JP2014102534A - Information processing device, control method of information processing device, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize high-speed data encryption and also inhibit unauthorized processing.SOLUTION: A fiscal printer 16 comprises: an encryption IC chip 81 which has at least a function for encrypting input data and is equipped with an IC chip storage unit 86; and an encryption IC chip control unit 82 which outputs a control command to the chip and controls the chip to execute processing. The IC chip storage unit 86 stores a password, and also a second SRAM 83 stores the common password. The encryption IC chip control unit 82 outputs a control command including the password to the encryption IC chip 81. The chip performs authentication of the control command on the basis of the password included in the control command and the password stored in the IC chip storage unit 86.

Description

  The present invention relates to an information processing apparatus that stores fiscal data, a control method for the information processing apparatus, and a program.

  Conventionally, an information processing apparatus (electronic cash register, receipt printer) that is provided in a store that sells products and stores fiscal data including information on transactions (information on sales, information on taxation, etc.) is known. (For example, refer to Patent Document 1).

Japanese Patent Laid-Open No. 05-120567

In the case of storing fiscal data as in the information processing apparatus described above, the fiscal data and the data accompanying it may be encrypted with an encryption key in order to improve data reliability and prevent falsification. In such a case, there is a need to realize high-speed encryption, but it is necessary to prevent unauthorized processing.
The present invention has been made in view of the above-described circumstances, and an object thereof is to prevent unauthorized processing from being performed while realizing high-speed data encryption.

In order to achieve the above object, the present invention has at least a function of encrypting input data, outputs a control command to the chip on which the first memory is mounted, and the chip. A control unit that executes processing, and a password common to the password stored in the first memory is stored in a second memory accessible by the control unit, and the control unit stores the password A control command including the control command is output to the chip, and the chip has a function of authenticating the control command based on the password included in the control command and the password stored in the first memory. It is characterized by that.
According to this configuration, high-speed encryption of various data can be realized by a dedicated chip having a function of encrypting input data. Further, the chip authenticates the control command based on the password included in the control command input from the control unit and the password stored in the mounted first memory. Even if there is an unauthorized access by the third party after being removed by a person, it is possible to detect this and to perform a corresponding appropriate process, for example, a process for making the data unusable It is possible to execute.

The present invention further includes a fraud detection unit that detects unauthorized access, and invalidates the password stored in the second memory when the fraud detection unit detects fraud. To do.
According to this configuration, if there is an unauthorized access, the password stored in the second memory is invalidated, and the chip cannot be controlled by the control command from the control unit. Can be prevented from being executed.

In the present invention, when fraud is detected by the fraud detector, the password stored in the second memory is overwritten and supplied to the second memory constituted by a volatile memory. The password stored in the second memory is invalidated by cutting off the power and deleting the password.
According to this configuration, the password stored in the second memory can be accurately invalidated.

In the present invention, the chip has a function of generating a secret key and a public key according to a public key cryptosystem, and stores the secret key generated by the function in the first memory. And
Here, the secret key is used, for example, when generating a digital signature relating to fiscal data, and must be prevented from being obtained by a third party by unauthorized means. According to the above configuration, the chip authenticates the control command based on the password included in the control command input from the control unit and the password stored in the mounted first memory. It is possible to prevent the secret key from being acquired by a simple control command.

In order to achieve the above object, the present invention has at least a function of encrypting input data, outputs a control command to the chip on which the first memory is mounted, and the chip. A control unit that causes a chip to execute a process, wherein the password is stored in the first memory and is shared by a second memory accessible by the control unit The control unit outputs a control command including the password to the chip, and the chip includes the password included in the control command and the password stored in the first memory. Then, the control command is authenticated.
According to this control method, high-speed encryption of various data can be realized by a dedicated chip having a function of encrypting input data. Further, the chip authenticates the control command based on the password included in the control command input from the control unit and the password stored in the mounted first memory. Even if there is an unauthorized access by the third party after being removed by a person, it is possible to detect this and to perform a corresponding appropriate process, for example, a process for making the data unusable It is possible to execute.

In order to achieve the above object, the present invention has at least a function of encrypting input data, outputs a control command to the chip on which the first memory is mounted, and the chip. A control unit that causes the chip to execute processing, and the chip of the information processing apparatus in which a password common to the password stored in the first memory is stored in a second memory accessible by the control unit And a program executed by the control unit, causing the control unit to output a control command including the password to the chip, and causing the chip to output the password included in the control command, and the first The control command is authenticated based on the password stored in one memory.
According to this program, high-speed encryption of various data can be realized by a dedicated chip having a function of encrypting input data. Further, the chip authenticates the control command based on the password included in the control command input from the control unit and the password stored in the mounted first memory. Even if there is an unauthorized access by the third party after being removed by a person, it is possible to detect this and to perform a corresponding appropriate process, for example, a process for making the data unusable It is possible to execute.

  According to the present invention, it is possible to prevent unauthorized processing while realizing high-speed data encryption.

