JP4675980B2 - Fraud prevention method - Google Patents

Description

  The present invention relates to an unauthorized operation prevention method for preventing unauthorized operation of an electronic device that handles confidential data.

  In an electronic device such as a card reader, confidential data (for example, key data used for encryption processing) is held in a volatile memory backed up by a secondary power source, and is volatile each time if necessary. The confidential data is read from the memory to the working memory, and various processes are executed. Since the confidential data is indispensable for the execution of various processes, it is normally held so as not to disappear. When any abnormality is detected, the power supply from the secondary power supply and the main power supply to the volatile memory is cut off and the confidential data is erased.

  Also, the tamper-proof device described in Patent Document 1 also holds security information and personal information so that they are not normally lost, and stores them in the storage unit when any abnormality is detected. Security information and personal information are unconditionally erased to prevent reading.

JP 2003-186752 A ([0002])

  However, since it is necessary to add a special circuit or electronic component to the normal function in order to construct the function as in the above two examples, and it is costly. In general, as a means for retaining information, an inexpensive non-volatile memory is mounted, and a circuit or mechanism considering tamper resistance is not incorporated.

  Therefore, even if the non-volatile memory that holds the electronic information is removed together with the electronic device device, or an illegal device such as skimming is set up or the electronic device device is once removed to steal electronic information, the non-volatile memory The electronic information held in the memory remains as it is, and it is not only not possible to detect that there has been an illegal act, but also there is a disadvantage that electronic information such as confidential data leaks to the outside and the discovery is delayed.

  In addition, even if some kind of abnormality is detected and electronic information is erased unconditionally, in order to erase the data held in the nonvolatile memory, it is necessary to supply time and external power. Depending on the technique described in No. 1, there is a possibility that incomplete data may be erased, and tamper resistance is not completely ensured.

  In addition, some confidential data is stored in a volatile memory that is backed up by a secondary power supply. Then, the configuration of the secondary power source and the control means for controlling the power supply becomes complicated.

  The present invention has been made in view of the above points, and its purpose is to make an electronic device inoperable or to securely erase or erase electronic information including confidential data when an illegal act is detected. It is to provide a fraud prevention method that prevents fraud in advance.

  In order to solve the problems as described above, the fraud prevention method of the present invention includes a nonvolatile memory in which electronic information including confidential data is stored, a volatile memory in which work data necessary for various operations is stored, Is provided in the electronic device device, and in the energized state of the electronic device device, the electronic information stored in the nonvolatile memory is stored in the volatile memory, the inside of the nonvolatile memory is erased, and a predetermined command is issued. When shifting to a non-energized state without executing, the electronic information in the volatile memory is erased, so that no electronic information is left in the electronic device.

  More specifically, the present invention provides the following.

(1) Preventing unauthorized operation of an electronic device that handles confidential data, including a nonvolatile memory storing electronic information including confidential data and a volatile memory storing work data necessary for various operations In the unauthorized operation prevention method, the electronic device device determines whether or not the content of the electronic information stored in the non-volatile memory is correct in the energized state, and the content of the electronic information is correct And storing the electronic information stored in the non-volatile memory in the volatile memory, and erasing the electronic information stored in the volatile memory from the non-volatile memory from the non-volatile memory. be stored and step, after receiving the power-off permission command to permit power down from the upper apparatus, the electronic information stored in the volatile memory to the non-volatile memory And the electronic device is stored in the non-volatile memory in the energized state again after being changed from the energized state to the non-energized state without receiving the power-off permission command . A fraud prevention method characterized in that the content of electronic information is judged to be incorrect and an error is notified to a host device .

  According to the present invention, when the electronic device is turned on and energized, the electronic information stored in the nonvolatile memory is stored in the volatile memory and the nonvolatile memory is erased. If the power is turned off without receiving the power off permission command and the power is turned off, the electronic information in the volatile memory is lost and the nonvolatile memory is already erased. Electronic information in the device is lost and not left. On the other hand, when the power-off permission command is received and put into the non-energized state, the electronic information is stored in the non-volatile memory through the process of storing the electronic information stored in the volatile memory. Electronic information in the device is held in a nonvolatile memory.

  Therefore, the unauthorized operation can be prevented by setting the case where the power-off permission command is received without receiving the power-off permission command as the unauthorized operation.

  Here, “the process of erasing the electronic information stored in the volatile memory from the nonvolatile memory from the nonvolatile memory” is performed after the completion of the electronic information migration to the volatile memory or together with the electronic information migration to the volatile memory. It can be done at any time. In addition to the function of formatting (initializing) the non-volatile memory, this process also writes specific data unrelated to the electronic information, effectively erasing the original electronic information and storing the stored electronic There is also a function that prevents information from being identified.

