JP2008242924A - Terminal equipment and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To increase the security of authentication information, and to simplify authentication using the authentication information. <P>SOLUTION: This terminal equipment is provided with: an SAM 4 having a flash memory 47 for storing data including a preliminarily set authentication code A and a CPU 41 for comparing the authentication code A with information; an input part 32 for accepting an input of an authentication code B; an RAM 33 having non-volatility and storage holding time non-volatility for holding storage for storing the authentication code B accepted by the input part 32, and a CPU 31 for reading the authentication code B stored in the RAM 33, making the CPU 41 compare the read authentication code B with the authentication code A, and when the comparison result is matched, permitting the use of the data stored in the flash memory 47. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

The present invention relates to a terminal device and a program.

  2. Description of the Related Art Conventionally, a terminal device used for payment by a credit card is known. In the terminal device, it is necessary to ensure the confidentiality of PIN (Personal Identification Numbers) information such as a password. For this reason, the terminal device provided with the module comprised with tamper resistance is used.

For example, a technique is known in which a module having tamper resistance is configured as a module that can be attached to and detached from a main body of a terminal device (see, for example, Patent Document 1). Thereby, the main body of the terminal device may not have tamper resistance. That is, application programs related to various transactions stored in the main body of the terminal device can be easily added, changed, modified, and updated, and versatility and expandability are improved.
JP 2003-16527 A

However, the above technique does not describe a technique for storing PIN information in the tamper resistant module. If the PIN information is stored in the tamper resistant module, the security of the PIN information can be maintained.
However, even if the PIN information is stored in the tamper-resistant module, the efficiency of user operability is poor in the case of a terminal device that requests PIN information every time the power is turned on. In this case, the user needs to input PIN information every time the power is turned on. Therefore, authentication using PIN information cannot be easily performed.
Further, when a plurality of users use one terminal device, it is necessary to notify the plurality of users of PIN information. In this case, a measure such as pasting the paper on which the PIN information is written on the terminal device is taken. Then, there is a possibility that PIN information is also known to a person who does not use the terminal device. For this reason, the security of PIN information (authentication information) could not be maintained.

  An object of the present invention is to increase the security of authentication information and easily perform authentication using the authentication information.

In order to solve the above problems, the terminal device according to the first aspect of the present invention provides:
It has tamper resistance provided with first storage means for storing data including first authentication information set in advance and first control means for comparing the first authentication information with information. Anti-tampering means,
Input means for receiving input of second authentication information;
Storing the second authentication information accepted by the input means, and having a non-volatility, or a second storage means having a non-volatile storage holding time for holding the storage;
The second authentication information stored in the second storage means is read, the read second authentication information and the first authentication information are compared with the first control means, and the comparison results match. A second control means for permitting use of the data stored in the first storage means,
Is provided.

The invention according to claim 2 is the terminal device according to claim 1,
In the case where the second storage unit has the storage retention time non-volatile, the storage unit includes an adjustment unit that adjusts the storage retention time.

The invention according to claim 3 is the terminal device according to claim 1 or 2,
The second storage means is
Volatile storage means having volatility;
Battery means for supplying power to the volatile storage means,
The adjusting means includes
By adjusting the amount of current of the battery means, the power supply time of the battery means as the memory retention time is adjusted.

The program of the invention described in claim 4 is:
Computer
It has tamper resistance provided with first storage means for storing data including first authentication information set in advance and first control means for comparing the first authentication information with information. Tamper resistant means,
Input means for receiving input of second authentication information;
A second storage means for storing the second authentication information received by the input means and having a non-volatility or a storage holding time for holding the memory;
The second authentication information stored in the second storage means is read, the read second authentication information and the first authentication information are compared with the first control means, and the comparison results match. If so, second control means for permitting use of the data stored in the first storage means,
To function as.

  ADVANTAGE OF THE INVENTION According to this invention, while improving the security of authentication information, the authentication using the said authentication information can be performed easily.

  Hereinafter, an example of an embodiment according to the present invention will be described in detail with reference to the accompanying drawings. However, the scope of the invention is not limited to the illustrated examples.

