Authentication device, authentication target device, image forming apparatus, and replacement unit for the same

Abstract

To improve resistance against a cryptanalysis attack, while preventing an increase in the data length of information used for authentication.SOLUTION: An authentication device authenticating an authentication target device comprises: acquisition means that acquires, from the authentication target device, information indicating secret data stored in the authentication target device, a first hash value corresponding to the secret data, and N being the frequency of repetitions (N is an integer of 2 or more); operation means that determines a second hash value from input data based on the secret data through N iterative operations with a unidirectional function; and authentication means that authenticates the authentication target device by comparing the first hash value acquired by the acquisition means from the authentication target device with the second hash value determined by the operation means.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to a technology for authenticating an authenticatee device by an authenticator device. [Background technology]

[0002] If a component not intended for design is connected to a device, it may cause the device to malfunction or unexpected events. Therefore, it is necessary to determine whether a component installed in a device is genuine, and if it is determined to be ungenuine, to warn the user. Patent Document 1 discloses a configuration that uses a password, a hash value, and an encryption key to determine whether a replacement unit installed in a device is genuine. Generally, the longer the data length (bit length) of the password, hash value, and encryption key, the higher the resistance to brute force and other cryptanalysis attacks. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6491743 Summary of the Invention [Problem to be solved by the invention]

[0004] However, with the improvement of computer processing power, the data length required to maintain sufficient resistance to cryptanalysis attacks has been increasing, and is expected to continue to increase in the future. Meanwhile, memory devices that store information used for authentication may be limited in capacity due to factors such as cost. Therefore, the data length of information used for authentication may not be sufficient to withstand cryptanalysis attacks.

[0005] The present invention provides a technique for improving resistance to cryptanalysis attacks while suppressing an increase in the data length of information used for authentication. [Means for solving the problem]

[0006] According to one aspect of the present invention, an authentication device that authenticates a device to be authenticated comprises: an acquisition means that acquires information indicating secret data stored in the device to be authenticated, a first hash value corresponding to the secret data, and a number of repetitions N (N is an integer greater than or equal to 2) from the device to be authenticated; a calculation means that calculates a second hash value from input data based on the secret data by repeating N times an operation using a one-way function; and an authentication means that authenticates the device to be authenticated by comparing the first hash value acquired from the device to be authenticated by the acquisition means with the second hash value calculated by the calculation means. [Effects of the Invention]

[0007] According to the present invention, it is possible to improve resistance to cryptanalysis attacks while suppressing an increase in the data length of information used for authentication. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating the configuration of an image forming apparatus according to some embodiments. [Figure 2] FIG. 1 is a configuration diagram of an authentication system according to an embodiment. [Figure 3] 10A and 10B are explanatory diagrams of the relationship between information in a secret data table and information in a hash value table, and the relationship between information in a hash value table and a combined hash value. [Figure 4] 10 is a flowchart of an authentication process according to some embodiments. [Figure 5] FIG. 1 is a configuration diagram of an authentication system according to an embodiment. [Figure 6] 10 is a flowchart of a process executed by an authenticated chip in an authentication process. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention claimed. Although multiple features are described in the embodiments, not all of these multiple features are necessarily essential to the invention, and multiple features may be combined arbitrarily. Furthermore, in the accompanying drawings, the same reference numerals are used to designate the same or similar components, and redundant explanations will be omitted.

[0010] First Embodiment FIG. 1 shows an image forming apparatus 100 constituting an authentication system according to this embodiment. The image forming apparatus 100 is, for example, a printer, a copier, or a multifunction peripheral, and forms an image on a sheet according to an electrophotographic process. The process cartridge 102 is a unit (replaceable unit) that is detachable from the main body of the image forming apparatus 100. The process cartridge 102 has, for example, a photosensitive member and components necessary for forming a toner image on the photosensitive member. The process cartridge 102 performs part of the process of forming an image on a sheet under the control of an engine controller 101. The process cartridge 102 has an authenticated chip 103. The authenticated chip 103 is a tamper-resistant device and functions as an authenticated device.

