Communication device, communication method, and program

Abstract

To provide a communication device, a communication method, and a program that can protect confidential information from threats such as side-channel attacks.SOLUTION: If confidential information is not stored or the number of use times of confidential information is not equal to or less than a predetermined use limit number when non-contact communication with a device D is performed, a host H selects an advanced authentication procedure requiring a large amount of calculation and performs authentication, whereas if confidential information is stored and the number of use times of the confidential information is equal to or less than the predetermined use limit number, the host H selects a simple authentication procedure with a smaller amount of calculation and performs authentication using the confidential information.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to the technical field of communication devices and the like that can select either an advanced authentication procedure that requires a large amount of calculation between communication partners or a simple authentication procedure that requires less calculation between communication partners. [Background technology]

[0002] Among the ever-increasing roles of smartphones, their role as a key for locking and unlocking doors is gaining attention. In authentication systems that use devices such as smartphones to unlock the front door of a home or the door of a parcel locker, mutual authentication is performed in an authentication procedure between a lock (communication device) and a device (communication partner) to perform operations such as unlocking. Such mutual authentication generally uses a counter value to count the number of times the mutual authentication has been successful. However, as long as authentication is not successful, the same counter value can be used to repeatedly attempt to generate a session key, etc., which raises the risk of the session key being guessed by a side-channel attack. Patent Document 1 discloses a technology for an IC card that dynamically generates an encryption key based on a counter value that is incremented each time authentication is successful. The technology executes an authentication delay process that repeatedly performs a predetermined dummy process using the value of a repetition counter before starting the authentication process in order to improve tamper resistance against side-channel attacks. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-148387 Summary of the Invention [Problem to be solved by the invention]

[0004] Before a smartphone can be used as a door key, the combination must be established between the smartphone and the lock installed on the door, which is the same as the authentication between an unspecified number of computers on a network. In other words, the door lock and the smartphone authenticate each other without knowing in advance that they can be combined.

[0005] The authentication procedure used in this situation is certificate verification using public key cryptography, and this authentication also uses a technology for secretly sharing information (such as Diffie-Hellman), and the secret information shared by this technology is used as a key for symmetric key cryptography that enables secret communication after authentication, or as input information for generating a key.

[0006] Therefore, an authentication procedure that verifies a certificate using public key cryptography can be considered an advanced authentication procedure that requires a large amount of calculation and computer resources to obtain a verification result. Therefore, in communications between an unspecified number of computers, an advanced authentication procedure is not used at the start of each communication, but a simple authentication procedure can also be used, in which secret information generated when authentication is successful once is stored and the secret information is reused at the start of the next communication. This simple authentication procedure is configured using a symmetric key cryptography that requires less calculation and computer resources than public key cryptography, but it is necessary to store the secret information and information that identifies the authentication procedure used to generate the secret information as a pair. It is difficult to store the secret information of all communication partners individually, and the secret information is only stored for a certain period of time.

[0007] However, since the combination of a door lock and a smartphone limits the parties that can be authenticated, the door lock can store a pair of secret information and information that identifies the authentication procedure used when the secret information was generated.

[0008] However, continued use of confidential information can make it vulnerable to security risks, and it can be guessed through side-channel attacks. On the other hand, restricting use by increasing security too much can impair convenience.

[0009] Therefore, the present invention has been made in consideration of the above points and aims to provide a communication device, a communication method, and a program that can protect secret information from threats such as side channel attacks when a choice can be made between an advanced authentication procedure that requires a large amount of calculation between communication partners and a simple authentication procedure that requires less calculation between communication partners and uses secret information generated in the advanced authentication procedure.

[0010] Furthermore, the present invention aims to provide a communication device, a communication method, and a program that can appropriately control confidential information, protect the confidential information from threats such as side channel attacks, and maintain convenience. [Means for solving the problem]

[0011] In order to solve the above problem, the invention of claim 1 is a communication device capable of selecting either an advanced authentication procedure requiring a large amount of calculation between a communication partner and a simple authentication procedure requiring less calculation between the communication partner and the communication partner using secret information generated in the advanced authentication procedure, the communication device comprising: storage means for storing the secret information and the number of times the secret information is used; and authentication means for selecting the simple authentication procedure and performing authentication when the secret information is stored in the storage means when communication is performed with the communication partner and the number of times the secret information is used is equal to or less than a predetermined limit number of times; a setting means for setting whether or not to impose a usage restriction on the confidential information; Equipped with The authentication means selects the simplified authentication procedure and executes authentication only when a setting is made to limit the use of the secret information when communication is performed with the communication partner, the secret information is stored in the storage means, and the number of times of use is equal to or less than a predetermined limit number of times of use. It is characterized by:

[0013] Claim 2 The invention described in claim 1 In the communication device described in the above, the authentication means is characterized in that if the secret information is not stored in the storage means or the number of uses is not equal to or less than a predetermined limit number of uses, the authentication means selects the advanced authentication procedure and performs authentication.

[0014] Claim 3 The invention described in claim 1 or 2The communication device described in the above item 1 further comprises an erasing unit that erases the confidential information from the storage unit when the number of uses is not equal to or less than a predetermined limit number of uses.

[0015] Claim 4 The invention described in claim 1 or 2 The communication device described in the above is characterized in that it further comprises an erasure means for erasing the secret information from the storage means when a predetermined time has elapsed since the secret information was stored in the storage means or when an authentication error occurs.

[0016] Claim 5 The invention described in claims 1 to 4 In the communication device described in any one of the above, the advanced authentication procedure is characterized in that authentication by signature generation and signature verification, and key sharing by public key cryptography are performed.

