JP5309252B2 - Information processing device - Google Patents

Description

  The present invention relates to an information processing apparatus, for example, an apparatus that automatically deletes security-related data stored therein.

With the spread of electronic money in recent years, commercial transactions using electronic money have been actively conducted.
In an electronic money system, electronic data corresponding to money called “value” is stored in an IC chip built in an electronic money card or the like, and is accessed from an electronic money terminal installed in a member store to increase or decrease money. Value transfer.
The amount change process for increasing the value balance stored in the IC chip is called “charge”, and the amount change process for decreasing the amount is called “settlement”.

The electronic money terminal and the electronic money card store various encryption keys. The electronic money terminal and the electronic money card confirm that the other party is a legitimate terminal by using these encryption keys, and encrypt communication. ing.
Further, the electronic money terminal accumulates the processing history with the electronic money card as usage log data for a certain period and transmits it to the electronic money server about once a day. Then, the electronic money server totals the usage log data transmitted from the electronic money terminal.

As described above, since data related to security is stored in the electronic money terminal, it is necessary to prevent the electronic money terminal from being illegally analyzed.
As described above, there are the following “security system and security processing method” as a technique for protecting the data inside the apparatus.

Japanese Patent Laid-Open No. 10-161865

  In this technology, data requiring security is stored in a volatile memory in the terminal, and when the opening of the terminal housing is detected, the power supply to the volatile memory is cut off and deleted.

Since electronic money terminals store a large amount of data, they are stored in a non-volatile storage device such as a hard disk. Various encryption keys are also stored in a nonvolatile storage device so that they are not erased even when the electronic money terminal is stopped.
Since the data stored in these non-volatile memories is held in the electronic money terminal even if there is no power supply, how to prevent leakage of internal data when the electronic money terminal is stolen Was an important issue.

  Accordingly, an object of the present invention is to prevent leakage of data related to security stored in an electronic money terminal.

In order to achieve the above object, according to the first aspect of the present invention, in the first aspect of the present invention, detection means for detecting a stop of power supply from an external power source, storage means for storing predetermined information, and the stored predetermined information An information processing means for performing information processing using the information of the information, and an erasing means for erasing the stored predetermined information when a stop of power supply is detected by the detecting means. An information processing apparatus is provided.
According to a second aspect of the present invention, the erasure unit includes an internal power source and a nonvolatile storage medium, and a stop record indicating that the power supply is stopped when the detection unit detects the stop of the power supply. Is recorded in the non-volatile storage medium using the power of the internal power supply, and when the stop record of the non-volatile storage medium is confirmed at the time of start-up, the predetermined information is erased. An information processing apparatus according to claim 1 is provided.
According to a third aspect of the present invention, there is provided a function restricting means for restricting an information processing function of the information processing means when there is a stop record in the nonvolatile storage medium at the time of startup. An information processing apparatus according to 2, is provided.
According to a fourth aspect of the present invention, the information according to the second or third aspect further comprises invalidating means for invalidating the stop recording recorded in the non-volatile storage medium after activation. A processing device is provided.
In the invention according to claim 5, the erasing unit records a time at which power supply from an external power supply is stopped in the nonvolatile storage medium, and a time at startup is within a predetermined time from the recorded time. In this case, the information processing apparatus according to claim 2, 3, or 4, wherein the predetermined information is not deleted.
In the invention according to claim 6, the erasure unit records a time when the power supply from the external power supply is stopped and a time when the power supply from the external power supply is resumed, and a time when the recording stops. 5. The information processing apparatus according to claim 2, wherein the predetermined information is not deleted when the time difference between the restarted times is within a predetermined time.
According to a seventh aspect of the present invention, the erasing unit includes an internal power source, and the stored predetermined information is erased using the power of the internal power source immediately after the detection unit detects the stop of power supply. The information processing apparatus according to claim 1 is provided.
In the invention according to claim 8, the information processing means stores the amount of money value as electronic data, receives money amount change information, and performs money amount change processing on the money amount stored in the money terminal. 8. The information processing apparatus according to claim 1, wherein the information is transmitted, and the predetermined information is an encryption key for encrypting the amount change information.
According to a ninth aspect of the present invention, there is provided the information processing apparatus according to the eighth aspect, wherein the erasing means further erases log data in which processing contents with the money terminal are recorded.

