Authenticated device, authentication system and authentication method

Abstract

To provide an authentication system with improved durability against malicious attacks.SOLUTION: An authenticated device comprises a memory for storing an original key set made of M-number of original keys identified by values of different key identifiers in advance. An authentication system stores an authentication identifier unique to the authentication system in advance and associated with a first key ID value identifying a first original key among the M-number of original keys, a first authentication key derived based on the authentication identifier and the first original key, and an electronic signature value used for verifying authenticity of the authentication identifier in advance. The authentication system sends the authentication identifier and the electronic signature value to the authenticated device. The authenticated device reads the first original key identified by the first key ID value from the memory when verification of the authentication identifier using the electronic signature value is succeeded, and derives a second authentication key the same as the first authentication key based on the first original key and the authentication identifier.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present disclosure relates to an authenticatee device, an authentication system, and an authentication method. [Background technology]

[0002] Many electronic devices are known that are used with replaceable parts connected to them. For example, an image forming apparatus can operate with various replaceable parts, such as cartridges containing toner or ink, process cartridges, conveyance rollers, or fixing units. If a replaceable part not intended for the design of an electronic device is connected to the electronic device, problems such as breakdown, malfunction, or degradation of output quality may occur. For this reason, some electronic devices have a mechanism for authenticating whether a replaceable part connected to the device is a genuine part.

[0003] Patent Document 1 discloses an example of a challenge-response authentication method. In the authentication method of Patent Document 1, an authentication chip of an image forming device has an authentication key table storing n authentication keys, each identified by n first identifiers, and an authenticated chip of a cartridge has an original key table storing m original keys, each identified by m second identifiers. The authenticated chip generates an authentication key based on an original key corresponding to a combination of the value of the first identifier received from the authentication chip and the value of a second identifier unique to the authenticated chip. The authentication chip selects from the authentication key table an authentication key corresponding to a combination of the value of the first identifier unique to the authenticated chip and the value of the second identifier received from the authenticated chip. This allows the authentication chip and the authenticated chip to share the same authentication key without communicating the authentication key itself, and challenge-response authentication is performed using the authentication key. Because the value of the first identifier exchanged between the chips to share the authentication key is unique to each individual image forming device, even if an attacker learns the value, the attacker cannot use the acquired information for other image forming devices. Similarly, even if an attacker learns the value of the second identifier exchanged between the chips, the attacker cannot use the learned information for other cartridges.

[0004] Incidentally, many chips to be authenticated are implemented as large-scale integrated circuits (LSI) chips. Confidential data, such as the master key table in Patent Document 1, is stored in tamper-resistant memory on the LSI chip, thereby protecting the information from external reading and tampering. However, Non-Patent Document 1 introduces an attack technique called a micro-probing attack, which can leak information stored in the memory on the LSI chip. A micro-probing attack involves processing the wiring on the LSI chip using a focused ion beam (FIB) device and detecting and analyzing signals flowing through targeted nodes on the wiring. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2020-72348 [Non-patent literature]

[0006] [Non-Patent Document 1] Sergei Skorobogatov, "How microprobing can attack encrypted memory", AHSA2017 Workshop, Vienna, Austria, August 30th to September 1st, 2017 Summary of the Invention [Problem to be solved by the invention]

[0007] In the authentication method of Patent Document 1, the chip to be authenticated reads the original key corresponding to the specified value of the first identifier from the original key table in accordance with a control command from the authenticating chip. The more memory accesses are repeated to read this original key, the more times the original key data flows through the wiring on the LSI chip, increasing the possibility that the original key will be leaked by a micro-probing attack described in Non-Patent Document 1. Therefore, regardless of whether authentication is successful, it is desirable to suppress memory accesses to read the original key in the chip to be authenticated.

[0008] In view of the above, the present invention aims to provide an authentication method that has improved resistance to malicious attacks. [Means for solving the problem]

[0009] According to one aspect, a device to be authenticated includes: storage means for storing in advance a set of M original keys (M is an integer equal to or greater than 2) each identified by a different key identifier (key ID) value; connection means for communicably connecting to an authentication system that authenticates the device to be authenticated; and control means for controlling communication with the authentication system via the connection means, wherein the authentication system pre-stores an authentication identifier that is unique to the authentication system and is associated with a first key ID value that identifies a first original key among the M original keys; a first authentication key derived based on the authentication identifier and the first original key; and a digital signature value used to verify the authenticity of the authentication identifier; and In a third stage, a device to be authenticated receives the authentication identifier and the digital signature value from the authentication system, verifies the authenticity of the received authentication identifier using the digital signature value, and if the verification of the authentication identifier is successful, reads from the storage means the first original key identified by the first key ID value derived based on the authentication identifier, derives a second authentication key identical to the first authentication key based on the read first original key and the authentication identifier, receives challenge data from the authentication system, generates response data based on the received challenge data and the derived second authentication key, and transmits the generated response data to the authentication system. Corresponding authentication systems and authentication methods are also provided. [Effects of the Invention]

[0010] According to the present invention, an authentication method is provided that has improved resistance to malicious attacks. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 2 is a block diagram showing a state in which a process cartridge is connected to an image forming apparatus in an embodiment. [Figure 2] FIG. 1 is a block diagram showing an example of the configuration of an authentication chip according to a first embodiment. [Figure 3] FIG. 2 is a block diagram showing an example of the configuration of an authenticated chip according to the first embodiment. [Figure 4]6 is a flowchart showing an example of the flow of a data generation process for generating data to be stored in the memories of the authenticating chip and the authenticated chip according to the first embodiment. [Figure 5] FIG. 2 is an explanatory diagram for explaining the configuration of a key storage table according to the first embodiment. [Figure 6] FIG. 3 is a sequence diagram showing an example of the overall flow of authentication processing according to the first embodiment. [Figure 7] 7 is a flowchart showing an example of a detailed flow of the authentication key acquisition process shown in FIG. 6. [Figure 8] FIG. 10 is a block diagram showing an example of the configuration of an authentication chip according to a second embodiment. [Figure 9] FIG. 10 is a block diagram showing an example of the configuration of an authenticated chip according to a second embodiment. [Figure 10] FIG. 10 is an explanatory diagram for explaining generation of an original key table and an authentication key table from an original key matrix. [Figure 11] 10 is a flowchart showing an example of the flow of a data generation process for generating data to be stored in the memories of an authenticating chip and an authenticated chip according to the second embodiment. [Figure 12] FIG. 10 is a sequence diagram showing an example of the overall flow of authentication processing according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention claimed. Although multiple features are described in the embodiments, not all of these multiple features are necessarily essential to the invention, and multiple features may be combined arbitrarily. Furthermore, in the accompanying drawings, the same reference numerals are used to designate the same or similar components, and redundant explanations will be omitted.

[0013] <1. Basic configuration> In the embodiment described below, a process cartridge connected to an image forming apparatus is authenticated by an authentication chip installed in the image forming apparatus. Therefore, the image forming apparatus may be referred to as an authentication system, and the process cartridge as an authenticated device. The process cartridge is an example of a replaceable part for an image forming apparatus. However, the technology disclosed herein is not limited to the combination of an image forming apparatus and a process cartridge, and may be applied to combinations of various electronic devices and replaceable parts.

[0014] FIG. 1 shows a process cartridge 200 connected to an image forming apparatus 100. The image forming apparatus 100 may be, for example, a printer, a copier, or a multifunction peripheral, and forms an image on a sheet according to an electrophotographic process. The process cartridge 200 is a replaceable part involved in the electrophotographic process. For example, a user can install or remove the process cartridge 200 from the image forming apparatus 100 by opening a cover (not shown) disposed on the housing of the image forming apparatus 100. The process cartridge 200 includes, for example, a photosensitive member and one or more members for forming a toner image on the surface of the photosensitive member. The image forming apparatus 100 includes an engine controller 101. The engine controller 101 controls the overall image forming operations of the image forming apparatus 100, such as sheet transport, toner image formation by the process cartridge 200, transfer of the toner image to the sheet, and fixing of the toner image on the sheet.

