WO2015136897A1

WO2015136897A1 - Information processing device and information processing method

Info

Publication number: WO2015136897A1
Application number: PCT/JP2015/001181
Authority: WO
Inventors: 松本　学
Original assignee: パナソニックＩｐマネジメント株式会社
Priority date: 2014-03-10
Filing date: 2015-03-05
Publication date: 2015-09-17
Also published as: JP5776023B1; JP2015171104A

Abstract

This information processing device is provided with: an authentication information input unit which accepts an input of authentication information; an execution environment provision unit which provides a secure execution environment that has a tamper-resistant property and a non-secure execution environment that does not have the tamper-resistant property and includes a settlement processing unit, separately; and a first encryption unit which is provided in the secure execution environment provided by the execution environment provision unit and encrypts the authentication information inputted to the authentication information input unit using an encryption key that can be decrypted in a settlement destination device of the settlement processing unit, the execution environment provision unit causing the settlement processing unit to execute settlement processing for the settlement destination device using first encrypted authentication information generated by the first encryption unit.

Description

Information processing apparatus and information processing method

The present invention relates to an information processing apparatus and an information processing method used for performing a settlement process in a transaction.

For example, in the (credit) transaction of goods or services using a credit card, by confirming (identity verification) whether the person performing the transaction and the owner of the credit card used for the transaction are the same person , Transaction safety (security) is ensured. This identity verification is performed by a customer signing a transaction slip on which transaction details are printed at the time of transaction settlement processing, and a store clerk visually comparing the signature and the signature written on the credit card.

In recent years, a terminal device capable of inputting and displaying such a signature has been realized using a smartphone or a tablet terminal. A large number of smartphones and tablet terminals are distributed as consumer devices, and it is possible to construct a payment terminal device by procuring at low cost. That is, such a payment terminal device can be procured at low cost if it can be configured using information terminals that are widely distributed as consumer devices, such as smartphones and tablet terminals. In addition, since the development platform for applications (software) used for payment processing and other business can be generalized, it is easy to reuse and divert development assets.

However, an information terminal designed to be used as a consumer device does not have the “tamper resistance” necessary to protect customer information and perform transactions safely. “Tamper resistance” refers to resistance to an attack that attempts to steal information from an information terminal. In order to ensure tamper resistance as a countermeasure against an attempt to steal information from an information terminal, a portion related to authentication information of a card used for payment processing (referred to as “secure portion” in Patent Document 1). A mobile device in which a portion having tamper resistance necessary as a terminal device is separated from a general-purpose portion has been proposed (see, for example, Patent Document 1).

Further, even in a general-purpose information terminal, for example, it is necessary to ensure information security when inputting a PIN (Personal Identification Number) such as a personal identification number. In order to ensure this type of tamper resistance, A banking system including a PINPAD that encrypts a PIN input by a user in a settlement process is known (see, for example, Patent Document 2).

US Patent Application Publication No. 2010/0145854 US Pat. No. 8,376,219

However, the conventional information processing apparatuses including Patent Document 1 and Patent Document 2 described above have a problem that the configuration of an input device such as a PINPAD or a touch panel is complicated in order to ensure tamper resistance.

In order to solve the conventional problems described above, the present invention provides an information processing apparatus and an information processing method that minimize tampering of the structure and ensure tamper resistance for ensuring information security. With the goal.

The present invention separately provides an authentication information input unit that receives input of authentication information, a secure execution environment having tamper resistance, and a non-secure execution environment including a settlement processing unit that does not have tamper resistance. An encryption unit that is provided in the secure execution environment provided by the environment providing unit and the execution environment providing unit, and that can decrypt the authentication information input to the authentication information input unit in a settlement destination device of the settlement processing unit A first encryption unit that encrypts using a key, wherein the execution environment providing unit uses the first encrypted authentication information generated by the first encryption unit. Is an information processing apparatus that causes the payment processing unit to execute a payment process for.

The present invention is an information processing method in an information processing apparatus including a payment processing unit, and includes a secure execution environment having tamper resistance and a non-secure execution environment including the payment processing unit having no tamper resistance. A step of providing the authentication information; a step of accepting input of authentication information; and encrypting the input authentication information using an encryption key that can be decrypted by a settlement destination device of the settlement processing unit in the secure execution environment And a step of causing the payment processing unit to execute a payment process for the payment destination device using the encrypted authentication information generated by the encryption.

According to the present invention, it is possible to minimize tampering of the structure and to secure tamper resistance for ensuring information security.

FIG. 1A is a front view showing an appearance of the settlement terminal device 1 in the present embodiment. FIG. 1B is a side view showing an appearance of the settlement terminal device shown in FIG. 1A. FIG. 2 is a block diagram specifically illustrating an example of a hardware configuration of the settlement terminal device of the present embodiment. FIG. 3 is a block diagram specifically illustrating an example of a system configuration mainly including software functions of the settlement terminal device of the present embodiment. FIG. 4 is a sequence diagram for explaining the communication operation between the virtual PIN pad and the PIN input unit via the virtual hypervisor. FIG. 5 is a flowchart for explaining in detail the first operation procedure during the payment process of the payment terminal device of the present embodiment. FIG. 6 is a flowchart for explaining in detail the second operation procedure during the settlement process of the settlement terminal device of the present embodiment. FIG. 7 is a flowchart for explaining in detail the operation procedure of PIN input at the virtual PIN pad in step S4 shown in FIG. FIG. 8A is a diagram showing a touch panel screen on which payment amount information and a message prompting a card reading operation are displayed in the payment terminal device. FIG. 8B is a diagram showing a touch panel screen on which a message prompting for input of a PIN is displayed. FIG. 9A is a diagram showing a box screen showing a state in which a single digit of PIN has been input by the user's input operation of PIN information to the keypad unit. FIG. 9B is a diagram showing a box screen showing a state in which all four digits of the PIN have been input. FIG. 10 is a front view showing an appearance of a payment terminal device in a modification of the present embodiment. FIG. 11 is a block diagram specifically illustrating an example of a system configuration mainly including software functions of a payment terminal device according to a modification of the present embodiment.