It is a figure which shows the structure of the information processing system which concerns on this embodiment. It is a flowchart which shows operation | movement of a fiscal printer.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating a configuration of an information processing system 1 according to the present embodiment.
As shown in FIG. 1, the information processing system 1 includes a fiscal printer 16 (information processing device), and a host computer 15 and a fiscal data reading device 40 can be connected to the fiscal printer 16. Yes.
The fiscal printer 16 issues a receipt under the control of the host computer 15 and stores fiscal information (fiscal data) input from the host computer 15.
Fiscal information (fiscal data) refers to information relating to sales transactions of products and the like (information relating to sales, information relating to taxation, etc.), which is information predetermined as information to be stored. This fiscal information is used, for example, as information to be referred to by the national institution for grasping the actual state of the transaction at the store when the national institution such as the government collects taxes from the store. Therefore, it is necessary to prevent falsification of the fiscal information. In the present embodiment, there are two types of data, that is, later-described writing receipt data 54 and daily sales data 53 as fiscal information (fiscal data).
In the following description, the receipt output by the fiscal printer 16 is a receipt issued at the checkout counter of the store at the time of customer accounting, and is always a subtotal amount T1 for each purchased product (the unit price of the product for each product). And the total amount T2 (the amount calculated by the sum of the subtotal amounts T1), and the payment amount T3 (consumption tax etc. is added to the total amount T2) It is assumed that the calculated amount is recorded.

As shown in FIG. 1, the fiscal printer 16 includes three substrates: a management substrate 20, a printer substrate 21, and a sub substrate 22.
The management board 20 includes a main control unit 25 (control unit), a PC connector 26a, a fiscal connector 26b, a communication IC 27, a ROM 28, a first SRAM 29, an RTC 30, an EJ memory 31, and an EJ memory control unit 32. A buffer IC 33 and an encryption module 80 are mounted.
The main control unit 25 centrally controls each unit of the fiscal printer 16 and includes a CPU and other peripheral circuits. The PC connector 26 a is a connector to which the host computer 15 is connected during normal use of the fiscal printer 16. The host computer 15 outputs a control command for causing the fiscal printer 16 to perform an operation related to the receipt issuance via the PC connector 26a, and outputs daily sales data 53 described later as fiscal information. The fiscal connector 26b is a connector to which the fiscal data reading device 40 is connected. The fiscal data reading device 40 is a device for reading data stored in the EJ memory 31 and the fiscal memory 50, which will be described later, and has obtained special permission from, for example, a person related to a national organization (government, etc.). Only a person can have it. The host computer 15 described above is maintained connected to the PC connector 26a. However, unlike the host computer 15, the fiscal data reading device 40 is appropriately connected to the fiscal connector 26b when data is read. The

The communication IC 27 is connected to the PC connector 26a and the fiscal connector 26b, and transmits / receives data to / from the host computer 15 and the fiscal data reading device 40 under the control of the main control unit 25. The ROM 28 stores various data such as a control program (firmware) for the main control unit 25 to perform various controls in a nonvolatile manner. The first SRAM 29 is a volatile memory that functions as a work area for the CPU of the main control unit 25, and temporarily stores various data. The RTC 30 (Real-time clock) outputs data indicating the current date and time (year / month / day, time) to the main control unit 25. The first SRAM 29 and the RTC 30 are supplied with backup power from a battery (not shown) even when the power of the fiscal printer 16 is turned off.
The EJ memory 31 is a NAND flash memory and can store a large amount of data. In particular, in the present embodiment, the EJ memory 31 is an MLC type NAND flash memory.
As is well known, an MLC type NAND flash memory can be increased in capacity at a lower cost than an SLC type. Therefore, as will be apparent later, as a memory for storing the write receipt data 54 that may frequently cause processing related to writing, and that the size of the stored data may increase rapidly. Is suitable.
In the EJ memory 31, the storage area in which the write receipt data 54 and the data associated therewith are written functions as a memory in which data can be written only once per address. As a result, the fiscal data written in the EJ memory 31 is prevented from being edited later, and the fiscal data stored in the EJ memory 31 is prevented from being falsified. The EJ memory control unit 32 includes a CPU, and reads, writes, and erases data with respect to the EJ memory 31 under the control of the main control unit 25. The buffer IC 33 controls a buffer provided to improve the efficiency of reading and writing data to the EJ memory 31.
The EJ memory 31, the EJ memory control unit 32, and the buffer IC 33 are sealed to the management board 20 by an epoxy resin, and the EJ memory 31 is physically removed from the management board 20. The data stored in is prevented from being falsified.

