JP2003122640A - Secret information protection system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a secret information protection system capable of preventing secret information from being leaked to a third person in acquiring and processing secret information by application software operating by a universal OS. SOLUTION: A control circuit 2 for a universal OS and a control circuit 3 for security are separately arranged, and the control circuit 3 for security is constituted so as to be operated by a private OS. The control circuit 2 for the universal OS requests the acquisition of secret information to the control circuit 3 for security by executing processing which is not directly associated with the reading of secret information such as picture display for promoting the input of a password or picture display for promoting the insertion of a card into a card reader. The control circuit 3 for security acquires the secret information whose security is required by executing the input control of a keyboard and a touch panel or the like and the reading control of the card reader, and enciphers the secret information by an enciphering part 17, and returns the enciphered data to the control circuit 2 for the universal OS. The control circuit 2 for the universal OS transmits the received enciphered data to an outside host equipment as they are.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a confidential information protection system for preventing confidential information from leaking to a third party during confidential information acquisition processing by an application module operating on a general-purpose OS.

[0002]

2. Description of the Related Art Conventionally, for example, in credit card payment and debit card payment, a personal identification number or ID, a credit line balance or a deposit balance is input between a host device managing the payment and a payer. Personal information, such as a display, that requires security as confidential information is transmitted and received via the man-machine interface.

As input / output devices such as a keyboard, a touch panel, and a card reader, for inputting a personal identification number or ID, an I / O device as a man-machine interface used for these processes is used. A display output device such as an LCD or CRT is used to display the credit line balance or the deposit balance. Further, an output device such as a speaker that gives a voice notification is also used.

In order to operate these I / O devices as a man-machine interface, application software that can be activated by a user on a general-purpose OS is combined between the host device and the I / O device. Are often used as It is convenient to use a general-purpose OS because it is possible to easily create application software for man-machine interface using a development tool that is open to the public.

[0005]

However, general-purpose O
In the case of S, the development environment of the application software is open to the public, so that it is easy to develop the pseudo application software. Therefore, when the original application software is combined with the above-mentioned function involving security processing, I / O For example, there has been a large number of temporary damages in which a personal identification number input from a device is stolen and misused by pseudo application software secretly incorporated by a third party.

This is because, for example, when a credit card is passed through a card reader, information is read by pseudo application software, and a personal identification number entered by key operation is also read by pseudo application software. The data is stored in an appropriate memory and then read out in a batch and used improperly.

[0007] In this way, developed by the public development tool,
A security function that incorporates application software that is activated on a general-purpose OS has a high possibility of easily leaking confidential information such as personal information to the outside due to pseudo application software. And there was a problem.

Therefore, there is a practical difficulty in using a general-purpose OS and a security function in combination, although it is easy to develop application software with a development tool.

The object of the present invention is to solve the above-mentioned conventional problems.
It is an object of the present invention to provide a confidential information protection system that prevents leakage of confidential information to a third party during confidential information acquisition processing by an application module operating on a general-purpose OS.

[0010]

The structure of the confidential information protection system according to the present invention will be described below. The secret information protection system of the present invention is a secret information protection system in the case where the acquisition processing of security-related secret information required by a host device is executed by the control of the general-purpose OS by an application module operating on the general-purpose OS. There
The security control of the secret information and the general-purpose OS side control are separated. When the general-purpose OS side control acquires the secret information, the secret-information acquisition request is transmitted to the security control, and the security control is requested to acquire. The secret information is converted into encrypted data that can be decrypted only by the host device and returned to the general-purpose OS side control, and the general-purpose OS side control transmits the returned encrypted data as it is to the host device. Is configured as follows.

The general-purpose OS-side control sends predetermined ID data to the security control prior to the secret information acquisition request, and the security control verifies that the ID data is correct. When the ID data is confirmed, the encrypted data is transferred to the general-purpose OS.
It is configured to reply to the side control.

In this secret information protection system, for example, as described in claim 3, the security control and the general-purpose OS side control are performed through the same I / O control, respectively, and one or more I / O devices are provided. The general-purpose OS side control uses the I / O device through the I / O control when transmitting / receiving normal data, and the security control performs the I / O control when transmitting / receiving the secret information. Is configured to use the above I / O device by occupying the control right of the above. Also, in this confidential information protection system, for example, as described in claim 4, the security control is a dedicated I / O.
Other I / O dedicated to the general-purpose OS side control
It is configured with equipment.

