Electronic information storage medium, IC chip, IC card, public key verification method, and program

Abstract

To provide an electronic information storage medium, an IC chip, an IC card, a public key verification method, and a program that are capable of more quickly confirming whether a private key and a public key have been written correctly.SOLUTION: An IC chip 1 receives a private key and a public key certificate from the external device 2 via a write command, generates a public key that pairs with the private key on the basis of the received private key, compares the generated public key with the public key contained in the received public key certificate, and transmits the comparison result to the external device 2.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to the technical field of IC chips (Integrated Circuits) that store key data used in cryptographic operations using public key cryptography. [Background technology]

[0002] Conventionally, in IC chips, as disclosed in Patent Document 1, for example, an issuance process is performed in which a plurality of data are written to a memory in the IC chip in response to a write command from an external device. For example, data written to a memory in an IC chip used for transactions may include a private key of the IC chip and a public key certificate including a public key paired with the private key. In this case, after the issuance process, a confirmation process is performed to confirm whether the private key and the public key have been properly written to the IC chip. For example, in this confirmation process, the external device first transmits an operation command (e.g., a READ RECORD command, etc.) to the IC chip to obtain a public key certificate from the IC chip. Next, the external device transmits an operation command (e.g., an INTERNAL AUTHENTICATE command, etc.) to the IC chip to cause the IC chip to perform an operation using the private key (e.g., signature generation), and obtains the operation result from the IC chip. Finally, the external device verifies (e.g., signature verification) the operation result using the public key included in the public key certificate obtained from the IC chip to confirm whether the private key and the public key have been properly written to the IC chip. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-013212 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the above-mentioned confirmation process requires that additional operational commands be sent to the IC chip multiple times after the issuance process to be executed, which results in a problem that the confirmation process to check whether the private key and public key have been correctly written to the IC chip takes time.

[0005] Therefore, the present invention has been made in consideration of these points and the like, and aims to provide an electronic information storage medium, an IC chip, an IC card, a public key matching method, and a program that can more quickly confirm the correct writing of a private key and a public key. [Means for solving the problem]

[0006] In order to solve the above problem, the invention described in claim 1 is an electronic information storage medium having a memory for storing a private key and a public key certificate, characterized in that it comprises: a receiving means for receiving the private key and the public key certificate from an external device; a generating means for generating a public key that pairs with the private key based on the private key received by the receiving means; a comparison means for comparing the public key generated by the generating means with the public key included in the public key certificate received by the receiving means; and a transmitting means for transmitting the comparison result by the comparison means to the external device.

[0007] The invention described in claim 2 is characterized in that, in the electronic information storage medium described in claim 1, the electronic information storage medium stores a program that defines an elliptic curve cryptography calculation algorithm and parameters used in the elliptic curve cryptography calculation algorithm, the receiving means receives a write command including an identifier of the parameters, and the generating means identifies the parameters based on the identifier included in the write command, and generates the public key based on the private key and a base point that is included in the identified parameters and indicates a point on the elliptic curve.

[0008] The invention recited in claim 3 is the electronic information storage medium recited in claim 2, characterized in that the electronic information storage medium stores the parameters for each different elliptic curve.

[0009] The invention described in claim 4 is characterized in that, in the electronic information storage medium described in any one of claims 1 to 3, the memory is a non-volatile memory, and after both the private key and the public key certificate received by the receiving means are written to the non-volatile memory, the generation means generates the public key based on the private key, and the comparison means compares the public key generated by the generation means with the public key included in the public key certificate received by the receiving means.

[0010] The invention described in claim 5 is characterized in that, in the electronic information storage medium described in any one of claims 1 to 3, the memory is a non-volatile memory, and before both the private key and the public key certificate received by the receiving means are written to the non-volatile memory, the generation means generates the public key based on the private key, and the comparison means compares the public key generated by the generation means with the public key included in the public key certificate received by the receiving means.

[0011] The invention described in claim 6 is an IC chip having a memory for storing a private key and a public key certificate, characterized in that it comprises: a receiving means for receiving the private key and the public key certificate from an external device; a generating means for generating a public key that pairs with the private key based on the private key received by the receiving means; a comparison means for comparing the public key generated by the generating means with the public key included in the public key certificate received by the receiving means; and a transmitting means for transmitting the comparison result by the comparison means to the external device.

