Key management device, key management system, key management method, and key management program

Abstract

To identify a user by using a PKCS#11-based HSM.SOLUTION: A key management device according to an embodiment comprises: a first acquisition unit that acquires pre-authentication information including a user ID, authentication information, and encrypted authentication information; a storage unit that securely stores a DB key; a first authentication unit that decodes the encrypted authentication information by using the DB key, and performs authentication by using the decoded authentication information and the authentication information; a generation unit that generates a ticket linked to the user ID on the basis of an authentication result, and generates a pre-authentication response including the ticket; a first output unit that outputs the pre-authentication response; a second acquisition unit that acquires session information including the ticket; a second authentication unit that authenticates the session information on the basis of the ticket included in the session information, and generates a cipher key corresponding to the ticket; and a second output unit that outputs a result of authentication performed by the second authentication unit.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] An embodiment of the present invention relates to a key management device, a key management system, a key management method, and a key management program. [Background technology]

[0002] In recent years, there are increasing opportunities to use encryption keys stored in hardware security modules (HSMs) for data confidentiality, electronic signatures, device authentication, etc. of information processing devices. Here, an HSM is a device that has encryption processing and key management functions and is certified according to international standards (e.g., Federal Information Processing Standard (FIPS), Common Criteria (CC), Peripheral Component Interconnect (PCI), etc.).

[0003] For example, Patent Document 1 discloses a technique for enhancing security when using encrypted data by erasing an encryption key stored in an HSM after a predetermined time has elapsed. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 4946562 Summary of the Invention [Problem to be solved by the invention]

[0005] In PKCS(Public-Key Cryptography Standards)#11-based HSMs, authentication is performed as a role rather than a specific individual. This creates the problem that users (individuals) cannot be identified.

[0006] The present invention has been made in light of the above-mentioned circumstances, and has an object to provide a technique capable of performing user-specific authentication in a PKCS#11-based HSM. [Means for solving the problem]

[0007] A key management device according to an embodiment includes a first acquisition unit that acquires pre-authentication information including a user ID, authentication information, and encrypted authentication information, a storage unit that securely stores a DB key, a first authentication unit that decrypts the encrypted authentication information using the DB key and performs authentication using the decrypted authentication information and the authentication information, a generation unit that generates a ticket linked to the user ID based on a result of the authentication and generates a pre-authentication response including the ticket, a first output unit that outputs the pre-authentication response, a second acquisition unit that acquires session information including the ticket, a second authentication unit that authenticates the session information based on the ticket included in the session information and generates an encryption key corresponding to the ticket, and a second output unit that outputs a result of the authentication by the second authentication unit. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram conceptually illustrating an example of the configuration of a key management system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of the configuration of a host device and an HSM in a key management system according to an embodiment. [Diagram 3] FIG. 3 is a block diagram showing an example of the configuration of an application server in the key management system according to the embodiment. [Figure 4] FIG. 4 is a diagram showing an example of the software configuration of the host device, the HSM, and the application server. [Diagram 5] FIG. 5 is a sequence diagram showing an example of a user authentication registration process according to the embodiment. [Figure 6] FIG. 6 is a diagram showing an example of a conceptual diagram of the registration process described with reference to FIG. [Figure 7] FIG. 7 is a sequence diagram showing an example of the authentication process according to the embodiment. [Figure 8] FIG. 8 is a diagram showing an example of a conceptual diagram of the registration process described with reference to FIG. [Figure 9] FIG. 9 is a diagram showing an example of a conceptual diagram of the registration process described with reference to FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] The key management device, the key management system, the key management method, and the key management program will be described in detail below with reference to the drawings. In the following embodiments, the parts with the same numbers perform the same operations, and the repeated description will be omitted. For example, when there are multiple identical or similar elements, a common symbol may be used to describe each element without distinguishing between them, and a subnumber may be used in addition to the common symbol to describe each element with distinction between them.

[0010] (composition) FIG. 1 is a diagram conceptually illustrating an example of the configuration of a key management system 100 according to an embodiment. As shown in FIG. 1, the key management system 100 includes a host device 1, an HSM 2, and an application server 3.

[0011] The host device 1 and HSM 2 are placed, for example, in a business office 10. The host device 1 is connected to the HSM 2 and an application server 3. The host device 1 transmits requests such as a signature generation request from the application server 3 to the HSM 2, and transmits a digital signature and the like to the application server 3.

