Electronic apparatus, information processing device, communication method, and program

Abstract

To provide an electronic apparatus capable of shortening the processing time required for completing distribution of encrypted data compared to the conventional apparatuses.SOLUTION: An electronic apparatus includes: a communication unit that communicates with an information processing device; a control unit that performs, via the communication unit, relaying authentication of a secure element by the information processing device using a second encryption method and obtaining confidential information from the information processing device, within one session using a first encryption method; and the secure element that has higher tamper resistance than the control unit.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an electronic device, an information processing apparatus, a communication method, and a program.

Background Art

[0002] In recent years, IoT (Internet of Things) devices often have a secure element and store an electronic certificate (client certificate) for authentication in the secure element. However, since an electronic certificate has an expiration date, it is necessary to periodically update the electronic certificate stored in the secure element.

[0003] Patent Document 1 discloses a secret information distribution system that decrypts the encryption of secret information distributed by a device management server and updates the secret information in a secure element disposed within an IoT device.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, generally, since the processing power of the processor of a secure element is not high, when decrypting encrypted data encrypted and distributed to an IoT device with the secure element, depending on the amount of information of the encrypted data, there is a problem that the processing time until the distribution is completed may become long.

[0006] The present invention has been made in view of such circumstances, and provides an electronic device, an information processing apparatus, a communication method, and a program capable of shortening the processing time until the distribution of encrypted data is completed compared with the conventional case.

Means for Solving the Problems

[0007] The present invention has been made to solve the above-described problems. One aspect of the present invention is a communication unit that communicates with an information processing apparatus, and relays authentication of a secure element by the information processing apparatus using a second encryption method within one session by a first encryption method, and a control unit that acquires encrypted data including confidential information from the information processing apparatus via the communication unit, and a connection unit that communicates with the secure element or is communicatively connected to the secure element, wherein the secure element is an electronic device having higher tamper resistance than the control unit.

[0008] Another aspect of the present invention is the above-described electronic device, wherein the control unit acquires non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method and the second encryption method from the information processing apparatus via the communication unit, decrypts the non-confidential information and the confidential information by the first encryption method, transmits the confidential information decrypted by the first encryption method to the secure element, and the confidential information decrypted by the first encryption method is decrypted by the second encryption method by the secure element.

[0009] Another aspect of the present invention is the above-described electronic device, wherein the control unit acquires non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method from the information processing apparatus via the communication unit, decrypts the non-confidential information and the confidential information by the first encryption method, and transmits the confidential information decrypted by the first encryption method to the secure element.

[0010] Another aspect of the present invention is the above-described electronic device, wherein the control unit determines whether to send the data stored in the received packet to the secure element by referring to the header of the packet received from the information processing apparatus.

[0011] Another aspect of the present invention is the above-described electronic device, wherein the confidential information is transmitted from the information processing apparatus together with a command for the secure element.

[0012] Another aspect of the present invention is an information processing apparatus including a communication unit that communicates with an electronic device, and a control unit that performs, via the communication unit, authentication using a second encryption method of a secure element included in the electronic device or a secure element communicatively connected to the electronic device, which has higher tamper resistance than other parts of the electronic device, within one session using a first encryption method, and transmission of encrypted data including confidential information to the electronic device.

[0013] Another aspect of the present invention is the above-described information processing apparatus, wherein the control unit transmits non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method and the second encryption method to the electronic device via the communication unit.

[0014] Another aspect of the present invention is the above-described information processing apparatus, wherein the control unit transmits non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method to the electronic device via the communication unit.

[0015] Another aspect of the present invention is the above-described information processing apparatus, wherein the control unit includes, in a header of a packet to be transmitted, information for the electronic device to determine whether to send the data stored in the packet to the secure element.

[0016] Another aspect of the present invention is the above-described information processing apparatus, wherein the confidential information is transmitted together with a command for the secure element of the electronic device.

[0017] Another aspect of the present invention is a communication method for an electronic device including a control unit and a secure element having higher tamper resistance than the control unit or a connection unit communicatively connected to the secure element, the method including: a first step of relaying authentication of the secure element by an information processing device using a second encryption method; and a second step of obtaining encrypted data including confidential information from the information processing device, wherein the first step and the second step are performed within one session using a first encryption method.

