JP6464816B2 - Payment terminal - Google Patents

Description

  The present invention relates to a settlement terminal that settles a transaction amount with a card.

  2. Description of the Related Art Conventionally, electronic settlement transactions are performed in which a transaction amount is settled (settled) with a card (such as a credit card or a debit card). One of payment terminals that process electronic payment transactions is a CAT (Credit Authorization Terminal).

  Since the payment terminal handles card information and personal information such as personal identification number entered by the cardholder, the personal information entered is illegally read and leaked by tampering by a malicious third party. It has a function (tamper resistance function) for preventing the above. For example, the payment terminal has an opening detection function for detecting that the housing of the payment terminal main body has been opened. When the opening detection function detects that the housing of the payment terminal main body has been opened, the payment terminal stores it in the memory. It is the structure which deletes the personal information etc. which are stored (refer patent document 1 etc.).

International Publication No. 2008/117467

  However, the tampering technique has become more sophisticated, and it is desired to enhance tamper resistance.

  As one of the enhancements of tamper resistance, personal information is illegally read from this conductor line by unauthorized access to the conductor line connecting the arithmetic processing unit (CPU) and the external memory (RAM). May be taken out) and prevented from leaking to third parties.

  An object of the present invention is to prevent personal information from being illegally read out from this conductor line and leaking to a third party by unauthorized access to the conductor line connecting the arithmetic processing unit and the external memory. The purpose is to provide a payment terminal with improved security.

  The settlement terminal of the present invention has the following configuration in order to achieve the above object.

  The payment terminal processes, for example, an electronic payment transaction in which the transaction amount is settled (settled) with a card (such as a credit card or a debit card).

The arithmetic processing unit performs an encryption process for encrypting the input personal information using an encryption key stored in the built-in memory. The encryption key here is a key used for encrypting information (personal information). Further, the encryption key may be the same key as the decryption key used when decrypting the encrypted information (personal information), or may be a key different from this decryption key. In other words, the decryption key may be the same as the encryption key or different from the encryption key. To personal information, information of the card to be used for settlement of transactions (card information) and includes a personal identification number, etc. of the card. The arithmetic processing unit is, for example, a CPU, and has high resistance to tampering (tamper resistance). Therefore, it is possible to prevent the encryption key stored in the built-in memory and the input personal information from leaking due to unauthorized access to the arithmetic processing unit.

The arithmetic processing unit stores the personal information encrypted by the encryption process in the external memory connected by the conductor line. That is, encrypted personal information flows on a conductor line that electrically connects the arithmetic processing unit and the external memory. For this reason, even if unauthorized access is made to the conductor line that electrically connects the arithmetic processing unit and the external memory, it is the encrypted personal information that is illegally read from this conductor line. Further, as described above, since the encryption key is stored in the built-in memory of the arithmetic processing unit, it is not illegally read out from the conductor line that electrically connects the arithmetic processing unit and the external memory.
In addition, the arithmetic processing unit determines whether or not authentication for settlement of the transaction amount is performed at the center, and when it is determined that the center performs the authentication, includes the personal identification number in the encrypted personal information stored in the external memory, In the case where it is determined that the password is not to be used, the personal identification number is not included in the encrypted personal information stored in the external memory. In addition, when it is determined that the authentication for settlement of the transaction amount is performed at the center, the arithmetic processing unit executes an encryption process for encrypting the password, and determines that the authentication for settlement of the transaction amount is not performed at the center. In this case, the encryption process for encrypting the personal identification number may not be executed.

The output unit outputs the encrypted personal information stored in the external memory to the external device . The external device is a communication device for communicating with a higher-level device, a printer for printing transaction contents, a POS terminal for registering merchandise for transaction, and the like. The host device is a center that authenticates whether or not settlement is possible for an electronic settlement transaction, a transaction management device that manages a transaction history, and the like.

  Therefore, unauthorized access to the conductor line connecting the arithmetic processing unit and the external memory can prevent personal information from being illegally read out from the conductor line and leaked to a third party, thereby improving security. .

  Further, as a configuration for inputting the personal information, the payment terminal may be connected to the arithmetic processing unit and include a personal information input unit such as a card reader or a PIN pad for inputting the personal information.

  The built-in memory of the arithmetic processing unit has a battery-backed volatile storage area, and the encryption key may be stored in the volatile storage area. In this case, when the opening detection unit detects that the housing of the payment terminal main body has been opened, it is preferable to stop the battery backup for the built-in memory and erase the encryption key. Thereby, it is possible to prevent the encryption key from being read illegally, and to further improve the security.

