Information processing system, information processing method, and program

Abstract

To provide an information processing system, an information processing method, and a program configured to facilitate management of transitional period of public key cryptosystems.SOLUTION: An information processing system includes a selection unit and an authentication unit. The selection unit selects, when a parameter related to a transaction does not satisfy a predetermined condition, a first public key cryptosystem from among a plurality of public key cryptosystems, or selects, when the parameter satisfies the predetermined condition, a second public key cryptosystem which is different from the first public key cryptosystem. The authentication unit acquires, when the first public key cryptosystem is selected, a first public key certificate in the first public key cryptosystem from an IC card to execute authentication processing on the IC card using the first public key cryptosystem, or acquires, when the second public key cryptosystem is selected, a tag specifying a second public key certificate in the second public key cryptosystem from the IC card, and acquires the second public key certificate based on the tag from a server, to execute authentication processing on the IC card using the second public key cryptosystem.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] An embodiment of the present invention relates to an information processing system, an information processing method, and a program. [Background technology]

[0002] With the advent of quantum computers, there has been much discussion about the transition to PQC (Post-Quantum Cryptography) calculations, which is an example of public key cryptography. The advent of quantum computers increases the possibility that current encryption, including IC cards, can be decrypted. Therefore, security products, including IC cards, need to be made compatible with PQC calculations. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2022-508774 Summary of the Invention [Problem to be solved by the invention]

[0004] However, when switching to PQC calculation, the data size of the public key certificate for PQC calculation may become much larger than that of the public key certificate for conventional public key cryptography such as RSA encryption, etc. Therefore, a system that solves the problem of the data size to be stored in the IC card is required.

[0005] The present invention has been made in consideration of the above, and aims to provide an information processing system, an information processing method, and a program that can facilitate operation during the transition period of migration of public key cryptography. [Means for solving the problem]

[0006] An information processing system according to an embodiment includes a selection unit and an authentication unit. The selection unit selects a first public key cryptosystem from among a plurality of public key cryptosystems when a parameter related to a transaction does not satisfy a predetermined condition, and selects a second public key cryptosystem different from the first public key cryptosystem from among the plurality of public key cryptosystems when the parameter satisfies a predetermined condition. When the selection unit selects the first public key cryptosystem, the authentication unit acquires a first public key certificate of the first public key cryptosystem from the IC card and performs authentication processing of the IC card by the first public key cryptosystem, and when the selection unit selects the second public key cryptosystem, the authentication unit acquires a tag identifying a second public key certificate of the second public key cryptosystem from the IC card, acquires a second public key certificate from the server based on the tag, and performs authentication processing of the IC card by the second public key cryptosystem. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of an information processing system according to the present embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of the configuration of an IC card included in the information processing system according to the present embodiment. [Diagram 3] FIG. 3 is a diagram showing an example of the configuration of the affiliated store terminal included in the information processing system according to the present embodiment. [Figure 4] FIG. 4 is a diagram showing an example of the configuration of the issuer host server included in the information processing system according to the present embodiment. [Diagram 5] FIG. 5 is a diagram showing an example of the functional configuration of the affiliated store terminal included in the information processing system according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, an example of an information processing system, an information processing method, and a program according to the present embodiment will be described with reference to the accompanying drawings.

[0009] 1 is a diagram showing an example of the configuration of an information processing system according to the present embodiment. The information processing system according to the present embodiment includes an issuer host server 10, an affiliated store terminal 20, and an IC card 30, as shown in FIG.

[0010] 2 is a diagram showing an example of the configuration of an IC card included in the information processing system according to this embodiment. The IC card 30 may be a credit card or the like. In this embodiment, the IC card 30 has a card-shaped main body C made of plastic or the like. The IC card 30 also has a module M built into the main body C. The module M is integrally formed with an IC chip Ca, a communication unit 35, an MPU 36, and a fingerprint sensor 37 connected together, and is embedded in the main body C of the IC card 30.

[0011] 2, the IC card 30 includes a module M and the like. The module M includes an IC chip Ca, a communication unit 35, an MPU 36, and the like. The IC chip Ca includes a processor 31, a ROM 32, a RAM 33, an NVM 34, and the like. The processor 31 is connected to the ROM 32, the RAM 33, the NVM 34, and the communication unit 35 via a data bus or the like. The communication unit 35 is connected to the MPU 36 via a data bus or the like.

[0012] The IC card 30 may include components as necessary in addition to the components shown in FIG. 2, and certain components may be excluded from the IC card 30.

