Authentication target device and authentication system

Abstract

To make it more difficult to imitate an authentication target device as compared with a conventional one.SOLUTION: An authentication target device recovers a source kay by decoding an encryption source key with a secret key stored in non-volatile first storage means to generate a new encryption source key by encrypting the source key by using a random number as a new secret key. The authentication target device updates the secret key and the encryption source key with the new secret key and the new encryption key. The authentication target device leads out an authentication key on the basis of the source key, and generates response data on the basis of challenge data received from the authentication device and the authentication key. The authentication device also generates the authentication key in the same order to generate the response data for inspection on the basis of the challenge data and the authentication key. The authentication device obtains an authentication result on the basis of the response data transmitted from the authentication target device and the response data for the inspection.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present invention relates to an authenticated device and an authentication system. [Background technology]

[0002] When a part that was not anticipated in the design is connected to an electronic device such as an image forming device, the electronic device may break down or an unexpected event may occur. Patent Document 1 discloses a method of performing challenge-response authentication using a secret encryption key (authentication key) to identify whether a battery pack is genuine.

[0003] Incidentally, a device to be authenticated by an authentication device is made into an LSI (large scale integrated circuit) chip and is provided with tamper resistance so that secret information is not revealed from the LSI chip. Meanwhile, according to Non-Patent Document 1, a micro-probing attack is introduced that exposes secret information from a non-volatile memory mounted on the LSI chip. Therefore, the tamper resistance of the device to be authenticated is exposed to the threat of the micro-probing attack. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 5064003 [Non-patent literature]

[0005] [Non-Patent Document 1] Sergei Skorobogatov, United Kingdom 'How microprobing can attack encrypted memory', In Proceedings of Euromicro Conference on Digital System Design, AHSA 2017 Special Session, Vienna, Austria. IEEE Computer Society, 2017. Summary of the Invention [Problem to be solved by the invention]

[0006] If secret information is exposed from the authenticated device, a counterfeit product containing the exposed secret information may be created, and the electronic device to which the counterfeit product is connected may be damaged. Therefore, the appearance of a defense method against microprobing attacks is eagerly awaited. Therefore, the present invention aims to make counterfeiting of authenticated devices more difficult than ever before. [Means for solving the problem]

[0007] The present invention relates to, for example, An authentication system for authenticating a device to be authenticated by transmitting challenge data from an authentication device to a device to be authenticated and transmitting response data from the device to the authentication device, comprising: The authenticated device is a first non-volatile storage means for storing a private key of the device to be authenticated and an encrypted original key generated by encrypting an original key with the private key; a first decryption means for decrypting the encrypted original key using the private key stored in the first storage means to restore the original key; a volatile first storage means for temporarily storing the master key; A first random number generating means for generating random numbers; a first encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a first updating means for updating the private key and the encryption source key stored in the first storage means with the new private key and the new encryption source key; a first derivation means for deriving an authentication key based on the master key stored in the first storage means; a first generating means for generating the response data based on the challenge data received from the authentication device and the authentication key, The authentication device includes: a second non-volatile storage means for storing a private key of the authentication device and an encrypted original key generated by encrypting an original key with the private key; a second decryption means for decrypting the encrypted original key using the private key stored in the second storage means to restore the original key; a volatile second storage means for temporarily storing the master key; A second random number generating means for generating random numbers; a second encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a second updating means for updating the private key and the encryption source key stored in the second storage means with the new private key and the new encryption source key; a second derivation means for deriving an authentication key based on the master key stored in the second storage means; A second generating means for generating response data for verification based on the challenge data and the authentication key; and an authentication means for determining an authentication result based on the response data transmitted from the device to be authenticated and the response data for verification. Effect of the Invention

[0008] According to the present invention, it becomes more difficult to imitate an authenticated device than before. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an image forming apparatus. [Diagram 2] FIG. 1 is a diagram illustrating an authentication system. [Diagram 3] FIG. 2 is a diagram for explaining an authenticated chip. [Figure 4] FIG. 2 is a diagram for explaining an authentication chip. [Diagram 5] FIG. 1 is a sequence diagram showing an authentication method. [Figure 6] 11 is a flowchart showing a method for deriving an authentication key. [Figure 7] FIG. 2 is a diagram for explaining the operation of an encryptor, a decryptor, and a deriver. [Figure 8] FIG. 2 is a diagram explaining the operation of a CPU. [Figure 9] FIG. 2 is a diagram for explaining an authentication chip. [Figure 10] FIG. 4 is a diagram for explaining the operation of a deriver. [Figure 11] 11 is a flowchart showing a method for deriving an authentication key. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, the embodiments will be described in detail with reference to the attached drawings. Note that the following embodiments do not limit the invention according to the claims. Although the embodiments describe a number of features, not all of these features are essential to the invention, and the features may be combined in any manner. Furthermore, in the attached drawings, the same reference numbers are used for the same or similar configurations, and duplicated descriptions are omitted.

[0011] <First Example> [Image forming device (authentication system)] FIG. 1 shows an image forming apparatus 100, an optional paper feeder 130, and an optional paper discharger 140. The image forming apparatus 100 is a printer, copier, or multifunction machine that forms an image on a sheet according to an electrophotographic process. The charging roller 16 uniformly charges the surface of the photosensitive drum 19. The exposure unit 21 irradiates the surface of the photosensitive drum 19 with light to form an electrostatic latent image. The developing roller 17 attaches toner to the electrostatic latent image to form a toner image. The paper feed unit 12 supplies a sheet from the sheet stacking unit 11 to the conveying path. The conveying rollers 13 and 14 convey the sheet through the conveying path. The sheet is conveyed to a transfer nip formed by a transfer roller 20 and the photosensitive drum 19. The transfer roller 20 transfers the toner image from the photosensitive drum 19 to the sheet. The cleaner 18 cleans the surface of the photosensitive drum 19.

[0012] The sheet onto which the toner image has been transferred is transported to the fixing device 120. The fixing device 120 applies heat and pressure to the sheet and the toner image to fix the toner image onto the sheet. The transport rollers 26 and the discharge rollers 27 transport the sheet and discharge it outside the image forming apparatus 100.

[0013] Here, the process cartridge 102 is configured by integrating the photosensitive drum 19, charging roller 16, developing roller 17, and cleaner 18, and is a replaceable part that is detachable from the image forming apparatus 100. The fixing unit 120 is also a replaceable part that is detachable from the image forming apparatus 100. The optional paper feeder 130 is a device provided to increase the sheet stacking capacity, and is detachable from the image forming apparatus 100. The optional paper discharge device 140 is a device that sorts and discharges sheets on which images have been formed, and is detachable from the image forming apparatus.

[0014] FIG. 2 shows that the process cartridge 102 is provided with an authenticated chip 103. The engine controller 101 has a control device 105, an authentication chip 106, and a communication circuit 104. The control device 105 is a controller (e.g., a CPU, a microcomputer) that controls the entire image forming apparatus 100. The authentication chip 106 is a semiconductor integrated circuit that authenticates the authenticated chip 103. The communication circuit 104 is a communication circuit for communicating with the process cartridge 102. The process cartridge 102 has the authenticated chip 103. The authenticated chip 103 is a tamper-resistant chip. The control device 105 detects that the process cartridge 102 is mounted on the image forming apparatus 100 using a mounting sensor 109. When the mounting sensor 109 detects the process cartridge 102, the control device 105 instructs the authentication chip 106 to perform authentication. The control device 105 transmits a challenge generated by the authentication chip 106 to the authenticated chip 103 via the communication circuit 104. The control device 105 receives a response from the authenticated chip 103 via the communication circuit 104 and transfers the response to the authentication chip 106. The control device 105 receives an authentication result from the authentication chip 106. The authenticated chip 103 is incorporated in one or more of the consumables or replacement parts (e.g., the fixing unit 120) of the image forming device 100 and optional devices (e.g., the optional paper feeder 130 and paper discharger 140, etc.).

[0015] FIG. 3 shows the internal configuration of the authenticated chip 103. FIG. 4 shows the internal configuration of the authentication chip 106. In the first embodiment, it is assumed that the authenticated chip 103 and the authentication chip 106 have the same hardware configuration, except for the stored information and program code. In the following description, the same reference symbols are used for the same or similar components. The suffixes a and b may be added to the end of these reference symbols to distinguish the authenticated chip 103 from the authentication chip 106. For example, CPU201a indicates the CPU 201 of the authenticated chip 103. CPU201b indicates the CPU 201 of the authentication chip 106.

[0016] As shown in FIG. 3, the authenticated chip 103 includes a CPU 201a, a CPU bus 202a, a logic circuit 203a, a non-volatile memory 204a, a memory bus 205a, a volatile memory 206a, and an external interface 207a.