[0017] Claim 6 The invention described in claim 5 In the communication device described in the above, in the simplified authentication procedure, authentication is performed using a random number and the secret information.

[0019] Claim 7 The invention described in A communication device capable of selecting either an advanced authentication procedure requiring a large amount of calculation between a communication partner and a simple authentication procedure requiring a smaller amount of calculation between the communication partner and the communication partner using secret information generated in the advanced authentication procedure, the communication device comprising: a storage means for storing the secret information and the number of times the secret information is used; and an authentication means for selecting the simple authentication procedure and executing authentication when the secret information is stored in the storage means when communication is performed with the communication partner and the number of times the secret information is used is equal to or less than a predetermined limit number of times. The method is characterized in that the computer included in the device with which the communication device communicates executes the steps of: storing the secret information generated in the advanced authentication procedure; setting whether or not to impose a usage limit on the secret information; if the setting to impose a usage limit on the secret information is made and the number of uses is equal to or less than a predetermined usage limit, generating encrypted data for authentication using the secret information and a random number; and transmitting a response including the encrypted data to the communication device.

[0020] Claim 8The invention described in the item (1) is a communication device capable of selecting either an advanced authentication procedure requiring a large amount of calculation with a communication partner, or a simple authentication procedure requiring less calculation with the communication partner using secret information generated in the advanced authentication procedure, and the communication method executed by the communication device is provided with storage means for storing the secret information and the number of times the secret information is used, the method comprising the steps of: determining whether the secret information is stored in the storage means when communication is performed with the communication partner; determining whether the number of times the secret information is used is equal to or less than a predetermined limit number of times when it is determined that the secret information is stored in the storage means; and selecting the simple authentication procedure to perform authentication when it is determined that the number of times the secret information is used is equal to or less than the predetermined limit number of times. certification Steps and a step of setting whether or not to impose a usage restriction on the confidential information; Including In the authentication step, the simplified authentication procedure is selected and authentication is performed only if a setting is made to limit the use of the secret information when communication is performed with the communication partner, the secret information is stored in the storage means, and the number of uses is equal to or less than a predetermined limit number of uses. It is characterized by:

[0021] Claim 9 The invention described in the item (1) is a communication device capable of selecting either an advanced authentication procedure requiring a large amount of calculation between a communication partner and a simple authentication procedure requiring less calculation using secret information generated in the advanced authentication procedure between the communication partner and the communication partner, wherein the communication device includes a computer having storage means for storing the secret information and the number of times the secret information is used, and the computer includes authentication means for selecting the simple authentication procedure and performing authentication when the secret information is stored in the storage means when communication is performed with the communication partner and the number of times the secret information is used is equal to or less than a predetermined limit number of times; and a program that functions as setting means for setting whether or not to impose a use restriction on the secret information, wherein the authentication means selects the simplified authentication procedure and performs authentication only when a setting for imposing a use restriction on the secret information when communication is performed with the communication partner is set, the secret information is stored in the storage means, and the number of uses is equal to or less than a predetermined use limit. It is characterized by: [Effects of the Invention]

[0022] According to the present invention, it is possible to protect confidential information from threats such as side channel attacks. Furthermore, according to the present invention, it is possible to appropriately control confidential information, protect confidential information from threats such as side channel attacks, and maintain convenience. [Brief explanation of the drawings]

[0023] [Figure 1]1 is a diagram illustrating an example of a schematic configuration of an authentication system S according to the present embodiment. [Figure 2] 10 is a flowchart showing an example of an authentication procedure selection process of the control unit 13 in the host H. [Figure 3] FIG. 10 is a sequence diagram illustrating an example of an advanced authentication procedure performed between a host H and a device D. [Figure 4] 10 is a sequence diagram showing an example of a simple authentication procedure 1 performed between a host H and a device D. FIG. [Figure 5] 10 is a flowchart showing an example of a simplified authentication procedure execution determination process of the control module 2 in the device D. [Figure 6] 10 is a sequence diagram showing an example of a simple authentication procedure 2 performed between a host H and a device D. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0024] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The embodiment described below is an embodiment in which the present invention is applied to an authentication system used, for example, to unlock the front door of a house, the door to a parcel locker, or the door of a car.

[0025] [1. Overview of Authentication System S] First, a schematic configuration of an authentication system S according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the schematic configuration of the authentication system S according to this embodiment. As shown in Fig. 1, the authentication system S includes a device D and a host (host computer) H. Here, the host H is an example of a communication device of the present invention, and the communication partner of the host H is the device D. The host H and the device D are capable of contactless communication using, for example, near field communication (NFC) technology. Furthermore, Bluetooth (registered trademark), ZigBee, LoRa, or UWB (Ultra Wide Band) may be used for communication between the host H and the device D.

[0026] The host H and the device D are configured to selectively perform an advanced authentication procedure (hereinafter referred to as the "advanced authentication procedure") that requires a large amount of calculations, or a simple authentication procedure (hereinafter referred to as the "simple authentication procedure") that requires less calculations. In the advanced authentication procedure, authentication is performed by signature generation and signature verification, and key sharing is performed by public key cryptography. In this embodiment, as an example, the advanced authentication procedure is performed by signature generation and signature verification using ECDSA (Elliptic Curve Digital Signature Algorithm), and key exchange is performed by ECDH (Elliptic curve Diffie-Hellman key exchange).