An example of an embodiment according to the present invention will be described with reference to FIGS.
First, with reference to FIG. 1, the structural example of the payment system 1 of this Embodiment is demonstrated. The payment system 1 is a system that performs payment using a credit card or a cash card. The payment system 1 includes a center server 2, an electronic device 3 as a terminal device, a terminal device, a SAM (Secure Application Module) 4 as tamper-proof means, and a network N. The center server 2 and the electronic device 3 are communicatively connected via a communication network N such as the Internet.

  As shown in FIG. 2, the center server 2 includes a CPU (Central Processing Unit) 21, an input unit 22, a RAM (Random Access Memory) 23, a display unit 24, a storage unit 25, and a communication unit 26. It is prepared for.

The CPU 21 develops a program designated from the system program and various application programs stored in the storage unit 25 in the RAM 23, and executes various processes in cooperation with the program expanded in the RAM 23. In particular, the storage unit 25 stores a settlement program to be described later.

  The CPU 21 transmits the permission information to the electronic device 3 after receiving the center server authentication information in cooperation with the settlement program. The center server authentication information means a terminal ID and an encrypted terminal ID. The terminal ID refers to unique ID information for each electronic device 3. The encrypted terminal ID refers to a terminal ID encrypted by SAM4. The permission information refers to information indicating that the operation of the electronic device 3 is permitted or not.

When permitting the operation of the electronic device 3, the CPU 21 transmits an operation OK signal to the electronic device 3 as permission information. When the operation of the electronic device 3 is not permitted, an operation refusal signal is transmitted to the electronic device 3 as permission information. At this time, the permission information is transmitted to the electronic apparatus 3 after being encrypted with a key T1 described later. In addition, after receiving payment information from the electronic device 3, the CPU 21 permits / denies payment processing.

  The input unit 22 includes a keyboard having cursor keys, numeric input keys, various function keys, and the like, and outputs a pressing signal pressed by the operator using the keyboard to the CPU 21. Further, the input unit 22 may include a pointing device such as a mouse.

The RAM 23 is a volatile memory that stores various types of information, and has a work area for developing various types of programs and data.

  The display unit 24 is configured by an LCD (Liquid Crystal Display), a CRT (Cathode Ray Tube), or the like, and performs screen display according to a display signal from the CPU 21.

  The storage unit 25 is configured by an HDD (Hard Disk Drive) or the like, and stores various programs and various data.

  The communication unit 26 includes a modem, a TA (Terminal Adapter), a router, a network card, and the like, and transmits and receives information to and from the electronic device 3 on the connected network N.

  As shown in FIG. 3, the electronic device 3 includes a CPU 31 as a second control unit, an input unit 32 as an input unit, a RAM 33 as a second storage unit and a volatile storage unit, and a backup as a battery unit. The battery 33A, a display unit 34, a flash memory 35 as a second storage unit, a communication unit 36, a connection unit 37, a card reader 38, and a connection unit 39 as an input unit are configured. The The CPU 31, the input unit 32, the RAM 33, and the communication unit 36 are the same as the CPU 21, the input unit 22, the RAM 23, and the communication unit 26, respectively, and different parts will be mainly described.

The CPU 31 expands a program specified from the system program and various application programs stored in the flash memory 35 in the RAM 33 and executes various processes in cooperation with the program expanded in the RAM 33. In particular, the flash memory 35 stores an authentication code receiving program to be described later.

  The CPU 31 reads the authentication code B from the RAM 33 in cooperation with the authentication code receiving program, compares the read authentication code B and the authentication code A with the SAM 4, and if the comparison result matches, the flash memory of the SAM 4 The use of the data (keys T1, R1, D1) stored in 47 is permitted. Here, the authentication code refers to authentication information (for example, PIN information) necessary for making a payment.

  The input unit 32 includes various input keys and the like, receives input of various information from the user from various input keys, and outputs the information to the CPU 31. Specifically, the input unit 32 receives an input of the authentication code B.

The RAM 33 is a volatile memory that stores various types of information. The RAM 33 stores the authentication code B input by the input unit 32. The RAM 33 is non-volatile during the backup time T as the storage holding time. Here, the backup time T means, for example, a time during which power can be supplied to the RAM 33 by the backup battery 33A when the power of the electronic device 3 is OFF. During the backup time T, the RAM 33 is non-volatile even when the power of the electronic device 3 is turned off.