  Further, the external memory may have an area for developing a business application program that performs processing that does not use personal information. Business application programs that perform processing that does not use personal information include a display program that controls screen display of a display provided in the settlement terminal body, a print program that performs print output to a printer connected to the settlement terminal, and the like. .

  Further, the encryption program and business application program related to the encryption processing in the arithmetic processing unit are stored in a read-only memory (ROM), and when the settlement terminal body is turned on, The business application program may be expanded in the internal memory of the arithmetic processing unit, and the business application program may be expanded in the external memory.

  According to the present invention, it is possible to prevent personal information from being illegally read out from this conductor line and leaked to a third party by unauthorized access to the conductor line connecting the arithmetic processing unit and the external memory. Improvement can be achieved.

It is a block diagram which shows the structure of the principal part of a payment terminal. It is the schematic which shows the external appearance of a payment terminal. It is the schematic which shows the hierarchical structure of the software of a payment terminal. It is a flowchart which shows operation | movement of a payment terminal. It is a flowchart which shows a load process. It is a flowchart which shows transaction processing. It is a flowchart which shows the input reception process of personal information.

  Hereinafter, a settlement terminal according to an embodiment of the present invention will be described.

  FIG. 1 is a block diagram showing a configuration of a main part of a payment terminal according to this example. FIG. 2 is a schematic diagram showing an overview of a payment terminal according to this example. The settlement terminal 1 includes a CPU 2, a ROM 3, a RAM 4, a personal information input unit 5, an input / output unit 6, and an opening detection unit 7. Each part of the settlement terminal 1 main body is electrically connected by a conductor line.

  The settlement terminal 1 processes an electronic settlement transaction in which the transaction amount is settled (settled) with a card (such as a credit card or a debit card).

  The CPU 2 controls the operation of the payment terminal 1 main body. Further, the CPU 2 includes a memory 10 that is backed up by a battery. The memory 10 is a volatile memory. The CPU 2 has a configuration corresponding to the arithmetic unit referred to in the present invention. The memory 10 has a configuration corresponding to the built-in memory referred to in the present invention. Although details will be described later, the CPU 2 performs an encryption process for encrypting personal information.

  The ROM 3 is a program that is activated on the settlement terminal 1 main body, such as an operating system (OS), an application programming interface (API), a business application program (hereinafter simply referred to as a business application), an encryption program, and the like. Remember. The ROM 3 has a configuration corresponding to the read-only memory referred to in the present invention.

  In the RAM 4, the OS, API, and business application stored in the ROM 3 are expanded when the payment terminal 1 body is activated. The RAM 4 has an area for storing encrypted personal information as necessary. The RAM 4 has a configuration corresponding to the external memory referred to in the present invention.

  The personal information input unit 5 includes a card reader 5a for reading card information recorded on the card, an operation key 5b having a numeric keypad and function keys, and a PIN pad (not shown) connected to the settlement terminal 1 main body. Etc. The PIN pad is a device for the cardholder to input a personal identification number. 2 shows only a magnetic card reader that reads card information from a magnetic card as the card reader 5a. However, the personal information input unit 5 may be an IC card reader that reads card information from a contact IC card, The configuration may also include a non-contact type IC card reader that reads card information from a contact type IC card.

The input / output unit 6 performs data input / output with a connected external device. External device includes a communication device for communicating with the host device, a printer for printing transaction contents, a POS terminal or the like for registering of the goods and the like to trade. Further, the host device is an authentication center (corresponding to a center referred to in the present invention) that authenticates whether or not settlement is possible for an electronic settlement transaction, a transaction management device that manages a transaction history, and the like. The input / output unit 6 has a configuration corresponding to the output unit referred to in the present invention.

  The opening detection unit 7 detects that the housing of the payment terminal 1 main body has been opened. The unsealing detection unit 7 is configured to detect that the housing of the settlement terminal 1 main body has been unsealed using, for example, a known tamper pin.

  The payment terminal 1 also includes the display 8 shown in FIG. 2 and a display unit (not shown) that controls display on the display 8.

  Next, the memory built in the CPU 2 will be described. The memory 10 has an encryption program expansion area 11 and a variable area 12. The encrypted program stored in the ROM 3 is expanded in the encrypted program expansion area 11 at startup. In the variable area 12, data generated during operation is stored as necessary. For example, the personal information (card information, personal identification number, etc.) input in the personal information input unit 5 is stored. The variable area 12 stores an encryption key 13 used for encryption processing of personal information. The decryption key used when decrypting information (personal information) encrypted with the encryption key 13 may be the encryption key 13 or a key different from the encryption key 13.

