Authentication device, authentication system, and authentication method

Abstract

To provide an authentication device, an authentication system, and an authentication method, capable of preventing a leakage of an electromagnetic characteristic of an authenticated device in the case where an authentication of the authenticated device is performed via a communication network.SOLUTION: In an authentication system, an authentication device comprises a response data determination part 260 that compares a response data expectation value corresponded to a challenge data in accordance with an electromagnetic characteristic of at least one first authenticated device acquired from the first authenticated device with a response data corresponded to the electromagnetic characteristic and the challenge data of a second authenticated device, and determines an authenticity of the second authenticated device. Both of the electromagnetic characteristics of the first and second authenticated devices are a characteristic expressed as a secondary graph formed by a X-shaft and a Y-shaft, and the challenge data is generated as a pair [Xn and Yn] of Y-shaft threshold values in each of a plurality of X-shaft value Xn and each X-shaft value (n is an integer value).SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to authentication technology for electronic devices. [Background technology]

[0002] In conventional electronic device authentication, the electromagnetic characteristics of the electronic device are measured, the measured electromagnetic characteristics are stored in advance, and later the electromagnetic characteristics of the device to be authenticated are measured and compared with the electromagnetic characteristics stored in advance to determine the authenticity of the device to be authenticated (for example, Patent Document 1). Also, a method of authentication focusing on the spectrum of electromagnetic waves radiated from an electronic device as the electromagnetic characteristics of the electronic device has been proposed (for example, Non-Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] US Patent Application Publication No. 2010 / 0230597 [Non-patent literature]

[0004] [Non-Patent Document 1] Hidego Kaji et al., Basic Study on Individual Identification Method of Electronic Devices Using Differences in Emission Spectrum Caused by Manufacturing and Mounting Variations, Technical Report of the Institute of Electronics, Information and Communication Engineers, Japan, Institute of Electronics, Information and Communication Engineers, 2019.02.20, Vol.118, No.457, pp.163-167 Summary of the Invention [Problem to be solved by the invention]

[0005] According to the conventional technology, it is necessary to place a device that performs authentication (authentication device) near a device to be authenticated (authenticated device) and compare the electromagnetic characteristics of the authenticated device measured on the spot with the electromagnetic characteristics previously stored in the authentication device. In addition, if the authentication device and the authenticated device are in different locations and authentication is to be performed via a communication network, it is necessary to send the electromagnetic characteristic data of the authenticated device to the authentication device via the communication network. When communication is performed via a communication network, if the communication data on the communication network is intercepted and the electromagnetic characteristic data of the authenticated device is leaked, there is a problem that a counterfeit device may be used to pose as the genuine authenticated device for authentication.

[0006] The present disclosure has been made to solve such problems, and aims to provide an authentication technology that can prevent leakage of electromagnetic characteristics of a device to be authenticated when authentication of the device to be authenticated is performed via a communication network. [Means for solving the problem]

[0007] One aspect of an authentication device according to an embodiment of the present disclosure includes a response data determination unit that compares a response data expected value corresponding to challenge data corresponding to at least one electromagnetic characteristic of a first authenticated device obtained from a first authenticated device with the electromagnetic characteristics of a second authenticated device and response data corresponding to the challenge data, and determines the authenticity of the second authenticated device, where the electromagnetic characteristics of the first authenticated device and the electromagnetic characteristics of the second authenticated device are characteristics represented as a two-dimensional graph consisting of an X-axis and a Y-axis, and the challenge data is generated as a set [Xn, Yn] (n is an integer) of multiple X-axis values ​​Xn and a Y-axis threshold value Yn at each X-axis value. Effect of the Invention

[0008] According to the authentication device according to the embodiment of the present disclosure, the electromagnetic characteristics of the device to be authenticated are not transmitted or received, so that leakage of the electromagnetic characteristics of the device to be authenticated can be prevented. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an authentication system including an authentication device and a response device. [Figure 2A] FIG. 2 illustrates an example of a hardware configuration of an authentication device and a response device. [Figure 2B] FIG. 2 illustrates an example of a hardware configuration of an authentication device and a response device. [Diagram 3] 1 is a flow chart of an authentication method. [Figure 4] 11 is a diagram showing examples of electromagnetic characteristics (EMCi, EMCr), challenge data, response data, and response data expected values. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Various embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Note that components with the same or similar reference numerals in the drawings have the same or similar configurations or functions, and redundant descriptions of such components will be omitted.