[0015] If an unauthorized process cartridge is connected to the image forming apparatus 100, problems such as device failure, malfunction, or reduced print quality may occur. Therefore, the image forming apparatus 100 has a mechanism for authenticating whether a process cartridge installed in the apparatus is an authorized product. The functions of a process cartridge 200 installed in the image forming apparatus 100 are enabled only if authentication is successful. As components related to this authentication mechanism, the engine controller 101 has a connection interface (I / F) 103, a sensor 105, a control device 107, and an authentication chip 110. The process cartridge 200 has an authenticated chip 210. Typically, the authentication chip 110 and the authenticated chip 210 are tamper-resistant.

[0016] The connection I / F 103 is a connection means communicatively connected to the authenticated chip 210. The connection between the connection I / F 103 and the authenticated chip 210 may be a wired connection via electrical contacts or a wireless connection via an antenna. The sensor 105 is a detection means for detecting whether a process cartridge is attached to the image forming apparatus 100. The control device 107 is a controller that comprehensively controls the operation of the image forming apparatus 100. The authentication chip 110 is an integrated circuit (IC) chip that has the function of authenticating whether the process cartridge 200 is genuine based on authentication data received from the authenticated chip 210 via the connection I / F 103. The authenticated chip 210 is an IC chip with a built-in memory that pre-stores authentication data for the process cartridge 200. Both the authentication chip 110 and the authenticated chip 210 may be LSIs.

[0017] In this embodiment, the memory of the authenticated chip 210 pre-stores a set of M original keys (M is an integer equal to or greater than 2), each identified by a different key identifier (key ID) value. When the sensor 105 detects that a process cartridge has been installed in the image forming apparatus 100, the control device 107 starts authentication processing. In this authentication processing, the authentication chip 110 transmits an authentication identifier (described later) unique to the image forming apparatus 100 to the authenticated chip 210. The authenticated chip 210 reads from the memory a first original key identified by a first key ID value derived based on the received authentication identifier, and derives an authentication key to be used for authentication based on the read first original key and the authentication identifier. The authentication chip 110 generates challenge data and transmits the challenge data to the authenticated chip 210 via the connection I / F 103. The authenticated chip 210 generates response data based on the challenge data received from the authentication chip 110 and the derived authentication key, and returns the generated response data to the authentication chip 110. The authentication chip 110 generates verification data based on the challenge data sent to the authenticated chip 210 and the authentication key corresponding to the authentication identifier. The authentication chip 110 then compares the response data received from the authenticated chip 210 with the verification data to authenticate whether the process cartridge 200 is genuine, and outputs the authentication result to the control device 107.

[0018] In the above authentication process, the original key is read from memory in the chip to be authenticated, but if the number of reads increases, the data of the original key flowing through the wiring on the chip will be analyzed by a micro-probing attack, increasing the possibility of the original key being leaked. Therefore, the mechanism described in the next section and subsequent sections will be used to reduce the number of memory accesses for reading the original key in the chip to be authenticated.

[0019] <2. First Example> <2-1. Example of authentication chip configuration> 2 is a block diagram showing an example of the configuration of the authentication chip 110 according to the first embodiment. Referring to FIG. 2, the authentication chip 110 includes an internal bus 111, an input / output circuit 112, a control circuit 113, a volatile memory 114, a nonvolatile memory 115, a cryptographic processing circuit 121, and a random number generation circuit 122.

[0020] The internal bus 111 is a signal line that interconnects the control circuit 113, the volatile memory 114, the nonvolatile memory 115, the cryptographic processing circuit 121, and the random number generation circuit 122. The input / output circuit 112 relays data between the control device 107 and the control circuit 113 of the authentication chip 110. The control circuit 113 is a control means that controls communication with the device to be authenticated. The control circuit 113 may be, for example, a central processing unit (CPU), a microcontroller, or a microprocessor, and performs various processes according to commands input from the control device 107. The volatile memory 114 may be, for example, a random access memory (RAM), and provides the control circuit 113 with a temporary storage area for calculations. The nonvolatile memory 115 is a storage means that may include, for example, a semiconductor memory or a hard disk.

[0021] In this embodiment, the non-volatile memory 115 stores one or more computer programs 116 executed by the control circuitry 113, control parameters (not shown), an authentication identifier (I j ) 117, first authentication key (A j ) 118, and the digital signature value (σ j ) 119. The authentication identifier 117 is an identifier unique to the authentication chip 110, associated with a key ID value that identifies one of the M original keys stored in the authenticated chip 210. In the following description, an original key among the M original keys identified using the authentication identifier 117 may be referred to as the first original key, and the key ID value that identifies the first original key may be referred to as the first key ID value. The first authentication key 118 is an authentication key derived in advance based on the authentication identifier 117 and the first original key. The electronic signature value 119 is a pre-generated electronic signature value used to verify the authenticity of the authentication identifier 117. In this embodiment, a digital signature based on a public key cryptosystem is used as the electronic signature.

[0022] The cryptographic processing circuit 121 is a calculation means for executing cryptographic processing that may include hash function calculations or encryption using a common key cryptosystem. The random number generation circuit 122 is a generation means for generating random numbers according to commands input from the control circuit 113. The random number generation circuit 122 is used, for example, to generate the above-mentioned challenge data. In this embodiment, the control circuit 113 functions as an authentication unit 131 that cooperates with the cryptographic processing circuit 121 and the random number generation circuit 122 to perform challenge-response type authentication processing for authenticating the authenticated chip 210. The flow of the authentication processing will be explained in detail later.

[0023] <2-2. Example of the configuration of the authenticated chip> 3 is a block diagram showing an example of the configuration of the authenticated chip 210 according to the first embodiment. Referring to FIG. 3, the authenticated chip 210 includes an internal bus 211, a connection I / F 212, a control circuit 213, a volatile memory 214, a non-volatile memory 215, a cryptographic processing circuit 221, and a signature verification circuit 222.

[0024] The internal bus 211 is a signal line that interconnects the control circuit 213, the volatile memory 214, the nonvolatile memory 215, the cryptographic processing circuit 221, and the signature verification circuit 222. The connection I / F 212 is a connection means that is communicatively connected to the authentication system. The control circuit 213 is a control means that controls communication with the authentication system via the connection I / F 212. The control circuit 213 may be, for example, a CPU, a microcontroller, or a microprocessor. The volatile memory 214 may be, for example, a RAM, and provides the control circuit 213 with a temporary storage area for calculations. The nonvolatile memory 215 is a storage means that includes, for example, a tamper-resistant semiconductor memory. The nonvolatile memory 215 stores one or more computer programs 216 executed by the control circuit 213, control parameters (not shown), and authentication data used to authenticate the process cartridge 200.

[0025] In this embodiment, the authentication data stored in the nonvolatile memory 215 includes an original key table 217, a public key (pk) 218, and a key storage table 240. The original key table 217 is a table that stores an original key set consisting of the M original keys described above. The public key 218 is used to verify the authenticity of an authentication identifier received from the authentication chip 110 using a public key cryptosystem. The key storage table 240 is a table that stores authentication keys derived based on original keys read from the original key table 217 for future reuse.

[0026] The cryptographic processing circuit 221 is a computing means that performs cryptographic processing, which may include hash function calculations or encryption using a symmetric key cryptosystem. The signature verification circuit 222 is a verification means that performs signature verification using an electronic signature to verify the authenticity of data. For example, the signature verification circuit 222 verifies the authenticity of the authentication identifier 117 using the electronic signature value 119 received from the authentication chip 110 together with the authentication identifier 117. In this embodiment, the control circuit 213 functions as a read control unit 231 and a response unit 232. The read control unit 231 controls the reading of authentication data from the nonvolatile memory 215. The response unit 232 responds to control commands received from the authentication chip 110 for challenge-response authentication. The functions of the read control unit 231 and the response unit 232 will be described in detail later.

[0027] 2 and 3, each of the circuits shown separately from the control circuit (e.g., the random number generation circuit, the encryption processing circuit, and the signature verification circuit) may be implemented as a software module executed by the control circuit instead of being implemented as an independent circuit. Also, each of the modules described as the functions of the control circuit (e.g., the authentication unit, the read control unit, and the response unit) may be implemented as an independent circuit separate from the control circuit. Also, although each of FIGS. 2 and 3 shows one non-volatile memory, each of the illustrated memories may actually be a collection of multiple memory circuits. For example, the key storage table 240 of the authenticated chip 210 may be included in a memory circuit separate from the memory circuit including the original key table 217.