[0027] On the other hand, in the simple authentication procedure, calculations according to the ECDH protocol (hereinafter referred to as "ECDH calculations") are not performed, and mutual authentication is performed using secret information and random numbers generated in the advanced authentication procedure and stored in the host H and device D (in other words, based on the secret information) using a symmetric key cryptosystem. Here, one-sided authentication in which the host H authenticates the device D may be performed. Furthermore, the secret information is, for example, information that is shared only between the host H and the device D when the host H and the device D perform the advanced authentication procedure. In ECDH, the secret information is called a shared-secret.

[0028] However, if secret information is used continuously without any restrictions, there is a risk that its value may be guessed by a side channel attack. Therefore, in this embodiment, the number of times the secret information is used is counted, and if the counted number of times (i.e., the count value) is equal to or less than a predetermined usage limit, a simple authentication procedure is executed. That is, after the first authentication is performed in the advanced authentication procedure, high-speed authentication using the secret information is performed in the simple authentication procedure within the usage limit number allowed by the settings. The usage limit number is not particularly limited, but is set to, for example, about 5 to 10 times.

[0029] On the other hand, there are cases where users change frequently and convenience is important, such as in a hotel room, and there are also cases where users rarely change, such as in the front door of a house, where convenience is important but long-term peace of mind can be achieved by occasionally changing the lock. Therefore, in this embodiment, convenience is maintained by making it possible to set whether or not to impose restrictions on the use of secret information. In other words, if the setting is set to not impose restrictions on the use of secret information, after the first authentication is performed using the advanced authentication procedure, high-speed authentication using secret information is performed using the simple authentication procedure without any particular restrictions.

[0030] When the authentication system S is used to unlock the front door of a house or the door of a parcel locker, the host H is applied to a door control device. Alternatively, when the authentication system S is used to unlock the door of a car, the host H is applied to an on-board computer. On the other hand, when the authentication system S is used to unlock the front door of a house, the door of a parcel locker, or the door of a car, the device D is applied to a mobile terminal (e.g., a smartphone), an IC card, or a key holder carried by the user.

[0031] 1, the device D is configured to include a communication module 1, a control module 2, and an IC (Integrated Circuit) module 3. The control module 2 and the IC module 3 may be integrated together. The communication module 1 is, for example, a contactless IC chip (e.g., a CLF (Contactless Front-end)) that performs contactless communication using NFC technology, and communicates with a contactless reader / lidar provided in the host H within a contactless field.

[0032] Although not shown, the control module 2 is configured with a CPU (Central Processing Unit), RAM (Random Access Memory), ROM (Read Only Memory), NVM (Nonvolatile Memory), etc., and executes various processes according to programs (including the program of the present invention) stored in the ROM or NVM. For example, the control module 2 executes arithmetic processes such as key generation in response to commands from the host H in each of the simple authentication procedure and the advanced authentication procedure with the host H, and transmits a response indicating the processing result to the host H. The control module 2 also has a counter function that counts the number of times the confidential information is used, a restriction setting function that sets whether or not to impose a restriction on the use of the confidential information (i.e., whether or not to impose a restriction on the use), and a confidential information erasure function that erases the confidential information under predetermined conditions.

[0033] Here, the restriction setting function performs settings to impose restrictions on the use of confidential information (i.e., setting that there is a usage restriction) and also sets the number of usage restrictions in accordance with a usage condition setting command sent from a setting device used by the manufacturer or administrator before shipping of the device D. The count value counted by the counter function, the flag indicating whether there is a usage restriction set by the restriction setting function, and the number of usage restrictions are stored, for example, in the NVM of the control module 2 or the IC module 3.

[0034] The IC module 3 is, for example, a secure element with high tamper resistance. The IC module 3 may be mounted on the device D as a small, detachable IC card, or may be mounted on an embedded circuit board as an eSIM (Subscriber Identity Module) so that it cannot be easily removed or replaced from the device D. A secure memory in the IC module 3 stores a key pair of a public key and a private key unique to the device D, as well as confidential information generated in an advanced authentication procedure. Here, the public key included in the key pair and a key ID for identifying the public key are shared in advance with the host H. Furthermore, a device ID unique to the device D is stored in the secure memory. The device ID unique to the device D may be a unique value assigned by a server or the like, or may be a hash value obtained by hashing the public key and private key of the device D.

[0035] If the number of times the secret information stored in the secure memory is used exceeds a predetermined usage limit, the secret information may be erased from the secure memory by a secret information erasure function. Furthermore, if a predetermined time has passed since the secret information was stored in the secure memory or an authentication error occurs, the secret information may be erased from the secure memory by the secret information erasure function. Furthermore, if a program such as firmware installed in the control module 2 or the IC module 3 is updated, the secret information may be erased from the secure memory by the secret information erasure function.

[0036] As shown in FIG. 1 , the host H is configured to include a communication unit 11, a storage unit 12 (an example of a storage means), a control unit 13, and the like. The communication unit 11 is, for example, a contactless reader / lidar that performs contactless communication using NFC technology, and communicates with a contactless IC chip provided in the device D within a contactless field. When the device D enters the contactless field of the communication unit 11, an initial response sequence is performed between the host H and the device D. In the initial response sequence, the communication unit 11 transmits a request command from the host H to the device D and receives a response from the device D, thereby identifying the device D and transitioning it to an active state. Thereafter, an advanced authentication procedure or a simplified authentication procedure is performed between the host H and the device D. Note that before transitioning to the active state, parameters may be exchanged between the host H and the device D, and communication conditions such as communication speed may be mutually confirmed, as necessary.