[0017] The CPU 201a is, for example, a central processing unit (CPU) with a bus width of 32 bits. The memory bus 205a and the CPU bus 202a include a data bus and an address bus. The data bus has a bus width of 32x2=64 bits for input and output of data. The CPU 201a communicates with the logic circuit 203a via the CPU bus 202a. Furthermore, the CPU 201a accesses the non-volatile memory 204a and the volatile memory 206a via the CPU bus 202a, the memory bus controller 212a, and the memory bus 205a.

[0018] The logic circuit 203a includes an interface circuit 208a, a random number generator 209a, an encryptor / decryptor 210a, a deriver 211a, a memory bus controller 212a, a register 213a, and an initialization circuit 214a. The interface circuit 208a is a communication circuit that communicates with an external device via an external interface 207a. The external interface 207a is connected to the communication circuit 104. The random number generator 209a is a circuit that generates random numbers. The encryptor / decryptor 210a includes an encryption circuit (encoder) that encrypts plaintext with a key, and a decryption circuit (decoder) that decrypts ciphertext with the key. The deriver 211a is a circuit that derives an authentication key. The memory bus controller 212a mediates or controls access to the non-volatile memory 204a and the volatile memory 206a. The register 213a is a storage device that temporarily holds information. The initialization circuit 214a is a circuit that protects the information held by the register 213a and erases the information held in the register 213a. The initialization circuit 214a may be called a protection circuit.

[0019] The non-volatile memory 204a may be a charge storage type device on a floating gate such as an EEPROM (Electrically Erasable Programmable Read Only Memory) and a flash memory. The non-volatile memory 204a may be an ECC (Error Correcting Code) memory. ECC is a function to detect and correct data corruption. This will improve the reliability of the information stored in the non-volatile memory 204a and memory security. The non-volatile memory 204a stores a chip ID 215a, a reception ID 216a, a pointer 217a, and a counter 218a. In addition, the non-volatile memory 204a stores an A chip private key 219a, an A encryption original key 220a, a B chip private key 221a, a B encryption original key 222a, an authentication key 223a, and a program code 224a.

[0020] The chip ID 215a is identification information of the authenticated chip 103, and is unique identification information. The received ID 216a is identification information of the authentication chip 106 received from the authentication chip 106 and stored. The pointer 217a is used to switch between a plurality of information sets described later. The counter 218a is used to detect an abnormal end (unauthorized end) of the authentication process. The A chip private key 219a is a private key linked to the A encryption original key 220a, and is a key used to restore the original key from the A encryption original key 220a. The B chip private key 221a is a private key linked to the B encryption original key 222a, and is a key used to restore the original key from the B encryption original key 222a. The A chip private key 219a and the A encryption original key 220a form one key set. The B chip private key 221a and the B encryption original key 222a form another key set. The authentication key 223a is a key used in the authentication process. The program code 224a is a program executed by the CPU 201a.

[0021] The CPU 201a executes the program code 224a to realize various authentication functions. A memory bus 205a and a CPU bus 202a are interposed between the CPU 201a and the program code 224a. Therefore, the reading of the program code 224a by the CPU 201a is mediated by the memory bus controller 212a. Temporary data generated during the execution of the program code 224a is stored in the volatile memory 206a. The volatile memory 206a may be a static random access memory (SRAM). The memory bus controller 212a permits the CPU 201a to read and write data from and to the volatile memory 206a.

[0022] The memory bus controller 212a permits the CPU 201a to read and write the chip ID 215a, the received ID 216a, the pointer 217a, the counter 218a, and the authentication key 223a. However, the memory bus controller 212a prohibits the CPU 201a from directly reading and writing the A chip private key 219a, the A encryption original key 220a, the B chip private key 221a, and the B encryption original key 222a.

[0023] The interface circuit 208a is electrically connected to the communication circuit 104 when the process cartridge 102 is attached to the main body of the image forming apparatus 100. The interface circuit 208a receives a command and a challenge transmitted from the control device 105 via the communication circuit 104 and transfers them to the CPU 201a. The CPU 201a generates a response corresponding to the command and challenge in accordance with the program code 224a and outputs it to the interface circuit 208a. The interface circuit 208a transmits the response to the control device 105 via the external interface 207a and the communication circuit 104.

[0024] As shown in Fig. 4, the configuration of the authentication chip 106 is common to the configuration of the authenticated chip 103 shown in Fig. 3. Therefore, the explanation of the configuration of the authentication chip 106 refers to the explanation of the configuration of the authenticated chip 103. In other words, by replacing the last letter "a" of the reference numeral in the above explanation with "b", the above explanation becomes an explanation of the configuration of the authenticated chip 103. The following mainly explains the parts of the configuration of the authentication chip 106 that are different from the configuration of the authenticated chip 103.

[0025] In Fig. 4, the external interface 207b is connected to the control device 105. The interface circuit 208b communicates with the control device 105 via the external interface 207b. The program code 224b is a program that causes the CPU 201b to cause the authentication chip 106 to execute a specific authentication process. The chip ID 215b is identification information of the authentication chip 106, and is unique identification information. The received ID 216b is identification information of the authenticated chip 103 that is received from and stored in the authenticated chip 103.

[0026] The control device 105 transfers the response data received from the authenticated chip 103 to the authentication chip 106 via the external interface 207b. The CPU 201b of the authentication chip 106 receives the response data and verifies the response data (authentication process) according to the program code 224b. That is, the CPU 201b judges whether the received response data is genuine response data or not. The CPU 201b reports (transmits) the judgment result (authentication result) to the control device 105 via the interface circuit 208b and the external interface 207b.

[0027] [Authentication Sequence] 5 shows an authentication sequence executed between the authenticated chip 103 and the authentication chip 106. Here, the starting point of the authentication sequence is the control device 105.

[0028] Acquisition of identification information of the authenticated chip 103 In Sq1, the control device 105 transmits an ID request to the authenticated chip 103. The ID request is a command for requesting unique identification information (chip ID 215a) held by the authenticated chip 103. The interface circuit 208a of the authenticated chip 103 receives the ID request via the external interface 207a. The CPU 201a obtains the ID request from the interface circuit 208a according to the program code 224a. The CPU 201a compares the ID given to the ID request with its own ID, and thereby understands that the ID request is a command addressed to the authenticated chip 103. The CPU 201a reads out "TC_ID", which is the chip ID 215a, from the non-volatile memory 204a according to the ID request. As an example, it is assumed that the TC_ID is 8 bytes of information.

[0029] In Sq2, the CPU 201a of the authenticated chip 103 transmits the TC_ID via the interface circuit 208a and the external interface 207a. The control device 105 receives the TC_ID via the communication circuit 104.

[0030] In Sq3, the control device 105 transfers "TC_ID", which is the chip ID 215a of the authenticated chip 103, to the authentication chip 106. The interface circuit 208b of the authentication chip 106 receives the TC_ID via the external interface 207b. The CPU 201b acquires the TC_ID from the interface circuit 208b according to the program code 224b, and recognizes that it has received the TC_ID of the authenticated chip 103. The CPU 201b reads out the received ID 216b from the non-volatile memory 204b. The received ID 216b is the chip ID "TC_ID'" received in the past. The CPU 201b compares the old chip ID "TC_ID'" received in the past with the TC_ID received this time. If the two are different, the CPU 201b overwrites the received ID 216b with the TC_ID received this time to update it. If the two are the same, the CPU 201b discards the TC_ID received this time. The CPU 201b may store information indicating whether the reception ID 216b has been updated in the volatile memory 206b.

[0031] Acquisition of identification information of authentication chip 106 In Sq4, the control device 105 transmits an ID request to the authentication chip 106. The ID request is a command for requesting unique identification information (chip ID 215b) held by the authentication chip 106. The interface circuit 208b of the authentication chip 106 receives the ID request via the external interface 207b. The CPU 201b obtains the ID request from the interface circuit 208b according to the program code 224b. The CPU 201b compares the ID given to the ID request with its own ID and understands that the ID request is a command addressed to the authentication chip 106. The CPU 201b reads out "AC_ID", which is the chip ID 215b, from the non-volatile memory 204b in accordance with the ID request. As an example, it is assumed that the AC_ID is 8 bytes of information.

[0032] In Sq5, the CPU 201b of the authentication chip transmits the AC_ID via the interface circuit 208b and the external interface 207b. The control device 105 receives the AC_ID from the authentication chip .

[0033] In Sq6, the control device 105 transfers "AC_ID", which is the chip ID 215b of the authentication chip 106, to the authenticated chip 103. The interface circuit 208a of the authenticated chip 103 receives the AC_ID via the external interface 207a. The CPU 201a acquires the AC_ID from the interface circuit 208a according to the program code 224a, and recognizes that it has received the AC_ID of the authentication chip 106. The CPU 201a reads out the received ID 216a from the non-volatile memory 204a. The received ID 216a is the chip ID "AC_ID'" received in the past. The CPU 201a compares the old chip ID "AC_ID'" received in the past with the AC_ID received this time. If the two are different, the CPU 201a overwrites the received ID 216a with the AC_ID received this time to update it. If the two are the same, the CPU 201a discards the AC_ID received this time. The CPU 201a may store information indicating whether the reception ID 216a has been updated in the volatile memory 206a.