[0011] The engine controller 101 provided in the main body of the image forming apparatus 100 has a control device 105, an authentication chip 106, a communication circuit 104, and an attachment sensor 107, and functions as an authentication device that authenticates the device to be authenticated. The control device 105 also functions as a controller that performs overall control of the entire image forming apparatus 100. The authentication chip 106 performs a process to authenticate the authenticated chip 103. The authentication chip 106 may be a tamper-resistant device. The communication circuit 104 performs a communication process with the process cartridge 102. The attachment sensor 107 detects that the process cartridge 102 has been attached to the main body of the image forming apparatus 100. When the attachment sensor 107 detects that the process cartridge 102 has been attached, the control device 105 starts the authentication process, which will be described later.

[0012] FIG. 2 is a configuration diagram of an authentication system including the authentication chip 106 and the authenticated chip 103. The input / output circuit 201a of the authentication chip 106 relays data transmitted and received between the control device 105 and a microcomputer (hereinafter referred to as "microcomputer") 202a. The microcomputer 202a executes necessary processing in accordance with commands from the control device 105. At that time, the microcomputer 202a stores data necessary for the processing in a volatile memory 203a. The nonvolatile memory 204a stores a control program 205a for the authentication chip 106, a signature verification key 215, and a chip identifier table 216. The chip identifier table 216 stores identifiers (chip identifiers) of authenticated chips 103 that have been successfully authenticated in the past. The verifier 206 verifies the digital signature based on the signature verification key 215. The calculator 207a calculates a hash value of input data using a one-way function F. The comparator 208 determines whether the two input data match. The processing performed by one or more of the verifier 206, the calculator 207a, and the comparator 208 may be performed by the microcomputer 202a.

[0013] The image forming apparatus 100 is configured so that when the process cartridge 102 is attached to the main body of the image forming apparatus 100, the input / output circuit 201b of the authenticated chip 103 and the communication circuit 104 of the engine controller 101 are electrically connected. The input / output circuit 201b relays data exchanged between the control device 105 and the microcomputer 202b. The microcomputer 202b executes necessary processing in accordance with commands from the control device 105. At that time, the microcomputer 202b stores data necessary for the processing in the volatile memory 203b. The non-volatile memory 204b stores a control program 205b of the authenticated chip 103, a secret data table 209, a hash value table 210, a chip identifier 211, a combined hash value 213, an iteration count 214, and a digital signature 212.

[0014] The chip identifier 211 is an identifier assigned to each individual chip 103 to be authenticated, and is unique to each individual chip 103 to be authenticated. The secret data table 209 is information (table) indicating multiple pieces of secret data used for authentication. The hash value table 210 is information (table) indicating hash values ​​calculated from each piece of secret data indicated in the secret data table 209. A method for calculating the hash values ​​indicated in the hash value table 210 based on the secret data indicated in the secret data table 209 will be described later. The digital signature 212 is a digital signature (signature information) generated using a signature key based on information indicating the combined hash value 213 and the number of iterations 214. A method for generating the combined hash value 213 will be described later. The signature key used to generate the digital signature 212 corresponds to the signature verification key 215 stored in the authentication chip 106. In other words, by verifying the digital signature 212 using the signature verification key 215, the validity of the combined hash value 213 and the number of iterations 214 can be verified.

[0015] 3(A) is an explanatory diagram of the relationship between multiple secret data indicated in the secret data table 209 and multiple hash values ​​indicated in the hash value table 210. First, M (M is an integer equal to or greater than 2) pieces of secret data sec(1) to sec(M) are generated by any method, for example, randomly. Information indicating these M pieces of secret data sec(1) to sec(M) is stored as the secret data table 209 in the nonvolatile memory 204b of the authenticated chip 103.