[0012] The invention described in claim 7 is an IC card having a memory for storing a private key and a public key certificate, characterized in that it comprises: a receiving means for receiving the private key and the public key certificate from an external device; a generating means for generating a public key that pairs with the private key based on the private key received by the receiving means; a comparison means for comparing the public key generated by the generating means with the public key included in the public key certificate received by the receiving means; and a transmitting means for transmitting the comparison result by the comparison means to the external device.

[0013] The invention described in claim 8 is a public key matching method executed by an electronic information storage medium having a memory for storing a private key and a public key certificate, characterized in that it includes the steps of receiving a private key and a public key certificate from an external device, generating a public key that pairs with the private key based on the received private key, a matching means for matching the generated public key with a public key included in the received public key certificate, and transmitting a matching result by the matching means to the external device.

[0014] The invention described in claim 9 is characterized in that a computer included in an electronic information storage medium having a memory for storing a private key and a public key certificate is made to function as a receiving means for receiving a private key and a public key certificate from an external device, a generating means for generating a public key that pairs with the private key based on the private key received by the receiving means, a comparison means for comparing the public key generated by the generating means with the public key included in the public key certificate received by the receiving means, and a transmitting means for transmitting the comparison result by the comparison means to the external device. Effect of the Invention

[0015] According to the present invention, the correct writing of the private key and the public key can be confirmed more quickly. [Brief description of the drawings]

[0016] [Figure 1] 2 is a diagram illustrating an example of a hardware configuration of an IC chip 1. FIG. [Diagram 2] FIG. 2 is a diagram illustrating an example of a software configuration of the IC chip 1. [Diagram 3] 10 is a flowchart showing an example of an issuing process of a CPU 15 in an IC chip 1. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment in which the present invention is applied to an IC chip having a non-volatile memory for storing a private key and a public key certificate including a public key that is paired with the private key.

[0018] [1. Configuration and Function of IC Chip 1] First, the configuration and functions of an IC chip 1 according to this embodiment will be described with reference to Fig. 1. The IC chip 1 is an example of an electronic information storage medium capable of communicating with an external device 2. The IC chip 1 is mounted on, for example, an IC card such as a credit card, a cash card, or a My Number card, or a mobile device such as a smartphone. In the case of a mobile device such as a smartphone, the IC chip 1 may be mounted on a small IC card that is detachable from the mobile device, or may be mounted on an embedded board as an eUICC (Embedded Universal Integrated Circuit Card) so that it cannot be easily removed or replaced from the mobile device. The IC card or mobile device is provided with an antenna used for contactless communication.

[0019] FIG. 1 is a diagram showing an example of a hardware configuration of an IC chip 1. As shown in FIG. 1, the IC chip 1 includes an I / O circuit 11, a random access memory (RAM) 12, a nonvolatile memory (NVM) 13, a read only memory (ROM) 14, a central processing unit (CPU) 15 (an example of a computer), and a coprocessor 16 that performs cryptographic operations. The I / O circuit 11 serves as an interface with an external device 2. Note that communication between the IC chip 1 and the external device 2 may be non-contact communication or contact communication. In the case of non-contact communication, communication between the IC chip 1 and the external device 2 is performed via an antenna (not shown) mounted on, for example, an IC card or a mobile device. An example of the external device 2 is an issuing device in a factory before the shipment of the IC chip 1.

[0020] The NVM 13 is a non-volatile memory such as a flash memory or an electrically erasable programmable read-only memory, and can be used to store a private key and a public key certificate. The public key certificate may include, for example, a signature (data) by a private key of a certification authority, an expiration date of the signature, and a serial number. The NVM 13 or the ROM 14 stores an operating system, a transaction application, a program for writing confirmation (including the program of the present invention) and the like installed in the IC chip 1. Here, the transaction application is, for example, an application for executing a process related to a transaction conforming to the EMV (registered trademark) specification. The transaction application includes a program that specifies an elliptic curve cryptography calculation algorithm such as ECDSA (Elliptic Curve Digital Signature Algorithm). The IC chip 1 may have transaction applications installed corresponding to each of a plurality of different brands.

[0021] The NVM 13 also has a record storage area for writing multiple records (also called record data). The records store data in, for example, TLV format, and are logically stored (collected) in a file (for example, EF (Elementary File)) and managed. Multiple records can be stored in one file. Each file is assigned an SFI (Short File Identifier), which is an identifier (file ID) for the file. Each record is assigned a record number. A record can be uniquely identified by specifying the SFI and record number.