  FIG. 3 is a schematic diagram showing the hierarchical structure of software of the payment terminal. The business application described above includes a display program for controlling display on the display 8, a print program for generating and outputting print data to a printer connected to the input / output unit 6, an authentication program for authenticating settlement of transaction amounts, There is a communication program for controlling communication with the apparatus.

  The payment terminal 1 forms a hierarchy in the order of the OS layer, the API layer, and the AP layer. The encryption program is defined as one of API programs executed in the API layer. Business applications such as a display program, a printing program, and an authentication program are defined as applications executed in the AP layer. That is, the encryption program is executed at a different level from the business application.

  Hereinafter, the operation of the payment terminal 1 will be described. FIG. 4 is a flowchart showing the operation of the payment terminal.

  When the power of the main body is turned on, the settlement terminal 1 performs a load process for loading various programs stored in the ROM 3 (s1, s2).

  FIG. 5 is a flowchart showing the load process according to s2. The settlement terminal 1 executes the loading program in the CPU 2 (s11), and expands the encryption program stored in the ROM 3 in the encryption program expansion area 11 of the memory 10 of the CPU 2 (s12). Further, the settlement terminal 1 expands the OS, API, and various business applications stored in the ROM 3 in the RAM 4 (s13), and completes this loading process. The processes of s12 and s13 may be reverse to the above order or may be executed in parallel.

  As is apparent from the above description, the settlement terminal 1 expands the encryption program in the encryption program expansion area 11 of the memory 10 and does not expand it in the RAM 4. The settlement terminal 1 is ready for transaction processing upon completion of the load processing for s2.

  The payment terminal 1 waits for an input operation related to the start of the transaction to be performed or until the power source of the payment terminal 1 is turned off (s3, s4). The settlement terminal 1 performs a transaction process when an input operation related to the start of the transaction is performed (s5). Further, when the payment terminal 1 is turned off, the payment terminal 1 performs a power-off process (s6) and ends this process.

  FIG. 6 is a flowchart showing the transaction processing according to s5. The settlement terminal 1 receives input of transaction information (s21). The transaction information that receives the input in s21 is a product / service code for identifying the product or service to be traded, a transaction amount, and the like. The settlement terminal 1 stores the transaction information input in s21 in the variable area 12 of the memory 10 of the CPU2. Further, the payment terminal 1 accepts input of personal information used for payment of the transaction amount (s22). The personal information that receives the input in s22 is card information of a card that settles the transaction amount, a personal identification number of the card that settles the transaction amount, and the like.

  FIG. 7 is a flowchart showing the personal information input acceptance process in s22. The settlement terminal 1 receives an input of the type of card used for settlement of the transaction amount (s31). In s31, an input of a type related to the usage of a card such as a credit card, a debit card or a prepaid card or a type related to a physical configuration of a card such as a magnetic card, a contact IC card, or a non-contact IC card is accepted. . In s31, the card type used for settlement of the transaction amount is input by the operation of the operation key 5b by the operator.

  The payment terminal 1 accepts input of card information for the type of card input in s31 (s32). In s32, the card reader included in the personal information input unit 5 reads the card information and inputs the read card information to the CPU 2. The CPU 2 stores the input card information in the variable area 12 of the memory 10.

  The settlement terminal 1 encrypts the input card information in the CPU 2 (s33). In s33, the CPU 2 encrypts the input card information with the encryption program expanded in the encryption program expansion area 11 of the memory 10. The CPU 2 encrypts the card information using the encryption key 13 stored in the variable area 12 of the memory 10. Further, when the CPU 2 encrypts the card information, the CPU 2 stores the encrypted card information in the variable area 12 of the memory 10 and also stores the unencrypted card information stored in the variable area 12 (s32). Deleted card information). That is, the payment terminal 1 deletes the unencrypted card information from the variable area 12 of the memory 10 as soon as the card information becomes unnecessary (however, the encrypted card information is stored in the variable of the memory 10). Stored in area 12). This suppresses a decrease in security against leakage of unencrypted card information.

  The settlement terminal 1 accepts an input of a password (s34). In s34, the card holder inputs the password using the PIN pad provided in the personal information input unit 5. The entered password is entered into the CPU 2. The CPU 2 stores the input personal identification number in the variable area 12 of the memory 10.