[0013] The processor 31 functions as a control unit that controls the entire IC card 30. The processor 31 performs various processes based on control programs and control data stored in the ROM 32 or the NVM 34. For example, the processor 31 executes a program stored in the ROM 32 to control the operation of the IC card 30 or to perform various processes according to the operation mode of the IC card 30. The processor 31 is also an example of a processor that transmits a tag stored in the ROM 32, which will be described later, via the communication unit 35.

[0014] For example, the processor 31 may be a processor that executes a program to control each unit in the IC card 30 and perform information processing. Some of the various functions that the processor 31 executes the program may be realized by a hardware circuit. In this case, the processor 31 controls the functions executed by the hardware circuit.

[0015] ROM 32 is a non-volatile memory that stores control programs, control data, etc. in advance. ROM 32 is incorporated into IC card 30 during the manufacturing stage with the control programs, control data, etc. stored therein. That is, the control programs and control data stored in ROM 32 are incorporated in advance according to the specifications of IC card 30.

[0016] Specifically, ROM 32 stores a tag that identifies a first public key certificate (e.g., an RSA public key certificate) of at least one first public key cryptosystem (e.g., RSA operation) among the multiple public key cryptosystems, and a second public key certificate (e.g., a PQC certificate) of at least one second public key cryptosystem (e.g., PQC operation) different from the first public key cryptosystem among the multiple public key cryptosystems. That is, ROM 32 is an example of a storage unit that stores a tag.

[0017] RAM 33 is a volatile memory. RAM 33 temporarily stores data being processed by processor 31. For example, RAM 33 functions as a calculation buffer, a reception buffer, and a transmission buffer. The calculation buffer temporarily holds the results of various arithmetic processes executed by processor 31. The reception buffer holds command data and the like received from affiliated store terminal 20 via communication unit 35. The transmission buffer holds messages or response data (e.g., public key certificates or tags) and the like to be transmitted to affiliated store terminal 20 via communication unit 35.

[0018] The NVM 34 is configured by a non-volatile memory such as a flash ROM to which data can be written and rewritten. The NVM 34 stores control programs, applications, and various data according to the operational use of the IC card 30. For example, program files, data files, and the like are created in the NVM 34. The control programs and various data, and the like are written in each created file.

[0019] The communication unit 35 is an interface for transmitting and receiving data to and from the affiliated store terminal 20. In other words, the communication unit 35 is an example of a third communication interface that communicates with the affiliated store terminal 20 (an example of a terminal). When the IC card 30 is realized as a contact-type IC card, the communication unit 35 is composed of a communication control unit and a contact unit for physically and electrically contacting the affiliated store terminal 20 to transmit and receive signals. For example, the IC card 30 is activated by receiving an operating power supply and an operating clock from the affiliated store terminal 20 via the contact unit.

[0020] When IC card 30 is realized as a contactless IC card, communication unit 35 is composed of a communication control unit such as a modulation / demodulation circuit for wireless communication with affiliated store terminal 20, and an antenna. For example, IC card 30 receives radio waves from affiliated store terminal 20 via an antenna and a modulation / demodulation circuit. IC card 30 is activated by generating operating power and an operating clock from the radio waves using a power supply unit (not shown).

[0021] The communication unit 35 is an interface for transmitting and receiving data to and from the MPU 36 .

[0022] 3 is a diagram showing an example of the configuration of an affiliated store terminal included in the information processing system according to this embodiment. The affiliated store terminal 20 is installed in a store or the like, communicates with an IC card 30 held by a user, transmits information to the IC card 30, and receives information from the IC card 30. Many IC cards 30 are distributed in the market, and affiliated store terminals 20 installed in various places communicate with the IC card 30 held by a user.

[0023] Here, we will explain the schematic configuration of the affiliated store terminal 20. The affiliated store terminal 20 includes a processor 21, a ROM (Read Only Memory) 22, a RAM (Random Access Memory) 23, an auxiliary storage device 24, a card reader / writer 25, an operation unit 26, a display 27, and a communication interface 28.

[0024] The processor 21 corresponds to the central part of a computer that executes various processes such as calculations and controls required for the operation of the affiliated store terminal 20 based on a program stored in at least one of the ROM 22 and the auxiliary storage device 24. The processor 21 is, for example, a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). The affiliated store terminal 20 may be configured to combine two or more processors 21 and execute various processes through cooperation between these two or more processors.