  According to the present invention, it is possible to prevent leakage of data stored in an electronic money terminal by automatically erasing data related to internal security when restarting after power is turned off, for example.

It is the figure which showed the network structure of the electronic money system. It is the block diagram which showed an example of the hardware structure of an electronic money card. It is the figure which showed an example of the hardware constitutions of an electronic money terminal. It is a flowchart for demonstrating the process at the time of the power failure which an electronic money terminal performs. It is a flowchart for demonstrating the starting process which an electronic money terminal performs. It is a flowchart for demonstrating the process at the time of power-off which the electronic money terminal which concerns on a modification is performed.

(1) Outline of Embodiment The electronic money terminal 8 (FIG. 3) monitors whether it is connected to an external power source, and operates using the power of the internal battery 33 when disconnected from the external power source. Then, the fact that it is disconnected from the external power source is recorded in the power-off flag of the nonvolatile memory 39.
When the electronic money terminal 8 is activated, the electronic money terminal 8 refers to the power-off flag to check whether the electronic money terminal 8 has been disconnected from the external power source. When it is confirmed that the electronic money terminal 8 has been disconnected from the external power supply, the electronic money terminal 8 starts after erasing the security data stored in the storage unit 41.
On the other hand, if it is confirmed that it is not disconnected from the external power supply, it starts without erasing the security data.

  The above is the basic configuration, but in this case, the security data is erased even when a momentary interruption (instant blackout) due to a lightning strike, etc., the electronic money terminal 8 is as follows, It is determined whether or not the power supply is instantaneously interrupted. If the power supply is instantaneously interrupted, it has a function of starting without deleting the security data.

First, the electronic money terminal 8 records the time disconnected from the external power supply in the nonvolatile memory 39. Then, the electronic money terminal 8 calculates the time disconnected from the external power source from the time difference between the current time and the time recorded in the nonvolatile memory 39 at the time of restart.
If this time is within the predetermined time, the electronic money terminal 8 starts up without deleting the security data. In other words, since the power supply is restored within a short period of time, the instantaneous interruption provides a threshold for the time when the electronic money terminal 8 is disconnected from the external power supply. Distinguish from external power supply.

As described above, the electronic money terminal 8 can detect power-off and use it as a trigger to erase security data each time. Therefore, the risk for terminal theft can be reduced.
Further, since the electronic money terminal 8 erases the security data with the power of the external power supply when restarting, it is possible to erase a large amount of security data simply by installing the small capacity battery 33.

(2) Details of Embodiment In this embodiment, a case where data related to security held by an electronic money terminal used in an electronic money system is taken as an example will be described.
FIG. 1 is a diagram showing a network configuration of the electronic money system 1.
The electronic money system 1 includes an electronic money card 6, a mobile phone 7, an electronic money server 2, an electronic money terminal 8, and the like. The electronic money terminal 8 and the electronic money server 2 can be connected via a network. .

The electronic money card 6 incorporates a non-contact type IC chip and can communicate with the electronic money terminal 8 by short-range wireless communication. Communication between the electronic money card 6 and the electronic money terminal 8 is encrypted. The electronic money card 6 encrypts information received from the electronic money terminal 8 and information to be transmitted to the electronic money terminal 8. It has a function to do.
The IC chip may be a contact type and connected to the electronic money terminal 8 by electrode contact.

  The IC chip is a kind of computer on which a CPU is mounted, and stores the amount of value, which is electronic data corresponding to currency, in the electronic money system 1 or the amount change information (amount of money) transmitted from the electronic money terminal 8. The amount change process is performed on the stored amount of value using a command to increase or decrease.

Value is electronic data associated with a monetary value in the electronic money system 1 and has an amount as an attribute, and an increase or decrease in the amount causes a transfer of exchange value similar to that of currency.
When increasing (charging) the value of an IC chip, the amount of money for the increase is collected from the customer, and this is distributed to the merchants that have settled with the value according to the settlement amount, so that the correspondence between the currency and the value can be achieved It is illustrated.

The concept of value can also include exchange value exchangeable with goods and services such as points.
The IC chip functions as a money terminal that stores the amount of money as electronic data (value), receives amount change information, and performs amount change processing on the stored amount.

