JP2010003183A - Security apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security apparatus preventing an outflow or theft of security information held by each functional component inside the security apparatus. <P>SOLUTION: This security apparatus comprises the respective functional components of a power supply part 10, a security function part 20, a CPU part 30, and an other important part 40. The respective functional components 10-40 constituting the security apparatus are connected to each other via a communication network 50. When a power switch not shown in the figure is turned on, each of the functional component 10-40 performs communication for mutual authentication with the power supply part 10 via the communication network 50 between the functional components, and performs confirmation of validity by an authentication ID. When each of the functional component 10-40 detects that the authentication ID is different from a previously registered authentication ID by the communication, each of the functional component 10-40 individually stops its operation by its own decision. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a security device for safely holding security information, assuming a security device configured by a control device incorporating a functional component for maintaining security. A security device has a function to safely hold data that needs to be concealed, such as key information for card access in an electronic money card. For example, a functional component is stolen or illegally opened to maintain security. This refers to a control device that can detect unauthorized operations and take appropriate actions.

  In order to prevent the leakage of information due to theft of the electronic device, that is, to maintain the security of the electronic device, a technology is known in which authentication is performed by a power supply control device constituting the electronic device (see Patent Document 1).

In this prior art, the electronic system is composed of an electronic device and an authentication information adding device, and the electronic device is composed of a power control unit and a main function unit, and authentication information is stored in advance in the power control unit. The main function unit is supplied with power from the power control unit, and the power control unit compares the stored authentication information with the authentication information added by the authentication information adding device and matches them. For example, the power supply control unit supplies power to the main function unit, and if the authentication information does not match, the power supply control unit does not supply power to the main function unit to prevent information leakage due to theft of the electronic device. Disclosure.
JP 2007-004574 A

  In the prior art disclosed in Patent Document 1, when power is supplied to the power supply line from the power control unit, the main function unit becomes operable and prevents leakage of information due to theft of the electronic device. There was a problem that the security of the device could not be maintained.

  In view of the above problems, an object of the present invention is to provide a security device capable of preventing leakage or theft of security information held by each functional component in the security device.

  Each functional component of the security function unit / power supply unit / CPU unit / other key components constituting the security device according to the configuration of the present invention holds an authentication ID for mutual authentication, and is a communication network within the device. Connect to each other. Each functional component exchanges the authentication ID with each other via the communication network to determine the validity of the functional component.If the validity is determined by the authentication ID, the function component shifts to a normal operation. If the legitimacy is not judged by the above, each functional component stops its operation or shuts off the power supply from the power supply unit to make it inoperable.

  According to the present invention, it is possible to prevent leakage of security information in the security device. Further, according to the present invention, it is possible to prevent unauthorized use due to replacement of unauthorized functional components in the security device. Furthermore, according to the present invention, it is possible to prevent unauthorized use by removing a functional component in the security device.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[Embodiment 1]
FIG. 1 is a configuration diagram showing the basic principle of a security device according to the first embodiment of the present invention. In FIG. 1, the security device is composed of functional parts of a power supply unit 10, a security function unit 20, a CPU unit 30, and other pivotal parts 40, and each functional component 10-40 constituting the security device is between each functional component. They are connected to each other via a communication network 50. The communication network 50 may be configured by a communication line provided independently for communication, or a power supply line provided for supplying power from the power supply unit 10 to the functional components 20 to 40. It may be configured by a communication line in a format that superimposes a signal on.

  The power supply unit 10 performs authentication for supplying predetermined power to each functional component, and authentication for mutual authentication between the functional components in a predetermined area of the memory 14 that is not erased even if power supply is interrupted ID 15 is stored.

The security function unit 20 stores an authentication ID 23 for mutual authentication between functional components in a predetermined area of the memory 22 that is not erased even if power supply is interrupted.
The CPU unit 30 stores an authentication ID 33 for mutual authentication between functional components in a predetermined area of the memory 32 that is not erased even if power supply is interrupted.

