mod Nc/Nb)), that is, the map f (a3−1) and uses that map f (a3−1) as the address MEM_ADR of the external memory address space.

[0952] Step ST403:

[0953] The control unit 438 shown in FIG. 70 uses the address MEM_ADR f (a3−1) obtained at step ST402 to read from the external memory 407 the encrypted data block e ({X1, X2}) and writes this in the work memory 437.

[0954] Step ST404:

[0955] The decryption unit 432 shown in FIG. 70 decrypts the data block e ({X1, X2}) read from the work memory 437 to generate the data block {X1, X2}. Further, the parity processing unit 435 uses the parity data added to the data block e ({X1, X2}) for parity processing, then writes the data block {X1, X2} again in the work memory 437.

[0956] Step ST405:

[0957] The control unit 438 rewrites the “X2” corresponding to the address “a3” in the data block {X1, X2} corresponding to the address read from the work memory 437 and already decrypted to the write data “d32” to generate the data block {X1, d32} and writes this in the work memory 437.

[0958] Step ST406:

[0959] The parity processing unit 435 generates the parity data of the data block {X1, d32}.

[0960] Step ST407:

[0961] The encryption unit 431 encrypts the data block {X1, d32} read from the work memory 437 using the scramble key K.

[0962] Step ST408:

[0963] The control unit 438 writes the data block {X1, d32} at the address MEM_ADR f (a3−1) of the external memory 407 and writes parity data generated at step ST406 in a predetermined area of the external memory 407.

[0964] Note that the control unit 438 judges if the address next input from the CPU 466 is “a3−1” before encrypting the data block at step ST407. If “a3−1”, it rewrites the data block X1 by the write data, then encrypts it and writes it in the external memory 407.

[0965] Due to this, it is possible to reduce the number of steps in the case of writing to successive addresses.

[0966] Further, even when writing data of a data length Nb in the external memory 407, the control unit 438, for example, pads data by the data of (Nc-Nb) to obtain data of the data length Nc, then encrypts it and writes it in the external memory 407.

[0967] That is, a storage area of a data length Nc in the external memory 407 is assigned even to data of a data length Nb.

[0968] [Read From External Memory 407]

[0969] FIG. 73 is a view for explaining a read operation from the external memory 407 to the bus scramble unit 461.

[0970] FIG. 74 is a flow chart for explaining that read operation.

[0971] Step ST411:

[0972] The CPU 466 outputs to the bus scramble unit 461 the address CPU_ADR “a3” to be read from.

[0973] Step ST412:

[0974] When Nc>Nb, the address management unit 433 shown in FIG. 70 uses the address “a3” to find the map f (a3−(a3 mod Nc/Nb)), that is, the map f (a3−1), and uses that map f (a3−1) as the address MEM_ADR of the external memory address space.

[0975] Step ST413:

[0976] The CPU 466 shown in FIG. 67 uses the address MEM_ADR f (a3−1) obtained at step ST402 to read the encrypted (scrambled) data block e ({d31, d32}) from the external memory 407 and writes this in the work memory 437.

[0977] Step ST414:

[0978] The decryption unit 432 shown in FIG. 70 decrypts the data block e ({d31, d32}) read from the work memory 437 to generate {d31, d32}. Further, the parity processing unit 435 uses the parity data added to the data block e ({d31, d32}) for parity processing, then writes the data block {d31, d32} again in the work memory 437.

[0979] Step ST415:

[0980] The control unit 438 fetches the data “d32” corresponding to the CPU_ADR “a3” in the data block {d31, d32} read from the work memory 437 and already decrypted and outputs the same to the CPU 466.

[0981] That is, it fetches the “(a3 mod Nc/Nb)+1” th data in the data block and outputs it to the CPU 466.

[0982] [Management of Scramble Key]

[0983] The scramble key management unit 434 shown in FIG. 70 manages a scramble key used in the encryption unit 431 and decryption unit 432 as follows.

[0984] The scramble key management unit 434 may use a different key for every address in the external memory 407. Therefore, it is necessary to hold a plurality of scramble keys. One example of the method for this is shown below.

[0985] The scramble key management unit 434, as shown in FIG. 75, stores a plurality of scramble keys K1, K2, and K3. It switches the key used according to the address from the CPU 466 and outputs the same to the encryption unit 431 and decryption unit 432.

[0986] Specifically, when accessing the address “a1”, it uses the scramble key K1, when accessing the address “a2”, it uses the scramble key K2, and when accessing the address “a3”, it uses the scramble key K3.

[0987] Further, as shown in FIG. 76, the computation circuit 434a in the scramble key management unit 434 performs processing using the key Ks forming the class and the address input from the CPU 466 and outputs the computation result as the scramble key K to the encryption unit 431 and decryption unit 432.

[0988] That computation may include encryption or decryption of a padding address number by Ks, finding the exclusive OR (XOR), or other computation.

[0989] Further, the bus scramble unit 461 may hold the scramble keys at a predetermined location of the bus and input the scramble key corresponding to the address issued by the CPU 466 through that bus. In this case, since the data bus for transmitting the scramble key is the same as the bus of the bus scrambler, control by a memory controller becomes necessary. The location for holding the scramble keys may be anywhere inside or outside of the SAM chip 408, but if outside of the chip, to ensure the security of the path to the chip, the key is encrypted by a transport key and decrypted at the time of arrival at the bus scramble unit 461. The bus scramble unit 461 holds the transport key in the form of hardware or software.

[0990] In the bus scramble unit 461, however, even if changing the scramble key for each address input from the CPU 466, if continually accessing a certain address, the possibility rises of the scrambling of the address area being analyzed by spending some time. Therefore, the scramble key is not a constant one. It is made variable by a technique as shown below for example.

[0991] The scramble key management unit 434, for example, causes the generation of a random number when powering up the SAM chip 408 or the like so as to generate a scramble key. The scramble key basically need only be known by the bus scrambler, so the problems of delivery of the key, synchronization, etc. do not arise.

[0992] Further, the scramble key management unit 434 switches the scramble key used for every access to the external memory 407. In this case, it is necessary that the key for encrypting data already in the external memory 407 and the currently held key not be the same.