[0022] For example, the AIP (Application Interchange Profile), AFL (Application File Locator), and parameters used in the elliptic curve cryptography algorithm used by the transaction application are stored in separate records. Here, the parameters are publicly disclosed by public institutions and industry groups, and there are a plurality of parameters such as NIST P-256, P-521, secp256r1, and secp521r1. Such parameters include a prime number p, a curve parameter a, a curve parameter b, a base point G, an order n, and a cofactor (h). The curve parameters a and b are coefficients in the equation "y^2=x^3+ax+b" that represents an elliptic curve. The base point G indicates a point on the elliptic curve other than the point at infinity. Furthermore, a private key and a public key certificate used in the elliptic curve cryptography algorithm are stored in separate records. Note that, when multiple transaction applications are installed in the IC chip 1, the parameters, private keys, and public key certificates used in the elliptic curve cryptography algorithm specified by each of the applications are stored in the records of the files corresponding to the respective transaction applications.

[0023] Fig. 2 is a diagram showing an example of the software configuration of the IC chip 1. As shown in Fig. 2, the write confirmation program causes the CPU 15 to function as a parameter management unit 151, a key information management unit 152, a command processing unit 153 (an example of a receiving means), a public key generation unit 154 (an example of a generating means), a public key comparison unit 155 (an example of a comparing means), and a response transmission unit 156 (an example of a transmitting means), etc. The write confirmation program may be incorporated into the OS or a predetermined application.

[0024] The parameter management unit 151 manages the record number of the record storing the parameter used in the elliptic curve cryptography calculation algorithm, the SFI of the file storing the record, and the parameter ID (identifier for identifying the parameter) of the parameter in association with each other. When multiple transaction applications are installed in the IC chip 1, the parameter IDs of the parameters used in the elliptic curve cryptography calculation algorithm defined by each application are different from each other. The parameter ID may be an identifier for identifying the elliptic curve cryptography calculation algorithm or an identifier for identifying a public key certificate.

[0025] The key information management unit 152 manages the private key and the public key certificate stored in the NVM 13. For example, the key information management unit 152 manages the record number of the record storing the private key used in the elliptic curve cryptography calculation algorithm, the SFI of the file storing the record, and the key ID of the private key (an identifier for identifying the private key) in association with each other. The key information management unit 152 also manages the record number of the record storing the public key certificate, the SFI of the file storing the record, and the key ID of the public key included in the public key certificate (which may be the same as the key ID of the private key) in association with each other. Note that when multiple transaction applications are installed in the IC chip 1, the key IDs of the private keys used in the elliptic curve cryptography calculation algorithms defined by each application are different from each other.

[0026] The command processing unit 153 receives a write command from the external device 2 via the I / O circuit 11, for example, in the issuance process. The above-mentioned private key and public key certificate are received by the write command. Here, the write command (for example, WRITE RECORD, APPEND RECORD, PUT KEY, or STORE DATA) is configured by a command APDU including a header portion having CLA (instruction class), INS (instruction code), P1 and P2 (parameters), and a body portion having Lc and data, as specified in, for example, ISO / IEC 7816-3. Lc indicates the data length of data. Data includes data to be written, for example, in the TLV format. Furthermore, data of any write command received in the issuance process may include a parameter ID of a parameter used in an elliptic curve cryptography algorithm together with the data to be written.

[0027] The private key and public key certificate described above may be set as the value V of the data to be written in the data of the write command transmitted separately from the external device 2. In this case, the tag T indicates the type of the value V (whether it is a private key or a certificate) and the key ID, and the length L indicates the data length of the value V. Then, in response to the received write command, the command processing unit 153 executes a process of writing the data to be written included in the write command as one record in the record storage area of ​​the NVM 13. As a result, the private key and public key certificate described above are each written and stored in the record storage area of ​​the NVM 13.

[0028] The public key generating unit 154 generates a public key paired with the private key received by the command processing unit 153, based on the private key. Here, the private key used to generate the public key may be the private key written in the record storage area of ​​the NVM 13. However, the private key used to generate the public key may be the private key temporarily stored in the RAM 12 (i.e., the private key before being written in the record storage area). For example, the public key is calculated (=s*G) based on the private key s written in the record storage area and the base point G included in the parameter identified by the parameter ID included in the received write command. Note that a public key can be generated from a private key using a known technique.