The encryption module 80 includes an encryption IC chip 81 (chip), an encryption IC chip control unit 82 (control unit), and a second SRAM 83 (second memory).
The encryption IC chip 81 includes an IC chip processing unit 85 (control unit) having a control circuit capable of executing various processes described later, and an IC chip storage unit 86 (first memory) configured by an EEPROM. Has been. The function of the IC chip processing unit 85 and the data stored in the IC chip storage unit 86 will be described later.
The encryption IC chip control unit 82 is connected to the main control unit 25 so as to be capable of signal communication, and outputs a control command to the encryption IC chip 81 in cooperation with the main control unit 25 or independently. The encryption IC chip 81 is controlled by causing the encryption IC chip 81 to execute processing. Further, the encryption IC chip control unit 82 has a function of executing a process for confirming whether or not the firmware operating in the main control unit 25 has been tampered with before the main control unit 25 is activated. Have.
The data stored in the second SRAM 83 will be described later.
The communication module 37 is a module for communicating with an external device such as a server device managed by the government or the like via a network such as a telephone network or the Internet. The standard for communication with an external device may be anything such as a GPRS standard.
The fraud detection unit 35 mounted on the management board 20 will be described later.

In addition, a printer control unit 45 is mounted on the printer substrate 21, and the printer control unit 45 controls the recording mechanism 46 based on a control command output from the host computer 15 and issues a receipt.
The recording mechanism 46 includes a thermal head 46a that records an image by applying heat to the printing surface of the roll paper, a transport mechanism 46b that transports the roll paper, a cutting mechanism 46c that cuts the roll paper at a predetermined position, and the like. Under the control of the printer control unit 45, these mechanisms and devices are operated to issue a receipt.
The printer board 21 is provided with a printer-side connector 42, and the management board 20 is provided with a management-side connector 43. By connecting the printer-side connector 42 and the management-side connector 43, management is performed. The substrate 20 and the printer substrate 21 are connected.
In this embodiment, when a receipt is issued, first, the host computer 15 connected to the fiscal printer 16 generates a control command and outputs the generated control command to the main control unit 25 via the PC connector 26a. The main control unit 25 to which the control command is input outputs the input control command to the printer control unit 45.

A fiscal memory 50 and a fiscal memory control unit 51 are mounted on the sub-board 22.
The fiscal memory 50 is a so-called serial flash memory using an element employing a serial bus. As is well known, the serial flash memory is characterized in that the stored data is more reliable and the number of times data can be written is larger than that of the NAND flash memory.
Fiscal memory 50 stores fiscal writing date / time data 52 and daily sales data 53, which will be described later. In the fiscal memory 50, the storage area in which the daily sales data 53 and data associated therewith are written functions as a memory in which data can be written only once per address. Thereby, the fiscal data written in the fiscal memory 50 is prevented from being edited later, and the fiscal data stored in the fiscal memory 50 is prevented from being falsified.
The fiscal memory control unit 51 includes a CPLD (Complex programmable logic device) which is a device in which a programmable logic circuit is written, and reads / writes data from / to the fiscal memory 50 under the control of the main control unit 25. .
The fiscal memory 50 and the fiscal memory control unit 51 are sealed to the sub-board 22 by an epoxy resin. For example, the fiscal memory 50 is physically removed from the sub-board 22 and then stored in the fiscal memory 50. Tampering with stored data is prevented.

Next, the write receipt data 54 stored in the EJ memory 31 and the daily sales data 53 stored in the fiscal memory 50 will be described. As described above, these data correspond to fiscal data.
The write receipt data 54 is data indicating information recorded on a receipt issued by the fiscal printer 16 and is data predetermined as data to be stored. For example, on the receipt, for each product purchased by the customer, information indicating the product, information indicating the unit price of the product, information indicating the number of the product purchased, information indicating the purchase price of each product, all products In the case where information indicating the total purchase price is recorded, and data indicating these information is predetermined as data to be stored, the data indicating these information corresponds to the write receipt data 54 .
As described above, in the present embodiment, when a receipt is issued by the fiscal printer 16, a control command is generated by the host computer 15, this control command is output to the main control unit 25, and the control command is further transmitted to the main control unit. 25 to the printer control unit 45. At that time, the main control unit 25 extracts information to be stored as the write receipt data 54 from the control command, generates the write receipt data 54 based on the extracted information, and generates the generated write receipt data 54. Is stored in the EJ memory 31 by controlling the EJ memory control unit 32.
In the present embodiment, the written receipt data 54 includes a subtotal amount T1, a total amount T2, and a payment amount T3 in the receipt. That is, as described above, the receipt issued by the fiscal printer 16 according to the present embodiment records the subtotal amount T1, the total amount T2, and the payment amount T3. At least these three pieces of information are extracted from the command and stored in the EJ memory 31 as write receipt data 54.