[0025] For example, by executing a program, processor 21 has a function of transmitting command data to IC card 30 via card reader / writer 25, a function of executing processing based on response data etc. received from IC card 30, a function of selecting a public key cryptosystem (calculation method) to be used for a transaction from among a plurality of public key cryptosystems, and a communication function between IC card 30 and issuer host server 10. By using these functions, processor 21 transmits a write command including data input to operation unit 26 etc. or write data to IC card 30 via card reader / writer 25.

[0026] The ROM 22 is a read-only non-volatile memory that corresponds to the main memory of the processor 21, which corresponds to a computer. The ROM 22 stores programs such as an operating system or application software. The ROM 22 also stores data and the like used by the processor 21 when performing various processes.

[0027] The RAM 23 is a volatile memory that corresponds to a main storage portion of the processor 21, which corresponds to a computer. The RAM 23 is used as a so-called work area for storing data that is temporarily used when the processor 21 performs various processes.

[0028] The auxiliary storage device 24 corresponds to an auxiliary storage portion of the processor 21, which corresponds to a computer. The auxiliary storage device 24 is, for example, an EEPROM (Electric Erasable Programmable Read Only Memory) (registered trademark), an HDD (Hard Disk Drive), or an SSD (Solid State Drive). The auxiliary storage device 24 may store a part or all of the above programs. The auxiliary storage device 24 also stores data used by the processor 21 in performing various processes, data generated by the various processes by the processor 21, various setting values, etc.

[0029] The card reader / writer 25 is an interface device for transmitting and receiving data to and from the IC card 30. That is, the card reader / writer 25 is an example of a first communication interface that communicates with the IC card 30. The card reader / writer 25 is an example of a reader that reads a public key certificate or a tag from the IC card 30. The card reader / writer 25 includes an antenna, a contact terminal, a communication control unit, and the like, and communicates in a non-contact manner with a combination or contactless IC card 30 (antenna of the IC card 30) via the antenna, and communicates by being physically and electrically connected to the combination IC card 30 (contact terminal of the IC card) via the contact terminal. As described above, in this embodiment, the case where a combination card is used is described, but if the card reader / writer 25 is for a contactless card, no contact terminal is provided.

[0030] The operation unit 26 accepts input instructions from an operator of the affiliated store terminal 20. The operation unit 26 transmits input data corresponding to the accepted input instructions to the processor 21. The operation unit 26 is, for example, a keyboard, a numeric keypad, or a touch panel.

[0031] Display 27 is a display device that displays various information under the control of processor 21. Display 27 is, for example, a liquid crystal monitor. Display 27 may be formed integrally with operation unit 26, for example. Communication interface 28 communicates with external devices such as issuer host server 10. In other words, communication interface 28 is an example of a second communication interface that communicates with issuer host server 10.

[0032] Fig. 4 is a diagram showing an example of the configuration of an issuer host server included in the information processing system according to this embodiment. Issuer host server 10 is a server that performs screening and issuing of credit cards. In this embodiment, issuer host server 10 has a CPU 11, ROM 12, RAM 13, and communication interface 14, as shown in Fig. 4. CPU 11, ROM 12, RAM 13, and communication interface 14 are connected via a data bus or the like.

[0033] CPU 11 controls the entire issuer host server 10. For example, CPU 11 is an example of a processor that transmits a second public key certificate to the affiliated store terminal 20 via the communication interface 4. ROM 12 stores various programs and various data executed by CPU 11. ROM 12 also stores a second public key certificate and a tag of the second public key certificate in association with each other. That is, ROM 12 is an example of a storage unit that stores a second public key certificate based on a tag. RAM 13 is used as a working area when CPU 11 executes various programs stored in ROM 12. Communication interface 14 manages communication between issuer host server 10 and external devices such as affiliated store terminal 20. That is, communication interface 14 is an example of a fourth communication interface that communicates with affiliated store terminal 20.

[0034] 5 is a diagram showing an example of the functional configuration of an affiliated store terminal included in the information processing system according to this embodiment. In this embodiment, the affiliated store terminal 20 has a selection unit 201 and an authentication unit 202. In this embodiment, the selection unit 201 and the authentication unit 202 are realized in the affiliated store terminal 20, but this is not limited thereto. For example, the selection unit 201 and the authentication unit 202 can be realized in the IC card 30 by the processor 31 of the IC card 30 executing a program stored in the ROM 32.

[0035] The selection unit 201 selects an RSA operation (an example of a first public key cryptosystem) from among a plurality of public key cryptosystems when transaction parameters do not satisfy a predetermined condition. The selection unit 201 is also an example of a selection unit that selects an RSA operation (an example of a second public key cryptosystem) from among a plurality of public key cryptosystems when transaction parameters satisfy a predetermined condition.

