JP2016162020A - Settlement terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a settlement terminal with improved security by preventing personal information stored in a memory from being illegally read with an application program illegally altered, resulting in leakage to a third party.SOLUTION: A settlement terminal 1 settles a transaction. A first RAM 4 stores input personal information, and develops an application program using the personal information. A second RAM 5 develops an application program which does not use the personal information. An input/output section 7 outputs the personal information stored in the first memory to a host device, when the application program using the personal information is executed.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a settlement terminal that settles a transaction amount with a card.

  2. Description of the Related Art Conventionally, electronic settlement transactions are performed in which a transaction amount is settled (settled) with a card (such as a credit card or a debit card). One of payment terminals that process electronic payment transactions is a CAT (Credit Authorization Terminal).

  Since the payment terminal handles card information and personal information such as personal identification number entered by the cardholder, the personal information entered is illegally read and leaked by tampering by a malicious third party. It has a function (tamper resistance function) for preventing the above. For example, the payment terminal has an opening detection function for detecting that the housing of the payment terminal main body has been opened. When the opening detection function detects that the housing of the payment terminal main body has been opened, the payment terminal stores it in the memory. It is the structure which deletes the personal information etc. which are stored (refer patent document 1 etc.).

International Publication No. 2008/117467

  However, the tampering technique has become more sophisticated, and it is desired to enhance tamper resistance.

  One enhancement of tamper resistance is to prevent personal information stored in the memory from being dumped and leaked to a third party by an illegally rewritten application program.

  An object of the present invention is to improve security by preventing unauthorized reading of personal information stored in a memory by an application program that has been illegally rewritten and leaking it to a third party. The purpose is to provide a payment terminal.

  The settlement terminal of the present invention has the following configuration in order to achieve the above object.

  The payment terminal processes, for example, an electronic payment transaction in which the transaction amount is settled (settled) with a card (such as a credit card or a debit card).

  The first memory stores the input personal information and develops a business application program that uses the personal information. The business application program that uses personal information is, for example, an authentication program that performs processing related to transaction settlement authentication, or an encryption program that encrypts input personal information. The personal information is card information (card information) used for transaction settlement, a personal identification number of the card, and the like.

  Further, a business application program that does not use personal information is developed in the second memory. Business application programs that do not use personal information are, for example, a display program that controls screen display on a display provided in the settlement terminal body, and a print program that outputs print data related to transactions to a printer.

  The output unit outputs the personal information stored in the first memory to the host device when a business application program that uses the personal information is executed.

  In this way, the payment terminal expands the business application program that uses personal information in the first memory, and expands the business application program that does not use personal information in the second memory that is different from the first memory in hardware. To do. Therefore, even if a business application program that does not use personal information is illegally rewritten, the personal information stored in the first memory by the illegally rewritten business application program (business application program that does not use personal information) Will not be dumped. In other words, it is possible to prevent personal information stored in the first memory from being dumped and leaked to a third party by an illegally rewritten business application program.

  Moreover, it is preferable that the personal information transmitted to the host device is encrypted and transmitted. As a result, it is possible to improve security against personal information being extracted through a transmission route to the host device. In this case, an encryption key used for encrypting personal information may be stored in the first memory. The encryption key here is a key used for encrypting information (personal information). Further, the encryption key may be the same key as the decryption key used when decrypting the encrypted information (personal information), or may be a key different from this decryption key. In other words, the decryption key may be the same as the encryption key or different from the encryption key.

  Furthermore, the first memory may be a volatile memory and configured to be backed up by a battery to prevent the encryption key from being lost and prevent the encryption key from being read illegally. For example, an opening detection unit that detects that the housing of the payment terminal main body has been opened is provided, and when it is detected that the housing of the payment terminal main body has been opened, the battery backup for the first memory is stopped. The encryption key stored in the first memory is lost.

  According to the present invention, it is possible to prevent personal information stored in the memory from being illegally read out and leaked to a third party by an illegally rewritten application program, and security can be improved.

It is a block diagram which shows the structure of the principal part of a payment terminal. It is the schematic which shows the external appearance of a payment terminal. It is a flowchart which shows operation | movement of a payment terminal. It is a flowchart which shows a load process. It is a flowchart which shows transaction processing. It is a flowchart which shows the input reception process of personal information.

  Hereinafter, a settlement terminal according to an embodiment of the present invention will be described.