The mobile phone 7 is a mobile terminal incorporating an IC chip similar to the electronic money card 6.
Similar to the IC chip of the electronic money card 6, the IC chip of the mobile phone 7 incorporates an electronic money function, and can perform a money amount change process by performing short-distance wireless communication with the electronic money terminal 8. .
Further, the mobile phone 7 can communicate with the electronic money server 2 via a network, receive money amount change information from the electronic money server 2, and perform money amount change processing.

Note that the electronic money card 6 and the mobile phone 7 are examples of an IC chip assembling form, and can be incorporated into other embedding media such as PDA (Personal Digital Assistant).
In the following description, the electronic money card 6 is used as a built-in medium for an IC chip, but the same description holds for other built-in media.

Member stores are stores (convenience stores, department stores, restaurants, other retail stores, vending machines, sales vehicles, other mobiles, etc.) that can be used for value transactions using the electronic money card 6 and are single at the accounting location. Or a plurality of electronic money terminals 8.
For example, the electronic money terminal 8 may be installed alone, or may be incorporated in an accounting apparatus (cash register or POS system).

The electronic money terminal 8 is a terminal that transmits various commands to the electronic money card 6 and causes the CPU of the electronic money card 6 to process information. The electronic money terminal 8 can communicate with the electronic money card 6 over a short distance.
The electronic money terminal 8 stores various encryption keys, and uses this to authenticate the electronic money card 6 and encrypt communication with the electronic money card 6.

The electronic money terminal 8 generates an amount change information by receiving an input of a charge amount or a settlement amount from an operator, and transmits the amount change information to the electronic money card 6, thereby performing an amount change process on the electronic money card 6. Let it be done.
Further, the electronic money terminal 8 accumulates the processing contents performed with the electronic money card 6 as usage log data, and transmits it to the electronic money server 2 later by batch processing.
The electronic money terminal 8 also encrypts communication contents with the electronic money server 2 using an encryption key.

The electronic money center is an operating entity of the electronic money system 1 and manages the electronic money system 1 using the electronic money server 2.
The electronic money server 2 is connected to the electronic money terminals 8, 8, 8,... Via the network, and the usage log data is transmitted from the electronic money terminal 8 and stored in a database.
The electronic money server 2 uses the usage log data stored in the database to total the charge amount and the payment amount for each member store.
The electronic money center performs fund settlement with each member store based on the result of the aggregation.

In the electronic money system 1 configured as described above, the electronic money terminal 8 stores therein an encryption key and other information that should not be leaked to the outside. The usage log data is also a trade secret, and it is desirable to prevent leakage to the outside.
For this reason, the electronic money terminal 8 has a security function for deleting these data in the event that the electronic money terminal 8 is stolen.
The range of data to be erased can be set in advance in the electronic money terminal 8 such as an encryption key or usage log data.
Hereinafter, erasure target data to be erased will be referred to as security data.
In addition to the encryption key and the usage log data, the security data can be various variations such as only the encryption key and further the encryption key and the member store ID.

The electronic money terminal 8 confirms that the electronic money terminal 8 is connected to the external power supply terminal (outlet) by monitoring the presence / absence of power supply from the external power supply.
When the electronic money terminal 8 detects the stop of the power supply from the external power supply, the electronic money terminal 8 is operated by a pre-installed battery, and the power-off flag prepared in the nonvolatile memory is turned on (it is set to off when normal). Set).
After that, the electronic money terminal 8 checks whether or not the power-off flag of the nonvolatile memory is set to ON when power is supplied from the external power source and starts up. If it is off, it starts without erasing the security data.

  There may be a momentary interruption in which the power supply is momentarily interrupted due to a lightning strike, etc., but in order to distinguish between a power supply interruption due to a momentary interruption and an artificial power supply interruption due to theft, etc. The money terminal 8 further has the following functions.

The electronic money terminal 8 includes a clock, and when the power supply is stopped, sets the power-off flag to ON and stores the time when the power supply stops in the nonvolatile memory.
When the electronic money terminal 8 confirms that the power-off flag is on when power is supplied again, the electronic money terminal 8 obtains the current time from the internal clock and stores the current time from the time stored in the nonvolatile memory. Calculate the time to reach.
If this time is within the predetermined time, the electronic money terminal 8 starts without deleting the security data. If the time is not within the predetermined time, the electronic money terminal 8 starts after deleting the security data.