[0011] Embodiment 1 <Configuration> (Authentication System) A configuration of an authentication system including an authentication device and a response device according to the first embodiment of the present disclosure will be described with reference to Fig. 1 and Fig. 2. The authentication system according to the present disclosure is a system that authenticates the authenticity of an authenticated device (second authenticated device) 100. In other words, the authenticated device 100 is a device that requests authentication. The authenticated device 100 has inherent electromagnetic characteristics (EMC: electromagnetic characteristics). Hereinafter, the inherent electromagnetic characteristics EMC will be expressed as electromagnetic characteristics EMCi, using the initial letter of inherent, which means "inherent".

[0012] Even if the device to be authenticated 100 is manufactured to the same design as other devices to be authenticated (not shown), each device has different electromagnetic characteristics EMCi due to manufacturing errors of individual components and printed wiring boards, assembly errors, etc. Examples of such electromagnetic characteristics EMCi include radiative electromagnetic noise radiated into space by the operation of the device to be authenticated 100, and conductive electromagnetic noise that is conducted through a cable when the device to be authenticated 100 is operating. Another example of the electromagnetic characteristics EMCi is the reflection characteristic (S of S parameters) observed from a specific external I / F such as the power connector or signal connector of the device to be authenticated 100, regardless of the operation of the device to be authenticated 100 (power on / off). 11 characteristics), and transmission characteristics between multiple external I / Fs (S parameters nm characteristics; n and m are numbers assigned to multiple external I / Fs), F parameters, Z parameters, Y parameters, etc. converted from S parameters. These are generally characteristics expressed on a frequency axis, but the electromagnetic characteristics EMCi of the device to be authenticated 100 may be characteristics expressed on a time axis, such as a reflected waveform when a step wave or impulse wave is applied to a specific external I / F of the device to be authenticated 100, or a passing waveform at another external I / F. In addition, a combination of multiple electromagnetic characteristics may be used as the electromagnetic characteristics EMCi. Examples of the device to be authenticated 100 include, for example, an electric device or electronic device, or an electric component or electronic component, but are not limited to these examples as long as the electromagnetic characteristics can be acquired. For example, it may be a mechanical component that does not include an electric circuit.

[0013] In order to authenticate the authenticity of the device to be authenticated 100, as shown in Fig. 1, the authentication system according to the present disclosure includes an authentication device 200, a storage device 500, and a response device 300. Communication between the authentication device 200 and the response device 300 is performed via a wired or wireless communication network 400. The storage device 500 is a device that pre-records electromagnetic characteristics EMCi of one or more devices to be authenticated. Hereinafter, the electromagnetic characteristics EMCi of the device to be authenticated (first device to be authenticated) recorded in the storage device 500 will be referred to as electromagnetic characteristics EMCr, using the initial letter of registered, which means "recorded".

[0014] (Authentication device) The authentication device 200 is a device that authenticates the authenticity of the device to be authenticated 100. To achieve this purpose, the authentication device 200 includes, as functional units, an electromagnetic characteristic acquisition unit (first electromagnetic characteristic acquisition unit) 210, a challenge data generation unit 220, an expected value generation unit 230, a challenge data transmission unit 240, a response data reception unit 250, and a response data determination unit 260.

[0015] (Electromagnetic characteristics acquisition department) The electromagnetic characteristic acquisition unit 210 is a functional unit that acquires at least one electromagnetic characteristic EMCr from the storage device 500. The electromagnetic characteristic acquisition unit 210 supplies the acquired electromagnetic characteristic EMCr to the challenge data generation unit 220 and the expected value generation unit 230. Note that the data may be supplied via a control unit (not shown) included in the authentication device 200. The same applies below.