  (2) A fraud prevention method characterized in that the electronic information includes an execution program.

  According to the present invention, since the execution program other than the confidential data is also stored in the non-volatile memory and stored from the non-volatile memory to the volatile memory in the energized state, the non-energized state can be obtained without receiving the power-off permission command. In such a case, the execution program is also lost, and thereafter the operation of the electronic device can be disabled. In addition, when a part of the execution program is stored from the non-volatile memory to the volatile memory, the electronic device apparatus normally operates normally with the program stored in the non-volatile memory and the volatile memory, while the source disconnection permission command When the power is turned off without receiving the message, a part of the execution program is lost, and thereafter, the operation of the electronic device cannot be normally performed.

  According to the present invention, it is possible to prevent the electronic information held in the nonvolatile memory from leaking to the outside, and when an unauthorized operation is detected, the subsequent electronic device is disabled or cannot be operated normally. Therefore, such unauthorized operation can be prevented.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

[Configuration of electronic device]
FIG. 1 is a block diagram of an electronic device apparatus 1 used in a fraud prevention method according to an embodiment of the present invention.

  The electronic device device 1 includes a CPU 10, a RAM 11, and an EEPROM 12, and various connections are made via a bus. Further, for example, when the electronic device 1 is a card reader, a shutter 13 provided for the purpose of protecting the inside of the device or card protection during card processing, or a sensor provided for grasping the card position inside the device. 14 etc., and various connections are made.

  The CPU 10 governs overall control of the electronic device apparatus 1. For example, a command for opening / closing the shutter 13 or notifying the card position detected by the sensor 14 is transmitted / received. It also serves to transfer various data between memories.

  The RAM 11 is an example of a volatile memory, and provides a work area for the CPU 10 to execute a program. The work area stores work data necessary for various operations, and also stores electronic information from the EEPROM 12.

  The EEPROM 12 is an example of a nonvolatile memory, and stores electronic information such as confidential data, an execution program, and an error detection code (CRC, check SUM, BCC). Another nonvolatile memory may be a flash memory. As shown in FIG. 2, the data is composed of the key data and the CRC as the error detection code, and is stored in the EEPROM 12. In the case where 8-byte key data is stored in the EEPROM 12 which can be written in units of 16 bytes, the CRC value is stored in the block of key data for 8 bytes and the last 2 bytes.

[Normal]
FIG. 3 is a flowchart showing a processing routine executed in the electronic device 1 at the normal time.

  When the electronic device 1 is turned on and energized (step S1), the CRC of the key data storage area of the EEPROM 12 is checked (step S2). If it is determined that the CRC value is correct, the process proceeds to step S5. On the other hand, if the CRC value is determined to be invalid as a result of the check, a security error is notified to the host device (step S4).

  The security error is notified to the host device when it is determined that all or part of the key data is not in the key data storage area of the EEPROM 12 and is illegal. For example, there is a case where data is lost by an unauthorized operation at the previous use. If a security error is issued, further operations are impossible.

  In step S5, the key data is stored in the RAM 11 in order to save the key data in the EEPROM 12 in the RAM 11. The key data storage area of the EEPROM 12 is erased together with the saving or after the saving is completed, and the key data stored in the RAM 11 from the EEPROM 12 is deleted from the EEPROM 12. Erasing may mean rewriting to “all 0xFF” or “all 0x00”, but rewriting to another specific data (for example, “all 0x11” or “all 0x22”) can achieve the same effect. Obtainable. It is also possible to rewrite the data area of 1 block (16 bytes) with 16 patterns “0x00, 0x01, 0x02, 0x03,... The effect is obtained. In addition, the same effect can be obtained by rewriting with random numbers. Further, the same effect can be obtained by rewriting data only for a specific data area designated in advance or randomly selected, instead of rewriting the entire data area.

  When these series of processes (steps S1 to S6) are completed, various processes are executed under the execution program stored in the RAM 11, and the normal operation of the electronic device can be performed (step S7).

  When the operator performs an operation to turn off the power after the normal operation ends, a power-off permission command for permitting the power-off from the host device is transmitted to the electronic device, and the electronic device receives it (step S8). .

  The electronic device apparatus that has received the command writes the key data stored in the RAM 11 to the EEPROM 12 and stores it (step S9).

  When the operation of writing the key data stored in the RAM 11 to the EEPROM 12 is completed, the power is turned off and the power is turned off (step S10). When the power is turned on again, the processing from step S1 is repeatedly executed.

  As described above, the key data is held in the electronic device device by executing various processes shown in FIG. 3 normally.

[When cheating]
FIG. 4 is a flowchart showing a processing routine executed by the electronic device 1 at the time of fraud.