  In this way, the electronic money terminal 8 determines that there is a momentary interruption when the power supply from the external power supply is interrupted within a predetermined time, and starts up without deleting the security data. Since the instantaneous interruption occurs in a very short time of several milliseconds to several hundred milliseconds, by setting the predetermined time slightly longer than the instantaneous interruption (for example, about 500 milliseconds), the electronic money terminal 8 It is possible to distinguish between power interruption due to theft and the like and instantaneous interruption.

As described above, when the power supply from the external power supply is stopped, the electronic money terminal 8 records that fact in the nonvolatile memory, and when the power supply from the external power supply is resumed, Erase security data using power from an external power source.
Therefore, a large amount of security data can be erased only by mounting a small battery that can be recorded in the nonvolatile memory. That is, it is possible to delete security data that exceeds the capacity of the battery.

The usage log data is generated every time it is processed with the electronic money card 6 and the amount of data tends to increase. On the other hand, it is not preferable to mount a large battery on the electronic money terminal 8.
Therefore, as in this embodiment, a mechanism that can erase a large amount of data with a small battery is effective.
Hereinafter, depending on the case, the power supply from the external power supply is abbreviated as power supply interruption.

FIG. 2 is a block diagram showing an example of a hardware configuration of the electronic money card 6.
The electronic money card 6 includes a CPU (Central Processing Unit) 21, a high frequency circuit 22, an antenna 26, a ROM (Read Only Memory) 23, a RAM (Random Access Memory) 24, an EEPROM (Electrically Erasable and Programmable ROM) 25, and the like. ing.
These elements are formed on an IC chip. However, the antenna 26 is constituted by an aerial line extending around an elliptical curve around the outer edge of the electronic money card 6 or on the diagonal line of the electronic money card 6, and the end is connected to the IC chip. .

The CPU 21 is a central processing unit that performs information processing according to various programs stored in the ROM 23 and the EEPROM 25. The CPU 21 receives the amount change information from the electronic money terminal 8, and uses this to change the amount of the stored value balance. Perform processing.
The CPU 21 can perform short-range wireless communication with the electronic money terminal 8 via the antenna 26 and the high-frequency circuit 22.

  The antenna 26 is an antenna for transmitting and receiving radio waves with an antenna built in the reader / writer unit of the electronic money terminal 8, and transmits and receives various types of information and drives an IC chip by radio waves from the reader / writer unit. Power generation.

  The high frequency circuit 22 converts the high frequency transmitted from the reader / writer unit of the electronic money terminal 8 to the antenna 26 and outputs the digital signal to the CPU 21. Conversely, the high frequency circuit 22 converts the digital signal output from the CPU 21 into a high frequency. 26 to the reader / writer unit.

The RAM 24 is a readable / writable memory that provides a working memory when the CPU 21 performs information processing.
In the present embodiment, the CPU 21 is used as a temporary storage area when performing a money amount change process or the like.
The ROM 23 is a read-only memory that stores basic programs, parameters, data, and the like for causing the electronic money card 6 to function.

The EEPROM 25 is a ROM capable of writing and erasing information. Information stored in the EEPROM 25 is maintained even when power is not supplied to the electronic money card 6.
The EEPROM 25 stores an electronic money program for causing the electronic money card 6 to function as an electronic money card, as well as various encryption keys, value balances and log data for encrypting communication with the electronic money terminal 8. An electronic money storage unit 29 for storing various data such as an electronic money function unit ID which is ID information for identifying the IC chip is formed.

FIG. 3 is a diagram illustrating an example of a hardware configuration of the electronic money terminal 8.
The electronic money terminal 8 includes a CPU 31, a ROM 37, a RAM 38, a nonvolatile memory 39, a storage unit 41, a power interruption detection circuit 32, a battery 33, a communication control unit 34, an input / output unit 35, a reader / writer unit 36, a clock unit 40, and the like. Connected via bus line.

  The electronic money terminal 8 operates when there is power supply from the external power source. When the power supply from the external power source is stopped, the electronic money terminal 8 is powered by the battery 33 for a certain amount of time (the CPU 31 supplies power to the nonvolatile memory 39). (Time required to record the power-off flag and power-off time).

In addition, the electronic money terminal 8 is configured such that, when the power is turned off, the CPU 31 sets the power-off flag in the nonvolatile memory 39 and operates only at the minimum configuration part that records the power-off time among the entire configuration. You can also.
With this configuration, the power consumption of the battery 33 can be reduced, and the battery 33 can be further downsized.