  The backup battery 33A is a backup battery that supplies power to the RAM 33 for a predetermined time (backup time).

  The display unit 34 includes an LCD, an ELD (ElectroLuminescent Display), and the like, and performs screen display based on display information input from the CPU 31.

  The flash memory 35 is a non-volatile memory that stores various types of information in a readable and writable manner.

  The connection unit 37 is configured by an IC socket and performs electrical connection with the SAM 4. The card reader 38 reads information recorded on the IC card 38A. The connection unit 39 is configured by an IC socket, and performs electrical connection with the memory card 39A.

  The SAM 4 is configured by a tamper-resistant module or an IC card. Here, the IC card refers to a USIM (Universal Subscriber Identity Module) card. As shown in FIG. 4, the SAM 4 includes a CPU 41 as a first control unit, a cryptographic operation unit 42, a RAM 43, an abnormality detection unit 44, a ROM 45, a communication unit 46, and a first storage unit. And a flash memory 47. The CPU 41, RAM 43, communication unit 46, and flash memory 47 are the same as the CPU 21, RAM 23, communication unit 26, and flash memory 35, respectively, and different parts will be mainly described.

  The CPU 41 develops a program specified from the system program and various application programs stored in the flash memory 47 in the RAM 43 and executes various processes in cooperation with the program expanded in the RAM 43. In particular, the flash memory 47 stores an authentication code confirmation program to be described later. Here, the authentication code confirmation program may be stored in the ROM 45.

The CPU 41 confirms the validity of the authentication code B in cooperation with the authentication code confirmation program. Then, the verification result of the validity of the authentication code B is transmitted to the electronic device 3. Checking the validity of the authentication code B means comparing the authentication code A stored in the flash memory 47 with the authentication code B. As a result of the comparison, if the authentication code A and the authentication code B match, the authentication code B is confirmed to be valid.
In addition, when receiving a server authentication information generation instruction from the electronic device 3, the CPU 41 generates server authentication information. Generation of server authentication information refers to reading the terminal ID stored in the flash memory 47 or generating the encrypted terminal ID by encrypting the terminal ID.

  The cryptographic operation unit 42 performs encryption / decryption of information using the keys T1, D1, and R1. For example, the terminal ID is encrypted using the key T1. Further, the permission information received from the electronic device 3 is decrypted using the key T1.

  The abnormality detection unit 44 is configured by at least one of a voltage, a temperature, an optical sensor, and the like, for example. For example, when a third party tries to read data in the SAM 4 regardless of good intentions or bad intentions, abnormalities in abnormal voltage, temperature, and light (quantity) are detected. After detecting the abnormality, the data stored in the RAM 43 and flash memory 47 is erased (destroyed). The ROM 45 stores information in a readable manner.

  The flash memory 47 is a non-volatile memory that stores various information in a readable and writable manner. Specifically, the flash memory 47 stores an authentication code A, a key T1, a key D1, a key R1, and an authentication code confirmation program.

  Next, the encryption key will be described with reference to FIG. Here, description will be made using the key T1, the key D1, and the key R1 as encryption keys.

  The key T1 is a unique key for each electronic device 3. The keys T1 are stored in pairs in the storage unit 25 of the center server 2 and the flash memory 47 of the SAM4. In this case, the key T1 is stored, for example, as a pair of common key cryptosystems. The encryption method may be encrypted using a public key encryption method.

The key D1 is an encryption key for data outside the SAM 4 (for example, the RAM 33 and the flash memory 35 of the electronic device 3). The key D1 is stored in the flash memory 47 of the SAM4. The encrypted data D of the key D1 indicates data encrypted with the key D1. For example, it indicates data including card numbers that are prohibited from use. Also, the encrypted data D of the key D1 is stored in the RAM 33 or the flash memory 35 of the electronic device 3. The key R1 is an authentication key for the card reader 38. The key R1 is stored in the card reader 38 and the flash memory 47, respectively.