[0993] Therefore, for example, the scramble key is updated as shown in FIG. 77 and FIG. 78.

[0994] [1]: The encryption unit 431 inputs the data “d3” from the CPU 466, while the bus scramble unit 461 inputs the address “a1” from the CPU 466.

[0995] [2]: The bus scramble unit 461 accesses the address “f (a1)” of the external memory 407.

[0996] [3]: The data “e ({d1, d2})” is read from the address “f (a1)” of the external memory 407 to the decryption unit 432.

[0997] [4]: The decryption unit 432 decrypts the data “e ({d1, d2})” to generate the data “(d1, d2}”.

[0998] At this time, the scramble key management unit 434 selects the scramble key K1, while the decryption unit 432 performs decryption using the scramble key K1.

[0999] Further, rewriting is performed by the data “d3”, and the data “{d3, d2}” is generated.

[1000] [5]: The bus scramble unit 461 changes the scramble key from K1 to K2. The scramble keys K1 and K2 are values of timers, values stored at the addresses, or values generated by random number generation or other techniques.

[1001] [6]: The encryption unit 431 encrypts the rewritten data “{d3, d2}” using the changed scramble K2 to generate the data “e ({d3, d2})”.

[1002] [7] The data “e ({d3, d2})” is written at the address “f (a1)” of the external memory 407.

[1003] [Parity Processing of Parity Processing Unit 435]

[1004] When writing data into the external memory 407, the parity processing unit calculates in advance the parity data of the data before encryption and writes that parity data in the external memory 407 along with the encrypted data.

[1005] Due to this, when some sort of physical trouble occurs in the external memory 407, data is tampered with, etc., this is detected at the time of readout, whereby more secure execution of a program becomes possible.

[1006] Further, due to the addition of the parity data, even if the length of the plain text and the length of the encrypted text are the same, the address space of the CPU 466 and address space of the external memory 407 will never completely match. This is because, for example, when writing at the address “a1” the data “d1”, at the same time as writing the Nc portion at f (a1), it is necessary to write the parity “p1” (size Np) of the data “d1” somewhere in the external memory 407. The parity data is stored at any storage area in the external memory 407 in for example the following case.

[1007] The parity data is placed immediately next to the data obtained by encrypting the corresponding plain text. In this case, the bus scramble unit 461 reads the data “e (d1)” from the address “f (a1)” of the external memory 407, then reads the parity data “p1” from the address “f (a1)+Nc/Nb”. In this case, the bus scramble unit 461 does not have to perform any special calculations other than the map f of the address.

[1008] Further, in addition, the external memory 407 has secured in it in advance a storage area exclusively for the parity data. The parity data “p1” is written in that exclusive storage area. In this case, the bus scramble unit 461 has to perform processing based on the parity address map fp. The parity data “p1” is written in the address “fp (a1)” in the external memory 407.

[1009] When the parity processing unit 435 detects a parity error, it halts the processing of the CPU 466 etc. to prevent illicit processing of the data or program. Note that the content of the parity processing is not particularly limited.

[1010] [Pipeline Processing by Pipeline Processing Control Unit 436]

[1011] In the present embodiment, for example, under the control of the pipeline processing control unit 436, for example, processing of the bus scramble unit 461 is divided into a plurality of stages and a pipeline is formed using the stages as units so as to enable the access time to the external memory 407 as seen from the CPU 466 to be shortened.

[1012] That is, when not forming a pipeline, at least the time required for processing one encryption block is required for one access of the memory from the CPU 466 to the external memory 407.

[1013] For example, if forming a pipeline for the processing performed by bus scramble unit 461 in accordance with a read instruction of data of the address “a1” issued by the CPU 466, for example, when the CPU 466 requests data of a higher address continuously from the address “a1” by program codes etc., if the bus scramble unit 461 reads in advance the data of the address “f (a1+Nc/Nb)” after the address “f (a1)”, it is possible to eliminate the overhead of the encryption and decryption processing.

[1014] For example, if considering the case where when the time for the memory access is ignored, encryption of each data is performed in three rounds such as with triple DES or the like, 1 clock is required for one round of encryption, and Nc/Nb=1, the CPU 466 issues instructions designating the addresses “a1”, “a1+1”, and “a1+2” for reading data consecutively from the external memory 407.

[1015] At this time, three rounds of decryption become necessary, and three clocks are required for decrypting each data.

[1016] If pipeline processing is not performed, as shown in FIG. 79 segment A, three clocks after the CPU 466 issues the first read instruction, the data “e3 (d1)” read from the external memory 407 using the address “a1” is decrypted three times to obtain the data “d1” which is then input to the CPU 466. Next, after another three clocks, the data “e3 (d2)” read from the external memory 407 using the address “a1” is decrypted three times to obtain the data “d2” which is then input to the CPU 466. Next, after another three clocks, the data “e3 (d3)” read from the external memory 407 using the address “a1+2” is decrypted three times to obtain the data “d3” which is then input to the CPU 466.

[1017] That is, all of the data “d1, “d2”, and “d3” is input to the CPU 466 nine clocks after the CPU 466 issues the first read instruction.

[1018] As opposed to this, in the present embodiment, the pipeline processing control unit 436 converts the decryption processing of the decryption unit 432 into pipeline processing in three stages as shown in FIG. 79 segment B using each round as a stage.

[1019] Due to this, on the other hand, while it takes three clocks from which the CPU 466 first issues a read instruction for the data corresponding to the address “a1” to be input to the CPU 466, subsequently data corresponding to the addresses “a1+1” and “a1+2” are input successively to the CPU 466 every clock.

[1020] Due to this, all of the data “d1”, “d2”, and “d3” is input to the CPU 466 five clocks after the CPU 466 first issues a read instruction.

[1021] Note that, when the CPU 466 requests data of the address “a2” far from the address “a1” after “a1”, the data on the pipeline is discarded and the data of the addresses “a2”, “a2+1” . . . is packed in the pipeline.