The CPU 31 performs information processing according to a predetermined program, and controls the entire electronic money terminal 8.
Specifically, the CPU 31 generates money amount change information and transmits it to the electronic money card 6, causing the electronic money card 6 to perform money amount change processing, or usage log data in which processing contents with the electronic money card 6 are recorded. Is generated.

When the power supply from the external power supply stops, the CPU 31 operates with the power supplied from the battery 33, sets the power-off flag of the nonvolatile memory 39 to ON, and sets the time when the power is turned off to the clock unit 40. And is recorded in the nonvolatile memory 39.
When restarting, the CPU 31 confirms the power-off flag. If the power-off flag is on, the CPU 31 determines from the power-off time stored in the nonvolatile memory 39 and the current time measured by the clock unit 40. It is determined whether or not there is an instantaneous interruption. If it is not an instantaneous interruption, the security data is deleted before starting. If it is an instantaneous interruption, the security data is not deleted.
Even when the main power switch of the electronic money terminal 8 is turned off, the CPU 31 operates with the power of the external power source, and monitors the power interruption.

The ROM 37 is a read-only memory that stores basic programs and parameters for operating the electronic money terminal 8.
The RAM 38 is a readable / writable memory that provides a working memory for the CPU 31 and loads and stores programs and data stored in the storage unit 41.
The communication control unit 34 is a connection device that connects the electronic money terminal 8 to the electronic money server 2 via a network.

The power-off detection circuit 32 is a circuit that notifies the CPU 31 when the power supply from the external power supply is stopped.
The power-off detection circuit 32 functions as a detection unit that detects the stop of power supply from the external power supply.
The power-off detection circuit 32 operates even when the main power switch of the electronic money terminal 8 is turned off, and monitors that the power cord of the electronic money terminal 8 is connected to the external power terminal. .
For example, the power supply is monitored by monitoring the peak value of the voltage of the external power supply, and when the peak value falls below a predetermined value, it is determined that the power supply from the external power supply has stopped.
Moreover, you may monitor by another method, such as using an electric current value or monitoring the execution value of a voltage or an electric current value.

  The power-off detection circuit 32 normally operates with power from an external power source, and operates with power supplied from the battery 33 when power supply from the external power source is stopped. In this way, the power-off detection circuit 32 can operate and transmit a signal to the CPU 31 even when the power is cut off.

The battery 33 is an internal power supply, and includes, for example, a power storage device such as a large-capacity capacitor, a lithium ion battery, an alkaline ion battery, a fuel cell, or a lead storage battery, and a control circuit that controls power supplied by these power storage devices. Thus, when the power supply from the external power supply is stopped, the electronic money terminal 8 is supplied with power that can be operated to some extent.
When the battery 33 is configured by a secondary battery, a capacitor, or the like, the battery 33 can be configured to be always fully charged by power from an external power source while the electronic money terminal 8 is operating.

The non-volatile memory 39 is a non-volatile storage medium configured by, for example, an EEPROM.
Note that the non-volatile memory 39 may be any memory that can maintain stored contents when the power is turned off, such as a semiconductor memory device including a battery.
In the non-volatile memory 39, it is possible to secure an area where the CPU 31 can set a power-off flag and write a time when the power is turned off. The non-volatile memory 39 stops power supply from an external power source. Even in this case, the power-off flag set by the CPU 31 and the time at the time of power-off are retained. The power-off flag functions as a stop record indicating that power supply has been stopped.

  In this embodiment, the power-off flag and the power-off time are configured to be stored in the nonvolatile memory 39. However, when the storage unit 41 is a nonvolatile storage device, these pieces of information are stored in the storage unit 41. It is also possible to configure so as to memorize.

The clock unit 40 is constituted by, for example, a crystal transmission device provided with a battery, and outputs the current time every moment regardless of the presence or absence of an external power supply.
The clock unit 40 is configured to make it difficult to change the time, for example, the time cannot be corrected unless a password is input.
The clock unit 40 is used when the CPU 31 reads the time when the power is turned off and the time when the power is started.

  The storage unit 41 includes, for example, a hard disk and other storage media, and a drive device that drives them, and includes a program storage unit 42 that stores various programs, a data storage unit 43 that stores data, and the like. .