[0028] <2-3. Generating authentication data and storing it in memory> The manufacturers of the image forming apparatus 100 and the process cartridge 200 generate the above-mentioned authentication data during the manufacturing stage and store the necessary portions in the memory of the authentication chip 110 and the authenticated chip 210. This section describes the processing during the manufacturing stage.

[0029] 4 is a flowchart showing an example of the flow of a data generation process for generating data to be stored in the nonvolatile memory 115 of the authentication chip 110 and the nonvolatile memory 215 of the authenticated chip 210. The data generation process of FIG. 4 may be executed in a device (e.g., a general-purpose computer) different from the image forming apparatus 100 and the process cartridge 200. In the following description, processing steps will be abbreviated as 'S'.

[0030] 4, first, prior to data generation, a pair of a public key pk and a private key sk for public key cryptography is prepared in S11. The key pair prepared here may be different for each individual image forming device, or may be common to multiple image forming devices manufactured by a legitimate manufacturer, as long as it is guaranteed that a digital signature value generated using the private key sk can be verified using the public key pk.

[0031] Next, in S13, M original keys K1,...,K M M original keys K1,...,K are generated. M Each of the original keys K may be a random number having a predetermined length and different from each other. m The index m of (m∈1,...,M) may be referred to as a key ID. Next, in S15, the generated M original keys K1,...,K M are stored in the original key table 217 of the nonvolatile memory 215 of the authenticated chip 210. These M original keys K1,...,K MThe original key set consisting of these may be common to a plurality of process cartridges that may be used in the same image forming apparatus 100. Furthermore, in S17, the public key pk is stored in the nonvolatile memory 215. Furthermore, in S19, an empty key storage table 240 is generated in the nonvolatile memory 215 of the authenticated chip 210. Note that when a plurality of process cartridges are manufactured, the above-mentioned steps S15 to S19 may be repeated a plurality of times.

[0032] Next, in S21, a secret value q unique to the image forming apparatus 100 (or the authentication chip 110) is generated. The secret value q may be a random number value having a predetermined length. Next, in S23, a first key ID value j is randomly selected (j∈1,...,M) from the range [1,M] of the key ID value m. Next, in S25, an authentication identifier I is generated based on the secret value q and the first key ID value j. j For example, an authentication identifier I j may be generated by concatenating the secret value q and the first key ID value j as in the following equation (1): I j = q||j (1) Here, the operator ∥ represents an operation that concatenates the values ​​before and after the operator. In other words, if the secret values ​​q are different, the corresponding authentication identifier I j According to the formula (1), the first key ID value j is the authentication identifier I j Therefore, the authentication identifier I j By extracting a part of the authentication identifier I j It is possible to extract the first key ID value j from the authentication identifier I j As long as it is possible to derive a first key ID value j from j may be generated using a relational expression different from equation (1).

[0033] Next, in S27, M original keys K1,...,K M The first original key K identified by the first key ID value j j , and authentication identifier I jBased on this, the first authentication key A j For example, the first authentication key A j is expressed as the first key K j and authentication identifier I j and the resulting input data (also called payload) may be fed into a hash function: A j = MSB L (h1(K j ||I j )) (2) Here, the function h1 is a one-way cryptographic hash function. As an example of the cryptographic hash function, SHA256 defined by NIST (National Institute of Standards and Technology) as FIPS PUB 180-4 can be used. Function MSB L is a function that cuts out the most significant L bits (discards the remaining bits), and may be, for example, L=128. When formula (2) is used, the first original key K j and authentication identifier I j Deterministically generate the first authentication key A from j can be derived, while the first authentication key A j to the first key K j It is difficult to guess.

[0034] Alternatively, first authentication key A j is expressed as the first key K j is used as a common key to generate an authentication identifier I j may be generated by encrypting: A j = Enc X (K j ,I j ||c)) (3) where Enc Xis a function that represents encryption processing in a symmetric key cryptosystem X. For example, the symmetric key cryptosystem X can be AES (Advanced Encryption Standard), which is a type of block cipher defined by NIST as FIPS PUB 197, and the block length can be, for example, 128 bits. X The first argument is the common key, and the second argument is the object of encryption (also called plaintext). In the example of formula (3), the function Enc X To match the size of the second argument to the block length, we use the authentication identifier I j A predetermined bit string c is concatenated to the first key K j and authentication identifier I j Deterministically generate the first authentication key A from j can be derived, while the first authentication key A j to the first key K j It is difficult to guess.

[0035] Next, in S29, the authentication identifier I is calculated using the secret key sk as shown in the following equation (4). j The digital signature value σ j will generate: σ j =Sign(sk,I j ) (4) The function Sign in formula (4) represents a digital signature algorithm. The digital signature algorithm used here may be, for example, the algorithm defined by NIST as FIPS PUB 186-4. The first argument of the function Sign is a private key sk, and the second argument is an authentication identifier I j is.

[0036] Next, in S31, an authentication identifier I j , first authentication key A j , and the digital signature value σ jis stored in the nonvolatile memory 115 of the authentication chip 110. Note that if multiple image forming devices are manufactured, the above-mentioned steps S21 to S31 may be repeated multiple times, and the key ID value selected in each repetition may differ from one another. Then, the data generation process of FIG. 4 ends.

[0037] <2-4. Key storage table configuration> FIG. 5 is an explanatory diagram for explaining the configuration of the key storage table 240 according to this embodiment. Referring to FIG. 5, the key storage table 240 has two data items: an ID 241 and an authentication key 242. The ID 241 is an identifier for identifying each record in the key storage table 240. In the example of FIG. 5, an authentication identifier is used as the value of the ID 241. In another example, a first key ID value that can be derived based on the authentication identifier may be used as the value of the ID 241. That is, the key storage table 240 is configured to store the key value of the authentication key (second authentication key) derived in the authenticated chip 210 in association with the corresponding identifier. When the process cartridge 200 (or the authenticated chip 210) is initially manufactured, the key storage table 240 is empty, but may contain up to A MAX When the process cartridge 200 is mounted in the image forming apparatus 100, the authentication chip 110 outputs the authentication identifier I j When the authentication identifier I is received, the read control unit 231 of the authenticated chip 210 reads the received authentication identifier I j The first key K corresponding to j from the original key table 217. The read control unit 231 also reads out the read first original key K j and authentication identifier I j Based on this, for example, according to equation (2) or (3), a second authentication key A, which is the same as the first authentication key held on the authentication chip 110 side, is obtained. j Then, the read control unit 231 derives the derived second authentication key A. j is associated with the corresponding identifier and stored in the key storage table 240. In the example of FIG. 5, the first record in the key storage table 240 is the authentication identifier I j and second authentication key A j The figure shows a pair with

[0038] It is assumed that the process cartridge 200 is once removed from the image forming apparatus 100 and then re-attached to the image forming apparatus 100. When the attachment of the process cartridge 200 is detected, the authentication chip 110 transmits the authentication identifier I to the authenticated chip 210. j The read control unit 231 of the authenticated chip 210 transmits the authentication identifier I received from the authenticating chip 110. j The first key K corresponding to j For example, the read control unit 231 determines whether the received authentication identifier I j is stored in the key storage table 240, and the authentication identifier I j is stored in the key storage table 240, the first original key K j In this case, the read control unit 231 can determine that the first original key K has been read in the past without accessing the original key table 217. j and authentication identifier I j A second authentication key A previously derived based on j is acquired from the key storage table 240. When the process cartridge 200 is first mounted in the image forming apparatus 100, the authentication identifier I j is not stored in the key storage table 240, the read control unit 231 j In this case, the read control unit 231 may determine that the first original key K has not been read out in the past. j and authentication identifier I j Based on this, a second authentication key A is generated. j The response unit 232 derives the second authentication key A thus derived or acquired by the read control unit 231. j The authentication chip 110 responds to an authentication request using the above.

[0039] In this embodiment, the key storage table 240 stores a maximum of A MAX The read control unit 231 stores up to four authentication keys. jThe first key K corresponding to j When it is determined that the authentication key has not been read in the past, the number of authentication keys stored in the key storage table 240 is equal to or exceeds the maximum number A. MAX If the number of authentication keys stored in the key storage table 240 is equal to the maximum number A, MAX , the response unit 232 may reject the authentication request from the authentication chip 110 and return an error message to the authentication chip 110.

[0040] In addition, the maximum number A MAX The value of can be determined in the preliminary design stage, taking into consideration how many different image forming apparatuses one process cartridge 200 is likely to be attached to and used in in a realistic use case.

