JP4765608B2 - Data processing apparatus, data processing program, and data processing system - Google Patents

Description

  The present invention relates to a data processing device that performs data communication with a host device using a mutual authentication method, a data processing program that causes the data processing device to function, and a data processing system to which the data processing device is applied.

  Conventionally, as a data communication method for ensuring the security of data exchanged between two devices, there has been data communication using a mutual authentication method. In the mutual authentication method, as is well known, two devices that perform data communication authenticate each other device using a predetermined key (mutual authentication key) before starting data communication, and this authentication is performed. Is established, the communication system starts data communication between these two devices. Data encrypted with the mutual authentication key (encrypted data) is transmitted and received between the two devices. That is, the data transmitted by the transmitting device is encrypted and transmitted with the mutual authentication key, and the encrypted data received by the receiving device is decrypted using the mutual authentication key.

  Data communication based on this mutual authentication method is also used in transaction processing systems for processing transactions using electronic money that have recently begun to be put into practical use. In this transaction processing system, data for acquiring electronic money information from a medium (hereinafter referred to as an electronic money medium) such as an IC card or a mobile phone that stores information related to electronic money (hereinafter referred to as electronic money information). A system comprising a processing device and a transaction processing device for performing transaction processing related to the settlement of the transaction amount using the electronic money information acquired by the data processing device, between the data processing device and the transaction processing device Data communication is performed by the mutual authentication method described above.

By the way, in this mutual authentication method, the security of data exchanged between two devices decreases as the confidentiality of the mutual authentication key used for data communication decreases. In other words, in order to ensure the security of data communication in the mutual authentication method, the confidentiality of the mutual authentication key must be improved. On the other hand, when data communication between two devices is performed by the mutual authentication method, a mutual authentication key is assigned to the administrator of each device (data processing device and transaction processing device) in order to connect the data processing device and the transaction processing device. Etc. need to be shared. That is, there are many people who know the mutual authentication key, and the secrecy cannot be sufficiently secured. Therefore, initial authentication (hereinafter referred to as initial authentication) between two apparatuses (data processing apparatus and transaction processing apparatus) that perform data communication using a mutual authentication key shared by an administrator or the like as an initial authentication key, It has been proposed to execute the initial authentication key and generate a mutual authentication key used in subsequent data communication between the two devices when the initial authentication is established (see Patent Document 1 and the like). ). Patent Document 1 also proposes generating a mutual authentication key to be used in the next data communication every time data communication is performed between two devices.
Japanese Patent No. 3498008

  However, in the mutual authentication method, two devices connected by a data communication line generate a mutual authentication key to be used in subsequent data communication at the time of initial authentication. The devices are in a one-to-one relationship. For example, a data processing device that has not performed initial authentication in the transaction processing system described above can be used by connecting to any transaction processing device. However, when the initial authentication is performed, an authentication key used for data communication is generated between the data processing device and the transaction processing device, and thereafter, when this data processing device is connected to another transaction processing device. Conversely, when this transaction processing apparatus is connected to another data processing apparatus, mutual authentication between the two apparatuses is not established. For this reason, in a case where one device fails in two devices connected by a data communication line and subjected to initial authentication, the one device cannot be replaced and used. That is, the other device that has not failed cannot be used (the one device that has been replaced does not know the authentication key used for mutual authentication with the other device that has not failed, so , Authentication with the other device is not established.)

  As a method for solving this problem, when mutual authentication is not established between two devices connected by a data communication line, mutual authentication is performed again using an initial authentication key, and mutual authentication used for subsequent data communication is performed. It is conceivable that the authentication key is generated, but if this is done, the secrecy of the initial authentication key is not sufficiently secured, so that the data security is greatly reduced. Specifically, if a spoofing device is connected as one device of two devices that have been initially authenticated and mutual authentication is performed, the initial mutual authentication fails, but the initial authentication key that is subsequently Since the used initial authentication is established, the impersonation device can enter data communication with one device. That is, in the impersonation device, the data of one device can be used illegally.

  An object of the present invention is to perform data processing capable of easily exchanging a failed device and sufficiently ensuring data security when one of two devices that have been performing data communication has failed. To provide an apparatus, a data processing program, and a data processing system.

  The data processing apparatus of the present invention has the following configuration in order to solve the above problems.

(1) mutual authentication means for performing mutual authentication with the host device using the first mutual authentication key or the second mutual authentication key;
When the mutual authentication with the higher-level device is performed by the mutual authentication means using the first mutual authentication key, the second mutual authentication key used for mutual authentication is generated with the higher-level device. Mutual authentication key generation means
When the second mutual authentication key is generated by the mutual authentication key generation unit, the mutual authentication with the host device using the first mutual authentication key in the mutual authentication unit is prohibited, and the second A mutual authentication control means for enabling mutual authentication with the host device using a mutual authentication key, and
The mutual authentication means includes means for performing mutual authentication with a specific device using a third mutual authentication key,
The mutual authentication control means enables the mutual authentication with the higher-level apparatus using the first mutual authentication key in the mutual authentication means when a predetermined command is transmitted from a specific apparatus for which mutual authentication has been established. , Means for prohibiting mutual authentication with the host device using the second mutual authentication key.