Hereinafter, an embodiment of an information processing apparatus and an information processing method according to the present invention (hereinafter referred to as “the present embodiment”) will be described with reference to the drawings. In the following embodiment, as an example of the information processing apparatus according to the present invention, a payment terminal apparatus used in the payment process in a transaction of goods or services will be described as an example. The present invention is not limited to the information processing apparatus and the information processing method, and the computer-readable recording medium for causing the information processing apparatus to execute the operation of the information processing method, or the information processing method for the information processing apparatus It may be expressed as a program for executing the above operation.

FIG. 1A is a front view showing an appearance of the settlement terminal device 1 of the present embodiment. FIG. 1B is a side view showing an appearance of settlement terminal device 1 shown in FIG. 1A. The settlement terminal device 1 of the present embodiment is portable and has a configuration including an information processing unit 2 that performs various types of information processing including settlement processing in merchandise or service transactions, for example.

In the following description, “secure” refers to a tamper resistance required against a man-in-the-middle attack on information from a third party (malicious third party, virus such as malware or unauthorized application) as a payment terminal device. “Non-secure” means that such tamper resistance is not provided.

The payment terminal device 1 shown in FIG. 1A includes, for example, a slit 5 serving as a magnetic card slide path on the upper side surface 6 of the information processing unit 2 in order to read card information recorded on a magnetic card. The settlement terminal device 1 includes an insertion port 7 into which the contact IC card is inserted in order to read card information recorded on the contact IC card, for example, on the lower surface 8 of the information processing unit 2. The settlement terminal device 1 includes a loop antenna 38 for reading card information recorded on, for example, a non-contact type IC card inside the settlement terminal device 1.

Further, the settlement terminal device 1 includes a touch panel 10 that functions as an example of an input unit and a display unit on the front surface 9 of the information processing unit 2 (see FIG. 1A).

(Hardware configuration of payment terminal device)
FIG. 2 is a block diagram specifically illustrating an example of the hardware configuration of the payment terminal device 1 of the present embodiment. The payment terminal apparatus 1 shown in FIG. 2 includes a CPU 21, a local wireless communication unit 22 to which a local wireless communication antenna 23 is connected, a wide area wireless communication unit 24 to which a wide area wireless communication antenna 25 is connected, a display unit 29, Non-contact type IC card reader / writer to which a touch input detection unit 30, a flash ROM 32, a RAM 33, a keypad unit 34, a magnetic card reader unit 35, a power supply unit 36, a battery 37, and a loop antenna 38 are connected. And a contact type IC card reader unit 44.

Further, as shown in FIG. 3, the settlement terminal device 1 provides a virtual secure execution environment and a virtual non-secure execution environment in the virtual hypervisor SW 5 that can be realized using the CPU 21, for example. . The virtualization hypervisor SW5 provides a secure execution environment and a non-secure execution environment, for example, using a virtual machine (VM).

The information processing unit 2 of the payment terminal device 1 includes a CPU (Central Processing Unit) 21 that generally manages the processing of each unit of the payment terminal device 1 shown in FIG. In FIG. 2, each unit of the payment terminal device 1 is connected to the CPU 21.

The local wireless communication unit 22 is connected to the local wireless communication antenna 23, and performs wireless communication by, for example, a wireless local area network (LAN) via a local wireless communication path (not shown). Local wireless communication is not limited to, for example, a wireless LAN, but may be Bluetooth (registered trademark) or the like.

The wide area wireless communication unit 24 is connected to the wide area wireless communication antenna 25 and performs wide area wireless communication via a wide area wireless communication path (WAN: Wide Area Network) not shown. Wide-area wireless communication uses, for example, communication using a mobile phone line such as W-CDMA (Wideband Code Division Multiple Access), UMTS (Universal Mobile Telecommunications System), CDMA (Code Division Multiple Access) 2000, LTE (Long Term Evolution). Can do.

The display unit 29 is configured using, for example, an LCD (Liquid Crystal Display) or an organic EL (Electroluminescence), and displays information or data instructed by the CPU 21 on the touch panel 10 shown in FIG. 1A. The touch input detection unit 30 detects a touch input of a user (for example, a clerk of a credit card registration member store or a customer who has purchased a product) on the touch panel 10.

Flash ROM (Read Only Memory) 32 stores various data. The stored data may be, for example, business-related data or a program for controlling the operation of the payment terminal device 1 (mainly the information processing unit 2). Further, the program includes various programs related to the operation of the payment terminal device 1 such as an application (software) for payment processing. For this reason, the flash ROM 32 has a function as a recording medium for recording a program.