[0041] <2-5. Cartridge authentication> 6 is a sequence diagram showing an example of the overall flow of authentication processing according to this embodiment. The authentication processing mainly involves the authentication chip 110 of the image forming apparatus 100 and the authenticated chip 210 of the process cartridge 200. The connection I / F 103 of the engine controller 101 is interposed in the communication path between the authentication chip 110 and the authenticated chip 210, but the connection I / F 103 is omitted from the drawing.

[0042] The authentication process can be started, for example, when the sensor 105 detects that the process cartridge 200 has been attached to the image forming apparatus 100, and the control device 107 sends a control command to the authentication chip 110 to instruct the start of authentication. Note that the trigger for starting authentication may not be the detection of the attachment of the process cartridge 200, but may be, for example, the detection of a user operation requesting the start of authentication via a user interface of the image forming apparatus 100.

[0043] First, in S111, the authentication unit 131 of the authentication chip 110 receives an authentication identifier I unique to the authentication chip 110. j from the nonvolatile memory 315 and transmits it to the authenticated chip 210. In addition, in S113, the authentication unit 131 reads out the digital signature value σ jis read from the nonvolatile memory 315 and transmitted to the chip to be authenticated 210, and the chip to be authenticated 210 receives the authentication identifier I j The authenticity of the document will be verified.

[0044] In addition, in S115, the authentication unit 131 sends a random number value D as challenge data to the random number generation circuit 122. C In S117, the authentication unit 131 generates the challenge data D generated by the random number generation circuit 122. C Next, in S119, the authenticating unit 131 transmits an authentication request including the challenge data D C and the first authentication key A stored in the nonvolatile memory 115. j Based on this, for example, according to equation (6) or equation (7) described later, the verification data D V Generate.

[0045] In S121, the responder 232 of the authenticated chip 210 transmits the authentication identifier I received from the authenticating chip 110 to the signature verification circuit 222. j The authenticity of the digital signature value σ j The signature verification here can be expressed as the following formula (5): res=Verify(pk,I j ,σ j ) (5) The function Verify in equation (5) represents a digital signature verification algorithm corresponding to the digital signature algorithm used in equation (4). The first argument of the function Verify is the public key pk stored in the nonvolatile memory 215, and the second argument is the authentication identifier I j and the third argument is the signature value σ j The output res of the function Verify indicates the signature verification result, i.e., whether the verification was successful or failed, as a logical value ("true" or "false"). The authentication identifier I received in S111 is j If the signature is authentic, the signature verification result res indicates "true" according to the public key cryptography mechanism. j is invalid or the digital signature value σj If is invalid, the signature verification result res indicates "false."

[0046] If the signature verification result res indicates "false", the authentication process proceeds to S129, and the response unit 232 sends an error message indicating a failure of the signature verification to the authentication chip 110. In this case, the authentication process ends without the read control unit 231 accessing the original key table 217 in the nonvolatile memory 215. On the other hand, if the signature verification result res indicates "true", the authentication process proceeds to S123.

[0047] Authentication Identifier I j If the authenticity of the second authentication key A is successfully verified, in S123, the read control unit 231 executes an authentication key acquisition process to obtain the second authentication key A. j Obtain the second authentication key A. j is the first authentication key A stored in advance in the authentication chip 110. j It is the same key.

[0048] 7 is a flowchart showing an example of a detailed flow of the authentication key acquisition process executed by the read control unit 231. Referring to FIG. 7, first, in S201, the read control unit 231 reads the authentication identifier I received from the authentication chip 110. j It is determined whether the record of authentication identifier I exists in the key storage table 240. j If the record of the authentication identifier I does not exist in the key storage table 240, the process proceeds to S203. j If the record exists in the key storage table 240, the process proceeds to S213.

[0049] In S203, the read control unit 231 checks whether there is space in the key storage table 240, that is, whether the number of authentication keys stored in the key storage table 240 is equal to or greater than the maximum number A. MAX If there is free space in the key storage table 240, the process proceeds to S205. On the other hand, if there is no free space in the key storage table 240, the process proceeds to S215.

[0050] When the process proceeds to S205, the read control unit 231 reads the authentication identifier I jThe first key K corresponding to j Therefore, in S205, the read control unit 231 determines that the authentication identifier I j For example, the read control unit 231 derives the first key ID value j from the authentication identifier I j Next, in S207, the read control unit 231 accesses the original key table 217 in the nonvolatile memory 215 and derives the first original key K identified by the first key ID value j. j Next, in S209, the read control unit 231 reads out the first original key K j and authentication identifier I j Based on this, a second authentication key A is generated. j For example, the read control unit 231 derives the first original key K j and authentication identifier I j The second authentication key A is generated by inputting the input data generated by concatenating j Alternatively, the read control unit 231 may derive the first original key K j is used as a common key to generate an authentication identifier I j By encrypting the second authentication key A j Next, in S211, the read control unit 231 may derive the derived second authentication key A. j and authentication identifier I j The pair is stored in the key storage table 240.

[0051] When the process proceeds to S213, the read control unit 231 reads the authentication identifier I j The first key K corresponding to j Therefore, in S213, the read control unit 231 determines that the first original key K j and authentication identifier I j A second authentication key A previously derived based on j from the key storage table 240. For example, the read control unit 231 obtains the authentication identifier I j(or the first key ID value j), the corresponding record can be quickly found and the second authentication key A indicated by the record can be obtained. j can be obtained.

[0052] If the process proceeds to S215, the number of authentication keys stored in the key storage table 240 reaches the maximum number A. MAX , and a new authentication key cannot be additionally stored in the key storage table 240. Therefore, in S215, the read control unit 231 transmits an error message indicating that the upper limit of the number of memory accesses has been reached to the authentication chip 110. In this case, the first original key K j Certification based on this will be rejected.

[0053] Returning to FIG. 6, in S125, the response unit 232 sends the challenge data D received from the authentication chip 110 to the cryptographic processing circuit 221. C and a second authentication key A obtained or derived as a result of the above-described authentication key obtaining process. j For example, response data D R is expressed as the second authentication key A as shown in the following equation (6). j and Challenge Data D C and the resulting input data may be fed into a hash function: D R = MSB L (h1(A j ||D C )) (6) As mentioned above, function h1 may be a one-way cryptographic hash function, and function MSB L may be a function that extracts the most significant L bits of the argument. Alternatively, the response data D R is expressed as the second authentication key A as shown in the following equation (7). j is used as a common key to generate challenge data D C may be generated by encrypting: D R = Enc X (Aj ,D C ) (7) As mentioned above, Enc X is a function representing encryption processing in a common key cryptosystem X, and for example, AES with a block length of 128 bits may be used as the common key cryptosystem X. The generation of verification data in S119 in the authentication chip 110 may be performed in the same manner as the generation of response data here. Then, in S127, the response unit 232 generates the generated response data D R is returned to the authentication chip 110.

[0054] Response data D from the authenticated chip 210 R The authentication unit 131 of the authentication chip 110 receives the response data D R However, the verification data D generated in S119 V Response data D R is the verification data D V If the response data D matches the authentication data D, the authentication unit 131 determines that the authentication of the process cartridge 200 has been successful. R is the verification data D V If they do not match, the authentication unit 131 determines that the authentication of the process cartridge 200 has been unsuccessful. The authentication unit 131 reports the authentication result determined in S131 to the control device 107.

[0055] In S133, the control device 107 accepts or rejects the connection of the process cartridge 200 depending on the authentication result reported from the authentication chip 110. If the authentication is unsuccessful, the control device 107 may warn the user that the process cartridge 200 is not genuine. The warning here may be given by any method, such as displaying a warning message on the display of the image forming apparatus 100, turning on a warning light, or outputting an alarm sound.

[0056] If the authentication is successful, the control device 107 accepts the connection of the process cartridge 200 and enables image formation using the process cartridge 200. For example, the control device 107 may read out additional control parameters (e.g., parameters related to image formation conditions) that may be held in the memory of the process cartridge 200, and use them for subsequent image formation operations.