  Next, an operation of registering (storing) the authentication code A in the flash memory 47 of the SAM 4 will be described with reference to FIG. First, an authentication code A is issued from the center server 2 when the electronic device 3 is manufactured. The issued authentication code A is transmitted to the SAM 4 via the electronic device 3. The authentication code A is stored in the flash memory 47 of the SAM 4.

  Next, with reference to FIG. 7, an authentication code confirmation operation will be described. For example, it is assumed that the electronic device 3 is purchased by the user. At this time, the authentication code A is transmitted only to the purchased user by the vendor of the electronic device 3. Then, at the place where the electronic device 3 is shipped, the user enters the same authentication code B as the authentication code A transmitted from the seller. The input authentication code B is stored in the RAM 33 of the electronic device 3. Then, it is determined whether or not the authentication code B stored in the RAM 33 matches the authentication code A stored in the flash memory 47 of the SAM 4.

The authentication code B is input only when the electronic device 3 is installed as described above. After the electronic device 3 is installed, the authentication code B stored in the RAM 33 is used. This eliminates the need for the user to input the authentication code B many times. Therefore, authentication can be performed easily. Even when a plurality of users use the electronic device 3, it is not necessary to write the authentication code B on paper or the like. Therefore, the security of the authentication code B can be improved.

  Next, with reference to FIG. 8, the operation when the authentication code A and the authentication code B match in FIG. 7 will be described. In this case, first, the SAM 4 generates center server authentication information (terminal ID, encrypted terminal ID). At this time, the encrypted terminal ID is encrypted using the key T1. The generated center server authentication information is transmitted to the center server 2 via the electronic device 3.

  Then, the center server 2 confirms the server authentication information. The server authentication information is confirmed based on the decryption result of the encrypted terminal ID. For example, assume that the terminal ID is ID1. In this case, the key T1 corresponding to the terminal ID1 is read based on a table (not shown) in which the key T and the terminal ID are stored in association with each other. Then, decryption is performed using the read key T1. Then, it is determined whether or not the decrypted terminal ID (decrypted terminal ID) matches the terminal ID. When the decryption terminal ID and the terminal ID are both ID1, an operation OK signal is transmitted to the electronic device 3 as permission information. Further, when it is determined that the decryption terminal ID and the terminal ID do not match, an operation rejection signal is transmitted to the electronic device 3. At this time, the operation OK signal or the operation rejection signal is encrypted by the center server 2 with the key T1 and transmitted.

Then, an operation OK signal or an operation rejection signal is transmitted to the SAM 4 by the electronic device 3. Then, the operation OK signal or the operation rejection signal is decrypted with the key T1 by the SAM4. When the operation OK signal is decoded, a use permission signal is transmitted to the electronic device 3. When the operation refusal signal is decoded, a use non-permission signal is transmitted to the electronic device 3.

When the use permission signal is transmitted from the SAM 4 to the electronic device 3, the electronic device 3 transmits an instruction to read the key R 1 to the SAM 4. Then, the key R1 is transmitted from the SAM 4 to the electronic device 3. After the key R1 is transmitted, the electronic device 3 decrypts the payment information (for example, the card number) read by the card reader 38 using the key R1. Also, the encrypted data D of the key D1 is decrypted by the electronic device 3 using the key D1. Then, it is determined whether or not the payment information matches the decrypted data D. For example, it is determined whether or not the card number, which is the payment information, matches the prohibited card number included in the decrypted data D. If it is determined that the payment information does not match the decrypted data D, the payment information is encrypted using the key T1. Then, the settlement information encrypted with the key T1 is transmitted from the electronic device 3 to the center server 2.

Then, the center server 2 decrypts the transmitted payment information with the key T1. After the payment information is decrypted with the key T1, confirmation of approval of the decrypted payment information is performed. Confirmation of the settlement information is performed by determining whether or not the settlement information (card number or the like) stored in advance in the center server 2 matches the decrypted settlement information. If it is determined that the two match, the center server 2 transmits a settlement permission signal to the electronic device 3. When it is determined that the two do not match, the center server 2 transmits a settlement non-permission signal to the electronic device 3. Then, settlement processing is performed by the electronic device 3.

