Verification device, verification method, program, and verification system

Abstract

To provide a verification device, a verification method, a program, and a verification system for verifying an error of a ciphertext from a device with limited resources.SOLUTION: A verification device 10 is configured to: acquire a ciphertext 71 encrypted by predetermined computation with a plain text 70 and key data 52, and a conversion error detection code 66 converted by computation with an error detection code 62 of the key data and an error detection code 65 of the plain text (S14); generate a decoded text 72 by inverse operation with the acquired ciphertext 71 and key data 53 acquired in advance (S15); calculate an error detection code 67 of the decoded text (S16); inversely calculate an error detection code 68 of the key data by inverse operation with the acquired conversion error detection code 66 and the error detection code 67 of the decoded text (S17); and compare the inversely calculated error detection code 68 of the key data with the error detection code 63 of the key data acquired in advance, to verify the acquired ciphertext 71(S18).SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present invention relates to a verification device, a verification method, a program, and a verification system. [Background Art]

[0002] As the practical application of quantum computers progresses, it is said that the security of cryptographic communication using conventional shared key systems and public key systems will become an issue. In order to provide absolutely secure cryptographic communication, one-time pad cryptography using a shared random number sequence via quantum key distribution technology or the like is used. For example, Patent Document 1 discloses a shared random number management method in which a random number sequence is shared between a center node and each of a plurality of remote nodes, and when communication is performed between a first remote node and a second remote node, a part of a second random number sequence of the second remote node is delivered from the center node to the first remote node, and the first remote node and the second remote node share the part of the second random number sequence. [Prior Art Document] [Patent Document]

[0003] [Patent Document 1] Japanese Unexamined Patent Publication No. 2009-265159 [Summary of the Invention] [Problem to be Solved by the Invention]

[0004] However, in the case of one-time pad cryptography, as the size of the disposable encryption key increases, there has been a problem that bit errors that occur stochastically due to external disturbance during transfer and storage of the disposable encryption key also increase. Particularly in devices with limited resources such as IC cards, when encrypting and sending a ciphertext, processing to detect and correct errors such as bit errors in a large-size encryption key is a high-load operation, and has been a factor that reduces the response speed of the device.

[0005] Therefore, the present invention has been made in view of the above-mentioned problems, and one example of its objective is to provide a verification device, verification method, program, and verification system that can verify errors in ciphertext from equipment with limited resources. [Means for solving the problem]

[0006] To solve the above problems, the invention described in claim 1 is characterized by comprising: a ciphertext acquisition means for acquiring a ciphertext encrypted by a predetermined operation between plaintext and key data, and a conversion error detection code converted by the operation between the error detection code of the key data and the error detection code of the plaintext; a decryption means for generating a decrypted text by performing the inverse operation of the operation between the acquired ciphertext and the previously acquired key data; a decrypted text error detection code calculation means for calculating the error detection code of the decrypted text; an inverse calculation means for inversely calculating the error detection code of the key data by performing the inverse operation between the acquired conversion error detection code and the error detection code of the decrypted text; and a verification means for verifying the acquired ciphertext by comparing the inversely calculated error detection code of the key data with the error detection code of the key data previously acquired.

[0007] Furthermore, the invention described in claim 2 is characterized in that, in the verification device described in claim 1, the key data is a disposable key block obtained sequentially from a random number sequence.

[0008] Furthermore, the invention described in claim 3 is characterized in that, in the verification device described in claim 2, the device further comprises a random number sequence storage means for storing the random number sequence, and a disposable key block information acquisition means for acquiring information on the starting position and block size of the disposable key block in the random number sequence, wherein the previously acquired key data is acquired from the random number sequence storage means according to the information on the starting position and block size.

[0009] Furthermore, the invention described in claim 4 is characterized in that, in the verification device described in any one of claims 1 to 3, the calculation is an XOR operation.

[0010] Furthermore, the invention described in claim 5 is characterized in that, in the verification device described in any one of claims 1 to 3, the error detection code is a cyclic redundant code.

[0011] Furthermore, the invention described in claim 6 is characterized in that, in the verification device described in any one of claims 1 to 3, the previously acquired key data and the error detection code for the previously acquired key data are acquired in advance through a secure communication channel.