[0057] 6 may be performed in a different order from that shown in the figure. j and the digital signature value σ j The authentication chip 110 receives the authentication identifier I from the chip to be authenticated 210. j After the authenticity of the challenge data D is verified, C may be transmitted to the chip to be authenticated 210. Also, the authentication chip 110 may transmit the verification data D V The challenge data D is generated by C Before transmitting the response data D from the authenticated chip 210 R This may be done at any time, such as after receiving the

[0058] In this section, the encryption processing circuit 221 of the authenticated chip 210 generates the second authentication key A. j Derivation of and response data D R In this example, a common circuit performs both calculations, preventing an increase in the circuit size and reducing the manufacturing cost of the device. However, j Derivation of and response data D R The generation of the second authentication key A may be performed by a separate circuit according to a different algorithm. j Derivation of and response data D R One of the two may be generated using a cryptographic hash function (for example, SHA256), and the other may be generated as an encryption process using a symmetric key cryptosystem (AES with a block length of 128 bits).

[0059] In this section, the authentication identifier I j In the above example, the authentication identifier I is generated by concatenating the secret value q and the first key ID value j as shown in equation (1). j The method for generating the authentication identifier I is not limited to this example. j may be generated through an operation such as the following equation (8): I j = q*M+j-1 (8) Here, M represents the size of the original key table 217 (the number of original keys included in the original key table 217). In this case, in S205 of FIG. 7, the authentication identifier I j The operation to derive the first key ID value from is a modulo operation as shown in the following equation (9): j= 1+(I j mod M) (9) where mod is the modulus operator. In another example, the generation of the secret value q can be omitted and the authentication identifier I j may simply be set equal to the first key ID value j (I j =j).

[0060] <2-6. Summary of the first embodiment> In the first embodiment described above, the device to be authenticated pre-stores in memory a set of M original keys, each identified by a different key ID value. Meanwhile, the authentication system pre-stores in memory a first authentication key derived based on the first original key and an authentication identifier associated with a first key ID value that identifies a first original key among the M original keys. The device to be authenticated reads from memory the first original key identified by the first key ID value based on the authentication identifier received from the authentication system, and derives a second authentication key identical to the first authentication key based on the first original key and the authentication identifier. This allows the authentication system and the device to be authenticated to secretly share a common authentication key, enabling challenge-response authentication. Even if an attacker were to attack an authentication chip installed in the authentication system and obtain the first authentication key, the first authentication key would be useless in other authentication systems (e.g., other image forming apparatuses). This means that analyzing an authentication chip mounted on one authentication system is useless for the purpose of manufacturing an unauthorized authenticated device that can fraudulently pass authentication by another authentication system.

[0061] In the first embodiment described above, the device to be authenticated reads the first original key identified by the first key ID value derived based on the authentication identifier from memory only if the authenticity of the authentication identifier is successfully verified using the digital signature value received from the authentication system. Therefore, even if an authentication identifier whose authenticity is not guaranteed is received from the authentication system, no memory access is performed to read the original key, reducing the number of times original key data flows through the wiring on the chip. This improves resistance to malicious attacks such as microprobing attacks.

[0062] Furthermore, in the first embodiment described above, if the device to be authenticated determines that the first original key corresponding to the authentication identifier received from the authentication system has been read from memory in the past, the device to be authenticated retrieves and uses the previously derived second authentication key from the key storage table. Therefore, data of the same original key does not flow multiple times through the wiring on the chip, making statistical analysis of data flowing through the wiring on the chip difficult. This further improves resistance to malicious attacks such as microprobing attacks. Even if an authentication key registered in the key storage table is leaked, the authentication key is valid only for a specific authentication system, and it is difficult to infer the original key from the leaked authentication key. Therefore, attacks on the key storage table are not useful for the fraudulent purpose of impersonating the device to be authenticated.

[0063] In the first embodiment, one of verifying the authenticity of the authentication identifier using the digital signature value and reusing the second authentication key stored in the key storage table may be omitted.

[0064] In contrast to the above-described mechanism, in order to manufacture a counterfeit authenticated device that can pass authentication fraudulently by analyzing the data flowing through the wiring on the chip, an attacker is forced to obtain many legitimate authentication chips and repeat authentication to collect statistically significant data. However, by sufficiently increasing the size M of the original key set, the amount of data required for analysis becomes enormous, making analysis practically impossible. Furthermore, by setting a limit on the maximum number of authentication keys stored in the key storage table, it becomes even more difficult to collect data for analysis, and the confidentiality of the original key set can be further strengthened.

[0065] <3. Second Example> <3-1. Example of authentication chip configuration> 8 is a block diagram showing an example of the configuration of an authentication chip 110 according to the second embodiment. Referring to FIG. 8, the authentication chip 110 includes an internal bus 111, an input / output circuit 112, a control circuit 313, a volatile memory 114, a non-volatile memory 315, a cryptographic processing circuit 121, and a random number generation circuit 122.

[0066] The control circuit 313 is a control means that controls communication with the device to be authenticated. The control circuit 313 may be, for example, a central processing unit, a microcontroller, or a microprocessor, and performs various processes according to commands input from the control device 107. The non-volatile memory 315 is a storage means that may include, for example, a semiconductor memory or a hard disk.

[0067] In this embodiment, the non-volatile memory 315 stores one or more computer programs 116 executed by the control circuitry 313, control parameters (not shown), an authentication identifier (I j ) 117, the authentication key table 318, and the digital signature value (σ j ) 119. The authentication key table 318 stores N (N is an integer of 2 or more) authentication keys A 1-j ,...,A N-j This is a table that stores a set of authentication keys consisting of authentication key A. 1-j ,...,A N-j are authentication keys derived based on the authentication identifier 117 and N original keys whose first key ID is equal to the first key ID value j associated with the authentication identifier 117 in a master key matrix described below that includes master keys each identified by two key IDs.

[0068] In this embodiment, the control circuit 313 functions as an authentication unit 331 that cooperates with the encryption processing circuit 121 and the random number generation circuit 122 to perform challenge-response type authentication processing for authenticating the authenticated chip 210. The flow of the authentication processing will be explained in detail later.

[0069] <3-2. Example of the configuration of the authenticated chip> 9 is a block diagram showing an example of the configuration of the authenticated chip 210 according to the second embodiment. Referring to Fig. 9, the authenticated chip 210 includes an internal bus 211, a connection I / F 212, a control circuit 413, a volatile memory 214, a non-volatile memory 415, a cryptographic processing circuit 221, and a signature verification circuit 222.

[0070] The control circuit 413 is a control means that controls communication with the authentication system via the connection I / F 212. The control circuit 413 may be, for example, a CPU, a microcontroller, or a microprocessor. The non-volatile memory 415 is a storage means that includes, for example, a tamper-resistant semiconductor memory. The non-volatile memory 415 stores one or more computer programs 216 executed by the control circuit 413, control parameters (not shown), and authentication data used to authenticate the process cartridge 200.

[0071] In this embodiment, the authentication data stored in the nonvolatile memory 415 includes an original key table 417, a public key (pk) 218, a second key ID value (i) 419, and a key storage table 240. The original key table 417 stores M original keys K (M is an integer equal to or greater than 2). i-1 ,...,K i-M This is a table that stores a set of original keys consisting of the original key K i-1 ,...,K i-M is an original key whose second key ID is equal to the second key ID value 219 in an original key matrix (described later) that includes original keys each identified by two key IDs. The second key ID value 419 indicates a value i that is randomly selected in advance from the range [1, N] of the second key IDs in the original key matrix.

[0072] The control circuit 413 functions as a read control unit 231 and a response unit 432. The response unit 432 responds to a control command received from the authentication chip 110 for challenge-response authentication. The function of the response unit 432 will be described in detail later, focusing on the differences from the response unit 232 according to the first embodiment.

[0073] 8 and 9 may be implemented as software modules executed by the control circuit instead of being implemented as independent circuits. Furthermore, each of the modules described as the functions of the control circuit may be implemented as an independent circuit separate from the control circuit. Furthermore, each of the memories shown may actually be a collection of multiple memory circuits.

[0074] <3-3. Generating authentication data and storing it in memory> The manufacturer of the image forming apparatus 100 and the process cartridge 200 generates the above-mentioned authentication data at the manufacturing stage and stores the necessary portions in the memory of the authenticating chip 110 and the authenticated chip 210. Before explaining the processing at the manufacturing stage, the relationship between the original key matrix in this embodiment and the authentication key set in the authentication key table 318 of the authenticating chip 110 and the original key set in the original key table 417 of the authenticated chip 210 will be explained.