[0034] ●Certification renewal In Sq7, the control device 105 transmits an update request to the authenticated chip 103, requesting the authenticated chip 103 to update the authentication key 223a. Here, the authentication key is a key used in the challenge-response authentication performed between the authentication chip 106 and the authenticated chip 103. When the CPU 201a of the authenticated chip 103 receives the update request, it starts the update process. The CPU 201a reads information indicating whether the received ID 216a has been updated from the volatile memory 206a, and determines whether the authentication key 223a needs to be updated. If the received ID 216a has been updated, the authentication key 223a needs to be updated. If the received ID 216a has not been updated, the authentication key 223a does not need to be updated. If the authentication key 223a needs to be updated, the CPU 201a controls the logic circuit 203a to derive a new authentication key and overwrites it on the authentication key 223a.

[0035] In Sq8, the control device 105 transmits an update request to the authentication chip 106, requesting the authentication chip 106 to update the authentication key 223b. When the CPU 201b of the authentication chip 106 receives the update request, it starts the update process. The CPU 201b reads information indicating whether the received ID 216b has been updated from the volatile memory 206b, and determines whether the authentication key 223b needs to be updated. If the received ID 216b has been updated, the authentication key 223b needs to be updated. If the received ID 216b has not been updated, the authentication key 223b does not need to be updated. If the authentication key 223b needs to be updated, the CPU 201b controls the logic circuit 203b to derive a new authentication key and overwrites it over the authentication key 223b.

[0036] ● Challenge-response authentication In Sq9, the control device 105 transmits a challenge request to the authentication chip 106. The challenge request is a command requesting the generation of challenge data C_DATA. Upon receiving the challenge request, the CPU 201b of the authentication chip 106 controls the logic circuit 203 in accordance with the program code 224b to generate the challenge data C_DATA.

[0037] In Sq10, the CPU 201b of the authentication chip 106 transmits the challenge data C_DATA to the control device 105. The control device 105 receives the challenge data C_DATA from the authentication chip 106.

[0038] In Sq11, the control device 105 transmits the challenge data C_DATA received from the authentication chip 106 to the authenticated chip 103. The CPU 201a of the authenticated chip 103 receives the challenge data C_DATA from the control device 105. The CPU 201a controls the logic circuit 203 to generate response data R_DATA using the challenge data C_DATA and the authentication key 223a.

[0039] In Sq12, the CPU 201a of the authenticated chip 103 transmits the response data R_DATA to the control device 105. The control device 105 receives the response data R_DATA from the authenticated chip 103.

[0040] In Sq13, the control device 105 transmits the response data R_DATA received from the authenticated chip 103 to the authentication chip 106. The authentication chip 106 receives the response data R_DATA from the control device 105. The authentication chip 106 generates response data R_DATA for verification based on the challenge data C_DATA and the authentication key 223b. The authentication chip 106 generates an authentication result based on the received response data R_DATA and the response data R_DATA for verification.

[0041] In Sq14, the authentication chip 106 transmits the authentication result to the control device 105. The control device 105 permits or prohibits the operation of the process cartridge 102 depending on the authentication result. For example, if the authentication result is OK, the operation of the process cartridge 102 is permitted. If the authentication result is NG, the operation of the process cartridge 102 is temporarily stopped or prohibited. Then, a display operation unit (not shown) mounted on the image forming apparatus 100 may output a warning indicating that the authentication is NG, and prompt the user to decide whether or not to resume. When an indication of intention to resume is input from the display operation unit, the image forming apparatus 100 permits or resumes the operation of the process cartridge 102.

[0042] Details of authentication key derivation 6 shows a method of deriving an authentication key executed in the authenticated chip 103 and the authenticating chip 106. Since the authentication key derivation method is a process executed in common in the authenticated chip 103 and the authenticating chip 106, in the following description, the letters a and b will be omitted from the reference characters. Each step is executed by the CPU 201 in accordance with the program code 224. Furthermore, each step may be executed by the logic circuit 203 controlled by the CPU 201.

[0043] In S601, the CPU 201 instructs the initialization circuit 214 to release the protection, thereby releasing the protection. The initialization circuit 214 switches reading and writing to the register 213 from a prohibited state (protected state) to a permitted state (released state) in accordance with the instruction from the CPU 201. Furthermore, this instruction causes the encryption / decryption unit 210 and the derivation unit 211 to transition from an inactive state to an active state.

[0044] In S602, the CPU 201 reads its own ID (chip ID 215) and the other party's ID (received ID 216) from the non-volatile memory 204. The two read IDs (TC_ID and AC_ID) are temporarily stored in the volatile memory 206.

[0045] In S603, the CPU 201 reads the counter 218 from the non-volatile memory 204 and determines whether the counter 218 is at a predetermined value. As described below, the predetermined value is a value indicating whether the previous authentication process ended abnormally. The predetermined value may be, for example, the maximum value MAXCNT (=3) that the counter 218 can take. In this case, if the value of the counter 218 is equal to or less than MAXCNT, the CPU 201 proceeds to S604. The counter 218 in the initial state is 0. If the previous authentication process was normal (counter 218=0), the CPU 201 proceeds to S604. If the counter 218 exceeds MAXCNT, the CPU 201 proceeds to S620. In S620, the CPU 201 notifies (reports) the control device 105 of the error via the interface circuit 208. For example, the CPU 201 stops the authentication process in the logic circuit 203 and transmits information indicating an authentication error to the control device 105. Optionally, in S621, the CPU 201 may reset the counter 218.

[0046] In S604, the CPU 201 increments the counter 218 that has been read by 1. In S605, the CPU 201 generates a random number RND by instructing the random number generator 209 to generate a random number. The generated random number RND is temporarily stored in the register 213 by the memory bus controller 212. Here, the random number RND is assumed to be 16 bytes of information.

[0047] In S606, the CPU 201 reads the pointer 217 and determines whether the pointer 217 is 0. It is assumed that the initial value of the pointer 217 is 0. If the pointer 217 is 0, the CPU 201 executes S608 to S612 and S613 to S615. If the pointer 217 is 1, the CPU 201 executes S630 to S634 and S613 to S615.

[0048] In S608, the CPU 201 reads the A chip private key 219 and the encryption original key 220 by instructing the memory bus controller 212 to read them from the non-volatile memory 204. Here, it is assumed that the A chip private key 219 is TC_KEY_A and the A encryption original key 220 is EN_TORG_KEY_A. The memory bus controller 212 temporarily stores the A chip private key 219 and the A encryption original key 220 in the register 213.

[0049] In S609, the CPU 201 restores the original key TORG_KEY. For example, the CPU 201 instructs the encryptor / decryptor 210 to restore the original key. As a result, the encryptor / decryptor 210 decrypts the A encrypted original key 220 using the A chip private key 219. As shown in FIG. 7(A), the encryptor / decryptor 210 restores the original key TORG_KEY from the A chip private key 219 "TC_KEY_A" and the A encrypted original key 220 "EN_TORG_KEY_A". Here, the encryptor / decryptor 210 may restore the original key TORG_KEY according to the following formula.

[0050] TORG_KEY=DEC(TC_KEY_A,EN_TORG_KEY_A)··(1) Here, the DEC() function may be a secret key decryption function, for example based on the AES algorithm as described in NIST_FIPS_PUB 197. TC_KEY_A is the decryption key used in the decryption function. EN_TORG_KEY_A is the input ciphertext used in the decryption function. It is assumed that TC_KEY_A, EN_TORG_KEY_A, and TORG_KEY are all 16 bytes of information. The decrypted master key TORG_KEY is the master key used to generate the A encryption master key 220, and is temporarily stored in register 213.

[0051] In S610, the CPU 201 instructs the encryptor / decryptor 210 to generate a new encryption key, thereby generating a new encryption key EN_TORG_KEY_A' based on the original key TORG_KEY and the random number RND held in the register 213. As shown in Fig. 7(B), the encryptor / decryptor 210 generates the new encryption key EN_TORG_KEY_A' based on the original key TORG_KEY and the random number RND. The encryptor / decryptor 210 may generate the new encryption key EN_TORG_KEY_A' based on the following equation, for example.

[0052] EN_TORG_KEY_A'=ENC(RND,TORG_KEY)··(2) Here, the ENC() function may be a symmetric encryption function based on the AES algorithm as described in NIST_FIPS_PUB 197. ENC() is the inverse function of DEC(). The key information input to ENC() is a random number RND. The input plaintext input to ENC() is the original key TORG_KEY. EN_TORG_KEY_A' is assumed to be 16 bytes of information. The new encryption key EN_TORG_KEY_A' is temporarily stored in register 213.