[0012] Furthermore, the invention described in claim 7 is characterized by including: a ciphertext acquisition step in which a ciphertext acquisition means acquires a ciphertext encrypted by a predetermined operation between plaintext and key data, and a conversion error detection code converted by the operation between the error detection code of the key data and the error detection code of the plaintext; a decryption step in which a decryption means generates a decrypted text by performing the inverse operation of the operation between the acquired ciphertext and the previously acquired key data; a decrypted text error detection code calculation step in which a decrypted text error detection code calculation means calculates the error detection code of the decrypted text; an inverse calculation step in which an inverse calculation means calculates the error detection code of the key data by performing the inverse operation between the acquired conversion error detection code and the error detection code of the decrypted text; and a verification step in which a verification means verifies the acquired ciphertext by comparing the inversely calculated error detection code of the key data with the error detection code of the key data previously acquired.

[0013] Furthermore, the invention described in claim 8 is characterized in that a computer functions as a ciphertext acquisition means for acquiring a ciphertext encrypted by a predetermined operation between plaintext and key data, and a conversion error detection code converted by the operation between the error detection code of the key data and the error detection code of the plaintext; a decryption means for generating a decrypted text by performing the inverse operation of the operation between the acquired ciphertext and the previously acquired key data; a decrypted text error detection code calculation means for calculating the error detection code of the decrypted text; an inverse calculation means for inversely calculating the error detection code of the key data by performing the inverse operation between the acquired conversion error detection code and the error detection code of the decrypted text; and a verification means for verifying the acquired ciphertext by comparing the inversely calculated error detection code of the key data with the error detection code of the previously acquired key data.

[0014] Furthermore, the invention described in claim 9 is a verification system comprising: an issuing device for issuing key data; a terminal device for generating encrypted ciphertext by performing a predetermined operation between the key data obtained from the issuing device and plaintext; and a verification device for verifying the ciphertext from the terminal device, wherein the verification device comprises: a key acquisition means for obtaining the ciphertext and a conversion error detection code converted by the operation between the error detection code of the key data and the error detection code of the plaintext from the terminal device; a decryption means for generating a decrypted text by performing the inverse operation of the operation between the obtained ciphertext and the key data previously obtained from the issuing device; a decrypted text error detection code calculation means for calculating the error detection code of the decrypted text; an inverse calculation means for inversely calculating the error detection code of the key data by performing the inverse operation between the obtained conversion error detection code and the error detection code of the decrypted text; and a verification means for verifying the obtained ciphertext by comparing the inversely calculated error detection code of the key data with the error detection code of the key data previously obtained from the issuing device. [Effects of the Invention]

[0015] According to the present invention, a verification device on the ciphertext receiving side acquires, together with a ciphertext, a converted error detection code converted by an operation of an error detection code of key data and an error detection code of plaintext, calculates an error detection code of a decrypted text of the ciphertext, inversely calculates the error detection code of the key data by an inverse operation of the acquired converted error detection code and the error detection code of the decrypted text, and verifies the acquired ciphertext by comparing the inversely calculated error detection code of the key data with an error detection code of key data acquired in advance. Therefore, an error in the ciphertext from a device on the ciphertext transmitting side can be verified without imposing a processing load on the device, which has limited resources. [BRIEF DESCRIPTION OF THE DRAWINGS]

[0016] [Figure 1] FIG. 1 is a diagram showing a schematic configuration example of a verification system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram showing a schematic configuration example of the verification device in FIG. 1. [Figure 3] FIG. 3 is a diagram showing a schematic configuration example of the IC card in FIG. 1. [Figure 4] FIG. 4 is a diagram showing a schematic configuration example of the issuing device in FIG. 1. [Figure 5] FIG. 5 is a sequence diagram showing an operation example of IC card issuance in the verification system. [Figure 6] FIG. 6 is a schematic diagram showing an example of a data flow in the verification system. [Figure 7] FIG. 7 is a sequence diagram showing an operation example of verification in the verification system. DESCRIPTION OF EMBODIMENTS

[0017] Hereinafter, embodiments of the present invention will be described with reference to the drawings. The embodiments described below are cases where the present invention is applied to a verification system.

[0018] [1. Overview of Configuration and Functions of Verification System S] First, the configuration and overview functions of a verification system according to an embodiment of the present invention will be described with reference to FIG. 1.

[0019] FIG. 1 is a schematic diagram showing an example of a general configuration of a verification system S according to the present embodiment.