[0029] The public key matching unit 155 matches (in other words, compares) the public key generated by the public key generation unit 154 with the public key included in the public key certificate received by the command processing unit 153. In this matching, it is determined whether or not the two public keys match. Here, the public key certificate used for matching the public keys may be the public key certificate written in the record storage area of ​​the NVM 13. However, the public key certificate used for matching the public keys may also be the public key certificate temporarily stored in the RAM 12 (i.e., the public key certificate before it is written in the record storage area).

[0030] The response transmission unit 156 transmits a response indicating the result of the comparison by the public key comparison unit 155 to the external device 2 via the I / O circuit 11. Here, the response indicating the result of the comparison is configured with a response APDU including SW1 and SW2 (status words). For example, if it is determined that both public keys match, SW1 and SW2 indicate normal completion (0x9000). On the other hand, if it is determined that both public keys do not match, SW1 and SW2 indicate an error.

[0031] [2. Operation of IC chip 1] Next, the operation of the IC chip 1 will be described with reference to Fig. 3. Fig. 3 is a flow chart showing an example of an issuing process of the CPU 15 in the IC chip 1. The process shown in Fig. 3 is started when the IC chip 1 receives a write command from an external device 2 (issuing device) by the command processing unit 153 during an issuing process in a manufacturing plant for the IC chip 1, for example. Note that the process shown in Fig. 3 is repeatedly executed until, for example, writing of all data to be written that is necessary for the operation of a transaction application is completed. That is, the IC chip 1 receives a plurality of write commands in sequence.

[0032] 3 starts, the CPU 15 determines whether the data to be written included in the write command received by the command processing unit 153 is a private key (in other words, whether the data to be written includes a private key) (step S1). Here, whether the data to be written is a private key may be determined based on, for example, a tag T (type of value V) included in the data to be written, or based on an INS (for example, whether it indicates PUT KEY) included in the write command.

[0033] If it is determined that the data to be written is not a private key (step S1: NO), the process proceeds to step S3. On the other hand, if it is determined that the data to be written is a private key (step S1: YES), the command processing unit 153 writes the private key acquired from the write command to the record storage area of ​​the NVM 13 (step S2), and the process proceeds to step S6. The private key thus stored is managed by the key information management unit 152.

[0034] In step S3, the CPU 15 determines whether the data to be written included in the write command received by the command processing unit 153 is a public key certificate (in other words, whether the data to be written includes a public key certificate). Here, whether the data to be written is a public key certificate is determined based on, for example, the tag T (type of value V) included in the data to be written.

[0035] If it is determined that the data to be written is not a public key certificate (step S3: NO), the process proceeds to step S5. On the other hand, if it is determined that the data to be written is a public key certificate (step S3: YES), the command processing unit 153 writes the public key certificate acquired from the write command to the record storage area of ​​NVM 13 (step S4), and the process proceeds to step S6. The public key certificate thus stored is managed by the key information management unit 152.

[0036] In step S5, the command processing unit 153 writes the data to be written other than the private key and the public key certificate to the record memory area of ​​the NVM 13, and the process proceeds to step S9. In step S6, the CPU 15 determines whether or not both the private key and the public key certificate have been written. If it is determined that both the private key and the public key certificate have not been written (step S6: NO), the process proceeds to step S9. If it is determined that both the private key and the public key certificate have been written (step S6: YES), the process proceeds to step S7.

[0037] In step S7, CPU 15 generates a public key paired with the private key written in step S2, based on the private key, by public key generation unit 154. For example, CPU 15 acquires a parameter ID from a write command including a private key or a public key certificate, and identifies a parameter managed by parameter management unit 151 based on the parameter ID. CPU 15 then calculates a public key paired with the private key, based on the written private key and a base point included in the identified parameter.

[0038] Next, CPU 15 compares the public key included in the public key certificate written in step S4 with the public key generated in step S7 using public key comparison unit 155, and determines whether the two public keys match (step S8). If it is determined that the two public keys match (step S8: YES), the process proceeds to step S9. On the other hand, if it is determined that the two public keys do not match (step S8: NO), the process proceeds to step S10.

[0039] In step S9, CPU 15 transmits a response indicating normal completion to external device 2 via response transmission unit 156. On the other hand, in step S10, CPU 15 transmits a response indicating an error to external device 2 via response transmission unit 156. Note that in the process shown in Fig. 3, the private key may be written to NVM 13 before the public key certificate, or the public key certificate may be written to NVM 13 before the private key.