In the program storage unit 42, an OS that is a basic program for causing the electronic money terminal 8 to function, an information processing program for causing the electronic money card 6 to perform the money amount change process, a power-off is detected, A power-off recording program that writes a power-off flag and power-off time to the nonvolatile memory 39, and a start-up program that starts after checking the power-off flag and power-off time and erasing security data when starting up are stored. ing.
The data storage unit 43 stores security data and other data.

  The security data corresponds to predetermined information to be deleted, and the storage unit 41 functions as a storage unit that stores predetermined information. Further, since the CPU 31 performs information processing with the electronic money card 6 using an encryption key or the like, it functions as information processing means for performing information processing using this predetermined information.

The input / output unit 35 includes input devices such as a keyboard and a barcode reader, and output devices such as a liquid crystal display device, a printer, and an audio output device.
The input device is used to accept input such as product code, payment amount, and charge amount from the person in charge of operation, etc., and the output device displays the current processing status on the display device or the processing is completed by the audio output device This is used to output a predetermined sound effect or print the processing contents with a printer.
The reader / writer unit 36 has a built-in antenna and performs wireless communication with the IC chip of the electronic money card 6.

Next, the power interruption process performed by the electronic money terminal 8 will be described with reference to the flowchart of FIG.
First, the electronic money terminal 8 uses the power interruption detection circuit 32 to continuously monitor the power supply from the external power supply after the regular operation starts.
When the power-off detection circuit 32 detects the power-off, the power-off detection circuit 32 notifies the CPU 31 that the power-off has occurred (step 5).

When receiving the power-off notification from the power-off detection circuit 32, the CPU 31 acquires the current time from the clock unit 40 as the power-off time (step 10).
Next, the CPU 31 sets the power-off flag of the nonvolatile memory 39 from off to on, and writes the power-off time in the nonvolatile memory 39 (step 15).
The non-volatile memory 39 holds a memory of a power-off flag and a power-off time.
Thereafter, the electronic money terminal 8 stops except for the clock unit 40.

Next, a startup process performed by the electronic money terminal 8 will be described with reference to FIG.
First, the CPU 31 accepts an activation request. This activation request is made, for example, by an operator in charge of starting the electronic money terminal 8 or automatically after an instantaneous interruption.
Then, the CPU 31 reads the power-off flag state and the power-off time from the nonvolatile memory 39 (step 35).
Next, the CPU 31 determines whether or not the power has been turned off based on the power-off flag read from the nonvolatile memory 39 (step 40).

If the power-off flag is off, the CPU 31 determines that there is no power-off (step 40; N), and initializes the nonvolatile memory 39 (step 55).
This initialization is performed by setting the power-off flag state to OFF and deleting the power-off time.

When the power-off flag is on, the CPU 31 determines that the power is off (step 40; Y), and further determines whether or not the power-off is an instantaneous interruption (step 45).
The CPU 31 determines whether or not there is an instantaneous interruption as follows.
First, when the CPU 31 determines that the power has been cut off, the CPU 31 reads the current time from the clock unit 40. Then, the time elapsed from the power-off time read from the nonvolatile memory 39 to the current time is calculated and compared with a predetermined time (threshold value).
When the elapsed time is within the predetermined time, the CPU 31 determines that there is an instantaneous interruption, and when it is longer than the predetermined time, the CPU 31 determines that there is no instantaneous interruption.

As a result of the determination, if it is a momentary interruption (step 45; Y), the CPU 31 initializes the nonvolatile memory 39 (step 55), and then deletes the electronic money terminal 8 without deleting the security data. Start (step 60).
If it is not an instantaneous interruption (step 45; N), the CPU 31 erases the security data stored in the storage unit 41 (step 50).
Then, after initializing the nonvolatile memory 39 (step 55), the CPU 31 activates the electronic money terminal 8 (step 60).
As described above, the electronic money terminal 8 includes invalidating means for invalidating the power-off flag recorded in the nonvolatile memory 39 after activation.

In the above example, the non-volatile memory 39 is initialized regardless of whether there is a power interruption or a momentary interruption. For example, the electronic money terminal 8 can execute a plurality of software such as a ticket issuing program. In this case, it is considered that the electronic money processing function may be activated or terminated while the electronic money terminal 8 is turned on.
That is, in this case, the activation of the electronic money terminal 8 corresponds to the activation of the electronic money processing program on the electronic money terminal 8, and the electronic money processing program is activated if the nonvolatile memory 39 has not been initialized. This is because security data may be erased depending on the power-off flag and power-off time of the nonvolatile memory 39 each time.
If the electronic money terminal 8 always operates the electronic money processing program, it is not always necessary to initialize the nonvolatile memory 39.