The other important part 40 stores an authentication ID 43 for mutual authentication between functional parts in a predetermined area of the memory 42 that is not erased even if the power supply is interrupted.
When a power switch of a security device (not shown) is turned on, each of the functional components 10 to 40 performs communication for mutual authentication with the power supply unit 10 via the communication network 50 between the functional components, and uses the authentication ID. Check the validity.

  When it is detected that each functional component 10-40 is different from an authentication ID registered in advance in the process of performing the communication, at least each functional component 10-40 individually stops its operation based on its own judgment. The sequence in this case is shown in FIG.

  FIG. 2 is a flowchart showing an operation sequence when the operation is individually stopped by mutual authentication by communication between the functional components shown in FIG. In FIG. 2, the step is simply indicated as “S”.

  In FIG. 2, the flow starts when the power is turned on, and communication for mutual authentication between the power supply unit 10 and the security function unit 20 is executed (step S20). Then, mutual confirmation by the authentication ID is performed (step S21). Next, it is determined whether the authentication ID is correct (step S22). If the authentication ID is incorrect, the operation of the functional component is individually stopped (step S23). On the other hand, if the authentication ID is positive, next, communication for mutual authentication between the power supply unit 10 and the CPU unit 30 is executed (step S24). Then, mutual confirmation by the authentication ID is performed (step S25).

  Next, it is determined whether the authentication ID is correct (step S26). If the authentication ID is incorrect, the operation of the functional component is individually stopped (step S23). On the other hand, if the authentication ID is positive, next, communication for mutual authentication between the power supply unit 10 and the other key unit 40 is executed (step S27). Then, mutual confirmation by the authentication ID is performed (step S28).

  Next, it is determined whether the authentication ID is correct (step S29). If the authentication ID is incorrect, the operation of the functional component is individually stopped (step S23). On the other hand, if the authentication ID is positive, the process ends here.

As a result, even if the power supply unit is replaced with a different (different) functional part due to unauthorized modification, it becomes inoperable and the security of the device can be ensured.
[Modification]
FIG. 3 is a diagram showing a modification of the operation process shown in FIG. In FIG. 1, when the power is turned on, the functional components 10 to 40 communicate with each other via the communication network 50 between the functional components to confirm the authentication ID of the functional component. At this time, if there is a functional component with an incorrect authentication ID, it is determined that each functional component has been tampered with and the operation is stopped. A sequence example in this case is shown in FIG.

  FIG. 3 is a flowchart showing an operation sequence when it is determined that unauthorized modification is performed by mutual authentication through communication between the functional components and the operation is stopped. In FIG. 3, the step is simply denoted as “S”.

  In FIG. 3, as in FIG. 2, the flow starts when the power is turned on, and communication for mutual authentication between the power supply unit 10 and the security function unit 20 is executed (step S30). Then, mutual confirmation by the authentication ID is performed (step S31). Next, it is determined whether the authentication ID is correct (step S32). If the authentication ID is incorrect, the operation of the power supply unit 10 or the security function unit 20 is stopped (step S33). On the other hand, if the authentication ID is positive, next, communication for mutual authentication between the security function unit 20 and the CPU unit 30 is executed (step S34). Then, mutual confirmation by the authentication ID is performed (step S35).

  Next, it is determined whether the authentication ID is correct (step S36). If the authentication ID is incorrect, the operation of the security function unit 20 or the CPU unit 30 is stopped (step S37). On the other hand, if the authentication ID is positive, next, communication for mutual authentication between the CPU unit 30 and the other key unit 40 is executed (step S38). Then, mutual confirmation by the authentication ID is performed (step S39).

  Next, it is determined whether the authentication ID is correct (step S40). If the authentication ID is incorrect, the operation of the CPU unit 30 or other pivotal unit 40 is stopped (step S41). On the other hand, if the authentication ID is positive, the process ends here.