  In this configuration, the mutual authentication means performs mutual authentication (initial authentication) using the first mutual authentication key (initial authentication key) with the host device, and when this authentication is established, the mutual authentication key generation means performs the second mutual authentication key generation means. Generate an authentication key. The data communication with the host device may be performed via a data communication line or may be performed wirelessly. In addition, when the second mutual authentication key is generated by the mutual authentication key generation means, the mutual authentication control means prohibits mutual authentication with the host device using the first mutual authentication key, and the second mutual authentication key Enable mutual authentication with the host device using. That is, when the second mutual authentication key is generated by the mutual authentication key generation means, the authentication key used for mutual authentication with the host device is set to the second mutual authentication key generated by the mutual authentication key generation means Is done. Further, the mutual authentication means performs mutual authentication using the specific device and the third mutual authentication key, and when a predetermined command is transmitted from the specific device after the authentication is established, the mutual authentication control means Mutual authentication with the host device using the first mutual authentication key is enabled, and mutual authentication with the host device using the second mutual authentication key is prohibited.

  As described above, when the initial authentication using the first mutual authentication key is established with the host device, the second mutual authentication generated at the time of the initial authentication is used as the authentication key used in the mutual authentication with the host device. Since it is set as a key, data security is not reduced. When mutual authentication using the third authentication key is established with the specific device, the mutual authentication key used for mutual authentication with the host device is set as the first mutual authentication key. In other words, when mutual authentication is performed with the specific device using the third mutual authentication key, the next mutual authentication with the host device is the initial authentication using the initial authentication key. For this reason, when a higher-level device that has been performing data communication until now fails, mutual authentication using the third mutual authentication key is performed between the specific device and another failed higher-level device. Can be replaced.

  Further, since the third authentication key is only used for mutual authentication with the specific device, the secrecy thereof can be sufficiently ensured.

  (2) The mutual authentication control means is means for using a mutual authentication key transmitted from the specific device together with a predetermined command as the first mutual authentication key.

  In this configuration, by performing mutual authentication with the specific device using the third mutual authentication key, the first mutual authentication key used for the next mutual authentication with the host device is set. Therefore, the first mutual authentication key can be set according to the host device that performs mutual authentication.

(3) A secret data storage unit for storing secret data acquired from an external device after mutual authentication with the host device is established by the mutual authentication unit using the first mutual authentication key. Prepared,
The mutual authentication control means includes means for erasing confidential data stored in the confidential data storage means when a predetermined command is transmitted from a specific device for which mutual authentication has been established.

  In this configuration, when a predetermined command is transmitted from a specific device for which mutual authentication has been established, the secret data stored in the secret data storage means is erased. Therefore, any higher-level device (the mutual authentication using the initial authentication key) is deleted. The secret data is erased when it is possible to connect to a device capable of authentication. Accordingly, it is possible to sufficiently secure the security data stored in the data processing device.

  According to the present invention, when a host device that has been performing data communication up to now has failed while ensuring sufficient data security, the failed host device can be replaced with another host device.

  Embodiments of the present invention will be described below.

  FIG. 1 is a schematic diagram showing a configuration of a transaction processing system according to an embodiment of the present invention. The transaction processing system of this embodiment uses electronic money information from a medium (hereinafter referred to as electronic money medium 10) such as an IC card or a mobile phone that stores information related to electronic money (hereinafter referred to as electronic money information). Data processing apparatus 1 that acquires the transaction amount, transaction processing apparatus 2 that performs transaction processing related to the settlement of the transaction amount using the electronic money information acquired by the data processing apparatus 1, and a management apparatus that is used to manage the data processing apparatus 1 3 is provided. The transaction processing device 2 corresponds to the higher-level device referred to in the present invention, and the management device 3 corresponds to the specific device referred to in the present invention. Transaction processing device 2 is, for example, a POS terminal or a vending machine. The data processing device 1 and the transaction processing device 2 are connected by a data communication line. The management device 3 is a device connected to the data processing device 1 as necessary.

  In this embodiment, the electronic money medium 10 is described as a medium having a wireless communication function and performing data communication related to electronic money information with the data processing device 1 by wireless communication. It may be a medium.