A RAM (Random Access Memory) 33 is used for temporarily storing processing data generated in the middle of calculation processing associated with the operation of the payment terminal device 1 (mainly the information processing unit 2). Working memory.

The keypad unit 34 corresponds to the keypad unit 34 of the PIN (Personal Identification Number) input unit HW1 as an example of the authentication information input unit provided in the hardware HW0 illustrated in FIG. 3, and accepts key input from the user. .

The magnetic card reader unit 35 is arranged inside the slit 5 shown in FIG. 1B and reads a magnetic stripe as card information printed on the magnetic card. The card information read by the magnetic card reader unit 35 is input to the CPU 21.

The non-contact type IC card reader / writer unit 43 is connected to the loop antenna 38 and reads card information recorded on the non-contact type IC card. The card information read by the non-contact type IC card reader / writer unit 43 is input to the CPU 21.

The contact-type IC card reader unit 44 is arranged inside the insertion slot 7 shown in FIG. 1B, and stores card information recorded on the contact-type IC card via the electrodes of the contact-type IC card inserted into the insertion slot 7. read. The card information read by the contact type IC card reader unit 44 is input to the CPU 21.

The power source unit 36 is mainly a power source of the information processing unit 2 and receives power supplied from the battery 37 to supply power to each unit of the information processing unit 2 including the CPU 21. The CPU 21 can control the power supply unit 36 to supply or stop power supply to some or all of the circuits constituting the information processing unit 2. As a power supply destination of the power supply unit 36, in addition to the CPU 21, the local wireless communication unit 22, the wide area wireless communication unit 24, the display unit 29, the touch input detection unit 30, the non-contact type IC card reader / writer unit 43, and the contact type IC card Each unit includes a reader unit 44, a keypad unit 34, a magnetic card reader unit 35, and the like.

The settlement terminal device 1 including the above configuration has the following characteristics.

In the present embodiment, the information processing unit 2 includes a touch panel 10 (see FIGS. 1A and 2) configured by the display unit 29 and the touch input detection unit 30, and an external connection destination device (for example, a settlement center 50). A local wireless communication unit 22 or a wide area wireless communication unit 24 capable of communication.

In recent years, contact-type IC cards, non-contact-type IC cards, and electronic money have been added to magnetic cards that have been used for payment of transactions using cards, and the payment schemes for transactions using cards have been diversified. . With the addition of a new payment scheme, the development cost and price of the payment terminal device 1 are increasing. Here, if the information processing unit 2 is a consumer device such as a smartphone or a tablet terminal, the price of the payment terminal device 1 itself can be reduced. Rise in development costs is minimized.

In this case, the information processing unit 2 employs a general-purpose OS (for example, refer to the virtualized hypervisor SW5 shown in FIG. 3) as a software platform. Accordingly, since the development platform for the payment application (payment application) and other applications used for business (hereinafter referred to as “business application”) is generalized, it is easy to reuse and divert development assets. In addition, if a consumer device can be used for the configuration of the information processing unit 2, the information processing unit 2 has a calculation processing capability high enough to record and play a video without stress. Can be operated flexibly without stress.

(System configuration mainly for software functions of payment terminal devices)
FIG. 3 is a block diagram specifically illustrating an example of a system configuration mainly including software functions of the settlement terminal device 1 of the present embodiment. In FIG. 3, each operation | movement performed in CPU21 of the information processing part 2 of the payment terminal device 1 is shown as a functional block of software. Specifically, the virtualization hypervisor SW5, the secure screen UI application SW11, the LED display application SW12, the IC card input / output driver SW13, the encryption processing unit SW14, the keypad input / output / execution control unit SW15, A decryption unit SW16 and a keypad driver SW17. The functions of the display driver SW18, IC card reader driver SW19, LED driver SW20, guest OS1SW21, terminal UI application SW31, payment application SW32, center connection application SW33, display driver SW34, and guest OS2SW35 It is executed (implemented) in the CPU 21. In FIG. 3, reference numerals ST1 to ST7 indicate processing procedures relating to PIN information as an example of authentication information in a secure execution environment.

The virtualization hypervisor SW5 provides a secure virtual machine (Secure VM) SW1 that provides a secure execution environment to the hardware HW0 of the payment terminal device 1, and a non-secure virtual machine (Non-) that provides a non-secure execution environment. Secure VM) SW3 is provided separately.

The secure virtual machine SW1 includes a secure screen UI application SW11, an LED display application SW12, an IC card input / output driver SW13, an encryption processing unit SW14, a keypad input / output / execution control unit SW15, and an encryption release unit SW16. A keypad driver SW17, a display driver SW18, an IC card reader driver SW19, an LED driver SW20, and a guest OS1_SW21.

The guest OS (Operating System) 1SW21 is basic software for controlling the secure virtual machine SW1 for realizing a secure execution environment, and is, for example, Windows (registered trademark) or Linux (registered trademark).

The keypad driver SW17 controls the operation of the keypad unit 34, inputs an encrypted PIN from the PIN input unit HW1 through a secure communication path 53 described later, and inputs / outputs the keypad through the decryption unit SW16. / Output to execution control unit SW15.