[0018] Another aspect of the present invention is a communication method for authenticating a secure element included in an electronic device or a secure element communicatively connected to the electronic device, the secure element having higher tamper resistance than other parts of the electronic device, the method including: a first step of performing authentication of the secure element using a second encryption method; and a second step of transmitting encrypted data including confidential information to the electronic device, wherein the first step and the second step are performed within one session using a first encryption method.

[0019] Another aspect of the present invention is a program for causing a computer of an electronic device including a secure element having higher tamper resistance than a control unit or a connection unit communicatively connected to the secure element to function as the control unit that, within one session using a first encryption method, relays authentication of the secure element by the information processing device using a second encryption method and obtains encrypted data including confidential information from the information processing device via a communication unit for communicating with the information processing device.

[0020] Another aspect of the present invention is a program for causing a computer to function as a control unit that performs, via the communication unit, authentication using a second encryption method for a secure element included in the electronic device or a secure element communicatively connected to the electronic device, which has higher tamper resistance than other parts of the electronic device, within one session using a first encryption method, and transmission of encrypted data including confidential information to the electronic device.

Advantages of the Invention

[0021] According to this invention, an electronic device, an information processing apparatus, a communication method, and a program can shorten the processing time until the completion of distribution of encrypted data as compared with the prior art.

Brief Description of the Drawings

[0022]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Modes for Carrying Out the Invention

[0023] Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a schematic block diagram showing the configuration of an information distribution system 100 according to an embodiment of the present invention. The information distribution system 100 includes an electronic device 10, a network 20, and a management server 30 (information processing device). In the example of FIG. 1, the information distribution system 100 includes one electronic device 10, but may include a plurality of electronic devices 10. The information distribution system 100 distributes confidential information and non-confidential information, which are encrypted data, to the electronic device 10. Here, the confidential information is information such as a private key among electronic certificates that is not disclosed to other devices. The non-confidential information is information such as a public key certificate that may be disclosed to other devices.

[0024] The electronic device 10 is an IoT device such as a home appliance or a sensor connected to the network 20. The electronic device 10 includes a communication unit 11, a control unit 12, and an SE (Secure Element) 13. The communication unit 11 communicates with other devices including the management server 30 via the network 20. The control unit 12 includes, for example, a Central Processing Unit (CPU) and a memory, and the CPU reads and executes a program stored in the memory to control the communication of the electronic device 10 and the SE 13. This memory may be any of RAM, ROM, E2PROM, flash memory, etc. Also, the control unit 12 may include buses such as SPI, I2C, Uart, GPIO. Also, the control unit 12 may be one IC chip or may span multiple IC chips.

[0025] For example, the control unit 12 relays the authentication of the secure element by the management server 30 using the Secure Channel Protocol (SCP, the second encryption method) within one session by the Transport Layer Security (TLS, the first encryption method), and obtains encrypted data including confidential information from the management server 30 via the communication unit 11.

[0026] Note that the control unit 12 may obtain non-confidential information encrypted by TLS and confidential information encrypted by TLS and SCP from the management server 30 via the communication unit 11, decrypt the TLS for the non-confidential information and the confidential information, and transmit the confidential information decrypted by TLS to the secure element 13. Further, the confidential information decrypted by TLS is decrypted by the secure element 13 using SCP.

[0027] Alternatively, the control unit 12 may obtain non-confidential information encrypted by TLS and confidential information encrypted by TLS from the management server 30 via the communication unit 11, decrypt the TLS for the non-confidential information and the confidential information, and transmit the confidential information decrypted by TLS to the secure element 13.

[0028] Note that in this embodiment, as the first encryption method and the second encryption method, TLS (\"The Transport Layer Security (TLS) Protocol Version 1.3\" of RFC8446) and SCP (Secure Channel Protocol of GlobalPlatform) are used, respectively, but other encryption methods may be used.