[0012] The HSM2 as a key management device is a hardware device with tamper resistance that securely generates, protects, and manages key information. For example, the HSM2 is connected to the host device 1 via PCIe, or is connected to the host device via a LAN. For example, when connected via a LAN, the HSM2 may be placed in the same rack as the rack in which the host device 1 is placed. The HSM2 generates key information including an encryption key, and securely stores the generated encryption key. The HSM2 also executes arithmetic processing including an encryption process using the stored key information. For example, the HSM2 performs arithmetic processing such as encryption and decryption of data using the stored key information, digital signature, and creation of digital certificate.

[0013] The host device 1 cooperates with the HSM 2 to provide the application server 3 with an encryption key generated by the HSM 2 in response to a request from the application server 3. For example, as a key generation function, the host device 1 provides the application server 3 with key information generated by the HSM 2 in response to a request from the application server 3. For example, the host device 1 may instruct the HSM 2 to generate key information including a key pair of a public key and a private key in response to a request from the application server 3.

[0014] The host device 1 may also have a function of storing log data indicating the processing contents. For example, when the host device 1 executes cryptographic processing such as digital signature using a private key stored in the HSM2, the host device 1 may generate log data indicating the cryptographic processing contents, and store data (signed log data) on which the HSM2 digitally signs the generated log data in a storage device. The function of storing log data indicating the processing contents may be a feature of the HSM2. It may be disposed in the business office 10.

[0015] The application server 3 transmits a request for processing such as an electronic signature to the host device 1. Then, the application server 3 obtains data that has been subjected to arithmetic processing (electronic signature or encryption) by the HSM 2 from the host device 1. Note that, although one application server 3 is shown in the example of FIG. 1, it goes without saying that a plurality of application servers 3 may be connected to the host device 1. In addition, the application server 3 may be integrated with the host device 1, or the application server 3 may be installed in the business office 10.

[0016] FIG. 2 is a block diagram showing an example of the configuration of the host device 1 and the HSM 2 in the key management system 100 according to the embodiment. As shown in FIG. 2, the host device 1 includes a processor 11, a RAM 12, a ROM 13, a communication unit 14, an input / output interface 15, an input device 16, an output device 17, and the like. The processor 11 is a CPU (central processing unit), an MPU (micro processing unit), a DSP (digital signal processor), etc. The processor 11 is connected to each part in the host device 1 via a system bus, and transmits and receives data to and from each part. The processor 11 cooperates with the RAM 12 and the ROM 13 to execute operations such as control and data processing in the host device 1.

[0017] The RAM 12 is a volatile memory that temporarily stores data and functions as a working memory when the processor 11 executes a program.

[0018] The ROM (Read Only Memory) 13 is a non-volatile memory that stores programs for implementing the basic operations of the host device 1, control data, and the like.

[0019] The communication unit 14 is an interface for communicating with the HSM 2 and the application server 3. Here, in communication with the HSM 2, if the HSM 2 and the host device 1 are connected via PCIe, the communication with the HSM 2 is performed via a bus, not via the communication unit 14. On the other hand, if the HSM 2 is connected via a LAN, the host device 1 communicates with the HSM via the communication unit 14. In addition, in communication with the application server 3, the communication unit 14 may perform communication in a wired or wireless manner. For example, the communication unit 14 connects to the application server 3 via a wide area network such as the Internet. Alternatively, the communication unit 14 connects to the application server 3 directly via a LAN or the like.

[0020] The input / output interface 15 is connected to the input device 16, the output device 17, and the like. The input / output interface 15 is an interface that enables transmission and reception of information between the input device 16 and the output device 17. The input / output interface 15 may be integrated with the communication unit 14. For example, the host device 1 and at least one of the input device 16 or the output device 17 are wirelessly connected using a short-range wireless technology or the like, and information may be transmitted and received using the short-range wireless technology.

[0021] The input device 16 may include, for example, a keyboard, a pointing device, etc., for an administrator who manages the host device 1 to input various information to the host device 1. The input device 16 may also include a reader for reading data to be stored in the ROM 13 from a memory medium such as a USB memory, or a disk device for reading such data from a disk medium.

[0022] The output device 17 includes a display or the like that displays the results of calculations performed by the processor 11, applications executed by the processor 11, etc. The output device 17 also includes a printer or the like that prints information displayed on the display.

[0023] As shown in FIG. 2, the HSM 2 further includes a processor 21, a RAM 22, a ROM 23, a communication unit 24, a coprocessor 25, a secure ROM 26, and the like.