[0016] Next, concatenated data is generated by concatenating each of the secret data sec(1) to sec(M) with the chip identifier 211 stored in the nonvolatile memory 204b of the authenticated chip 103. In FIG. 3A, the chip identifier 211 is referred to as "id." In the following description, "A|B" represents concatenated data obtained by concatenating data A and data B. Next, a hash value is generated by using the concatenated data as input to a one-way function F. In FIG. 2A, hsh(m)_1 (m is an integer from 1 to M) represents the hash value obtained by using the concatenated data "id|sec(m)" as input to the one-way function F. Note that "n" in the notation hsh(m)_n represents the number of times the output of the one-way function F has been calculated.

[0017] Next, concatenated data is generated by concatenating hsh(m)_1 and the chip identifier 211. In FIG. 2A, "id|hsh(m)_1" indicates concatenated data obtained by concatenating hsh(m)_1 and id. Next, a second hash value is generated by using the concatenated data as an input to the one-way function F. In FIG. 2A, hsh(m)_2 indicates a hash value obtained by using "id|hsh(m)_1" as an input to the one-way function F. In this way, by repeating the process of obtaining a hash value N times using the concatenated data concatenated with the chip identifier 211 as an input to the one-way function F, hash values ​​hsh(1)_N to hsh(M)_N are obtained based on the secret data sec(1) to sec(M), respectively. Information indicating the hash values ​​hsh(1)_N to hsh(M)_N is stored in the non-volatile memory 204b of the authenticated chip 103 as a hash value table 210. In the following description, the M hash values ​​hsh(1)_N to hsh(M)_N indicated by the hash value table 210 will be simply referred to as hash values ​​hsh(1) to hsh(M).

[0018] The information indicating the number of repetitions N is stored as the number of repetitions 214 in the nonvolatile memory 204b of the chip to be authenticated 103, and is also used to calculate the digital signature 212. The one-way function F used to obtain the hash value hsh(m) from the secret data sec(m) is the same as the one-way function F used by the calculator 207a of the authentication chip 106.

[0019] 3(B) is an explanatory diagram of the relationship between the multiple hash values ​​indicated in the hash value table 210 and the combined hash value 213. As shown in FIG. 3(B), the combined hash value 213 is obtained by inputting data obtained by concatenating M hash values ​​hsh(1) to hsh(M) indicated in the hash value table 210 to a one-way function F. This one-way function F is also the same as that used by the calculator 207a of the authentication chip 106. The combined hash value 213 is stored in the non-volatile memory 204b of the authenticated chip 103 and is also used to calculate the digital signature 212.

[0020] FIG. 4 is a flowchart of the authentication process executed by the control device 105. The control device 105 starts the process of FIG. 4 in response to the installation sensor 107 detecting the installation of the process cartridge 102. In S10, the control device 105 reads the chip identifier 211 of the authenticated chip 103. In S11, the control device 105 determines whether the read chip identifier 211 is stored in the chip identifier table 216. If the chip identifier 211 is stored in the chip identifier table 216, the control device 105 determines that the installed process cartridge 102 has been authenticated. In this case, the control device 105 determines that the authentication has been successful and ends the process of FIG. 4.

[0021] On the other hand, if the read chip identifier 211 is not stored in the chip identifier table 216, the control device 105 reads the digital signature 212, the combined hash value 213, and the number of iterations 214 in S12, and has the verifier 206 verify the digital signature 212. In S13, the control device 105 obtains a verification result from the verifier 206. If the verification result is unsuccessful (NG), the control device 105 determines that the authentication is unsuccessful and ends the processing of FIG. 4. On the other hand, if the control device 105 obtains a verification result indicating successful verification (OK) from the verifier 206, in S14, the control device 105 reads the hash values ​​hsh(1) to hsh(M) from the hash value table 210 and has the calculator 207a calculate a combined hash value. In S15, the control device 105 has the comparator 208 determine whether the combined hash value calculated by the calculator 207a matches the combined hash value 213 read from the authenticated chip 103.