[0020] As shown in FIG. 1, the verification system S includes a verification device 10 that verifies a ciphertext, an IC card 20 that transmits the ciphertext to the verification device 10, and an issuing device 30 that issues the IC card 20.

[0021] The verification device 10 is a server device, and is connected to a plurality of IC cards 20 via a network NW. The verification device 10 is also connected to the issuing device 30 via a secure communication channel SC. The verification device 10 acquires in advance from the issuing device 30 a one-time encryption key for each IC card 20 issued by the issuing device 30, and a unique ID such as a chip ID of the IC card 20. Note that the unique ID only needs to be an ID that can be distinguished from other IC cards 20, and only needs to be unique to the IC card 20.

[0022] Here, the secure communication channel SC is a communication channel whose security is ensured using a protocol such as quantum key distribution. The secure communication channel SC may also be a dedicated line between the verification device 10 and the issuing device 30. If a secure communication channel can be secured in advance between the verification device 10 and the issuing device 30, communication between the verification device 10 and the issuing device 30 may be performed via a communication channel through the network NW instead of the secure communication channel SC.

[0023] The IC card 20 is an example of a terminal device connected to the verification device 10, which is an example of a server device. The IC card 20 includes an IC chip, which is an example of an electronic information storage medium. The IC chip is, for example, a tamper-resistant IC chip. Forms of the IC chip include a form of eSE (embedded Secure Element), a form of SIM card (Subscriber Identity Module Card), and the like.

[0024] IC card 20 can be, for example, a credit card, a cash card, an ETC card, a digital room key, a digital vehicle key, an identification card, or a passport. IC card 20 may also be a SIM card (Subscriber Identity Module Card) or an IC tag. IC card 20 may also be a mobile device such as a smartphone with a SIM card inserted. IC card 20 may also be a mobile device with an embedded IC chip. Furthermore, an IC chip, which is an example of an electronic information storage medium, may also be mounted on a control device such as an ECU (Electronic Control Unit).

[0025] The IC card 20 connects to the reader / writer devices 40, 41, etc. by being inserted into them or by wireless communication with them. The reader / writer devices 40, 41, etc., which are examples of terminal devices, connect to the verification device 10 via a network NW.

[0026] The reader / writer devices 40 and 41 may be connected to a personal computer or the like that accepts plaintext input. The reader / writer devices 40 and 41 may also be mobile devices that incorporate the functionality of the IC card 20. In this case, the mobile device accepts the plaintext input.

[0027] The issuing device 30 ejects the IC card 20 on which the necessary information has been written. The issuing device 30 generates random numbers, divides the random numbers into key blocks, and generates a key block as an example of key data, a cyclic redundancy code (CRC), which is an example of an error detection code for the key block, etc. When issuing the IC card 20, the issuing device 30 writes the key block, the error detection code for the key block, etc., to the IC card 20 and ejects the IC card 20. The issuing device 30 transmits the same key block as the IC card 20 to the verification device 10. In this way, the issuing device 30 issues key data to the verification device 10 and the IC card 20 by transmitting the key data to the verification device 10 and the IC card 20.

[0028] When the issuing device 30 writes a key block, it stores the key block, the error detection code for the key block, etc., in a database, associating them with a unique ID such as the chip ID of the IC card 20.

[0029] Examples of error detection codes include fixed-length check bits such as CRC, message authentication codes such as CMAC (Cipher-based MAC), and hash values. The algorithm for calculating the error detection code can be any algorithm used to calculate the error detection code, such as the CRC algorithm, hash functions such as MD5 (Message Digest 5) and SHA (Secure Hash Algorithm), functions used for checksums, and parity check functions.

[0030] Verification device 10 is an example of a verification device that verifies ciphertext from a terminal device. IC card 20, or reader / writer devices 40 and 41 connected to IC card 20, are examples of terminal devices that generate encrypted ciphertext through a predetermined operation between key data obtained from an issuing device and plaintext. Issuing device 30 is an example of an issuing device that issues key data.

[0031] Next, an example of the configuration of the verification device 10 will be explained using a diagram. Figure 2 is a diagram showing an example of the configuration of the verification device 10.

[0032] As shown in Figure 2, the verification device 10, which functions as a computer, comprises a communication unit 11, a storage unit 12, a display unit 13, an operation unit 14, an input / output interface unit 15, and a control unit 16. The control unit 16 and the input / output interface unit 15 are connected via a system bus 17.