[0024] The processor 21 is a CPU, an MPU, a DSP, or the like. The processor 21 is connected to each unit in the HSM 2 via a system bus, and transmits and receives data to and from each unit. The processor 21 cooperates with the RAM 22 and the ROM 23 to execute operations such as control and data processing in the HSM 2.

[0025] The RAM 22 is a volatile memory that temporarily stores data, and functions as a working memory when the processor 21 executes a program.

[0026] The ROM 23 is a non-volatile memory that stores programs and control data for implementing the basic operations of the HSM 2.

[0027] The communication unit 24 is an interface for communicating with the host device 1. On the other hand, when the HSM is connected to the host device 1 via a LAN, the HSM is connected to the host device 1 via the communication unit 24.

[0028] The coprocessor 25 is a CPU, an MPU, a DSP, or the like. The coprocessor 25 executes cryptographic calculation processes such as cryptographic processing and secure messaging generation processing. For example, the coprocessor 25 executes public key cryptography encryption and decryption processes, common key cryptography encryption and decryption processes, calculations using hash functions, and the like.

[0029] The secure ROM 26 is a ROM having tamper resistance. The secure ROM is a non-volatile memory that stores an encryption key and the like used when the coprocessor 25 executes a process. Here, the tamper resistance may be possessed by the entire HSM 2, or may be possessed by only the secure ROM.

[0030] FIG. 3 is a block diagram showing an example of the configuration of the application server 3 in the key management system 100 according to the embodiment. As shown in FIG. 3, the application server 3 includes a processor 31, a RAM 32, a ROM 33, a communication unit 34, an input / output interface 35, an input device 36, an output device 37, etc. The processor 31 is a CPU, an MPU, a DSP, or the like. The processor 31 is connected to each unit in the application server 3 via a system bus, and transmits and receives data to and from each unit. The processor 31 cooperates with the RAM 32 and the ROM 33 to execute operations such as control and data processing in the application server 3.

[0031] The RAM 32 is a volatile memory that temporarily stores data, and functions as a working memory when the processor 31 executes a program.

[0032] The ROM 33 is a non-volatile memory that stores programs and control data for implementing the basic operations of the application server 3 .

[0033] The communication unit 34 is an interface for communicating with the host device 1. The communication unit 34 may perform communication in a wired or wireless manner. For example, the communication unit 34 connects to the host device 1 via a wide area network such as the Internet. Alternatively, the communication unit 34 connects directly to the host device 1 via a LAN or the like.

[0034] The input / output interface 35 is connected to the input device 36, the output device 37, and the like. The input / output interface 35 is an interface that enables transmission and reception of information between the input device 36 and the output device 37. The input / output interface 35 may be integrated with the communication unit 34. For example, the application server 3 and at least one of the input device 36 or the output device 37 are wirelessly connected using a short-range wireless technology or the like, and information may be transmitted and received using the short-range wireless technology.

[0035] The input device 36 may include, for example, a keyboard, a pointing device, or the like, with which a user managing the application server 3 inputs various information to the host device 1. The input device 36 may also include a reader for reading data to be stored in the ROM 33 from a memory medium such as a USB memory, or a disk device for reading such data from a disk medium.

[0036] The output device 37 includes a display or the like that displays the results of calculations performed by the processor 31, applications executed by the processor 31, etc. The output device 37 also includes a printer or the like that prints information displayed on the display.

[0037] FIG. 4 is a diagram showing an example of the software configuration of the host device 1, the HSM 2, and the application server 3. As shown in FIG. The host device 1 includes an HSM setting application 101 (shown as HSM setting app in FIG. 4), a unique API 102, a key management API 103, and a user database 104 (shown as user DB in FIG. 4). The HSM 2 includes an authentication and authorization function unit 201, a slot 202, and a key management engine 203. The application server 3 includes a user application 301.

[0038] The HSM setting application 101 is an application that allows an administrator of a host PC to register users who use the application server 3. The HSM setting application 101 is, for example, an application provided by a company that manufactures HSMs. The HSM setting application 101 can operate under the control of the processor 11.

[0039] The unique API 102 is an API provided by a company that produces the HSM, and is an API that can be connected to an authentication and authorization function unit 201 (described later) of the HSM 2. The unique API 102 can operate under the control of the processor 11.

[0040] The key management API 103 is an API that complies with PKCS#11 and can be connected to, for example, the key management engine 203 of the HSM 2. The key management API 103 can operate under the control of the processor 11.