In any case, the security control may be executed by application software running on an undisclosed OS as described in claim 5, or as described in claim 6, for example. In addition, it may be configured to be executed by a dedicated circuit having a hardware configuration.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing a configuration of a secret information protection system according to the first embodiment. As shown in the figure, the secret information protection system 1 includes a general-purpose OS control circuit 2 connected to an external host device (not shown),
The general-purpose OS control circuit 2 and the security control circuit 3 are combined.

The general-purpose OS control circuit 2 on one side is a CP
U5 and LC connected to this CPU5 via bus 6
Display output unit 7 including a display module such as D, PCMC
An I / O (input / output) unit 8 such as an IA standard PC card or a touch panel, an interface unit 9 for connecting to an external device such as a host device, a communication function unit 11 for communicating with the security control circuit 3, A memory unit 12 that temporarily stores various data and an RO that stores a general-purpose OS
M or a storage, or a medium unit 13 for reading and writing by mounting an appropriate medium.

Then, the other security control circuit 3
Of the data of the CPU 15, the encryption unit 17 connected to the CPU 15 via the bus 16, the keyboard unit 18 for processing an event from the keyboard, and the data of the magnetic card such as a credit card or a debit card inserted in the card reader. Card reading unit 19 for controlling reading, general-purpose OS
Communication function unit 21 for communicating with the control circuit 2 for use, a memory unit 22 for temporarily storing various data, and a general-purpose O
It is composed of a ROM storing S or a storage, or a medium unit 23 for reading and writing by mounting an appropriate medium.

The security control circuit 3 operates with a proprietary OS that is not disclosed to the outside, and is composed of a microcomputer including a circuit embedded in one chip. A dedicated driver is used. However, for example, it is arranged at an appropriate location which is difficult to discriminate among a large number of electronic chip components mounted on the same printed circuit board on which the general-purpose OS control circuit 2 is constructed. Of course, it may be arranged in a device separate from the general-purpose OS control circuit 2.

The LCD and the like include a CRT and the like, and the touch panel and keyboard are
They may be replaced with each other, and credit and debit cards are not limited to magnetic cards.
It may be a C card.

The general-purpose OS control circuit 2 on one side is a CP
While controlling each unit by the U5, mainly based on an input instruction from the I / O unit 8 by a system user or an instruction input from an external host device via the interface unit 9, for example, payment amount or Performs processing that is not involved in the control of the part directly related to confidential information such as personal information that requires security.

In this processing, for example, a screen for prompting the input of the personal identification number, a screen for prompting the insertion of the card into the card reader, a screen for notifying the good or bad of the processing performed, and a voice notification thereof are given. This is a process for controlling various I / O devices so as to drive the speaker, and a process for transmitting an information acquisition request from the host device to the security control circuit 3.

Contrary to the general-purpose OS control circuit 2, the other security control circuit 3, on the other hand, is a portion directly related to confidential information such as payment amount and various personal information, that is, important data shown by a broken line in FIG. Control the part that processes. For example, the input control of the personal identification number by the keyboard unit 18, the reading of the input personal identification number, and the card reading unit 19
Control of inserting the card into the card reader and reading of personal information such as name, telephone number, and ID from the inserted card.

Then, the security control circuit 3 encrypts the read personal identification number and other personal information by the encryption unit 17, and then the encrypted data is transmitted to the communication function unit 2
It is sent to the general-purpose OS control circuit 2 via 1 and 11.
The general-purpose OS control circuit 2 in the configuration of the present example does not have a decryption function for the above-mentioned encrypted data, and the above-mentioned encrypted data input from the security control circuit 3 is directly transmitted to the outside via the interface unit 9. Send to host device.

The external host device is composed of a server or the like for managing secret information such as the above-mentioned payment amount and various personal information acquired through the secret information protection system 1, and has a decryption function for the above-mentioned encrypted data. Having the above, the encrypted data of the secret information returned from the general-purpose OS control circuit 2 in response to the acquisition request from the own device is decrypted, a predetermined management process is executed, and the processing result is displayed if necessary. General-purpose OS control circuit 2
To notify.