[0037] However, when multiple devices D enter the contactless field of the communication unit 11, the multiple devices D simultaneously send responses to a request command, resulting in a state (collision) in which the communication unit 11 is unable to correctly recognize the device D with which it is communicating. Anti-collision is implemented as a measure to prevent this, and in time-slot anti-collision, for example, each device D sends a response including an anti-collision ID during a response time period corresponding to a random number. This enables the communication unit 11 to recognize each device D. Note that even in bit-collision anti-collision, an anti-collision ID (hereinafter referred to as "anti-collision ID") is sent from the device D to the host H.

[0038] The storage unit 12 is configured with, for example, a nonvolatile memory, a hard disk drive (HDD), or a solid state drive (SSD), and stores various programs such as an operating system and applications (including the program of the present invention). The storage unit 12 also stores a key pair of a public key and a private key unique to the host H. Here, the public key included in the key pair and a key ID for identifying the public key are shared in advance with the device D. Furthermore, the storage unit 12 stores identification information unique to the device D that has communicated with the host H and secret information generated in the advanced authentication procedure, in association with each other. Here, the identification information unique to the device D may be an anti-collision ID or a device ID unique to the device D. It is preferable that the public key and key ID of the device D are managed in association with the identification information unique to the device D.

[0039] The control unit 13 (an example of a computer) is composed of a CPU, RAM, ROM, etc., and functions as an authentication processing unit (an example of an authentication means) that performs authentication processing, for example, according to a program stored in the memory unit 12, a counter that counts and stores the number of times the secret information is used, a restriction setting unit (an example of a setting means) that sets whether or not to impose restrictions on the use of the secret information, and a secret information erasure unit (an example of an erasure means) that erases the secret information under specified conditions.

[0040] Specifically, when contactless communication is performed with device D, if secret information associated with identification information unique to device D is not stored in storage unit 12, or if the number of uses of the secret information is not equal to or less than a predetermined use limit (i.e., exceeds the use limit), control unit 13 selects the advanced authentication procedure and performs authentication processing including signature generation and signature verification using ECDSA, and key exchange using ECDH. Here, the use limit of the secret information is a count value counted by a counter. This count value is stored, for example, in storage unit 12. Note that, because host H and device D differ in susceptibility to attack, the use limit set in host H may be configured to be different from the use limit set in device D.

[0041] On the other hand, when contactless communication is performed with device D, if secret information is stored in association with identification information unique to device D and the number of times the secret information has been used is equal to or less than a predetermined usage limit, the control unit 13 selects the simple authentication procedure and performs authentication processing using symmetric key cryptography, using the secret information associated with the identification information and a random number. That is, when communication is performed for the first time with device D, the control unit 13 selects the advanced authentication procedure and performs, for example, mutual authentication, stores the secret information generated in the advanced authentication procedure in association with identification information unique to device D, and when communication is performed for the second or subsequent time with device D, selects the simple authentication procedure and performs mutual authentication using the secret information associated with the identification information unique to device D and a random number. The simple authentication procedure may be one-sided authentication in which the control unit 13 authenticates only device D.

[0042] Furthermore, as described above, in order to maintain convenience, it is preferable that the restriction setting unit sets whether or not to impose a use restriction on the confidential information. For example, the restriction setting unit sets a use restriction on the confidential information (i.e., a use restriction setting) and sets a use restriction count in accordance with a use condition setting command transmitted from a setting device used by a manufacturer or administrator before shipping the host H. The flag indicating whether or not a use restriction is present and the use restriction count set by the restriction setting unit are stored, for example, in the storage unit 12. When a use restriction on the confidential information is set, the flag is set to "1," for example. On the other hand, when a use restriction on the confidential information is not set, the flag is set to "0," for example.

[0043] Then, only when a setting is made to limit the use of the secret information when contactless communication is performed with device D, the secret information is stored in the storage unit 12, and the number of times the secret information is used is equal to or less than a predetermined limit, the control unit 13 selects the simple authentication procedure and executes authentication processing including authentication (mutual authentication or unilateral authentication) using the secret information associated with the identification information and a random number. On the other hand, when a setting is not made to limit the use of the secret information and the secret information is stored in the storage unit 12 when communication is performed with device D, the control unit 13 selects the simple authentication procedure and executes authentication processing including authentication (mutual authentication or unilateral authentication) using the secret information associated with the identification information, regardless of whether the number of times the secret information is used is equal to or less than the predetermined limit.

[0044] Note that, when the number of times the secret information stored in the storage unit 12 is used exceeds a predetermined usage limit, the secret information erasure unit may erase the secret information from the storage unit 12. Furthermore, when a predetermined time has elapsed since the secret information was stored in the storage unit 12 or when an authentication error occurs, the secret information erasure unit may erase the secret information from the storage unit 12. Furthermore, when a program such as firmware installed in the control unit 13 is updated, the secret information erasure unit may erase the secret information from the storage unit 12.

[0045] [2. Operation of authentication system S] Next, the operation of the authentication system S will be described with reference to Figs. 2 to 6. Fig. 2 is a flowchart showing an example of an authentication procedure selection process by the control unit 13 in the host H. Fig. 3 is a sequence diagram showing an example of an advanced authentication procedure performed between the host H and the device D. Fig. 4 is a sequence diagram showing an example of a simple authentication procedure 1 performed between the host H and the device D. Fig. 5 is a flowchart showing an example of a simple authentication procedure execution determination process by the control module 2 in the device D. Fig. 6 is a sequence diagram showing an example of a simple authentication procedure 2 performed between the host H and the device D.

