JP5011512B2 - Memory monitoring method - Google Patents

Description

  The present invention relates to a memory monitoring method for monitoring a memory in which confidential data is stored.

  In an electronic device such as a card reader, confidential data (for example, key data used for encryption processing) is held in a volatile memory backed up by a secondary power supply, and an illegal act has occurred in the electronic device. In some cases, the confidential data stored in the volatile memory is erased. For example, when an unauthorized action is detected such as when the electronic device is removed from the terminal or the cover is opened, the power supply to the volatile memory is cut off, and the confidential data in the volatile memory is naturally erased. As a result, the subsequent operation of the electronic device can be disabled, and leakage of confidential data to the outside can be prevented.

  In addition, a function is incorporated that constantly monitors the error detection code of confidential data stored in the volatile memory and disables the operation of the electronic device device if an illegal action is detected when the error detection code is abnormal. It is out. An error detection code is abnormal when confidential data stored in volatile memory is illegally rewritten or lost, and is always kept at the same time as the error detection code of confidential data calculated This means a case where the error detection code that is set does not match.

  In an electronic device device incorporating such a function, if an illegal act is detected while the power is off, the confidential data is lost by shutting off the power supply from the secondary power source to the volatile memory. Data loss is detected at the time of raising, and the operation of the electronic device is disabled. When an illegal act is detected while the power is on, the confidential data is lost by shutting off the power supply to the volatile memory from the main power source and the secondary power source. When the power is on, an error detection code of confidential data is always calculated, and an abnormality is detected by comparing with an error detection code stored and stored in the volatile memory at the same time.

  And the monitoring system described in patent document 1 exists as what detects abnormality by comparing with an error detection code. In such a monitoring method, a BCC value is calculated and stored when an OS (operating system) or an AP (application program) is stored, and a BCC value is calculated and stored in advance when the OS or AP is activated. Compared with the BCC value, a match / mismatch is determined.

Japanese Patent Laid-Open No. 3-5856

  However, in the conventional method, when the confidential data that should be originally stored is completely lost and becomes all 0, the CRC calculation result with an initial value of 0 becomes 0, and the CRC held at the same time is also stored. Since it is 0, the CRC check result is OK, so it cannot be detected whether or not there is an abnormality.

  For this reason, it is necessary to make a judgment by incorporating another detection method, but there is a drawback that the monitoring process becomes redundant or the load on the monitoring system becomes heavy.

  In the method described in Patent Document 1, the OS has a monitoring function. The OS always calculates the BCC value of the AP and compares it with the BCC value held by the AP. Is to examine. APs and OSs are stored in one memory as they do not disappear, but it is not considered that the contents of APs and OSs become all 0. Therefore, it is normal that the BCC value held by the AP or OS is unchanged, for example, the BCC value at the time of installation is held.

  In addition, since AP and OS are not particularly inconvenient even if they are leaked, they are stored so that they will not be lost even if they are leaked or copied due to fraud. In order to prevent leakage of confidential data, it is stored so that confidential data can be lost when an illegal act is detected. For this reason, it is important to detect abnormality by determining whether the confidential data is lost and not stored or whether the confidential data is originally stored.

  The present invention has been made in view of such a point, and its purpose is to output the calculation result of error detection codes such as CRC as abnormal even when data is lost due to fraud and becomes all 0. It is an object of the present invention to provide a memory monitoring method that can be performed.

  In order to solve the above-described problems, a memory monitoring method according to the present invention includes a memory storing confidential data and an error detection code, a work memory storing work data necessary for various operations of the electronic device. In the electronic device apparatus equipped with the error detection code stored in the memory is stored in the working memory when the power of the electronic device is turned on, while the error detection of the confidential data stored in the memory is always performed The code is calculated, and the error detection code calculated as a result of the calculation is compared with the error detection code stored in the working memory.

  More specifically, the present invention provides the following.

(1) A memory monitoring method for monitoring a memory storing confidential data and an error detection code handled in an electronic device, wherein the electronic device includes a memory storing the confidential data and an error detection code, an electronic A work memory for storing work data necessary for various operations of the device, and storing the error detection code stored in the memory in the work memory when the power of the electronic device is turned on. A storage step, a calculation step of calculating an error detection code of confidential data stored in the memory after being stored in the working memory, an error detection code that has been calculated, and an error detection stored in the working memory A comparison step of comparing the codes, and when the two error detection codes are different by repeating the calculation step and the subsequent steps , Memory monitoring method characterized by comprising the step of notifying that it is abnormal.

  According to the present invention, the error detection code stored in the memory is stored in a working memory different from the memory, while the error detection code of the confidential data stored in the memory is constantly calculated. By comparing the error detection code calculated as a result of the calculation and the error detection code stored in the working memory, when these two error detection codes are different from each other, abnormal, and when these two error detection codes are the same Can be notified to the host device of the electronic device device as normal.