  The settlement terminal 1 determines whether authentication for settlement of the transaction amount related to the current transaction is performed at the center or the settlement terminal 1 main body (s35). When the settlement terminal 1 determines that the authentication for settlement of the transaction amount is performed at the center, the CPU 2 encrypts the input password by the encryption program expanded in the encryption program expansion area 11 of the memory 10. (S36). The CPU 2 encrypts the password using the encryption key 13 stored in the variable area 12. When the CPU 2 encrypts the password, it stores the encrypted password in the variable area 12 of the memory 10 and the unencrypted password stored in the variable area 12 (the password input in s34). Number). That is, the settlement terminal 1 deletes the unencrypted personal identification number from the variable area of the memory 10 as soon as the personal identification number becomes unnecessary (however, the encrypted personal identification number is stored in the variable area of the memory 10). To remember.) As a result, a decrease in security against leakage of the unencrypted password is suppressed.

  On the other hand, if the settlement terminal 1 determines that authentication for settlement of the transaction amount is not performed at the center (that is, performed by the payment terminal 1 itself), it performs an authentication process regarding whether or not settlement of the transaction amount is possible (s37). The settlement terminal 1 determines that the authentication for settlement of the transaction amount is not performed at the center in s36 when the card used for settlement of the transaction is a prepaid card or the like. In s37, if the value balance of the prepaid card used for transaction settlement is less than the transaction amount, it is determined that the transaction amount cannot be settled. On the other hand, if the value balance of the prepaid card used for transaction settlement is equal to or greater than the transaction amount, it is determined that the transaction amount can be settled.

  Note that the settlement terminal 1 does not perform authentication for settlement of the transaction amount at s35 even when the transaction amount is less than a predetermined amount (for example, 1000 yen) (when it is a small transaction) (settlement terminal). It is also possible to make a determination as follows.

  Returning to FIG. 6, when the processing related to s22 (the processing shown in FIG. 7) is completed, the payment terminal 1 stores the necessary information in the RAM 4 in the information stored in the variable area 12 of the memory 10 of the CPU 2. (S23). In s23, when the authentication process is not performed in s37 described above, the transaction information input in s21 stored in the variable area of the memory 10 of the CPU 2, the card information encrypted in s33, and the password encrypted in s36 The number is transferred to the RAM 4. On the other hand, when the authentication process is performed in s37 described above, the transaction information input in s21 stored in the variable area of the memory 10 of the CPU 2 and the card information encrypted in s33 are transferred to the RAM 4.

  That is, in the payment terminal 1, personal information such as card information and a personal identification number flowing through a conductor line connecting the CPU 2 and the RAM 4 is encrypted. For this reason, even if personal information is illegally read from this conductor line (even if personal information is extracted) due to unauthorized access to the conductor line connecting the CPU 2 and the RAM 4, the read personal information is It is encrypted.

  Further, the encryption key 13 does not flow through a conductor line that connects the CPU 2 and the RAM 4. As described above, the encryption key 13 is only stored in the variable area 12 of the memory 10 of the CPU 2 and is not output from the CPU 2 to the outside. Therefore, even if the encrypted personal information is extracted due to unauthorized access to the conductor line connecting the CPU 2 and the RAM 4, the encryption key 13 does not leak, so that the extracted personal information is decrypted. Can be prevented.

  The settlement terminal 1 determines whether authentication relating to settlement of the transaction amount has been performed (s24). In s24, it is determined whether or not authentication related to settlement of the transaction amount has been performed in s37 described above, that is, whether or not authentication related to settlement of the transaction amount is performed in the center.

  If the payment terminal 1 determines that it has been authenticated in s24, it proceeds to s27 described later without performing the processes related to s25 and s26 described below.

  If the settlement terminal 1 determines that it has not been authenticated in s24, it transmits an authentication request to the center (s25), and waits to receive an authentication result from the center (s26). In s25, the payment terminal 1 transmits the encrypted personal information (encrypted card information and personal identification number) and transaction information including the transaction amount to the center. For each payment terminal 1, the center stores the encryption key 13 stored in the payment terminal 1 as a decryption key. Therefore, the center can decrypt the personal information included in the authentication request received from the settlement terminal 1.

  The center may be configured to recognize the settlement terminal 1 that has transmitted the authentication request by the line number, or by the terminal code (terminal code that identifies the settlement terminal 1) included in the authentication request. It may be a configuration. Further, each payment terminal 1 may store the public key of the center as the encryption key 13 and store the decryption key (secret key) corresponding to the center. In this case, the center does not have to recognize the settlement terminal 1 that has transmitted the authentication request.