  FIG. 2 is a diagram showing the configuration of the main part of the data processing apparatus of this embodiment. The data processing device 1 includes a control unit 11 that controls the operation of the main body, a wireless communication unit 12 that wirelessly communicates with the electronic money medium 10, a transaction processing device 2 that is connected via a data communication line, and a management device A communication unit 13 that controls communication with the communication unit 3. The control unit 11 includes a first mutual authentication key storage area 15 that stores a first mutual authentication key, a second mutual authentication key storage area 16 that stores a second mutual authentication key, and a third mutual authentication key. The third mutual authentication key storage area 17 for storing the key flag for storing a key flag indicating whether the first mutual authentication key or the second mutual authentication key is used in mutual authentication with the transaction processing device 2 A memory 11a having a storage area 18 and a secret data storage area 19 for storing secret data is provided. The memory 11a is a non-volatile memory, and may be composed of one memory or a plurality of memories. When the key flag stored in the key flag storage area 18 is “0”, the data processing device 1 uses the first mutual authentication key for mutual authentication with the transaction processing device 2, and this key flag is “1”. ”, The second mutual authentication key is used for mutual authentication with the transaction processing apparatus 2. Further, the data processing device 1 uses the third mutual authentication key for mutual authentication with the management device 3 regardless of the state of the key flag stored in the key flag storage area 18. The secret data stored in the secret data storage area 19 is data for which security is required, for example, authentication data used for confirming the validity of the electronic money medium 10. The secret data is preferably stored in the secret data storage area 19 after initial authentication is performed between the data processing device 1 and the transaction processing device 2. This secret data may be acquired by data communication with the transaction processing device 2 or may be acquired by data communication with another device not shown. When acquiring the secret data from the transaction processing device 2, when the initial authentication with the transaction processing device 2 is established, the processing for acquiring the secret data may be continued. In addition, when obtaining secret data from another device, when mutual authentication performed using a fourth mutual authentication key (not shown) is established, processing for obtaining secret data is continued. Just do it. As described above, the process for acquiring the secret data from the other apparatus is preferably performed after the initial authentication with the transaction processing apparatus 2 is performed. In the wireless communication unit 12, a range of several centimeters from the antenna coil 12a is a wireless communication area. The communication part 13 communicates with the transaction processing apparatus 2 and the management apparatus 3 which are connected via the data communication line as needed. The communication part 13 has individually the communication port to which the transaction processing apparatus 2 is connected, and the communication port to which the management apparatus 3 is connected. The data processing device 1 is configured to recognize whether the device performing data communication is the transaction processing device 2 or the management device 3 by the connected communication port.

  The electronic money medium 10 is configured to operate by obtaining an operating power supply by electromagnetic coupling with the wireless communication unit 12 when located in the wireless communication area of the wireless communication unit 12.

  FIG. 3 is a diagram showing the configuration of the main part of the transaction processing apparatus of this embodiment. Transaction processing apparatus 2 includes a control unit 21 that controls the operation of the apparatus main body, a communication unit 22 that controls data communication with data processing apparatus 1 connected via a data communication line, and an operation unit that receives input operations. 23 and a transaction processing unit 24 for processing the transaction. The control unit 21 is provided with a memory 21a having a first mutual authentication key storage area 25 for storing a first mutual authentication key and a second mutual authentication key storage area 26 for storing a second mutual authentication key. It has been. The memory 21a is a non-volatile memory, and may be composed of one memory or a plurality of memories. Transaction processing apparatus 2 determines an authentication key (first mutual authentication key or second mutual authentication key) used for mutual authentication with data processing apparatus 1 in accordance with an instruction from data processing apparatus 1. The communication unit 22 communicates with the data processing apparatus 1 connected via the data communication line as necessary. The operation unit 23 is provided with a plurality of operation keys, for example, a registration key for a merchandise to be traded, a settlement key, and a bar code reader for reading a bar code attached to the merchandise. The transaction processing unit 24 performs, for example, a product registration process for registering a product to be traded, a settlement process for settlement of a transaction amount, and a printing process for issuing a receipt on which transaction details are printed.

  FIG. 4 is a diagram showing the configuration of the main part of the management apparatus of this embodiment. The management device 3 includes a control unit 31 that controls the operation of the apparatus main body, a communication unit 32 that controls data communication with the data processing device 1 connected via a data communication line, and an operation unit 33 that receives input operations. And. The control unit 31 is provided with a memory 31a having a third mutual authentication key storage area 35 for storing a third mutual authentication key. The communication unit 32 communicates with the data processing apparatus 1 connected via the data communication line as necessary. The operation unit 33 is provided with a plurality of operation keys.

  Next, the operation of the transaction processing system according to the embodiment of the present invention will be described. First, transaction processing in this transaction processing system will be briefly described. At the time of transaction processing, the data processing device 1 and the transaction processing device 2 are connected via a data communication line, but the management device 3 may be connected to the data processing device 1 via a data communication line. , It does not have to be connected. When the data processing device 1 and the transaction processing device 2 are turned on, that is, when data communication is possible via the data communication line to which both devices are connected, Execute authentication process. Details of this mutual authentication processing will be described later. When mutual authentication is established between the data processing device 1 and the transaction processing device 2, data communication is possible, and when the mutual authentication is not established, data communication is not possible. Here, the operation at the time of transaction processing will be described assuming that mutual authentication between the data processing device 1 and the transaction processing device 2 is established.

  In addition, when the mutual authentication between the data processing device 1 and the transaction processing device 2 is not established, this transaction processing cannot be executed.