[0041] The user database 104 is, for example, a database that stores the user ID and encrypted authentication information of the user who uses the user application 301. The encrypted authentication information will be described later. For example, the user database 104 is a storage unit that uses a part of the ROM 13.

[0042] The authentication and authorization function unit 201 is controlled by the processor 21, and performs authentication operations using a DB key or the like stored in a slot 202 (described later). For example, the authentication and authorization function unit 201 can operate under the control of the coprocessor 25.

[0043] The slot 202 includes, for example, slot 0, . . . slot X, and each slot 202 includes a corresponding token, although not shown in FIG. 4 and the like. Usually, one slot and one token are assigned to each application server 3 (i.e., each customer). Therefore, in the conventional method, it is not possible to know which user among users who use the user application 301 has used the application. Note that, although an example in which the application server 3 in this embodiment uses slot X will be described, it is of course possible to assign the application server 3 to any slot. In addition, the slot 202 stores, for example, a DB (Data Base) key, a log key, a method of generating random numbers for generating tickets, and the like, in advance. This information is stored, for example, in the secure ROM 26.

[0044] The key management engine 203 is an API for performing cryptographic communication with the host device 1 in compliance with PKCS#11. The key management engine 203 can operate under the control of the program 21. The key management engine 203 may be an API that complies with the standard, and therefore a detailed description thereof will be omitted here.

[0045] The user application 301 is an application used by each user of the application server 3, and operates under the control of the processor 31. Note that, for communication from the user application 301 to the unique API 102 or the key management compatible API 103, the user application 301 may directly call the function of the unique API 102 or the key management compatible API 103, or the host device 1 may have an application that relays communication from the user application 301.

[0046] (operation) (Registration action) First, a user authentication and registration process in the HSM 2 according to the embodiment will be described. FIG. 5 is a sequence diagram showing an example of a user authentication registration process according to the embodiment. Each operation in this sequence is realized by processor 11 of host device 1 and processor 21 and coprocessor 25 of HSM 2 reading and executing programs stored in the internal memory, RAM 12 or ROM 13 of processor 11, and the internal memory, RAM 22, ROM, or secure ROM 26 of processor 21.

[0047] In the process described below, it is assumed that the administrator of the host device 1 has already been registered in the host device 1 using a common method. Therefore, it is assumed that encrypted administrator authentication information linked to the administrator user ID is stored in the user database. Furthermore, it is assumed that the application server 3 uses slot X. Therefore, the user of the application server 3 will register in slot X of the HSM 2.

[0048] In step ST101, the processor 11 of the host device 1 transmits a pre-registration request to the HSM 2. First, in response to an input from an administrator wishing to register a user, the processor 11 launches an application provided by the business operator who created the HSM, and controls the output device 17 to display the application. Then, the processor 11 operating as an acquisition unit acquires an administrator user ID and administrator authentication information from the input device 16. Furthermore, the processor 11 operating as an acquisition unit acquires encrypted administrator authentication information linked to the administrator user ID stored in the user database. Then, the processor 11 operating as a transmission unit transmits the acquired administrator user ID, administrator authentication information, and encrypted administrator authentication information to the HSM 2 via the unique API 102.

[0049] In step ST102, the processor 21 and the coprocessor 25 of the HSM2 perform authentication processing. The processor 21 operating as an output unit outputs the encrypted administrator authentication information to the coprocessor 25 together with an instruction to perform authentication processing using slot X based on the administrator user ID included in the pre-registration request. The coprocessor 25 operating as a decryption unit uses the DB key to decrypt the encrypted administrator authentication information. Then, the processor 21 operating as an authentication unit performs authentication processing based on the decrypted administrator authentication information and the administrator authentication information. For example, if the decrypted administrator authentication information and the administrator authentication information match, authentication is performed, and if they do not match, authentication is not performed. After confirming that authentication has been successful, the coprocessor 25 issues a ticket using a random number and sets the expiration date of the ticket. Then, the coprocessor 25 operating as an output unit outputs the ticket and the expiration date of the ticket to the processor 21.

[0050] In step ST103, the processor 21 transmits a pre-registration response including the ticket and the expiration date to the host device 1 via the authentication and authorization function unit 201.

[0051] In step ST104, the processor 11 transmits a user registration request to the HSM 2. Having received the pre-registration response, the processor 11 uses the HSM setting application 101 to inform the administrator that a ticket has been acquired and the expiration date of the ticket. The administrator inputs the user ID of a user to be registered (e.g., a user of the application server 3). The user ID may be any information capable of uniquely identifying a user, and may be, for example, an email address, a user registration number registered in the application server 3, or the like. The processor 11 transmits a user registration request including the user ID, the ticket, and the administrator user ID via its own API.

