Portable electronic device, information processing device, information processing system, and information processing method

Abstract

To provide a portable electronic device capable of implementing a predetermined encryption algorithm with a limited hardware resource.SOLUTION: A portable electronic device includes a memory, an interface, and a processor. The memory stores encryption information including an encryption algorithm. The interface communicates with an information processing device. The processor generates a random number. In addition, the interface transmits the encryption information to the information processing device, and receives a public key transmitted from the information processing device out of the public key and a secret key generated on the basis of the encryption algorithm. The processor generates an encryption random number from the random number through encryption processing based on the public key. The interface transmits the encryption random number to the information processing device. The processor generates a session key used for communication with the information processing device on the basis of the random number.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] FIELD Embodiments of the present invention relate to a portable electronic device, an information processing device, an information processing system, and an information processing method. [Background technology]

[0002] Security devices such as IC cards equipped with an IC (Integrated Circuit) chip have become widespread and are used as credit cards and IC passports. IC cards are called portable electronic devices because they are carried by users.

[0003] For example, each time an ePassport and a reader generate an elliptic curve key, exchange their public keys, and generate a session key for encrypting subsequent processing and communication. This session key is used to ensure confidentiality and integrity, and is used not only for encryption but also for generating authenticators. In a passport, the session keys for encryption and authenticators are generated and shared at the same time. In this method, only the public keys are exchanged, making it extremely difficult to identify the session key. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2022-537733 [Patent Document 2] International Publication No. 2021 / 029173 [Patent Document 3] Patent No. 7004654 Summary of the Invention [Problem to be solved by the invention]

[0005] With the advent of quantum computers, it is becoming necessary to transition to cryptography that is difficult to calculate with quantum computers (Post Quantum Cryptography: PQC). Under such circumstances, although security devices such as IC cards are very secure, compared to reading devices, their volatile and non-volatile memories are small and the calculation speed of their CPUs (Central Processing Units) is not sufficient to mount PQC. In other words, the hardware resources of IC cards are a hurdle to mounting PQC. There is a demand for technology that enables the mounting of specified cryptographic algorithms such as PQC on such devices with limited hardware resources.

[0006] An object of the present invention is to provide a portable electronic device, an information processing device, an information processing system, and an information processing method that enable a predetermined encryption algorithm to be installed using limited hardware resources. [Means for solving the problem]

[0007] A portable electronic device according to an embodiment includes a memory, an interface, and a processor. The memory stores cryptographic information including a cryptographic algorithm. The interface communicates with an information processing device. The processor generates a random number. The interface also transmits the cryptographic information to the information processing device, and receives the public key transmitted from the information processing device out of a public key and a private key generated based on the cryptographic algorithm. The processor generates an encrypted random number from the random number by encryption processing based on the public key. The interface transmits the encrypted random number to the information processing device. The processor generates a session key to be used for communication with the information processing device based on the random number. [Brief description of the drawings]

[0008] [Figure 1]FIG. 1 is a block diagram showing an example of an information processing system including an IC card as a portable electronic device according to an embodiment, and an IC card processing device as an information processing device that communicates with the IC card. [Diagram 2] FIG. 2 is a block diagram illustrating an example of the configuration of an IC card according to the embodiment. [Diagram 3] FIG. 3 is a diagram showing a first example of a session key sharing process sequence according to the embodiment. [Figure 4] FIG. 4 is a diagram showing a second example of a session key sharing process sequence according to the embodiment. [Diagram 5] FIG. 5 is a diagram showing a third example of a session key sharing process sequence according to the embodiment. [Figure 6] FIG. 6 is a diagram showing a fourth example of a session key sharing process sequence according to the embodiment. [Figure 7] FIG. 7 is a diagram showing a fifth example of a session key sharing process sequence according to the embodiment. [Figure 8] FIG. 8 is a diagram showing a sixth example of a session key sharing process sequence according to the embodiment. [Figure 9] Figure 9 is an example of Algorithm 1 of the PQC standard (Kyber). [Figure 10] Figure 10 is an example of Algorithm 2 of the PQC standard (Kyber). DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 is a block diagram showing an example of an information processing system including an IC card as a portable electronic device according to an embodiment, and an IC card processing device as an information processing device that communicates with the IC card. 1, the information processing system includes an IC card processing device 1 and an IC card 2. The IC card processing device 1 is a higher-level device that supplies commands to the IC card 2 and receives responses from the IC card 2.

[0010] In the exemplary configuration shown in FIG. 1, the IC card processing device 1 includes a CPU (Central Processing Unit) 11, a display 12, an operation unit 13, a card reader / writer 14, an OCR (Optical Character Recognition or Optical Character Reader) 15, and a storage unit 16.

[0011] The CPU 11 is a processor that controls the overall operation of the IC card processing device 1. The CPU 11 performs various processes based on the control programs and control data stored in the storage unit 16. For example, the CPU 11 executes a program stored in a memory such as the storage unit 16 to control the operation of the IC card processing device 1 or to perform various processes according to the operating mode of the IC card processing device 1. Note that some of the various functions may be realized by a hardware circuit. In this case, the CPU 11 controls the functions executed by the hardware circuit.