Here, when the main control unit 25 writes the write receipt data 54 in the EJ memory 31, the main control unit 25 acquires data indicating the current date and time (date + time) from the RTC 30, and indicates the date based on the acquired data. The EJ writing date / time data 55 is generated, and the writing receipt data 54 and the EJ writing date / time data 55 are written in association with each other. That is, each of the write receipt data 54 is stored in the EJ memory 31 in association with the EJ write date / time data 55 which is data indicating the date / time written in the EJ memory 31.
Further, when writing the write receipt data 54, the main control unit 25 writes an EJ digital signature 56, which is a digital signature generated using the write receipt data 54 as original data, in association with the write receipt data 54. That is, each of the write receipt data 54 is stored in the EJ memory 31 in association with the EJ digital signature 56 generated based on each data. A means for generating the EJ digital signature 56 will be described later.
An apparatus (for example, a server apparatus managed by the government) that examines and inspects fiscal data stored in the fiscal data reading device 40 and other fiscal printers 16, when each fiscal printer 16 generates the EJ digital signature 56. And a public key corresponding to a secret key (EJ digital signature secret key KA1, which will be described later) used when generating the EJ digital signature 56. 16 and the corresponding EJ digital signature 56 can detect tampering with the write receipt data 54.
Note that one reason for storing the EJ writing date / time data 55 and the writing receipt data 54 in association with each other is that, depending on the country, this is required by law or regulation.
As described above, since the write receipt data 54 is generated in response to the issuance of the receipt, there is a possibility that a process related to writing may occur frequently and the size of the stored data increases. It may be fast.

The daily sales data 53 is the total sales of “1 day” obtained by the accounting in which the receipt is issued by the fiscal printer 16. In the present embodiment, “one day” is a period from opening to closing in a store to which the information processing system 1 is applied. That is, the total data is data related to information obtained by totaling the accounting information included in the receipt.
The host computer 15 controls the fiscal printer 16 for each transaction performed at the checkout counter and issues a receipt, and cumulatively stores the sales amount for each transaction (= payment amount T3 in the receipt). Then, after closing the store, the host computer 15 is based on the sales amount for each transaction stored cumulatively at a predetermined timing (for example, when a person in charge has instructed or at a predetermined time). The total sales for “one day” related to the corresponding fiscal printer 16 are calculated, and the daily sales data 53 is generated based on the calculated total sales. The generated daily sales data 53 is stored in the main control unit 25. Output. When the daily sales data 53 is input, the main control unit 25 controls the fiscal memory control unit 51 to write the daily sales data 53 into the fiscal memory 50.
Here, when writing the daily sales data 53 to the fiscal memory 50, the main control unit 25 causes the RTC 30 to output data indicating the current date and time, and acquires and acquires the date and time of writing based on this data. The daily sales data 53 is written in the fiscal memory 50 in a state where the fiscal writing date / time data 52 (aggregated data), which is data indicating the date / time, and the daily sales data 53 are associated with each other. That is, each of the daily sales data 53 is stored in the fiscal memory 50 in association with the fiscal writing date / time data 52 which is data indicating the date / time written in the fiscal memory 50.
Further, when writing the daily sales data 53, the main control unit 25 writes a fiscal digital signature 58, which is a digital signature generated using the daily sales data 53 as original data, in association with the daily sales data 53. That is, each of the daily sales data 53 is stored in the fiscal memory 50 in association with the fiscal digital signature 58 generated based on each data. Means for generating the fiscal digital signature 58 will be described later.
A device (for example, a server device managed by the government) that investigates and inspects fiscal data stored in the fiscal data reading device 40 and other fiscal printers 16 uses the fiscal digital signature 58 to generate daily sales data. It is possible to detect tampering with 53.
As described above, in the present embodiment, the fiscal writing date / time data 52 and the daily sales data 53 are stored in association with each other, but this is required by law or regulation in some countries. Because.

On the other hand, the host computer 15 includes a host control unit 44. The host control unit 44 includes a CPU, ROM, RAM, and other peripheral circuits, and centrally controls each unit of the host computer 15, and includes an application execution unit 44a and a printer driver execution unit 44b. Yes.
The application execution unit 44a reads out and executes an application program stored in a predetermined storage unit included in the host computer 15, thereby generating application output data including information to be recorded in a receipt to be issued. The output data is output to the printer driver execution unit 44b. For example, the application execution unit 44a specifies a product code of a product purchased by a customer based on an input value from a bar code reader (not shown), accesses a predetermined database, and uses the product code to Various information including the subtotal amount, the total amount, and the payment amount are acquired by acquiring the unit price and the product name, and the application output data is generated based on the acquired information.
The printer driver execution unit 44b reads out and executes a printer driver stored in a predetermined storage unit included in the host computer 15, thereby executing a command of the fiscal printer 16 based on the application output data input from the application execution unit 44a. In accordance with the specification, a control command for causing the fiscal printer 16 to perform a series of operations related to the receipt issuance is generated and output to the fiscal printer 16.
The control command includes, for example, a command for instructing start of image recording, a command for instructing to drive the thermal head 46a, a command for instructing to feed a roll paper by a predetermined amount in the transport direction, and a cutting mechanism 46c. Various commands such as a command for instructing cutting of the roll paper are included.