[0029] SE13 is an area having higher tamper resistance than the control unit 12, such as an area in an IC chip, a processor (e.g., a trust zone of an ARM (registered trademark) processor), software, etc., and stores confidential information. The integrated circuit constituting SE13 may be an IC chip of the same chip as the control unit 12 or an IC chip different from the control unit 12. SE13 decrypts the confidential information decrypted by TLS and received from the control unit 12 using SCP. Note that the control unit 12 and SE13 may communicate using the format of the Application Protocol Data Unit (APDU) of ISO / IEC 7816-4. The confidential information received by SE13 from the control unit 12 may be an APDU generated by the management server 30 and encrypted by SCP.

[0030] The network 20 is a network such as the Internet or a mobile communication network, and communicatively connects the electronic device 10 and the management server 30.

[0031] The management server 30 manages the confidential information and non-confidential information of the electronic device 10, and distributes and updates the confidential information and non-confidential information to the electronic device 10 as necessary. The management server 30 is realized by one or more computers reading and executing a program. The management server 30 includes a communication unit 31, a control unit 32, and a storage unit 33. The communication unit 31 communicates with the electronic device 10 via the network 20. The control unit 32 manages the confidential information and non-confidential information of the electronic device 10, and updates it by distributing the confidential information and non-confidential information to the electronic device 10 via the communication unit 31 when the expiration date has passed. For example, the control unit 32 encrypts the non-confidential information with TLS and transmits it to the electronic device 10 via the communication unit 31, and encrypts the confidential information with TLS and SCP and transmits it to the electronic device 10 via the communication unit 31. The storage unit 33 stores the confidential information and non-confidential information of the SE13.

[0032] FIG. 2 is a sequence diagram showing an operation example of the information distribution system 100 in the present embodiment. The control unit 12 of the electronic device 10 transmits a connection request S1 to the management server 30 via the communication unit 11. Next, the control unit 12 of the electronic device 10 and the management server 30 perform a TLS handshake S2 therebetween. By this TLS handshake S2, a TLS session key is generated and a TLS session is started. Encryption using this TLS session key is used for subsequent communication between the electronic device 10 and the management server 30. Here, encryption using the TLS session key is also referred to as encryption by TLS. Note that in this TLS handshake S2, authentication of the electronic device 10 using an authentication key (a common key used in symmetric encryption or a secret key and a public key used in asymmetric encryption) of the electronic device 10 or the SE13 may or may not be performed.

[0033] Next, the SE13 and the management server 30 perform an SCP handshake S3 between them. Through this SCP handshake S3, an SCP session key is generated and an SCP session is started. For subsequent communication between the SE13 and the management server 30, encryption using this SCP session key is used. Here, encryption using the SCP session key is also referred to as encryption by the SCP. Also, for this SCP handshake S3 and subsequent communication between the SE13 and the management server 30, encryption by TLS is used between the control unit 12 and the management server 30. Further, in this SCP handshake S3, authentication of the SE13 using the authentication key (electronic certificate) of the SE13 is performed. This authentication may be mutual authentication using the authentication key of the management server 30 as well.

[0034] Next, the management server 30 transmits confidential information S4. This confidential information S4 is encrypted by the SCP and TLS. That is, on top of the encryption by the SCP, further encryption by TLS is applied to this confidential information S4. When the control unit 12 receives the confidential information S4 via the communication unit 11, it decrypts it with TLS. The control unit 12 transmits the confidential information S5 decrypted with TLS to the SE13. Since the confidential information S5 is encrypted by the SCP, when the SE13 receives the confidential information S5, it decrypts it with the SCP and stores it in the SE13.

[0035] Next, the management server 30 transmits non-confidential information S6. This non-confidential information S6 is encrypted by TLS. When the control unit 12 receives the non-confidential information S6 via the communication unit 11, it decrypts it with TLS and stores it in the control unit 12 or in the storage area of the electronic device 10. In this way, since the non-confidential information S6 and the confidential information S4 are communicated within the same session by the SCP handshake S3 that authenticates the SE13 and by TLS, the destination is guaranteed.