[0012] For example, the CPU 11 has a function of acquiring encryption information transmitted from the IC card 2 via the card reader / writer 14, and generating a public key (Pub Key) and a secret key (Sec Key) that are a PQC key pair based on the PQC encryption algorithm and key length included in the encryption information. The CPU 11 also has a function of transmitting various data such as a public key or an encrypted public key to the IC card 2 via the card reader / writer 14. The CPU 11 also has a function of encrypting various data such as a public key to be transmitted to the IC card 2 via the card reader / writer 14. The CPU 11 also has a function of decrypting various encrypted data such as an encrypted random number transmitted from the IC card 2 via the card reader / writer 14. The CPU 11 also has a function of generating a session key, etc. based on the decrypted random number. The CPU 11 may also operate based on an input from the operation unit 13 via the card reader / writer 14. For example, the CPU 11 transmits a write command including data input via the operation unit 13 to the IC card 2, thereby requesting the IC card 2 to write the data. In this embodiment, a case where the PQC encryption algorithm is implemented will be described, but the encryption algorithm is not limited to the PQC encryption algorithm, and the mechanism of this embodiment can be applied to any predetermined encryption algorithm.

[0013] The display 12 is a display device that displays various information under the control of the CPU 11. The display 12 is, for example, a liquid crystal monitor.

[0014] Various operation instructions and data are input to the operation unit 13 by a user of the IC card processing device 1. The operation unit 13 transmits the input operation instructions and data to the CPU 11. The operation unit 13 is, for example, a keyboard, a numeric keypad, or a touch panel.

[0015] The card reader / writer 14 is an interface (second interface) that communicates with the IC card 2. The card reader / writer 14 is configured by an interface that complies with a predetermined communication protocol of the IC card 2, etc.

[0016] For example, when the IC card 2 is a contact type IC card, the card reader / writer 14 complies with, for example, ISO / IEC 7816 and is composed of a contact unit for physically and electrically connecting to the contact unit of the IC card 2. When the IC card 2 is a non-contact type IC card, the card reader / writer 14 complies with, for example, ISO / IEC 14443 and is composed of an antenna for wireless communication with the IC card 2, a communication control unit, and the like.

[0017] Furthermore, if the IC card 2 is a dual card that supports both the contact type and the contactless type, the card reader / writer 14 of the IC card processing device 1 is configured to support the dual card. That is, the card reader / writer 14 is configured with a communication control unit and a contact unit for physically and electrically contacting the communication unit 25 of the IC card 2 to transmit and receive signals, and a communication control unit such as a modulation / demodulation circuit for wireless communication with the communication unit 25 of the IC card 2, and an antenna.

[0018] Furthermore, the card reader / writer 14 performs power supply, clock supply, reset control, and data transmission / reception for the IC card 2. For example, the card reader / writer 14 activates (starts up) the IC card 2 under the control of the CPU 11, transmits various commands, and receives responses to the transmitted commands.

[0019] The OCR 15 is an interface (external interface) that acquires information from the IC card 2. Optically readable information, such as a combination of letters, numbers, and symbols, a barcode, or a QR code (registered trademark), is printed on the IC card 2, and the OCR 15 optically reads this information and outputs the read result to the CPU 11. For example, the CPU 11 generates a random number from the encrypted random number by performing a decryption process based on the read result.

[0020] The IC card processing device 1 includes a card reader / writer 14 and an OCR 15, and obtains information from the IC card 2 via these two independent paths.

[0021] The storage unit 16 is equipped with non-volatile and volatile memory. The non-volatile memory stores control programs and control data in advance, while the volatile memory temporarily stores data being processed by the CPU 21, and functions as a receiving buffer, a calculation buffer, and a sending buffer.

[0022] Next, the IC card 2 will be described. The IC card 2 is activated and put into an operable state by receiving power and other supplies from a higher-level device such as the IC card processing device 1. For example, when the IC card 2 is connected to the IC card processing device 1 by contact-type communication, that is, when the IC card 2 is configured as a contact-type IC card, the IC card 2 is activated by receiving operating power and an operating clock from the IC card processing device 1 via a contact unit serving as a communication interface.

[0023] In addition, when the IC card 2 is connected to the IC card processing device 1 via a contactless communication method, that is, when the IC card 2 is configured as a contactless IC card, the IC card 2 receives radio waves from the IC card processing device 1 via an antenna and a modulation / demodulation circuit as a communication interface, and activates itself by generating operating power and an operating clock from the radio waves using the power supply unit.

[0024] The IC card 2 also has a Machine Readable Zone (MRZ) 20 on one or both sides of the card, and the MRZ includes optically readable printed information, such as a combination of letters, numbers and symbols, a barcode, or a QR code.

[0025] Next, a configuration example of the IC card 2 will be described. FIG. 2 is a block diagram illustrating an example of the configuration of an IC card according to the embodiment. The IC card 2 has a card-shaped main body C made of plastic or the like. The IC card 2 has a module M built into the main body C. The module M is formed integrally with one or more IC chips Ca and an external interface for communication in a connected state, and is embedded in the main body C of the IC card 2. As shown in Fig. 2, the module M of the IC card 2 includes a CPU 21, a ROM 22, a RAM 23, an NVM 24, and a communication unit 25. These units are connected to each other via a data bus.