The decryption unit SW16 shares a common key with the encryption unit HW2 of the PIN input unit HW1, and decrypts the encrypted PIN output from the keypad driver SW17. The decryption unit SW16 outputs the PIN information obtained by the decryption to the keypad input / output / execution control unit SW15. Incidentally, for the exchange of the encrypted PIN between the PIN input unit HW1 and the encryption unit HW2, encryption / decomposition by a public key cryptosystem may be performed instead of the common key.

The keypad input / output / execution control unit SW15 as an example of the control unit controls management of input / output of PIN information that is authentication information (for example, a personal identification number) and execution of operations related to input / output of the PIN information. The keypad input / output / execution control unit SW15 collates the PIN information with the PIN information registered in the IC card, and outputs the PIN information to the encryption processing unit SW14 when it is determined that the two match as a result of the collation. Then, the PIN information is encrypted by the encryption processing unit SW14. The keypad input / output / execution control unit SW15 instructs the secure screen UI application SW11 to display a message prompting the user to input PIN information.

The encryption processing unit SW14 as an example of the first encryption unit has an encryption key that can be decrypted in the settlement center 50, and is output from the keypad input / output / execution control unit SW15 using this encryption key. The encrypted PIN information is encrypted and output to the keypad input / output / execution control unit SW15. The encryption processing may be performed by encryption using a common key method using the same key as the settlement center 50, or the encryption processing unit SW14 and the settlement center 50 have their own private keys and the other party's public key Encryption by a public key cryptosystem possessing

The secure screen UI application SW11 displays a display screen on which secure information is input on the touch panel 10 in response to an instruction from the keypad input / output / execution control unit SW15. Specifically, the secure screen UI application SW11 displays a message for prompting the user to input PIN information, displays an asterisk (*) in units of digits to hide the input PIN information, or A message indicating that the payment process has been canceled is displayed.

The display driver SW18 controls the operation of the display unit 29 constituting the touch panel 10, and acquires character or image data output from, for example, the keypad input / output / execution control unit SW15 or the secure screen UI application SW11 to display the display unit SW18. 29.

The LED display application SW12 generates display data of an LED (Light Emitting Diode) (not shown) and outputs it to the LED driver SW20.

The LED driver SW20 controls the operation of turning on or off the LED according to the display data output from the LED display application SW12.

The IC card reader driver SW19 controls the operation of the contact type IC card reader unit 44 and the non-contact type IC card reader / writer unit 43, and passes the read card information to the IC card input / output driver SW13. This IC card reader driver SW19 may be mounted with an independent individual card reader driver for each of the magnetic card reader unit 35, the non-contact type IC card reader / writer unit 43, and the contact type IC card reader unit 44. .

The IC card input / output driver SW13 outputs the card information output from the IC card reader driver SW19 to the keypad input / output / execution control unit SW15.

The virtual PIN pad (VM_PINPAD) SW4 shown in FIG. 3 converts the PIN information input from the keypad unit 34 of the PIN input unit HW1 into encrypted PIN information encrypted so that it can be decrypted in the settlement center 50. The virtual PIN pad SW4 is provided in the secure virtual machine SW1, and includes a keypad driver SW17, an encryption release unit SW16, a keypad input / output / execution control unit SW15, an encryption processing unit SW14, and a secure screen UI application SW11. And a part of the display driver SW18.

The non-secure virtual machine SW3 includes a terminal UI application SW31, a payment application SW32, a center connection application SW33, a display driver SW34, and a guest OS2_SW35.

The guest OS 2SW 35 is basic software for controlling the non-secure virtual machine SW3 for realizing a non-secure execution environment, and is, for example, Windows (registered trademark) or Linux (registered trademark).

The terminal UI application SW31 displays a display screen on which non-secure information is input on the touch panel 10 in response to an instruction from the payment application SW32. For example, the terminal UI application SW31 displays various information in the payment process and accepts various input operations while the payment application SW32 is activated.

The settlement application SW32 is a general-purpose application that communicates with a settlement center 50 as an example of an external settlement destination apparatus connected by the center connection application SW33. Further, the payment application SW32 acquires encrypted PIN information generated by the virtual PIN pad SW4 of the secure virtual machine SW1 from the virtualized hypervisor SW5, and performs a payment process including the encrypted PIN information with the payment center 50. Between.

The display driver SW34 controls the operation of the display unit 29 constituting the touch panel 10, and is output from, for example, the payment screen output from the keypad input / output / execution control unit SW15 or the payment application SW32 or the terminal UI application SW31. Character or image data is acquired and displayed on the display unit 29.

The center connection application SW33 transmits the application for the payment process using the data output from the payment application SW32 to the local wireless communication unit 22 or the transmission center 50 or the like, which is a connection destination device determined by the payment application SW32. Instructs the wide area wireless communication unit 24.

The virtualization hypervisor SW5 as an example of an execution environment providing unit is a program for emulating the hardware HW0 shown in FIG. 3, and includes a plurality of execution environments in which a plurality of OSs operate independently and in parallel. Provide separately. The encryption unit HW2 of the PIN input unit HW1 and the keypad driver SW17 in the secure VM PIN pad generate a dedicated secure communication path 53 therebetween. The PIN information input to the keypad unit of the PIN input unit HW1 is encrypted by the encryption unit HW2. The encrypted PIN information generated by the encryption unit HW2 is output to the keypad driver SW17 via the communication path 53. The virtualization hypervisor SW5 acquires the encrypted PIN information generated by the encryption processing unit SW14 from the keypad input / output / execution control unit SW15 and passes it to the settlement application SW32 of the non-secure virtual machine SW3.