[0075] FIG. 10 is an explanatory diagram for explaining generation of an original key table and an authentication key table from an original key matrix. The original key matrix 500 shown in FIG. 10 is a two-dimensional array of original keys, each of which is identified by a first key ID and a second key ID. Each original key in the original key matrix 500 is identified by a combination of one of M candidate values ​​of the first key ID and one of N candidate values ​​of the second key ID. Therefore, the original key matrix 500 includes a total of M×N original keys. In other words, the original key matrix 500 is made up of N original key sets, each of which includes M original keys. Such an original key matrix 500 is prepared by generating M×N random numbers during the manufacturing stage of the image forming apparatus 100 and the process cartridge 200. Then, when the authenticated chip 210 of the process cartridge 200 is manufactured, M original keys K identified by a unique second key ID value i selected for the chip are stored. i-1 ,...,K i-M are extracted from the original key matrix 500 and stored in the original key table 417. On the other hand, when the authentication chip 110 of the image forming device 100 is manufactured, N original keys K 1-j ,...,K N-j is extracted from the original key matrix 500. Then, the authentication identifier I associated with the first key ID value j is j Using N original keys K 1-j ,...,K N-j are authentication key A 1-j ,...,A N-j and N authentication keys A1-j ,...,A N-j are stored in the authentication key table 318. Here, the conversion of each original key into an authentication key may be performed by any of the methods described above in relation to the first embodiment (for example, equation (2) or equation (3)).

[0076] 11 is a flowchart showing an example of the flow of a data generation process for generating data to be stored in the nonvolatile memory 315 of the authentication chip 110 and the nonvolatile memory 415 of the authenticated chip 210. The data generation process of FIG. 11 may be executed in a device different from the image forming apparatus 100 and the process cartridge 200.

[0077] 11, first, prior to data generation, a pair of a public key pk and a private key sk for public key encryption is prepared in S11. The key pair prepared here may be different for each individual image forming device, or may be common to multiple image forming devices manufactured by a legitimate manufacturer.

[0078] Next, in S12, an original key matrix 500, which is a two-dimensional array of M×N, is generated. 1-1 ,...,K N-M may be different random values ​​having a predetermined length. Then, in S14, a second key ID value i for one chip 210 to be authenticated is selected from a range of second key ID values ​​(i∈1,...,N). Then, in S16, M original keys K, each of which has a second key ID equal to the second key ID value i, are selected. i-1 ,...,K i-M is extracted from the original key matrix 500 and stored in the original key table 417 of the nonvolatile memory 415 of the authenticated chip 210. Furthermore, in S18, the public key pk and the second key ID value i are stored in the nonvolatile memory 415. Furthermore, in S19, an empty key storage table 240 is generated in the nonvolatile memory 415 of the authenticated chip 210. Note that when multiple process cartridges are manufactured, the above-mentioned S14 to S19 are repeated multiple times, and the second key ID values ​​selected in each repetition may differ from one another.

[0079] Next, in S21, a secret value q unique to the image forming apparatus 100 (or the authentication chip 110) is generated. The secret value q may be a random value having a predetermined length. Next, in S23, a first key ID value j for one authentication chip 110 is selected from the range of first key ID values ​​(j∈1,...,M). Next, in S25, an authentication identifier I is generated based on the secret value q and the first key ID value j. j is generated.

[0080] Next, in S28, N original keys K whose first key ID is equal to the first key ID value j in the original key matrix 500 are selected. 1-j ,...,K N-j and authentication identifier I j and N authentication keys A 1-j ,...,A N-j For example, each authentication key A j may be generated using a one-way cryptographic hash function as in the above formula (2), or may be generated through encryption processing using a symmetric key cryptosystem as in the above formula (3).

[0081] Next, in S29, a digital signature value σj of the authentication identifier Ij is generated using the secret key sk as shown in the above equation (4). j , N authentication keys A 1-j ,...,A N-j , and the digital signature value σ j is stored in the nonvolatile memory 315 of the authentication chip 110. Note that if multiple image forming devices are manufactured, the above-mentioned steps S21 to S32 may be repeated multiple times, and the first key ID value selected in each repetition may differ from one another. Then, the data generation process of FIG. 11 ends.

[0082] <3-4. Cartridge authentication> 12 is a sequence diagram showing an example of the overall flow of authentication processing according to this embodiment. The authentication processing mainly involves the authentication chip 110 of the image forming apparatus 100 and the authenticated chip 210 of the process cartridge 200. The connection I / F 103 of the engine controller 101 is interposed in the communication path between the authentication chip 110 and the authenticated chip 210, but the connection I / F 103 is omitted from the drawing.

[0083] First, in S311, the response unit 432 of the chip to be authenticated 210 transmits the second key ID value i stored in advance in the nonvolatile memory 415 to the authentication chip 110 in response to a request from the authentication chip 110. Next, in S311, the authentication unit 331 of the authentication chip 110 transmits an authentication identifier I unique to the authentication chip 110. j to the authenticated chip 210. In addition, in S313, the authentication unit 331 transmits the digital signature value σ j to the authenticated chip 210.

[0084] In addition, in S315, the authentication unit 331 sends a random number value D as challenge data to the random number generation circuit 122. C In S317, the authentication unit 331 generates the challenge data D generated by the random number generation circuit 122. C The authentication request including the above is transmitted to the authenticated chip 210.

[0085] Next, in S318, the authentication unit 331 receives N authentication keys A stored in the authentication key table 318. 1-j ,...,A N-j The first authentication key A identified by the second key ID value i received from the authenticated chip 210 i-j Next, in S319, the authentication unit 331 selects the challenge data D C and the first authentication key A selected in S318. i-j Based on this, the validation data D V Generate.

[0086] In S321, the responder 432 of the authenticated chip 210 transmits the authentication identifier I received from the authenticating chip 110 to the signature verification circuit 222. jThe authenticity of the digital signature value σ j The signature verification here can be expressed as in the above-mentioned formula (5).

[0087] If the signature verification fails in S321, the authentication process proceeds to S329, and the response unit 432 sends an error message indicating the failure of the signature verification to the authentication chip 110. In this case, the authentication process ends without the read control unit 231 accessing the original key table 417 in the nonvolatile memory 415. On the other hand, if the signature verification is successful, the authentication process proceeds to S323.

[0088] In S323, the read control unit 231 executes the authentication key acquisition process described with reference to Fig. 7, as in the first embodiment. As a result, the M original keys K stored in the original key table 417 are i-1 ,...,K i-M The first key K i-j Second authentication key A corresponding to i-j is newly derived or (if previously derived) retrieved from the key storage table 240. i-j is the first authentication key A selected in S318 in the authentication chip 110. i-j It is the same key.

[0089] Next, in S325, the response unit 432 transmits the challenge data D received from the authentication chip 110 to the cryptographic processing circuit 221. C and the above-mentioned second authentication key A i-j For example, response data D R may be generated according to the above-described formula (6) or formula (7). Then, in S327, the response unit 432 outputs the generated response data D R is returned to the authentication chip 110.

[0090] Response data D from the authenticated chip 210 R The authentication unit 331 of the authentication chip 110 receives the response data D R However, the verification data D generated in S319 VResponse data D R is the verification data D V If the response data D matches the authentication data D, the authentication unit 331 determines that the authentication of the process cartridge 200 has been successful. R is the verification data D V If they do not match, the authentication unit 331 determines that the authentication of the process cartridge 200 has been unsuccessful. The authentication unit 331 reports the authentication result determined in S331 to the control device 107.

[0091] In S333, the control device 107 accepts or rejects the connection of the process cartridge 200 depending on the authentication result reported from the authentication chip 110. The processing executed by the control device 107 when authentication is successful and when authentication is unsuccessful may be the same as the processing described in relation to S133 in FIG.

[0092] 6, the processing steps included in the authentication process of Fig. 12 may also be performed in an order different from that shown in the figure. For example, the transmission of the second key ID value i from the authenticated chip 210 to the authentication chip 110 and the transmission of the authentication identifier I from the authenticated chip 110 to the authenticated chip 210 may be performed in an order different from that shown in the figure. j and the digital signature value σ j The transmission of the first and second messages may be performed first.

[0093] In this embodiment, too, the derivation of the first and second authentication keys and the generation of the response data may be performed according to the same algorithm (e.g., in the same circuit), or according to different algorithms (e.g., in different circuits).