[0022] When the control device 105 receives a comparison result from the comparator 208 indicating that the two combined hash values ​​do not match in S15, it determines that the authentication is unsuccessful and ends the processing in FIG. 4. On the other hand, when the control device 105 receives a comparison result from the comparator 208 indicating that the two combined hash values ​​match in S15, the control device 105 reads one or more secret data from the secret data table 209 in S16. In the following description, it is assumed that the control device 105 reads one piece of secret data sec(m). The control device 105 causes the calculator 207a to calculate a hash value hsh(m) based on the number of iterations 214, the chip identifier 211, and the secret data sec(m).

[0023] The calculator 207a obtains first output data by using input data, which is concatenated data of the secret data (m) and the chip identifier 211, as input to the one-way function F. Subsequently, the calculator 207a obtains the (k+1)th output data by using the concatenated data of the kth output data and the chip identifier 211 as input to the one-way function F, and repeats this process from k=1 to N-1 to obtain a hash value hsh(m). Note that the value of N is indicated by the number of repetitions 214.

[0024] In S17, the control device 105 causes the comparator 208 to determine whether the hash value hsh(m) calculated by the calculator 207a and the hash value hsh(m) read from the authenticated chip 103 match.

[0025] When the control device 105 receives a comparison result from the comparator 208 in S17 indicating that the two hash values ​​hsh(m) do not match, it determines that the authentication has been unsuccessful and ends the processing in Fig. 4. On the other hand, when the control device 105 receives a comparison result from the comparator 208 in S17 indicating that the two hash values ​​hsh(m) match, it determines that the authentication has been successful. In this case, the control device 105 stores the chip identifier 211 read in S10 in the chip identifier table 216.

[0026] In S16, when a plurality of pieces of secret data, for example, K pieces of secret data (K is an integer from 2 to M), are read, the control device 105 calculates K hash values ​​corresponding to the K pieces of secret data, respectively. If all of the calculated K hash values ​​match the corresponding hash values ​​stored in the hash value table 210, the control device 105 determines that the authentication is successful; otherwise, it determines that the authentication is unsuccessful.

[0027] If the control device 105 determines that the authentication is unsuccessful, it performs processing such as notifying the user that the process cartridge 102 is not a genuine product.

[0028] As described above, by repeating the calculation using the one-way function F multiple times, the calculation time for the authentication process can be increased without extending the data length of the secret data sec(m). This increases the calculation time required for a brute force attack or other cryptanalysis attack, but it is possible to improve resistance to cryptanalysis attacks while suppressing an increase in the data length of the secret data.

[0029] In this embodiment, when calculating a hash value from secret data, the concatenated data with the chip identifier 211 is always used as input data to the one-way function F. However, it is sufficient to use the concatenated data with the chip identifier 211 in at least one of N calculations using the one-way function F, and it is not necessary to always use the concatenated data with the chip identifier 211 as input to the one-way function F. For example, in the first calculation using the one-way function F, the concatenated data of the secret data and the chip identifier 211 is used, and in the second to Nth calculations, the output data of the previous one-way function F can be used as input to the one-way function F as is. Alternatively, in the first calculation, a hash value can be calculated using only the secret data as input to the one-way function F, and further, in the second to N-1th calculations, the output data of the previous one-way function F can be used as input as is, and in the Nth calculation, the concatenated data of the hash value output in the N-1th calculation and the chip identifier 211 can be used as input to the one-way function F as is. Furthermore, in odd-numbered calculations, the concatenated data is used, and in even-numbered calculations, the output data of the previous one-way function F can be used as input as is. Furthermore, in even-numbered calculations, concatenated data is used, and in odd-numbered calculations, the output data of the previous one-way function F can be used as input to the one-way function F as is.

[0030] In this embodiment, the nonvolatile memory 204b of the authenticated chip 103 stores the combined hash value 213 and the iteration count 214 as plaintext, and the digital signature 212. However, a message recovery digital signature may be stored as the digital signature 212. In this case, the verifier 206 verifies the digital signature 212 in S12, and also recovers the combined hash value 213 and the iteration count 214 from the digital signature 212.