[0016] (Challenge Data Generation Unit) The challenge data generation unit 220 is a functional unit that generates challenge data according to the electromagnetic characteristic EMCr acquired by the electromagnetic characteristic acquisition unit 210. The challenge data generation unit 220 supplies the generated challenge data to the challenge data transmission unit 240 and the expected value generation unit 230.

[0017] (Expected value generation part) The expected value generation unit 230 is a functional unit that compares the electromagnetic characteristic EMCr acquired by the electromagnetic characteristic acquisition unit 210 with the challenge data generated by the challenge data generation unit 220, and generates a response data expected value that is the result of the comparison. The expected value generation unit 230 supplies the generated response data to the response data determination unit 260.

[0018] (Challenge Data Transmission Unit) The challenge data transmission unit 240 is a functional unit that transmits the challenge data generated by the challenge data generation unit 220 to the response device 300 via the communication network 400 .

[0019] (Response data receiver) The response data receiving unit 250 is a functional unit that receives the response data related to the authentication target device 100 generated by the response device 300 from the response device 300 via the communication network 400.

[0020] (Response data determination part) The response data determination unit 260 is a functional unit that compares the response data expected value generated by the expected value generation unit 230 with the response data received by the response data reception unit 250, and determines the authenticity of the authentication-target device 100.

[0021] (Answering device) The response device 300 is a device that generates response data based on the electromagnetic characteristics EMCi of the device to be authenticated 100 and challenge data received from the authentication device 200, and responds to the authentication device 200 by transmitting the generated response data to the authentication device 200. To achieve this purpose, the response device 300 includes, as functional units, an electromagnetic characteristic acquisition unit (second electromagnetic characteristic acquisition unit) 310, a challenge data receiving unit 320, a response data generating unit 330, and a response data transmitting unit 340.

[0022] (Electromagnetic characteristics acquisition department) The electromagnetic characteristic acquisition unit 310 is a functional unit that acquires the electromagnetic characteristic EMCi of the device to be authenticated 100. The electromagnetic characteristic acquisition unit 310 supplies the acquired electromagnetic characteristic EMCi to the response data generation unit 330. Note that the data may be supplied via a control unit (not shown) included in the response device 300. The same applies below.

[0023] (Challenge data receiver) The challenge data receiving unit 320 is a functional unit that receives challenge data from the authentication device 200 via the communication network 400. The challenge data receiving unit 320 supplies the received challenge data to the response data generating unit 330.

[0024] (Response data generation part) The response data generating unit 330 is a functional unit that generates response data by comparing the electromagnetic characteristics EMCi supplied from the electromagnetic characteristics acquiring unit 310 with the challenge data supplied from the challenge data receiving unit 320. The response data generating unit 330 supplies the generated response data to the response data transmitting unit 340.

[0025] (Response data sending part) The response data transmission unit 340 is a functional unit that transmits the response data generated by the response data generation unit 330 to the authentication device 200 via the communication network 400.

[0026] 1, the response device 300 may be a device different from the device to be authenticated 100, or may be integrated with the device to be authenticated 100. When the response device 300 is integrated with the device to be authenticated 100, for example, the device to be authenticated 100 includes the functional unit of the response device 300.

[0027] Next, a hardware configuration example of the authentication device 200 and the response device 300 will be described with reference to Figures 2A and 2B. The functional units of the authentication device 200 and the response device 300 are realized by a processing circuit. The processing circuitry may be a dedicated processing circuit 600 as shown in Figure 2A, or a processor 700 that executes a program stored in a memory 800 as shown in Figure 2B.

[0028] When the processing circuitry is a dedicated processing circuit 600, the dedicated processing circuit 600 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination of these. Each functional unit of the authentication device 200 and the response device 300 may be realized by a plurality of separate processing circuits, or each functional unit may be realized by a single processing circuit.

[0029] When the processing circuitry is a processor 700, the functional units of the authentication device 200 and the response device 300 are realized by software, firmware, or a combination of software and firmware. The software and firmware are written as programs and stored in the memory 800. The processor 700 realizes the functions of each functional unit by reading and executing the programs stored in the memory. Here, examples of the memory 800 include non-volatile or volatile semiconductor memories such as random access memory (RAM), read-only memory (ROM), flash memory, erasable programmable read-only memory (EPROM), and electrically erasable programmable read-only memory (EEPROM), as well as magnetic disks, flexible disks, optical disks, compact disks, mini disks, and DVDs.