  Next, with reference to FIG. 9, the operation when the authentication code A and the authentication code B do not match in FIG. 7 will be described. In this case, the keys T1, R1, and D1 cannot be used. Further, the input authentication code B is erased without being stored in the RAM 33 of the electronic device 3.

  Next, an authentication code confirmation process executed by the SAM 4, an authentication code reception process executed by the electronic device 3, and a settlement process executed by the center server 2 will be described with reference to FIGS. 10 and 11. . The authentication code confirmation process is a process for confirming the validity of the input authentication code B. The authentication code reception process is a process of receiving the authentication code B input by the user via the input unit 32 and instructing the SAM 4 to confirm the validity of the authentication code B. The settlement processing is processing for authenticating the center server authentication information and permitting or not permitting settlement.

  First, the authentication code confirmation process will be described. For example, an authentication code confirmation process is performed in cooperation with the CPU 41 and an authentication code confirmation program read from the ROM 45 and appropriately expanded in the RAM 43, triggered by the start of reception of an authentication code confirmation instruction signal from the electronic device 3. Is executed.

  First, a confirmation instruction for the authentication code B is received from the electronic device 3 (step S101). The confirmation instruction for the authentication code B refers to instruction information for confirming the validity of the authentication code B. The authentication code B is included in the confirmation instruction information of the authentication code B. Then, the authentication code B is confirmed, and the confirmation result of the authentication code B is transmitted (step S102). Here, the verification of the authentication code B is performed by comparing whether or not the authentication code A stored in the flash memory 47 matches the received authentication code B. Then, the confirmation result of the authentication code B is transmitted to the electronic device 3.

  After execution of step S102, it is determined whether or not the authentication code A and the authentication code B match (confirmation result OK) (step S103). If the confirmation result is not OK (step S103; NO), stop processing is executed (step S104). This stop process corresponds to the operation described in FIG. After executing step S104, the authentication code confirmation process ends.

  If the confirmation result is OK in step S103 (step S103; YES), an instruction to generate center server authentication information is received from the electronic device 3 (step S105). Then, center server authentication information is generated, and the center server authentication information is transmitted to the electronic device 3 (step S106). Specifically, the terminal ID and the encrypted terminal ID encrypted with the key T <b> 1 are transmitted to the electronic device 3.

  After execution of step S106, an instruction to read the key R1 is received from the electronic device 3 (step S107). Then, the key R1 stored in the flash memory 47 is read, and the read key R1 is transmitted to the electronic device 3 (step S108). After execution of step S108, the authentication code confirmation process ends.

  Next, an authentication code reception process executed by the electronic device 3 will be described. For example, in the electronic device 3, an authentication code reception program read from the flash memory 35 and appropriately expanded in the RAM 33, triggered by an input of an execution instruction of the authentication code reception process via the input unit 32, etc. An authentication code acceptance process is executed in cooperation with the CPU 31. At this time, it is assumed that the authentication code A issued from the center server 2 is stored in the flash memory 47 of the SAM 4 in advance.

  First, the authentication code B on the RAM 33 is confirmed (step S201). Confirmation of the authentication code B on the RAM 33 is performed by confirming whether or not the authentication code B is stored in the RAM 33. And it is discriminate | determined whether it is confirmation OK (step S202). That is, whether or not the authentication code B is stored in the RAM 33 is confirmed. In the case of confirmation OK (step S202; YES), the process proceeds to step S204 described later. When it is not confirmation OK (step S202; NO), the input of the authentication code B from the user is accepted through the input unit 32, and the accepted authentication code B is stored in the RAM 33 (step S203).

  After execution of step S203, a confirmation instruction for the authentication code B is transmitted to the SAM 4 (step S204). Then, the confirmation result of the authentication code B is received from the SAM 4 (step S205).

  After execution of step S205, it is determined whether or not the confirmation result is OK (step S206). When it is determined that the confirmation result is not OK (step S206; NO), a retry is executed (step S207). At this time, the input authentication code B is erased without being stored in the RAM 33, and a retry is executed.

  If it is determined in step S206 that the confirmation result is OK (step S206; YES), a center server authentication information generation instruction is transmitted to the SAM 4 (step S208). That is, an instruction for generating a terminal ID and an encrypted terminal ID is transmitted to the SAM 4. Then, the center server authentication information is received from the SAM 4 (step S209).