[0046] 2 is started when, for example, a user holds device D over communication unit 11 (contactless reader / lidar) and device D enters the contactless field of communication unit 11 of host H. When the process shown in Fig. 3 is started, control unit 13 of host H transmits a request command to device D via communication unit 11 (step S1).

[0047] It should be noted that there may be cases where multiple devices D simultaneously respond with their anti-collision IDs. In this case, the process of step S1 is repeated until only one anti-collision ID is read. When the control module 2 of device D receives a request command from host H via the communication module 1, it transmits a response including an anti-collision ID to host H via the communication module 1 in response to the request command (step S2).

[0048] Next, when the control unit 13 of the host H receives a response from the device D via the communication unit 11, it transmits a device selection (command) including an anti-collision ID to the device D via the communication unit 11 (step S3). Note that when the control unit 13 of the host H receives responses transmitted from multiple devices D in step S2, there may be a time when it is unable to read the 0 / 1 bits of the anti-collision ID due to a collision. In this case, in step S3, the control unit 13 of the host H transmits a device selection including an identifier consisting of the read bit string to all devices D. Then, if the control module 2 of each device D's own anti-collision ID matches the identifier included in the device selection, it again transmits a response including the anti-collision ID to the host H (if they do not match, it does not respond). By repeating this process, only devices D whose identifier included in the device selection matches their own anti-collision ID continue to respond. In this way, one device D is selected from multiple devices D.

[0049] Next, when the control module 2 of device D receives a device selection from host H via the communication module 1, it transmits a response including communication conditions to host H in accordance with the device selection via the communication module 1 (step S4). Next, when the control module 13 of host H receives a response from device D via the communication unit 11, it transmits a SELECT command (including the Application ID) to device D via the communication unit 11 (step S5).

[0050] Next, when the control module 2 of the device D receives the SELECT command from the host H via the communication module 1, it selects an application in response to the SELECT command and transmits a response to the SELECT command to the host H via the communication module 1 (step S6). This response includes, for example, SW (Status Word) “9000” and FCI (File Control Information) in TLV format.

[0051] Next, when the control unit 13 of the host H receives a response from the device D via the communication unit 11, it transmits a read command to the device D via the communication unit 11 (step S7). Next, when the control module 2 of the device D receives the read command from the host H via the communication module 1, it reads the device ID (an example of identification information unique to the device D) from the IC module 3 in response to the read command, and transmits a response including the device ID to the host H via the communication module 1 (step S8).

[0052] The control module 2 of device D may read the device ID from the IC module 3 in response to the SELECT command sent from host H in step S5, and send a response including the device ID to host H in step S6. In this case, the processes of steps S7 and S8 are unnecessary. Also, if an anti-collision ID is used as identification information unique to device D, the processes of steps S7 and S8 are unnecessary.

[0053] Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, it acquires the device ID or anti-collision ID as identification information unique to the device D (step S9).

[0054] Next, the control unit 13 of the host H determines whether or not secret information is stored in the storage unit 12 in association with the identification information acquired in step S9 (step S10). If the control unit 13 of the host H determines that secret information is not stored (step S10: NO), it selects and starts the advanced authentication procedure (step S11). On the other hand, if the control unit 13 of the host H determines that secret information is stored (step S10: YES), it acquires the secret information from the storage unit 12 (step S12).

[0055] Next, the control unit 13 of the host H determines whether or not a setting has been made to impose a use restriction on the secret information (i.e., whether or not there is a use restriction) (step S13). If the control unit 13 of the host H determines that a setting has not been made to impose a use restriction on the secret information (for example, the flag indicating whether or not there is a use restriction = "0") (step S13: NO), the control unit 13 of the host H selects a simple authentication procedure and starts the simple authentication procedure in which the secret information acquired in step S12 is used (step S17).

[0056] On the other hand, if the control unit 13 of the host H determines that a setting is made to restrict the use of the secret information (for example, the flag indicating whether or not there is a usage restriction = "1") (step S13: YES), it increments the number of times the secret information is used by 1 (step S14). For example, the count value is incremented by 1 by a counter. Next, the control unit 13 of the host H determines whether the number of times the secret information is used is equal to or less than a predetermined usage restriction (for example, the count value ≦ the usage restriction) (step S15).

[0057] As another example, a limit on the number of uses may be set in a counter, and each time the confidential information is used, the counter value may be decremented by 1 in step S14. In this case, if the counter value is greater than "0" in step S15, it is determined that the number of uses of the confidential information is equal to or less than the limit on the number of uses.

[0058] If the control unit 13 of the host H determines that the number of times the secret information has been used is not equal to or less than the predetermined usage limit (step S15: NO), it erases the secret information from the storage unit 12 (step S16). Next, the control unit 13 of the host H selects the advanced authentication procedure and starts the advanced authentication procedure (step S11).

[0059] On the other hand, if the control unit 13 of the host H determines that the number of times the secret information has been used is less than or equal to the predetermined usage limit (step S15: YES), it selects a simple authentication procedure and starts the simple authentication procedure in which the secret information acquired in step S12 is used (step S17).

[0060] (2.1 Advanced Authentication Procedures) 3, in the advanced authentication procedure, the control unit 13 of the host H generates a random number H (step S21). Next, the control unit 13 of the host H transmits an authentication start command to the device D via the communication unit 11 (step S22). The authentication start command includes a host ID unique to the host H, the random number H generated in step S21, and information indicating that it is for the advanced authentication procedure.