  FIG. 5A is a flowchart showing the operation of the data processing apparatus during transaction processing, and FIG. 5B is a flowchart showing the operation of the transaction processing apparatus during transaction processing. The transaction processing device 2 accepts registration of commodities to be traded (s11). The transaction processing device 2 registers products to be traded based on key operations provided on the operation unit 23, barcodes attached to products to be traded read by a barcode reader (not shown), and the like. When the registration of the product to be traded is completed, the transaction processing device 2 requests the data processing device 1 to transmit electronic money information from the communication unit 22 (s12).

  When the data processing device 1 receives the transmission request for the electronic money information transmitted from the transaction processing device 2 (s1), the wireless communication unit 12 uses the electronic money medium 10 (antenna coil) located in the wireless communication area. Electronic money information is acquired from the electronic money medium 10) held near 12a (s2). The data processing apparatus 1 confirms the validity of the electronic money medium 10 prior to the acquisition of the electronic money information in s2, and acquires the electronic money information from the electronic money medium 10 when the validity is confirmed. The validity is confirmed using authentication data stored in the secret data storage area 19. For example, if the authentication data is a mutual authentication key with the electronic money medium 10, the mutual authentication with the electronic money medium 10 is performed using the mutual authentication key, and when the mutual authentication is established, the electronic money medium It is determined that 10 legitimacy has been confirmed. In s2, the operation of the wireless communication unit 12 is started, and the electronic money medium 10 located in the wireless communication area is requested to transmit the stored electronic money information. When receiving this request, the electronic money medium 10 transmits the stored electronic money information. The data processing device 1 acquires electronic money information by receiving the electronic money information transmitted from the electronic money medium 10 in the wireless communication unit 12. The data processing device 1 transmits the electronic money information acquired in s2 to the transaction processing device 2 (s3).

  When the transaction processing device 2 receives the electronic money information transmitted from the data processing device 1 (s13), the transaction processing unit 24 uses the electronic money information received this time to determine the transaction amount of the commodity registered in s11. A settlement process for settlement is performed (s14). When the settlement processing is completed, the transaction processing device 2 transmits a request for instructing the data processing device 1 to update the electronic money information stored in the electronic money medium 10 (s15). The request transmitted in s15 is an instruction related to updating the remaining amount in the electronic money information.

  When the data processing device 1 receives an instruction for updating the electronic money information transmitted from the transaction processing device 2 (s4), the data processing device 1 updates the electronic money information stored in the electronic money medium 10 that acquired the electronic money information in s2. (S5). In s5, the wireless communication unit 12 transmits to the electronic money medium 10 a command for instructing to update the electronic money information together with the electronic money information to be updated. When the electronic money medium 10 receives an electronic money information update instruction from the data processing device 1, the electronic money medium 10 updates the electronic money information stored in accordance with the instruction. The processing device 1 is notified. Upon receiving the update completion of the electronic money information from the electronic money medium 10 (s6), the data processing device 1 notifies the transaction processing device 2 of the completion of the update of the electronic money information (s7), and stops the operation of the wireless communication unit 12 (S8).

  When receiving the completion of updating the electronic money information from the data processing device 1 (s16), the transaction processing device 2 ends the current transaction processing.

  In the transaction processing described above, the communication data exchanged between the data processing device 1 and the transaction processing device 2 is generated when mutual authentication is performed using the first mutual authentication key or the second mutual authentication key. It is encrypted using a random number as an encryption key. This second mutual authentication key is a mutual authentication key generated between the data processing device 1 and the transaction processing device 2 at the time of initial authentication described later. The second mutual authentication key is an authentication key in which confidentiality is ensured without being output from the data processing device 1 and the transaction processing device 2 to the administrator of the transaction processing system. Not published. Therefore, the security of data exchanged by data communication between the data processing device 1 and the transaction processing device 2 is sufficiently ensured.

  Next, the mutual authentication process between the data processing device 1 and the transaction processing device 2 will be described. FIG. 6 is a flowchart showing the mutual authentication process in the data processing apparatus, and FIG. 7 is a flowchart showing the mutual authentication process in the transaction processing apparatus. When the data processing device 1 detects that the transaction processing device 2 capable of data communication is connected to the communication unit 13 via the data communication line after the power is turned on, the data processing device 1 starts the mutual authentication processing. The data processing apparatus 1 determines whether the current mutual authentication is the initial authentication using the first mutual authentication key or the normal authentication using the second mutual authentication key (s21). Specifically, it is confirmed whether the key flag stored in the key flag storage area 18 of the memory 11a is “0” or “1”. If the key flag is “0”, the transaction processing device 2 is determined as the initial authentication, and if the key flag is “1”, the mutual authentication with the transaction processing device 2 is determined as the normal authentication. That is, the data processing device 1 enables one of the initial authentication and the normal authentication and prohibits the other depending on the state of the key flag. If the data processing device 1 determines that the initial authentication is performed in s21, the data processing device 1 requests the transaction processing device 2 for the initial authentication (s22), and starts executing the initial authentication (s23). If it is determined that normal authentication is performed in s21, the transaction processing device 2 is requested to perform normal authentication (s24), and execution of normal authentication is started (s25). When there is a request for initial authentication from the data processing device 1 (s41), the transaction processing device 2 starts executing the initial authentication (s43). Further, when there is a request for normal authentication from the data processing apparatus 1 (s42), execution of normal authentication is started (s44). The initial authentication and the normal authentication are substantially different only in whether the mutual authentication key used for the processing is the first mutual authentication key (initial authentication) or the second mutual authentication key (normal authentication). The processing is the same.

