Access control for a microprocessor card

• US 20030212895A1
• Filed: 12/20/2002
• Published: 11/13/2003
• Est. Priority Date: 12/20/2001
• Status: Active Grant

• Current Assignee: Canon Information Technology Services Incorporated (Canon Inc.)
• Original Assignee: Canon Information Technology Services Incorporated (Canon Inc.)
• Inventors: Kisliakov, Andrew
• Granted Patent: US 7,194,768 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06K 19/07 with integrated circuit chips

Abstract

A method and apparatus for executing messages using a plurality of applications resident in a memory means (276) of an electronic card (100), is disclosed. The electronic card (100) is adapted for coupling to a reader device (300) to facilitate reading of the memory means (276). The reading device (300) is configured for communication with a remote apparatus (computer 700) having a further application executing thereon. The one or more card resident applications are required to process one or more messages received from the further application. Depending on the determination, the one or more messages are executed using a first of the card resident applications if one or more predetermined criteria are met. Alternatively, the one or more messages are executed using a second of the card resident applications if one or more further criteria are met. The one or more further criteria are determined via an array containing the one or more further criteria.

Claims

1. A method of executing messages using a plurality of applications resident in a memory means of an electronic card, said electronic card being adapted for coupling to a reader device to facilitate reading of said memory means, said reading device being configured for communication with a remote apparatus having a further application executing thereon, said method comprising the steps of:

determining which of the one or more card resident applications are required to process one or more messages received from said further application; and

depending on said determination;

executing said one or more messages using a first of said card resident applications if one or more predetermined criteria are met, or

executing said one or more messages using a second of said card resident applications if one or more further criteria are met, wherein said one or more further criteria are determined via an array containing said one or more further criteria.

2. The method according to claim 1, wherein said criteria includes whether a user of said electronic card has been verified.

3. The method according to claim 1, wherein said criteria includes whether a secure communications link has been established between said further application and one of said first and second card resident applications.

4. The method according to claim 1, wherein said criteria includes a general denial of execution.

5. The method according to claim 1, wherein said criteria includes a general allowance of execution.

6. The method according to claim 1, wherein said first application performs said determination.

7. The method according to claim 1, wherein at least one of said card resident applications is configured to allow execution of messages from a said further application.

8. The method according according to claim 1, wherein said card has one or more user interface elements formed on a surface thereof.

9. The method according to claim 8, wherein said first application is configured to process reading signals generated from a user selection of one or more of said user interface elements.

10. An apparatus for executing messages using a plurality of applications resident in a memory means of an electronic card, said electronic card being adapted for coupling to a reader device to facilitate reading of said memory means, said reading device being configured for communication with a remote apparatus having a further application executing thereon, said apparatus comprising:

processor means for determining which of the one or more card resident applications are required to process one or more messages received from said further application, and

depending on said determination;

executing said one or more messages using a first of said card resident applications if one or more predetermined criteria are met, or

executing said one or more messages using a second of said card resident applications if one or more further criteria are met, wherein said one or more further criteria are determined via an array containing said one or more further criteria.

11. The apparatus according to claim 10, wherein said criteria includes whether a user of said electronic card has been verified.

12. The apparatus according to claim 10, wherein said criteria includes whether a secure communications link has been established between said further application and one of said first and second card resident applications.

13. The apparatus according to claim 10, wherein said criteria includes a general denial of execution.

14. The apparatus according to claim 10, wherein said criteria includes a general allowance of execution.

15. The apparatus according to claim 10, wherein said first application performs said determination.

16. The apparatus according to claim 10, wherein at least one of said card resident applications is configured to allow execution of messages from a said further application.

17. The apparatus according according to claim 10, wherein said card has one or more user interface elements formed on a surface thereof.

18. The apparatus according to claim 17, wherein said first application is configured to process reading signals generated from a user selection of one or more of said user interface elements.