  FIG. 1 is a block diagram showing a configuration of a main part of a payment terminal according to this example. FIG. 2 is a schematic diagram showing an overview of a payment terminal according to this example. The settlement terminal 1 includes a CPU 2, a ROM 3, a first RAM 4, a second RAM 5, a personal information input unit 6, an input / output unit 7, and an opening detection unit 8. Each part of the settlement terminal 1 main body is electrically connected by a conductor line.

  The settlement terminal 1 processes an electronic settlement transaction in which the transaction amount is settled (settled) with a card (such as a credit card or a debit card).

  The CPU 2 controls the operation of the payment terminal 1 main body.

  The ROM 3 is a program that is activated on the settlement terminal 1 main body, such as an operating system (OS), an application programming interface (API), a business application program (hereinafter simply referred to as a business application), an encryption program, and the like. Remember. There are business applications that use personal information and those that do not use personal information. A business application that uses personal information is, for example, an authentication program that performs processing related to transaction settlement authentication or an encryption program that encrypts input personal information. Business applications that do not use personal information are, for example, a display program that controls screen display on the display 9 provided in the settlement terminal 1 main body, and a print program that outputs print data related to transactions to a printer. The personal information is card information (card information) used for transaction settlement, a personal identification number of the card, and the like.

  In FIG. 1, the encryption program is described separately from the business application, but this encryption program is also one of the business applications.

  In the first RAM 4, business applications (encryption program, authentication program, etc.) that use personal information stored in the ROM 3 are deployed when the payment terminal 1 main body is activated. The first RAM 4 stores an encryption key. The first RAM 4 is a volatile memory, but is backed up by a battery, so that the encryption key is not lost when the payment terminal 1 is turned off. The decryption key used when decrypting information (personal information) encrypted with the encryption key may be this encryption key or a key different from this encryption key.

  In the second RAM 5, the OS, API, and business applications (display program, print program, etc.) that do not use personal information stored in the ROM 3 are expanded when the settlement terminal 1 main unit is activated.

  The first RAM 4 and the second RAM 5 are different hardware. The second RAM 5 is also a volatile memory, but is not backed up by a battery.

  The first RAM 4 corresponds to the first memory referred to in the present invention, and the second RAM 5 corresponds to the second memory referred to in the present invention.

  The personal information input unit 6 includes a card reader 6a for reading card information recorded on the card, an operation key 6b having a numeric keypad and function keys, and a PIN pad (not shown) connected to the payment terminal 1 main body. Etc. The PIN pad is a device for the cardholder to input a personal identification number. 2 shows only a magnetic card reader that reads card information from a magnetic card as the card reader 6a. However, the personal information input unit 6 may be an IC card reader that reads card information from a contact-type IC card, The configuration may also include a non-contact type IC card reader that reads card information from a contact type IC card.

  The input / output unit 7 performs data input / output with a connected external device. Examples of the external device include a communication device for communicating with a host device, a printer for printing transaction contents, a POS terminal for registering a transaction product, and the like. The host device is an authentication center that authenticates whether or not settlement is possible for an electronic settlement transaction, a transaction management device that manages a transaction history, and the like. The input / output unit 7 has a configuration corresponding to the output unit referred to in the present invention.

  The opening detection unit 8 detects that the housing of the payment terminal 1 main body has been opened. The opening detection part 8 is a structure which detects that the housing | casing of the payment terminal 1 main body was opened using the well-known tamper pin, for example.

  The settlement terminal 1 also includes the display unit 9 shown in FIG. 2 and a display unit (not shown) that controls screen display of the display unit 9.

  Hereinafter, the operation of the payment terminal 1 will be described. FIG. 3 is a flowchart showing the operation of the payment terminal.

  When the power of the main body is turned on, the settlement terminal 1 performs a load process for loading various programs stored in the ROM 3 (s1, s2).

  FIG. 4 is a flowchart showing the loading process according to s2. The settlement terminal 1 executes a loading program in the CPU 2 (s11), and develops business applications (encryption program, authentication program, etc.) that use personal information stored in the ROM 3 in the first RAM 4 (s12). Further, the settlement terminal 1 develops the OS, API, and business application (printing program, display program, etc.) that does not use personal information stored in the ROM 3 in the second RAM 5 (s13), and completes this loading process. To do. The processes of s12 and s13 may be reverse to the above order or may be executed in parallel.

  The settlement terminal 1 is ready for transaction processing upon completion of the load processing for s2.