  Therefore, always calculate the error detection code of the confidential data stored in the memory, store the error detection code of the confidential data when the power is turned on in another working memory, and compare these error detection codes Thus, even when the confidential data becomes all 0, an abnormality can be detected.

  In addition, “the process of storing the error detection code stored in the memory in the working memory when the electronic device is turned on” is performed every time the electronic device is turned on. By adopting a configuration that does not hold the error detection code stored in the memory, the error detection code leaked to the outside because the error detection code once stored in the work memory is subsequently held in the work memory. Can be prevented. In particular, it is desirable to ensure the confidentiality of the error detection code when the content of the confidential data can be read or estimated from the error detection code.

  (2) The memory is a volatile memory that retains the stored contents when power is supplied from a backup power source, and retains the confidential data and the error detection code even when the power is off. A memory monitoring method characterized by the above.

  According to the present invention, the confidential data and the error detection code are stored in the volatile memory, and the confidential data and the error detection code are held by the power supply from the backup power supply even when the electronic device is not energized. Therefore, in the case of fraud, the power supply to the volatile memory is cut off and the confidential data and the error detection code are lost, while the power supply to the volatile memory is maintained and the confidential data and the error detection code are retained in the normal time. Can do.

  (3) The electronic device apparatus includes power control means for controlling supply of power from a power source to the memory, and the power control means is configured to supply the memory to the memory when detecting an illegal act of the electronic device apparatus A memory monitoring method characterized by shutting off power supply.

  According to the present invention, the supply of power to the memory is controlled by the power supply control means, and the power supply to the memory is cut off when an illegal act of the electronic device is detected. In the case of a volatile memory that retains the stored contents when power is supplied, the power supply from the backup power supply can also be cut off, so the contents of the volatile memory may be completely lost. it can.

  According to the present invention, even when confidential data is completely lost due to an illegal act of the electronic device apparatus, the error detection code check result can be detected as abnormal, and the subsequent electronic apparatus device can be made inoperable or normal. Can be disabled.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

[Configuration of electronic device]
FIG. 1 is a block diagram of an electronic device apparatus 1 used in a memory monitoring method according to an embodiment of the present invention.

  The electronic device apparatus 1 includes a CPU 10, a RAM 11, an EEPROM 12, a backup RAM 15, a battery 16, a power source 17, a power source control unit 18, and a fraud detection unit 19, and various connections are made via a bus. Has been. Further, for example, when the electronic device 1 is a card reader, a shutter 13 provided for the purpose of protecting the inside of the device or card protection during card processing, or a sensor provided for grasping the card position inside the device. 14 etc., and various connections are made.

  The CPU 10 governs overall control of the electronic device apparatus 1. For example, a command for opening / closing the shutter 13 or notifying the card position detected by the sensor 14 is transmitted / received. It also serves to transfer various data between memories. Further, the CPU 10 has a memory parity check function, and can calculate an error detection code such as a CRC to check whether the data is the same.

  The RAM 11 is an example of a volatile memory, and provides a work area for the CPU 10 to execute a program. Work data necessary for various operations is stored in the work area.

  The EEPROM 12 is an example of a nonvolatile memory, and stores electronic information such as a flag indicating whether or not key data has been set. Another nonvolatile memory may be a flash memory.

  The backup RAM 15 loses data when an illegal act is detected, and stores confidential data and error detection codes (CRC, check SUM, BCC, etc.). As shown in FIG. 2, the data is composed of key data and CRC as an error detection code. In the case of storing 8-byte key data in the backup RAM 15 capable of writing in units of 16 bytes, the CRC value is stored in the block of key data for 8 bytes and the last 2 bytes.

  The battery 16 supplies power to the backup RAM 15 via the power control means 18 as a backup power source. The power supply 17 also supplies power to the backup RAM 15 via the power supply control means 18 and supplies power to various connected means / devices.

  The power supply control means 18 controls to supply power from the battery 16 or the power supply 17 to the backup RAM 15 when the electronic device 1 is energized, and to supply power from the battery 16 to the backup RAM 15 when the electronic device 1 is not energized. Furthermore, when the fraud detection is detected by the fraud detection means 19, the power is cut off without supplying power to the backup RAM 15.

  The fraud detection means 19 is a circuit that detects fraud such as when the electronic device is removed from the terminal or when the cover is opened.

[Memory monitoring]
FIG. 3 is a flowchart showing a memory monitoring process routine executed by the electronic device 1.

  First, a key data registration command is received from the host device (step S1), and an operation for registering key data is started. The CPU 10 calculates the CRC value of the key data received from the device (step S2), writes the received key data to the backup RAM 15 (step S3), and writes the calculated CRC value to the backup RAM 15 (step S4). Store with.

  Next, the calculated CRC value is stored and held in the RAM 11 (step S5). If the CRC value calculated by the CPU 10 is stored in the RAM 11, step S5 can be omitted.