[0033] The communication unit 11 controls communication between the IC card 20 and the issuing device 30. The communication unit 11 controls communication with the IC card 20 via reader / writer devices 40 and 41 that can be connected to the network NW. The communication unit 11 controls communication with the issuing device 30 via a secure communication channel SC. The communication unit 11 may also communicate with the issuing device 30 via the network NW.

[0034] The storage unit 12 is composed of, for example, a hard disk drive, a solid-state drive, etc. The operating system and applications are stored in the storage unit 12.

[0035] Furthermore, a database is constructed in the storage unit 12 in which key blocks, error detection codes for key blocks, and unique IDs of IC cards 20 are associated. Note that the storage unit 12 may also store a random number sequence common to the issuing device 30 as an example of a random number sequence storage means. In this case, a database is constructed in which the ID of the random number sequence, the size of the key block, the key block number, the error detection code for the key block, and the unique ID of the IC card 20 are associated.

[0036] The display unit 13 is composed of, for example, a liquid crystal display element or an organic EL (Electro-Luminescence) element. The operation unit 14 is composed of, for example, a keyboard and a mouse.

[0037] The input / output interface unit 15 is the interface between the communication unit 21 and the storage unit 22, etc., and the system control unit 25.

[0038] The control unit 16 includes, for example, a CPU (Central Processing Unit), RAM (Random Access Memory), and ROM (Read Only Memory). The control unit 16 allows the CPU to read and execute various programs stored in the ROM, RAM, and storage unit 12.

[0039] Next, we will explain an example of the IC card 20's configuration using a diagram.

[0040] Figure 3 shows an example of the general configuration of the IC card 20. As shown in Figure 3, the IC card 20 is composed of a communication unit 21, a storage unit 22, a control unit 23, and the like.

[0041] The communication unit 21 has contact terminals and / or a coil-type antenna. When an IC card 20 is issued in the issuing device 30, the IC card 20 communicates with the issuing device 30 via the contact terminals or coil-type antenna of the communication unit 21. When the IC card 20 is inserted into the reader / writer devices 40 and 41, the IC card 20 communicates with the reader / writer devices 40 and 41 via the contact terminals or coil-type antenna of the communication unit 21.

[0042] The storage unit 22 is, for example, a non-volatile memory (NVM) such as flash memory. The storage unit 22 stores the operating system (OS) and applications. The applications include mutual authentication processing programs, etc. The storage unit 22 stores a unique ID, such as a chip ID, for identifying the IC card 20.

[0043] The storage unit 22 stores a key block, which is an example of key data transmitted from the issuing device 30, and a cyclic redundancy code, which is an example of an error detection code for key data.

[0044] The control unit 23 is comprised of a CPU, RAM, ROM, etc. The control unit 23 performs operations between the plaintext and the key block, and calculates error detection codes for the plaintext. An example of a predetermined operation between the plaintext and key data to convert the plaintext into ciphertext is the exclusive OR (XOR) operation. The predetermined operation can be any operation that allows for easy inverse operation to decrypt the ciphertext back into plaintext.

[0045] Next, an example of the general configuration of the issuing device 30 will be explained using Figure 4. Figure 4 is a diagram showing an example of the general configuration of the issuing device 30.

[0046] As shown in Figure 4, the issuing device 30 includes a control unit 31, a storage unit 32, a communication unit 33, a display unit 34, and an issuing unit 35.

[0047] The control unit 31 is comprised of a CPU, RAM, ROM, etc. The control unit 31 controls the storage unit 32 and the communication unit 33, etc. The control unit 31 has a random number generation function, etc. The random number generation function may be implemented in software or in hardware. The control unit 31 also calculates an error detection code.

[0048] The storage unit 32 is composed of, for example, a hard disk drive, a solid-state drive, etc. The storage unit 12 stores the operating system and applications.

[0049] Furthermore, the memory unit 32 constructs a database in which the generated key block, the error detection code for the key block, and the unique ID of the issued IC card 20 are associated.

[0050] The communication unit 33 has a reader / writer function for the IC card 20. The communication unit 33 connects to the IC card 20 via its contact terminals and / or a coil-type antenna and controls communication between the issuing device 30 and the IC card 20. The control unit 31 writes the generated key block, etc., to the IC card 20 via the communication unit 33. The communication unit 33 controls communication with the verification device 10 via the secure communication channel SC. The communication unit 33 may also communicate with the verification device 10 via the network NW.