The settlement terminal 1 determines whether or not the settlement of the transaction amount that by the card (s27). If settlement is possible, the settlement terminal 1 performs a settlement process in which the transaction amount is settled with a card, and processes the transaction (s28). On the other hand, if payment is not possible, the payment terminal 1 performs transaction cancellation processing for canceling the transaction (s29), and ends this processing.

  As described above, the settlement terminal 1 according to this example does not flow unencrypted personal information on the conductor line that electrically connects the CPU 2 and the RAM 4, and therefore, the payment terminal 1 is connected to the conductor line that connects the CPU 2 and the RAM 4. Security against unauthorized access can be improved.

  Further, in the payment terminal 1, business applications such as display programs and printing programs developed on the RAM 4 are illegally rewritten, and personal information stored in the RAM 4 is dumped by the illegally rewritten business application. However, the personal information dumped is also encrypted. Accordingly, security against unauthorized rewriting of business applications can be improved. In addition, this makes it possible for the user using the payment terminal 1 body to freely change the business application without reducing the security against leakage of personal information. That is, a user who uses the settlement terminal 1 main body can use a user-friendly business application and can improve operability. Furthermore, since the payment terminal 1 is configured to develop and execute an authentication program that uses personal information and a business application that does not use personal information on the same RAM 4, an increase in the cost of the payment terminal 1 main body can be suppressed.

  When the opening detection unit 7 detects that the housing of the payment terminal 1 is opened, the payment terminal 1 deletes the personal information and the encryption key 13 stored in the variable area 12. Specifically, the personal information and the encryption key 13 stored in the variable area 12 are lost by stopping the battery backup for the memory 10. Accordingly, the settlement terminal 1 does not leak the encryption key 13 stored in the variable area 12 of the memory 10 of the CPU 2 by opening.

1 ... Payment terminal 2 ... CPU
3 ... ROM
4 ... RAM
5 ... Personal information input unit 5a ... Card reader 5b ... Operation key 6 ... Input / output unit 7 ... Opening detection unit 8 ... Display 10 ... Memory 11 ... Encrypted program expansion area 12 ... Variable area 13 ... Encryption key

Claims (7)

In a payment terminal that settles the transaction amount with a card ,
An arithmetic processing unit for performing an encryption process for encrypting input personal information;
An external memory connected to the arithmetic processing unit by a conductor line and storing the personal information encrypted by the arithmetic processing unit by the encryption processing;
An output unit that outputs the encrypted personal information stored in the external memory to an external device , and
The personal information includes a password of a card used for settlement of the transaction amount,
The arithmetic processing unit has a built-in memory to the arithmetic processing section, using the encryption key stored in the internal memory, have rows the encryption process for the input personal information,
Further, the arithmetic processing unit determines whether or not authentication for settlement of the transaction amount is performed at the center, and when it is determined that the authentication is performed at the center, the password is stored in the encrypted personal information stored in the external memory. A payment terminal that includes a number and does not include the personal identification number in the encrypted personal information stored in the external memory if it is determined not to be performed at the center .   The payment terminal according to claim 1, further comprising a personal information input unit connected to the arithmetic processing unit for inputting personal information.   The settlement terminal according to claim 1, wherein the built-in memory of the arithmetic processing unit has a volatile storage area backed up by a battery, and stores the encryption key in the volatile storage area. . An opening detection unit that detects that the housing of the payment terminal body has been opened;
The settlement terminal according to claim 3, wherein the arithmetic processing unit stops battery backup for the built-in memory when the unsealing detection unit detects that the housing of the settlement terminal main body is unsealed.   The payment terminal according to any one of claims 1 to 4, wherein the external memory has an area for developing a business application program for performing processing that does not use personal information encrypted by the calculation processing unit by the arithmetic processing unit. An encryption program for the encryption processing in the arithmetic processing unit, and a read-only memory for storing the business application program,
The encryption program is expanded in the built-in memory of the arithmetic processing unit,
The settlement terminal according to claim 5, wherein the business application program is expanded in the external memory. When it is determined that the authentication for settlement of the transaction amount is performed at the center, the arithmetic processing unit executes the encryption processing for encrypting the personal identification number, and performs authentication for settlement of the transaction amount by the center. The payment terminal according to any one of claims 1 to 6, wherein if it is determined not to be performed, the encryption processing for encrypting the personal identification number is not executed.

Images