[0026] The CPU 21 is a processor that functions as a control unit that controls the entire IC card 2. The CPU 21 performs various processes based on the control programs and control data stored in the ROM 22 or the NVM 24. For example, the CPU 21 executes a program stored in the ROM 22 to control the operation of the IC card 2 or to perform various processes according to the operating mode of the IC card 2. Note that some of the various functions may be realized by a hardware circuit. In this case, the CPU 21 controls the functions executed by the hardware circuit.

[0027] For example, the CPU 21 has a function of reading out encryption information from the ROM 22, and transmitting the encryption information including the PQC encryption algorithm and key length supported by the IC card 2 to the IC card processing device 1 via the communication unit 25. The CPU 21 also has a function of generating an encrypted random number from a random number by encryption processing based on a public key transmitted from the IC card processing device 1. The CPU 21 also has a function of transmitting the encrypted random number to the IC card processing device 1 via the communication unit 25. The CPU 21 also has a function of generating a session key, etc. based on the random number.

[0028] The ROM 22 is a non-volatile memory that stores control programs, control data, encryption information, identification information, and the like in advance. The ROM 22 is incorporated into the IC card 2 in a state in which the control programs and control data are stored in the manufacturing stage. That is, the programs, control data, encryption information, and identification information stored in the ROM 22 are incorporated in advance according to the specifications of the IC card 2. The ROM 22 may be configured with a flash memory, and may be written in the manufacturing stage, or may be written and rewritten in a subsequent phase. Information regarding encryption may be written in the manufacturing stage, or may be written and updated in a subsequent phase.

[0029] The encryption information includes the PQC encryption algorithm and key length supported by the IC card 2. The identification information is unique information capable of identifying the IC card 2. The MRZ20 includes the identification information as optically readable printed information such as a combination of letters, numbers, and symbols, a barcode, or a QR code. The MRZ20 may include all of the identification information or may include a part of the identification information. The MRZ20 may include the identification information in a form other than printing. For example, if the identification information is a combination of letters, numbers, and symbols, the MRZ20 may include embossing corresponding to the identification information.

[0030] The RAM 23 is a volatile memory. The RAM 23 temporarily stores data being processed by the CPU 21. For example, the RAM 23 includes a receiving buffer, a calculation buffer, a transmission buffer, and the like. The receiving buffer holds data transmitted from the IC card processing device 1 and received via the communication unit 25. The calculation buffer holds temporary results for the CPU 21 to perform various calculations. The transmission buffer holds data to be transmitted to the IC card processing device 1 via the communication unit 25.

[0031] The NVM 24 is configured by a non-volatile memory such as an EEPROM or a flash ROM to which data can be written and rewritten. The NVM 24 stores control programs, applications, and various data according to the operational use of the IC card 2. For example, program files and data files are created in the NVM 24. The control programs and various data are written in each created file. The NVM 24 may also store encryption information and identification information.

[0032] The communication unit 25 communicates with the card reader / writer 14 of the IC card processing device 1 and is composed of an interface (first interface) corresponding to a predetermined communication protocol, etc. When the IC card 2 is realized as a contact-type IC card, the communication unit 25 is composed of a communication control unit and a contact unit for physically and electrically contacting the card reader / writer 14 of the IC card processing device 1 to transmit and receive signals. When the IC card 2 is realized as a non-contact-type IC card, the communication unit 25 is composed of a communication control unit such as a modulation / demodulation circuit for wireless communication with the card reader / writer 14 of the IC card processing device 1 and an antenna.

[0033] In addition, if the IC card 2 is a dual card that supports both contact and contactless types, the communication unit 25 is composed of a communication control unit and a contact unit for physically and electrically contacting the card reader / writer 14 of the IC card processing device 1 to send and receive signals, and a communication control unit such as a modulation / demodulation circuit and an antenna for performing wireless communication with the card reader / writer 14 of the IC card processing device 1.

[0034] The session key sharing process according to the embodiment will be described below. In the IC card processing system according to the embodiment, the IC card processing device 1 generates a new public key and private key, which are a PQC key pair, every time based on the PQC encryption algorithm and key length transmitted from the IC card 2, and transmits the public key to the IC card 2. This eliminates the need to store a fixed key in the IC card 2, making it possible to reduce consumption of non-volatile memory. The IC card 2 generates a random number, generates an encrypted random number from the random number by encryption processing based on the received public key, and transmits the encrypted random number to the IC card processing device 1. The IC card 2 generates a session key from the random number, and the IC card processing device 1 generates a random number from the encrypted random number by decryption processing based on the private key, generates a session key from the random number, and the session key is shared between the IC card processing device 1 and the IC card 2. The IC card processing device 1 may transmit information for generating a public key to the IC card 2, and the IC card 2 may generate the public key based on the received information. In other words, the IC card processing device 1 is not necessarily limited to a method of transmitting the public key itself to the IC card 2, as long as it can share the generated public key with the IC card 2.