The PIN input unit HW1 includes a keypad unit 34 and an encryption unit HW2 as an example of a second encryption unit that encrypts PIN information input by the keypad unit 34. The encryption key used in the encryption of the encryption unit HW2 is a common key shared with the decryption unit SW16, for example. However, the encryption key is not limited to the common key.

Next, a communication operation between the virtual PIN pad SW4 and the PIN input unit HW1 via the virtual hypervisor SW5 will be described with reference to FIG. FIG. 4 is a sequence diagram illustrating a communication operation between the virtual PIN pad SW4 and the PIN input unit HW1 via the virtualized hypervisor SW5.

In FIG. 4, first, when, for example, a common key cryptosystem is used between the encryption unit HW2 of the PIN input unit HW1 and the decryption unit SW16 of the virtual PIN pad SW4, the virtual PIN pad SW4 and the PIN input are used. A common key exchange (KEY EXCHANGE) is performed with the unit SW7 (T1).

After the exchange of the common key is completed, a secure communication path 53 for encrypted communication is formed between the virtual PIN pad SW4 and the PIN input unit SW7 (T2). After the step T2, when PIN information is input by the user, the encrypted PIN information generated by the PIN input unit HW1 is transmitted and received between the virtual PIN pad SW4 and the PIN input unit SW7 (T3).

Further, an operation instruction for confirming or canceling the encrypted PIN information is transmitted / received between the virtual PIN pad SW4 and the PIN input unit SW7 (T4).

(Operation procedure at the time of payment processing of the payment terminal device 1)
Next, the operation | movement at the time of the payment process of the payment terminal device 1 of this embodiment is demonstrated with reference to FIG. FIG. 5 is a flowchart for explaining in detail the first operation procedure during the payment process of the payment terminal device 1 of the present embodiment. FIG. 6 is a flowchart for explaining in detail the second operation procedure during the payment process of the payment terminal device 1 of the present embodiment. The settlement terminal device 1 causes the settlement application SW 32 (see FIG. 3) installed in the information processing unit 2 (see FIGS. 1A and 2) to execute, and starts the settlement processing procedure.

In FIG. 5, when the terminal UI application SW31 receives the payment amount information and the payment method (S1), the terminal UI application SW31 displays a message for prompting the card reading operation on the screen of the touch panel 10 (see FIG. 8A) (S2). .

In a secure execution environment provided by the secure virtual machine SW1 (secure VM), the IC card input / output driver SW13 slides into the slit 5 of the user's IC card, inserts into the insertion slot 7, or the front of the payment terminal device 1. The system waits until the IC card can be read by any of the operations close to 9 (S3). When the IC card is read (S3, YES), the virtual PIN pad SW4 accepts input of encrypted PIN information (S4). Details of the procedure for inputting the encrypted PIN information in step S4 will be described later with reference to FIG.

After step S4, whether the virtual PIN pad SW4 in the secure execution environment provided by the secure virtual machine SW1 (secure VM) has received the input of the encrypted PIN information output from the PIN input unit HW1 It is determined whether or not (S5), and if not completed (S5, NO), the operation of the virtual PIN pad SW4 returns to step S4, and the virtual PIN pad SW4 accepts the input of the encrypted PIN information again.

When the input of the encrypted PIN information output from the PIN input unit HW1 is completed (S5, Yes), the keypad input / output / execution control unit SW15 performs step S4 (particularly, step S15 shown in FIG. 7). Whether the PIN information decrypted in step S3 matches the PIN information registered in the IC card read in step S3 is checked (S6). In the first operation procedure at the time of settlement processing requiring PIN verification shown in FIG. 5, the PIN information input in step S4 is encrypted with a key that can be decrypted by the IC card (not shown) read in step S3. May be used. The PIN information input by the touch panel 10 in step S4 may be output to the encryption processing unit SW14 and may be encrypted by the encryption processing unit SW14. Alternatively, the encryption of the PIN information may be performed by an encryption processing unit (not shown) provided separately from the encryption processing unit SW14. Then, the PIN information (encrypted PIN information) encrypted by the encryption processing unit SW14 or the encryption processing unit (not shown) may be output to the keypad input / output / execution control unit SW15.

The keypad input / output / execution control unit SW15 passes the PIN information or the encrypted PIN information to the IC card via the IC card input / output driver SW13 and the IC card reader driver SW19. The IC card collates the data obtained by decrypting the PIN information or the encrypted PIN information obtained from the keypad input / output / execution control unit SW15 with the PIN information registered in advance in the IC card, and the collation result of those PINs Is output (S6). The keypad input / output / execution control unit SW15 inputs the PIN verification result output from the IC card via the IC card reader driver SW19 and the IC card input / output driver SW13. The keypad input / output / execution control unit SW15 inputs the PIN verification result output from the IC card via the IC card reader driver SW19 and the IC card input / output driver SW13.