  Here, mutual authentication between the data processing device 1 and the transaction processing device 2 will be described by taking initial authentication as an example. FIG. 8 is a flowchart showing initial authentication in the data processing apparatus, and FIG. 9 is a flowchart showing initial authentication in the transaction processing apparatus. The data processing device 1 generates a random number Rap (s61), and generates M1 obtained by encrypting the random number Rap with the first mutual authentication keys Kap1 and Kbp1 stored in the first mutual authentication key storage area 15. (S62), this M1 is transmitted to the transaction processing apparatus 2 (s63). When the transaction processing device 2 receives M1 obtained by encrypting the random number Rap from the data processing device 1 (s81), the transaction processing device 2 stores the first mutual authentication key stored in the first mutual authentication key storage area 25 in the first mutual authentication key storage area 25. M2 encrypted with Kbp1 and Kap1 is generated (s82). Further, a random number Rbp is generated (s83), and M3 is generated by encrypting the random number Rbp with the first mutual authentication keys Kbp1 and Kap1 stored in the first mutual authentication key storage area 25 (s84). The processing related to s82 and the processing related to s83 and s84 may be mixed. Transaction processing apparatus 2 transmits M2 generated in s82 and M3 generated in s84 to data processing apparatus 1 (s85).

  When the data processing device 1 receives M2 and M3 transmitted from the transaction processing device 2 (s64), the first mutual authentication storing the currently received M2 in the first mutual authentication key storage area 15 Decryption is performed using the keys Kap1 and Kbp1 (s65), and it is determined whether M1 ′ obtained by decrypting this M2 matches M1 generated in s62 (M1 transmitted to the transaction processing device 2 in s63) (s66). If the data processing device 1 determines that they do not match in s66, it determines that mutual authentication with the transaction processing device 2 has not been established (s67). In s67, the transaction processing apparatus 2 is notified that mutual authentication has not been established, and this processing is terminated. On the other hand, if the data processing device 1 determines that they match in s66, the data processing device 1 encrypts M3 received in s64 with the first mutual authentication keys Kap1 and Kbp1 stored in the first mutual authentication key storage area 15. The generated M4 is generated (s68), and this M4 is transmitted to the transaction processing apparatus 2 (s69).

  The transaction processing device 2 is waiting to receive M4 that is not authenticated or encrypted from the data processing device 1 (s86, s87). When transaction processing device 2 receives authentication failure from data processing device 1, transaction processing device 2 determines that mutual authentication with data processing device 1 has not been established (s88), and ends this processing. On the other hand, when M4 transmitted from the data processing device 1 is received, the M4 received this time is decrypted with the first mutual authentication keys Kbp1 and Kap1 stored in the first mutual authentication key storage area 25 (s89). Then, it is determined whether M3 ′ obtained by decoding M4 matches M3 generated in s84 (M3 transmitted to data processing apparatus 1 in s85) (s90). If transaction processing device 2 determines that they do not match in s90, it determines that mutual authentication with data processing device 1 has not been established in s88. In s88, the data processing apparatus 1 is notified of the failure of authentication. On the other hand, if it is determined in s90 that they match, it is determined that mutual authentication with the data processing apparatus 1 has been established (s91). In s91, authentication establishment is transmitted to the data processing device 1. When the data processing device 1 receives the authentication failure from the transaction processing device 2 (s70), the data processing device 1 determines that the mutual authentication with the transaction processing device 2 has not been established in s67. On the contrary, if authentication establishment is received from the transaction processing apparatus 2 in s70, it will determine with mutual authentication with the transaction processing apparatus 2 having been established (s71).

  Note that the normal authentication is a process in which the first mutual authentication key in the above-described initial authentication is replaced with the second mutual authentication key, and description thereof is omitted here.

  When the initial authentication that is started in s23 is established, the data processing device 1 generates the second mutual authentication keys Kap2 and Kbp2 from the random numbers Rap and Rbp used in the initial authentication (s26 and s27). Store in the second mutual authentication key storage area 16 (s28). s28 is processing for updating the second mutual authentication key stored in the second mutual authentication key storage area 16 to the second mutual authentication key generated in s27. Further, the data processing device 1 updates the key flag stored in the key flag storage area 18 to “1” (s29). Furthermore, the data processing device 1 performs setting for permitting data communication with the transaction processing device 2 connected to the communication unit 13 via the data communication line (s30). The subsequent data communication with the transaction processing apparatus 2 is performed using data encrypted with the random number Rap or Rbp generated at the time of mutual authentication (initial authentication) as an encryption key.