[0053] In S611, the CPU 201 instructs the memory bus controller 212 to update the A chip private key 219 and the A encryption original key 220 stored in the non-volatile memory 204. The memory bus controller 212 overwrites the A encryption original key 220 with the new encryption key EN_TORG_KEY_A' held in the register 213. The memory bus controller 212 overwrites the A chip private key 219 with the random number RND stored in the register 213.

[0054] In S612, the CPU 201 assigns 1 to the pointer 217. As a result, in the next authentication process, the B chip private key 221 and the B encryption original key 222 will be used. After that, the CPU 201 proceeds to S613.

[0055] When the pointer 217 is 1, S630 to S634 are executed instead of S608 to S612. In particular, S630 to S633 are merely the replacement of the A chip private key 219 of S608 to S611 with the B chip private key 221, and the replacement of the A encryption original key 220 with the B encryption original key 222. That is, as shown in Fig. 7(C), the encryptor / decryptor 210 restores the original key TORG_KEY from the B chip private key 221 "TC_KEY_B" and the B encryption original key 222 "EN_TORG_KEY_B". Accordingly, the formula (3) is used instead of the formula (1).

[0056] TORG_KEY=DEC(TC_KEY_B,EN_TORG_KEY_B)··(3) 7(D), the encryption / decryption device 210 generates a new encryption key EN_TORG_KEY_B' based on the original key TORG_KEY and the random number RND. Accordingly, equation (4) is used instead of equation (2).

[0057] EN_TORG_KEY_B'=ENC(RND,TORG_KEY)··(4) Here, TC_KEY_B, EN_TORG_KEY_B, and EN_TORG_KEY_B' are all 16-byte information.

[0058] In S634, the CPU 201 assigns 0 to the pointer 217. As a result, the A chip private key 219 and the A encryption source key 220 will be used in the next authentication process. When the pointer 217 is 0, the A set of keys will be used. When the pointer 217 is 1, the B set of keys will be used. In FIG. 6, the pointer 217 goes back and forth between 0 and 1, so the A set of keys and the B set of keys are used alternately. The CPU 201 then proceeds to S613.

[0059] In S613, the CPU 201 instructs the derivation unit 211 do 7(E), the deriver 211 derives the authentication key AUTH_KEY using the original key TORG_KEY held in the register 213, the TC_ID of the authenticated chip 103, and the AC_ID of the authenticating chip 106. For example, the deriver 211 may use the following equation.

[0060] AUTH_KEY=SHA256(TORG_KEY||TC_ID||AC_ID)··(5) Here, SHA() is a cryptographic hash function. Details of SHA256 are described in, for example, NIST_FIPS_PUB 180-4. A hash function is an example of a one-way function. A one-way function is a general term for a function that generates output data from input data so that the input data cannot be restored from the output data. The formula || indicates that data is concatenated. TORG_KEY||TC_ID||AC_ID means that TORG_KEY, TC_ID, and AC_ID are concatenated. As a result, 32 bytes of data are obtained. In formula (5), 32 bytes of data are input to SHA256. SHA256 outputs 32 bytes of data. Therefore, the authentication key AUTH_KEY is obtained by cutting out the upper (or lower) 16 bytes of the output data. The CPU 201 instructs the memory bus controller 212 to overwrite the authentication key 223 in the non-volatile memory 204 with the authentication key AUTH_KEY.

[0061] In this way, the derived authentication key 223 is stored in the non-volatile memory 204. The reason for this is to avoid re-specifying the authentication key 223 for a device with which a chip ID has been exchanged once. As can be seen from formula (5), the chip ID and the authentication key 223 are linked. Therefore, even if the authentication key 223 is revealed, a device equipped with another chip ID cannot use this authentication key 223. use It is not possible. Therefore, there is little risk in storing authentication key 223 in non-volatile memory 204. Furthermore, if chip IDs are exchanged and authentication keys are generated repeatedly every time image forming apparatus 100 is powered on, access to the original key information, which is confidential information, will occur. This increases the chances of the original key information being exposed. For this reason, authentication key 223 generated once for the same chip ID pair is stored in non-volatile memory 204, and this authentication key 223 is used in authentication processing. This reduces the chances of the original key information being exposed.

[0062] In S614, the CPU 201 decrements the counter 218 by 1. This causes the counter 218 to return from 1 to 0. In other words, the counter 218 held in the non-volatile memory 204 becomes 0.

[0063] In S615, CPU 201 activates initialization circuit 214. When initialization circuit 214 returns from the inactive state to the active state, all data held in register 213 is erased. In addition, encryption / decryption unit 210 and derivation unit 211 transition from an active state to a stopped state. This completes the derivation of the authentication key.

[0064] Counters and Pointers If the previous authentication process ended normally, counter 218 is 0. When authentication process starts, counter 218 is changed to 1, and when authentication process ends normally, counter 218 is returned to 0. If the power supply of authenticated chip 103 is turned off during the authentication process from S605 to S611 (the decryption update period of the authentication key), counter 218 is maintained at 1. In other words, if the update of the authentication key ends abnormally, counter 218 remains at 1. As a result, repeated execution of cryptographic calculations for updating the authentication key due to forced power-off is avoided.

[0065] Because S607, S612 and S634 exist, pointer 217 alternates between 0 and 1. When pointer 217 is 0, the key in set A is used. 。 When pointer 217 is 1, the key of set B is used. By preparing multiple key sets in this way, for example, even if the key information of set A is destroyed due to a forced power off during a calculation using set A, the key information of set B is maintained correctly.

[0066] About the encryption formula As described above, formulas (1) to (5) are exemplified. Formula (1) is a formula for decrypting the A encrypted original key 220 with the A chip private key 219 to derive the original key TORG_KEY. Formula (2) is a formula for encrypting the original key TORG_KEY with the random number RND to generate a new A encrypted original key 220. The random number RND becomes the new A chip private key 219. Formula (3) is a formula for decrypting the B encrypted original key 222 with the B chip private key 221 to derive the original key TORG_KEY. Formula (4) is a formula for encrypting the original key TORG_KEY with the random number RND to generate a new B encrypted original key 222. The random number RND becomes the new B chip private key 221. Formula (5) is a formula for deriving the authentication key AUTH_KEY from the original key TORG_KEY, the identification information (TC_ID) of the authenticated chip 103, and the identification information (AC_ID) of the authentication chip 106.

[0067] In this way, the original key TORG_KEY, which is the basis of the authentication key AUTH_KEY, is not stored in the non-volatile memory 204. Furthermore, the original key TORG_KEY is merely derived temporarily when the authentication key AUTH_KEY is derived and is held in the register 213. When the derivation of the authentication key AUTH_KEY is completed, the original key TORG_KEY is deleted from the register 213.

[0068] The authentication key AUTH_KEY is linked to the identification information of the authenticated chip 103 and the authentication chip 106. The authentication key AUTH_KEY is stored in the non-volatile memory 204 as the authentication key 223. However, the authentication key AUTH_KEY can be used only in combination with the identification information of the authenticated chip 103 and the identification information of the authentication chip 106. In other words, an authenticating device or an authenticated device having other identification information cannot use this authentication key AUTH_KEY. Therefore, even if the authentication key AUTH_KEY is stored in the non-volatile memory 204, the security risk is low. Even if the authentication key AUTH_KEY is discovered for some reason, the original key TORG_KEY will not be exposed because a one-way function is used in equation (5).

[0069] In formula (5), the cryptographic hash function SHA256 is used, but this is only one example. Other one-way functions may be used. For example, a message authentication code using symmetric key cryptography may be used. An example of a message authentication code is described in NIST SP 800-38B. This is called the message authentication code CMAC. CMAC is an authentication algorithm devised to use the encryption function AES in message authentication. The formula for deriving the authentication key AUTH_KEY using CMAC is formula (6). In other words, formula (6) may be used instead of formula (5).

[0070] AUTH_KEY=CMAC(TORG_KEY,TC_ID||AC_ID)··(6) Here, the key information input to CMAC is TORG_KEY. The input plaintext input to CMAC is TC_ID||AC_ID.

[0071] A more compact module may be configured by combining the encryption / decryption unit 210 and the derivation unit 211a. In this case, it would be advantageous to use formula (6) in which the encryption / decryption unit 210 and the derivation unit 211a can use the same encryption primitive function, AES. When formula (6) is used, even if the authentication key AUTH_KEY is identified, the original key TORG_KEY remains unknown.

[0072] In formula (6), even if the data length of TC_ID||AC_ID exceeds 16 bytes, the CMAC calculation can be performed. If the data length of C_ID||AC_ID is 16 bytes or less, AES, which is a primitive function of CMAC, may be used instead of CMAC.