[0052] In step ST105, the processor 21 and the coprocessor 25 issue temporary authentication information. The processor 21 outputs the user ID to the coprocessor 25 along with an instruction to perform authentication processing using slot X based on the administrator user ID included in the pre-registration request. The coprocessor 25, operating as a generator, generates temporary authentication information using random numbers and associates it with the user ID. The coprocessor 25 further encrypts the temporary authentication information using a DB key. Then, the coprocessor 25 outputs the temporary authentication information and the encrypted temporary authentication information to the processor 21.

[0053] In step ST106, the processor 21 transmits the temporary authentication information and the encrypted temporary authentication information to the host device 1 via the authentication and authorization function unit 201. The processor 11 stores the encrypted temporary authentication information in the user database in association with the user ID.

[0054] In step ST107, the processor 11 operating as a transmitter transmits the user's permanent authentication information to the HSM2. The processor 11 uses the HSM setting application 101 to show the temporary authentication information to the administrator. The administrator then inputs the user ID, the temporary authentication information, and the permanent authentication information to the host device 1. Here, the permanent authentication information is a password used by the user, and may be information set by the user. Therefore, the host device 1 may obtain the permanent authentication information in advance from the user of the application server 3. The processor 11 obtains the encrypted temporary authentication information linked to the user ID from the user database. The processor 11 then transmits the user ID, the temporary authentication information, the encrypted temporary authentication information, and the permanent authentication information to the HSM2 via the unique API.

[0055] In step ST108, the processor 21 and the coprocessor 25 perform authentication processing and encryption. The processor 21 outputs to the coprocessor 25 an instruction to perform authentication processing using slot X based on the user ID, along with the encrypted temporary authentication information, provisional authentication information, and provisional authentication information included in the user formal authentication information. The coprocessor 25, operating as an authentication unit, decrypts the encrypted temporary authentication information and determines whether the decrypted temporary authentication information matches the provisional authentication information. If they match, authentication is granted, and if they do not match, authentication is not granted. If authentication is granted, the coprocessor 25 encrypts the formal authentication information using the DB key. Then, it outputs the encrypted formal authentication information to the processor 21.

[0056] In step ST109, the processor 21 transmits the encrypted main authentication information to the host device 1 via the authentication and authorization function unit 201.

[0057] In step ST110, the processor 11 stores the encrypted main authentication information in the user database in association with the user ID.

[0058] FIG. 6 is a diagram showing an example of a conceptual diagram of the registration process described with reference to FIG. Step ST shown in Fig. 6 corresponds to step ST shown in Fig. 5. As shown in Fig. 6, first, the HSM setting application 101 causes the HSM2 to authenticate the administrator using the administrator user ID and administrator authentication information. After that, a user registration request including the user ID and ticket of the user to be registered is output to the HSM2, and temporary authentication information is issued. Then, the user ID, temporary authentication information, and real authentication information are output to the HSM2, whereby the real authentication information linked to the user ID is registered.

[0059] (Authentication process) Next, an example of authentication processing using the HSM2 will be described. FIG. 7 is a sequence diagram showing an example of the authentication process according to the embodiment. Each operation in this sequence is realized by processor 11 of host device 1, processor 21 and coprocessor 25 of HSM 2, and processor 31 of app server 3 reading and executing programs stored in the internal memory, RAM 12, or ROM 13 of processor 11, the internal memory, RAM 22, or ROM 23, or secure ROM 26 of processor 21, and the internal memory, RAM 32, or ROM 33 of processor 31.

[0060] In the following description, it is assumed that the user of the application server 3 is a user who has been registered by the above-mentioned registration operation. In the following description, the above-mentioned authentication information will simply be referred to as authentication information.

[0061] In step ST201, the processor 31 transmits pre-authentication information to the host device 1. The processor 31 operating as a transmission unit requests a user ID and authentication information from the user using the user application 301 or the like. The processor 31 acquires the user ID and authentication information input by the user to the user application 301. The processor 31 transmits the pre-authentication information including the acquired user ID and authentication information.

[0062] In step ST202, the processor 11 operating as a transmitter transmits a pre-authentication request to the HSM 2. The processor 11 acquires encrypted authentication information corresponding to the user ID from the user database 104. Then, the processor 11 transmits a pre-authentication request including the user ID, the authentication information, and the encrypted authentication information to the HSM 2 via the unique API 102.