[0036] Figure 3 is a flowchart showing an operation example of the management server 30 in the present embodiment. The control unit 32 of the management server 30 receives a connection request from the electronic device 10 via the communication unit 31 (step Sa1). Next, the control unit 32 performs a TLS handshake with the control unit 12 of the electronic device 10 via the communication unit 31 (step Sa2). Next, the control unit 32 performs an SCP handshake with the SE 13 of the electronic device 10 via the communication unit 31 (step Sa3).

[0037] Next, the control unit 32 reads out the confidential information of the SE 13 of the electronic device 10 from the storage unit 33, encrypts the confidential information with SCP and TLS, and transmits it to the electronic device 10 via the communication unit 31 (step Sa4). Here, the confidential information may be stored in the APDU of a command (for example, the StoreData command of the GlobalPlatform Card Specification v2.3.1) for instructing the SE 13 to store the confidential information. Further, the APDU may be encrypted with SCP, and the HTTP (Hyper Text Transport Protocol) packet storing the APDU may be encrypted with TLS. Note that the APDU may be encrypted with SCP, and the HTTP (Hyper Text Transport Protocol) packet storing the APDU may not be encrypted with TLS. In this way, when the APDU is encrypted with SCP and the HTTP packet is not encrypted with TLS, at the time of the TLS handshake in step Sa2, the control unit 12 of the electronic device 10 may verify the certificate of the management server 30 and confirm whether the management server information (for example, the URL (Uniform Resource Locator) of the management server 30, the certification authority that issued the certificate of the management server 30, etc.) is acceptable to the electronic device 10.

[0038] Also, the header of the packet storing the confidential information may include information for determining that the packet stores the confidential information. The information may be, for example, that application / x-apdu is set in the ContentType of the HTTP header.

[0039] Also, the confidential information may be divided into a plurality of parts and stored in a plurality of APDUs. In that case, each time the process of step Sa4 is performed, one APDU may be stored in an HTTP packet and transmitted.

[0040] Next, the control unit 32 receives a response to the APDU from the electronic device 10 via the communication unit 31 (step Sa5). When the confidential information is divided into a plurality of parts and the transmission of the confidential information is not completed (step Sa6 - No), the control unit 32 returns to step Sa4 and transmits the next divided part of the confidential information. When the transmission of the confidential information is completed (step Sa6 - Yes), the non - confidential information of the electronic device 10 is read from the storage unit 33, encrypted with TLS, and transmitted to the electronic device 10 via the communication unit 31 (step Sa7). Note that the header of the packet storing the non - confidential information may include information for determining that the packet stores non - confidential information. This information may be, for example, that application / octet - stream is set in the ContentType of the HTTP header.

[0041] Next, the control unit 32 ends the TLS session started in step Sa2 (step Sa8).

[0042] FIG. 4 is a flowchart showing an operation example of the control unit 12 in the present embodiment. First, the control unit 12 transmits a connection request to the management server 30 via the communication unit 11 (step Sb1). Next, the control unit 12 performs a TLS handshake with the management server 30 via the communication unit 11 (step Sb2). Next, the control unit 12 relays the SCP handshake between the management server 30 and the SE13 (step Sb3).

[0043] Next, the control unit 12 receives a packet from the management server 30 via the communication unit 11 and decrypts it using TLS (step Sb4). The control unit 12 determines whether the received packet stores confidential information (step Sb5). The control unit 12 may make this determination by referring to the header of the packet. If the packet is an HTTP packet, for example, the control unit 12 may determine that it stores confidential information when "application / x-apdu" is set in the ContentType of the HTTP header.

[0044] If it is determined in step Sb5 that the packet stores confidential information (step Sb5 - Yes), the control unit 12 transmits the confidential information decrypted using TLS in step Sb4 to the SE13 (step Sb8). Next, the control unit 12 receives a response from the SE13 for the transmission in step Sb8, transmits the response to the server (step Sb9), and proceeds to step Sb7.

[0045] On the other hand, if it is determined in step Sb5 that the packet does not store confidential information (step Sb5 - No), the control unit 12 determines whether the received packet stores non-confidential information (step Sb6). The control unit 12 may make this determination by referring to the header of the packet. If the packet is an HTTP packet, for example, the control unit 12 may determine that it stores non-confidential information when "application / octet-stream" is set in the ContentType of the HTTP header.