[0073] The initialization circuit 214 controls the initialization of the register 213, and permission / prohibition of the operation of the encryption / decryption device 210 and the derivation device 211. Furthermore, the initialization circuit 214 may have a timer initialization function. When the initialization circuit 214 releases the protection of the register 213 in S601, the initialization circuit 214 starts a timer contained therein. When the timer reaches a predetermined time, the initialization circuit 214 may automatically enable the protection. As a result, the initialization circuit 214 clears the register 213 and prohibits the operation of the encryption / decryption device 210 and the derivation device 211. This makes it possible to protect the key information even when the CPU 201 goes into a runaway state.

[0074] In this way, the authenticated chip 103 and the authentication chip 106 each derive the authentication key AUTH_KEY according to the same algorithm. Therefore, the authentication key AUTH_KEY derived by the authenticated chip 103 matches the authentication key AUTH_KEY derived by the authentication chip 106. The authenticated chip 103 and the authentication chip 106 apply the same challenge data C_DATA and the same authentication key AUTH_KEY to the same algorithm to generate response data R_DATA. Therefore, the response data R_DATA of both matches, so the authenticated chip 103 is successfully authenticated.

[0075] How to generate challenge data 8A shows an authentication calculation executed by each CPU 201 of the authenticated chip 103 and the authentication chip 106. The CPU 201 generates response data R_DATA from challenge data C_DATA and the authentication key AUTH_KEY. The CPU 201b instructs the random number generator 209b to generate challenge data C_DATA, which is a 16-byte random number. The challenge data C_DATA is transmitted to the authenticated chip 103 via the control device 105. As a result, the CPU 201a also shares the same challenge data C_DATA. The challenge data C_DATA is stored in the volatile memory 206.

[0076] The CPU 201 may generate the response data R_DATA according to equation (7). Equation (7) is held in the program code 224.

[0077] R_DATA=SHA256(AUTH_KEY||C_DATA)··(7) Here, SHA256() is the same as the cryptographic hash function described in equation (5). SHA256() is embedded in the program code 224. The operation using SHA256() may be achieved with the assistance of the derivation unit 211a. Equation (8) may be used instead of equation (7).

[0078] R_DATA=CMAC(AUTH_KEY,C_DATA)·(8) Here, CMAC is the same function that performs message authentication as explained in equation (6). The authentication key AUTH_KEY is the input encryption key input to CMAC. C_DATA is the input plaintext input to CMAC. Both equations (7) and (8) are one-way functions. Therefore, even if the response data R_DATA is discovered, the authentication key AUTH_KEY cannot be derived. Even in equation (8), the data length of C_DATA may exceed 16 bytes. If C_DATA is 16 bytes or less, CMAC uses its primitive function, AES.

[0079] The response data R_DATA generated by the authenticated chip 103 is transmitted to the authentication chip 106. The CPU 201b of the authentication chip 106 receives the response data R_DATA via the external interface 207b and the interface circuit 208b. The CPU 201b stores the response data R_DATA in the volatile memory 206b.

[0080] As shown in FIG. 8B, the CPU 201b calculates the authentication result by comparing the response data R_DATA for verification generated by the authentication chip 106 with the response data R_DATA generated by and received from the authenticated chip 103. That is, the CPU 201b judges whether the response data R_DATA for verification generated by the authentication chip 106 matches the response data R_DATA generated by and received from the authenticated chip 103. The CPU 201b transmits the authentication result (information indicating whether the authentication is successful or not) to the control device 105 via the external interface 207b and the interface circuit 208b. When the authentication key AUTH_KEY held by the authentication chip 106 is equal to the authentication key AUTH_KEY held by the authenticated chip 103, the original key held by the authentication chip 106 is also equal to the original key held by the authenticated chip 103. Therefore, the authentication is successful.

[0081] The chip to be authenticated 103 and the authentication chip 106 may use any one-way function such as SHA256() or CMAC(). However, the function used by the chip to be authenticated 103 and the one-way function used by the authentication chip 106 must match. Similarly, the one-way functions used by the chip to be authenticated 103 and the authentication chip 106 to generate response data R_DATA must also match.

[0082] In the above authentication method, it is confirmed that the authenticating chip 106 and the authenticated chip 103 have the same original key TORG_KEY. The original key TORG_KEY itself does not exist in the non-volatile memory 204. The non-volatile memory 204 stores the A chip private key 219, the A encrypted original key 220, the B chip private key 221, and the B encrypted original key 222. However, these are pieces of information generated by cryptographic calculation from the original key TORG_KEY and the random number RND. Therefore, even if this secret information is exposed by a microprobing attack, the original key TORG_KEY is not exposed.

[0083] Advantages of this embodiment against micro-probing attacks In a microprobing attack, a probing point is generally generated on the surface of an LSI chip by a FIB (Focused Ion Beam) device. Specifically, the protective film on the surface of the LSI chip is partially removed to expose the aluminum or copper wiring. Then, metal atoms such as tungsten are deposited on the probing point of the wiring to be read by the FIB device. This is to make it possible to contact the probing point provided on the LSI chip from the surface of the LSI chip. The memory bus 205a is likely to be selected as the target of the attack. Since the volatile memory 206 and the non-volatile memory 204 are regularly provided with multiple memory cells, the bus is also easy to read. Since multiple logic modules are connected to this bus, the transistor cells become large. The metal wiring of the bus is also wide and long. As a result, processing by the FIB device becomes easy. However, to analyze a high-performance chip such as a 32-bit CPU, it is necessary to probe and read many nodes such as the data bus, address bus, control bus, and clock. On the other hand, a thin and sharp-tipped contact needle is used for probing. The member that holds the contact needle is relatively large. Due to this restriction, the number of probing points that can be read at one time is only a few. Therefore, to analyze a large amount of CPU data, a certain number of probing points must be grouped together and measurements must be performed for each group.

[0084] An attacker may narrow down the target of attack to the A chip private key 219a and the A encryption original key 220a. In this case, probing must be performed by timing when the CPU 201a accesses them. Even if a part of the information to be exposed can be exposed at this time, the A chip private key 219a and the A encryption original key 220a have already been rewritten when the A chip private key 219a and the A encryption original key 220a are accessed at the next probing measurement opportunity. Therefore, unless the entire chip private key 219a and the A encryption original key 220a are identified in one measurement, the original key TORG_KEY that is truly desired to be known will not be exposed. This will not cause information leakage that would allow a copy chip to be created.

[0085] The original key TORG_KEY is temporarily stored in the register 213a. However, the period during which the original key TORG_KEY is held in the register 213a is only an extremely short period for generating the authentication key AUTH_KEY. In addition, in the register 213a of the logic circuit 203a, the wiring connecting the small transistor cells can be embedded in the lower metal layer with short and high density. Therefore, when a hard tamper-resistant technology such as providing a shield layer in the uppermost metal is installed, it becomes very difficult to draw all the probing points to the chip surface. Therefore, it also becomes difficult to expose the original key TORG_KEY from the logic circuit 203a. In addition, the register 213a and the memory bus controller 212a may be controlled so as to prohibit the original key, the chip private key, and the encrypted original key from appearing on the CPU bus 202a. This makes it difficult to draw the original key from the CPU bus 202a.

[0086] The authentication key AUTH_KEY can be directly accessed from the CPU 201a. Suppose, the authentication key AUTH_KEY may be exposed by an attacker. However, the authentication key AUTH_KEY is valid only for the combination of the image forming apparatus 100 equipped with the authentication chip 106 storing specific identification information and the process cartridge 102 equipped with the authenticated chip 103 storing specific identification information. In other words, the exposed authentication key AUTH_KEY cannot be used in other combinations of the image forming apparatus 100 and the process cartridge 102. Therefore, even if the authentication key AUTH_KEY is derived by a destructive attack such as a microprobing attack, it is difficult to create a counterfeit of the process cartridge 102. For the above reasons, the authenticated chip 103 and the authentication chip 106 of the first embodiment have extremely high resistance to microprobing attacks.

[0087] In the above explanation, the encryptor / decryptor 210 is responsible for encrypting and decrypting the key. The encryptor / decryptor 210 may be implemented separately as an encryptor and a decryptor. In this case, since the encryptor and the decryptor have inverse functions, the decryption of the key may be performed by the encryptor, and the encryption of the key may be performed by the decryptor. The A encryption original key 220 and the A chip private key 219 are stored in a pair in the non-volatile memory 204. The B encryption original key 222 and the B chip private key 221 are stored in a pair in the non-volatile memory 204. In the first embodiment, Leave These two key sets are used alternately. The reason for the existence of two key sets is to ensure data integrity even if the power is unintentionally turned off. Therefore, three or more key sets may be provided and used in rotation. As already explained, the non-volatile memory 204 may suppress errors using ECC, but bit errors that cannot be corrected may occur. Increasing the number of key sets held in the non-volatile memory 204 will make it easier to remain a key set that can be corrected by ECC.