  Here, when the secret data stored in the secret data storage area 19 is obtained from the transaction processing device 2, the secret data is obtained from the transaction processing device 2 following the processing of s30. And the process memorize | stored in the secret data storage area 19 acquired here should just be performed. As described above, data communication with the transaction processing apparatus 2 relating to the acquisition of the confidential data is performed by data encrypted using the random number Rap or Rbp generated at the time of initial authentication as an encryption key. In the processing for acquiring the secret data, the data processing device 1 requests the transaction processing device 2 to transmit the secret data, and the secret data transmitted from the transaction processing device 2 is stored in the secret data storage area. 19 is a process to be stored in 19.

  Further, when the secret data is obtained from another device that is not the transaction processing device 2, the secret data may be obtained from the other device after the initial authentication process is completed. In the acquisition of the secret data, the data processing apparatus 1 performs mutual authentication using a preset mutual authentication key (for example, a fourth mutual authentication key not shown), and this mutual authentication is established. Sometimes, secret data is acquired from a device for which mutual authentication has been established, and stored in the secret data storage area 19.

  On the other hand, the data processing device 1 performs a setting for prohibiting data communication with the transaction processing device 2 connected to the communication unit 13 via the data communication line if the initial authentication started in s23 is not established. (S31). Further, when the normal authentication that is started in s25 is established (s32), the data processing device 1 performs a setting for permitting data communication with the transaction processing device 2 connected through the data communication line (s33). . Subsequent data communication with the transaction processing device 2 is performed using data encrypted with the random number Rap or Rbp generated during mutual authentication (normal authentication) as an encryption key. On the contrary, if mutual authentication is not established, a setting for prohibiting data communication with the transaction processing apparatus 2 connected to the communication unit 13 via the data communication line is performed in s31.

  The transaction processing device 2 generates the second mutual authentication keys Kap2 and Kbp2 from the random numbers Rap and Rbp used in the above-described initial authentication when the initial authentication started to be executed in s43 is established (s45 and s46). Store in the second mutual authentication key storage area 26 (s47). The data processing device 1 and the transaction processing device 2 generate the second mutual authentication key with the same logic. Moreover, the transaction processing apparatus 2 performs setting for permitting data communication with the data processing apparatus 1 connected to the communication unit 23 via the data communication line (s48). Further, subsequent data communication with the data processing apparatus 1 is performed by data encrypted using a random number Rap or Rbp generated at the time of mutual authentication (initial authentication) as an encryption key. Here, when the transaction processing device 2 is configured to supply confidential data to the data processing device 1, the transaction processing device 2 waits for a transmission request of confidential data from the data processing device 1, The secret data is transmitted to the data processing device 1. At this time, the transaction processing apparatus 1 encrypts and transmits the confidential data using the random number Rap or Rbp generated at the time of initial authentication as an encryption key. Further, subsequent data communication with the data processing apparatus 1 is performed with data encrypted using a random number Rap or Rbp generated during mutual authentication (initial authentication) as an encryption key.

  On the other hand, the transaction processing device 2 performs a setting for prohibiting data communication with the data processing device 1 connected to the communication unit 23 via the data communication line if the initial authentication started in s43 is not established. (S49). Moreover, the transaction processing apparatus 2 will perform the setting which permits data communication with the data processing apparatus 1 connected to the communication part 23 via a data communication line, if the normal authentication which started execution in s44 is materialized (s50). Perform (s51). Subsequent data communication with the data processing apparatus 1 is performed with data encrypted using a random number Rap or Rbp generated during mutual authentication (during normal authentication) as an encryption key. On the other hand, if mutual authentication is not established, a setting for prohibiting data communication with the data processing device 2 connected to the communication unit 23 via the data communication line is performed in s49.

As described above, in the transaction processing system of this embodiment, data communication is performed between both devices only when mutual authentication (initial authentication or normal authentication) is established between the data processing device 1 and the transaction processing device 2. Can be done. In other words, when mutual authentication between the data processing device 1 and the transaction processing device 2 is not established, data communication cannot be performed between the two devices. Further, the second mutual authentication key generated in the initial authentication is valid only between the data processing device 1 and the transaction processing device 2 that have performed the initial authentication, and is managed in both devices. Therefore, the possibility of leakage is low, and the secrecy can be sufficiently secured. As a result, even if an unauthorized device (spoofing device) is connected to the data processing device 1, normal authentication performed before data communication between the two devices is not established, and data processing is not performed. It is possible to prevent a situation in which the secret data stored in the secret data storage area 19 of the device 1 is illegally used by this impersonation device. Further, in data communication between the data processing device 1 and the transaction processing device 2, data encrypted using the random number Rap or Rbp generated at the time of mutual authentication as described above is exchanged. Therefore, it is possible to sufficiently ensure the security of data exchanged between the data processing device 1 and the transaction processing device 2.

  Next, a case will be described in which the data processing device 1 is disconnected from the transaction processing device 2 connected at this point for some reason and connected to another transaction processing device 2 for use. The data processing device 1 has performed the above-described initial authentication with the transaction processing device 2 connected at this time, and the key flag already stored in the key flag storage area 18 of the memory 11a is “1”. Is. In order to return the key flag stored in the key flag storage area 18 of the memory 11a from “1” to “0”, the data processing device 1 and the management device 3 are connected by a data communication line. Perform the return process shown.