[1022] [Address Scramble by Address Management Unit 433]

[1023] When the SAM chip 408 repeatedly accesses specific consecutive address areas in the external memory 407, it becomes possible to predict to a certain extent that this is a subroutine or array. If an array or other data, it becomes easy for an attacker to obtain beneficial (critical for the operating side) data by focusing the attack on it.

[1024] To avoid this, in the present embodiment, the address bus between the CPU 466 and SAM chip 408 is passed through the bus scramble unit 461 and the address management unit 433 is made to scramble the addresses as well so as to make it possible to prevent access to consecutive areas in the external memory 407. This scrambling corresponds to the above-mentioned map f. If not scrambling the addresses, the map f becomes a map of only the areas secured for the parity data. For example “∀a ε[CPU address space], f (a)=(1+p)a”. Here, p is the alignment size of the parity data.

[1025] Next, the overall operation of the communication system 401 shown in FIG. 64 will be explained.

[1026] FIG. 80 is a view for explaining the overall operation of the communication system 401 shown in FIG. 64.

[1027] Step ST431:

[1028] The businesses 415_1 to 415_3 or a party requested by these businesses produce the application programs AP_1, AP_2, and AP_3 for the processing for transactions performed by the businesses using the IC card 403 for example on the personal computers 416_1, 416_2, and 416_3 shown in FIG. 64.

[1029] Further, the manager of the SAM chip 408 generates AP management data 421, scrambles it, and stores it in the external memory 407.

[1030] Step ST432:

[1031] The application programs AP_1, AP_2, and AP_3 are downloaded through the authentication units 417_1, 417_2, and 417_3 from the personal computers 416_1, 416_2, and 416_3 to the SAM chip 408.

[1032] Step ST433:

[1033] The user is issued the IC card 403

[1034] The IC of the IC card 403 stores the key information used for transactions by the user with the business contracted with.

[1035] Note that, the contract between the user and a business may also be concluded after issuance of the IC card 403 through the Internet 410 etc.

[1036] Step ST434:

[1037] For example, when the user uses the personal computer 405 to access the server 402 through the Internet 410 to try to purchase a product, the server 402 issues a processing request through the Internet 410 to the ASP server 406.

[1038] When the ASP server 406 receives a processing request from the server 402, it accesses the personal computer 405 through the Internet 410. Further, a processing requesting relating to the IC card 403 issued from the card reader/writer 404 is transmitted through the personal computer 405, Internet 410, and ASP server 406 to the SAM chip 408.

[1039] Step ST435:

[1040] The SAM chip 408 selections an application program in accordance with the processing request received at step ST434 and executes that selected application program.

[1041] In the execution of that application program, the SAM chip 408 and external memory 407 communicate based on the processing of the above-mentioned bus scramble unit 461.

[1042] Step ST436:

[1043] The SAM chip 408 outputs the execution results of the application program to the ASP server 406.

[1044] FIG. 81 is a functional block diagram showing more specifically the function blocks of the SAM chip 408 shown in FIG. 67.

[1045] As shown in FIG. 81, the SAM chip 408 is connected through an internal bus 490 to a card I/F unit 491, ASP communication interface unit 460, bus scramble unit 461, encryption/decryption unit 465, storage unit 463, and CPU 466.

[1046] Part of the functions of the signature processing unit 462 and authentication processing unit 463 shown in FIG. 67 are for example realized by the CPU 466.

[1047] The SAM chip 408 shown in FIG. 81, for example as shown in FIG. 82, may connect the card I/F unit 491 connected to the internal bus 490 to an RF reception/transmission unit 492 outside of the SAM chip 408 and transfer data with the IC card 203 by a noncontact system through an antenna 492a of the RF reception/transmission unit 492.

[1048] As explained above, according to the communication system 401, by giving the above-mentioned functions to the bus scramble unit 461 in the SAM chip 408, the following effects are obtained.

[1049] That is, according to the communication system 401, it is possible to store for example confidential data relating to processing using the IC card 403 in an external memory 407 in a secure state.

[1050] Further, according to the communication system 401, by forming the processing of the bus scramble unit 461 into a pipeline, it is possible for the SAM chip 408 to access the external memory 407 at a high speed.

[1051] Further, according to the communication system 401, by giving the bus scramble unit 461 a parity function, it is possible to improve the reliability of the data read from the external memory 407.

[1052] Sixth Embodiment

[1053] The present embodiment is an embodiment corresponding to the 19th aspect of the invention.

[1054] [Related Art of Present Embodiment]

[1055] First, a computer for executing a transaction business program using an IC card of a related art of the present invention will be explained.

[1056] FIG. 83 is a functional block diagram of a computer 501 used in electronic settlement of a related art of the present invention.

[1057] As shown in FIG. 83, the computer 501 has a CPU 502, memory 503, and communication circuit 504.

[1058] The CPU 502, memory 503, and communication circuit 504 are connected to a CPU data bus 506.

[1059] The CPU 502 and communication circuit 504 are connected to a CPU address bus 507.

[1060] The CPU 502 comprehensively controls the operation of the computer 501, operates based on instructions of a program stored in the memory 503, and accesses the memory 503 during its operation.

[1061] The communication circuit 504 communicates with the IC card 508 by the contact system or noncontact system. In the contact type, the IC card 508 and the communication circuit 504 are connected by electrical contacts. Further, in the noncontact type, the IC card 508 and the communication circuit 504 are connected through electromagnetic waves or light etc.

[1062] The data received from the IC card 508 through the communication circuit 504 is processed by the CPU 502 in accordance with a program stored in the memory 503. Further, the data obtained by the processing by the CPU 502 is transmitted through the communication circuit 504 to the IC card 508.

[1063] Further, the CPU 502 writes the results of settlement generated by communication with the IC card 508 in the memory 503.

[1064] FIG. 84 is a view for explaining the software configuration of the CPU 502 shown in FIG. 83.

[1065] In FIG. 84, the bottommost layer is the hardware layer, that is, the hardware component of the CPU 502 shown in FIG. 83.

[1066] Above the hardware layer is positioned a communication driver layer. The communication driver layer has positioned in it a communication driver layer for controlling the communication circuit 504 connected to the CPU 502. The program of the communication driver layer is usually stored in a nonvolatile memory.