[0088] <Second embodiment> In the first embodiment, the authenticated chip 103 and the authentication chip 106 derive the same authentication key AUTH_KEY using common hardware and a common algorithm. Furthermore, the authenticated chip 103 and the authentication chip 106 temporarily hold the original key TORG_KEY, which is most desired to be kept secret, in the register 213. The wiring of the register 213 can be localized in the lower wiring layer of each chip. Furthermore, this wiring may be protected by a shield layer installed on the upper part of each chip. These provide hard tamper resistance. The hard tamper resistance can be applied not only to the authenticated chip 103 but also to the authentication chip 106. In the second embodiment, it is assumed that high hard tamper resistance is concentrated only on the authenticated chip 103. Therefore, the attack target is practically narrowed down to only the authenticated chip 103.

[0089] In the second embodiment, the hardware configuration and memory configuration of the authenticated chip 103 are the same as those in the first embodiment, except that the program code 224a of the authenticated chip 103 is changed.

[0090] Furthermore, in the second embodiment, the hardware configuration and memory configuration of the authentication chip 106 are changed. Fig. 9 shows the configuration of the authentication chip 106. Compared to Fig. 4, in Fig. 9, the encryptor / decryptor 210b does not exist in the logic circuit 203b. Furthermore, the pointer 217b, the counter 218b, the A chip private key 219b, the A encryption original key 220b, the B chip private key 221b, and the B encryption original key 222b do not exist in the non-volatile memory 204b. Instead, the non-volatile memory 204b stores the authentication original key 323.

[0091] [Authentication Sequence] The authentication sequence in the second embodiment is the same as the authentication sequence in the first embodiment.

[0092] [Authentication key derivation method] (1) Deriving the authentication key in the authenticated chip 103 The authenticated chip 103 derives the authentication key AUTH_KEY by using the following equation (10) instead of equation (5).

[0093] AUTH_KEY=SHA256(SHA256(TORG_KEY||AC_ID)||TC_ID)··(10) That is, the derivation unit 211a uses the hash function SHA256() twice. The derivation unit 211a first concatenates the original key TORG_KEY and the chip ID of the authentication chip 106 to calculate linked information TORG_KEY||AC_ID. Next, the derivation unit 211a inputs the linked information TORG_KEY||AC_ID to SHA256() to obtain the calculation result, SHA256(TORG_KEY||AC_ID). Next, the derivation unit 211a concatenates the calculation result, SHA256(TORG_KEY||AC_ID) and the chip ID (=TC_ID) of the authenticated chip 103 to obtain linked information. The derivation unit 211a inputs the linked information (SHA256(TORG_KEY||AC_ID)||TC_ID) to SHA256() again to derive the authentication key AUTH_KEY. Here, SHA256 is the same hash function as that defined by equation (5). The authentication key AUTH_KEY calculated by equation (10) is stored in the non-volatile memory 204a as the authentication key 223a.

[0094] Instead of formula (10), a message authentication code CMAC using a common key cryptography technique may be used. In this case, formula (10) is replaced by formula (11).

[0095] AUTH_KEY=CMAC(CMAC(TORG_KEY,AC_ID),TC_ID)··(11) Here, CMAC() is the same as the message authentication code function described in equation (6). In equation (11), the calculation of CMAC() is executed twice. In the first calculation, the derivation unit 211a generates a message authentication code of the original key TORG_KEY and AC_ID, which is the chip ID. In the second calculation, the derivation unit 211a uses the result of the first calculation CMAC(TORG_KEY, AC_ID) as a key input. That is, the derivation unit 211a generates a message authentication code of CMAC(TORG_KEY, AC_ID) and TC_ID.

[0096] (2) Deriving the authentication key in the authentication chip 106 A chip ID 215b, which is identification information of the authentication chip 106, and a corresponding authentication source key 323 are written in advance in the non-volatile memory 204b of the authentication chip 106. The authentication source key 323 may be expressed as an authentication source key AORG_KEY. The chip ID 215b of the authentication chip 106 is an AC_ID. The following relationship holds between AORG_KEY and AC_ID.

[0097] AORG_KEY=SHA256(TORG_KEY||AC_ID)··(12) Here, the original key TORG_KEY is the same as the original key TORG_KEY that the authenticated chip 103 obtains in the process of deriving the authentication key AUTH_KEY, and is information that is handled only at the manufacturing factory of the printer that includes the authentication chip 106. In other words, the authentication chip 106 itself does not derive the original key TORG_KEY according to the program code 224b. The SHA256() function is the same as that used in equation (10).

[0098] 10, the deriver 211b derives the authentication key AUTH_KEY by using the chip ID (=TC_ID) of the authenticated chip 103 and the authentication source key AORG_KEY received via the control device 105. For example, the deriver 211b may use equation (13).

[0099] AUTH_KEY=SHA256(AORG_KEY||TC_ID)·(13) Here, SHA256() is the same as that used in equation (10).

[0100] By the above-mentioned calculation procedure, the authentication key AUTH_KEY derived by the authenticated chip 103 using equation (10) coincides with the authentication key AUTH_KEY derived by the authentication chip 106 using equation (13). The calculation performed by the authentication chip 106 to derive the authentication key AUTH_KEY may be performed with the assistance of the deriver 211b, or may be performed by the CPU 201b according to the program code 224b.

[0101] When the authenticated chip 103 uses equation (11) instead of equation (10), the following equation (14) holds instead of equation (12).

[0102] AORG_KEY=CMAC(TORG_KEY,AC_ID)··(14) Here, the message authentication code function CMAC() is the same as that used in equation (11). This authentication source key AORG_KEY is written in the non-volatile memory 204b as the authentication source key 323 at the factory. In this case, the authentication chip 106 uses equation (15) instead of equation (13) to derive the authentication key AUTH_KEY.

[0103] AUTH_KEY=CMAC(AORG_KEY,TC_ID)··(15) Here, CMAC() is the same as that used in equation (11). Through the above-mentioned calculation procedure, the authentication key AUTH_KEY derived by the authenticated chip 103 using equation (11) matches the authentication key AUTH_KEY derived by the authenticating chip 106 using equation (15).

[0104] Although the same hash function is used in equations (12) and (13), this is merely an example. Different hash functions may be used in equations (12) and (13). It is sufficient to use a function whose input value is computationally difficult to derive from the output value. Similarly, different message authentication code functions may be used in equations (14) and (15). AES is given as a primitive function for CMAC(), but this is also merely an example. Different common key ciphers may be used in equations (14) and (15). Furthermore, if the input plaintext length of CMAC is 16 bytes or less, CMAC itself may be replaced with the primitive function AES.

[0105] Flowchart FIG. 11 shows a method for deriving the authentication key AUTH_KEY, which is executed by the CPU 201b of the authentication chip 106.

[0106] In S1101, the CPU 201b reads the other party's ID (received ID 216b) from the non-volatile memory 204b. In S1102, the CPU 201b reads the authentication source key 323 from the non-volatile memory 204b. In S1103, the CPU 201b calculates the authentication key AUTH_KEY based on the other party's ID (received ID 216b) and the authentication source key 323 (authentication source key AORG_KEY). As described above, the deriver 211b may calculate the authentication key AUTH_KEY.

[0107] In the second embodiment, the authentication source key 323 (=AORG_KEY) held by the authentication chip 106 is different for each chip ID 215b (AC_ID) held by the authentication chip 106. As described above, the authentication chip 106 mounted on the printer may be subjected to a destructive attack such as a microprobing attack. As a result, the authentication source key 323 of the authentication chip 106 may be exposed. However, the exposed information cannot be used by other printers having other chip IDs 215b. Therefore, destructive attacks against a printer including an authentication chip 106 are essentially worthless.

[0108] In the first embodiment, both the authenticated chip 103 and the authentication chip 106 require tamper resistance of the logic circuit 203. On the other hand, in the second embodiment, the authentication chip 106 does not require tamper resistance. Therefore, it will be sufficient to focus on the protection of the authenticated chip 103. This will contribute to reducing the production cost of the entire authentication system.