  FIG. 10 is a flowchart showing return processing in the data processing apparatus, and FIG. 11 is a flowchart showing return processing in the management apparatus. The administrator connects the data processing device 1 removed from the transaction processing device 2 to the management device 3 through the data communication line, and performs a predetermined input operation on the management device 3. Accordingly, when a predetermined input operation is performed, the management device 3 transmits an initialization request to the data processing device 1 and starts a mutual authentication process with the data processing device 1 (s111 to s113). On the other hand, when receiving the initialization request transmitted from the management apparatus 3 connected to the communication unit 13 (s101), the data processing apparatus 1 starts mutual authentication processing with the management apparatus 3 (102). The mutual authentication process between the data processing apparatus 1 and the management apparatus 3 is an authentication process using a third mutual authentication key. The data processing apparatus 1 and the transaction processing apparatus 2 described with reference to FIGS. It is the same process as the authentication process between. If the mutual authentication with the management device 3 is not established, the data processing device 1 ends this processing (s103). If the mutual authentication with the data processing device 1 is not established, the management device 3 ends this processing (s114).

  After the mutual authentication with the data processing device 1 is established, the management device 3 performs a predetermined input operation (an operation related to changing the key flag) on the operation unit 33, with respect to the data processing device 1, the memory 11a. The key flag change command for instructing to return the key flag stored in the key flag storage area 18 from “1” to “0” is transmitted (s115, s116), and this process is terminated. On the other hand, when the data processing apparatus 1 receives the key change command transmitted from the management apparatus 3 after mutual authentication with the management apparatus 3 is established, the confidential data stored in the confidential data storage area 19 is received. Is deleted, and then the key flag stored in the key flag storage area 18 is set to “0” (s104 to s106).

  Therefore, even if it is the data processing apparatus 1 removed from the transaction processing apparatus 2, it can return to the initial state which can be connected to the arbitrary transaction processing apparatuses 2 by performing this return process. For this reason, it is possible to flexibly cope with a failure or the like of the transaction processing apparatus 2 connected through the data communication line.

  Further, the data processing device 1 erases the secret data stored in the secret data storage area 19 before returning the key flag from “1” to “0” in the return processing with the management device 3. Therefore, even if an impersonation device is connected to the data processing device 1 and this impersonation device is used as the management device 3 for the purpose of illegally obtaining the confidential data, the confidential data can be acquired. Can not. That is, even a person who knows the third mutual authentication key cannot illegally obtain the secret data stored in the secret data storage area 19 of the data processing device 1. Therefore, the security of the secret data can be sufficiently ensured.

  Further, the management device 3 may transmit the first mutual authentication key to be updated to the data processing device 1 together with the key flag change command in s116. In this case, when the data processing device 1 returns the key change flag from “1” to “0”, the data authentication device stores the mutual authentication key stored in the first mutual authentication key storage area 15 this time. The first mutual authentication key notified from is updated. In this way, the first mutual authentication key stored in the first mutual authentication key storage area 15 by the data processing device 1 is connected to the first mutual authentication key to be used for initial authentication. Thus, the data processing apparatus 1 can be used more flexibly.

  In the above embodiment, the present invention has been described in an embodiment in which the present invention is applied to a transaction processing system. However, the present invention is not limited to a transaction processing system, but can be applied to other types of data processing systems. Moreover, in the said embodiment, although the data processing apparatus 1 and the transaction processing apparatus 2 were connected with the data communication line, the system in which communication in both apparatuses was performed by radio | wireless communication may be sufficient. Similarly, the data communication between the data processing device 1 and the management device 3 may be performed by wireless communication.

  Furthermore, in the data processing device 1 of the above embodiment, the key flag storage area 18 is provided, and the mutual authentication with the transaction processing device 2 is performed according to the state of the key flag stored in the key flag storage area 18. Although it is configured to determine whether to perform initial authentication using one mutual authentication key or normal authentication using a second mutual authentication key, the second mutual authentication key storage area 16 is used as a transaction processing device. The mutual authentication key used for mutual authentication with 2 may be an area for storing mutual authentication, and the mutual authentication with the transaction processing device 2 may be always performed using the mutual authentication key stored in this area. In this case, in the initial state, the data processing device 1 stores the first mutual authentication key stored in the first mutual authentication key storage area 15 and the mutual information stored in the second mutual authentication key storage area 16. The authentication key is the same. Then, when mutual authentication with the transaction processing device 2 is established, the first mutual authentication key stored in the first mutual authentication key storage area 15 and the second mutual authentication key storage area 16 are stored. If the mutual authentication keys are the same, the second mutual authentication keys Kap2 and Kbp2 are generated from the random numbers Rap and Rbp generated in the current mutual authentication (initial authentication in the above-described embodiment), and the second mutual authentication keys Kap2 and Kbp2 are generated. The process of storing in the two mutual authentication key storage area 16 (processing for updating the mutual authentication key stored in the second mutual authentication key storage area 16) may be performed. However, when mutual authentication is established, the first mutual authentication key stored in the first mutual authentication key storage area 15 and the mutual authentication key stored in the second mutual authentication key storage area 16 If they are not the same, the process of updating the mutual authentication key stored in the second mutual authentication key storage area 16 at this time is not performed. In this case, the key flag storage area 18 shown in FIG. 2 can be made unnecessary.