[0061] Next, the control module 2 of device D receives the authentication start command from host H via the communication module 1. If it determines that the authentication start command is for the advanced authentication procedure, it obtains the host ID and random number H from the authentication start command and further generates random number D (step S23). Next, the control module 2 of device D signs random numbers H and D with the private key of device D (step S24). That is, signature D is generated by ECDSA (signature generation). Next, the control module 2 of device D transmits a response to the authentication start command to host H via the communication module 1 (step S25). This response includes signature D and random number D.

[0062] Next, when the control unit 13 of the host H receives a response from the device D via the communication unit 11, it obtains the signature D and the random number D from the response and verifies the signature D using the public key of the device D (step S26). That is, the signature D is verified (signature verification) using ECDSA. Then, if the verification of the signature D is successful (authentication is successful), the control unit 13 of the host H signs the random number D and the random number H using the private key of the host H (step S27). That is, the signature H is generated using ECDSA. Next, the control unit 13 of the host H sends an authentication completion command to the device D via the communication unit 11 (step S28). The authentication completion command includes the signature H.

[0063] Next, when the control module 2 of device D receives the authentication completion command from host H via the communication module 1, it obtains signature H from the authentication completion command and verifies signature H using the public key of host H (step S29). That is, signature H is verified using ECDSA. Then, if the verification of signature H is successful (authentication is successful), mutual authentication is completed, and the control module 2 of device D transmits a response to the authentication completion command to host H via the communication module 1 (step S30).

[0064] Next, upon receiving the response from the device D via the communication unit 11, the control unit 13 of the host H generates a temporary key pair of a temporary public key H and a temporary private key H unique to the host H (step S31). Here, the temporary public key H is a temporary public key and is distinguished from a public key that is shared and managed in advance. Similarly, the temporary private key H is a temporary private key and is distinguished from a private key that is shared and managed in advance. The temporary public key H is generated by an ECDH calculation based on a previously generated temporary private key H (e.g., a random number) and a point on an elliptic curve according to the ECDH protocol. In the ECDH calculation, for example, the temporary public key H is generated from the temporary private key H by performing scalar multiplication to calculate a k-fold point kp of a point p on the elliptic curve. The parameters of the elliptic curve are known between the host H and the device D. Next, the control unit 13 of the host H sends a key agreement command to the device D via the communication unit 11 (step S32). The key agreement command includes the temporary public key H.

[0065] Next, when the control module 2 of device D receives a key sharing command from host H via communication module 1, it obtains the temporary public key H from the key sharing command and, similar to host H, generates a temporary key pair of temporary public key D and temporary private key D unique to device D by ECDH calculation (step S33). The temporary public key D is generated by ECDH calculation based on the previously generated temporary private key D (e.g., a random number) and a point on an elliptic curve in accordance with the ECDH protocol. Next, the control module 2 of device D generates a shared secret (an example of secret information) from the temporary public key H and temporary public key D by ECDH calculation (step S34).

[0066] Next, the control module 2 of device D records the host ID and the shared secret generated in step S34 in non-volatile memory (step S35). Next, the control module 2 of device D generates a session key to be used in the secure session between host H and device D from the random number H, the random number D, and the shared secret generated in step S34 (step S36). Next, the control module 2 of device D transmits a response to the key exchange command to host H via the communication module 1 (step S37). This response includes the temporary public key D.

[0067] Next, when the control unit 13 of the host H receives a response from the device D via the communication unit 11, it obtains the temporary public key D from the response and generates a shared secret from the temporary public key H and the temporary public key D by ECDH calculation (step S38). The shared secret generated here is generated using the same generation method as the shared secret generated in step S34, so the two are identical. Next, the control unit 13 of the host H associates the device ID with the shared secret generated in step S38 and records them in memory (e.g., RAM or non-volatile memory) (step S39). For example, the device ID (an example of identification information) and the shared secret (an example of secret information) are associated and registered in a table. Next, the control unit 13 of the host H generates a session key from the random number H, the random number D, and the shared secret generated in step S38 (step S40). The session key generated here is generated using the same generation method as the session key generated in step S36, so the two are identical.

[0068] Next, the control unit 13 of the host H starts a secure session with the device D using the session key generated in step S40. Once the secure session has started, for example, a read command and its response are sent and received between the host H and the device D via an encrypted path using the session key. This allows data exchange and the like to be carried out.

[0069] (2.2 Simple Authentication Procedure 1) 4, in simple authentication procedure 1, the control unit 13 of the host H generates a random number H (step S51). Next, the control unit 13 of the host H transmits an authentication start command to the device D via the communication unit 11 (step S52). The authentication start command includes a host ID unique to the host H, the random number H generated in step S51, and information indicating that it is for simple authentication procedure 1.

[0070] Next, the control module 2 of the device D receives the authentication start command from the host H via the communication module 1. If it determines that the authentication start command is for the simple authentication procedure 1, it executes processing related to the execution determination of the simple authentication procedure (simple authentication procedure execution determination processing) (step S53). If the determination result is that the execution is possible, the process proceeds to step S54. If the determination result is that the execution is not possible, error processing is executed. In such error processing, for example, the control module 2 of the device D sends a response indicating an authentication error to the host H and erases the confidential information from the secure memory using the confidential information erasure function. As a result, the host H sends, for example, an authentication start command for the advanced authentication procedure to the device D.

[0071] Here, the simplified authentication procedure implementation determination process will be described in detail with reference to Fig. 5. In the simplified authentication procedure implementation determination process, as shown in Fig. 5, the control module 2 of device D determines whether or not a setting has been made to impose a use restriction on the secret information (i.e., whether or not there is a use restriction) (step S531). If the control module 2 of device D determines that a setting has not been made to impose a use restriction on the secret information (step S531: NO), it sets "implementation possible" and returns to the process shown in Fig. 4. On the other hand, if the control module 2 of device D determines that a setting has been made to impose a use restriction on the secret information (step S531: YES), it increments the number of times the secret information is used by 1 (step S532). For example, the count value is incremented by 1 using a counter function.