[0036] Here, the parameters related to the transaction (transaction parameters) may be, for example, at least one of the transaction amount, the store where the transaction is performed, and the frequency of use of the IC card 30. Here, the specified conditions are preset conditions, and are conditions for a transaction using a more secure public key cryptosystem (for example, a second public key cryptosystem). For example, the specified conditions may be a threshold value for the transaction amount using the second public key cryptosystem. For example, the specified conditions may be a store where the transaction is performed using the second public key cryptosystem. For example, the specified conditions may be a threshold value for the frequency of use (frequency of use threshold) of the IC card 30 using the second public key cryptosystem.

[0037] For example, when the transaction amount, which is an example of a transaction parameter, is equal to or less than 10,000 yen, which is an example of a predetermined condition, the selection unit 201 selects RSA arithmetic, which is an example of the first public key cryptography. Also, when the transaction amount, which is an example of a transaction parameter, is higher than 10,000 yen, the selection unit 201 selects PQC arithmetic, which is an example of the second public key cryptography. Also, when the frequency of use, which is an example of a transaction parameter, is equal to or greater than a frequency of use threshold, which is an example of a predetermined condition, the selection unit 201 selects RSA arithmetic, which is an example of the first public key cryptography. Also, when the frequency of use, which is an example of a transaction parameter, is lower than a frequency of use threshold, which is an example of a predetermined condition, the selection unit 201 selects PQC arithmetic, which is an example of the second public key cryptography.

[0038] When the authentication unit 202 selects the first public key cryptosystem, it obtains the first public key certificate from the IC card 30 via the card reader / writer 25 and executes authentication processing of the IC card 30 using the first public key cryptosystem. This makes it possible to easily obtain the public key certificate, thereby improving the processing speed for decrypting data encrypted using the public key cryptosystem.

[0039] Furthermore, when the second public key cryptosystem is selected, authentication unit 202 acquires a tag from IC card 30 via card reader / writer 25. Then, authentication unit 202 transmits the acquired tag to issuer host server 10 via communication interface 28. At that time, CPU 11 of issuer host server 10 identifies a second public key certificate stored in ROM 12 in association with the tag received from affiliated store terminal 20, and transmits the identified second public key certificate to affiliated store terminal 20. As a result, by storing the second public key certificate in issuer host server 10, which is an example of an external server, the problem of the data size of data stored in IC card 30 can be solved, and therefore operation during the transition period of the transition of the public key cryptosystem can be facilitated.

[0040] Next, authentication unit 202 functions as an example of an authentication unit that acquires a second public key certificate based on the tag from issuer host server 10 via communication interface 28 and executes authentication processing of IC card 30 using the second public key cryptosystem. This allows authentication processing to be executed using a more secure public key cryptosystem, so that although it takes time to decrypt encrypted data, it is possible to realize more secure transactions.

[0041] Here, the authentication process may be a process for verifying whether or not IC card 30 is an unauthorized card and for verifying the identity of the card holder. Specifically, when decrypting data (e.g., card number, expiration date) encrypted using a private key, the authentication process uses a public key certificate (first public key certificate or second public key certificate) to determine whether or not the public key is correct. If it is determined that the public key is correct, the authentication process determines that IC card 30 is a correct card and uses the public key to decrypt the encrypted data.

[0042] In this way, according to the information processing system of this embodiment, the second public key certificate is stored in the issuer host server 10, which is an example of an external server, thereby solving the problem of the data size of the data stored in the IC card 30, thereby facilitating operation during the transitional period of the transition of the public key cryptography method.

[0043] The program executed by the affiliated store terminal 20 of this embodiment is provided by being pre-installed in the ROM 22 or the like. The program executed by the affiliated store terminal 20 of this embodiment may be provided by being recorded in a computer-readable recording medium such as a CD-ROM, a flexible disk (FD), a CD-R, or a digital versatile disk (DVD) in the form of an installable or executable file.

[0044] Furthermore, the program executed by the affiliated store terminal 20 of this embodiment may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Also, the program executed by the affiliated store terminal 20 of this embodiment may be provided or distributed via a network such as the Internet.

[0045] The program executed by the affiliated store terminal 20 in this embodiment has a modular structure including the above-mentioned units (selection unit 201, authentication unit 202), and in terms of actual hardware, an example of a processor 21 such as a CPU reads out the program from the ROM 22 and executes it, thereby loading the above-mentioned units onto the main memory device, and the selection unit 201 and authentication unit 202 are generated on the main memory device.