  The payment terminal 1 waits for an input operation related to the start of the transaction to be performed or until the power source of the payment terminal 1 is turned off (s3, s4). The settlement terminal 1 performs a transaction process when an input operation related to the start of the transaction is performed (s5). Further, when the payment terminal 1 is turned off, the payment terminal 1 performs a power-off process (s6) and ends this process.

  FIG. 5 is a flowchart showing the transaction processing according to s5. The settlement terminal 1 receives input of transaction information (s21). The transaction information that receives the input in s21 is a product / service code for identifying the product or service to be traded, a transaction amount, and the like. The settlement terminal 1 stores the transaction information input in s21 in a variable area (not shown) of the first RAM 4. Further, the payment terminal 1 accepts input of personal information used for payment of the transaction amount (s22). The personal information that receives the input in s22 is card information of a card that settles the transaction amount, a personal identification number of the card that settles the transaction amount, and the like.

  FIG. 6 is a flowchart showing the personal information input acceptance process in s22. The settlement terminal 1 receives an input of the type of card used for settlement of the transaction amount (s31). In s31, an input of a type related to the usage of a card such as a credit card, a debit card or a prepaid card or a type related to a physical configuration of a card such as a magnetic card, a contact IC card, or a non-contact IC card is accepted. . In s31, the card type used for settlement of the transaction amount is input by the operation of the operation key 6b by the operator.

  The payment terminal 1 accepts input of card information for the type of card input in s31 (s32). In s 32, the card reader included in the personal information input unit 6 reads the card information, and inputs the read card information to the first RAM 4. The first RAM 4 stores the input card information in the variable area.

  The settlement terminal 1 encrypts the card information input in s32 (s33). In s33, the input card information is encrypted by the encryption program developed in the first RAM 4. The settlement terminal 1 encrypts the card information using the encryption key stored in the first RAM 4. Further, when the payment terminal 1 encrypts the card information, the encrypted card information is stored in the variable area of the first RAM 4 and the unencrypted card information (in s32) stored in the variable area. Delete the entered card information. That is, the payment terminal 1 deletes the unencrypted card information from the variable area of the first RAM 4 as soon as the card information becomes unnecessary (however, the encrypted card information (It is stored in the variable area of the RAM 4). This suppresses a decrease in security against leakage of unencrypted card information.

  The settlement terminal 1 accepts an input of a password (s34). In s34, the card holder inputs the personal identification number using the PIN pad provided in the personal information input unit 6. The input password is input to the first RAM 4. The first RAM 4 stores the input password.

  The settlement terminal 1 determines whether authentication for settlement of the transaction amount related to the current transaction is performed at the center or the settlement terminal 1 main body (s35). If the settlement terminal 1 determines that authentication related to settlement of the transaction amount is performed at the center, the settlement terminal 1 encrypts the input password by the encryption program developed in the first RAM 4 (s36). The payment terminal 1 encrypts the password using the encryption key stored in the first RAM 4. When the settlement terminal encrypts the password, it stores the encrypted password in the variable area of the first RAM 4 and the unencrypted password stored in this variable area (input in s34). Delete the password. That is, the settlement terminal 1 deletes the unencrypted personal identification number from the first RAM 4 as soon as the personal identification number is no longer necessary (however, the encrypted personal identification number is stored in the variable of the first RAM 4). Is stored in the area.) As a result, a decrease in security against leakage of the unencrypted password is suppressed.

  On the other hand, if the settlement terminal 1 determines that authentication for settlement of the transaction amount is not performed at the center (that is, performed by the payment terminal 1 itself), it performs an authentication process regarding whether or not settlement of the transaction amount is possible (s37). The settlement terminal 1 determines that the authentication for settlement of the transaction amount is not performed at the center in s36 when the card used for settlement of the transaction is a prepaid card or the like. In s37, if the value balance of the prepaid card used for transaction settlement is less than the transaction amount, it is determined that the transaction amount cannot be settled. On the other hand, if the value balance of the prepaid card used for transaction settlement is equal to or greater than the transaction amount, it is determined that the transaction amount can be settled.

  Note that the settlement terminal 1 does not perform authentication for settlement of the transaction amount at s35 even when the transaction amount is less than a predetermined amount (for example, 1000 yen) (when it is a small transaction) (settlement terminal). It is also possible to make a determination as follows.