[0030] In addition, some of the functional units of the authentication device 200 and the response device 300 may be realized by dedicated hardware, and some may be realized by software or firmware. In this way, the processing circuit can realize each of the above-mentioned functions by hardware, software, firmware, or a combination of these.

[0031] <Operation> Next, the operation of the authentication system of the present disclosure will be described with reference to Figures 3 and 4. First, the electromagnetic characteristic EMCi of the device to be authenticated 100 is recorded in advance in the storage device 500 together with the identification information of the device to be authenticated 100. As described above, the electromagnetic characteristic EMCi of the device to be authenticated 100 recorded in the storage device 500 is referred to as the electromagnetic characteristic EMCr. The electromagnetic characteristic EMCi is recorded for each device to be authenticated that is expected to be authenticated later.

[0032] The authentication system operates in response to an authentication request for the device to be authenticated 100 from the device to be authenticated 100 or another external system (not shown) to the authentication device 200. In response to the authentication request, in step ST101, the electromagnetic characteristic acquisition unit 210 of the authentication device 200 acquires an electromagnetic characteristic EMCr of the device to be authenticated 100 from one or more electromagnetic characteristics recorded in the storage device 500.

[0033] In step ST102, the challenge data generating unit 220 generates challenge data, which is a data set corresponding to the electromagnetic characteristic EMCr. The "data set corresponding to the electromagnetic characteristic EMCr" means a data set including at least one pair (X, Y) of an X-axis value X on the X-axis of the electromagnetic characteristic EMCr and a Y-axis value Y at the X-axis value X, where the Y-axis value Y is smaller than the maximum value and larger than the minimum value of the electromagnetic characteristic EMCr in a two-dimensional graph representing the electromagnetic characteristic EMCr.

[0034] As an example, the challenge data generating unit 220 generates, as challenge data, a set [Xn, Yn] (n is an integer) of a plurality of X-axis values ​​(Xn; for example, frequency or time) of the electromagnetic characteristic EMCr and a threshold value for a Y-axis value (Yn; for example, gain, phase, or signal waveform) at each X-axis value. When generating challenge data by combining a plurality of electromagnetic characteristics, the challenge data may be in a format such as [Xn, Y1n, Y2n,...] (n is an integer) as a set of threshold values ​​Y1n and Y2n of different characteristics corresponding to a common X-axis value (Xn). The challenge data generating unit 220 randomly generates such challenge data every time an authentication request occurs. That is, the number of n on the X-axis, the X-axis value (Xn), and all or a part of the Y-axis threshold value Yn corresponding to Xn are randomly generated every time an authentication request occurs even for the same authentication-target device 100.

[0035] As another example, the challenge data generation unit 220 may generate, as the challenge data, a set [Xn, Y] (n is an integer) of multiple X-axis values ​​Xn and a single Y-axis threshold Y that is common to the multiple X-axis values.

[0036] As another example, the challenge data generation unit 220 may generate, as challenge data, for the X-axis, a plurality of shared X-axis values ​​Xn, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated by a common tool and shared each time an authentication request is made, and for the Y-axis, may generate a plurality of different Y-axis threshold values ​​Yn for the shared X-axis values.

[0037] As another example, the challenge data generation unit 220 may generate, as challenge data, for the X-axis, multiple shared X-axis values ​​Xn, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated by a common tool and shared each time an authentication request is made, and for the Y-axis, a common and single Y-axis threshold Y may be generated for the multiple shared X-axis values.

[0038] As another example, the challenge data generating unit 220 may generate a plurality of X-axis values ​​Xn and some or all of the Y-axis thresholds Y or Yn for each X-axis value as random values ​​each time an authentication request occurs.