[0051] The display unit 34 is composed of, for example, a liquid crystal display element or an organic EL element.

[0052] The issuing unit 35 has a feeder mechanism for the IC card 20 and ejects the IC card 20 on which key data such as key blocks has been written.

[0053] [2. Operation of the Verification System] Next, the operation of the verification system according to one embodiment of the present invention will be explained with reference to the diagrams.

[0054] (2.1 Example of IC card 20 issuance operation) First, an example of the operation of issuing an IC card 20 by the issuing device 30 will be explained using Figures 5 and 6. Figure 5 is a sequence diagram showing an example of the operation of issuing an IC card in the verification system. Figure 6 is a schematic diagram showing an example of the data flow in the verification system.

[0055] As shown in Figure 5, the verification system S generates a disposable encryption key (step S1). Specifically, as shown in Figure 6, the control unit 31 of the issuing device 30 generates a random number of a predetermined length as the disposable encryption key 50. The size of the random number depends on the capacity of the storage unit 22 of the IC card 20.

[0056] Next, the verification system S divides the key into key blocks (step S2). Specifically, the control unit 31 of the issuing device 30 divides the encryption key 50 into key blocks 51 of a predetermined size. The control unit 31 may divide the key blocks 51 so that their size matches the memory architecture of the IC card 20 of the terminal device (for example, the write page size of the rush memory), or so that they match the communication packet size of the communication channel between the terminal device and the issuing device 30. The control unit 31 may also generate random numbers of the key block length for each block without dividing the random numbers.

[0057] Next, the verification system S calculates the key CRC for each key block (step S3). Specifically, the control unit 31 of the issuing device 30 calculates the remainder (key CRC 61) by dividing the random number value of the key block by a predetermined value. The key CRC 61 is an example of an error detection code for key data. The divisor and other parameters used to calculate the CRC are examples of parameters used to calculate the error detection code.

[0058] Next, the verification system S transmits each key block and each CRC for issuing the IC card 20 (step S4). Specifically, the control unit 31 of the issuing device 30 transmits each key block 51 and key CRC 61 in block order to the IC card 20 connected to the issuing device 30, paired together. The control unit 31 associates each key block 51 and each key CRC 61 with the unique ID of the connected IC card 20 and stores them in block order in the storage unit 32. The issuing device 30 also transmits to the connected IC card 20 a divisor for calculating the CRC, which is an example of a parameter for calculating the error detection code. The block order is, for example, the order from the beginning of the encryption key 50 when it is divided from the beginning.

[0059] Next, the verification system S stores each key block and each CRC (step S5). Specifically, the control unit 23 of the IC card 20 pairs each received key block 52 and each key CRC 62 and stores them in block order in the storage unit 22. The control unit 23 also stores parameters for calculating the received error detection code in the storage unit 22.

[0060] Next, the issuing device 30 discharges the IC card 20, which stores each key block and each key CRC, etc., from the issuing unit 35.

[0061] Next, the verification system S transmits each key block, each key CRC, and a unique ID to the verification device 10 (step S6). First, the issuing device 30 and the verification device 10 are connected via a secure communication channel SC. The control unit 31 transmits the pairs of each key CRC 61 of each key block 51, along with the unique ID of the IC card 20, to the verification device 10 via the secure communication channel SC in block order. The issuing device 30 transmits to the verification device 10 a divisor for calculating the CRC, which is an example of a parameter for calculating the error detection code.

[0062] Next, the verification system S associates and stores each key block and each key CRC with a unique ID (step S7). Specifically, the control unit 16 of the verification device 10 pairs each received key block 53 and each key CRC 63 and stores them in the storage unit 12 in block order, associated with the received unique ID. The control unit 16 also stores the parameters for calculating the received error detection code in the storage unit 12, associated with the received unique ID.

[0063] Furthermore, if the verification device 10 and the issuing device 30 share a random number sequence for a disposable encryption key in advance using a protocol such as quantum key distribution, instead of sending the key block 51, a sequence of key block generation information (starting position and block size of the disposable encryption key) may be sent together with the key block's CRC 61. In this case, the key block 53 is generated in the verification device 10 in the same manner as in the issuing device 30.