FIG. 2 is a flowchart showing a magnetic card reading process as an example of communication by the general-purpose OS control circuit 2 and the security control circuit 3 described above. As shown in the figure, the general-purpose OS control circuit 2 sends (issues) a command to start transmission / reception to / from the security control circuit 3 to the security control circuit 3 (step H21) to perform security control. It waits for reception of the ACK (contract) signal from the circuit 3 (step H22, determination is N). Note that the transmission / reception start command is issued from the general-purpose OS control circuit 2 by the I / O unit 8 by the customer using the system.
It is performed based on an input instruction from the user or a start of a device provided in the system for automatically detecting a customer using the system.

Upon receiving the transmission / reception start command, the security control circuit 3 returns (responds) an ACK signal or a NACK (rejection) signal to start transmission / reception (step S31). Normally, an ACK signal is returned unless there is a failure in the devices related to the security control circuit 3.

When the general-purpose OS control circuit 2 receives the ACK signal from the security control circuit 3 (Yes in H22), it sends a magnetic card control command to the security control circuit 3 (step H23). At this time, the general-purpose OS control circuit 2 uses the display output unit 7 to the customer who uses the system, for example, "Please insert a card", and the magnetic card to the card reader that is controlled by the security control circuit 3 is displayed. Display a screen prompting you to insert the.

When the security control circuit 3 receives the above magnetic card control command, the card reading unit 19 drives and controls the card reader (step S32), and the credit card inserted by the customer using the system.
Data consisting of personal confidential information recorded on a magnetic card such as a cash card or a debit card is read, the read data is encrypted, and the encrypted data is returned to the general-purpose OS control circuit 2 (step S
33). The general-purpose OS control circuit 2 transmits the encrypted data received from the security control circuit 3 to the host device via the interface unit 9 (step H2).
4).

As described above, the general-purpose OS control circuit 2 does not participate in the control of the portion directly related to security-sensitive secret information such as the payment amount and personal information, and these information are controlled by the security control circuit 3. After being converted into encrypted data that can be decrypted only by the host device, it is delivered to the general-purpose OS control circuit 2. Therefore, even if general-purpose O
Even if the pseudo application software by a third party operating on S intervenes, since the data to be read is encrypted data, at least the security control circuit 3
It is not known what kind of information is given from the signal sent from the general-purpose OS control circuit 2 to the general-purpose OS control circuit 2. That is, the confidential information cannot be read effectively.

In the above example, the transmission / reception of the data recorded on the magnetic card is described, but step H2
In the processes of S3, S32, and S33, the process of transmitting / receiving the personal identification number can be replaced. That is, the personal identification number stored in the database of the host device corresponding to the magnetic card whose data has been read in the above-described processing and the personal identification number input in the above-mentioned replaced processing of steps H23, S32, and S33. When and are compared and match,
Data reading from a further magnetic card thereafter may be executed. Of course, in this case, if the personal identification numbers do not match, even if there is a data acquisition request from the general-purpose OS control circuit 2, the security control circuit 3
No response from.

When data is passed from the security control circuit 3 to the general-purpose OS control circuit 2, the security control circuit 3 receives the specific code from the general-purpose OS control circuit 2 at the first time or each time. You may set so that it may be limited to.

FIG. 3 is a diagram showing the configuration of the secret information protection system according to the second embodiment. Since the configuration of each part of the security control circuit 3 shown in the figure is the same as that in the case of FIG. 1 described above, each part is shown with the same number as in FIG. In the general-purpose OS control circuit 2 ′, the same functions as those in FIG. 1 are designated by the same reference numerals as those in FIG. 1, and the different functions from those in FIG. 1 are the same as those in FIG. 1. Is added with “′”, and a newly added portion is given a new number.

As shown in the figure, in the secret information protection system 25 of this example, the general-purpose OS control circuit 2'is encrypted / encrypted.
The decoding function unit 14 is provided. In the data communication with the security control circuit 3, all the encrypted data is communicated, but when passing the encrypted data from the security control circuit 3 to the general-purpose OS control circuit 2 ', the general-purpose OS control circuit 2' It is set to be limited to when a specific code is received from.