It is the schematic which shows the structure of the transaction processing system which is embodiment of this invention. It is a figure which shows the structure of the principal part of the data processor of this embodiment. It is a figure which shows the structure of the principal part of the transaction processing apparatus of this embodiment. It is a figure which shows the structure of the principal part of the management apparatus of this embodiment. It is a flowchart which shows operation | movement of the data processing apparatus at the time of transaction processing, and a transaction processing apparatus. It is a flowchart which shows the mutual authentication process in a data processor. It is a flowchart which shows the mutual authentication process in a transaction processing apparatus. It is a flowchart which shows the initial authentication process in a data processor. It is a flowchart which shows the initial authentication process in a transaction processing apparatus. It is a flowchart which shows the return process in a data processor. It is a flowchart which shows the return process in a management apparatus.

Explanation of symbols

1-Data processing device 2-Transaction processing device 3-Management device 11-Control unit 11a-Memory 12-Wireless communication unit 13-Communication unit 15-First mutual authentication key storage area 16-Second mutual authentication key storage area 17-third mutual authentication key storage area 18-key flag storage area 19-secret data storage area 21-control unit 21a-memory 22-communication unit 25-first mutual authentication key storage area 26-second mutual Authentication key storage area 31-control unit 31a-memory 32-communication unit 35-third mutual authentication key storage area

Claims (5)

Mutual authentication means for performing mutual authentication with the host device using the first mutual authentication key or the second mutual authentication key;
When the mutual authentication with the higher-level device is performed by the mutual authentication means using the first mutual authentication key, the second mutual authentication key used for mutual authentication is generated with the higher-level device. Mutual authentication key generation means
When the second mutual authentication key is generated by the mutual authentication key generation unit, the mutual authentication with the host device using the first mutual authentication key in the mutual authentication unit is prohibited, and the second A mutual authentication control means for enabling mutual authentication with the host device using a mutual authentication key, and
The mutual authentication means includes means for performing mutual authentication with a specific device using a third mutual authentication key,
The mutual authentication control means enables the mutual authentication with the higher-level apparatus using the first mutual authentication key in the mutual authentication means when a predetermined command is transmitted from a specific apparatus for which mutual authentication has been established. A data processing device which is means for prohibiting mutual authentication with the host device using the second mutual authentication key.   The data processing apparatus according to claim 1, wherein the mutual authentication control unit is a unit that uses a mutual authentication key transmitted from the specific device together with a predetermined command as the first mutual authentication key. A secret data storage means for storing secret data acquired from an external device after mutual authentication with the host device is established by the mutual authentication means using the first mutual authentication key;
The said mutual authentication control means contains a means to erase | eliminate the confidential data which the said confidential data storage means memorize | stores, when a predetermined command is transmitted from the specific apparatus with which mutual authentication was materialized. Data processing equipment. A first step of performing mutual authentication with the host device using the first mutual authentication key stored in the storage means;
In the first step, the second mutual authentication key used for mutual authentication with the higher-level device when mutual authentication with the higher-level device is performed using the first mutual authentication key. Generating and storing in the storage means;
When the second mutual authentication key is generated in the second step, mutual authentication with the host device using the first mutual authentication key is prohibited, and the second mutual authentication key is used. A third step of enabling mutual authentication with the host device;
A fourth step of performing mutual authentication with a specific device using a third mutual authentication key stored in the storage means;
When mutual authentication with the specific device executed in the fourth step is established and a predetermined command is transmitted from the specific device, mutual authentication with the host device using the first mutual authentication key A data processing program for causing a computer to execute a fifth step of validating and prohibiting mutual authentication with the higher-level device using the second mutual authentication key. In a data processing system that performs data communication when mutual authentication is established, and a data processing system having a host device,
The data processing device uses a first mutual authentication key or a second mutual authentication key to perform mutual authentication with the host device,
When the mutual authentication with the higher-level device is performed by the mutual authentication means using the first mutual authentication key, the second mutual authentication key used for mutual authentication is generated with the higher-level device. Mutual authentication key generation means
When the second mutual authentication key is generated by the mutual authentication key generation unit, the mutual authentication with the host device using the first mutual authentication key in the mutual authentication unit is prohibited, and the second A mutual authentication control means for enabling mutual authentication with the host device using a mutual authentication key, and
When the mutual authentication is performed using the data processing device and a third mutual authentication key and the mutual authentication is established, the mutual authentication control means of the data processing device includes a specific device that performs data communication. When a predetermined command is transmitted from a specific device for which mutual authentication has been established, the mutual authentication with the host device using the first mutual authentication key in the mutual authentication means is validated, and the second mutual authentication A data processing system which is means for prohibiting mutual authentication with the host device using a key

Images