[0064] (2.2 Verification operation example) Next, we will explain an example of the verification operation in the verification system S using diagrams. Figure 7 is a sequence diagram showing an example of the verification operation in the verification system S.

[0065] First, the control unit 23 of the IC card 20 divides the plaintext to be transmitted to the verification device 10 into blocks equal to the size of the stored key block 52, and generates a plaintext block 70. If the size of the plaintext block 70 does not match the size of the key block 52, the control unit 23 may perform padding to make the data lengths equal.

[0066] As shown in Figure 7, the verification system S generates ciphertext by performing calculations on the key block and the plaintext block (step S10). Specifically, the control unit 23 of the IC card 20 calculates the XOR of the key block 52 and the plaintext block 70 to generate the ciphertext 71 of the plaintext block 70.

[0067] Next, the verification system S calculates the plaintext CRC of the plaintext block (step S11). Specifically, the control unit 23 of the IC card 20 uses parameters for calculating error detection codes obtained from the issuing device 30 to calculate the plaintext CRC 65 of the plaintext block 70, which is an example of a plaintext error detection code. The plaintext CRC 65 is an example of a plaintext error detection code.

[0068] Next, the verification system S calculates a converted CRC by comparing the key CRC of the key block with the plaintext CRC of the plaintext block (step S12). Specifically, the control unit 23 of the IC card 20 calculates an XOR operation between the key CRC 62 of the key block and the plaintext CRC 65 of the plaintext block to generate a converted CRC 66. The key CRC 62 is converted to a converted CRC 66 by the XOR operation with the plaintext CRC 65. The converted CRC 66 is an example of a conversion error detection code. The error detection code of the key data is converted to a conversion error detection code by an operation between the error detection code of the key data and the error detection code of the plaintext.

[0069] Next, the verification system S transmits the unique ID, ciphertext, and converted CRC (step S13). Specifically, the control unit 23 of the IC card 20 concatenates the unique ID of the IC card 20 itself, the generated ciphertext 71, and the converted CRC 66, and transmits them to the verification device 10 via the reader / writer devices 40, 41, etc.

[0070] Next, the verification system S obtains the unique ID, ciphertext, and converted CRC (step S14). Specifically, the control unit 16 of the verification device 10 obtains the unique ID, ciphertext 71, and converted CRC 66 of the IC card 20 from the IC card 20. In this way, the verification device 10 functions as an example of a ciphertext acquisition means that obtains ciphertext encrypted by a predetermined operation between plaintext and key data, and converted error detection codes converted by an operation between the error detection code of the key data and the error detection code of the plaintext.

[0071] Next, the verification system S generates a decrypted text from the ciphertext (step S15). Specifically, the control unit 16 of the verification device 10 calculates the XOR of the received ciphertext 71 and the key block 53 previously obtained from the issuing device 30 to generate a decrypted text block 72. The control unit 16 obtains the key block 53 by referring to the storage unit 12 based on the unique ID of the IC card 20. In this way, the verification device 10 functions as an example of a decryption means that generates a decrypted text by performing the inverse operation of the operation between the obtained ciphertext and the previously obtained key data.

[0072] Next, the verification system S calculates the decoded statement CRC from the decoded statement (step S16). Specifically, the control unit 16 of the verification device 10 calculates the decoded statement CRC 67 from the decoded statement block 72 using parameters for calculating the error detection code obtained from the issuing device 30. The control unit 16 obtains the parameters for calculating the error detection code by referring to the storage unit 12 based on the unique ID of the IC card 20. The decoded statement CRC 67 is an example of the error detection code of the decoded statement. In this way, the verification device 10 functions as an example of a decoded statement error detection code calculation means for calculating the error detection code of the decoded statement.

[0073] Next, the verification system S performs an inverse calculation on the key CRC from the converted CRC and the decoded statement CRC (step S17). Specifically, the control unit 16 of the verification device 10 calculates the XOR of the converted CRC 66 obtained from the IC card 20 and the generated decoded statement CRC 67 to perform an inverse calculation on the key CRC 68 of the key block. Here, the XOR operation is an example of an inverse operation. The converted CRC 66 is converted back to the key CRC 68 by the inverse operation of the XOR operation with the decoded statement CRC 67. The key CRC 68 is an example of an error detection code for the inversely calculated key data. In this way, the verification device 10 functions as an example of an inverse calculation means that calculates the error detection code for key data by performing an inverse operation on the acquired converted error detection code and the error detection code of the decoded statement.