[1067] Above the communication driver layer is an operating system (OS) layer for providing the program forming the foundation for the operation of the CPU 502. The OS layer provides the highest application (AP) layer with higher concept services compared with the lower layers. For example, the later explained function “get card type ( )”, “read card data ( )”, and “write card data ( )” are examples.

[1068] Further, above the OS layer is an AP layer defining the specific functions (services) realized by the computer 501. The AP layer has, for example, application programs MAIN, AP1, AP2, and AP3.

[1069] In the present embodiment, the explanation will be given illustrating the provision of settlement or other transactions using the IC card 508 as the application program.

[1070] For example, in the OS layer and AP layer, the function for determining the type of the IC card 508 is defined by “get card type ( )”.

[1071] In the OS layer and AP layer, the type of the IC card 508 can be specified by calling up this function. For example, assume that there are three types of IC cards 508, that is, Types A, B, and C. The return values of the function for the IC cards 508 are defined as in FIG. 85.

[1072] For example, assuming that the Type B IC card 508 is used, the return value of the result of execution of the function “get card type ( )” becomes “2”.

[1073] Further, in the OS layer and AP layer, “read data (*rp)” is defined as the function for reading data from the internal memory of the IC card 508.

[1074] Here, “*rp” is similar in concept to a pointer in the C language, “*” shows that the following variable is a pointer variable, and “rp” shows a specific location in the internal memory of the IC card 508. When “*rp” is indicated, this shows the content of the “rp address” in the memory of the IC card 508. Assume now that the internal memory stores data as shown in FIG. 86.

[1075] Further, if assuming that “rp=102H”, the return value of the function “read data (*rp)” becomes “56H” and it is possible to read the data of the “102H address”.

[1076] Further, in the OS layer and AP layer, “write data (*wp, wdata)” is defined as the function for writing data at a specific address of the internal memory of the IC card 508. Here, “*wp” is similar to the concept of a pointer in the C language, “*” indicates that the following variable is a pointer variable, and “wp” indicates a specific address of the internal memory of the IC card 508. When “*wp” is indicated, the content of the wp address of the internal memory of the IC card 508 is indicated. “wdata” is a variable in the write data. Assume now that the memory of the IC card 508 stores data as shown in FIG. 87. Here, if “wp=102H” and “wdata=73H” and executing the function “write data (*wp, wdata)”, as shown in FIG. 87, the data of the “102H address” of that memory is rewritten to “73H”.

[1077] The application programs AP1, AP2, and AP3 shown in FIG. 84 define operations for transactions relating to different types of IC cards 508. The correspondence is shown in FIG. 88.

[1078] In FIG. 84, the application program MAIN is executed first at the time of startup of the computer 501. The application program MAIN uses the above-mentioned function “get card type ( )” to determine the type of the IC card 508 used. The CPU 502 selects and executes the corresponding application program in accordance with the type of the IC card 508 determined based on the correspondence table shown in FIG. 88.

[1079] If imagining a situation in which IC cards 508 of the Type A, Type B, and Type C are handled by different businesses, the application programs AP1, AP2, and AP3 are produced by the individual businesses. Further, the storage areas of the internal memory of the IC card 508 are shared by the application programs AP1, AP2, and AP3. The application programs use portions assigned to them in advance.

[1080] As explained above, the application programs AP1, AP2, and AP3 are produced by the individual businesses, but sometimes there is an error in a program, an application program of another business is read by a business with malicious intent by an illicit program of that business, or a storage area in the IC card 508 for which one is not allowed access is illicitly accessed.

[1081] [Embodiment of the Present Invention]

[1082] FIG. 89 is a view of the configuration of the computer 551 according to an embodiment of the present invention.

[1083] As shown in FIG. 89, the computer 551 has a CPU 552, memory 553, communication circuit 504, judgment circuit 560, and switch circuit 561.

[1084] Here, the CPU 552 corresponds to the computation circuit of the present invention, the memory 553 corresponds to the storage circuit of the present invention, the communication circuit 504 corresponds to the communication circuit of the present invention, the judgment circuit 560 corresponds to the connection control circuit of the present invention, and the switch circuit 561 corresponds to the connection switching circuit of the present invention.

[1085] The CPU data bus 506 has a CPU 552, switch circuit 561, judgment circuit 560, and communication circuit 504 connected to it.

[1086] The CPU data bus 506 corresponds to the transmission line of the present invention.

[1087] Further, the switch circuit 561 is connected through a memory data bus 562 to the memory 553.

[1088] Further, the CPU address bus 507 has a memory 553, judgment circuit 560, and communication circuit 504 connected to it.

[1089] When the CPU 552 accesses the memory 553 or a peripheral device outside of the computer 551 etc., the CPU address bus 507 transmits a CPU_ADR showing the address.

[1090] In FIG. 89, the communication circuit 504 and IC card 508 given the same reference numerals as in FIG. 83 are the same as those explained in FIG. 83.

[1091] Further, the CPU 552 has the software structure as explained above using FIG. 84. That is, as the application programs AP1, AP2, and AP3, ones which define processing for transactions relating to three types of IC cards 508, that is, Types A, B, and C, are used.

[1092] The data received from an IC card 508 through the communication circuit 504 is processed by the CPU 552 in accordance with a program stored in the memory 553. Further, the data obtained by the processing by the CPU 552 is transmitted to the IC card 508 through the communication circuit 504.

[1093] Further, the CPU 552 writes the result of settlement generated by communication with the IC card 508 in the memory 553.

[1094] The switch circuit 561 switches the CPU data bus 506 and memory data bus 562 between the connection state and disconnection state based on a judgment result signal S560 from a judgment circuit 560 (control signal of the present invention).

[1095] Further, the CPU 552 executes the instructions (codes) of the programs of the OS layer, program MAIN, and application programs AP1, AP2, and AP3 shown in FIG. 84 fetched (read) from the memory 553.

[1096] The CPU 552, in accordance with the execution of those instructions, generates an instruction type instructing signal S552a, executing AP instructing signal S552b, and if necessary a called AP instructing signal S552c and outputs these to the judgment circuit 560.

