# US 10,318,933 B2 · Settlement terminal and method of protecting data stored in the settlement terminal against tampering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,318,933 B2 - Document ID: US10318933B2 - Status: Granted - Kind: B2 - Application number: 15/702,320 - Filed: 2017-09-12 - Published: 2018-03-29 - Granted: 2019-06-11 - Earliest claimed: 2016-09-23 - Assignees: Toshiba Tec Kabushiki Kaisha - Applicants: Toshiba Tec Kabushiki Kaisha - Inventors: Takafumi Fukushima - Web page: https://patentgrep.com/patent/US10318933B2 ## CPC - G06Q 20/04: Payment circuits - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 8/654: using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories - G06F 21/554: {involving event detection and direct action} - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06Q 20/32: using wireless devices - G06Q 20/347: {Passive cards} - G06Q 20/403: {Solvency checks} - G07F 7/1075: {PIN is checked remotely} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) ## Abstract A settlement terminal includes a card reader, a settlement processing unit including a processor programmed to carry out a settlement process using information acquired through the card reader and a tampering detection process, a storage device in which a first set of programs is stored after encryption by a first key and a second set of programs is stored after encryption by a second key, each set of programs including a first program for operating the card reader, and a second program for carrying out the settlement process. Upon detection of tampering, the processor of the settlement processing unit notifies an external terminal of the tampering and upon receiving an update instruction from the external terminal, updates a current set of programs used for operating the card reader and carrying out the settlement process from the first set to the second set. ## Claims ### Claim 1 A settlement terminal comprising: a card reader; a settlement processing unit including a processor programmed to carry out a settlement process using information acquired through the card reader and a tampering detection process; a storage device in which a first set of programs is stored after encryption by a first key and a second set of programs is stored after encryption by a second key, each set of programs including a first program for operating the card reader, and a second program for carrying out the settlement process, wherein upon detection of tampering, the processor of the settlement processing unit notifies an external terminal of the tampering and upon receiving an update instruction from the external terminal, updates a current set of programs used for operating the card reader and carrying out the settlement process from the first set to the second set. ### Claim 2 (depends on 1) The settlement terminal according to claim 1, wherein the tampering detection process includes comparing a start value associated with a current connection state with an initial value associated with a prior connection state, and outputting a tampering error signal if the start value does not match the initial value. ### Claim 3 (depends on 2) The settlement terminal according to claim 2, wherein the start value is an IP address currently assigned to the settlement terminal and the initial value is an IP address previously assigned to the settlement terminal. ### Claim 4 (depends on 1) The settlement terminal according to claim 1, wherein the settlement processing unit is connected to a point-of-sale (POS) terminal over a network to receive transaction data from the POS terminal. ### Claim 5 (depends on 4) The settlement terminal according to claim 4, wherein the external terminal is the POS terminal. ### Claim 6 (depends on 1) The settlement terminal according to claim 1, wherein the storage device includes an encryption processing circuit configured to encrypt the first and second sets of programs using the first and second keys, respectively, prior to storage in a storage area of the storage device and decrypt the first and second sets of programs using the first and second keys, respectively, when they are read out from the storage area. ### Claim 7 (depends on 6) The settlement terminal according to claim 6, wherein the storage device further includes an access control circuit configured to supply the first key to the encryption processing circuit if the first set of programs is the current set of programs and the second key to the encryption processing circuit if the second set of programs is the current set of programs. ### Claim 8 (depends on 1) The settlement terminal according to claim 1, wherein the processor is further programmed to write either normal mode data or maintenance mode data in a shared memory region such that, if the normal mode data is written, a tampering error signal is output if a start value associated with a current connection state does not match an initial value associated with a prior connection state, and if the maintenance mode data is written, the tampering error signal is not output even if the start value does not match the initial value. ### Claim 9 (depends on 8) The settlement terminal according to claim 8, wherein the settlement processing unit includes a wireless communication interface which sends an instruction to the processor to write maintenance mode data in the shared memory region upon authentication of a maintenance terminal that is within a communication range of the wireless communication interface. ### Claim 10 A method of protecting data stored in a settlement terminal against tampering, wherein the settlement terminal includes a card reader, a settlement processing unit including a processor programmed to carry out a settlement process using information acquired through the card reader and a tampering detection process, and a storage device in which a first set of programs is stored after encryption by a first key and a second set of programs is stored after encryption by a second key, each set of programs including a first program for operating the card reader, and a second program for carrying out the settlement process, said method comprising: performing a tampering detection process; upon detection of tampering, notifying an external terminal of the tampering; and upon receiving an update instruction from the external terminal, updating a current set of programs used for operating the card reader and carrying out the settlement process from the first set to the second set. ### Claim 11 (depends on 10) The method according to claim 10, wherein the tampering detection process includes comparing a start value associated with a current connection state with an initial value associated with a prior connection state, and outputting a tampering error signal if the start value does not match the initial value. ### Claim 12 (depends on 11) The method according to claim 11, wherein the start value is an IP address currently assigned to the settlement terminal and the initial value is an IP address previously assigned to the settlement terminal. ### Claim 13 (depends on 10) The method according to claim 10, wherein the settlement processing unit is connected to a point-of-sale (POS) terminal over a network to receive transaction data from the POS terminal. ### Claim 14 (depends on 13) The method according to claim 13, wherein the external terminal is the POS terminal. ### Claim 15 (depends on 10) The method according to claim 10, wherein the storage device includes an encryption processing circuit configured to encrypt the first and second sets of programs using the first and second keys, respectively, prior to storage in a storage area of the storage device and decrypt the first and second sets of programs using the first and second keys, respectively, when they are read out from the storage area. ### Claim 16 (depends on 15) The method according to claim 15, wherein the storage device further includes an access control circuit configured to supply the first key to the encryption processing circuit if the first set of programs is the current set of programs and the second key to the encryption processing circuit if the second set of programs is the current set of programs. ### Claim 17 (depends on 10) The method according to claim 10, wherein the processor is further programmed to write either normal mode data or maintenance mode data in a shared memory region such that, if the normal mode data is written, a tampering error signal is output if a start value associated with a current connection state does not match an initial value associated with a prior connection state, and if the maintenance mode data is written, the tampering error signal is not output even if the start value does not match the initial value. ### Claim 18 (depends on 17) The method according to claim 17, wherein the settlement processing unit includes a wireless communication interface which sends an instruction to the processor to write maintenance mode data in the shared memory region upon authentication of a maintenance terminal that is within a communication range of the wireless communication interface.