[0046] Although the embodiment of the present invention has been described, this embodiment is presented as an example and is not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the gist of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0047] 10 Issuer host server 11 CPU 12,22 ROM 13,23 RAM 14,28 Communication Interface 20 Merchant terminal 21,31 Processor 24 Auxiliary Storage Devices 25 Card Reader / Writer 30 IC Card 34 NVM 35 Communications Department 36 MPU 201 Selection Section 202 Authentication Department

Claims

1. a selection unit that selects a first public key cryptosystem from among a plurality of public key cryptosystems when a parameter related to a transaction does not satisfy a predetermined condition, and selects a second public key cryptosystem, different from the first public key cryptosystem, from among the plurality of public key cryptosystems when the parameter satisfies the predetermined condition; an authentication unit which, when the first public key cryptosystem is selected, acquires a first public key certificate of the first public key cryptosystem from an IC card and executes authentication processing of the IC card by the first public key cryptosystem, and, when the second public key cryptosystem is selected, acquires a tag that identifies a second public key certificate of the second public key cryptosystem from the IC card, acquires the second public key certificate from a server based on the tag, and executes authentication processing of the IC card by the second public key cryptosystem; An information processing system comprising:

2. 2. The information processing system according to claim 1, wherein the parameters include at least one of a transaction amount, a store where the transaction is performed, and a frequency of use of the IC card.

3. the first public key cryptosystem is an RSA cryptosystem, The information processing system according to claim 1 , wherein the second public key cryptosystem is PQC.

4. An information processing method executed in an information processing system, comprising: a selection unit selecting a first public key cryptosystem from among a plurality of public key cryptosystems when a parameter related to a transaction does not satisfy a predetermined condition, and selecting a second public key cryptosystem different from the first public key cryptosystem from among the plurality of public key cryptosystems when the parameter satisfies the predetermined condition; when an authentication unit selects the first public key cryptosystem, the authentication unit acquires a first public key certificate of the first public key cryptosystem from an IC card and executes authentication processing of the IC card by the first public key cryptosystem, and when an authentication unit selects the second public key cryptosystem, the authentication unit acquires a tag that identifies a second public key certificate of the second public key cryptosystem from the IC card, acquires the second public key certificate from a server based on the tag, and executes authentication processing of the IC card by the second public key cryptosystem; An information processing method comprising:

5. Computer, a selection unit that selects a first public key cryptosystem from among a plurality of public key cryptosystems when a parameter related to a transaction does not satisfy a predetermined condition, and selects a second public key cryptosystem, different from the first public key cryptosystem, from among the plurality of public key cryptosystems when the parameter satisfies the predetermined condition; an authentication unit which, when the first public key cryptosystem is selected, acquires a first public key certificate of the first public key cryptosystem from an IC card and executes authentication processing of the IC card by the first public key cryptosystem, and, when the second public key cryptosystem is selected, acquires a tag that identifies a second public key certificate of the second public key cryptosystem from the IC card, acquires the second public key certificate from a server based on the tag, and executes authentication processing of the IC card by the second public key cryptosystem; Program to make it work.

6. An information processing system including a terminal, an IC card, and a server, The terminal includes: a first communication interface for communicating with the IC card; a second communication interface for communicating with the server; a processor that selects a first public key cryptosystem from among a plurality of public key cryptosystems if parameters related to a transaction do not satisfy a predetermined condition, and selects a second public key cryptosystem different from the first public key cryptosystem from among the plurality of public key cryptosystems if the parameters satisfy the predetermined condition, and if the first public key cryptosystem is selected, acquires a first public key certificate of the first public key cryptosystem from the IC card via the first communication interface and performs authentication processing of the IC card by the first public key cryptosystem, and if the second public key cryptosystem is selected, acquires a tag that identifies a second public key certificate of the second public key cryptosystem from the IC card via the first communication interface, and acquires the second public key certificate from the server based on the tag via the second communication interface and performs authentication processing of the IC card by the second public key cryptosystem; Equipped with The IC card is a third communication interface for communicating with the terminal; A storage unit that stores the tag; a processor for transmitting the tag via the third communication interface; Equipped with The server, a fourth communication interface for communicating with the terminal; a storage unit that stores the second public key certificate based on the tag; a processor for transmitting a second public key certificate to the terminal via the fourth communication interface; Equipped with Information processing system.

Images