Next, means for generating the EJ digital signature 56 and the fiscal digital signature 58 as digital signatures will be described.
When the EJ digital signature 56 is generated for a certain write receipt data 54, the main control unit 25 obtains a hash value based on a predetermined hash function using the one write receipt data 54 as original data. The hash value is output to the cryptographic IC chip control unit 82.
The encryption IC chip control unit 82 encrypts the hash value input from the main control unit 25 using the EJ digital signature private key KA1 to generate the EJ digital signature 56, and Then, a control command for outputting the generated EJ digital signature 56 is generated and output to the IC chip processing unit 85 of the encryption IC chip 81.
When the control command is input, the IC chip processing unit 85 encrypts the hash value by using the EJ digital signature private key KA1 stored in advance in the IC chip storage unit 86. The EJ digital signature secret key KA1 is a secret key related to the public key cryptosystem, and processing when the secret key is generated and stored in the IC chip storage unit 86 will be described later. The hash value encrypted with the EJ digital signature secret key KA 1, which is a secret key, is the EJ digital signature 56.
Here, the encryption IC chip 81 is a chip in which a dedicated circuit for encrypting data and a dedicated program are incorporated using a specific key stored in the IC chip storage unit 86. Therefore, the process related to data encryption can be executed at a very high speed.
When the EJ digital signature 56 is generated, the IC chip processing unit 85 outputs the generated EJ digital signature 56 to the encryption IC chip control unit 82.
The encryption IC chip control unit 82 outputs the EJ digital signature 56 input from the IC chip processing unit 85 to the main control unit 25, and the main control unit 25 writes the input EJ digital signature 56 to the write receipt data 54. And stored in the EJ memory 31.
While the means for generating the EJ digital signature 56 has been described above, the fiscal digital signature 58 is also generated by the same means. That is, a fiscal digital signature secret key KA2, which is a secret key for generating the fiscal digital signature 58, is stored in advance in the IC chip storage unit 86, and the IC chip processing unit 85 uses the secret key, A fiscal digital signature 58 is generated and output.
In the above example, the main control unit 25 calculates the hash value. However, the encryption IC chip control unit 82 may calculate the hash value, and the IC chip processing unit 85 may perform the calculation. It may be a configuration.

Next, the operation of the fiscal printer 16 when performing processing for generating a secret key used when generating the EJ digital signature 56 and the fiscal digital signature 58 and other accompanying processing will be described.
2A and 2B are flowcharts for explaining the above-described operation. FIG. 2A shows the operation of the encryption IC chip control unit 82, and FIG. 2B shows the operation of the IC chip processing unit 85.
First, the cryptographic IC chip control unit 82 starts the processing from step SA2 onward when a predetermined event has occurred (step SA1). In the present embodiment, one of the triggers is that the user turns on the printer for the first time after shipping the fiscal printer 16. In addition, when there is an explicit instruction from the user or when a predetermined initialization is performed, the cryptographic IC chip control unit 82 starts processing from step SA2 onward using the event as a trigger.
Next, the encryption IC chip control unit 82 generates an authentication password PW (password) (step SA2). The authentication password PW is a password used for authentication of a control command output from the encryption IC chip control unit 82 to the IC chip processing unit 85 of the encryption IC chip 81. As will be apparent later, the cryptographic IC chip control unit 82 outputs the control command to the IC chip processing unit 85 after including the authentication password PW in the control command in accordance with the format of the control command. The IC chip processing unit 85 authenticates the control command based on the authentication password PW included in the control command and the authentication password PW stored in the IC chip storage unit 86.
Next, the encryption IC chip control unit 82 generates a control command for storing the authentication password PW generated in step SA <b> 2 in a predetermined storage area of the IC chip storage unit 86, and outputs the control command to the IC chip processing unit 85. (Step SA3). When the control command is input, the IC chip processing unit 85 stores the authentication password PW in the IC chip storage unit 86 based on the control command (step SB1).
Next, the encryption IC chip control unit 82 stores the authentication password PW generated in step SA2 in a predetermined storage area of the second SRAM 83 (step SA4).
In this embodiment, the encryption IC chip control unit 82 has a function of generating the authentication password PW. However, the IC chip processing unit 85 may have the function. The structure which the control part 25 has may be sufficient.