[0039] In step ST103, the expected value generating unit 230 compares the electromagnetic characteristic EMCr with the generated challenge data to generate a response data expected value that is a result of the comparison. That is, the expected value generating unit 230 generates a response data expected value that is expected for the generated challenge data. For example, the expected value generating unit 230 compares the electromagnetic characteristic EMCr of the authenticated device 100 with the generated challenge data, and generates an n-bit bit string (first data) as the response data expected value, with "1" if the level of the electromagnetic characteristic EMCr corresponding to the designated Xn is Yn or higher, and "0" if it is less than Yn. Note that the method of generating response data from the electromagnetic characteristic and challenge data in this way is also set in advance in the response data generating unit 330 of the response device 300.

[0040] In step ST104, the challenge data transmitting section 240 transmits the challenge data to the response device 300 via the communication network 400 in parallel with or before or after the generation of the response data expectation value.

[0041] The challenge data thus transmitted from the authentication device 200 is received by the challenge data receiving section 320 of the response device 300 via the communication network 400 (step ST201).

[0042] In step ST202, the electromagnetic characteristic acquisition unit 310 acquires the electromagnetic characteristic EMCi of the device to be authenticated 100 based on the received challenge data. For example, it extracts the electromagnetic characteristic EMCi recorded as data in the device to be authenticated 100, measures the characteristic such as an S parameter with a function equivalent to a network analyzer (converts the characteristics such as F, Z, Y parameters), and measures the response characteristic to a step wave or impulse wave with a function equivalent to a signal generator and a function equivalent to an oscilloscope.

[0043] Next, in step ST203, the response data generating unit 330 compares the acquired electromagnetic characteristic EMCi of the authenticated device 100 to be authenticated with the received challenge data, and generates the result of the comparison as response data. Following the above example, similar to the operation of the expected value generating unit 230, if the level of the electromagnetic characteristic EMCi corresponding to Xn specified in the challenge data is Yn or higher, the response data is generated as an n-bit bit string (second data) with "1" and if it is less than Yn, "0". The response data generating unit 330 passes the generated response data to the response data transmitting unit 340.

[0044] Next, in step ST204, the response data transmitting section 340 transmits the generated response data to the authentication device 200 via the communication network 400.

[0045] The response data transmitted from the response device 300 in this manner is received by the response data receiving section 250 of the authentication device 200 via the communication network 400 (step ST105).

[0046] Finally, in step ST106, the response data determination unit 260 compares the response data expected value generated by the expected value generation unit 203 with the response data received by the response data reception unit 250 to determine the authenticity of the device to be authenticated 100. For example, the response data expected value of n-bit generated by the expected value generation unit 230 is compared with the response data of n-bit received by the response data reception unit 250, and if there is a perfect match or a certain number of bits (for example, 85% or more of the total number of bits) match, the device to be authenticated is authenticated as authentic. The authentication result is transmitted to the device to be authenticated 100 that generated the authentication request or to another external system (not shown), etc.

[0047] FIG. 4 is a diagram showing examples of the electromagnetic characteristics (EMCi, EMCr), challenge data, response data, and response data expected values ​​exemplified in the above operation description.

[0048] Reference numeral 211 denotes an example of the recorded electromagnetic characteristic EMCr of the device to be authenticated, acquired by the electromagnetic characteristic acquisition unit 210 of the authentication device 200. As shown in Fig. 4, the electromagnetic characteristic EMCr is a characteristic represented as a two-dimensional graph consisting of an X-axis and a Y-axis.

[0049] Reference number 221 is an example of challenge data generated by challenge data generation unit 220 of authentication device 200, and is shown as challenge data consisting of multiple X-axis values ​​of electromagnetic characteristics (X-axis is, for example, frequency or time) and a set of threshold values ​​for Y-axis values ​​on the X-axis [Xn, Yn] (n is an integer).

[0050] Reference numeral 311 denotes an example of the electromagnetic characteristic EMCi of the authenticated device 100 acquired by the electromagnetic characteristic acquisition unit 310 of the response device 300. As shown in Fig. 4, the electromagnetic characteristic EMCi is a characteristic expressed as a two-dimensional graph consisting of an X-axis and a Y-axis.