[0035] Since the IC card processing device 1 has more hardware resources than the IC card 2, the IC card processing device 1 can handle PQC as an information processing system by taking charge of the process of generating a PQC key pair. Also, the IC card 2 does not need to store a fixed PQC key pair, reducing the load on memory. Furthermore, since a new PQC key pair is generated each time, the risk of the private key being identified can be reduced.

[0036] Next, the session key sharing process according to the embodiment will be described in detail. <Concept 1> 3 is a diagram showing a first example of a session key sharing process sequence according to the embodiment. The first example described here is a higher-level concept than the second and subsequent examples described later. In order to encrypt communication between the IC card processing device 1 and the IC card 2 using a session key, the CPU 21 of the IC card 2 reads out encryption information from the ROM 22. The encryption information includes a PQC encryption algorithm and a key length supported by the IC card 2. The CPU 21 controls so as to transmit the read encryption information to the IC card processing device 1, and the communication unit 25 transmits the encryption information to the IC card processing device 1 (ST101).

[0037] The card reader / writer 14 of the IC card processing device 1 receives the encryption information. The CPU 11 generates a public key and a private key based on the PQC encryption algorithm and key length included in the received encryption information. That is, the CPU 11 generates a public key and a private key that are a PQC key pair of the PQC encryption algorithm and key length included in the received encryption information (ST102).

[0038] The CPU 11 performs control so as to transmit the public key to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST103).

[0039] The communication unit 25 receives the public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received public key.

[0040] The CPU 21 generates a random number, and generates an encrypted random number from the random number by encryption processing based on the acquired public key. For example, the CPU 21 generates an encrypted random number from the random number by encryption processing based on the public key (ST104). Alternatively, the CPU 21 generates an encrypted random number from the random number and the identification information by encryption processing based on the public key.

[0041] The CPU 21 controls the communication unit 25 to transmit the encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the encrypted random number to the IC card processing device 1 (ST105).

[0042] The CPU 21 generates a session key based on the random number (ST106). The CPU 21 encrypts data to be transmitted in the subsequent processes using the session key, and the communication unit 25 transmits the data encrypted using the session key.

[0043] The card reader / writer 14 of the IC card processing device 1 receives the encrypted random number. The CPU 11 generates a random number from the encrypted random number by decryption processing based on a private key (ST107). Alternatively, the CPU 11 generates a random number and identification information from the encrypted random number by decryption processing based on a private key.

[0044] The CPU 11 generates a session key based on the random number (ST108). The CPU 11 encrypts data to be transmitted in the subsequent processes using the session key, and the card reader / writer 14 transmits the data encrypted using the session key.

[0045] For example, the IC card 2 encrypts data received from the IC card processing device 1 with the session key and transmits the encrypted data to the IC card processing device 1. The IC card processing device 1 encrypts data received from the IC card 2 with the session key and transmits the encrypted data to the IC card 2. The IC card 2 and the IC card processing device 1 verify whether the session key has been generated correctly based on the received encrypted data.

[0046] The above process provides the following effects. Multiple PQC methods have become standard, and it is possible that different methods may be implemented depending on the issuer (e.g., issuing country) of the IC card 2 (e.g., an IC passport); however, with the information processing system, it is possible to absorb differences in IC passport methods based on the PQC encryption algorithm and key length contained in the encryption information transmitted from the IC card 2.

[0047] Furthermore, according to the information processing system, the public key is used disposably, which alleviates concerns about the long-term use of fixed keys.

[0048] <Concept 2-1> 4 is a diagram showing a second example of a session key sharing process sequence according to the embodiment. Note that the second example described here is a subordinate concept to the first example described above, and the description will focus on the differences and omit the description of the common parts as appropriate.

[0049] An operator of the IC card processing device 1 holds the reading section of the OCR 15 over the MRZ 20 of the IC card 2, or holds the MRZ 20 of the IC card 2 over the reading section of the OCR 15. This causes the OCR 15 to read the identification information from the MRZ 20 of the IC card 2. The CPU 11 acquires the read identification information (ST201). In FIG. 4, the identification information read from the MRZ 20 and the identification information read from the ROM 22 are denoted as MRZ.

[0050] The CPU 21 of the IC card 2 reads out the encryption information from the ROM 22, and performs control so as to transmit the read encryption information to the IC card processing device 1, and the communication unit 25 transmits the encryption information to the IC card processing device 1 (ST202).

[0051] The card reader / writer 14 of the IC card processing device 1 receives the encrypted information.

[0052] The CPU 21 generates a first random number (RND) (ST203), reads the identification information (MRZ) from the ROM 22, and encrypts the first random number with the identification information (MRZ) (E(RND, MRZ)). That is, the CPU 21 generates a first encrypted random number from the first random number by encryption processing based on the read identification information (MRZ) (ST204).

[0053] The CPU 21 controls so as to transmit the generated first encrypted random number (Encrypted RND) to the IC card processing device 1, and the communication unit 25 transmits the first encrypted random number to the IC card processing device 1 (ST205).

[0054] The card reader / writer 14 receives the first encrypted random number.

[0055] The CPU 11 decrypts (D(RND, MRZ)) the first encrypted random number acquired via the card reader / writer 14 by the identification information (MRZ) acquired from the IC card 2 via the OCR 15. That is, the CPU 11 generates a first random number from the first encrypted random number by a decryption process based on the acquired identification information (MRZ) (ST206).