In the present embodiment described above, the following effects can be obtained.
(1) When the power supply from the external power source to the electronic money terminal 8 is stopped, the fact that the power supply has been stopped can be recorded in the nonvolatile memory 39.
(2) The CPU 31 can confirm whether or not the electronic money terminal 8 is disconnected from the external power source by confirming the power-off flag at the time of activation. When the CPU 31 is disconnected from the external power supply, the CPU 31 can erase the data (security data) to be erased.

(3) Since the security data is erased using the power of the external power supply, a large amount of data can be erased.
(4) The CPU 31 can determine whether or not the stop of the power supply is an instantaneous interruption by recording the time when the power supply from the external power supply is stopped in the nonvolatile memory 39.
(5) When the power supply from the external power supply is stopped instantaneously, the security data can be prevented from being deleted.

In the present embodiment, the power-off flag and the power-off time are stored in the nonvolatile memory 39, but the power-off time can also be used as the power-off flag.
In this case, the CPU 31 determines that the power has been turned off when the power-off time is written in the nonvolatile memory 39, and determines that the power has not been cut off when the power-off time is not written.
In this example, since the presence / absence of the power-off time functions as a power-off flag, the CPU 31 can determine the presence / absence of the power-off and the presence / absence of an instantaneous interruption without setting the power-off flag in the nonvolatile memory 39. .

In the present embodiment, the initialization of the nonvolatile memory 39 is performed by setting the power-off flag to OFF and erasing the power-off time. However, the present invention is not limited to this and is recorded in the nonvolatile memory 39. Any power-off flag and power-off time may be invalidated at startup.
This can be done, for example, by setting a power-off flag and a validity flag indicating invalidity and validity at the power-off time.

In the present embodiment, the CPU 31 further determines whether or not there is an instantaneous interruption after determining whether or not there is a power interruption. However, if it is not necessary to consider the instantaneous interruption, the determination of the instantaneous interruption is performed. It can also be configured not to perform the above.
In this case, the CPU 31 does not record the power-off time in the nonvolatile memory 39. At startup, the CPU 31 starts the electronic money terminal 8 after deleting the security data if the power-off flag is on in the nonvolatile memory 39, and if the power-off flag is off, The electronic money terminal 8 is activated without deleting the security data.

Furthermore, in the present embodiment, the time when the power is turned off and the time when the electronic money terminal 8 is activated are used as the determination of the momentary interruption, but the power supply restart time from the external power supply is stored in the nonvolatile memory 39. It is also possible to configure so as to determine an instantaneous interruption from the time difference between the restart time and the power interruption.
In this case, the power-off detection circuit 32 monitors the resumption of power supply from the external power supply after the power-off, and notifies the CPU 31 at the time of resumption. Upon receiving this notification, the CPU 31 acquires the current time from the clock unit 40 and stores it in the nonvolatile memory 39 as the restart time.
Then, the CPU 31 calculates the difference between the power-off time and the restart time stored in the non-volatile memory 39 at the time of startup, and determines that it is an instantaneous interruption when the time difference is within a predetermined time. If the electronic money terminal 8 determines that there is an instantaneous interruption, the security data is not deleted.
This method is effective when there is a time difference between starting up the electronic money terminal 8 and resuming power supply.

In the present embodiment, the security information is deleted when a power interruption that is not a momentary interruption is detected, but a function restriction unit that restricts the function of the electronic money terminal 8 may be provided.
In this case, the electronic money terminal 8 can perform function restriction so that, for example, the money amount change information cannot be transmitted to the electronic money card 6 after the security information is erased and activated.

(Modification)
In this modification, security data is erased with the power of the battery 33 immediately after detecting the stop of the power supply from the external power supply.
This method is effective when the power required for the battery 33 to erase the security data can be supplied.
In such a case, for example, the amount of security data may be small, or the amount of security data may be large, but the capacity of the battery 33 may be sufficiently large.