[0051] Reference numeral 331 denotes response data consisting of a 7-bit bit string generated by the response data generating unit 330 by matching the challenge data 221 received by the challenge data receiving unit 320 with the electromagnetic characteristic 311 of the device to be authenticated 100 acquired by the electromagnetic characteristic acquiring unit 310, and setting the level of the unique electromagnetic characteristic 311 corresponding to Xn of the X-axis specified in the challenge data 221 to "1" if the level is Yn or higher, and setting the level to "0" if the level is less than Yn. In this way, the response data generating unit 330 compares the Y-axis threshold value Yn with the Y-axis value at the multiple X-axis values ​​Xn of the electromagnetic characteristic 311, and determines which of the Y-axis threshold value Yn and the Y-axis value of the electromagnetic characteristic 311 is larger, to generate 7-bit data.

[0052] Reference numeral 231 denotes a response data expected value consisting of a 7-bit bit string generated by the expected value generation unit 230 by matching the electromagnetic characteristic 211 acquired by the electromagnetic characteristic acquisition unit 210 with the challenge data 221 generated by the challenge data generation unit 220, and generating "1" if the level of the electromagnetic characteristic 211 corresponding to Xn on the X-axis specified in the challenge data 221 is equal to or higher than Yn, and "0" if it is lower than Yn. In this way, the expected value generation unit 230 compares the Y-axis threshold value Yn with the Y-axis value at multiple X-axis values ​​Xn of the electromagnetic characteristic 211, and generates 7-bit data by determining which of the Y-axis threshold value Yn and the Y-axis value of the electromagnetic characteristic 211 is larger.

[0053] The response data 331 is received by the response data receiving unit 250 of the authentication device 200 via the communication network 400 by the response data transmitting unit 340 of the response device 300. The response data determining unit 260 compares the response data 331 with the response data expected value 231 generated by the expected value generating unit 230. If the response data 331 and the response data expected value 231 match perfectly or if a certain number of bits match between the response data 331 and the response data expected value 231, the authentication device 200 certifies that the device to be authenticated is genuine.

[0054] As described above, when authenticating an electronic device using its unique electromagnetic characteristics, challenge data corresponding to the unique electromagnetic characteristics of the device to be authenticated is randomly generated every time an authentication request occurs, transmitted via a communication network, and authentication is performed using response data corresponding to the challenge data, so that authentication can be performed via a communication network. Even if the challenge data or response data is intercepted on the communication network, false authentication due to spoofing or the like can be prevented because the unique electromagnetic characteristics of the device are kept secret.

[0055] Embodiment 2 For the second and subsequent embodiments, overlapping explanations of points in common with the first embodiment will be omitted, and an effort will be made to explain points of difference from the first embodiment.

[0056] The overall configuration of an authentication system including an authentication device and a response device according to the second embodiment is as shown in FIG. 1, similar to the first embodiment.

[0057] In the second embodiment, the challenge data generation unit 220 may generate, as challenge data each time an authentication request occurs, a set [Xn,Y] (n is an integer) of multiple X-axis values ​​(Xn; the X-axis is, for example, frequency or time) of the electromagnetic characteristic EMCr and a single Y-axis threshold value (Y) that is common to the multiple X-axis values.

[0058] The challenge data generator 220 may randomly generate a plurality of X-axis values ​​Xn and a common and single Y-axis threshold value Y every time an authentication request occurs.

[0059] The expected value generating unit 230 compares the Y-axis threshold Y with the Y-axis value at the multiple X-axis values ​​Xn of the electromagnetic characteristic 211, and determines which of the Y-axis threshold Y and the Y-axis value of the electromagnetic characteristic 211 is greater.

[0060] The response data generating unit 330 compares the Y-axis threshold Y with the Y-axis value of the multiple X-axis values ​​Xn of the electromagnetic characteristic 311, and determines which of the Y-axis threshold Y and the Y-axis value of the electromagnetic characteristic 311 is greater.

[0061] By generating the challenge data in this manner, it is possible to obtain an effect that the amount of challenge data can be reduced more than in the first embodiment.

[0062] Embodiment 3 The overall configuration of an authentication system including an authentication device and a response device according to the third embodiment is as shown in FIG. 1, similar to the first embodiment.