[0094] <3-5. Summary of the second example> In the second embodiment described above, the device to be authenticated pre-stores in a memory an original key set consisting of M original keys in an N×M original key matrix, each having a second key ID equal to a second key ID value unique to the device to be authenticated, and the second key ID value. The authentication system pre-stores in a memory an authentication key set derived based on N original keys in the same original key matrix, each having a first key ID equal to a first key ID value unique to the authentication system, and an authentication identifier associated with the first key ID. The authenticator reads from the memory a first authentication key identified by the second key ID value received from the device to be authenticated. The device to be authenticated reads from the memory a first original key identified by the first key ID value based on the authentication identifier received from the authentication system, and derives a second authentication key identical to the first authentication key based on the first original key and the authentication identifier. This allows the authentication system and the device to be authenticated to secretly share a common authentication key, enabling challenge-response authentication. If an attacker attempts to analyze the original key table by attacking the authenticated chip of the authenticated device, different sets of original keys derived from the original key matrix are stored in different authenticated chips, making it impossible to use multiple authenticated chips for consistent analysis. This makes it more difficult for an attacker to manufacture an unauthorized authenticated device that can fraudulently pass authentication by analyzing the authenticated chip.

[0095] Also in the second embodiment, the device to be authenticated reads from memory the first original key identified by the first key ID value derived based on the authentication identifier only if the authenticity of the authentication identifier is successfully verified using the digital signature value received from the authentication system. Therefore, even if an authentication identifier whose authenticity is not guaranteed is received from the authentication system, no memory access is performed to read the original key, and the number of times original key data flows through the wiring on the chip is reduced. This improves resistance to malicious attacks such as microprobing attacks.

[0096] Also in the second embodiment, if the device to be authenticated determines that it has previously read from memory the first original key corresponding to the authentication identifier received from the authentication system, it retrieves and uses the previously derived second authentication key from the key storage table. Therefore, data of the same original key does not flow multiple times through the wiring on the chip, making statistical analysis of data flowing through the wiring on the chip difficult. This further improves resistance to malicious attacks such as microprobing attacks. Even if an authentication key registered in the key storage table is leaked, the authentication key is valid only for a specific authentication system, and it is difficult to infer the original key from the leaked authentication key. Therefore, attacks on the key storage table are not useful for the fraudulent purpose of impersonating the device to be authenticated.

[0097] In the second embodiment as well, one of verifying the authenticity of the authentication identifier using the digital signature value and reusing the second authentication key stored in the key storage table may be omitted.

[0098] <4. Other embodiments> The above-described embodiment can also be realized in the form of a process in which a program for realizing one or more functions is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program, or by a circuit (e.g., ASIC) that realizes one or more functions.

[0099] The disclosure of this specification includes at least the following authenticatee device, authentication system, and authentication method. (Item 1) An authenticated device, a storage means for storing in advance a set of M original keys (M is an integer of 2 or more) each of which is identified by a different key identifier (key ID) value; a connection means communicably connected to an authentication system that authenticates the authenticated device; a control means for controlling communication with the authentication system via the connection means; Equipped with The authentication system includes: an authentication identifier unique to the authentication system, the authentication identifier being associated with a first key ID value that identifies a first key among the M original keys; a first authentication key derived based on the authentication identifier and the first original key; and a digital signature value used to verify the authenticity of the authentication identifier; is stored in advance, The control means receiving the authentication identifier and the digital signature value from the authentication system; verifying the authenticity of the received authentication identifier using the digital signature value; If the verification of the authentication identifier is successful, reading from the storage means the first original key identified by the first key ID value derived based on the authentication identifier; deriving a second authentication key that is the same as the first authentication key based on the read first original key and the authentication identifier; receiving challenge data from the authentication system; generating response data based on the received challenge data and the derived second authentication key; transmitting the generated response data to the authentication system; Authenticated device. (Item 2) The authenticated device described in item 1, wherein the authentication of the authenticated device is determined to be successful in the authentication system when the response data received from the authenticated device matches verification data generated in the authentication system based on the challenge data and the first authentication key. (Item 3) The device to be authenticated according to item 1 or 2, wherein the control means derives the second authentication key by inputting input data generated by concatenating the first original key and the authentication identifier into a cryptographic hash function. (Item 4) 3. The device to be authenticated according to item 1 or 2, wherein the control means derives the second authentication key by encrypting the authentication identifier using the first original key as a common key. (Item 5) the first key ID value is included as part of the authentication identifier; the control means derives the first key ID value by extracting the first key ID value from the authentication identifier; The device to be authenticated according to any one of items 1 to 4. (Item 6) the authentication system stores in advance an authentication key set consisting of N authentication keys (N is an integer of 2 or greater) including the first authentication key; The N authentication keys in the authentication key set are the authentication identifier; a raw key matrix consisting of N raw key sets each including M raw keys, wherein each raw key is identified by a combination of one of M candidate values ​​of a first key ID and one of N candidate values ​​of a second key ID; are authentication keys derived based on the M original keys of the original key set pre-stored in the storage means are original keys whose second key IDs are equal to second key ID values ​​unique to the device to be authenticated in the original key matrix; the first original key is equal to the original key identified in the original key matrix by a combination of the first key ID value and the second key ID value; the control means transmits the second key ID value to the authentication system, and causes the authentication system to select the first authentication key corresponding to the first original key from the authentication key set for verifying the response data; The device to be authenticated according to any one of items 1 to 5. (Item 7) An authentication system for authenticating an authenticated device, comprising: the device to be authenticated stores in advance a set of M original keys (M is an integer of 2 or greater) each of which is identified by a different key identifier (key ID) value; The authentication system includes: a connection means communicably connected to the device to be authenticated; a control means for controlling communication with the authenticated device via the connection means; A storage means, an authentication identifier unique to the authentication system, the authentication identifier being associated with a first key ID value identifying a first key among the M source keys; a first authentication key derived based on the authentication identifier and the first original key; and a digital signature value used to verify the authenticity of the authentication identifier; The storage means stores the above in advance; Equipped with The control means transmitting the authentication identifier and the digital signature value to the device to be authenticated, and having the device to be authenticated verify the authenticity of the authentication identifier using the digital signature value; generating challenge data and transmitting it to the device to be authenticated; receiving, in response to the successful verification of the authentication identifier at the device to be authenticated, response data generated using the challenge data, the first original key identified by the first key ID value associated with the authentication identifier, and a second authentication key based on the authentication identifier, from the device to be authenticated; generating verification data based on the challenge data and the first authentication key; authenticating the device to be authenticated by comparing the received response data with the verification data; Authentication system. (Item 8) 8. The authentication system of claim 7, wherein the first authentication key is a key derived in advance by inputting input data generated by concatenating the first original key and the authentication identifier into a cryptographic hash function. (Item 9) 8. The authentication system according to item 7, wherein the first authentication key is a key derived in advance by encrypting the authentication identifier using the first original key as a common key. (Item 10) 10. The authentication system according to any one of items 7 to 9, wherein the first key ID value is included as part of the authentication identifier. (Item 11) the storage means stores in advance an authentication key set consisting of N authentication keys (N is an integer of 2 or greater) including the first authentication key; The N authentication keys in the authentication key set are the authentication identifier; a raw key matrix consisting of N raw key sets each including M raw keys, wherein each raw key is identified by a combination of one of M candidate values ​​of a first key ID and one of N candidate values ​​of a second key ID; are authentication keys derived based on the M original keys of the original key set pre-stored by the device to be authenticated are original keys whose second key IDs are equal to second key ID values ​​unique to the device to be authenticated in the original key matrix; the first original key is equal to the original key identified in the original key matrix by a combination of the first key ID value and the second key ID value; The control means receiving the second key ID value from the authentication system; selecting the first authentication key corresponding to the first original key from the authentication key set using the received second key ID value; comparing the response data with the verification data generated based on the challenge data and the selected first authentication key; The authentication system according to any one of items 7 to 10. (Item 12) 1. An authentication method for authenticating an authenticatee device communicatively connected to an authentication system, comprising: the device to be authenticated comprises a storage means for storing in advance a set of original keys consisting of M original keys (M is an integer of 2 or more) each identified by a different key identifier (key ID) value, The authentication system includes: an authentication identifier unique to the authentication system, the authentication identifier being associated with a first key ID value that identifies a first key among the M original keys; a first authentication key derived based on the authentication identifier and the first original key; and a digital signature value used to verify the authenticity of the authentication identifier; is stored in advance, The authentication method includes: transmitting the authentication identifier and the digital signature value from the authentication system to the authenticated device; verifying the authenticity of the authentication identifier using the digital signature value in the device to be authenticated; If the verification of the authentication identifier is successful, in the device to be authenticated, reading from the storage means the first original key identified by the first key ID value derived based on the authentication identifier; deriving a second authentication key that is the same as the first authentication key, based on the read first original key and the authentication identifier, in the authenticated device; transmitting challenge data from the authentication system to the prover; generating response data in the device to be authenticated based on the challenge data and the derived second authentication key; transmitting the response data from the device to be authenticated to the authentication system; generating verification data based on the challenge data and the first authentication key in the authentication system; In the authentication system, authenticating the device to be authenticated by comparing the response data received from the device to be authenticated with the verification data; authentication methods, including