[1097] Here, the instruction type instructing signal S552a is a signal indicating whether which of the fetch instruction, read instruction, and write instruction the CPU 552 executed.

[1098] Here, the fetch instruction is an instruction for the CPU 552 to fetch the instruction codes through the CPU data bus 506.

[1099] The read instruction is an instruction for the CPU 552 to read data through the CPU data bus 506.

[1100] The write instruction is an instruction for the CPU 552 to write data through the CPU data bus 506.

[1101] Further, the executing AP instructing signal S552b is a signal showing of which program the instruction being executed by the CPU 552 belongs in the instructions of the application programs AP1, AP2, AP3, and MAIN and OS programs shown in FIG. 84.

[1102] The called AP instructing signal S552c shows which program of the application programs AP1, AP2, AP3, and MAIN and OS programs the program module of the call destination belongs when a program module being executed by the CPU 552 calls up another program module.

[1103] Further, the CPU 552 halts the CPU data bus 506 and its operation when as explained later the switch circuit 561 enters a disconnection state.

[1104] Next, the judgment circuit 560 will be explained in detail.

[1105] The judgment circuit 560 generates a judgment result signal S560 based on the instruction type instructing signal S552a and executing AP instructing signal S552b input from the CPU 552 and the address CPU_ADR input through the CPU address bus 507 from the CPU 552 and outputs this to the switch circuit 561.

[1106] FIG. 90 is a view of the configuration of the judgment circuit 560 shown in FIG. 89.

[1107] As shown in FIG. 90, the judgment circuit 560 has a selection circuit 570, fetch judgment circuit 571, read judgment circuit 572, and write judgment circuit 573.

[1108] The selection circuit 570 connects the switch 574 to one terminal of the terminals 575_1, 575_2, and 575_3 based on the instruction type instructing signal S552a input from the CPU 552 shown in FIG. 89.

[1109] Specifically, the selection circuit 570 connects the switch 574b to the terminal 575_1 when the instruction type instructing signal S552a indicates a fetch instruction.

[1110] Due to this, the fetch judgment result signal S571 output from the fetch judgment circuit 571 is output through the terminal 575_1 and switch 574 as the judgment result signal S560 from the judgment circuit 560 to the switch circuit 561.

[1111] Further, the selection circuit 570 connects the switch 574 to the terminal 575_2 when the instruction type instructing signal S552a indicates a read instruction.

[1112] Due to this, the read judgment result signal S572 output from the read judgment circuit 572 is output through the terminal 575_2 and switch 574 as the judgment result signal S560 from the judgment circuit 560 to the switch circuit 561.

[1113] Further, the selection circuit 570 connects the switch 574 to the terminal 575_3 when the instruction type instructing signal S552a indicates a write instruction.

[1114] Due to this, the write judgment result signal S573 output from the write judgment circuit 573 is output through the terminal 575_3 and switch 574 as the judgment result signal S560 from the judgment circuit 560 to the switch circuit 561.

[1115] The fetch judgment circuit 571 uses the executing AP instructing signal S552b, called AP instructing signal S552c, and address CPU_ADR input from the CPU 552 to generate the fetch judgment result signal S571 and outputs this toward the terminal 575_1 of the selection circuit 570.

[1116] FIG. 91 is a view of the configuration of the fetch judgment circuit 571 shown in FIG. 90.

[1117] As shown in FIG. 91, the fetch judgment circuit 571 has a storage unit 581_1 and judgment unit 582_1.

[1118] The storage unit 581_1 stores the fetch access range defining data 584_1 and fetch inter-AP call relation defining data 58.

[1119] The fetch access range defining data 584_1 defines the addresses in the memory 553 accessible when the CPU 552 is executing the fetch instruction for each case where the CPU 552 is executing programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1120] FIG. 92 is a view for explaining the fetch access range defining data 584_1.

[1121] The column (vertical) direction in FIG. 92 shows the programs of the OS layer and the application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1122] The “FROM” in the row (horizontal) direction shows the start address of the storage area in the memory 553 where storage of the program of the corresponding column is allowed.

[1123] The “FROM” in the row direction shows the start address of the address range of the memory 553 where the program of the corresponding column is allowed access.

[1124] The “TO” in the row direction shows the end address of the address range of the memory 553 where the program of the corresponding column is allowed access.

[1125] For example, the application program AP1 is allowed access to the range of the addresses “2000H” to “2FFFH” of the memory 553.

[1126] The fetch inter-AP call relation defining data 585_1 shows the combinations of programs to which program modules which may be called from or called belong when a program module is called up when the CPU 552 is executing a fetch instruction.

[1127] FIG. 93 is a view for explaining the fetch inter-AP call relation defining data 585_1.

[1128] The column direction of FIG. 93 shows the programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1129] The row direction of FIG. 93 shows the programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1130] The intersecting positions of the columns and rows show whether a program module of a program of the corresponding column is allowed to call up a program module of a program of the corresponding row. The “o” indicates that call up is allowed, while the “x” indicates that callup is not allowed.

[1131] For example, a program module of the application program AP1 is allowed to call up a program module of an OS program, MAIN, and application program AP3, but is not allowed to call up a program module of the application program AP2.

[1132] The judgment unit 582_1 judges if the address CPU_ADR is included in the address range of the memory 553 defined by the “FROM” and “TO” of the column shown in FIG. 92 corresponding to the program indicated by the executing AP instructing signal S552b based on the executing AP instructing signal S552b and address CPU_ADR input from the CPU 552 shown in FIG. 89 and the fetch access range defining data 584_1 read from the storage unit 581_1.

[1133] When judging that it is included in that judgment, the judgment unit 582_1 for example generates a fetch judgment result signal S571 instructing connection and outputs it toward the terminal 575_1 of the selection circuit 570 shown in FIG. 90.

[1134] On the other hand, when judging that it is not included in that judgment, the judgment unit 582_1 generates for example a fetch judgment result signal S571 instructing disconnection (break) and outputs it toward the terminal 575_1 of the selection circuit 570 shown in FIG. 90.