[0063] In step ST203, the processor 21 and the coprocessor 25 perform authentication processing. The processor 21 outputs the authentication information and the encrypted authentication information to the coprocessor 25 along with an instruction to perform authentication processing using slot X based on the user ID included in the pre-authentication request. The coprocessor 25 operating as an authentication unit decrypts the encrypted authentication information. Then, it is determined whether the decrypted authentication information matches the authentication information. If they match, authentication is granted, and if they do not match, authentication is not granted. If authentication is granted, the coprocessor 25 operating as a generation unit issues a ticket using a random number and sets an expiration date for the ticket. The expiration date may be set to any time.

[0064] In step ST204, the processor 21 transmits an authentication response to the host device 1. The coprocessor 25 outputs the ticket and the expiration date of the ticket to the processor 21. The processor 21 transmits a pre-authentication response including the ticket and the expiration date of the ticket to the host device 1 via the authentication and authorization function unit 201.

[0065] In step ST205, the processor 11 transmits a pre-authentication response to the application server 3. As a result, the user of the application server 3 is authenticated. Then, the user performs various processes based on the ticket transmitted from the HSM 2.

[0066] In step ST206, the processor 31 transmits an initialization instruction to the host device 1. The processor 31 determines that authentication is required when using the HSM2 based on a predetermined process via the user application 301. The processor 31 then generates an initialization instruction for initializing a connection to the HSM2 in the process, and transmits the initialization instruction to the host device 1.

[0067] In step ST207, the processor 11 transmits an initialization instruction to the HSM 2 via the key management API 103. Furthermore, upon receiving the initialization instruction, the processor 11 converts the received initialization instruction into an initialization instruction usable by the HSM 2, and transmits the converted initialization instruction to the HSM 2 via the key management API 103. The processor 21 or the coprocessor 25 of the HSM 2 initializes the connection of the application server 3 to the HSM 2, for example, by using C_Initialize, in accordance with the initialization instruction.

[0068] In step ST208, the processor 31 transmits the slot number to the host device 1. Next, the processor 31 transmits, via the user application 301, to the host device 1, the slot number used by the user (for example, slot X in this embodiment).

[0069] In step ST209, the processor 11 transmits the slot number to the HSM 2. The processor 11 that has received the slot number converts the slot number into a slot number that can be used by the HSM 2, and transmits a session open instruction to the HSM 2 via the key management API 103. The coprocessor 25 that has received the session open instruction establishes a session between the token corresponding to the slot number (slot X) and the user application 301, for example, using C_OpenSession, and obtains a session handle that identifies the established session.

[0070] In step ST210, the processor 21 transmits the session, which is a session handle, to the host device 1 via the key management engine 203.

[0071] In step ST211, the processor 11 uses the communication unit 14 to transmit the session to the application server 3.

[0072] In step ST212, the processor 31 transmits the session information to the host device 1. Having received the session, the processor 31 generates session information including a session handle, a role, and a ticket, and transmits the generated session information to the host device 1.

[0073] Generally, the session information includes a session handle, a role, and a PIN. In this embodiment, however, the session information is generated so as to include the ticket included in the pre-authentication response.

[0074] In step ST213, the processor 11 transmits the session information to the HSM 2. Upon receiving the session information, the processor 11 converts the session information into session information usable by the HSM 2, and transmits the session information to the HSM 2 via the key management API 103.

[0075] In step ST214, the processor 21 and the coprocessor 25 perform authentication processing. The coprocessor 25 operating as an authentication unit authenticates the session information using, for example, C_Login. For example, the coprocessor 25 authenticates the role included in the session information. As a result of the authentication, the coprocessor 25 generates, for example, an encryption key corresponding to the ticket. The encryption key is stored, for example, in the secure ROM 26. At this time, it is possible to identify the user ID corresponding to the ticket included in the session information. The coprocessor 25 operating as an output unit outputs the authentication result to the processor 21.

[0076] In step ST215, the processor 21 transmits the authentication result to the host device 1 via the key management engine 203.

[0077] In step ST216, the processor 11 uses the communication unit 14 to transmit the authentication result to the application server 3.

[0078] In step ST217, the processor 31 transmits a cryptographic calculation request to the host device 1. When a cryptographic calculation such as C_Encrypt is required, the processor 31 transmits to the host device 1 a cryptographic calculation request which is a request to perform the cryptographic calculation.