[0109] <Technical ideas derived from examples> [Point 1, 24] The image forming apparatus 100 is an example of an authentication system that transmits challenge data from an authenticating apparatus (e.g., authentication chip 106) to an authenticated apparatus (e.g., authenticated chip 103) and transmits response data from the authenticated apparatus to the authenticating apparatus, thereby authenticating the authenticated apparatus. The authenticated apparatus may be equipped with the following means. The nonvolatile memory 204a is an example of a nonvolatile first storage means that stores a private key (e.g., A chip private key 219a) of the authenticated apparatus and an encrypted original key (e.g., A encrypted original key 220a) generated by encrypting an original key with the private key. The encryptor / decryptor 210a is an example of a first decryption means that decrypts the encrypted original key with the private key stored in the first storage means to restore the original key. The register 213a is an example of a volatile first storage means that temporarily holds an original key (e.g., TORG_KEY). The random number generator 209a is an example of a first random number generation means that generates random numbers. The encryptor / decryptor 210a is an example of a first encryption means for encrypting an original key using a random number as a new secret key to generate a new encrypted original key. The CPU 201 and the memory bus controller 212a are an example of a first update means for updating the secret key and the encrypted original key stored in the first storage means with the new secret key and the new encrypted original key. The deriver 211a is an example of a first derivation means for deriving an authentication key based on the original key stored in the first storage means. The CPU 201a is an example of a first generation means for generating response data based on the challenge data and the authentication key received from the authentication device.

[0110] The authentication device may be equipped with the following means. The non-volatile memory 204b is an example of a non-volatile second storage means for storing a private key of the authentication device and an encrypted original key generated by encrypting the original key with the private key. The encryptor / decryptor 210b is an example of a second decryption means for decrypting the encrypted original key with the private key stored in the second storage means to restore the original key. The register 213b is an example of a volatile second storage means for temporarily storing the original key. The random number generator 209b is an example of a second random number generation means for generating random numbers. The encryptor / decryptor 210b is an example of a second encryption means for encrypting the original key using the random number as a new private key to generate a new encrypted original key. The CPU 201b and the memory bus controller 212b are an example of a second update means for updating the private key and the encrypted original key stored in the second storage means with the new private key and the new encrypted original key. The deriver 211b is an example of a second derivation means for deriving an authentication key based on the original key stored in the second storage means. The CPU 201b is an example of a second generating means for generating response data for verification based on the challenge data and the authentication key. The CPU 201b is an example of an authenticating means for obtaining an authentication result based on the response data transmitted from the device to be authenticated and the response data for verification. In this way, the original key itself is not stored in the non-volatile memory 204, but is merely temporarily held in a volatile memory (register 213) during the authentication process, making it more difficult to imitate the device to be authenticated than before.

[0111] [Point 2] The initialization circuit 214a is an example of a first erasing means that erases the original key held in the first holding means when the first derivation means derives the authentication key, thereby shortening the period during which the original key is held.

[0112] [Point 3] The initialization circuit 214a is an example of a protection means for protecting the original key held in the first holding means until the derivation of the authentication key by the first derivation means is completed. As a result, at least the original key is protected until the derivation of the authentication key is completed, so that the authentication key is derived accurately.

[0113] [Point 4] As described in relation to S603, the CPU 201a may function as a first monitoring means for monitoring whether the derivation of the authentication key by the first derivation means has ended abnormally. When the first monitoring means detects that the derivation of the authentication key by the first derivation means has ended abnormally, the CPU 201a may prohibit the second decryption means from decrypting the original key. This will prevent the original key from being revealed.

[0114] [Point 5] The counter 218a is an example of a counter that is set to a predetermined value when the derivation of the authentication key by the first derivation means starts, and is set to a value different from the predetermined value when the derivation of the authentication key by the first derivation means ends normally. The CPU 201a may detect, based on the counter, that the derivation of the authentication key by the first derivation means ends abnormally.

[0115] [Point 6] As described in relation to S620, the interface circuit 208a may function as a first notification means for notifying that the derivation of the authentication key by the first derivation means has ended abnormally.

[0116] [Points 7-9] As shown in FIG. 3, the first storage means may store two or more key sets, each of which is a set of a different private key and an encrypted original key. As shown in FIG. 6, the first decryption means (e.g., the encryptor / decryptor 210a) does not continuously use the same key set as a key set to be used to restore the original key among the two or more key sets. By preparing a plurality of key sets in this way, even if one key set is destroyed, the authentication process can be successful using the remaining key set. The first decryption means (e.g., the encryptor / decryptor 210a) may alternately use the first key set and the second key set included in the two or more key sets as a key set to restore the original key. The first decryption means may further include a first designation means (e.g., the pointer 217a) for designating a key set to be used by the first decryption means to restore the original key among the two or more key sets.

[0117] [Points 10-12] As described in relation to equations (7) and (8), the first generating means (e.g., CPU 201a) may generate response data by inputting the authentication key and the challenge data to the one-way function. This prevents the authentication key from being exposed even if the response data is exposed. As described in relation to equation (7), the first generating means (e.g., CPU 201a) may concatenate the authentication key and the challenge data before inputting them to the one-way function. As described in relation to equation (8), the first generating means (e.g., CPU 201a) may input the authentication key as a key parameter to the one-way function and input the challenge data as plaintext to the one-way function.

[0118] [Points of View 13-16] As described in relation to formula (5) and formula (6), the first derivation means (e.g., the deriver 211a) may derive an authentication key based on the original key stored in the first storage means, the identification information of the authentication device received from the authentication device, and the identification information of the authenticated device. For example, the first derivation means (the deriver 211a) may input the original key stored in the first storage means, the identification information of the authentication device received from the authentication device, and the identification information of the authenticated device to a one-way function. As described in relation to formula (5), the first derivation means (e.g., the deriver 211a) may concatenate the original key stored in the first storage means, the identification information of the authentication device received from the authentication device, and the identification information of the authenticated device, and then input them to the one-way function. As described in relation to formula (6), the first derivation means (e.g., the deriver 211a) may input the original key stored in the first storage means as a key parameter to the one-way function. Furthermore, the first derivation means (for example, the deriver 211a) may input a plaintext generated by concatenating the identification information of the authenticator received from the authenticator and the identification information of the authenticated device to the one-way function.

[0119] [Points 17, 25] As shown in FIG. 5, an authentication system is provided that transmits challenge data from the authenticator to the authenticatee and transmits response data from the authenticatee to the authenticator, thereby authenticating the authenticatee. The authenticatee may have the means described in the first aspect. As described in the second embodiment, the authentication device has the following means. The non-volatile memory 204b is an example of a non-volatile second storage means that stores the authentication source key AORG_KEY that is the basis for deriving the authentication key. As shown in FIG. 10, the deriver 211b functions as a second derivation means that derives the authentication key based on the identification information of the authenticatee and the authentication source key stored in the second storage means. As shown in FIG. 8(A), the CPU 201b functions as a second generation means that generates response data for verification based on the challenge data and the authentication key. As shown in FIG. 8(B), the CPU 201b functions as an authentication means that obtains an authentication result based on the response data transmitted from the authenticatee and the response data for verification.

[0120] [Points of View 18-22] As described in relation to formula (10) and formula (11), the first derivation means (e.g., deriver 211b) may derive an authentication key based on the original key held in the first holding means, the identification information of the authentication device received from the authentication device, and the identification information of the authenticated device. As shown in formula (10), the first derivation means may generate key data equal to the authentication original key by concatenating the original key held in the first holding means and the identification information of the authentication device received from the authentication device and inputting the concatenated result to a first one-way function. Furthermore, the first derivation means may derive an authentication key based on the key data and the identification information of the authenticated device. As shown in formula (10), the first derivation means may derive an authentication key by concatenating the key data and the identification information of the authenticated device and inputting the concatenated result to a second one-way function. As shown in formula (11), the first derivation means may generate key data equal to the authentication source key by inputting the source key stored in the first storage means as a key parameter and the identification information of the authentication device received from the authentication device as plaintext to a first one-way function. Furthermore, the first derivation means may derive an authentication key based on the key data and the identification information of the authenticated device. As shown in formula (11), the first derivation means may derive the authentication key by inputting the key data as a key parameter and the identification information of the authenticated device as plaintext to a second one-way function.

[0121] [Point 23] The authentication device may be an image forming device, and the authenticated device may be a replacement part or consumable that can be attached to or detached from the image forming device. This will prevent counterfeiting of replacement parts or consumables, and reduce malfunctions of the image forming device caused by counterfeits.