[1135] Further, when a program module of a program being executed by the CPU 552 calls up a program module of another program, the judgment unit 582_1 judges if that callup is allowed by the combination shown by the fetch inter-AP call relation defining data 585_1 shown in FIG. 93 based on the executing AP instructing signal S552b and called AP instructing signal S552c input from the CPU 552 shown in FIG. 89 and the fetch inter-AP call relation defining data 585_1 read from the storage unit 581_1.

[1136] When judging that it is allowed in that judgment, the judgment unit 582_1 for example generates a fetch judgment result signal S571 instructing connection and outputs this toward the terminal 575_1 of the selection circuit 570 shown in FIG. 90.

[1137] On the other hand, when judging that it is not allowed in that judgment, the judgment unit 582_1 generates for example a fetch judgment result signal S571 instructing disconnection and outputs this toward the terminal 575_1 of the selection circuit 570 shown in FIG. 90.

[1138] The read judgment circuit 572 uses the executing AP instructing signal S552b, called AP instructing signal S552c, and address CPU_ADR input from the CPU 552 to generate the read judgment result signal S572 and outputs this toward the terminal 575_2 of the selection circuit 570.

[1139] FIG. 94 is a view of the configuration of the read judgment circuit 572 shown in FIG. 90.

[1140] As shown in FIG. 94, the read judgment circuit 572 has a storage unit 581_2 and judgment unit 582_2.

[1141] The storage unit 581_2 stores the read access range defining data 584_2 and read inter-AP call relation defining data 585_2.

[1142] The read access range defining data 584_2 defines the addresses in the memory 553 accessible when the CPU 552 is executing a read instruction for each case where the CPU 552 is executing programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1143] FIG. 95 is a view for explaining the read access range defining data 584_2.

[1144] The column (vertical) direction in FIG. 95 shows the programs of the OS layer and the application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1145] The “FROM” in the row (horizontal) direction shows the start address of the storage area in the memory 553 where storage of the program of the corresponding column is allowed.

[1146] The “FROM” in the row direction shows the start address of the address range of the memory 553 where the program of the corresponding column is allowed access.

[1147] The “TO” in the row direction shows the end address of the address range of the memory 553 where the program of the corresponding column is allowed access.

[1148] The read inter-AP call relation defining data 585_2 shows the combinations of programs to which program modules which may call from or be called from belong when a program module is called up when the CPU 552 is executing a read instruction.

[1149] FIG. 96 is a view for explaining the read inter-AP call relation defining data 585_2.

[1150] The column direction of FIG. 96 shows the programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1151] The row direction of FIG. 96 shows the programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1152] The intersecting positions of the columns and rows show whether a program module of a program of the corresponding column is allowed to call up a program module of a program of the corresponding row. The “o” indicates that callup is allowed, while the “x” indicates that callup is not allowed.

[1153] The judgment unit 582_2 judges if the address CPU_ADR is included in the address range of the memory 553 defined by the “FROM” and “TO” of the column shown in FIG. 95 corresponding to the program indicated by the executing AP instructing signal S552b based on the executing AP instructing signal S552b and address CPU_ADR input from the CPU 552 shown in FIG. 89 and the read access range defining data 584_2 read from the storage unit 581_2.

[1154] When judging that it is included in that judgment, the judgment unit 582_2 for example generates a read judgment result signal S572 instructing connection and outputs it toward the terminal 575_2 of the selection circuit 570 shown in FIG. 90.

[1155] On the other hand, when judging that it is not included in that judgment, the judgment unit 582_2 generates for example a read judgment result signal S572 instructing disconnection (break) and outputs it toward the terminal 575_2 of the selection circuit 570 shown in FIG. 90.

[1156] Further, when a program module of a program being executed by the CPU 552 calls up a program module of another program, the judgment unit 582_2 judges if that callup is allowed by the combination shown by the read inter-AP call relation defining data 585_2 shown in FIG. 96 based on the executing AP instructing signal S552b and called AP instructing signal S552c input from the CPU 552 shown in FIG. 89 and the read inter-AP call relation defining data 585_2 read from the storage unit 581_2.

[1157] When judging that it is allowed in that judgment, the judgment unit 582_2 for example generates a read judgment result signal S572 instructing connection and outputs this toward the terminal 575_2 of the selection circuit 570 shown in FIG. 90.

[1158] On the other hand, when judging that it is not allowed in that judgment, the judgment unit 582_2 generates for example a read judgment result signal S572 instructing disconnection and outputs this toward the terminal 575_2 of the selection circuit 570 shown in FIG. 90.

[1159] The write judgment circuit 573 uses the executing AP instructing signal S552b, called AP instructing signal S552c and address CPU_ADR input from the CPU 552 to generate the write judgment result signal S573 and outputs this toward the terminal 575_3 of the selection circuit 570.

[1160] FIG. 97 is a view of the configuration of the write judgment circuit 573 shown in FIG. 90.

[1161] As shown in FIG. 97, the write judgment circuit 573 has a storage unit 581_3 and judgment unit 582_3.

[1162] The storage unit 581_3 stores the write access range defining data 584_3 and write inter-AP call relation defining data 585_3.

[1163] The write access range defining data 584_3 defines the addresses in the memory 553 accessible when the CPU 552 is executing the write instruction for each case where the CPU 552 is executing programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1164] FIG. 98 is a view for explaining the write access range defining data 584_3.

[1165] The column (vertical) direction in FIG. 98 shows the programs of the OS layer and the application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1166] The “FROM” in the row (horizontal) direction shows the start address of the storage area in the memory 553 where storage of the program of the corresponding column is allowed.

[1167] The “FROM” in the row direction shows the start address of the address range of the memory 553 where the program of the corresponding column is allowed access.

[1168] The “TO” in the row direction shows the end address of the address range of the memory 553 where the program of the corresponding column is allowed access.

[1169] The write inter-AP call relation defining data 585_3 shows the combinations of programs to which program modules which may call or be called from belong when a program module is called up when the CPU 552 is executing a read instruction.

[1170] FIG. 99 is a view for explaining the write inter-AP call relation defining data 585_3.

[1171] The column direction of FIG. 99 shows the programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1172] The row direction of FIG. 99 shows the programs of the OS layer and application programs MAIN, AP1, AP2, and AP3 shown in FIG. 84.