Upon receiving the above specific code, the security control circuit 3 encrypts the data obtained via the I / O device by the encryption unit 17, and then the encrypted data is transferred to the general-purpose OS control circuit 2 Send to ' The general-purpose OS control circuit 2'can decrypt the received encrypted data by the encryption / decryption function unit 14, and the decision as to whether or not to decrypt this encrypted data is switched depending on the situation. To be This switching depends on the application software of the corresponding device, for example, matching of the secret code,
Discrepancy etc. is used as a criterion.

Security-sensitive secret data in, for example, personal information that need not be decrypted at the processing stage of the general-purpose OS control circuit 2'is transmitted to the host device through the interface 9 with the outside as it is. Therefore, even in this case, even if the pseudo application software or the circuit is installed by the third party somewhere on the side of the general-purpose OS control circuit 2'or somewhere on the signal transmission path 26, the system is not operated. There is no risk that the confidential information flowing through will be read in an effective shape.

Similarly, the pseudo application software or the circuit is changed by the third party to the security control circuit 3
Even if it is installed on the side, the OS is different between the general-purpose OS on which the pseudo application software can operate and the OS on which the security control circuit 3 operates. Therefore, the installed pseudo application software can operate effectively. I can't. Therefore, security is maintained.

FIG. 4 is a diagram showing the configuration of the secret information protection system in the third embodiment. The secret information protection system 26 shown in the figure has an I / O control circuit 29 between a general-purpose OS control circuit 27 and a security control circuit 28.
Is intervened.

The general-purpose OS control circuit 27 is the same as the general-purpose OS control circuit 2 shown in FIG. 1 or the general-purpose OS control circuit 2'shown in FIG. 3, and the CPU 30 and the CPU 30 via the bus 31. Connected communication function unit 32, memory unit 3
3, the medium unit 34 is provided, but the I / O device is not provided. The security control circuit 28, like the security control circuit 3 shown in FIG. 1 or 3, also has a CPU 35, a communication function unit 37 connected to the CPU 35 via a bus 36, and an encryption unit. 38, memory unit 3
9. The medium unit 40 is provided, but the I / O device is not provided.

The I / O control circuit 29 is connected to the CPU 4
1 and two communication function units 43 and 44 are connected to the CPU 41 via a bus 42. The communication function unit 43 is a communication interface with the general-purpose OS control circuit 27, and the communication function unit 44 is a communication interface with the security control circuit 28. The I / O control circuit 29 is
Further, a PCMCIA standard PC card, an I / O unit 45 such as a touch panel, an interface unit 46 for connecting to an external device such as a host device, a keyboard unit 47 for processing events from the keyboard, and a display including a display module such as an LCD. The output unit 48, the memory unit 49 for temporarily storing various data, the ROM storing various control programs, the storage, or the medium unit 50 for reading and writing by mounting an appropriate medium, and the card reader are inserted. A card reading unit 51 for controlling reading of data from a magnetic card such as a credit card or a debit card is provided.

That is, the general-purpose OS control circuit 27 and the security control circuit 28 do not have the function of directly controlling the I / O equipment in their own circuits, and the I / O control circuit 29 is used to It is configured to share more than one I / O device.

When the I / 0 control circuit 28 receives a notification from one of the general-purpose OS control circuit 27 and the security control circuit 28 that control is desired, the I / 0 control circuit 28 accepts control from that circuit, while the other control is received. For the circuit, the presence or absence of access is checked, and if there is access, arbitration is performed such that the access is rejected or waited.

When transmitting / receiving normal data, a general-purpose OS is used.
The control circuit 27 for PC is connected to the PC via the I / O control circuit 29.
Card, touch panel, host device, keyboard, LC
It is possible to control and use any I / O device such as a D display device, a memory, various media, and a magnetic card. Further, the security control circuit 28 can also communicate with each other via the communication function units 32, 43, 44, and 37.

When the secret data such as personal information is sent and received by the instruction from the general-purpose OS control circuit 27, the security control circuit 28 causes the I / O control circuit 29.
Occupy the control right to control and use any of the above I / O devices. The secret data input or read by the security control circuit 28 via the I / O control circuit 29 is encrypted by the encryption unit 38, and the encrypted data is transferred to the general-purpose OS control circuit 27. It is directly transmitted to the host device via the interface unit 46 of the I / O control circuit 29 without passing through.