[0074] Next, the verification system S determines whether the CRCs of the reverse-calculated key block match (step S18). Specifically, the control unit 16 of the verification device 10 compares the key CRC 68 of the reverse-calculated key block with the key CRC 63 previously obtained from the issuing device 30 to determine whether they match. The control unit 16 obtains the key CRC 63 by referring to the storage unit 12 based on the unique ID of the IC card 20. In this way, the verification device 10 functions as an example of a verification means that verifies the obtained ciphertext by comparing the error detection code of the reverse-calculated key data with the error detection code of the previously obtained key data.

[0075] If the CRCs do not match (step S18: NO), the control unit 16 of the verification device 10 discards the decrypted text block 72. The control unit 16 of the verification device 10 notifies the IC card 20 of the CRC mismatch. The control unit 23 of the IC card 20 performs steps S10 to S13 with the same plaintext block 70 using the next key block 52 and the next key CRC 62. At this time, the control unit 23 refers to the storage unit 22 and uses a counter indicating the order of the key blocks 52 to obtain the next key block 52 and the corresponding next key CRC 62. When the control unit 16 of the verification device 10 obtains the ciphertext 71 and the converted CRC 66 again from the IC card 20, it performs steps S14 to S18 using the next key block 53 and the corresponding next key CRC 63. At this time, the control unit 16 refers to the storage unit 12 and uses a counter indicating the order of the key blocks 53 to obtain the next key block 53 and the corresponding next key CRC 63.

[0076] If the CRCs match (step S18: YES), the control unit 16 of the verification device 10 requests the next ciphertext 71. The control unit 23 of the IC card 20 performs the processing in steps S10 to S13 for the next plaintext block 70 using the next key block 52 and the next key CRC 62. When the control unit 16 of the verification device 10 obtains the next ciphertext 71 and the converted CRC 66 from the IC card 20, it performs the processing in steps S14 to S18 using the next key block 53 and the corresponding next key CRC 63.

[0077] As described above, according to this embodiment, the verification device 10 on the receiving end of the ciphertext 71 obtains the ciphertext 71 encrypted by a predetermined XOR operation between a plaintext block 70, which is an example of plaintext, and a key block 52, and the converted error detection code CRC66 obtained by an XOR operation between the key data error detection code key CRC62 and the plaintext error detection code plaintext CRC65, and generates a decrypted message block 72 by an inverse XOR operation between the obtained ciphertext 71 and the previously obtained key block 53, and decrypts the error detection code of the decrypted message CRC66 By calculating C67 and performing an inverse operation between the acquired converted error detection code CRC66 and the decrypted error detection code 67, the key CRC68 of the key data's error detection code is calculated. The acquired ciphertext 71 is then verified by comparing the calculated key data's error detection code CRC68 with the previously acquired key block's error detection code CRC63. This method does not burden the processing equipment on the IC card 20 that sends the ciphertext 71, and allows for verification of errors in the ciphertext 71 from the resource-limited IC card 20.

[0078] If the key data consists of 52 disposable key blocks extracted sequentially from a random number sequence, security is enhanced because the key data is disposable.

[0079] When a random number sequence is stored, and information on the starting position and block size in the random number sequence of a disposable key block is obtained, and the previously acquired key data is retrieved from the storage unit 12 of an example of a random number sequence storage means according to the information on the starting position and block size, the key data is not sent directly at the time of use, making it more resistant to interception and improving security.

[0080] If the operation is an XOR operation, the inverse operation is also an XOR operation, making it easy to perform the inverse operation.

[0081] If the error detection code is a cyclic redundancy code (CRC), it becomes easier to detect burst errors.