[0031] Second Embodiment Next, the second embodiment will be described, focusing on the differences from the first embodiment. Fig. 5 is a configuration diagram of an authentication system of this embodiment. Compared to the authentication system of the first embodiment shown in Fig. 2, this embodiment differs in that a read limit 501 is stored in the nonvolatile memory 204b of the authenticated chip 103. At the time of factory shipment, an initial value of the read limit 501 is stored in the nonvolatile memory 204b of the authenticated chip 103. The initial value is information indicating an integer greater than 0, and specifies the upper limit of the number of times the control device 105 can read the secret data.

[0032] 6 is a flowchart of the process executed by the microcomputer 202b of the chip to be authenticated 103 according to this embodiment. The process in FIG. 6 is executed when the control device 105 of the authentication chip 106 instructs the microcomputer 202b to read secret data. That is, the process in FIG. 6 is executed on the chip to be authenticated 103 side in S16 of FIG. 4.

[0033] In response to receiving an instruction to read the secret data from the control device 105, the microcomputer 202b determines in S20 whether the value of the readable number of times 501 is greater than 0. If the value of the readable number of times 501 is greater than 0, the microcomputer 202b updates the value of the readable number of times 501 by decrementing it by 1 in S21. Next, the microcomputer 202b transmits the secret data instructed to be read to the control device 105 in S22. On the other hand, if the value of the readable number of times 501 is not greater than 0 in S20, the microcomputer 202b notifies the control device 105 in S23 that transmission of the secret data is not possible. If the control device 105 receives a notification from the microcomputer 202b that transmission of the secret data is not possible, the control device 105 determines that authentication has been unsuccessful and ends the processing in FIG. 4.

[0034] In this embodiment, even if the control device 105 instructs to read a plurality of pieces of secret data, the value of the readable number 501 is updated in S21 to be decreased by 1. However, the value of the readable number 501 may be decreased in S21 by the number of pieces of secret data instructed to be read by the control device 105. In this case, the determination in S20 is a process of determining whether the value of the readable number 501 is equal to or greater than the number of pieces of secret data instructed to be read by the control device 105.

[0035] Furthermore, in this embodiment, if the value of the readable number of times 501 is not greater than 0, the microcomputer 202b notifies the control device 105 that transmission is not possible in S23. However, it is also possible to configure the microcomputer 202b not to notify the control device 105 of any error if the value of the readable number of times 501 is not greater than 0. In this case, if the microcomputer 202b does not transmit the secret data even after a predetermined period has elapsed since the instruction to read the secret data, the control device 105 determines that authentication has been unsuccessful.

[0036] As described above, in this embodiment, the number of times secret data can be read is limited, which makes simple data copying difficult and improves security against cryptanalysis attacks.

[0037] <Other> Although the present invention has been described using an embodiment in which an authentication device is provided in the main body of an image forming apparatus and an authenticated device is provided in a replacement unit of the image forming apparatus, the present invention can also be applied to devices other than image forming apparatuses. In other words, the present invention can be applied to any device that uses a replacement unit that is configured to be detachable from the main body of the device. Note that the authentication device is provided in the main body of the device, and the authenticated device is provided in the replacement unit of the device.