[0056] Furthermore, the CPU 11 generates a public key and a private key based on the PQC encryption algorithm and key length included in the received encryption information. That is, the CPU 11 generates a public key and a private key that are a PQC key pair of the PQC encryption algorithm and key length included in the received encryption information (ST207).

[0057] The CPU 11 performs control so as to transmit the public key to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST209).

[0058] The communication unit 25 receives the public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received public key.

[0059] The CPU 21 generates a second random number, and generates a second encrypted random number from the second random number by encryption processing based on the obtained public key (ST211).

[0060] The CPU 21 controls the communication unit 25 to transmit the second encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the second encrypted random number to the IC card processing device 1 (ST212).

[0061] Furthermore, CPU 21 generates a session key based on the first and second random numbers (ST213). CPU 21 encrypts data to be transmitted in the subsequent processes using the session key, and communication unit 25 transmits the data encrypted using the session key.

[0062] Furthermore, the CPU 21 generates an encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST214).

[0063] The card reader / writer 14 receives the second encrypted random number. The CPU 11 generates a second random number from the second encrypted random number by decryption processing based on the private key (ST215).

[0064] CPU 11 generates a session key based on the first and second random numbers (ST216). CPU 11 encrypts data to be transmitted in the subsequent processes using the session key, and card reader / writer 14 transmits the data encrypted using the session key.

[0065] Furthermore, the CPU 21 generates an encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST217).

[0066] The above process provides the following effects. According to the information processing system, by using both the identification information read via OCR 15 and the encryption information read via the card reader / writer 14, the final session key can be protected as long as either one of the pieces of information is secure.

[0067] In addition, according to the information processing system, by disposing of the public key, even if an attack on the public key is discovered, security can be ensured until the public key can be decrypted instantly before a session is established.

[0068] <Concept 2-2> 5 is a diagram showing a third example of a session key sharing process sequence according to the embodiment. Note that the third example described here is a modification of the second example described above, and the following description will focus on the differences and omit the description of the common parts as appropriate.

[0069] As described in the second example, the processes of ST201 to ST207 are executed, and CPU 11 generates an encrypted public key from the public key by encryption processing based on the first random number (ST208a). For example, CPU 11 uses AES (Advanced Encryption Standard) to encrypt the public key using the first random number as a key.

[0070] The CPU 11 performs control so as to transmit the encrypted public key to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST209).

[0071] The communication unit 25 receives the encrypted public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received encrypted public key.

[0072] The CPU 21 generates a public key from the encrypted public key by decryption processing based on the first random number (ST210a). For example, the CPU 21 uses AES to extract the public key from the encrypted public key using the first random number as a key.

[0073] The CPU 21 generates a second random number, and generates a second encrypted random number from the second random number by encryption processing based on the obtained public key (ST211).

[0074] The CPU 21 controls the communication unit 25 to transmit the second encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the second encrypted random number to the IC card processing device 1 (ST212).

[0075] Furthermore, CPU 21 generates a session key based on the first and second random numbers (ST213). CPU 21 encrypts data to be transmitted in the subsequent processes using the session key, and communication unit 25 transmits the data encrypted using the session key.

[0076] Furthermore, the CPU 21 generates an encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST214).

[0077] The card reader / writer 14 receives the second encrypted random number. The CPU 11 generates a second random number from the second encrypted random number by decryption processing based on the private key (ST215).

[0078] CPU 11 generates a session key based on the first and second random numbers (ST216). CPU 11 encrypts data to be transmitted in the subsequent processes using the session key, and card reader / writer 14 transmits the data encrypted using the session key.

[0079] Furthermore, the CPU 21 generates an encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST217).

[0080] The above process provides the following effects. Unless the first encrypted random number is decrypted, a third party cannot know the public key encrypted with the first random number. Therefore, the information processing system provides no clues for decryption, thereby improving security.

[0081] <Concept 2-3> 6 is a diagram showing a fourth example of a session key sharing process sequence according to an embodiment. Note that the fourth example is a modification of the third example described above, and the following description will focus on the differences and omit the description of the common parts as appropriate.

[0082] As explained in the second example, the processes in ST201 to ST207 are executed, and the CPU 11 generates an encrypted public key from the public key by encryption processing based on the MRZ (ST208b).

[0083] The CPU 11 performs control so as to transmit the encrypted public key to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST209).

[0084] The communication unit 25 receives the encrypted public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received encrypted public key.

[0085] The CPU 21 generates a public key from the encrypted public key by decryption processing based on the MRZ (ST210b).

[0086] Thereafter, the processes in ST212 to ST217 are executed as described in the second example.

[0087] <Concept 3-1> 7 is a diagram showing a fifth example of a session key sharing process sequence according to the embodiment. Note that the fifth example is a modification of the second to fourth examples described above, and the following description will focus on the differences and omit the description of the common parts as appropriate.

[0088] In the fifth example, the PQC standard method (Kyber) is used. Figure 9 is an example of Algorithm 1 of the PQC standard method (Kyber), and Figure 10 is an example of Algorithm 2 of the PQC standard method (Kyber).