[0072] Next, the control module 2 of the device D determines whether the number of times the secret information has been used is equal to or less than a predetermined usage limit (for example, the count value≦the usage limit) (step S533). As another example, a usage limit may be set in a counter, and the counter value may be decremented by 1 each time the secret information is used in step S532. In this case, if the counter value is greater than "0" in step S533, it is determined that the number of times the secret information has been used is equal to or less than the usage limit.

[0073] If the control module 2 of device D determines that the number of times the secret information is used is not equal to or less than the predetermined usage limit (step S533: NO), it sets "not to implement" and returns to the processing shown in Fig. 4. On the other hand, if the control module 2 of device D determines that the number of times the secret information is used is equal to or less than the predetermined usage limit (step S533: YES), it sets "possible to implement" and returns to the processing shown in Fig. 4.

[0074] Returning to the process shown in FIG. 4, in step S54, the control module 2 of device D obtains the host ID and random number H from the authentication start command and further generates random number D. Next, the control module 2 of device D obtains the shared secret recorded in association with the host ID of host H and generates a session key from random numbers H, D, and the shared secret by AES (Advanced Encryption Standard) calculation (step S55). Next, the control module 2 of device D encrypts random numbers D, H, and a predetermined specific value with the session key to generate authentication code D (an example of encrypted data) (step S56). Next, the control module 2 of device D transmits a response to the authentication start command to host H via the communication module 1 (step S57). The response includes authentication code D and random number D.

[0075] Next, when the control unit 13 of the host H receives a response from the device D via the communication unit 11, it acquires the authentication code D and the random number D from the response, and further acquires the shared secret recorded in association with the device ID of the device D, and generates a session key from the random number H, the random number D, and the shared secret by AES calculation (step S58). Next, the control unit 13 of the host H verifies the authentication code D using the session key (step S59). In this verification, the control unit 13 decrypts the authentication code D with the session key by AES calculation, and determines whether the decrypted authentication code D matches the "random number D (i.e., the random number D acquired from the response), the random number H, and the predetermined specific value." Then, if the verification of the authentication code D is successful (authentication is successful), the control unit 13 of the host H generates the authentication code H by encrypting the random number D, the random number H, and the predetermined specific value by AES calculation with the session key (step S60). Next, the control unit 13 of the host H transmits an authentication completion command to the device D via the communication unit 11 (step S61). The authentication completion command includes the authentication code H.

[0076] Next, when the control module 2 of device D receives the authentication completion command from host H via the communications module 1, it obtains the authentication code H from the authentication completion command and verifies the authentication code H using the session key (step S62). In this verification, the control unit 13 decrypts the authentication code H using the session key through an AES operation and determines whether the decrypted authentication code H matches the "random number D, random number H, and the predetermined specific value." If the verification of the authentication code H is successful (authentication successful), mutual authentication is completed, and the control module 2 of device D transmits a response to the authentication completion command to host H via the communications module 1 (step S63).

[0077] Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the control unit 13 starts a secure session with the device D using the session key generated in step S58.

[0078] (2.3 Simple Authentication Procedure 2) 6, in simple authentication procedure 2, the control unit 13 of the host H generates a random number H (step S71). Next, the control unit 13 of the host H transmits an authentication start command to the device D via the communication unit 11 (step S72). The authentication start command includes a host ID unique to the host H, the random number H generated in step S71, and information indicating that it is for simple authentication procedure 2.

[0079] Next, the control module 2 of the device D receives the authentication start command from the host H via the communication module 1. If the control module 2 determines that the authentication start command is for the simple authentication procedure 2, it executes a process for determining whether the simple authentication procedure can be performed (for example, the simple authentication procedure execution determination process shown in FIG. 5) as in the simple authentication procedure 1 (step S73). If the determination result is that the procedure can be performed, the process proceeds to step S74. If the determination result is that the procedure cannot be performed, error processing is executed.

[0080] Next, the control module 2 of device D obtains the host ID and random number H from the authentication start command, and further generates a random number D (step S74). Next, the control module 2 of device D obtains the shared secret recorded in association with the host ID of host H, and generates a session key from random numbers H, D, and the shared secret by AES calculation (step S75). Next, the control module 2 of device D encrypts random numbers D, H, and a predetermined specific value with the session key, thereby generating an authentication code D (step S76). Next, the control module 2 of device D transmits a response to the authentication start command to host H via the communication module 1 (step S77). The response includes the authentication code D and random number D.

[0081] Next, when the control unit 13 of the host H receives a response from the device D via the communication unit 11, it acquires the authentication code D and the random number D from the response, and further acquires the shared secret recorded in association with the device ID of the device D, and generates a session key from the random number H, the random number D, and the shared secret by AES calculation (step S78). Next, the control unit 13 of the host H verifies the authentication code D using the session key (step S79). Then, if the verification of the authentication code D is successful (authentication is successful) (i.e., one-sided authentication is completed), the control unit 13 of the host H starts a secure session with the device D using the session key generated in step S78.