[0038] [Other embodiments] The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0039] The disclosure of this embodiment includes the following configuration. (Configuration 1) An authentication device that authenticates an authenticatee device, an acquisition means for acquiring information indicating secret data stored in the device to be authenticated, a first hash value corresponding to the secret data, and a number of repetitions N (N is an integer equal to or greater than 2) from the device to be authenticated; a calculation means for calculating a second hash value from input data based on the secret data by repeating calculations using a one-way function N times; an authentication means for authenticating the device to be authenticated by comparing the first hash value acquired from the device to be authenticated by the acquisition means with the second hash value calculated by the calculation means; An authentication device comprising: (Configuration 2) 2. The authentication device according to configuration 1, wherein the authentication means determines that authentication of the device to be authenticated has failed if the first hash value and the second hash value do not match. (Configuration 3) the acquiring means acquires, from the device to be authenticated, signature information for verifying the information indicating the number of repetitions; 3. The authentication device according to configuration 1 or 2, wherein the authentication means determines that authentication of the device to be authenticated has failed if verification using the signature information has failed. (Configuration 4) the device to be authenticated stores a plurality of secret data and a plurality of first hash values ​​corresponding to the plurality of secret data; The authentication device according to configuration 3, wherein the signature information is information for verifying information indicating a third hash value obtained by the one-way function of a value obtained by concatenating the plurality of first hash values ​​and information indicating the number of iterations. (Configuration 5) the acquiring means acquires the plurality of first hash values ​​and the third hash value from the device to be authenticated; the calculation means calculates a fourth hash value by applying the one-way function to a value obtained by concatenating the plurality of first hash values; The authentication device according to configuration 4, wherein the authentication means determines that authentication of the device to be authenticated is unsuccessful if the third hash value acquired from the device to be authenticated by the acquisition means does not match the fourth hash value calculated by the calculation means. (Configuration 6) the acquiring means acquires an identifier of the authenticated device from the authenticated device; 6. The authentication device according to any one of configurations 1 to 5, wherein the input data is data obtained by concatenating the secret data and data indicating the identifier. (Configuration 7) The authentication device according to configuration 6, wherein the calculation means obtains the second hash value by repeating the steps of: obtaining first output data by inputting the input data to the one-way function; and obtaining the (k+1)th output data by inputting data obtained by concatenating the kth output data and data indicating the identifier to the one-way function, from k=1 to N-1. (Configuration 8) 8. An image forming apparatus having the authentication device according to any one of configurations 1 to 7, wherein a unit having the device to be authenticated is detachably attached. (Configuration 9) An authenticatee device to be authenticated by an authentication device, a storage means for storing information indicating a plurality of pieces of secret data, a first hash value corresponding to each of the plurality of pieces of secret data, and a number of repetitions N (N is an integer equal to or greater than 2); a processing means for performing processing to transmit the information stored in the storage means to the authentication device based on an instruction from the authentication device; Equipped with The device to be authenticated, wherein the first hash value corresponding to the secret data is calculated from input data based on the secret data by repeating a one-way function N times. (Configuration 10) 10. The device to be authenticated according to configuration 9, wherein the storage means further stores signature information for verifying the information indicating the number of repetitions. (Configuration 11) The authentication target device described in configuration 10, wherein the signature information is information for verifying information indicating a third hash value obtained by the one-way function of a value obtained by concatenating first hash values ​​corresponding to each of the multiple secret data, and information indicating the number of repetitions. (Configuration 12) 12. The device to be authenticated according to any one of configurations 9 to 11, wherein the input data is data obtained by concatenating the secret data and data indicating an identifier of the device to be authenticated. (Configuration 13) The authentication target device described in configuration 12, wherein the first hash value corresponding to the secret data is obtained by repeating the process of obtaining first output data by using the input data as input to the one-way function, and obtaining (k+1)th output data by using data obtained by concatenating the kth output data and data indicating the identifier as input to the one-way function, from k=1 to N-1. (Configuration 14) The device to be authenticated according to any one of configurations 9 to 13, wherein the processing means does not respond to a read instruction for the secret data from the authentication device when the number of times the authentication device has read the plurality of secret data reaches an upper limit, or notifies the authentication device that the secret data cannot be transmitted. (Configuration 15) A replacement unit for an image forming apparatus including the authenticated device according to any one of configurations 9 to 14.