  Returning to FIG. 5, when the processing related to s22 (the processing shown in FIG. 6) is completed, the payment terminal 1 determines whether or not the authentication related to the payment of the transaction amount is completed (s23). In s23, it is determined whether or not authentication related to settlement of the transaction amount has been performed in s37 described above, that is, whether or not authentication related to settlement of the transaction amount is performed in the center.

  If the payment terminal 1 determines that it has been authenticated in s23, the process proceeds to s26 described later without performing the processes related to s24 and s25 described below.

  If the settlement terminal 1 determines that it has not been authenticated in s23, it transmits an authentication request to the center (s24), and waits to receive an authentication result from the center (s25). In s24, the payment terminal 1 transmits the encrypted personal information (encrypted card information and personal identification number) and transaction information including the transaction amount to the center. For each payment terminal 1, the center stores an encryption key stored in the payment terminal 1 as a decryption key. Therefore, the center can decrypt the personal information included in the authentication request received from the settlement terminal 1.

  The center may be configured to recognize the settlement terminal 1 that has transmitted the authentication request by the line number, or by the terminal code (terminal code that identifies the settlement terminal 1) included in the authentication request. It may be a configuration. Alternatively, each settlement terminal 1 may store a public key of the center as an encryption key and store a decryption key (secret key) corresponding to the center. In this case, the center does not need to recognize the payment terminal 1 that has transmitted the authentication request.

  The settlement terminal 1 determines whether the transaction amount can be settled using a card (s26). If settlement is possible, the settlement terminal 1 performs settlement processing for settlement of the transaction amount with a card and processes the transaction (s27). On the other hand, if payment is not possible, the payment terminal 1 performs transaction cancellation processing for canceling the transaction (s28), and ends this processing.

  Further, when executing the transaction processing shown in FIG. 5, the settlement terminal 1 executes a display program developed in the second RAM 5, a printing program, and the like, thereby controlling screen display on the display unit 9 and input / output. Processing related to generation and output of print data for the printer connected to the unit 7 is performed.

  Thus, the payment terminal 1 according to this example has a configuration in which business applications that use personal information are expanded in the first RAM 4 and business applications that do not use personal information are expanded in the second RAM 5. The personal information stored in the first RAM 4 is not dumped by the business application expanded in the second RAM 5. Therefore, it is possible to prevent the personal information stored in the first RAM 4 from being read illegally and leaked to a third party by a business application that does not use the illegally rewritten personal information, and security can be improved. .

  In addition, this makes it possible for a user using the payment terminal 1 main body to freely change a business application that does not use personal information without reducing security against leakage of personal information. That is, a user who uses the settlement terminal 1 main body can use a user-friendly business application and can improve operability.

  Further, when the opening detection unit 8 detects that the housing of the main body of the payment terminal 1 is opened, the payment terminal 1 deletes the personal information and the encryption key stored in the first RAM 4. Specifically, the personal information and the encryption key stored in the first RAM 4 are lost by stopping the battery backup for the first RAM 4. Therefore, the settlement terminal 1 does not leak the encryption key stored in the first RAM 4 by opening.

  In addition, the settlement terminal 1 according to the above example encrypts the input personal information (card information and password) and transmits it to the host device. However, the input personal information (card information and password) is encrypted. It may be configured to transmit to a higher-level device without being converted. That is, the payment terminal 1 may not include the above-described configuration for encrypting personal information.

1 ... Payment terminal 2 ... CPU
3 ... ROM
4 ... 1st RAM
5 ... Second RAM
6 ... Personal information input unit 6a ... Card reader 6b ... Operation key 7 ... Input / output unit 8 ... Opening detection unit 9 ... Display

Claims (4)

In a payment terminal that settles transactions,
A first memory for storing the input personal information and developing a business application program that uses the personal information;
A second memory for developing a business application program that does not use the personal information;
A settlement terminal comprising: an output unit that outputs the personal information stored in the first memory to a host device when a business application program that uses the personal information is executed. An encryption program for encrypting the personal information is expanded in the first memory,
The settlement terminal according to claim 1, wherein the output unit outputs the personal information encrypted by execution of the encryption program to a host device when a business application program that uses the personal information is executed. .   The payment terminal according to claim 2, wherein the first memory stores an encryption key used when the personal information is encrypted by executing the encryption program. The first memory is a battery-backed volatile memory,
An opening detection unit for detecting that the housing of the settlement terminal body is opened;
The payment terminal according to any one of claims 1 to 3, wherein when the opening detection unit detects that the housing of the payment terminal main body has been opened, battery backup for the first memory is stopped.

Images