Next, the encryption IC chip control unit 82 generates an EJ digital signature secret key KA1 that is a secret key for generating the EJ digital signature 56, and a public key KB1 that is a corresponding public key. A control command for generating a fiscal digital signature private key KA2 that is a private key for generating the digital signature 58 and a public key KB2 that is a corresponding public key is generated and output to the IC chip processing unit 85. (Step SA5). The encryption IC chip control unit 82 includes the authentication password PW in the control command according to a predetermined format.
When the control command is input, the IC chip processing unit 85 authenticates the control command (step SB2). Specifically, the IC chip storage unit 86 determines whether or not the authentication password PW included in the control command matches the authentication password PW stored in the IC chip storage unit 86. Determines that the authentication has succeeded. On the other hand, if they do not match, it determines that the authentication has failed.
As described above, in this embodiment, the IC chip processing unit 85 authenticates the control command input from the encryption IC chip control unit 82 based on the authentication password PW. For this reason, even if the cryptographic IC chip 81 is removed by an unauthorized means by a third party and unauthorized access using the control command is performed by the third party, the unauthorizedness can be detected, and Corresponding appropriate processing, for example, processing for making the data unusable can be executed. In the following, the description will be made assuming that the authentication is successful in step SB2.
Next, the IC chip processing unit 85 includes an EJ digital signature private key KA1 and a public key KB1 key pair compliant with a predetermined public key encryption method such as the RSA encryption method, and a fiscal digital signature private key KA2, And a key pair of the public key KB2 is generated (step SB3).
Here, in the present embodiment, for different types of fiscal data (write receipt data 54 and daily sales data 53), corresponding digital signatures are generated using different secret keys. This is due to the following reason. That is, suppose that a third party obtains any one piece of fiscal data, for example, the write receipt data 54 by an unauthorized means. In this case, the written receipt data 54 may be altered, while the daily sales data 53 cannot be altered. If the falsification is performed only on the written receipt data 54, a mismatch occurs between the written receipt data 54 and the daily sales data 53. For this reason, it is possible to detect falsification with respect to the write receipt data 54 by implementing means for detecting the inconsistency. In other words, with respect to different types of fiscal data, a configuration in which a corresponding digital signature is generated using a different secret key increases the possibility that it can be detected if any tampering is performed. This also serves as a deterrent against tampering.
In this example, there are two types of fiscal data stored in the fiscal printer 16; the written receipt data 54 and the daily sales data 53. However, even if the configuration stores three or more types of fiscal data. Of course it is good. In this case, since a secret key for generating a digital signature is generated for each type of fiscal data, the size of the data related to the secret key may be very large.
The encryption IC chip 81 is a chip in which a dedicated circuit for executing processing for generating a secret key and a public key and a dedicated program are incorporated. Therefore, the process can be executed at a very high speed.
When the generation of the two key pairs is completed, the IC chip processing unit 85 notifies the encryption IC chip control unit 82 to that effect (step SB4).

Upon receiving the notification, the encryption IC chip control unit 82 uses the IC chip storage unit 86 for the secret keys (EJ digital signature secret key KA1 and fiscal digital signature secret key KA2) among the generated keys. On the other hand, for the public key (for the public key KB1 and the public key KB2), a control command for transmitting the public key without storing it in the IC chip storage unit 86 is generated, and the IC chip processing unit 85 (Step SA6). This control command includes an authentication password PW.
When the control command is input, the IC chip processing unit 85 authenticates the control command (step SB5), and then, based on the control command, the EJ digital signature private key KA1 and the fiscal digital The signature private key KA2 is stored in the IC chip storage unit 86 (step SB6). The IC chip storage unit 86 has a configuration and structure that prevents data from being accessed by unauthorized physical and software means. Further, the IC chip processing unit 85 outputs the public key KB1 and the public key KB2 to the encryption IC chip control unit 82 (step SB7).
When the public key KB1 and the public key KB2 are acquired, the cryptographic IC chip control unit 82 stores these public keys in the second SRAM 83 (step SA7).
As described above, in the present embodiment, among the secret key generated by the function of the encryption IC chip 81 and the public key, the IC chip storage unit in which the secret key is mounted on the encryption IC chip 81 (chip). While storing in 86 (first memory), the public key (data other than the data relating to the key used for data encryption) is stored in the second SRAM 83. As a result, the generated public key, in other words, the key not used for data encryption is stored in the second SRAM 83 different from the IC chip storage unit 86, so the public key is stored in the IC chip storage unit 86. It is possible to prevent a situation in which the secret key cannot be stored in the IC chip storage unit 86 due to a shortage of capacity due to the above, and efficient encryption can be realized. In particular, in the present embodiment, a secret key and a public key are generated for each type of fiscal data. However, there are many types of fiscal data, and therefore, the size of the data related to the secret key and the data related to the public key. Even when the value is large, it is possible to prevent a situation in which the secret key cannot be stored in the IC chip storage unit 86 and to realize efficient encryption.

Next, functions of the fraud detector 35 and related members will be described.
The fraud detection unit 35 is a functional block that detects unauthorized access to the fiscal memory 50 by a third party.
The fraud detector 35 detects unauthorized access by a predetermined means regardless of physical access or software access. Hereinafter, the function of the fraud detector 35 will be described with a specific example.
For example, the fraud detection unit 35 is configured to receive a signal to that effect when the cover of the fiscal printer 16, other components, or the device is removed by unauthorized means. Detect unauthorized access.
Further, for example, the fraud detection unit 35 monitors data input through the PC connector 26a, the fiscal connector 26b, and the communication module 37, and if there is an input of illegal data, it is determined that there has been an unauthorized access. To do.
In addition, for example, an inclination sensor, a vibration sensor, or the like is connected to the fraud detection unit 35. After the fiscal printer 16 is installed, an inclination greater than a predetermined threshold is detected, or vibration greater than a predetermined threshold is detected. If this happens, an unauthorized access is detected.
For example, the fraud detection unit 35 is equipped with a GPS sensor, and detects fraudulent access when the fiscal printer 16 moves beyond a predetermined range.
The configuration of the fraud detection unit 35 has been described above by giving a specific example. However, the configuration is not limited thereto, and any existing means for detecting fraud can be applied.