[0089] Since PQC has a large data (public key) size, the amount of data communication and the calculation time increase. Therefore, in the fifth example, seed information for generating a public key is shared in advance to reduce the amount of communication, and the IC card processing device 1 performs a pre-calculation to generate part of the public key. That is, the storage unit 16 of the IC card processing device 1 stores part or all of the PQC standard method, which is the seed information for generating a public key, and the ROM 22 or NVM 24 of the IC card 2 stores part or all of the PQC standard method.

[0090] As shown in Fig. 7, an operator of the IC card processing device 1 holds the reading unit of the OCR 15 over the MRZ 20 of the IC card 2, or holds the MRZ 20 of the IC card 2 over the reading unit of the OCR 15. This causes the OCR 15 to read the identification information from the MRZ 20 of the IC card 2. The CPU 11 acquires the read identification information (ST301). In Fig. 7, the identification information read from the MRZ 20 and the identification information read from the ROM 22 are denoted as MRZ.

[0091] The CPU 21 generates a first random number (RND) (ST302), reads the identification information (MRZ) from the ROM 22, and encrypts the first random number with the identification information (MRZ) (E(RND, MRZ)). That is, the CPU 21 generates a first encrypted random number from the first random number by encryption processing based on the read identification information (MRZ) (ST303).

[0092] The CPU 21 controls so as to transmit the generated first encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the first encrypted random number to the IC card processing device 1 (ST304).

[0093] The card reader / writer 14 receives the first encrypted random number.

[0094] The CPU 11 decrypts (D(RND, MRZ)) the first encrypted random number acquired via the card reader / writer 14 by the identification information (MRZ) acquired from the IC card 2 via the OCR 15. That is, the CPU 11 generates a first random number from the first encrypted random number by a decryption process based on the acquired identification information (MRZ) (ST305).

[0095] In addition, the CPU 11 generates a Kyber key pair, a public key (pk=(t, ρ)) and a private key (sk=s), based on the PQC standard scheme (RND=ρ (part of Kyber’s public key and the source of generation of matrix A)) stored in the memory unit 16 (ST306).

[0096] CPU 11 sets plaintext t (part of the public key) (ST307) and controls so as to transmit t to IC card 2, and card reader / writer 14 transmits t to IC card 2 (ST308). Alternatively, CPU 11 encrypts t (ST307) and controls so as to transmit the encrypted t to IC card 2, and card reader / writer 14 transmits the encrypted t to IC card 2 (ST308).

[0097] The communication unit 25 receives t or the encrypted t transmitted from the IC card processing device 1, and the CPU 21 acquires the received t or the encrypted t.

[0098] When the CPU 21 obtains the encrypted t, it decrypts t from the encrypted t based on the PQC standard method (RND=ρ (part of Kyber’s public key and the source of generation of matrix A)) stored in the ROM 22 or NVM 22 (ST309).

[0099] Furthermore, the CPU 21 generates a second random number, and generates a second encrypted random number from the second random number by encryption processing based on the public key (ST310).

[0100] The CPU 21 controls the communication unit 25 to transmit the second encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the second encrypted random number to the IC card processing device 1 (ST311).

[0101] Further, CPU 21 generates a session key based on the first and second random numbers (ST312). CPU 21 encrypts data to be transmitted in the subsequent processes using the session key, and communication unit 25 transmits the data encrypted using the session key.

[0102] Furthermore, the CPU 21 generates an encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST313A).

[0103] The card reader / writer 14 receives the second encrypted random number. The CPU 11 generates a second random number from the second encrypted random number by decryption processing based on the private key (sk=s) (ST314).

[0104] CPU 11 generates a session key based on the first and second random numbers (ST315). CPU 11 encrypts data to be transmitted in the subsequent processes using the session key, and card reader / writer 14 transmits the data encrypted using the session key.

[0105] Furthermore, the CPU 21 generates an encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST316A).

[0106] The above process provides the following effects. According to the information processing system, a third party cannot know ρ, which is a part of the public key, as in the case of introducing the first encrypted random number. Therefore, according to the information processing system, it is possible to enhance security without providing any clues for decryption. Furthermore, according to the information processing system, since it is not necessary to transmit or receive ρ, which is a part of the public key, it is possible to reduce the data size of communication. Furthermore, after transmitting the first encrypted random number (RND=ρ) to the reader, the IC card 2 can generate a ciphertext in advance using ρ during the waiting time.

[0107] <Concept 3-2> 8 is a diagram showing a sixth example of a session key sharing process sequence according to the embodiment. Note that the sixth example is a modification of the fifth example described above, and the following description will focus on the differences and omit the description of the common parts as appropriate.

[0108] As explained in the fifth example, the processes of ST301 to ST312, ST314, and ST315 are executed.

[0109] Meanwhile, the CPU 21 generates an encrypted MRZ (first authentication data) from the MRZ by encryption processing based on the second random number (ST316B).

[0110] The card reader / writer 14 transmits the first authentication data to the IC card 2 (ST317).

[0111] Furthermore, the CPU 21 generates an encrypted public key (second authentication data) from the public key by encryption processing based on the second random number (ST313B).

[0112] The communication section 25 transmits the second authentication data to the IC card processing device 1 (ST318).