While the security control circuit 28 occupies the control right of the I / O control circuit 29 as described above, the general-purpose OS control circuit 27 accesses the I / O control circuit 29. The secret data processed by the security control circuit 28 does not flow to the general-purpose OS control circuit 27 because it is blocked by the above-mentioned rejection or standby. In other words, even in this case, even if the pseudo application software is installed in the general-purpose OS control circuit 27 side by somebody, the secret data processed via the secret information protection system 26 cannot be read.

The security control circuit 28 is an I / O
When the control of the control circuit 29 is completed, the control right of the I / O control circuit 29 is returned to the general-purpose OS control circuit 27, and normal processing is performed by the general-purpose OS control circuit 27.

FIG. 5 shows the above-mentioned general-purpose OS control circuit 27.
9 is a flowchart showing a magnetic card reading process as an example of a process performed by the security control circuit 28. As shown in the figure, the general-purpose OS control circuit 27
When controlling an I / O device, enter a command to that effect
It is transmitted to the control circuit 29 (step H201). I / O
The control circuit 29 arbitrates to which circuit the control right is transferred, depending on the presence / absence of preceding access, the presence / absence of priority setting, and the like.
When the control right is passed to one circuit, for example, the general-purpose OS control circuit 27, an ACK signal is transmitted to the general-purpose OS control circuit 27, and the other circuit, for example, a security control circuit 28 in this case, is transmitted a NACK signal. (Step IO10
1).

When the general-purpose OS control circuit 27 receives the ACK signal from the I / O control circuit 29 (step H202,
If the determination is Y), an I / O control right acquisition command is transmitted to the I / O control circuit 29 (step H203), and subsequently,
In this example, read control of the magnetic card is performed via the card reading unit 51 (step IO102), and the magnetic card inserted in the card reader is read (step I).
O103).

If the information requested to be obtained from the host device or on the program is secret data requiring security, the general-purpose OS control circuit 27 sends the security control circuit 28 to the I / O control circuit. The information acquisition request command is transmitted via 29 or a dedicated interface (not shown). When the security control circuit 28 receives the information acquisition request command from the general-purpose OS control circuit 27, the I / O control circuit 29 receives the I / O control circuit 29.
A command to control the O device is transmitted to the I / O control circuit 29 (step S301).

In this case also, the I / O control circuit 29 arbitrates to which circuit the control right is to be passed, depending on the presence / absence of the preceding access and the presence / absence of the priority setting. Also in this case, when the ACK signal is transmitted to the general-purpose OS control circuit 27 and the NACK signal is transmitted to the security control circuit 28 as described above (N in step S302), the security control circuit 28 performs the NOP process. No response is given to the general-purpose OS control circuit 27, but the arbitration result of the I / O control circuit 29 is opposite, and an ACK signal is sent to the security control circuit 28 in response to a request from the security control circuit 28. When the NACK signal is transmitted to the general-purpose OS control circuit 27 (Y in S302), the security control circuit 28 receiving the NACK signal sends an I / O control right acquisition command to the I / O control circuit 29. Sent (step S30
3), and subsequently, reading control of the magnetic card is performed via the card reading unit 51 (step IO10).
2) The magnetic card inserted into the card reader is read (step IO103).

Also in this case, the secret data is not limited to the data of the magnetic card, and is also applied to the reading process of the personal identification number or ID input from the touch panel or the keyboard, for example.

FIG. 6 is a diagram showing the configuration of the secret information protection system according to the fourth embodiment. In the secret information protection system 55 shown in the figure, a general-purpose OS control circuit 56 and a security control circuit 57 are respectively dedicated I / Os.
It is configured with equipment. In the example shown in FIG.
The security control circuit 56 has a dedicated LCD display device 58 and a keyboard 59, and the security control circuit 57 has a dedicated L
A CD display device 61 and a keyboard 62 are provided. The general-purpose OS control circuit 56 and the security control circuit 57 can communicate with each other via the communication line 63 and exchange predetermined data with the host device. However, in the processing using the I / O device, Independently, using the dedicated I / O device described above.