[0046] If it is determined in step Sb6 that the packet stores non-confidential information (step Sb6 - Yes), the control unit 12 stores the non-confidential information in the memory of the control unit 12 (step Sb10) and proceeds to step Sb7. Also, if it is determined in step Sb6 that the packet does not store non-confidential information (step Sb6 - No), the control unit 12 proceeds directly to step Sb7.

[0047] In step Sb7, the control unit 12 determines whether to end the TLS session. If it does not end (step Sb7 - No), it returns to step Sb4. If it ends (step Sb7 - Yes), the process ends. For example, when the control unit 12 receives an instruction to end the TLS session from the management server 30 via the communication unit 11, or when there has been no communication in the TLS session for a predetermined time, the control unit 12 may determine to end the TLS session.

[0048] As described above, if the packet received from the management server 30 stores confidential information, the control unit 12 transmits the confidential information to the SE13 and stores it in the SE13. If the packet stores non - confidential information, the control unit 12 stores the non - confidential information in its memory. The memory for storing non - confidential information may be implemented on the same IC chip as the processor included in the control unit 12, or may be implemented on a different IC chip. Also, as described above, the control unit 12 may refer to the header of the packet received from the management server 30 (for example, the ContentType of the HTTP header) to determine whether the data stored in the received packet is confidential information or non - confidential information. That is, the management server 30 may include information indicating whether the information stored in the packet to be transmitted is confidential information or non - confidential information in the header of the packet.

[0049] Also, the control unit 12 may refer to the header of the packet received from the management server 30 (for example, the ContentType of the HTTP header) to determine whether to send the data stored in the received packet to the secure element 13. That is, the management server 30 may include information for the control unit 12 to determine whether to send the data stored in the packet to the secure element 13 in the header of the packet to be transmitted.

[0050] FIG. 5 is a flowchart showing an operation example of SE13 in the present embodiment. First, SE13 performs an SCP handshake with the management server 30 via the control unit 12 (step Sc1). Next, SE13 receives confidential information from the control unit 12 and decrypts the confidential information with the SCP (step Sc2). This confidential information may be stored in the APDU together with a command for SE13 (for example, StoreData command) and transmitted from the management server 30. The decrypted confidential information is stored in the memory of SE13 (step Sc3). Next, SE13 encrypts and transmits a response to the confidential information with the SCP (step Sc4).

[0051] When the reception of the confidential information is not completed, such as when the confidential information is divided into a plurality and transmitted from the management server 30 and there is still an unreceived division (step Sc5-No), the process of SE13 returns to step Sc2. On the other hand, when the reception of the confidential information is completed (step Sc5-Yes), SE13 terminates the SCP session (step Sc6).

[0052] FIG. 6 is a schematic block diagram showing the configuration of the electronic device 10 in a modified example of the present embodiment. In the modified example of FIG. 6, the electronic device 10 does not include SE13 but includes a connection unit 14 for communicating with SE13. In this case, it is the same as the above-described embodiment except that the control unit 12 communicates with SE13 via the connection unit 14. Note that SE13 is a device having higher tamper resistance than the electronic device 10, such as an IC card.

[0053] In the above-described embodiment, "saving", "recording", etc. also include temporarily saving or storing in a RAM or the like.

[0054] Further, the present invention may also be the following embodiments. (1) One embodiment of the present invention includes a communication unit that communicates with an information processing device, and relays the authentication of a secure element by the information processing device using a second encryption method within one session using a first encryption method, and acquires encrypted data including confidential information from the information processing device via the communication unit, and a control unit that performs the above operations, and a connection unit that communicates with or is communicatively connected to the secure element. The secure element is an electronic device having higher tamper resistance than the control unit.

[0055] Accordingly, regardless of whether the encrypted data including confidential information is encrypted by the second encryption method, it can be transmitted to an electronic device including a secure element or communicatively connected to a secure element. Therefore, even if the processing ability of the secure element is lower than that of the control unit, the processing time until the distribution of the encrypted data is completed can be made shorter than before.