When unauthorized access is detected by the unauthorized detection unit 35, a signal to that effect is output from the unauthorized detection unit 35 to the cryptographic IC chip control unit 82.
When a signal indicating that fraud has been detected is input, the cryptographic IC chip controller 82 performs the following processing. That is, the encryption IC chip control unit 82 accesses the second SRAM 83, and stores the storage area in which the authentication password PW is stored as other data (may be NULL data or other meaningless data. The authentication password PW is invalidated.
Thus, in this embodiment, when an unauthorized access to the fiscal printer 16 is detected, the authentication password PW stored in the second SRAM 83 is invalidated. Thereby, the following effects are produced.
That is, when the authentication password PW stored in the second SRAM 83 is invalidated, the IC chip processing unit 85 is not successfully authenticated for the control command output by the encryption IC chip control unit 82. As a result, it becomes impossible to output a control command from the cryptographic IC chip control unit 82 and cause the IC chip processing unit 85 to execute some processing. For this reason, it becomes impossible for a third party to output a control command to the IC chip processing unit 85 for an unauthorized purpose, to output a secret key, or to modify the secret key. That is, unauthorized access by a third party to the data stored in the IC chip storage unit 86 is prevented.
The means for invalidating the authentication password PW is not only a means for overwriting the authentication password PW. For example, when fraud is detected by the fraud detection unit 35, power is supplied to the second SRAM 83 which is a volatile memory. May be a means for erasing the authentication password PW.

As described above, the fiscal printer 16 according to the present embodiment has at least a function of generating a key used for data encryption and a function of encrypting input data, and the IC chip storage unit 86. The encryption IC chip 81 (chip) on which (first memory) is mounted and the key generated by the function of the encryption IC chip 81 are stored in the IC chip storage unit 86, while data other than the data related to the key Are included in a second SRAM 83 (second memory) different from the IC chip storage unit 86, and an encryption IC chip control unit 82 (control unit).
According to this configuration, high-speed encryption of various data can be realized by a dedicated chip having a function of encrypting input data. Further, the key used for encryption is stored in the IC chip storage unit 86, while at least a part of data other than the data related to the key used for encryption is different from the IC chip storage unit 86. Therefore, it is possible to suppress the occurrence of a situation in which the data related to the key cannot be stored in the IC chip storage unit 86 due to the lack of the capacity of the IC chip storage unit 86, thereby realizing efficient encryption.

In this embodiment, the cryptographic IC chip 81 has a function of generating a secret key and a public key related to a public key cryptosystem as a function of generating a key used for data encryption. The main control unit 25 stores the secret key generated by the function of the encryption IC chip 81 in the IC chip storage unit 86, and stores the public key generated by the function of the chip in the second SRAM 83.
According to this configuration, the chip has a function of generating a secret key and a public key related to the public key cryptosystem. Then, since the public key generated by the function, in other words, the key not used for data encryption is stored in the second SRAM 83 different from the IC chip storage unit 86, the public key is stored in the IC chip storage unit 86. It is possible to prevent a situation in which the secret key cannot be stored in the IC chip storage unit 86 due to a shortage of capacity due to storing the password, and efficient encryption can be realized.

In addition, the fiscal printer 16 according to the present embodiment stores different types of fiscal data, and the encryption IC chip 81 generates a key pair of a secret key and a public key for each type of fiscal data.
According to this configuration, a secret key is generated for each of different fiscal data, and there are a plurality of secret keys. Therefore, even when the size of the data related to the secret key and the data related to the public key is large, Since the public key is not stored in the IC chip storage unit 86, it is possible to prevent a situation in which the secret key cannot be stored in the IC chip storage unit 86 due to insufficient capacity due to the storage of the public key in the IC chip storage unit 86. And efficient encryption can be realized.

Further, the fiscal printer 16 according to the present embodiment has at least a function of encrypting input data, and the encryption IC chip 81 on which the IC chip storage unit 86 is mounted and the control command to the encryption IC chip 81. And an encryption IC chip control unit 82 (control unit) that causes the chip to execute processing. The fiscal printer 16 stores the authentication password PW in the IC chip storage unit 86 and also stores the common authentication password PW in the second SRAM 83 accessible by the encryption IC chip control unit 82. Further, the encryption IC chip control unit 82 outputs a control command including the authentication password PW to the encryption IC chip 81, and the encryption IC chip 81 includes the authentication password PW included in the control command and the IC chip. Based on the authentication password PW stored in the storage unit 86, the control command is authenticated.
According to this configuration, high-speed encryption of various data can be realized by a dedicated chip having a function of encrypting input data. Further, the encryption IC chip 81 authenticates the control command based on the password included in the control command input from the encryption IC chip control unit 82 and the password stored in the mounted IC chip storage unit 86. For example, even if there is unauthorized access by a third party after the chip has been removed by a third party, this can be detected and a corresponding appropriate process, for example, It is possible to execute processing for making data unusable.