In the operation sequence of FIG. 3, authentication between all functional parts is not performed, but brute force authentication may be performed between installed functional parts.
As a result, even if one of the functional components is replaced with a different (different) functional component due to unauthorized modification, it becomes inoperable and the security of the device can be ensured.
[Embodiment 2]
FIG. 4 is a block diagram showing the basic principle of the security device according to the second embodiment of the present invention. In FIG. 4, the security device is composed of functional parts of a power supply unit 10, a security function unit 20, a CPU unit 30, and other important parts 40, and each functional component 10-40 constituting the security device is between each functional component. They are connected to each other via a communication network 50. The communication network 50 may be configured by a communication line provided independently for communication, or a power supply line provided for supplying power from the power supply unit 10 to the functional components 20 to 40. It may be configured by a communication line in a format that superimposes a signal on.

  The power supply unit 10 performs authentication for supplying predetermined power to each functional component, and authentication for mutual authentication between the functional components in a predetermined area of the memory 16 that is not erased even when the power supply is interrupted Similarly, ID-A 17 and authentication ID-B 18 for mutual authentication between functional components are stored in a predetermined area of the memory 18.

  The security function unit 20 performs mutual authentication between the functional parts in the predetermined area of the memory 26 and the authentication ID-A 25 for mutual authentication between the functional parts in the predetermined area of the memory 24 that is not erased even if the power supply is interrupted. Authentication ID-B27 is stored.

  The CPU unit 30 is used for mutual authentication between the functional parts in the predetermined area of the memory 36 and the authentication ID-A 35 for mutual authentication between the functional parts in the predetermined area of the memory 34 that is not erased even if the power supply is interrupted. Authentication ID-B37 is stored.

  The other important part 40 is used for mutual authentication between the functional parts in the predetermined area of the memory 46 and the authentication ID-A 45 for mutual authentication between the functional parts in the predetermined area of the memory 44 that is not erased even if the power supply is interrupted. Authentication ID-B47 is stored.

  When a power switch (not shown) is turned on, the power supply unit 10 that is one of the functional components performs authentication communication via the communication network 50 between the functional components, and authenticates by the authentication ID-A. Confirm sex. Further, the functional components 10 to 40 configuring the network perform authentication communication between the functional components via the communication network 50 and confirm the validity by the authentication ID-B.

  When the authentication by authentication ID-A is successful and it is detected that the authentication results by authentication ID-B are different, each functional component 10-40 individually stops its operation at its own judgment. The sequence in this case is shown in FIG.

  FIG. 5 shows that the authentication using the first authentication ID (authentication ID-A) succeeds and the authentication result using the second authentication ID (authentication ID-B) differs due to the communication between the functional components shown in FIG. FIG. 11 is a flowchart showing an operation sequence when each functional component stops its operation when it is detected. In FIG. 5, the step is simply denoted as “S”.

  In FIG. 5, the flow starts when the power is turned on, and communication for mutual authentication between the power supply unit 10 and the security function unit 20 is executed (step S50). Then, mutual confirmation by the authentication ID-A is performed (step S51). Next, whether the authentication ID-A is correct or not is determined (step S52). If the authentication ID-A is incorrect, the operation of the functional component is individually stopped (step S53). On the other hand, if the authentication ID-A is positive, next, communication for mutual authentication between the power supply unit 10 and the CPU unit 30 is executed (step S54). Then, mutual confirmation by the authentication ID-A is performed (step S55).

  Next, it is determined whether the authentication ID-A is correct (step S56). If the authentication ID-A is incorrect, the operation of the functional component is individually stopped (step S53). On the other hand, if the authentication ID-A is positive, next, communication for mutual authentication between the power supply unit 10 and the other key unit 40 is executed (step S57). Then, mutual confirmation by the authentication ID-A is performed (step S58).

  Next, whether the authentication ID-A is correct or not is determined (step S59). If the authentication ID-A is incorrect, the operation of the functional component is individually stopped (step S53). On the other hand, if the authentication ID-A is positive, the process proceeds to the processing by the authentication ID-B after step S60.