The keypad input / output / execution control unit SW15, if the collation result that the PIN information input in step S4 matches the PIN information registered in the IC card read in step S3 is obtained from the IC card, The OS 1 (SW21), the virtual hypervisor SW5, and the guest OS2 (SW35) are used to instruct the payment application SW32 of the non-secure virtual machine SW3 to perform subsequent sales processing as payment processing (S7, FIG. 3). (Refer to ST7).

On the non-secure virtual machine SW3, if the settlement application SW32 obtains a collation result that the PIN information input in step S4 matches the PIN information registered in the IC card read in step S3 (S6, YES), sales processing as subsequent settlement processing is performed (S7). The sales processing data after the sales processing is transmitted to the settlement center 50 via the center connection application SW33. Note that the sales processing of the sales processing data shown in step S7 may be executed every time a customer purchases a product or receives a service, or communication between the payment terminal device 1 and the payment center 50. Is performed at a predetermined timing (for example, once a week), and may be processed together with other sales processing data at that time.

On the other hand, when the keypad input / output / execution control unit SW15 determines that they do not match as a result of the collation in step S6 (S6, NO), the keypad input / output / execution control unit SW15 performs the settlement process on the touch panel 10 for the secure screen UI application SW11. A message for canceling is displayed (S8). The keypad input / output / execution control unit SW15 does not instruct the payment application SW32 to perform sales processing, and the subsequent payment processing procedure is stopped.

In the second operation procedure at the time of settlement processing requiring PIN verification shown in FIG. 6, the keypad input / output / execution control unit SW15 outputs the PIN information to the encryption processing unit SW14, and the PIN information is transmitted to the encryption processing unit. Let SW14 encrypt.

The encryption processing unit SW14 encrypts the PIN information output from the keypad input / output / execution control unit SW15 using an encryption key that can be decrypted in the settlement center 50, and outputs the PIN information to the keypad input / output / execution control unit SW15. (S6A, see ST5 and ST6 in FIG. 3).

The keypad input / output / execution control unit SW15 sends encrypted PIN information (encrypted input PIN) to the non-secure virtual machine (non-secure) via the guest OS1 (SW21), the virtualized hypervisor SW5, and the guest OS2 (SW35). And pass to the settlement application SW32 on the non-secure virtual machine SW3 provided by the secure VM). The virtualization hypervisor SW5 acquires the encrypted PIN information generated by the encryption processing unit SW14 from the keypad input / output / execution control unit SW15 and passes it to the settlement application SW32 of the non-secure virtual machine SW3 (S7A, FIG. 3). ST7). On the non-secure virtual machine SW3, the payment application SW32 communicates with the payment center 50 via the center connection application SW33, transmits the encrypted PIN information generated in step S6A, and the card read in step S4. Make credit inquiry using card information.

The settlement center 50 decrypts the PIN information received from the settlement application SW32 of the settlement terminal device 1, and collates the PIN information managed in the settlement center 50 with the decrypted PIN (S8A). When these two PIN information matches and it is confirmed that there is no problem in dealing with the card to be verified (eg, not on the black list) (S8A, YES), the settlement center 50 is the center of the settlement terminal device 1. Credit is performed to the payment application SW32 via the connection application SW33.

The settlement application SW32 of the settlement terminal device 1 receives the credit of the settlement center 50 in step S11A, performs sales processing as subsequent settlement processing (S9A), and ends the communication with the settlement center 50. Note that the sales processing of the sales processing data shown in step S9A may be executed whenever a customer purchases a product or receives a service, or communication between the payment terminal device 1 and the payment center 50 is performed. It may be performed at a predetermined timing (for example, once a week), and may be processed together with other sales processing data at that time.

On the other hand, if the keypad input / output / execution control unit SW15 determines that they do not match as a result of the collation in step S8A (S8A, NO), the keypad input / output / execution control unit SW15 A message for canceling is displayed (S10). The keypad input / output / execution control unit SW15 does not instruct the payment application SW32 to perform sales processing, and the subsequent payment processing procedure is stopped.

Next, a PIN input operation procedure in the virtual PIN pad SW4 will be described with reference to FIG. FIG. 7 is a flowchart for explaining in detail the operation procedure of PIN input in the virtual PIN pad SW4 in step S4 shown in FIG.

In FIG. 7, when a common key cryptosystem is used between the encryption unit HW2 of the PIN input unit HW1 and the decryption unit SW16 of the virtual PIN pad SW4, for example, the virtual PIN pad SW4 and the PIN input unit SW7 A common key exchange (KEY （EXCHANGE) is performed between the two (S11, see T1 in FIG. 4).

After the exchange of the common key is completed, the virtualization hypervisor SW5 establishes a secure communication path 53 between the virtual PIN pad SW4 and the PIN input unit SW7. That is, a secure communication path 53 for encrypted communication is formed between the virtual PIN pad SW4 and the PIN input unit SW7 (S12, see T2 in FIG. 4).

After step S12, the secure screen UI application SW11 displays a message for prompting the user to input a PIN on the touch panel 10 (see S13, ST1, ST2, and FIG. 8B in FIG. 3). The user confirms the message displayed on the touch panel 10 and inputs a PIN as personal authentication information (for example, a personal identification number) to the keypad unit 34 of the PIN input unit HW1.

The encryption unit HW2 encrypts the obtained PIN information and outputs it to the virtualization hypervisor SW5 in response to the user's input to the keypad unit 34. The virtual hypervisor SW5 outputs the encrypted PIN information to the keypad driver SW17 via the communication path 53. The keypad driver SW17 outputs the encrypted PIN information to the decryption unit SW16.