19. A program resident in an apparatus, said program being configured for executing messages using a plurality of applications resident in a memory means of an electronic card, said electronic card being adapted for coupling to a reader device to facilitate reading of said memory means, said reading device being configured for communication with a remote apparatus having a further application executing thereon, said program comprising:

code for determining which of the one or more card resident applications are required to process one or more messages received from said further application; and

depending on said determination;

executing said one or more messages using a first of said card resident applications if one or more predetermined criteria are met, or

executing said one or more messages using a second of said card resident applications if one or more further criteria are met, wherein said one or more further criteria are determined via an array containing said one or more further criteria.

20. The program according to claim 19, wherein said criteria includes whether a user of said electronic card has been verified.

21. The program according to claim 19, wherein said criteria includes whether a secure communications link has been established between said further application and one of said first and second card resident applications.

22. The program according to claim 19, wherein said criteria includes a general denial of execution.

23. The program according to claim 19, wherein said criteria includes a general allowance of execution.

24. The program according to claim 19, wherein said first application performs said determination.

25. The program according to claim 19, wherein at least one of said card resident applications is configured to allow execution of messages from a said further application.

26. The program according according to claim 19, wherein said card has one or more user interface elements formed on a surface thereof.

27. The program according to claim 26, wherein said first application is configured to process reading signals generated from a user selection of one or more of said user interface elements.

28. The program according to 19, wherein said program is stored in a memory means of said apparatus and is executed by a processor of said apparatus.

29. A method of utilising an electronic card to access a service provided by an apparatus, said electronic card comprising a card portion having a memory means attached thereto, said memory means being adapted for coupling to a reader device to facilitate reading of said electronic card and having at least a data string retained therein, said data string being related to said electronic card, said method comprising the steps of:

verifying a user of said electronic card utilising said data string;

executing an application on said remote apparatus in response to said verification of said user, said application being related to said service;

issuing challenge data to said electronic card using said application;

responding to said challenge data with response data generated by said electronic card;

verifying said response data using said application; and

allowing access to said service in response to said verification of said response data.

30. A method according to claim 29, wherein said electronic card comprises has one or more user interface elements formed on a surface of said card portion.

31. A method according to claim 30, comparing reading signals generated from a user selection of at least one of said user interface elements with said data string in order to verify said user.

32. A method according to claim 29, further comprising the step of applying a signature to said response data prior to transmission to said apparatus.

33. A method according to claim 29, further comprising the step of encrypting said response data prior to transmission to said apparatus.

34. A method according to claim 33, wherein said encryption is performed using a first security key stored in said memory means.

35. A method according to claim 29, wherein said verification is performed using a second security key stored at said apparatus.

36. A method according to claim 31, wherein said comparion of said reading signals is performed by said electonic card.

37. A method according to claim 34, wherein said first security key is a private key.

38. A method according to claim 35, wherein said second security key is a public key.

39. A method according to claim 29, wherein said challenge data is a random number generated by said application.

40. A method according to claim 29, wherein said challenge data is transmitted to said reader device within an application proctocol data unit.

41. A method according to claim 29, wherein said data string represents a personal identification number.

42. A system for utilising an electronic card to access a service provided by a remote apparatus, said electronic card comprising a card portion having one or more user interface elements formed on a surface thefeof and at least a memory means attached thereto, said memory means being adapted for coupling to a reader device to facilitate reading of said electronic card and having at least a data string retained therein, said data string being related to said electronic card, said system comprising the steps of:

comparator means for comparing reading signals generated from a user selection of at least one of said user interface elements with said data string;

processor means for executing an application on said remote apparatus in response to said comparison, said application being related to said service;

challenge means issuing challenge data to said electronic card using said application;

response means for responding to said challenge data with response data generated by said electronic card;

verification means for verifying said response data using said application; and

allowing access to said service in response to said verification.

43. A system according to claim 42, further comprising signature means for applying a signature to said response data prior to transmission to said apparatus.

44. A system according to claim 42, further comprising encryption means for encrypting said response data prior to transmission to said apparatus.

45. A system according to claim 44, wherein said encryption is performed using a first security key stored in said memory means.