[0113] According to the information processing systems according to the first to fifth examples described above, it is possible to provide a portable electronic device, an information processing device, an information processing system, and an information processing method that enable the incorporation of PQC with limited hardware resources.

[0114] Public key variations include the following: (1) The IC card processing device 1 transmits the public key in plain text. (2) The IC card processing device 1 encrypts the public key with the first random number and transmits the encrypted public key. (3) The IC card processing device 1 encrypts the public key with the identification information read from the MRZ 20, and transmits the encrypted public key. (4) The IC card processing device 1 generates ρ, generates t from ρ, and transmits t in plain text. (5) The IC card processing device 1 generates ρ, generates t from ρ, encrypts t, and transmits the encrypted t. (6) The IC card 2 generates ρ and a first random number, and transmits both ρ and the first random number. The IC card processing device 1 generates t from ρ. (7) The IC card 2 generates ρ, sets ρ as a first random number, and transmits ρ. The IC card processing device 1 generates t from ρ. (8) The IC card 2 does not set the first random number itself to ρ, but hashes the first random number to ρ. (9) The IC card processing device 1 and the IC card 2 use the second random number as a session key. (10) The IC card processing device 1 and the IC card 2 generate a session key from the exclusive OR (XOR) of the first random number and the second random number.

[0115] Variations in session key verification methods include the following: (1) The IC card processing device 1 and the IC card 2 exchange authentication data obtained by encrypting the identification information read from the MRZ 20 with a second random number, and verify the session key. (2) The IC card processing device 1 and the IC card 2 encrypt the identification information read from the MRZ 20 with the result of performing an exclusive OR on the first random number and the second random number, and verify the session key.

[0116] The proposed variations of cryptographic algorithms and key lengths are as follows: (1) The IC card 2 presents encryption information including an encryption algorithm and a key length together with the MRZ 20. For example, the MRZ 20 is optically read by the OCR 15 of the IC card processing device 1, and the encryption information is received by the card reader / writer 14 of the IC card processing device 1. (2) The IC card 2 presents encryption information including an encryption algorithm and a key length together with the first random number. For example, the IC card 2 encrypts and presents information including the first random number and the encryption information. (3) The IC card 2 presents cryptographic information including a cryptographic algorithm and a key length in plain text, in addition to the first random number.

[0117] In the above description, the IC card processing device 1 acquires the identification information via the OCR 15, but the present invention is not limited to this. For example, the communication unit 25 of the IC card 2 may transmit the identification information stored in the ROM 22 or the like, and the card reader / writer 14 of the IC card processing device 1 may receive the identification information transmitted from the IC card 2. In this case, the CPU 21 of the IC card 2 may realize transmission and reception of the encrypted random number and the plain text or the encrypted key, and transmission of the identification information, using different communication methods (contact communication and non-contact communication).

[0118] For example, the communication unit 25 of the IC card 2 transmits and receives encrypted random numbers and plain text or encrypted keys by contact communication (a communication control unit and a contact unit for transmitting and receiving signals by physical and electrical contact) and transmits identification information by non-contact communication (a communication control unit such as a modulation / demodulation circuit and an antenna for wireless communication). On the other hand, the card reader / writer 14 of the IC card processing device 1 transmits and receives encrypted random numbers and plain text or encrypted keys by contact communication and receives identification information by non-contact communication.

[0119] Alternatively, the communication unit 25 of the IC card 2 transmits identification information by contact communication, and transmits and receives encrypted random numbers and plain text or encrypted keys by contactless communication. On the other hand, the card reader / writer 14 of the IC card processing device 1 receives identification information by contact communication, and transmits and receives encrypted random numbers and plain text or encrypted keys by contactless communication.

[0120] As described above, the information processing system according to the embodiment realizes transmission and reception of random numbers and keys and transmission and reception of identification information using different communication methods. This makes it possible to significantly reduce the risk that random numbers and keys and identification information are stolen at the same time, thereby improving security.

[0121] The program according to this embodiment may be transferred in a state stored in electronic devices such as the IC card processing device 1 and the IC card 2, or in a state not stored in the electronic device. In the latter case, the program may be transferred via a network, or in a state stored in a storage medium. The storage medium is a non-transient tangible medium. The storage medium is a computer-readable medium. The storage medium may be an optical disk, a memory card, or any other medium capable of storing a program and being readable by a computer, and the form of the storage medium is not important. The electronic device downloads the program transferred (provided) via a network and installs it in memory, or reads the program from the storage medium and installs it in memory.

[0122] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0123] 1...Card processing device 2. Cards 11...CPU 12…Display 13...Operation unit 14...Card reader / writer 16...Storage section 20…MRZ 21...CPU 22...ROM 23…RAM 24…NVM 25…Communications Department C…Main body Ca…chip

Claims

1. a memory for storing cryptographic information including a cryptographic algorithm; An interface for communicating with an information processing device; a processor for generating random numbers; the interface transmits the cryptographic information to the information processing device, and receives the public key transmitted from the information processing device out of a public key and a private key generated based on the cryptographic algorithm; The processor generates an encrypted random number from the random number by encryption processing based on the public key; The interface transmits the encrypted random number to the information processing device; The portable electronic device, wherein the processor generates a session key for use in communication with the information processing device based on the random number.