After execution of step S209, the center server authentication information is transmitted to the center server 2 (step S210). Then, permission information is received from the center server 2 (step S211). That is, the operation OK signal or the operation rejection signal encrypted with the key T1 is received from the center server 2. Then, as described with reference to FIG. 8, permission information (operation OK signal or operation rejection signal) is transmitted to the SAM 4, and the permission information is decoded by the SAM 4. After the permission information is decoded, a use permission signal or a use non-permission signal is transmitted to the electronic device 3.

  When the use permission signal is transmitted from the SAM 4, an instruction to read the key R 1 is transmitted to the SAM 4 (Step S 212). Then, the key R1 is received from the SAM 4 (step S213). After the key R1 is received, the settlement information read by the card reader 38 using the key R1 is decrypted (step S214). At this time, as described in FIG. 8, the encrypted data of the key D1 is also decrypted using the key D1. If it is determined that the settlement information decrypted in step S214 does not match the decrypted data D, the settlement information is encrypted with the key T1.

  Then, the encrypted payment information is transmitted to the center server 2 (step S215). After execution of step S215, settlement permission / denial information is received from the center server 2 (step S216). Then, a settlement process is executed (step S217). After execution of step S217, the authentication code acceptance process ends.

  Next, settlement processing executed by the center server 2 will be described. For example, the payment processing is executed in cooperation with the CPU 21 and the payment program read out from the storage unit 25 and appropriately expanded in the RAM 23, triggered by the start of reception of the center server authentication information from the electronic device 3. Is done.

  First, center server authentication information is received from the electronic device 3 (step S301). That is, a terminal ID (receiving terminal ID) and an encrypted terminal ID are received as center server authentication information. At this time, it is assumed that the encrypted terminal ID is encrypted with the key T1 in the cryptographic operation unit 42 of the SAM4. Then, the center server authentication information is confirmed, and a permission signal is transmitted to the electronic device 3 (step S302). The confirmation of the center server authentication information is as described with reference to FIG.

  After execution of step S302, payment information is received from the electronic device 3 (step S303). Then, as described with reference to FIG. 8, settlement information approval confirmation is performed, and settlement approval / disapproval information is transmitted (step S304). After execution of step S304, the settlement process ends.

  As described above, according to the present embodiment, the authentication code B stored in the RAM 33 is read, and the read authentication code B and the authentication code A stored in the flash memory 47 are compared with the CPU 41 of the SAM 4. If the comparison results match, the use of the data stored in the flash memory 47 can be permitted. Thereby, since the authentication code A is stored in the flash memory 47 having tamper resistance, the security of the authentication code A can be enhanced. Further, once the user inputs the authentication code B, it is not necessary to input the authentication code B thereafter. Thereby, user operability is improved and authentication can be easily performed. In addition, once the user inputs the authentication code B, it is not necessary to write the authentication code B on paper or the like to notify a plurality of users. Therefore, the security of the authentication code B can be maintained.

  Further, the backup battery 33A can supply power to the RAM 33 during the backup time. Thereby, when the backup time elapses, the RAM 33 is not supplied with power by the backup battery 33A, and the data stored in the RAM 33 can be erased. Therefore, even if the terminal device 3 is unnecessary and discarded, it is necessary to re-enter the authentication code B, so that it is possible to prevent abuse of the terminal device 3 by a third party. Further, while the RAM 33 is being fed by the backup battery 33A, the authentication code B is stored in the RAM 33, so that it can be used without degrading the operability of the terminal device 3.

(Modification of the embodiment)
Next, a modification of the embodiment according to the present invention will be described with reference to FIG. FIG. 12 shows an internal configuration of the electronic apparatus 3A. Hereafter, the same code | symbol is attached | subjected to the part similar to the electronic device 3, and the detailed description is used and a different part is demonstrated.

  The electronic device 3A includes a main power source VA, a battery VB as battery means, and a resistor R as adjustment means. The main power supply VA supplies a voltage V1 to the electronic device 3A. The battery VB supplies the voltage V2 to the RAM 33 during the backup time T. The battery VB corresponds to the backup battery 33A in FIG.