  Step S7 in FIG. 4 is the same as that in FIG. 3, and is a state in which normal operation of the electronic device is being performed.

  When the power is turned off without receiving the power-off permission command in step S8 after the normal operation is finished (step S11), and then the power is turned on and energized (step S1), the CRC check (Step S2), the check result is an error, and a security error is notified to the host device (Step S4).

  This is because when the power is turned off without receiving the power-off permission command, step S9 is not executed, so that the key data stored in the RAM 11 is not written into the EEPROM 12 and the power-off state is not generated. It becomes. For this reason, the key data stored in the RAM 11 is lost, and the key data in the EEPROM 12 has already been erased in step S6, so that no key data remains in the electronic device device and a security error always occurs. It is.

  As described above, by shifting to the non-energized state without executing the various processes shown in FIG. 3, the key data is lost without being held in the electronic device.

[Erase example]
Hereinafter, an example will be described in which the electronic information stored in the EEPROM 12 is stored in the RAM 11 and the electronic information stored in the EEPROM 12 is erased after the electronic information in the EEPROM 12 is saved in the RAM 11. The saving of the electronic information may be all of the electronic information stored in the EEPROM 12 or may be a part of the electronic information (for example, key data) stored in the EEPROM 12. The reason why all or a part of the electronic information stored in the EEPROM 12 is erased is to prevent the electronic information in the EEPROM 12 from being specified. An example of saving and erasing will be described.

  As a first example, as described above, only the key data in the EEPROM 12 is stored in the RAM 11, and then all the key data in the EEPROM 12 is erased.

  As a second example, only the key data in the EEPROM 12 is stored in the RAM 11, and then all the key data in the EEPROM 12 is erased, so that the key data before erasure cannot be specified. To make the state unidentifiable, only a specific part of the key data is erased, or only part of the key data is erased at random.

  As a third example, the key data in the EEPROM 12 is stored in the RAM 11, and then all the key data stored in the RAM 11 is erased from the EEPROM 12. As a fourth example, key data in the EEPROM 12 is stored in the RAM 11, and then the key data stored in the RAM 11 is erased from the EEPROM 12 so that the key data before erasure cannot be specified. The state that cannot be specified is as described above.

  An example of evacuating and erasing all electronic information is as follows.

  As a first example, all electronic information including key data in the EEPROM 12 is stored in the RAM 11, and thereafter all electronic information including key data in the EEPROM 12 is erased.

  As a second example, all the electronic information including the key data in the EEPROM 12 is stored in the RAM 11, and then a part of all the electronic information including the key data in the EEPROM 12 is deleted to identify the key data before erasure. Make it impossible. The state that cannot be specified is as described above.

[Application example]
In addition to the key data, a part of the execution program can also be stored in the RAM 11 and operated by the execution program stored in the RAM 11 and the EEPROM 12. In this case, the power is turned off without receiving the power-off permission command. When this happens, a part of the execution program is also lost, and thereafter it cannot operate normally. Some of the execution programs that move from the EEPROM 12 to the RAM 11 include a table in which the jump destination of each interrupt is specified, and a task table in which a task to be monitored is specified.

  The fraud prevention method according to the present invention is useful as a method capable of preventing external leakage of electronic information due to an unauthorized operation with a simple configuration.

It is a block diagram of the electronic device apparatus used with the fraud prevention method which concerns on embodiment of this invention. It is a figure which shows an example of a data structure. It is a flowchart which shows the processing routine performed with an electronic device apparatus at the time of normal. It is a flowchart which shows the processing routine performed with an electronic device apparatus at the time of cheating.

Explanation of symbols

1 Electronic device 10 CPU
11 RAM (volatile memory)
12 EEPROM (nonvolatile memory)

Claims (2)

Unauthorized operation to prevent unauthorized operation of electronic equipment that handles confidential data, which is equipped with non-volatile memory storing electronic information including confidential data and volatile memory storing work data necessary for various operations A prevention method,
The electronic device is in its energized state
Determining whether the content of the electronic information stored in the non-volatile memory is correct;
If the electronic information is correct,
Storing electronic information stored in the non-volatile memory in the volatile memory;
Erasing the electronic information stored in the volatile memory from the nonvolatile memory from within the nonvolatile memory;
After receiving the power-off permission command to permit power down from the upper apparatus, and storing the electronic information stored in the volatile memory to the nonvolatile memory,
Have
The electronic device device has an error in the content of the electronic information stored in the nonvolatile memory in the energized state again after the energized state is changed from the energized state without receiving the power-off permission command. A method of preventing fraud, which is characterized by notifying the host device of an error .   The fraud prevention method according to claim 1, wherein the electronic information includes an execution program.

Images