The fiscal printer 16 according to the present embodiment further includes a fraud detection unit 35 that detects unauthorized access. When the fraud detection unit 35 detects fraud, the authentication password PW stored in the second SRAM 83 is provided. Disable.
According to this configuration, when there is an unauthorized access, the authentication password PW stored in the second SRAM 83 is invalidated, and the encryption IC chip 81 cannot be controlled by the control command from the encryption IC chip control unit 82. Therefore, it is possible to prevent the chip from executing unauthorized processing by unauthorized means.

In the present embodiment, when fraud is detected by the fraud detector 35, the authentication password PW stored in the second SRAM 83 is overwritten, and the power supplied to the second SRAM 83 configured by a volatile memory is used. By blocking, the authentication password PW stored in the second SRAM 83 is invalidated.
According to this configuration, the password stored in the second SRAM 83 can be invalidated accurately.

In this embodiment, the encryption IC chip 81 has a function of generating a secret key and a public key related to the public key cryptosystem, and stores the secret key generated by the function in the IC chip storage unit 86. To do.
According to this configuration, the encryption IC chip 81 includes the authentication password PW included in the control command input from the encryption IC chip control unit 82 and the authentication password stored in the mounted IC chip storage unit 86. Since the control command is authenticated based on the password PW, it is possible to prevent the secret key from being acquired by an unauthorized control command.

The above-described embodiment is merely an aspect of the present invention, and can be arbitrarily modified and applied within the scope of the present invention.
For example, in this embodiment, the encryption IC chip control unit 82 stores the secret key generated by the function of the encryption IC chip 81 in the IC chip storage unit 86, while at least one of data other than the data related to the key. The part (public key) is stored in the second SRAM 83. However, the processing may be performed by the IC chip processing unit 85, the main control unit 25, or each functional block may cooperate. In this case, a subject that performs processing or a combination of subjects functions as a “control unit”.
For example, in the above-described embodiment, the write receipt data 54 and the fiscal writing date / time data 52 are exemplified as the fiscal information (fiscal data), but it goes without saying that the fiscal information is not limited to these data. Further, for example, each functional block shown in FIG. 1 can be arbitrarily realized by cooperation of hardware and software, and does not suggest a specific hardware configuration. In addition, the function of each functional block may be provided in another externally connected device, and for the various operations described, by executing a program stored in an externally connected storage medium, You may make it perform.

  DESCRIPTION OF SYMBOLS 1 ... Information processing system, 15 ... Host computer, 16 ... Fiscal printer (information processing apparatus), 25 ... Main control part (control part), 35 ... Fraud detection part, 53 ... Daily sales data (fiscal data), 54 ... Write receipt data (fiscal data), 80 ... encryption module, 81 ... encryption IC chip (chip), 82 ... encryption IC chip control unit (control unit), 83 ... second SRAM (second memory), 85 ... IC chip processing unit (control unit), 86 ... IC chip storage unit (first memory).

Claims (6)

A chip having at least a function of encrypting input data and mounted with a first memory;
A control unit that outputs a control command to the chip and causes the chip to execute processing,
A password common to the password stored in the first memory is stored in a second memory accessible by the control unit;
The control unit outputs a control command including the password to the chip,
The information processing apparatus, wherein the chip has a function of authenticating the control command based on the password included in the control command and the password stored in the first memory. It further includes a fraud detector that detects unauthorized access,
The information processing apparatus according to claim 1, wherein when the fraud is detected by the fraud detection unit, the password stored in the second memory is invalidated.   When fraud is detected by the fraud detector, the password stored in the second memory is overwritten, and the power supplied to the second memory constituted by a volatile memory is cut off. The information processing apparatus according to claim 2, wherein the password stored in the second memory is invalidated by deleting the password.   The chip has a function of generating a secret key and a public key related to a public key cryptosystem, and stores the secret key generated by the function in the first memory. 4. The information processing apparatus according to any one of 3. Information processing comprising: a chip having at least a function of encrypting input data and having a first memory mounted thereon; and a control unit that outputs a control command to the chip and causes the chip to execute processing An apparatus control method comprising:
Storing a password in the first memory, and storing the common password in a second memory accessible by the control unit;
The control unit outputs a control command including the password to the chip,
A control method for an information processing apparatus, wherein the control command is authenticated by the chip based on the password included in the control command and the password stored in the first memory. A chip having at least a function of encrypting input data and having a first memory mounted thereon; and a control unit that outputs a control command to the chip and causes the chip to execute a process. A password that is common to the password stored in the first memory is a program executed by the chip of the information processing apparatus stored in the second memory accessible by the control unit and the control unit. ,
Causing the control unit to output a control command including the password to the chip;
A program for causing the chip to authenticate the control command based on the password included in the control command and the password stored in the first memory.

Images