[0082] When key data and error detection codes for key data are acquired in advance via a secure communication channel, security is further enhanced by acquiring the key data and error detection codes for key data in advance via a secure communication channel such as quantum key distribution. [Explanation of symbols]

[0083] 10 Verification device 20 IC card (terminal device) 30. Issuing device 52, 53 Key Blocks (Key Data) 62, 63, 68 Key CRC (Error Detection Code for Key Data) 65. Plaintext CRC (Critical Reference Code for Plaintext Error Detection) 66. Conversion CRC (Conversion Error Detection Code) 67. Decoded text CRC (Error detection code for decoded text) 70 Plaintext Blocks (Plaintext) 71 Ciphertext 72 Decryption block (decryption text)

Claims

1. A ciphertext acquisition means that acquires a ciphertext encrypted by a predetermined operation between plaintext and key data, and a converted error detection code converted by the operation between the error detection code of the key data and the error detection code of the plaintext, Decryption means that generates a decrypted text by performing the inverse operation of the operation between the acquired ciphertext and the previously acquired key data, A decoding message error detection code calculation means for calculating the error detection code of the decoding message, An inverse calculation means for inversely calculating the error detection code of the key data by performing the inverse operation between the acquired conversion error detection code and the error detection code of the decoded sentence, A verification means for verifying the acquired ciphertext by comparing the error detection code of the key data calculated in reverse with the error detection code of the key data acquired in advance, A verification device characterized by comprising the following features.

2. In the verification apparatus described in claim 1, A verification device characterized in that the aforementioned key data is a disposable key block obtained sequentially from a random number sequence.

3. In the verification apparatus described in claim 2, Random number sequence storage means for storing the aforementioned random number sequence, A disposable key block information acquisition means for acquiring information on the starting position and block size of the disposable key block in the random number sequence, Furthermore, A verification device characterized in that the previously acquired key data is acquired from the random number sequence storage means according to the information of the start position and the block size.

4. In the verification apparatus according to any one of claims 1 to 3, A verification device characterized in that the aforementioned operation is an XOR operation.

5. In the verification apparatus according to any one of claims 1 to 3, A verification device characterized in that the error detection code is a cyclic redundant code.

6. In the verification apparatus according to any one of claims 1 to 3, A verification device characterized by acquiring the aforementioned pre-acquired key data and the error detection code for the aforementioned pre-acquired key data in advance via a secure communication channel.

7. The ciphertext acquisition step involves the ciphertext acquisition means acquiring a ciphertext encrypted by a predetermined operation between plaintext and key data, and a converted error detection code converted by the operation between the error detection code of the key data and the error detection code of the plaintext. The decryption means includes a decryption step in which a decrypted text is generated by performing the inverse operation of the operation between the acquired ciphertext and the previously acquired key data, The decoded text error detection code calculation means includes a decoded text error detection code calculation step that calculates an error detection code for the decoded text, The reverse calculation means includes a reverse calculation step in which the error detection code for the key data is calculated by performing the reverse operation between the acquired conversion error detection code and the error detection code for the decoded text, The verification means includes a verification step in which it verifies the acquired ciphertext by comparing the error detection code of the key data calculated in reverse with the error detection code of the key data acquired in advance, A verification method characterized by including the following.

8. Computers, A ciphertext acquisition means that acquires a ciphertext encrypted by a predetermined operation between plaintext and key data, and a converted error detection code converted by the operation between the error detection code of the key data and the error detection code of the plaintext. Decryption means that generates a decrypted text by performing the inverse operation of the operation between the acquired ciphertext and the previously acquired key data. Decoded sentence error detection code calculation means for calculating the error detection code of the decoded sentence, A reverse calculation means for reverse-calculating the error detection code of the key data by performing the reverse operation between the acquired conversion error detection code and the error detection code of the decoded sentence, and A program characterized by functioning as a verification means for verifying the acquired ciphertext by comparing the error detection code of the key data calculated in reverse with the error detection code of the key data acquired in advance.

9. A verification system comprising: an issuing device for issuing key data; a terminal device for generating encrypted ciphertext by performing a predetermined operation between the key data obtained from the issuing device and plaintext; and a verification device for verifying the ciphertext from the terminal device, The verification device, A key acquisition means that acquires the ciphertext and the converted error detection code obtained by the calculation between the error detection code of the key data and the error detection code of the plaintext from the terminal device, Decryption means that generates a decrypted text by performing the inverse operation of the operation between the acquired ciphertext and the key data previously acquired from the issuing device, A decoding message error detection code calculation means for calculating the error detection code of the decoding message, An inverse calculation means for inversely calculating the error detection code of the key data by performing the inverse operation between the acquired conversion error detection code and the error detection code of the decoded sentence, A verification means for verifying the acquired ciphertext by comparing the error detection code of the key data calculated in reverse with the error detection code of the key data previously obtained from the issuing device, A verification system characterized by having the following features.

Images