When the security control circuit 57 operates, if there is no permission response from the security control circuit 57 for information acquisition for the secret data, the general-purpose OS control circuit 56 performs the subsequent processing. I can't continue.

As a result, also in this case, the input data from the outside read on the security control circuit 57 side is
There is no risk of being stolen by simulated application software.

[0053]

As described above in detail, according to the present invention, the control of the general-purpose OS and the control relating to the secret information requiring security are separately configured, so that the secret information can be acquired on the other hand. It is possible to maintain the easiness of developing application software that carries out the general processing involved, and on the other hand, it is possible to prevent leakage of confidential information such as personal information that requires security, which makes it cheap and easy. It is possible to provide a confidential information protection system that can be constructed and has a high security function.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a secret information protection system according to a first exemplary embodiment.

FIG. 2 is a flowchart showing a magnetic card reading process as an example of communication by a general-purpose OS control circuit and a security control circuit according to the first embodiment.

FIG. 3 is a diagram showing a configuration of a secret information protection system according to a second exemplary embodiment.

FIG. 4 is a diagram showing a configuration of a secret information protection system according to a third exemplary embodiment.

FIG. 5 is a flowchart showing a magnetic card reading process as an example of a process performed by a general-purpose OS control circuit and a security control circuit according to the third embodiment.

FIG. 6 is a diagram showing a configuration of a secret information protection system according to a fourth exemplary embodiment.

[Explanation of symbols]

1 Confidential information protection system 2, 2'General-purpose OS control circuit 3 Security control circuit 5 CPU 6 buses 7 Display output section 8 I / O (input / output) section 9 Interface section 11 Communication function section 12, 12 'memory section 13, 13 'medium section 14 Encryption / Decryption Function Unit 15 CPU 16 bus 17 Encryption part 18 keyboard part 19 Card reader 21 Communication function section 22 Memory section 23 Media Department 25, 26 Confidential information protection system 27 Control circuit for general-purpose OS 28 Security control circuit 29 I / O control circuit 30, 35, 41 CPU 31, 36, 42 buses 32, 37, 43, 44 Communication function unit 33, 39, 49 Memory section 34, 40, 50 Medium section 38 Encryption part 46 Interface section 47 keyboard section 48 display output section 51 Card reader

Continued front page    (72) Inventor Yasushi Kasahara             1776 Yanoguchi, Inagi City, Tokyo             Within the corporation (72) Inventor Koichi Unno             1776 Yanoguchi, Inagi City, Tokyo             Within the corporation F-term (reference) 5B017 AA03 BA05 BB00 CA05                 5J104 AA32

Claims (6)

[Claims] 1. A secret information protection system in the case of executing a process of acquiring secret information related to security required by a host device under the control of the general-purpose OS by an application module operating on the general-purpose OS, comprising: The security control of the secret information and the general-purpose OS side control are separated, and when the general-purpose OS side control acquires the secret information, the general-purpose OS side control sends a request to acquire the secret information to the security control, and the security control is requested to acquire. The secret information is converted into encrypted data that can be decrypted only by the host device and returned to the general-purpose OS-side control, and the general-purpose OS-side control transmits the returned encrypted data to the host device as it is. A confidential information protection system characterized by 2. The general-purpose OS-side control sends predetermined ID data to the security control prior to the secret information acquisition request, and the security control confirms that the ID data is correct ID data. 2. When the encrypted data is returned, the encrypted data is returned to the general-purpose OS side control.
Confidential information protection system described. 3. The security control and the general-purpose OS
The side control shares one or more I / O devices through the same I / O control, and the general-purpose OS side control performs the I / O control through the I / O control during normal data transfer. The O / device is used, and the security control occupies the control right of the I / O control to use the I / O device when the confidential information is transmitted / received. Confidential information protection system. 4. The secret information according to claim 1, wherein the security control has a dedicated I / O device, and the general-purpose OS-side control has another dedicated I / O device. Protection system. 5. The security control is an undisclosed OS.
5. The confidential information protection system according to claim 1, wherein the control is executed by application software that operates above. 6. The security control is executed by a dedicated circuit having a hardware configuration.
The confidential information protection system described in 2, 3 or 4.