The decryption unit SW16 receives the encrypted PIN output from the keypad driver SW17 (see S14, ST3 in FIG. 3, FIG. 9A, and FIG. 9B). The decryption unit SW16 decrypts the input encrypted PIN using the common key exchanged in step S11, thereby decrypting the PIN information (S15, see ST4 in FIG. 3). Thereafter, the process returns to the process of the flowchart shown in FIG. 5 and proceeds to step S5 in FIG.

FIG. 8A is a diagram showing a screen of the touch panel 10 on which payment amount information (see step S1 shown in FIG. 5) and a message for prompting a card reading operation (see step S2 shown in FIG. 5) are displayed in the payment terminal device 1. is there. Specifically, in FIG. 8A, the touch panel 10 of the payment terminal device 1 displays characters “Total purchase amount ¥ 128,000 (tax included)” and “Please read the card” on the screen. Yes.

FIG. 8B is a diagram showing a screen of the touch panel 10 on which a message for prompting the input of the PIN (see step S13 shown in FIG. 7) is displayed. Specifically, a box 61 in which a PIN is entered, characters “Please enter your PIN”, and an arrow 63 pointing to the keypad 34 are displayed on the screen.

FIG. 9A is a diagram showing a screen of the box 61 showing a state where the PIN is input by one digit by the user's input operation of the PIN information to the keypad unit 34 (see steps S13 and S14 shown in FIG. 7). The entered number is displayed with an asterisk “*”. FIG. 9B is a diagram showing a screen of a box 61 showing a state where all four digits of PIN have been input. The PIN in this embodiment is 4 digits, but it may be a larger number of digits (for example, 12 digits).

As described above, the settlement terminal device 1 according to the present embodiment encrypts the authentication information (for example, PIN as a personal identification number) input by the PIN input unit HW1 by using the encryption key that can be decrypted by the settlement center 50. The encrypted PIN information generated by the conversion is passed in the order of the secure virtual machine SW1, the virtual hypervisor SW5, and the non-secure virtual machine SW3, and the payment application SW32 executes the payment process with the payment center 50.

As a result, the settlement terminal device 1 does not require the PIN input unit HW1 (for example, the keypad unit 34) configured using, for example, hardware resources to have a special specification as in Patent Document 2, so that the virtualization hypervisor SW5 can be used. Since the PIN input in the secure execution environment provided by the method is encrypted using the encryption key that can be decrypted in the settlement center 50, the security of the PIN information input by the user can be ensured accurately. In other words, the settlement terminal device 1 can suppress the complexity of the structure to the minimum, and can ensure tamper resistance for ensuring information security.

The payment terminal device 1 is installed with a plurality of applications (for example, payment applications and user applications) that can be executed in the non-secure execution environment of the acquirer, payment center, and registered member store with which the credit card registered member store has a contract. Even if it is, the integrity of the security of the input PIN information can be ensured and tamper resistance can be ensured.

In addition, since the payment terminal device 1 shares the secure execution environment and the non-secure execution environment using a single hardware resource, the virtualization hypervisor SW5 uses the hardware resource circuit of the payment terminal device 1 itself. The scale can be reduced.

Further, the settlement terminal device 1 encrypts the PIN information input by the PIN input unit HW1 in the encryption unit HW2, and the encrypted PIN information is provided in a secure execution environment via the secure communication path 53. Since the data is transferred to the PIN pad SW4, the security of the PIN information input by the PIN input unit HW1 can be ensured.

Moreover, since the payment terminal device 1 displays a message for prompting the user to input the PIN, the convenience regarding the input of the PIN information to the user can be improved.

(Modification of this embodiment)
FIG. 10 is a front view showing an appearance of a payment terminal device in a modified example of the present embodiment (hereinafter referred to as “this modified example”). The settlement terminal device 1A of the present modification has a tablet terminal type appearance. Since most of the hardware configuration and software configuration of the settlement terminal device 1A are common to the settlement terminal device 1 of the present embodiment described above, different portions will be described.

In the payment terminal device 1 of the present embodiment described above, the keypad unit 34 used for inputting the PIN information is provided. However, in the payment terminal device 1A of the present modification, an input is performed below the screen of the large touch panel 10A. A keypad portion 34A displayed as an operable software keyboard is displayed. Note that various input keys 91 and an insertion slot 93 into which a contact type IC card is inserted are arranged below the touch panel 10A.

The operation procedure at the time of payment processing of the payment terminal device 1A is substantially the same as that of the payment terminal device 1 of the present embodiment described above. That is, as in FIG. 3, the keypad input / output / execution control unit SW15 in the secure virtual machine SW1 of the settlement terminal device 1A encrypts the PIN (authentication information) input to the touch panel 10A within the same execution environment. The processing unit SW14 (first encryption unit) encrypts the data. The PIN encryption is performed using an encryption key that can be decrypted by the settlement center 50 (the settlement destination device of the settlement application SW32 (payment processing unit) in the non-secure virtual machine SW3). Then, the payment application SW32 (payment processing unit) in the non-secure virtual machine SW3 executes a payment process for the payment center 50 using the encrypted PIN (first encrypted authentication information).