[0122] The invention is not limited to the above-described embodiments, and various modifications and variations are possible without departing from the spirit and scope of the invention. Accordingly, the following claims are appended to apprise the public of the scope of the invention. [Explanation of symbols]

[0123] 100: image forming apparatus (authentication system), 103: authenticated chip, 106: authentication chip

Claims

1. An authentication system for authenticating a device to be authenticated by transmitting challenge data from an authentication device to a device to be authenticated and transmitting response data from the device to the authentication device, comprising: The authenticated device is a first non-volatile storage means for storing a private key of the device to be authenticated and an encrypted original key generated by encrypting an original key with the private key; a first decryption means for recovering the encrypted original key by using the private key stored in the first storage means to recover the original key; a volatile first storage means for temporarily storing the master key; A first random number generating means for generating random numbers; a first encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a first updating means for updating the private key and the encryption source key stored in the first storage means with the new private key and the new encryption source key; a first derivation means for deriving an authentication key based on the master key stored in the first storage means; a first generating means for generating the response data based on the challenge data received from the authentication device and the authentication key, The authentication device includes: a second non-volatile storage means for storing a private key of the authentication device and an encrypted original key generated by encrypting an original key with the private key; a second decryption means for recovering the encrypted original key by using the private key stored in the second storage means to recover the original key; a volatile second storage means for temporarily storing the master key; A second random number generating means for generating random numbers; a second encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a second updating means for updating the private key and the encryption source key stored in the second storage means with the new private key and the new encryption source key; a second derivation means for deriving an authentication key based on the master key stored in the second storage means; A second generating means for generating response data for verification based on the challenge data and the authentication key; An authentication system comprising: an authentication means for determining an authentication result based on the response data transmitted from the device to be authenticated and the response data for verification.

2. 2. The authentication system according to claim 1, wherein the authenticated device further comprises a first erasure means for erasing the original key stored in the first storage means when the first derivation means derives the authentication key.

3. The authentication system according to claim 1, characterized in that the authenticated device further has a protection means for protecting the original key stored in the first storage means until derivation of the authentication key by the first derivation means is completed.

4. The authenticated device further includes a first monitoring means for monitoring whether the derivation of the authentication key by the first derivation means has ended abnormally, 4. The authentication system according to claim 1, wherein when the first monitoring means detects that the derivation of the authentication key by the first derivation means has terminated abnormally, the first monitoring means prohibits the second decryption means from restoring the original key.

5. 5. The authentication system according to claim 4, wherein the first monitoring means has a counter that is set to a predetermined value when derivation of the authentication key by the first derivation means starts, and that is set to a value different from the predetermined value when derivation of the authentication key by the first derivation means ends normally, and detects that derivation of the authentication key by the first derivation means has ended abnormally based on the counter.

6. 6. The authentication system according to claim 4, wherein the device to be authenticated further comprises first notification means for notifying that derivation of the authentication key by the first derivation means has ended abnormally.

7. the first storage means stores two or more key sets, each of which is a set of a different private key and an encryption source key; 7. The authentication system according to claim 1, wherein the first decryption means does not consecutively use the same key set among the two or more key sets as a key set used to restore the original key.

8. The authentication system according to claim 7, characterized in that the first decryption means alternately uses a first key set and a second key set included in the two or more key sets as key sets for restoring the original key.

9. 9. An authentication system as described in claim 7 or 8, further comprising a first designation means for designating a key set from the two or more key sets to be used by the first decryption means to restore the original key.

10. 10. The authentication system according to claim 1, wherein the first generation means generates the response data by inputting the authentication key and the challenge data to a one-way function.

11. 11. The authentication system according to claim 10, wherein the first generating means concatenates the authentication key and the challenge data and then inputs the concatenated data to the one-way function.

12. 11. The authentication system according to claim 10, wherein the first generating means inputs the authentication key as a key parameter to the one-way function, and inputs the challenge data as plain text to the one-way function.

13. An authentication system according to any one of claims 1 to 10, characterized in that the first derivation means derives the authentication key based on the original key stored in the first storage means, identification information of the authentication device received from the authentication device, and identification information of the authenticated device.

14. The authentication system described in claim 11, characterized in that the first derivation means derives the authentication key by inputting the original key stored in the first storage means, identification information of the authentication device received from the authentication device, and identification information of the authenticated device into a one-way function.

15. The authentication system described in claim 14, characterized in that the first derivation means concatenates the original key stored in the first storage means, the identification information of the authentication device received from the authentication device, and the identification information of the authenticated device, and then inputs them to the one-way function.

16. The authentication system described in claim 14, characterized in that the first derivation means inputs the original key stored in the first storage means to the one-way function as a key parameter, and inputs a plaintext generated by concatenating the identification information of the authentication device received from the authentication device and the identification information of the authenticated device to the one-way function.

17. 1. An authentication system for authenticating a device to be authenticated by transmitting challenge data from an authentication device to a device to be authenticated and transmitting response data from the device to the authentication device, comprising: The authenticated device is a first non-volatile storage means for storing a private key of the device to be authenticated and an encrypted original key generated by encrypting an original key with the private key; a first decryption means for recovering the original key from the private key and the encrypted original key stored in the first storage means; a volatile first storage means for temporarily storing the master key; A first random number generating means for generating random numbers; a first encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a first updating means for updating the private key and the encryption source key stored in the first storage means with the new private key and the new encryption source key; a first derivation means for deriving an authentication key based on the master key stored in the first storage means; a first generating means for generating the response data based on the challenge data received from the authentication device and the authentication key, The authentication device includes: a second non-volatile storage means for storing an authentication source key that is a base for deriving an authentication key; a second derivation means for deriving the authentication key based on identification information of the authenticated device and the authentication source key stored in the second storage means; A second generating means for generating response data for verification based on the challenge data and the authentication key; An authentication system comprising: an authentication means for determining an authentication result based on the response data transmitted from the device to be authenticated and the response data for verification.

18. The authentication system described in claim 17, characterized in that the first derivation means derives the authentication key based on the original key stored in the first storage means, identification information of the authentication device received from the authentication device, and identification information of the authenticated device.

19. The authentication system described in claim 18, characterized in that the first derivation means generates key data equal to the authentication source key by concatenating the source key stored in the first storage means and identification information of the authentication device received from the authentication device and inputting the concatenated result into a first unidirectional function, and further derives the authentication key based on the key data and the identification information of the authenticated device.

20. 20. The authentication system according to claim 19, wherein the first derivation means derives the authentication key by concatenating the key data and identification information of the device to be authenticated and inputting the concatenated result to a second one-way function.

21. The authentication system described in claim 18, characterized in that the first derivation means generates key data equal to the authentication source key by using the source key stored in the first storage means as a key parameter and inputting identification information of the authentication device received from the authentication device as plain text into a first unidirectional function, and further derives the authentication key based on the key data and the identification information of the authenticated device.

22. The authentication system according to claim 21, characterized in that the first derivation means derives the authentication key by inputting the key data as a key parameter and identification information of the device to be authenticated as plain text into a second one-way function.

23. 23. The authentication system according to claim 1, wherein the authentication device is an image forming device, and the authenticated device is a replaceable part or a consumable item that is detachable from the image forming device.

24. A device to be authenticated transmits response data corresponding to challenge data transmitted from an authentication device to the authentication device, The authenticated device is a first non-volatile storage means for storing a private key of the device to be authenticated and an encrypted original key generated by encrypting an original key with the private key; a first decryption means for recovering the encrypted original key by using the private key stored in the first storage means to recover the original key; a volatile first storage means for temporarily storing the master key; A first random number generating means for generating random numbers; a first encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a first updating means for updating the private key and the encryption source key stored in the first storage means with the new private key and the new encryption source key; a first derivation means for deriving an authentication key based on the master key stored in the first storage means; a first generating means for generating the response data based on the challenge data received from the authentication device and the authentication key, The authentication device includes: a second non-volatile storage means for storing a private key of the authentication device and an encrypted original key generated by encrypting an original key with the private key; a second decryption means for recovering the encrypted original key by using the private key stored in the second storage means to recover the original key; a volatile second storage means for temporarily storing the master key; A second random number generating means for generating random numbers; a second encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a second updating means for updating the private key and the encryption source key stored in the second storage means with the new private key and the new encryption source key; a second derivation means for deriving an authentication key based on the master key stored in the second storage means; A second generating means for generating response data for verification based on the challenge data and the authentication key; a verification unit that obtains a result of authentication based on the response data transmitted from the device to be authenticated and the response data for verification;

25. A device to be authenticated transmits response data corresponding to challenge data transmitted from an authentication device to the authentication device, The authenticated device is a first non-volatile storage means for storing a private key of the device to be authenticated and an encrypted original key generated by encrypting an original key with the private key; a first decryption means for recovering the original key from the private key and the encrypted original key stored in the first storage means; a volatile first storage means for temporarily storing the master key; A first random number generating means for generating random numbers; a first encryption means for encrypting the original key by using the random number as a new secret key to generate a new encrypted original key; a first updating means for updating the private key and the encryption source key stored in the first storage means with the new private key and the new encryption source key; a first derivation means for deriving an authentication key based on the master key stored in the first storage means; a first generating means for generating the response data based on the challenge data received from the authentication device and the authentication key, The authentication device includes: a second non-volatile storage means for storing an authentication source key that is a base for deriving an authentication key; a second derivation means for deriving the authentication key based on identification information of the authenticated device and the authentication source key stored in the second storage means; A second generating means for generating response data for verification based on the challenge data and the authentication key; a verification unit that obtains a result of authentication based on the response data transmitted from the device to be authenticated and the response data for verification;

Images