2. The cryptographic algorithm is a cryptographic algorithm using quantum-computer-resistant cryptography.

2. The portable electronic device of claim 1.

3. The portable electronic device of claim 1, wherein the interface transmits the encrypted random number to the information processing device so that the random number is generated from the encrypted random number by a decryption process based on the private key, and the session key to be used for communication with the portable electronic device is generated based on the random number.

4. The cryptographic information includes a key length, The portable electronic device of claim 1 , wherein the public key and the private key are generated based on the cryptographic algorithm and the key length included in the cryptographic information.

5. the memory stores identification information capable of identifying the portable electronic device; The processor generates a first random number, and generates a first encrypted random number from the first random number by encryption processing based on the identification information; The interface transmits the first encrypted random number to the information processing device and receives the public key transmitted from the information processing device; The processor generates a second random number and generates a second encrypted random number from the second random number by encryption processing based on the public key; The interface transmits the second encrypted random number to the information processing device; The portable electronic device of claim 1 , wherein the processor generates the session key based on the first and second random numbers.

6. The portable electronic device of claim 5, wherein the interface transmits the first and second encrypted random numbers to the information processing device so that, in the information processing device, the first random number is generated from the first encrypted random number by a decryption process based on the identification information acquired from the portable electronic device, the second random number is generated from the second encrypted random number by a decryption process based on the private key, and the session key is generated based on the first and second random numbers.

7. the information processing device generates an encrypted public key from the public key by encryption processing based on the first random number, and transmits the encrypted public key in place of the public key; The interface receives the encrypted public key transmitted from the information processing device, The portable electronic device of claim 5 , wherein the processor generates the public key from the encrypted public key by a decryption process based on the first random number.

8. A readable zone on which the identification information is printed is provided, The portable electronic device of claim 5, wherein the information processing device acquires the identification information from the readable zone via an optically readable external interface, and generates the first random number from the first encrypted random number by a decryption process based on the identification information.

9. The interface is an interface that communicates with the information processing device by contact or non-contact based on a predetermined communication protocol, The processor transmits the identification information to the information processing device via the interface; The portable electronic device according to claim 5 , wherein the information processing device acquires the identification information via the interface, and generates the first random number from the first encrypted random number by a decryption process based on the identification information.

10. The interface includes: transmitting the identification information to the information processing device through contact communication; transmitting the first encrypted random number to the information processing device by non-contact communication, receiving the public key transmitted from the information processing device, and transmitting the second encrypted random number to the information processing device. Alternatively, the identification information is transmitted to the information processing device by the non-contact communication, The portable electronic device of claim 9 , wherein the contact communication transmits the first encrypted random number to the information processing device, receives the public key transmitted from the information processing device, and transmits the second encrypted random number to the information processing device.

11. an interface for communicating with the portable electronic device; a processor for generating a key; The interface receives cryptographic information transmitted from the portable electronic device; The processor generates a public key and a private key based on a cryptographic algorithm included in the cryptographic information; The interface transmits the public key to the portable electronic device, and receives an encrypted random number generated from a random number by an encryption process based on the public key in the portable electronic device; The processor generates the random number from the encrypted random number by a decryption process based on the private key, and generates a session key to be used for communication with the portable electronic device based on the random number.

12. An information processing system including a portable electronic device and an information processing device, The portable electronic device is a memory for storing cryptographic information including a cryptographic algorithm; a first interface for communicating with the information processing device; a processor for generating random numbers; the first interface transmits the cryptographic information to the information processing device, and receives the public key transmitted from the information processing device out of a public key and a private key generated based on the cryptographic algorithm; The processor generates an encrypted random number from the random number by encryption processing based on the public key; the first interface transmits the encrypted random number to the information processing device; the processor generates a session key to be used for communication with the information processing device based on the random number; The information processing device includes: a second interface for communicating with the portable electronic device; a second processor for generating a key; the second interface receives the cryptographic information transmitted from the portable electronic device; The second processor generates the public key and the private key based on the cryptographic algorithm included in the cryptographic information; the second interface transmits the public key to the portable electronic device and receives the encrypted random number generated from the random number by an encryption process based on the public key in the portable electronic device; The second processor generates the random number from the encrypted random number by a decryption process based on the private key, and generates the session key to be used for communication with the portable electronic device based on the random number.

13. An information processing method executed by a portable electronic device and an information processing device, comprising: The portable electronic device transmits cryptographic information including a cryptographic algorithm to the information processing device; the information processing device receives the encryption information transmitted from the portable electronic device, generates a public key and a private key based on the encryption algorithm included in the encryption information, and transmits the public key to the portable electronic device; the portable electronic device receives the public key transmitted from the information processing device, generates an encrypted random number from a random number by encryption processing based on the public key, transmits the encrypted random number to the information processing device, and generates a session key to be used for communication with the information processing device based on the random number; An information processing method in which the information processing device receives the encrypted random number transmitted from the portable electronic device, generates the random number from the encrypted random number by decryption processing based on the private key, and generates the session key to be used for communication with the portable electronic device based on the random number.

Images