FIG. 11 is a block diagram specifically illustrating an example of a system configuration mainly including software functions of the settlement terminal device 1A according to a modification of the present embodiment. FIG. 11 shows an example of mounting the display drivers SW18 and SW34 in the settlement terminal device 1A of the modification of the present embodiment, and specifically, only the difference with respect to FIG. 3 is shown. In FIG. 11, the display unit 29 of the touch panel 10A (see FIG. 10) is connected to the display driver SW18 in the secure virtual machine SW1. The display driver SW18 in the secure virtual machine SW1 and the display driver SW34 in the non-secure virtual machine SW3 are connected in a state in which tamper resistance is physically ensured.

Display on the display unit 29 by the display driver SW34 in the non-secure virtual machine SW3 is performed under the control of the display driver SW18 in the secure virtual machine SW1. In FIG. 10, the box 61 indicating the progress of PIN input, the arrow 63, and the keypad 34A used for PIN input are displayed by the display driver SW18 in the secure virtual machine SW1. About these, the display by display driver SW34 in non-secure virtual machine SW3 is interrupted | blocked. Therefore, when an unauthorized application is installed in the non-secure virtual machine SW3, a legitimate input area for entering the PIN is illegally hidden, or another unauthorized input area is displayed by the unauthorized application. To prevent. As a result, it is possible to reduce the possibility that the user of the settlement terminal device 1A inputs a PIN by mistaking an illegal input area as a regular one, and the PIN is taken (phishing).

In such a settlement terminal device 1A, the keypad portion which is hardware can be omitted, and the hardware circuit scale can be simplified. In addition, the settlement terminal device 1A can further simplify the user's input operation to the keypad unit 34A indicated by the arrow 63 because the keypad unit 34 and the touch panel 10A exist on the same screen.

Although various embodiments have been described above with reference to the drawings, it goes without saying that the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes and modifications can be made within the scope of the claims, and these are naturally within the technical scope of the present invention. Is done.

For example, in the above embodiment, the secure execution environment and the non-secure execution environment are realized by the same CPU, but may be realized by separate CPUs.

Also, the same operation can be performed by using a configuration in which the host OS and the virtualized application are combined instead of using the virtualized hypervisor.

The present invention can be applied to devices that require various secure inputs, such as bank ATM devices, in addition to payment terminal devices.

The present invention is useful, for example, as an information terminal device and an information processing method that are used in, for example, a settlement process, suppress the complexity of the structure to a minimum, and ensure tamper resistance for ensuring information security.

1, 1A Payment terminal device 2

Information processing unit

10, 10A Touch panel 21 CPU
22 Local Wireless Communication Unit 23 Local Wireless Communication Antenna 24 Wide Area Wireless Communication Unit 25 Wide Area Wireless Communication Antenna 29 Display Unit 30 Touch Input Detection Unit 32 Flash ROM
33 RAM
34, 34A Keypad part 35 Magnetic card reader part 36 Power supply part 37 Battery 38 Loop antenna 43 Non-contact type IC card reader / writer part 44 Contact type IC card reader part 50 Settlement center SW1 Secure virtual machine (Secure_VM)
SW3 non-secure virtual machine (Non-Secure_VM)
SW4 Virtual PIN pad SW5 Virtualization hypervisor SW13 IC card input / output driver SW14 Encryption processing unit SW15 Keypad input / output / execution control unit SW16 Decryption unit SW17 Keypad driver SW18 Display driver SW19 IC card reader driver SW20 LED driver SW21 Guest OS1
SW31 Terminal UI application SW32 Payment application SW33 Center connection application SW34 Display driver SW35 Guest OS2
HW2 encryption unit

Claims

An execution environment providing unit that separately provides a secure execution environment having tamper resistance and a non-secure execution environment including a settlement processing unit that does not have tamper resistance;
An authentication information input unit that is provided outside the secure execution environment and receives input of authentication information;
A first encryption unit that is provided outside the secure execution environment and encrypts the authentication information input to the authentication information input unit;
An decryption unit that is provided in the secure execution environment and decrypts the authentication information encrypted by the first encryption unit;
A second encryption unit that is provided in the secure execution environment and encrypts the authentication information decrypted by the decryption unit using an encryption key that can be decrypted by a settlement destination device of the settlement processing unit; With
The execution environment providing unit includes:
Providing the settlement processing unit with an execution environment for a settlement process for the settlement destination device using the authentication information encrypted by the second encryption unit;
Information processing device.
The information processing apparatus according to claim 1,
A display unit;
A control unit that causes the display unit to display a prompt to input the authentication information,
Information processing device.
The information processing apparatus according to claim 1,
The authentication information is a user password.
Information processing device.
An information processing method in an information processing apparatus including a settlement processing unit,
Separately providing a secure execution environment having tamper resistance and a non-secure execution environment including the payment processing unit not having tamper resistance;
Accepting input of authentication information outside the secure execution environment;
A first encryption step for encrypting the inputted authentication information outside the secure execution environment;
Decrypting the authentication information encrypted in the first encryption step in the secure execution environment;
A second encryption step of encrypting the decrypted authentication information using an encryption key that can be decrypted by a settlement destination device of the settlement processing unit in the secure execution environment;
Providing the settlement processing unit with an execution environment for settlement processing for the settlement destination device using the authentication information encrypted in the second encryption step,
Information processing method.