[0063] In the third embodiment, it is assumed that a plurality of X-axis values ​​are shared in advance between the authentication device 200 and the response device 300. The challenge data generation unit 220 acquires the shared plurality of X-axis values ​​by referring to memory. The shared plurality of X-axis values ​​may always be the same, or may be changed according to a certain predetermined rule every time an authentication request occurs.

[0064] In this manner, when multiple X-axis values ​​are shared, the challenge data generation unit 220 may generate multiple shared X-axis values ​​Xn for the X-axis, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated by a common tool and shared each time an authentication request is made, and may generate multiple Y-axis thresholds Yn that are different from one another for the multiple shared X-axis values ​​for the Y-axis.

[0065] In addition, the challenge data transmission unit 240 may transmit only the multiple Y-axis thresholds Yn generated by the challenge data generation unit 220 as [Yn] (n is an integer) out of the multiple X-axis values ​​Xn and multiple Y-axis thresholds Yn generated by the challenge data generation unit 220.

[0066] With this configuration, it is possible to obtain the effect that the amount of challenge data can be further reduced compared to the second embodiment.

[0067] Embodiment 4 The overall configuration of an authentication system including an authentication device and a response device according to the fourth embodiment is as shown in FIG. 1, similar to the first embodiment.

[0068] In the fourth embodiment, it is assumed that a plurality of X-axis values ​​are shared in advance between the authentication device 200 and the response device 300. The challenge data generation unit 220 acquires the shared plurality of X-axis values ​​by referring to memory. The shared plurality of X-axis values ​​may always be the same, or may be changed according to a certain rule every time an authentication request occurs.

[0069] In this manner, when multiple X-axis values ​​are shared, the challenge data generation unit 220 may generate multiple shared X-axis values ​​Xn for the X-axis, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated by a common tool and shared each time an authentication request is made, and may generate a common and single Y-axis threshold Y for the multiple shared X-axis values ​​Xn for the Y-axis.

[0070] Furthermore, the challenge data transmitting unit 240 may transmit only the generated single Y-axis threshold Y out of the generated multiple X-axis values ​​Xn and the single Y-axis threshold Y as [Y].

[0071] With this configuration, it is possible to obtain the effect of greatly reducing the amount of challenge data.

[0072] Embodiment 5. The overall configuration of an authentication system including an authentication device and a response device according to the fifth embodiment is as shown in FIG. 1, similar to the first embodiment.

[0073] In the fifth embodiment, the challenge data generating unit 220 may randomly generate a Y-axis threshold for the X-axis value of the electromagnetic characteristic EMCr outside a certain ratio range, for example, outside a range of the Y value of the electromagnetic characteristic EMCr ±10%. The challenge data generating units 220 in the first to third embodiments may also generate a Y-axis threshold outside a certain ratio range.

[0074] This provides the effect of reducing the effect on threshold determination even if the electromagnetic characteristics EMCi change slightly due to environmental changes or deterioration over time.

[0075] Embodiment 6 The overall configuration of an authentication system including an authentication device and a response device according to the sixth embodiment is as shown in FIG. 1, similar to the first embodiment.

[0076] In the sixth embodiment, the expected value generating unit 230 and the response data generating unit 330 may perform a calculation on the bit string of the comparison result between the Y-axis threshold value and the generated X-axis value according to a predetermined rule, and use the result as response data. For example, the expected value generating unit 230 and the response data generating unit 330 may encode or encrypt the bit string of the comparison result. The expected value generating unit 230 and the response data generating unit 330 in the first to fifth embodiments may operate in the same manner.

[0077] This has the effect of making it difficult to estimate the electromagnetic characteristic EMCi or the electromagnetic characteristic EMCr of the device to be authenticated, even if the challenge data and the response data are intercepted multiple times.