  The resistor R is a load resistor having a resistance value r1, and adjusts the backup time T of the RAM 33. Specifically, the resistor R adjusts the backup time T that is the power supply time of the battery VB by adjusting the amount of current of the battery VB. Here, the current amount (discharge current) of the battery VB is obtained by (V2 / r1). That is, by adjusting the resistance value r1 of the resistor R, the current amount of the battery VB can be adjusted.

  Here, the backup time T will be described. For the backup time T, the description of the above embodiment is used. In other words, the backup time T is a time during which the voltage V2 can be supplied to the RAM 33 by the battery VB in a state where the power supply of the electronic device 3A is OFF (a state where the voltage V1 is no longer supplied to the electronic device 3A). After the backup time T has elapsed, the supply of the voltage V2 from the battery VB is completed, and the data (authentication code B) stored in the RAM 33 is erased.

Here, assuming that the capacity of the battery VB is C (Ah) and the current consumption of the RAM 33 is i (A), the backup time T is obtained by the following equation (1).
T = C / (i + V2 / r1) (1)
From the equation (1), the backup time T can be obtained by designing the resistance value r1 of the resistor R to an appropriate value when designing the electronic apparatus 3A.

  For example, when the electronic device 3A is designed, the resistance value r1 of the resistor R is designed so that the backup time T is one month. In this case, the authentication code B stored in the RAM 33 is erased after one month. Therefore, the electronic device 3A cannot be used. In other words, even if the electronic device 3A is discarded without being invalidated, the electronic device 3A cannot be used.

  As described above, according to the modification of the present embodiment, similarly to the effect of the above-described embodiment, since the battery VB does not supply power to the RAM 33 after the backup time T has elapsed, the data stored in the RAM 33 is erased. Can do. Therefore, even if the terminal device 3A is no longer needed and discarded, it is necessary to re-enter the authentication code B, so that the abuse of the terminal device 3A by a third party can be prevented. Further, while the RAM 33 is powered by the battery VB, the authentication code B is stored in the RAM 33, so that it can be used without reducing the operability of the terminal device 3A.

  Further, by adjusting the resistance value r1 of the resistor R, the current amount (V2 / r1) of the battery VB can be adjusted. Thus, the user can set the backup time T by adjusting (designing) the resistance value r1 of the resistor R to an appropriate value at the time of designing. For example, when the current amount (V2 / r1) is designed so that the backup time T is one week, the terminal device 3A can be reliably disabled after one week. Thereby, abuse of the terminal device 3A can be prevented. Further, the user can grasp the state of the terminal device 3A (for example, whether or not the terminal device 3 is in a discarding state) by setting the backup time T.

  Note that the descriptions in the above embodiments and modifications are examples of the terminal device and the program according to the present invention, and the present invention is not limited thereto.

  For example, in the embodiment and the modification described above, the payment system 1 includes the electronic device 3 (or the electronic device 3A) and the SAM 4. However, the present invention is not limited to this. For example, as shown in FIG. 13, it is good also as a structure provided with the electronic device 3B which does not have tamper resistance, and the module 4A which has tamper resistance.

  Here, the electronic apparatus 3B includes a CPU 51, a line control unit 52, a printing unit 53, a display unit 54, a RAM 55, and a flash memory 56. The CPU 51, the line control unit 52, the display unit 54, the RAM 55, and the flash memory 56 are the same as the CPU 31, the communication unit 36, the display unit 34, the RAM 33, and the flash memory 35, respectively. The printing unit 53 prints the settlement processing result.

  The module 4A includes a CPU 61, an input unit 62, a card reader 63, a RAM 64, and a flash memory 65. The CPU 61, the input unit 62, the card reader 63, the RAM 64, and the flash memory 65 are the same as the CPU 31, the input unit 32, the card reader 38, the RAM 43, and the flash memory 45, respectively, and detailed descriptions thereof are cited. Here, since the module 4A is configured to be tamper resistant, the data in the RAM 64 and the flash memory 65 is destroyed when, for example, a predetermined detection means detects the opening of the module. This ensures tamper resistance.