[0056] (2) Another embodiment of the present invention is the electronic device according to (1), wherein the control unit acquires non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method and the second encryption method from the information processing device via the communication unit, decrypts the non-confidential information and the confidential information using the first encryption method, transmits the confidential information decrypted by the first encryption method to the secure element, and the confidential information decrypted by the first encryption method is decrypted by the secure element using the second encryption method.

[0057] (3) Another embodiment of the present invention is the electronic device according to (1), wherein the control unit acquires non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method from the information processing device via the communication unit, decrypts the non-confidential information and the confidential information using the first encryption method, and transmits the confidential information decrypted by the first encryption method to the secure element.

[0058] (4) Further, another embodiment of the present invention is the electronic device according to any one of (1) to (3), wherein the control unit refers to the header of the packet received from the information processing device and determines whether to send the data stored in the received packet to the secure element.

[0059] (5) Further, another embodiment of the present invention is the electronic device according to any one of (1) to (4), wherein the confidential information is transmitted from the information processing device together with a command for the secure element.

[0060] (6) Further, another embodiment of the present invention is an information processing device including a communication unit that communicates with an electronic device, and authentication using a second encryption method of a secure element included in the electronic device or a secure element communicatively connected to the electronic device, which has higher tamper resistance than other parts of the electronic device, within one session using a first encryption method, and transmission of encrypted data including confidential information to the electronic device, via the communication unit.

[0061] (7) Further, another embodiment of the present invention is the information processing device according to (6), wherein the control unit transmits the non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method and the second encryption method to the electronic device via the communication unit.

[0062] (8) Further, another embodiment of the present invention is the information processing device according to (6), wherein the control unit transmits the non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method to the electronic device via the communication unit.

[0063] (9) Further, another embodiment of the present invention is the information processing device according to any one of (6) to (8), wherein the control unit includes, in the header of the packet to be transmitted, information for the electronic device to determine whether to send the data stored in the packet to the secure element.

[0064] (10) Further, another embodiment of the present invention is the information processing apparatus according to any one of (6) to (9), wherein the confidential information is transmitted together with a command to a secure element of the electronic device.

[0065] (11) Further, another embodiment of the present invention is a communication method of an electronic device including a control unit and a secure element having higher tamper resistance than the control unit or a connection unit communicatively connected to the secure element, the method including: a first step of relaying authentication of the secure element by an information processing apparatus using a second encryption method; and a second step of acquiring encrypted data including confidential information from the information processing apparatus, wherein the first step and the second step are performed within one session by a first encryption method.

[0066] (12) Further, another embodiment of the present invention is a communication method including: a first step of authenticating a secure element included in an electronic device or a secure element communicatively connected to the electronic device, the secure element having higher tamper resistance than other parts of the electronic device, using a second encryption method; and a second step of transmitting encrypted data including confidential information to the electronic device, wherein the first step and the second step are performed within one session by a first encryption method.

[0067] (13) Further, another embodiment of the present invention is a program for causing a computer of an electronic device including a secure element having higher tamper resistance than a control unit or a connection unit communicatively connected to the secure element to function as the control unit that relays authentication of the secure element by the information processing apparatus using a second encryption method and acquires encrypted data including confidential information from the information processing apparatus within one session by a first encryption method via a communication unit that communicates with the information processing apparatus.

[0068] (14) Further, another embodiment of the present invention is a program for causing a computer to function as a control unit that performs, via the communication unit, authentication using a second encryption method for a secure element included in the electronic device or a secure element communicatively connected to the electronic device, which has higher tamper resistance than other parts of the electronic device, within one session using a first encryption method, and transmission of encrypted data including confidential information to the electronic device.

[0069] Further, a program for realizing the functions of the electronic device 10 and the management server 30 in FIG. 1 may be recorded on a computer-readable recording medium, and the program recorded on this recording medium may be read into a computer system and executed to realize the electronic device 10 and the management server 30. Here, the “computer system” is assumed to include hardware such as an OS and peripheral devices.