[0040] As described above, according to the above embodiment, the IC chip 1 is configured to receive a private key and a public key certificate from the external device 2 by a write command, generate a public key that pairs with the private key based on the received private key, compare the generated public key with the public key contained in the received public key certificate, and transmit the comparison result to the external device 2, thereby making it possible to more quickly confirm that the private key and public key have been written correctly.

[0041] In the above embodiment, the processes of steps S7 and S8 shown in FIG. 3 are configured to be executed after both the private key and the public key certificate are written to NVM 13, but the processes of steps S7 and S8 shown in FIG. 3 may be executed in a state in which both the private key and the public key certificate are received and temporarily stored in RAM 12 (i.e., before being written to NVM 13). In this case, if it is determined that the two compared public keys match, the private key and the public key certificate are written to NVM 13. On the other hand, if it is determined that the two compared public keys do not match, the private key and the public key certificate are not written to NVM 13, and a response indicating an error is transmitted to the external device 2. This makes it possible to reduce the time required for the write process. [Explanation of symbols]

[0042] 1 IC chip 2 External device 11 I / O circuit 12 RAM 13 NVM 14 ROM 15 CPU 16 Coprocessors 151 Parameter Management Unit 152 Key information management department 153 Command processing section 154 Public Key Generation Unit 155 Public Key Verification Unit 156 Response sender

Claims

1. An electronic information storage medium having a memory for storing a private key and a public key certificate, A receiving means for receiving a private key and a public key certificate from an external device; a generating means for generating a public key paired with the private key received by the receiving means; a verification means for verifying the public key generated by the generation means and the public key included in the public key certificate received by the reception means; a transmission means for transmitting a collation result by the collation means to the external device; An electronic information storage medium comprising:

2. the electronic information storage medium stores a program that defines an elliptic curve cryptography calculation algorithm and parameters used in the elliptic curve cryptography calculation algorithm; The receiving means receives a write command including an identifier of the parameter, The electronic information storage medium according to claim 1, characterized in that the generation means identifies the parameters based on the identifier included in the write command, and generates the public key based on the private key and a base point included in the identified parameters and indicating a point on an elliptic curve.

3. 3. The electronic information storage medium according to claim 2, wherein the electronic information storage medium stores the parameters for each different elliptic curve.

4. the memory is a non-volatile memory; An electronic information storage medium as described in any one of claims 1 to 3, characterized in that after both the private key and the public key certificate received by the receiving means are written to the non-volatile memory, the generating means generates the public key based on the private key, and the comparing means compares the public key generated by the generating means with the public key included in the public key certificate received by the receiving means.

5. the memory is a non-volatile memory; An electronic information storage medium as described in any one of claims 1 to 3, characterized in that before both the private key and the public key certificate received by the receiving means are written to the non-volatile memory, the generating means generates the public key based on the private key, and the comparing means compares the public key generated by the generating means with the public key included in the public key certificate received by the receiving means.

6. An IC chip having a memory for storing a private key and a public key certificate, A receiving means for receiving a private key and a public key certificate from an external device; a generating means for generating a public key paired with the private key received by the receiving means; a verification means for verifying the public key generated by the generation means and the public key included in the public key certificate received by the reception means; a transmission means for transmitting a collation result by the collation means to the external device; An IC chip comprising:

7. An IC card having a memory for storing a private key and a public key certificate, A receiving means for receiving a private key and a public key certificate from an external device; a generating means for generating a public key paired with the private key received by the receiving means; a verification means for verifying the public key generated by the generation means and the public key included in the public key certificate received by the reception means; a transmission means for transmitting a collation result by the collation means to the external device; An IC card comprising:

8. 1. A public key verification method executed by an electronic information storage medium having a memory for storing a private key and a public key certificate, comprising: receiving a private key and a public key certificate from an external device; generating a public key paired with the received private key based on the received private key; A verification means for verifying the generated public key with a public key included in the received public key certificate; transmitting a collation result by the collation means to the external device; A public key verification method comprising:

9. A computer included in an electronic information storage medium having a memory for storing a private key and a public key certificate, A receiving means for receiving a private key and a public key certificate from an external device; a generating means for generating a public key paired with the private key received by the receiving means; a verification means for verifying the public key generated by the generation means and the public key included in the public key certificate received by the reception means; a program that causes the program to function as a transmission means that transmits a collation result by the collation means to the external device;

Images