[1173] The intersecting positions of the columns and rows show whether a program module of a program of the corresponding column is allowed to call up a program module of a program of the corresponding row. The “o” indicates that callup is allowed, while the “x” indicates that callup is not allowed.

[1174] The judgment unit 582_3 judges if the address CPU ADR is included in the address range of the memory 553 defined by the “FROM” and “TO” of the column shown in FIG. 98 corresponding to the program indicated by the executing AP instructing signal S552b based on the executing AP instructing signal S552b and address CPU_ADR input from the CPU 552 shown in FIG. 89 and the write access range defining data 584_3 read from the storage unit 581_3.

[1175] When judging that it is included in that judgment, the judgment unit 582_3 for example generates a write judgment result signal S573 instructing connection and outputs it toward the terminal 575_3 of the selection circuit 570 shown in FIG. 90.

[1176] On the other hand, when judging that it is not included in that judgment, the judgment unit 582_3 generates for example a write judgment result signal S573 instructing disconnection (break) and outputs it toward the terminal 575_3 of the selection circuit 570 shown in FIG. 90.

[1177] Further, when a program module of a program being executed by the CPU 552 calls up a program module of another program, the judgment unit 582_3 judges if that callup is allowed by the combination shown by the write inter-AP call relation defining data 585_3 shown in FIG. 99 based on the executing AP instructing signal S552b and called AP instructing signal S552c input from the CPU 552 shown in FIG. 89 and the write inter-AP call relation defining data 585_3 read from the storage unit 581_3.

[1178] When judging that it is allowed in that judgment, the judgment unit 582_3 for example generates a write judgment result signal S573 instructing connection and outputs this toward the terminal 575_3 of the selection circuit 570 shown in FIG. 90.

[1179] On the other hand, when judging that it is not allowed in that judgment, the judgment unit 582_3 generates for example a write judgment result signal S573 instructing disconnection and outputs this toward the terminal 575_3 of the selection circuit 570 shown in FIG. 90.

[1180] Next, the selection circuit 570 will be explained.

[1181] The selection circuit 570 connects the switch 574 to one of the terminals 575_1, 575_2, and 575_3 based on the instruction type instructing signal S552a from the CPU 552.

[1182] Specifically, when the instruction type instructing signal S552a indicates a fetch instruction, the selection circuit 570 connects the switch 574 to the terminal 575_1 and outputs the fetch judgment result signal S571 as the judgment result S560 to the switch circuit 561. Due to this, the connection/disconnection of the switch circuit 561 is controlled by the fetch judgment result signal S571.

[1183] Further, when the instruction type instructing signal S552a indicates a read instruction, the selection circuit 570 connects the switch 574 to the terminal 575_2 and outputs the read judgment result signal S572 as the judgment result S560 to the switch circuit 561. Due to this, the connection/disconnection of the switch circuit 561 is controlled by the read judgment result signal S572.

[1184] Further, when the instruction type instructing signal S552a indicates a write instruction, the selection circuit 570 connects the switch 574 to the terminal 575_3 and outputs the write judgment result signal S573 as the judgment result S560 to the switch circuit 561. Due to this, the connection/disconnection of the switch circuit 561 is controlled by the write judgment result signal S573.

[1185] Next, examples of the operation of the computer 551 will be explained.

[1186] [First Example of Operation]

[1187] Next, an example of the operation where the computer 551 executes a fetch instruction in the process of execution of a program module of the application program AP1 and designates the address “2100H” of the address memory 553 will be explained.

[1188] In this case, a CPU_ADR indicating “2100H” flows on the CPU address bus 507, and an instruction type instructing signal S552a indicating a fetch instruction and an executing AP instructing signal S552b indicating AP1 are output from the CPU 552 to the judgment circuit 560.

[1189] Further, the judgment unit 582_1 shown in FIG. 91 judges if the address “2100H” is included in the address range “2000H” to “2FFFH” of the memory 553 defined by the “FROM” and “TO” of the column shown in FIG. 92 corresponding to the AP1 based on the executing AP instructing signal S552b and address CPU_ADR input from the CPU 552 and fetch access range defining data 584_1 shown in FIG. 92 read from the storage unit 581

[1190] Further, the judgment unit 582_1 generates a fetch judgment result signal S571 instructing connection and outputs it toward the terminal 575_1 of the selection circuit 570 shown in FIG. 90.

[1191] Further, the selection circuit 570 connects the switch 574 to the terminal 575_1 since the instruction type instructing signal S552a indicates a fetch.

[1192] Due to this, a fetch judgment result signal S571 instructing connection is output through the selection circuit 570 as the judgment result signal S560 to the switch circuit 561 shown in FIG. 89.

[1193] Further, the switch circuit 561 places the CPU data bus 506 and memory data bus 562 in the connection state to allow the CPU 552 to access the memory 553.

[1194] Note that, in the above explained case, when the address CPU_ADR indicates “3100H”, since that address is not included in the address range “2000H” to “2FFFH”, a fetch judgment result signal S571 instructing disconnection is output from the selection circuit 570 to the switch circuit 561. Due to this, the switch circuit 561 sets the CPU data bus 506 and memory data bus 562 in the disconnection state to prevent the CPU 552 from accessing the memory 553.

[1195] [Operation of Second Example]

[1196] Next, an example of the operation in the case where a program module of the application program AP2 calls up a program of the application program AP1 when the computer 551 executes a read instruction will be explained.

[1197] In this case, the executing AP instructing signal S552b showing AP2 and the called AP instructing signal S552c showing AP1 are output from the CPU 552 to the read judgment circuit 572.

[1198] The judgment unit 582_2 of the read judgment circuit 572 views the read inter-AP call relation defining data 585_2 shown in FIG. 96 and judges if a call from the AP2 to AP1 is allowed.

[1199] Further, the judgment unit 582_2 generates a read judgment result signal S572 instructing connection and outputs this toward the terminal 575_2 of the selection circuit 570 shown in FIG. 90.

[1200] Further, the selection circuit 570 connects the switch 574 to the terminal 575_2 since the instruction type instructing signal S552a indicates a read instruction.