[0079] In step ST218, the processor 11 transmits a cryptographic calculation request to the HSM2 through the PKCS#11 compliant API 1023.

[0080] In step ST219, the processor 21 and the coprocessor 25 perform a cryptographic calculation. The coprocessor 25 performs the cryptographic calculation according to the cryptographic calculation request using the cryptographic key corresponding to the ticket generated in step ST214. The coprocessor 25 then generates a cryptographic calculation result including a processing result of the cryptographic calculation, a log of the cryptographic calculation, the ticket, and a message authentication code (MAC). The processor 21 may store the calculation result in the ROM 23. The message authentication code is generated for the generated log and the acquired ticket. The host device 1, the HSM 2, and the user application server 3 can detect tampering of the log or the ticket based on the message authentication code as necessary, and can ensure non-repudiation of the user.

[0081] In step ST220, the processor 21 transmits the calculation result to the host device 1.

[0082] In step ST221, the processor 11 stores the calculation result. For example, the processor 11 associates the ticket of the calculation result with the user ID, and stores the calculation result (log and MAC) in the user database.

[0083] In step ST222, the processor 11 transmits the result of the cryptographic operation to the application server 3.

[0084] 8 and 9 are diagrams showing an example of a conceptual diagram of the registration process described with reference to FIG. Step ST shown in Figures 8 and 9 corresponds to step ST shown in Figure 7. As shown in Figure 8, first, authentication is performed based on pre-authentication information, and a ticket is issued. Then, authentication is performed based on session information including at least the ticket, and an encryption key corresponding to the ticket is generated. The ticket is linked to a user ID, and it is possible to identify the user who is handling the user application 301. Therefore, it is possible to recognize which user's process the log of the encryption calculation using the encryption key corresponding to the ticket is.

[0085] By implementing the above, it is possible to support the prevention of denial of individual users and the pursuit of accountability. In other words, it is possible to identify from the log who among the users who use the user application 301 created, used, and discarded an application. In other words, the above makes it possible to guarantee the entire life cycle of an encryption key that is used in encryption calculations and is generated, used, and deleted for each slot.

[0086] (Effects of the embodiment) According to the embodiment described above, it is possible to perform authentication that identifies a user who uses the user application 301 while conforming to PKCS#11. Also, by recording a log of the user's usage, it is possible to ensure the accountability of the user for any unauthorized use.

[0087] (Modification) In the above-described embodiment, an example has been shown in which a ticket is issued using the HSM 2 and the ticket is transmitted to the application server 3, but the host device 1 may issue a ticket and transmit it to the application server 3. In other words, the host device 1 may perform the authentication and generation functions during the ticket issuing process.

[0088] The program according to this embodiment may be transferred in a state stored in an electronic device (computer) as the host device 1, the HSM 2, or the application server 3, or may be transferred in a state not stored in the electronic device. In the latter case, the program may be transferred via a network, or may be transferred in a state stored in a storage medium. The storage medium is a non-transitory tangible medium. The storage medium is a medium (computer-readable medium) that can be read by a computer as the host device 1, the HSM 2, or the application server 3. The storage medium may be any medium capable of storing a program and being readable by a computer, such as an optical disk (e.g., a CD-ROM), a magnetic disk, or a semiconductor memory (e.g., a memory card), and the form of the medium is not important.

[0089] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0090] 10…Business office 100...Key management system 1...Host device 11…Processor 12…RAM 13...ROM 14…Communications Department 15... Input / Output Interface 16...Input device 17...Output device 101…HSM configuration application 102…Proprietary API 103…Key management API 104...User database 2…HSM 21…Processor 22…RAM 23...ROM 24…Communications Department 25...Coprocessor 26…Secure ROM 201...Authentication and authorization function unit 202…Slots 203...Key management engine 3. Application Server 31…Processor 32…RAM 33...ROM 34…Communications Department 35... Input / Output Interface 36...Input device 37...Output device 301...User application

Claims

1. a first acquisition unit that acquires pre-authentication information including a user ID, authentication information, and encrypted authentication information; A storage unit that securely stores the DB key; a first authentication unit that decrypts the encrypted authentication information by using the DB key and performs authentication by using the decrypted authentication information and the authentication information; a generation unit that generates a ticket linked to the user ID based on the authentication result and generates a pre-authentication response including the ticket; a first output unit that outputs the pre-authentication response; a second acquisition unit that acquires session information including the ticket; a second authentication unit that authenticates the session information based on the ticket included in the session information and generates an encryption key corresponding to the ticket; a second output unit that outputs an authentication result by the second authentication unit; A key management device comprising:

2. a third acquisition unit that acquires a cryptographic calculation request including the authenticated session information; a cryptographic calculation unit that performs cryptographic calculation using the cryptographic key generated corresponding to the ticket; a third output unit that outputs a calculation result including the ticket, a log of the cryptographic calculation, and a message authentication code (MAC); Further comprising: The key management device according to claim 1 .

