Information processing devices, mobile devices and communication systems

Abstract

The objective of this invention is to update the session key. In this invention, a first secret is derived from a key arrangement using a first communication that includes sending or receiving commands or responses to a second communication that is faster than the first communication. A first session key associated with the first secret is then derived. This first session key is used for encryption or message authentication in the first communication. A second session key is received, sent, or derived using the first communication. This second session key is used for encryption or message authentication in the second communication. A third session key is received, sent, or derived using the first communication, and this third session key replaces the second session key. This technology can be applied, for example, to communication systems conforming to MIPI specifications.

Claims

1. An information processing apparatus, characterized in that: it comprises a protection unit for protecting a first communication and a second communication; the protection unit derives a first secret from a key arrangement using the first communication, derives a first session key associated with the first secret, and uses the first session key to protect the operation of the first communication; the protection unit receives a second session key using the first communication protected by the first session key, or derives a second secret from the key arrangement and derives a second session key associated with the second secret, and uses an initialization vector including a source ID value, a hypothetical channel or extended hypothetical channel value, a frame counter value or an append frame number value, and the received or derived second session key to protect the operation of the second communication.

2. The information processing apparatus of claim 1, wherein the second communication system sends or receives a frame containing an extended packet header and packet data, and the second communication system protected by the second session key: stores the first MAC value obtained by using the second session key to calculate at least a portion or all of the extended packet header and a portion or all of the packet data in the first extended packet footer at the end of the frame within the frame and sends or receives it.

3. The information processing apparatus of claim 2, wherein the second communication system protected by the second session key: stores the second MAC value obtained by using the second session key to calculate at least part or all of the embedded data stored in the packet data in the second extended packet footer of the embedded data and sends or receives it.

4. The information processing apparatus of claim 1, wherein the second communication system sends or receives a frame containing a packet header and packet data, and the second communication system protected by the second session key sends or receives a first MAC value obtained by using the second session key to calculate at least a portion of the packet data, and stores it in first embedded data stored in the packet data.

5. The information processing apparatus of claim 4, wherein the second communication system protected by the second session key: transmits or receives a second MAC value obtained by using the second session key to calculate at least a portion of the second embedded data stored in the packet data, stored in the second embedded data, wherein the frame includes: a frame start, the second embedded data, at least one of image data and user-defined data, the first embedded data, and a frame end, wherein the second embedded data is transmitted or received between the frame start and at least one of the image data and the user-defined data, and wherein the first embedded data is transmitted or received between the image data and the user-defined data and the frame end.

6. The information processing apparatus as described in claim 4, wherein the aforementioned frame includes an extended packet header.

7. The information processing apparatus of claim 1, wherein the second communication system sends or receives a column containing an extended packet header and packet data, and the second communication system protected by the second session key: stores the MAC value obtained by using the second session key to calculate at least a portion or all of the extended packet header and a portion or all of the packet data in the extended packet footer of the column and sends or receives it.

8. The information processing apparatus of claim 1, wherein the second communication system protected by the second session key: transmits or receives information related to the MAC mode protecting the second communication by storing it in an extended packet header protected by the second session key, or transmits or receives it by storing it in embedded data stored in packet data protected by the second session key.

9. The information processing apparatus of claim 8, wherein the second communication is transmitting or receiving a frame containing a frame start, and the protection unit selects one of at least two of the first MAC mode, the second MAC mode, and a non-MAC mode as the MAC mode for protecting at least part or all of the packet data in the frame until the frame start transmission is completed.

10. The information processing apparatus of claim 1, wherein the first communication protected by the first session key transmits or receives a first key ID representing the key slot number corresponding to the second session key, and the second communication protected by the second session key transmits or receives information related to the first key ID protected by the second session key, wherein the second communication is faster than the first communication, and the amount of data in the information related to the first key ID is smaller than that in the first key ID.

11. The information processing apparatus of claim 1, wherein the second communication system protected by the second session key: stores information related to the first key ID, which indicates that the second communication is protected by the second session key, in embedded data protected by the second session key and sends or receives such information.

12. The information processing apparatus of claim 11, wherein the protection unit receives a third session key using the first communication protected by the first session key, or derives a third secret from the key arrangement and derives a third session key associated with the third secret, wherein the third session key replaces the second session key and is used, and the second communication protected by the third session key stores information related to the second key ID, which indicates that the second communication is protected by the third session key, in embedded data protected by the third session key and sends or receives such information.

13. The information processing apparatus of claim 1, wherein the first communication system protected by the first session key: stores information related to the first key ID indicating that the second session key can be used for the second communication in a write command or read response protected by the first session key and sends or receives such information.

14. The information processing apparatus of claim 13, wherein the protection unit receives a third session key using the first communication protected by the first session key, or derives a third secret from the key arrangement and derives a third session key associated with the third secret, and the first communication protected by the first session key stores information related to a second key ID indicating that the third session key can be used for the second communication and sends or receives such information in a write command or read response protected by the first session key, and the third session key is used to replace the second session key.

15. The information processing apparatus of claim 1, wherein the protection unit receives a third session key by means of the first communication protected by the first session key, or derives a third secret from the key arrangement and derives a third session key associated with the third secret, and the second communication protected by the second session key is: specifying the start time of sending or receiving the third session key, and the third session key is used to replace the second session key.

16. The information processing apparatus of claim 1, wherein the protection unit uses the first communication receiving third session key protected by the first session key, or derives a third secret from the key arrangement and derives a third session key associated with the third secret, and the protection unit begins to use the third session key by replacing the second session key with a calculation of the MAC value for at least a portion of the embedded data.

17. The information processing apparatus of claim 1, wherein the protection unit receives a third session key using the first communication protected by the first session key, or derives a third secret from the key arrangement and derives a third session key associated with the third secret, wherein the second session key and the third session key are updated alternately.

18. A mobile device, characterized in that: it comprises a protection unit for protecting a first communication and a second communication; the protection unit derives a first secret from a key arrangement using the first communication, derives a first session key associated with the first secret, and uses the first session key to protect the operation of the first communication; the protection unit receives a second session key using the first communication protected by the first session key, or derives a second secret from the key arrangement and derives a second session key associated with the second secret, and uses an initialization vector including a source ID value, a hypothetical channel or extended hypothetical channel value, a frame counter value or an append frame number value, and the received or derived second session key to protect the operation of the second communication.

19. A communication system, characterized in that: it comprises a protection unit for protecting a first communication and a second communication; the protection unit derives a first secret from a key arrangement using the first communication, derives a first session key associated with the first secret, and uses the first session key to protect the operation of the first communication; the protection unit receives a second session key using the first communication protected by the first session key, or derives a second secret from the key arrangement and derives a second session key associated with the second secret, and uses an initialization vector including a source ID value, a hypothetical channel or extended hypothetical channel value, a frame counter value or an append frame number value, and the received or derived second session key to protect the operation of the second communication.

Images