Hereinafter, the power-off process of the electronic money terminal 8 according to the present modification will be described with reference to the flowchart of FIG.
First, while the electronic money terminal 8 is operating, the power interruption detection circuit 32 monitors the power supply from the external power source.
When detecting the stop of the power supply from the external power source, that is, the power cut, the power cut detection circuit 32 notifies the CPU 31 that the power cut has occurred (step 70).

When the CPU 31 receives the power-off notification from the power-off detection circuit 32, the CPU 31 starts measuring the time elapsed since the notification was received according to the time measured by the clock unit 40 (step 75).
When the elapsed time is within the predetermined time (step 80; Y), the CPU 31 checks whether or not the power supply by the external power source has been resumed (step 85).
When the power supply is resumed (step 85; Y), the CPU 31 activates the electronic money terminal 8 without deleting the security data (step 95).
On the other hand, when the power supply has not been resumed (step 85; N), the CPU 31 returns to step 80.

  When the elapsed time is not within the predetermined time (step 80; N), the CPU 31 operates using the power supplied by the battery 33 to delete the security data (step 90), and activates the electronic money terminal 8 (step 90). Step 95).

As described above, in this modification, the instantaneous interruption is determined based on the elapsed time until the power supply from the external power source is started, and if it is an instantaneous interruption, the security data is started without being erased, If it is not off, the security data is immediately erased before starting.
In this modification, the presence / absence of a momentary interruption is determined. However, the security data may be deleted regardless of the momentary interruption.
In this case, when receiving a power-off notification from the power-off detection circuit 32, the CPU 31 immediately deletes the security data.

As described above, in the present embodiment and the modification, the case where the security data of the electronic money terminal 8 is protected has been described. However, this does not limit the protection target to the electronic money terminal 8, but a credit terminal, security The present invention can be applied to other information processing apparatuses having highly reliable data.
For example, it can be applied to computers in which confidential information such as research data and financial data is stored, or a removable hard disk device storing a large amount of business data is equipped with a CPU, battery, nonvolatile memory, etc. The business data can be erased when the device is restarted after power is turned off.

1 Electronic Money System 2 Electronic Money Server 6 Electronic Money Card 7 Mobile Phone 8 Electronic Money Terminal 31 CPU
32 Power-off detection circuit 33 Battery 34 Communication control unit 35 Input / output unit 36 Reader / writer unit 37 ROM
38 RAM
39 Nonvolatile memory 40 Clock unit 41 Storage unit

Claims (9)

Detection means for detecting a stop of power supply from an external power source;
Storage means for storing predetermined information;
Information processing means for performing information processing using the stored predetermined information;
An erasing unit for erasing the stored predetermined information when the detection unit detects a stop of power supply;
An information processing apparatus comprising:   The erasing unit includes an internal power source and a nonvolatile storage medium, and when the stop of the power supply is detected by the detection unit, a stop record indicating that the power supply is stopped is used for the power of the internal power source. 2. The method according to claim 1, wherein the predetermined information is erased when the stop recording of the non-volatile storage medium is confirmed at the time of start-up, and when there is a stop record. Information processing device.   The information processing apparatus according to claim 2, further comprising a function restriction unit that restricts an information processing function of the information processing unit when there is a stop record in the nonvolatile storage medium at startup.   4. The information processing apparatus according to claim 2, further comprising invalidating means for invalidating stop recording recorded in the nonvolatile storage medium after startup.   The erasing unit records the time when power supply from an external power supply is stopped in the nonvolatile storage medium, and erases the predetermined information when the startup time is within a predetermined time from the recorded time. The information processing apparatus according to claim 2, 3, or 4.   The erasing means records the time when the power supply from the external power supply is stopped and the time when the power supply from the external power supply is restarted, and the time difference between the stop time and the restart time related to the recording is within a predetermined time. The information processing apparatus according to claim 2, wherein the predetermined information is not deleted.   2. The erasing unit includes an internal power source, and erases the stored predetermined information using the power of the internal power source immediately after the detection unit detects the stop of power supply. The information processing apparatus described in 1. The information processing means stores the monetary value amount as electronic data, receives the amount change information and transmits the amount change information to the money terminal that performs the amount change process on the stored amount,
The information processing apparatus according to claim 1, wherein the predetermined information is an encryption key for encrypting the amount change information.   The information processing apparatus according to claim 8, wherein the erasure unit further erases log data in which processing contents with the money terminal are recorded.

Images