[0078] It is possible to combine the embodiments, and to modify or omit each embodiment as appropriate. [Industrial Applicability]

[0079] The authentication system of the present disclosure can be used as an authentication system for an authenticated device via a communication network. [Explanation of symbols]

[0080] 100 Authentication target device, 200 Authentication device, 203 Expected value generation unit, 210 Electromagnetic characteristic acquisition unit (first electromagnetic characteristic acquisition unit), 211 Electromagnetic characteristic EMCr, 220 Challenge data generation unit, 221 Challenge data, 230 Expected value generation unit, 231 Response data expected value, 240 Challenge data transmission unit, 250 Response data reception unit, 260 Response data judgment unit, 300 Response device, 310 Electromagnetic characteristic acquisition unit (second electromagnetic characteristic acquisition unit), 311 Electromagnetic characteristic EMCi, 320 Challenge data reception unit, 330 Response data generation unit, 331 Response data, 340 Response data transmission unit, 400 Communication network, 500 Storage device, 600 Processing circuit, 700 Processor, 800 Memory.

Claims

1. a response data determination unit that compares a response data expected value corresponding to challenge data according to at least one electromagnetic characteristic of a first device to be authenticated, which is acquired from the first device to be authenticated, with electromagnetic characteristics of a second device to be authenticated and response data corresponding to the challenge data, and determines authenticity of the second device to be authenticated; the electromagnetic characteristics of the first device to be authenticated and the electromagnetic characteristics of the second device to be authenticated are characteristics expressed as a two-dimensional graph having an X-axis and a Y-axis, The challenge data is generated as a set [Xn, Yn] (n is an integer) of a plurality of X-axis values ​​Xn and a Y-axis threshold value Yn at each X-axis value. Authentication device.

2. The Y-axis threshold Yn of the challenge data is a common and single Y-axis threshold Y for the multiple X-axis values.

2. The authentication device according to claim 1.

3. 2. The authentication device according to claim 1, the challenge data is transmitted to a response device; the response data is generated in the response device and then transmitted to the authentication device; The X-axis value Xn of the challenge data is a plurality of shared X-axis values ​​Xn, which are fixed values ​​shared in advance between the authentication device and the response device, or variable values ​​generated by a common tool and shared each time an authentication request is made, The Y-axis threshold Yn of the challenge data is a plurality of Y-axis thresholds Yn different from each other for the shared plurality of X-axis values, the authentication device transmits only the plurality of Y-axis thresholds Yn out of the plurality of X-axis values ​​Xn and the plurality of Y-axis thresholds Yn as [Yn] (n is an integer); 2. The authentication device according to claim 1.

4. 2. The authentication device according to claim 1, the challenge data is transmitted to a response device; the response data is generated in the response device and then transmitted to the authentication device; The X-axis value Xn of the challenge data is a plurality of shared X-axis values ​​Xn, which are fixed values ​​shared in advance between the authentication device and the response device, or variable values ​​generated by a common tool and shared each time an authentication request is made, The Y-axis threshold Yn of the challenge data is a common and single Y-axis threshold Y for the shared multiple X-axis values ​​Xn, The authentication device transmits only the single Y-axis threshold Y as [Y] among the multiple X-axis values ​​Xn and the single Y-axis threshold Y.

2. The authentication device according to claim 1.

5. The plurality of X-axis values ​​Xn and some or all of the Y-axis thresholds Y or Yn at each X-axis value are set to random values ​​each time an authentication request is generated. An authentication device according to any one of claims 1 to 4.

6. An authentication device according to claim 1; a response device which receives the challenge data and transmits the response data to the authentication device; An authentication system comprising:

7. the response device and the second authenticated device are integrated together; 7. An authentication system according to claim 6.

8. A step of comparing a response data expected value corresponding to challenge data according to at least one electromagnetic characteristic of the first device to be authenticated acquired from the first device to be authenticated with electromagnetic characteristics of the second device to be authenticated and response data corresponding to the challenge data, and determining authenticity of the second device to be authenticated. Equipped with the electromagnetic characteristics of the first device to be authenticated and the electromagnetic characteristics of the second device to be authenticated are characteristics expressed as a two-dimensional graph having an X-axis and a Y-axis, The challenge data is generated as a set [Xn, Yn] (n is an integer) of a plurality of X-axis values ​​Xn and a Y-axis threshold value Yn at each X-axis value. Authentication method.

Images