[1201] Due to this, a read judgment result signal S572 instructing connection is output through the selection circuit 570 as the judgment result signal S560 to the switch circuit 561 shown in FIG. 89.

[1202] Further, the switch circuit 561 sets the CPU data bus 506 and memory data bus 562 to the connection state, whereby the CPU 552 can access the memory 553.

[1203] On the other hand, in the above case, when the program module of the application program AP2 calls up a program of the application program AP3, it is judged from the read inter-AP call relation defining data 585_2 shown in FIG. 96 that a call from the AP2 to AP3 is not allowed.

[1204] Further, the judgment unit 582_2 generates the read judgment result signal S572 instructing disconnection and outputs this toward the terminal 575_2 of the selection circuit 570 shown in FIG. 90.

[1205] Due to this, a read judgment result signal S572 instructing disconnection is output through the selection circuit 570 as the judgment result signal S560 to the switch circuit 561 shown in FIG. 89.

[1206] Further, the switch circuit 561 sets the CPU data bus 506 and memory data bus 562 to the disconnection state to prevent the CPU 552 from accessing the memory 553.

[1207] As explained above, the judgment circuit 560 and switch circuit 561 determine the connection state between the memory 553 and CPU data bus 506 based on data defined in advance in accordance with each program in accordance with a program being executed by the CPU 552.

[1208] Therefore, an application program being executed by the CPU 552 can be prevented from illicitly accessing instructions and data of another application program stored in the memory 553 and a high security can be obtained among application programs even when the CPU 552 is executing a plurality of application programs.

[1209] The present invention is not limited to the above explained embodiment.

[1210] For example, in the above explained embodiment, the case was illustrated where the judgment circuit 560 stored fetch access range defining data 584_1, fetch inter-AP call relation defining data 585_1, read access range defining data 584_2, read inter-AP call relation defining data 585_2, write access range defining data 584_3, and write inter-AP call relation defining data 585_3, but as shown in FIG. 100, it is also possible to use an IC card 558 storing such data in a state encrypted using key information K.

[1211] In this case, the judgment circuit 560 holds the key information K and decryption program 590, accesses the IC card 558 through the CPU data bus 506 and communication circuit 504, reads the fetch access range defining data 584_1, fetch inter-AP call relation defining data 585_1, read access range defining data 584_2, read inter-AP call relation defining data 585_2, write access range defining data 584_3, and write inter-AP call relation defining data 585_3 from the IC card 558, and uses the same decrypted using a predetermined decryption program 590 and key information K.

[1212] Further, the present invention may store the above decryption program in an encrypted state in the IC card 558, read this through the communication circuit 504 and CPU data bus 506 into the judgment circuit 560, decrypt this by the judgment circuit 560 using predetermined key information, store the decrypted decryption program in the memory 553, and have the judgment circuit 560 read and execute the decryption program from the memory 553.

[1213] Further, in the above explained embodiment, the case was shown of the CPU 552 outputting to the judgment circuit 560 an executing AP instructing signal S552b and called AP instructing signal S552c, but these signals may also be generated, as shown in FIG. 101, by the judgment circuit 560 monitoring the CPU address bus 507.

[1214] Seventh Embodiment

[1215] The present embodiment is an embodiment corresponding to the 20th and 21st aspects of the invention.

[1216] FIG. 102 is a view of the configuration of a semiconductor chip 631 of an embodiment of the present invention.

[1217] As shown in FIG. 102, the semiconductor chip 631 has an internal memory 632, switch circuit 633, switch circuit 634, judgment circuit 635, selection circuit 636, and CPU 637.

[1218] The internal memory 632, switch circuit 633, switch circuit 634, judgment circuit 635, and CPU 637 are connected to a CPU data bus 640.

[1219] The internal memory 632, judgment circuit 635, and CPU 637 are connected to an address bus 641.

[1220] The internal memory 632, judgment circuit 635, and CPU 637 are connected to a signal line 642.

[1221] Further, the internal memory 632 is further connected to an internal data bus 643.

[1222] Further, the switch circuit 634 is further connected through an external data bus 644 to an external memory 660.

[1223] Further, the selection circuit 636 is further connected through an external data bus 645 to a debugger 661.

[1224] Here, the semiconductor chip 631 corresponds to the semiconductor circuit of the first aspect of the invention, the CPU data bus 640 corresponds to the first transmission line of the first semiconductor circuit, the program module PM_1 corresponds to an instruction for executing a program of the first aspect of the invention, the internal memory 632 corresponds to the storage circuit of the first aspect of the invention, the CPU 637 corresponds to the processing circuit of the first aspect of the invention, the switch circuit 633 corresponds to the first connection switching circuit of the first aspect of the invention, the switch circuit 634 corresponds to the second connection switching circuit of the first aspect of the invention, the judgment circuit 635 corresponds to the connection control circuit of the first aspect of the invention, the selection circuit 636 corresponds to the third connection switching circuit of the first aspect of the invention, the external memory 660 corresponds to the storage apparatus of the first aspect of the invention, and the debugger 661 corresponds to the external apparatus of the first aspect of the invention.

[1225] Further, the signal line 642 corresponds to the third transmission line of the first aspect of the invention, while the address bus 641 corresponds to the fourth transmission line of the first aspect of the invention.

[1226] Further, the judgment result signal S635a corresponds to the first control signal of the first aspect of the invention, the judgment result signal S635b corresponds to the second control signal of the first aspect of the invention, and the judgment result signal S635c corresponds to the third control signal of the first aspect of the invention.

[1227] FIG. 103 is a view for explaining the software configuration of the semiconductor chip 631 shown in FIG. 102.

[1228] In FIG. 103, the bottommost layer is the hardware layer, that is, the hardware component of the semiconductor chip 631 shown in FIG. 102.

[1229] Above the hardware layer is positioned a communication driver layer. The communication driver layer has positioned in it a communication driver layer for controlling the communication. The program of the communication driver layer is usually stored in a nonvolatile memory.

[1230] Above the communication driver layer is an operating system (OS) layer for providing the program forming the foundation for the operation of the semiconductor chip 631. The OS layer provides the highest application (AP) layer with higher concept services compared with the lower layers.