[0070] Further, the “computer-readable recording medium” refers to a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a storage device such as a hard disk built into a computer system. Furthermore, the “computer-readable recording medium” also includes, like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line, a medium that dynamically holds a program for a short time, and a volatile memory inside a computer system that becomes a server or a client in that case and holds a program for a certain period of time. Also, the above program may be for realizing a part of the above-described functions, and may further be realizable in combination with a program already recorded in the computer system for realizing the above-described functions.

[0071] As described above, the embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and design changes and the like within the scope not departing from the gist of the present invention are also included.

Description of Reference Numerals

[0072] 10 Electronic device 11 Communication unit 12 Control unit 13 SE 20 Network 30 Management server 30 31 Communication unit 32 Control unit 33 Memory unit 100 Information distribution system

Claims

1. A communication unit that communicates with an information processing device, In one session using a first encryption method, relaying the authentication of a secure element by the information processing device using a second encryption method and acquiring encrypted data including confidential information from the information processing device, a control unit that performs the operations via the communication unit, A connection unit that communicates with the secure element or is communicatively connected to the secure element Comprising, The secure element has higher tamper resistance than the control unit, An electronic device.

2. The control unit acquires non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method and the second encryption method from the information processing device via the communication unit, decrypts the first encryption method for the non-confidential information and the confidential information, and transmits the confidential information decrypted by the first encryption method to the secure element, The confidential information decrypted by the first encryption method is decrypted by the second encryption method by the secure element, The electronic device according to claim 1.

3. The control unit acquires non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method from the information processing device via the communication unit, decrypts the first encryption method for the non-confidential information and the confidential information, and transmits the confidential information decrypted by the first encryption method to the secure element, The electronic device according to claim 1.

4. The control unit refers to the header of the packet received from the information processing device and determines whether to send the data stored in the received packet to the secure element, The electronic device according to claim 1.

5. The confidential information is transmitted from the information processing device together with a command for the secure element, The electronic device according to claim 1.

6. A communication unit that communicates with an electronic device, In one session using a first encryption method, authentication using a second encryption method of a secure element included in the electronic device or a secure element communicatively connected to the electronic device, the secure element having higher tamper resistance than other parts of the electronic device, and transmission of encrypted data including confidential information to the electronic device, a control unit that performs the operations via the communication unit An information processing apparatus comprising

7. The control unit transmits the non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method and the second encryption method to the electronic device via the communication unit. The information processing apparatus according to claim 6.

8. The control unit transmits the non-confidential information encrypted by the first encryption method and the confidential information encrypted by the first encryption method to the electronic device via the communication unit. The information processing apparatus according to claim 6.

9. The control unit includes, in the header of the packet to be transmitted, information for the electronic device to determine whether to send the data stored in the packet to the secure element. The information processing apparatus according to claim 6.

10. The information processing apparatus according to claim 6, wherein the confidential information is transmitted together with a command to the secure element of the electronic device.

11. A communication method for an electronic device including a control unit and a secure element having higher tamper resistance than the control unit or a connection unit communicatively connected to the secure element, A first step of relaying the authentication of the secure element by an information processing apparatus using a second encryption method, A second step of acquiring encrypted data including confidential information from the information processing apparatus And having The first step and the second step are performed within one session by a first encryption method. Communication method.

12. A first step of authenticating a secure element included in an electronic device or a secure element communicatively connected to the electronic device and having higher tamper resistance than other parts of the electronic device using a second encryption method, A second step of transmitting encrypted data including confidential information to the electronic device And having The first step and the second step are performed within one session by a first encryption method. A communication method.

13. A computer of an electronic device including a secure element having higher tamper resistance than a control unit or a connection unit communicatively connected to the secure element, A communication unit that communicates with an information processing apparatus In one session using the first encryption method, the control unit performs, via the communication unit, relay of authentication of the secure element by the information processing device using the second encryption method and acquisition of encrypted data including confidential information from the information processing device A program for causing the above to function

14. A computer A communication unit that communicates with an electronic device In one session using the first encryption method, authentication using a second encryption method of a secure element included in the electronic device or a secure element communicatively connected to the electronic device, the secure element having higher tamper resistance than other parts of the electronic device, and transmission of encrypted data including confidential information to the electronic device are performed via the communication unit. A control unit A program for causing the above to function

Images