  In step S60, first, communication for mutual authentication between the power supply unit 10 and the security function unit 20 is executed. Then, mutual confirmation by the authentication ID-B is performed (step S61). Next, whether the authentication ID-B is correct or not is determined (step S62). If the authentication ID-B is incorrect, the operation of the power supply unit 10 or the security function unit 20 is stopped (step S63). On the other hand, if the authentication ID-B is positive, communication for mutual authentication between the security function unit 20 and the CPU unit 30 is executed (step S64). Then, mutual confirmation by the authentication ID-B is performed (step S65).

  Next, whether or not the authentication ID-B is correct is determined (step S66). If the authentication ID-B is incorrect, the operation of the security function unit 20 or the CPU unit 30 is stopped (step S67). On the other hand, if the authentication ID-B is positive, next, communication for mutual authentication between the CPU unit 30 and the other key unit 40 is executed (step S68). Then, mutual confirmation by the authentication ID-B is performed (step S69).

  Next, whether the authentication ID-B is correct or not is determined (step S70). If the authentication ID-B is incorrect, the operation of the CPU unit 30 or other pivotal unit 40 is stopped (step S71). On the other hand, if the authentication ID-B is positive, the process ends here. In the operation sequence of FIG. 5, authentication using authentication ID-B is not performed between all functional components, but even if brute force authentication is performed between installed functional components. good.

As a result, even if the authentication ID-A is analyzed and the power supply unit is replaced with a different functional part by unauthorized modification, it becomes impossible to operate, and the security of the device can be ensured. In addition, even if the authentication ID-A is analyzed and the power supply part and functional parts other than the power supply part (for example, security function part) are replaced with different functional parts due to unauthorized modification, it becomes inoperable and ensures the security of the device It becomes possible to do.
[Modification]
FIG. 6 is a diagram showing a modification of the operation process shown in FIG. In FIG. 1, when the power is turned on, the power supply unit 10 that is one of the functional components performs authentication using the authentication ID-A through the communication network 50 with the functional components 20 to 40, and then configures the network The functional components 10 to 40 perform authentication using the authentication ID-B between the functional components via the communication network 50. If the authentication with ID-A succeeds and it is detected that the result of authentication with Authentication ID-B is different, the functional component that has detected that the result of authentication with Authentication ID-B is different In response, a stop command is issued, and each functional component stops its operation. This sequence is shown in FIG.

  FIG. 6 shows that a functional component that has succeeded in authentication with authentication ID-A and detected that the result of authentication with authentication ID-B is different by communication between each functional component issues a stop command to other functional components. FIG. 5 is a flowchart showing an operation sequence when each functional component stops its operation. In FIG. 6, the step is simply indicated as “S”.

  In FIG. 6, as in FIG. 5, the flow starts when the power is turned on, and communication for mutual authentication between the power supply unit 10 and the security function unit 20 is executed (step S80). Then, mutual confirmation by the authentication ID-A is performed (step S81). Next, it is determined whether the authentication ID-A is correct (step S82). If the authentication ID-A is incorrect, the operation of the functional component is individually stopped (step S83). On the other hand, if the authentication ID-A is positive, next, communication for mutual authentication between the power supply unit 10 and the CPU unit 30 is executed (step S84). Then, mutual confirmation by the authentication ID-A is performed (step S85).

  Next, it is determined whether the authentication ID-A is correct (step S86). If the authentication ID-A is incorrect, the operation of the functional component is individually stopped (step S83). On the other hand, if the authentication ID-A is positive, next, communication for mutual authentication between the power supply unit 10 and the other key unit 40 is executed (step S87). Then, mutual confirmation by the authentication ID-A is performed (step S88).

  Next, it is determined whether the authentication ID-A is correct (step S89). If the authentication ID-A is incorrect, the operation of the functional component is individually stopped (step S83). On the other hand, if the authentication ID-A is positive, the process proceeds to the processing by authentication ID-B after step S90.