[0100] The invention is not limited to the above-described embodiments, and various changes and modifications can be made without departing from the spirit and scope of the invention. Accordingly, the following claims are appended to apprise the public of the scope of the invention. [Explanation of symbols]

[0101] 100: Image forming apparatus (authentication system), 101: Engine controller, 103: Connection I / F (connection means), 110: Authentication chip, 113, 313: Control circuit (control means), 115, 315: Non-volatile memory (storage means), 117: Authentication identifier, 118: First authentication key, 119: Electronic signature value, 318: Authentication key table, 200: Process cartridge (authenticated device), 210: Authenticated chip, 212: Connection I / F (connection means), 213, 413: Control circuit (control means), 215, 415: Non-volatile memory (storage means), 217, 417: Original key table (first storage means), 218: Public key, 219: Second key ID value, 240: Key storage table (second storage means), 500: Original key matrix

Claims

1. An authenticated device, a storage means for storing in advance a set of M original keys (M is an integer equal to or greater than 2) each of which is identified by a different key identifier (key ID) value; A connection means communicably connected to an authentication system that authenticates the authenticated device; a control means for controlling communication with the authentication system via the connection means; Equipped with The authentication system includes: an authentication identifier unique to the authentication system, the authentication identifier being associated with a first key ID value identifying a first key of the M original keys; a first authentication key derived based on the authentication identifier and the first original key; and A digital signature value used to verify the authenticity of the authentication identifier; is stored in advance, The control means receiving the authentication identifier and the digital signature value from the authentication system; Verifying the authenticity of the received authentication identifier using the digital signature value; If the verification of the authentication identifier is successful, reading from the storage means the first original key identified by the first key ID value derived based on the authentication identifier; deriving a second authentication key that is the same as the first authentication key based on the read first original key and the authentication identifier; receiving challenge data from the authentication system; generating response data based on the received challenge data and the derived second authentication key; Transmitting the generated response data to the authentication system. Authenticated device.

2. The authenticated device of claim 1, wherein the authentication of the authenticated device is determined to be successful when the response data received from the authenticated device in the authentication system matches verification data generated in the authentication system based on the challenge data and the first authentication key.

3. 2. The device to be authenticated according to claim 1, wherein the control means derives the second authentication key by inputting input data generated by concatenating the first original key and the authentication identifier to a cryptographic hash function.

4. 2. The authenticated device according to claim 1, wherein said control means derives said second authentication key by encrypting said authentication identifier using said first original key as a common key.

5. the first key ID value is included as part of the authentication identifier; the control means derives the first key ID value by extracting the first key ID value from the authentication identifier; The authenticated device according to claim 1 .

6. the authentication system stores in advance an authentication key set including N authentication keys (N is an integer equal to or greater than 2) including the first authentication key; The N authentication keys in the authentication key set are The authentication identifier; and An original key matrix consisting of N original key sets each including M original keys, where each original key is identified by a combination of one of M candidate values ​​of a first key ID and one of N candidate values ​​of a second key ID, N original keys whose first key ID is equal to the first key ID value; and the M original keys of the original key set pre-stored in the storage means are original keys whose second key IDs are equal to second key ID values ​​unique to the device to be authenticated in the original key matrix; the first raw key is equal to a raw key identified in the raw key matrix by a combination of the first key ID value and the second key ID value; the control means transmits the second key ID value to the authentication system, and causes the authentication system to select the first authentication key corresponding to the first original key from the authentication key set for verifying the response data. The authenticated device according to any one of claims 1 to 5.

7. An authentication system for authenticating an authenticated device, comprising: the device to be authenticated stores in advance a set of M original keys (M is an integer equal to or greater than 2) each of which is identified by a different key identifier (key ID) value; The authentication system includes: A connection means communicatively connected to the authenticated device; a control means for controlling communication with the authenticated device via the connection means; A storage means, an authentication identifier unique to the authentication system, the authentication identifier being associated with a first key ID value identifying a first key of the M original keys; a first authentication key derived based on the authentication identifier and the first original key; and A digital signature value used to verify the authenticity of the authentication identifier; The storage means for storing the above in advance; Equipped with The control means transmitting the authentication identifier and the electronic signature value to the authenticated device, and having the authenticated device verify the authenticity of the authentication identifier using the electronic signature value; generating challenge data and transmitting it to the prover; receiving, in response to the verification of the authentication identifier being successful at the authenticated device, response data generated using the challenge data, the first original key identified by the first key ID value associated with the authentication identifier, and a second authentication key based on the authentication identifier, from the authenticated device; generating verification data based on the challenge data and the first authentication key; authenticating the authenticated device by comparing the received response data with the verification data; Authentication system.

8. 8. The authentication system of claim 7, wherein the first authentication key is a key previously derived by inputting input data generated by concatenating the first original key and the authentication identifier into a cryptographic hash function.

9. The authentication system according to claim 7 , wherein the first authentication key is a key derived in advance by encrypting the authentication identifier using the first original key as a common key.

10. The authentication system of claim 7 , wherein the first key ID value is included as part of the authentication identifier.

11. the storage means stores in advance an authentication key set including N authentication keys (N is an integer equal to or greater than 2) including the first authentication key; The N authentication keys in the authentication key set are The authentication identifier; and An original key matrix consisting of N original key sets each including M original keys, where each original key is identified by a combination of one of M candidate values ​​of a first key ID and one of N candidate values ​​of a second key ID, N original keys whose first key ID is equal to the first key ID value; and the M original keys of the original key set stored in advance by the device to be authenticated are original keys whose second key IDs are equal to second key ID values ​​unique to the device to be authenticated in the original key matrix; the first raw key is equal to a raw key identified in the raw key matrix by a combination of the first key ID value and the second key ID value; The control means receiving the second key ID value from the authentication system; selecting, from the authentication key set, the first authentication key corresponding to the first original key using the received second key ID value; comparing the response data with the verification data generated based on the challenge data and the selected first authentication key; The authentication system according to any one of claims 7 to 10.

12. 1. An authentication method for authenticating an authenticatee device communicatively connected to an authentication system, comprising: the device to be authenticated comprises a storage means for storing in advance a set of original keys consisting of M original keys (M is an integer equal to or greater than 2) each of which is identified by a different key identifier (key ID) value, The authentication system includes: an authentication identifier unique to the authentication system, the authentication identifier being associated with a first key ID value identifying a first key of the M original keys; a first authentication key derived based on the authentication identifier and the first original key; and A digital signature value used to verify the authenticity of the authentication identifier; is stored in advance, The authentication method includes: transmitting the authentication identifier and the digital signature value from the authentication system to the authenticated device; verifying the authenticity of the authentication identifier by using the digital signature value in the authenticated device; if the verification of the authentication identifier is successful, reading, in the authenticated device, from the storage means, the first original key identified by the first key ID value derived based on the authentication identifier; deriving a second authentication key, which is the same as the first authentication key, based on the read first original key and the authentication identifier in the authenticated device; transmitting challenge data from the authentication system to the prover; generating response data in the authenticated device based on the challenge data and the derived second authentication key; transmitting the response data from the authenticatee device to the authentication system; generating verification data based on the challenge data and the first authentication key in the authentication system; in the authentication system, authenticating the authenticated device by comparing the response data received from the authenticated device with the verification data; , an authentication method, including

Images