[0082] As described above, according to the above embodiment, the host H is configured to select the advanced authentication procedure to perform mutual authentication when no secret information is stored or the number of times the secret information has been used is greater than or equal to the predetermined use limit when contactless communication is performed with the device D, while selecting the simplified authentication procedure to perform authentication using the secret information when the secret information is stored and the number of times the secret information has been used is less than or equal to the predetermined use limit, thereby protecting the secret information from threats such as side channel attacks.Furthermore, the host H is configured to select the simplified authentication procedure to perform authentication using the secret information only when a setting to limit the use of the secret information is configured to be performed when contactless communication is performed with the device D, the secret information is stored, and the number of times the secret information has been used is less than or equal to the predetermined use limit, thereby appropriately controlling the secret information, protecting the secret information from threats such as side channel attacks, and maintaining convenience.

[0083] In the above embodiment, an authentication method in which two types of authentication processes, an advanced authentication procedure and a simple authentication procedure, are used as an example. However, the present invention can also be applied to an authentication method in which three or more types of authentication processes are used. In addition, in the above embodiment, a case in which contactless communication is performed between the host H and the device D is used as an example. However, the present invention can also be applied to a case in which contact communication is performed between the host H and the device D. In the above embodiment, FIGS. 2 to 6 show the processing of the control unit 13 of the host H and the control module 2 of the device D, but the processing of the control module 2 of the device D may be executed by the IC module 3. [Explanation of symbols]

[0084] 1 Communication module 2 Control Module 3 IC modules 11 Communications Department 12 Storage section 13 Control Unit D Device H Host S Authentication System

Claims

1. A communication device capable of selecting either an advanced authentication procedure requiring a large amount of calculation between communication partners or a simple authentication procedure requiring a smaller amount of calculation between communication partners using secret information generated in the advanced authentication procedure, a storage means for storing the secret information and the number of times the secret information is used; an authentication means for selecting the simplified authentication procedure and executing authentication when the secret information is stored in the storage means when communication is performed with the communication partner and the number of times of use is equal to or less than a predetermined limit number of times of use; a setting means for setting whether or not to impose a usage restriction on the confidential information; Equipped with a communication device characterized in that the authentication means selects the simplified authentication procedure and performs authentication only when a setting is made to impose a usage limit on the secret information when communication is conducted with the communication partner, the secret information is stored in the storage means, and the number of uses is equal to or less than a predetermined usage limit.

2. 2. The communication device according to claim 1, wherein the authentication means selects the advanced authentication procedure and performs authentication when the secret information is not stored in the storage means or the number of uses is not equal to or less than a predetermined limit number of uses.

3. 3. The communication device according to claim 1, further comprising: an erasing unit that erases the confidential information from the storage unit when the number of uses is not equal to or less than a predetermined limit number of uses.

4. 3. The communication device according to claim 1, further comprising an erasure means for erasing the secret information from the storage means when a predetermined time has elapsed since the secret information was stored in the storage means or when an authentication error occurs.

5. 5. The communication device according to claim 1, wherein the advanced authentication procedure includes authentication by signature generation and signature verification, and key sharing by public key cryptography.

6. 6. The communication device according to claim 5, wherein the simple authentication procedure uses a random number and the secret information to perform authentication.

7. A communication device capable of selecting either an advanced authentication procedure requiring a large amount of calculation between communication partners, or a simple authentication procedure requiring less calculation between communication partners using secret information generated in the advanced authentication procedure, the communication device comprising: a storage means for storing the secret information and the number of times the secret information is used; and an authentication means for selecting the simple authentication procedure and performing authentication when the secret information is stored in the storage means when communication is performed with the communication partner and the number of times the secret information is used is equal to or less than a predetermined limit on the number of times it is used, the communication device comprising: a computer included in a device that is the communication partner of the communication device; storing secret information generated in the advanced authentication procedure; a setting step for setting whether or not to impose a usage restriction on the confidential information; generating encrypted data for authentication using the secret information and a random number when a setting for limiting use of the secret information is made and the number of times of use is equal to or less than a predetermined limit number of times; transmitting a response including the encrypted data to the communication device; A program characterized by executing the following.

8. A communication method executed by a communication device that can select either an advanced authentication procedure that requires a large amount of calculation between communication partners and a simple authentication procedure that requires less calculation between communication partners and uses secret information generated in the advanced authentication procedure, the communication device including storage means for storing the secret information and the number of times the secret information is used, comprising: a step of determining whether or not the secret information is stored in the storage means when communication is performed with the communication partner; a step of determining whether the number of times of use is equal to or less than a predetermined limit number of times of use when it is determined that the secret information is stored in the storage means; an authentication step of selecting the simplified authentication procedure and performing authentication when it is determined that the number of uses is equal to or less than a predetermined limit number of uses; a step of setting whether or not to impose a usage restriction on the confidential information; Including, a communication method characterized in that, in the authentication step, the simplified authentication procedure is selected to perform authentication only if a setting is made to impose a usage limit on the secret information when communication is performed with the communication partner, the secret information is stored in the storage means, and the number of uses is equal to or less than a predetermined usage limit.

9. A communication device that can select either an advanced authentication procedure that requires a large amount of calculation between communication partners and a simple authentication procedure that requires less calculation between communication partners and uses secret information generated in the advanced authentication procedure, the communication device including a computer that includes storage means for storing the secret information and the number of times the secret information is used, a program that functions as an authentication means that selects the simplified authentication procedure and executes authentication when the secret information is stored in the storage means when communication is performed with the communication partner and the number of times of use is equal to or less than a predetermined number of times of use limit, and as a setting means that sets whether or not to impose a use limit on the secret information, The authentication means selects the simplified authentication procedure and performs authentication only when a setting is made to restrict the use of the secret information when communication is performed with the communication partner, the secret information is stored in the storage means, and the number of uses is equal to or less than a predetermined limit number of uses.

Images