  In step S90, first, communication for mutual authentication between the power supply unit 10 and the security function unit 20 is executed. Then, mutual confirmation by the authentication ID-B is performed (step S91). Next, whether the authentication ID-B is correct or not is determined (step S92). If the authentication ID-B is incorrect, the power supply unit 10 or the security function unit 20 issues a stop command for other functional components (step S93). On the other hand, if the authentication ID-B is positive, communication for mutual authentication between the security function unit 20 and the CPU unit 30 is executed (step S94). Then, mutual confirmation by the authentication ID-B is performed (step S95).

  Next, whether the authentication ID-B is correct or not is determined (step S96). If the authentication ID-B is incorrect, the security function unit 20 or the CPU unit 30 issues a stop command for other functional components (step S97). On the other hand, if the authentication ID-B is positive, communication for mutual authentication between the CPU unit 30 and the other key unit 40 is executed (step S98). Then, mutual confirmation by the authentication ID-B is performed (step S99).

  Next, whether the authentication ID-B is correct or not is determined (step S100). If the authentication ID-B is incorrect, the CPU 30 or other pivotal part 40 issues a stop command for other functional parts (step S101). On the other hand, if the authentication ID-B is positive, the process ends here. In the sequence shown in FIG. 6, authentication using authentication ID-B is not performed between all functional components, but brute force authentication may be performed between installed functional components. .

The authentication ID described above may be a fixed value, or may be configured to be automatically updated in the security device at certain time intervals in order to improve security.
Even if the security function unit 20 is removed and only power is supplied, the ID authentication cannot be confirmed via the communication network between the functional components, so that the security function unit 20 is stopped. In this way, even if only the security function unit 20 is removed and installed in another device, it can be prevented from being misused.

It is a block diagram which shows the basic principle of the security apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows the operation | movement sequence at the time of stopping the operation | movement separately by the mutual authentication by communication between each functional component shown in FIG. It is a figure which shows the modification of the operation | movement process shown in FIG. It is a block diagram which shows the basic principle of the security apparatus which concerns on the 2nd Embodiment of this invention. When the communication between the functional components shown in FIG. 4 succeeds in the authentication by the first authentication ID and detects that the authentication results by the second authentication ID are different, each functional component stops its operation. It is a flowchart which shows an operation | movement sequence. It is a figure which shows the modification of the operation | movement process shown in FIG.

Explanation of symbols

10 Power supply unit 12 Power supply control unit 14 Memory (non-volatile)
15 Authentication ID
16 Memory (non-volatile)
17 Authentication ID-A
20 Security function part 22 Memory (non-volatile)
23 Authentication ID
24 memory (non-volatile)
25 Authentication ID-A
26 Memory (non-volatile)
27 Authentication ID-B
30 CPU part 32 Memory (non-volatile)
33 Authentication ID
34 Memory (non-volatile)
35 Authentication ID-A
36 Memory (non-volatile)
37 Authentication ID-B
40 Other key parts 42 Memory (non-volatile)
43 Authentication ID
44 Memory (non-volatile)
45 Authentication ID-A
46 Memory (non-volatile)
47 Authentication ID-B

Claims (5)

  A communication network for performing authentication between components among the functional components constituting the security device is configured, and each functional component constituting the network is a power supply unit that is one of the functional components via the communication network A security device that performs mutual communication for authentication and detects that the authentication results are different, and each functional component individually stops its operation at its own discretion.   If authentication is performed between the functional parts excluding the power supply part instead of authentication with the power supply part, and it is detected that the result of the authentication is different, each functional part except the power supply part is individually determined by its own judgment. 2. The security device according to claim 1, wherein the operation is stopped.   The security device according to claim 2, wherein an authentication ID for authenticating the power supply unit and each functional component is different from an authentication ID for authenticating between the functional components.   4. The functional component that detects that the result of authentication is different issues a stop command to other functional components, and each functional component stops its operation. The listed security device.   5. The communication line constituting a communication network between functional parts uses a power supply line provided to supply power from the power supply unit to other functional parts. The security device according to Item 1.

Images