  In the case of the above configuration, the authentication code B is input by the input unit 62. Then, the CPU 61 confirms the input authentication code B and the authentication code A stored in the RAM 64. Then, the confirmation result is transmitted to the electronic device 3B. With this configuration, the security of authentication information can be increased and authentication can be performed easily.

  Further, although the authentication code B has been described as being stored in the RAM 33, it may be stored in the flash memory 35.

  Further, although the authentication code B is input via the input unit 32, for example, the authentication code B may be stored in the memory card 39A. In this case, the authentication code B is input by the connection unit 39 as input means. That is, the authentication code B is read from the memory card 39 </ b> A, and the read authentication code B is input by the connection unit 39. Then, the inputted authentication code B is stored in the RAM 33.

  Further, although the backup time T is set by adjusting (designing) the resistance value r1 of the resistor R, the present invention is not limited to this. For example, the backup time T may be adjusted by using a timer (not shown) as the adjusting means. In this case, when the backup time T prepared by the timer is reached, the CPU 31 erases the data stored in the flash memory 35 or the RAM 33.

  In addition, the detailed configuration and detailed operation of the payment system 1 in the above embodiment can be changed as appropriate without departing from the spirit of the present invention.

It is the schematic which shows the payment system 1 which concerns on this invention. 2 is a block diagram showing an internal configuration of a center server 2. FIG. 3 is a block diagram showing an internal configuration of a terminal device 3. FIG. It is a block diagram which shows the internal structure of SAM4. It is a figure explaining an encryption key. It is explanatory drawing of the operation | movement which registers the authentication code A in SAM4. It is explanatory drawing of the confirmation operation | movement of an authentication code. It is explanatory drawing of operation | movement when the authentication code A and the authentication code B correspond. It is explanatory drawing of operation | movement when the authentication code A and the authentication code B do not correspond. It is a flowchart which shows an authentication code confirmation process, an authentication code reception process, and a payment process. It is a flowchart which shows an authentication code confirmation process, an authentication code reception process, and a payment process. It is a block diagram which shows the internal structure of 3 A of terminal devices. It is a block diagram which shows the internal structure of the terminal device 3B and the module 4A.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Payment system 2 Center server 3, 3A, 3B Terminal device 4 SAM
11, 21, 31 CPU
22, 32 Input unit 23, 33, 43 RAM
24, 34 Display unit 25 Storage unit 26, 36 Communication unit 33A Backup battery 35, 45 Flash memory 37, 39 Connection unit 38 Card reader 38A IC card 39A Memory card 42 Cryptographic operation unit 44 Abnormality detection unit A, B Authentication code T1, D1, R1 Encryption key T Backup time VA Main power supply VB Battery

Claims (4)

It has tamper resistance provided with first storage means for storing data including first authentication information set in advance and first control means for comparing the first authentication information with information. Anti-tampering means,
Input means for receiving input of second authentication information;
Storing the second authentication information accepted by the input means, and having a non-volatility, or a second storage means having a non-volatile storage holding time for holding the storage;
The second authentication information stored in the second storage means is read, the read second authentication information and the first authentication information are compared with the first control means, and the comparison results match. A second control means for permitting use of the data stored in the first storage means,
A terminal device comprising:   The terminal device according to claim 1, further comprising an adjusting unit configured to adjust the storage holding time when the second storage unit has the storage holding time non-volatile. The second storage means is
Volatile storage means having volatility;
Battery means for supplying power to the volatile storage means,
The adjusting means includes
The terminal device according to claim 1, wherein a power supply time of the battery unit as the memory holding time is adjusted by adjusting a current amount of the battery unit. Computer
It has tamper resistance provided with first storage means for storing data including first authentication information set in advance and first control means for comparing the first authentication information with information. Tamper resistant means,
Input means for receiving input of second authentication information;
A second storage means for storing the second authentication information received by the input means and having a non-volatility or a storage holding time for holding the memory;
The second authentication information stored in the second storage means is read, the read second authentication information and the first authentication information are compared with the first control means, and the comparison results match. If so, second control means for permitting use of the data stored in the first storage means,
Program to function as.

Images