3. a third acquisition unit that acquires a cryptographic calculation request including the authenticated session information; a cryptographic calculation unit that performs cryptographic calculation using the cryptographic key generated corresponding to the ticket; a second storage unit for storing the ticket, a log of the cryptographic calculation, and a calculation result including a message authentication code (MAC); Further comprising: The key management device according to claim 1 .

4. The storage unit is tamper-resistant. The key management device according to claim 1 .

5. The first acquisition unit acquires a pre-registration request including an administrator user ID, administrator authentication information, and encrypted administrator authentication information; the first authentication unit decrypts the encrypted administrator authentication information by using the DB key, and performs authentication by using the decrypted administrator authentication information and the administrator authentication information; the generation unit generates a second ticket associated with the administrator user ID based on an authentication result of the administrator authentication information, and generates a pre-registration response including the second ticket and an expiration date of the second ticket; The first output unit outputs the pre-registration response. The key management device according to claim 1 .

6. The first acquisition unit further acquires a user registration request including the second ticket and a user ID in response to the output of the pre-registration response, The generation unit generates temporary authentication information and encrypted temporary authentication information using random numbers; the first output unit outputs the temporary authentication information and the encrypted temporary authentication information. The key management device according to claim 5 .

7. the first acquisition unit acquires user real authentication information including the user ID, the temporary authentication information, the encrypted temporary authentication information, and real authentication information in response to the output of the temporary authentication information; the first authentication unit decrypts the encrypted temporary authentication information by using the DB key, performs authentication by using the decrypted temporary authentication information and the temporary authentication information, and encrypts the final authentication information by using the DB key in response to the authentication. The key management device according to claim 6.

8. the pre-authentication response includes an expiration date for the ticket. The key management device according to claim 1 .

9. A key management device; a host device connected to the key management device; A key management system comprising: The host device includes: an acquisition unit that acquires pre-authentication information including a user ID and authentication information from an application server; a storage unit that stores encrypted authentication information obtained by encrypting the authentication information; a first output unit that outputs a pre-authentication request including the user ID, authentication information, and the encrypted temporary authentication information to the key management device; a transmission unit that receives a pre-authentication response including a ticket in response to the pre-authentication request and transmits the pre-authentication response to the application server; a receiving unit that receives session information including the ticket; a second output unit that outputs the session information; Equipped with The key management device A storage unit that securely stores the DB key; a first authentication unit that decrypts encrypted authentication information included in the pre-authentication request by using the DB key, and performs authentication by using the decrypted authentication information and the authentication information; a generation unit that generates a ticket linked to the user ID based on the authentication result and generates a pre-authentication response including the ticket; a first output unit that outputs the pre-authentication response; a second authentication unit that authenticates the session information based on the ticket included in the session information and generates an encryption key corresponding to the ticket; a second output unit that outputs an authentication result by the second authentication unit; 1. A key management system comprising:

10. A key management method executed by a processor of a key management device, comprising: Obtaining pre-authentication information including a user ID, authentication information, and encrypted authentication information; Securely storing the DB key; decrypting the encrypted authentication information using the DB key; authenticating using the decrypted authentication information and the authentication information; generating a ticket linked to the user ID based on the authentication result; generating a pre-authentication response that includes the ticket; outputting the pre-authentication response; obtaining session information including the ticket; authenticating the session information based on the ticket included in the session information and generating an encryption key corresponding to the ticket; outputting an authentication result of the session information; The key management method includes:

11. A key management program comprising instructions for execution by a processor of a key management device, The instruction: Obtaining pre-authentication information including a user ID, authentication information, and encrypted authentication information; Securely storing the DB key; decrypting the encrypted authentication information using the DB key; authenticating using the decrypted authentication information and the authentication information; and generating a ticket linked to the user ID based on the authentication result; generating a pre-authentication response that includes the ticket; outputting the pre-authentication response; obtaining session information including the ticket; authenticating the session information based on the ticket included in the session information and generating an encryption key corresponding to the ticket; outputting an authentication result of the session information; A key management program.

Images