[0040] The invention is not limited to the above-described embodiments, and various changes and modifications can be made without departing from the spirit and scope of the invention. Accordingly, the following claims are appended to apprise the public of the scope of the invention. [Explanation of symbols]

[0041] 105: control device, 206a: computing unit, 208: comparator

Claims

1. An authentication device that authenticates an authenticatee device, an acquisition means for acquiring, from the device to be authenticated, information indicating secret data stored in the device to be authenticated, a first hash value corresponding to the secret data, and a number of repetitions N (N is an integer equal to or greater than 2); a calculation means for calculating a second hash value from input data based on the secret data by repeating calculations using a one-way function N times; an authentication means for authenticating the device to be authenticated by comparing the first hash value acquired from the device to be authenticated by the acquisition means with the second hash value calculated by the calculation means; An authentication device comprising:

2. 2. The authentication device according to claim 1, wherein said authentication means determines that authentication of said authenticated device has failed if said first hash value and said second hash value do not match.

3. the acquiring means acquires, from the device to be authenticated, signature information for verifying the information indicating the number of repetitions; 2. The authentication device according to claim 1, wherein said authentication means determines that authentication of said device to be authenticated has failed if verification using said signature information has failed.

4. the device to be authenticated stores a plurality of secret data and a plurality of first hash values ​​corresponding to the plurality of secret data; 4. The authentication device according to claim 3, wherein the signature information is information for verifying information indicating a third hash value obtained by the one-way function of a value obtained by concatenating the plurality of first hash values ​​and information indicating the number of repetitions.

5. the acquiring means acquires the plurality of first hash values ​​and the third hash value from the device to be authenticated; the calculation means calculates a fourth hash value by applying the one-way function to a value obtained by concatenating the plurality of first hash values; 5. The authentication device according to claim 4, wherein the authentication means determines that authentication of the device to be authenticated is unsuccessful if the third hash value acquired from the device to be authenticated by the acquisition means does not match the fourth hash value calculated by the calculation means.

6. the acquiring means acquires an identifier of the authenticated device from the authenticated device; The authentication device according to claim 1 , wherein the input data is data obtained by concatenating the secret data and data indicating the identifier.

7. 7. The authentication device of claim 6, wherein the calculation means obtains the second hash value by repeating the steps of: obtaining first output data by using the input data as input to the one-way function; and obtaining the (k+1)th output data by using data obtained by concatenating the kth output data and data indicating the identifier as input to the one-way function, from k=1 to N-1.

8. 8. An image forming apparatus comprising the authentication device according to claim 1, wherein a unit having the device to be authenticated is detachably mounted.

9. An authenticatee device to be authenticated by an authentication device, a storage means for storing information indicating a plurality of pieces of secret data, a first hash value corresponding to each of the plurality of pieces of secret data, and a number of repetitions N (N is an integer equal to or greater than 2); a processing means for performing processing to transmit the information stored in the storage means to the authentication device based on an instruction from the authentication device; Equipped with The device to be authenticated, wherein the first hash value corresponding to the secret data is calculated from input data based on the secret data by repeating a one-way function N times.

10. 10. The device to be authenticated according to claim 9, wherein said storage means further stores signature information for verifying the information indicating the number of repetitions.

11. The authentication device of claim 10, wherein the signature information is information for verifying information indicating a third hash value obtained by the one-way function of a value obtained by concatenating first hash values ​​corresponding to each of the multiple secret data, and information indicating the number of repetitions.

12. 10. The device to be authenticated according to claim 9, wherein the input data is data obtained by concatenating the secret data with data indicating an identifier of the device to be authenticated.

13. The authentication target device of claim 12, wherein the first hash value corresponding to the secret data is obtained by repeating the process of obtaining first output data by using the input data as input to the one-way function, and obtaining (k+1)th output data by using data obtained by concatenating the kth output data and data indicating the identifier as input to the one-way function, from k=1 to N-1.

14. The authenticated device according to claim 9, wherein the processing means does not respond to a read instruction for the secret data from the authentication device or notifies the authentication device that the secret data cannot be transmitted when the number of times the authentication device has read the plurality of secret data reaches an upper limit.

15. A replacement unit for an image forming apparatus, comprising the authenticated device according to any one of claims 9 to 14.

Images