  Next, a key data stored flag is set in the EEPROM 12 (step S6), and memory monitoring is started.

  In the monitoring process, the key data stored in the backup RAM 15 is always CRC-calculated for each block (step S7), and the CPU 10 stores the CRC value stored in the RAM 11 in step S5 and the CRC calculated in step S7. (Step S8).

  If it is determined that the CRC values do not match as a result of the comparison, a security error command is issued to the host device (step S9). On the other hand, if it is determined that the CRC values match, the process proceeds to step S10. Note that the security error command is issued when it is determined that the key data in the key data storage area of the backup RAM 15 has been lost due to fraud.

  In step S10, another monitoring task is executed, and the process is sequentially returned to step S7 to monitor the CRC value.

[Memory monitoring at power-on]
FIG. 4 is a flowchart showing a memory monitoring processing routine at power-on that is executed in the electronic device 1.

  When the power is turned on and the electronic device is started up (step S11), the key data stored flag of the EEPROM 12 is checked during the initialization process (step S12). This is to check whether or not the key data has been set in the backup RAM 15. If the flag is set, the process proceeds to step S15. On the other hand, if no flag is set, no key data is set in the backup RAM 15, and therefore, the monitoring process is not performed (step S14), and the normal operation for executing only other monitoring tasks is started.

  If it is determined in step S13 that the key data stored flag is set, the CRC value stored in the backup RAM 15 is stored and held in the RAM 11 (step S15), and memory monitoring is started.

  Note that the memory monitoring process is the same as steps S7 to S10 described above.

  Here, if it is determined in step S13 that the key data stored flag is set, but the key data is not stored in the backup RAM 15, some fraud is detected when the power is off, and the contents of the backup RAM 15 It may have been lost.

In this case, since the CRC value of the backup RAM 15 in step S15 is different from the CRC value calculated in step S8, a security error is issued with the CRC calculation result as an error (step S9).
If the block storing the key data and CRC value of the backup RAM 15 becomes all 0, the CRC value of the backup RAM 15 in step S15 is 0, and the CRC value calculated in step S8 is also 0. Therefore, a security error is issued with the CRC calculation result as an error (step S9). Alternatively, a security error is issued assuming that the data in the backup RAM 15 is all 0.

[Application example]
In this specification, the CRC value is used as the error detection code, but a check SUM or BCC may be used, or a combination of CRC, check SUM, and BCC may be used. In the case of the combined use, in the case of the backup RAM 15 capable of writing in units of 16 bytes, the storage area is divided into 8 bytes for key data, 2 bytes for check SUM, 2 bytes for CRC, 2 bytes for BCC, etc. Can be stored.

  In addition, the error detection code can be stored not in the backup RAM 15 but in the EEPROM 12 or another backup memory. This eliminates the need for an all 0 check as to whether confidential data has been lost when the power is turned on.

  Alternatively, the error detection code can be stored in the backup RAM 15 and also stored in the EEPROM 12 or another backup memory. As a result, it is possible to detect whether or not there is an abnormality simply by always comparing the error detection code values of both the backup RAM 15 and the EEPROM 12 or another backup memory, leading to an improvement in processing speed.

  The memory monitoring method according to the present invention is useful as a method capable of recognizing fraudulent behavior of an electronic device apparatus by simple processing.

It is a block diagram of the electronic device apparatus used with the memory monitoring method which concerns on embodiment of this invention. It is a figure which shows an example of a data structure. It is a flowchart which shows the memory monitoring process routine performed with an electronic device apparatus. It is a flowchart which shows the memory monitoring process routine at the time of power activation performed with an electronic device apparatus.

Explanation of symbols

1 Electronic device 10 CPU
11 RAM
12 EEPROM
15 Backup RAM (nonvolatile memory)
16 Battery 17 Power supply 18 Power supply control means 19 Fraud detection means

Claims (3)

A memory monitoring method for monitoring a memory storing confidential data and an error detection code handled in an electronic device,
The electronic device device includes a memory in which the confidential data and the error detection code are stored, and a work memory in which work data necessary for various operations of the electronic device device is stored.
A storage step of storing the error detection code stored in the memory in the working memory when powering on the electronic device;
A calculation step of calculating an error detection code of confidential data stored in the memory after being stored in the working memory;
Anda comparison step for comparing the error detection code stored in the error detection code to the working memory in which the above calculation,
A memory monitoring method comprising: a step of notifying the host device of an electronic device device of an abnormality when the two error detection codes are different by repeating the calculation step and thereafter .   The memory is a volatile memory that retains the stored content when power is supplied from a backup power source, and retains the confidential data and the error detection code even when the power is off. The memory monitoring method according to claim 1. The electronic device apparatus is provided with power control means for controlling the power supply from the power source to the memory,
3. The memory monitoring method according to claim 1, wherein the power control unit cuts off the supply of power to the memory when detecting an illegal act of the electronic device. 4.

Images