Authentication device, authentication system, and authentication method

Abstract

This authentication device comprises a first electromagnetic characteristic acquisition unit (210) that acquires recorded electromagnetic characteristics of a first apparatus being authenticated, a challenge data generation unit (220) that generates challenge data from the recorded electromagnetic characteristics, an expected value generation unit (230) that compares the recorded electromagnetic characteristics and the generated challenge data and generates a response data expected value that represents the result of comparison, a challenge data transmission unit (240) that transmits the generated challenge data to a response device, a response data reception unit (250) that receives response data pertaining to a second apparatus being authenticated from the response device, and a response data determination unit (260) that compares the generated response data expected value and the received response data and determines the genuineness of the second apparatus being authenticated. The response device compares the electromagnetic characteristics acquired from the second apparatus being authenticated and the transmitted challenge data and generates the result of comparison as response data.

Description

Authentication device, authentication system, and authentication method

[0001] The present disclosure relates to authentication technology for electronic devices.

[0002] In conventional electronic device authentication, the electromagnetic characteristics of the electronic device are measured, the measured electromagnetic characteristics are stored in advance, and then the electromagnetic characteristics of the device to be authenticated are measured and compared with the pre-stored electromagnetic characteristics to determine the authenticity of the device to be authenticated (see, for example, Patent Document 1). Also, a method has been proposed for performing authentication that focuses on the spectrum of electromagnetic waves emitted from an electronic device as the electromagnetic characteristics of the electronic device (see, for example, Non-Patent Document 1).

[0003] US Patent Application Publication No. 2010 / 0230597

[0004] Hidego Kaji et al., "Basic Study on Individual Identification Method of Electronic Devices Using Differences in Emission Spectrum Caused by Manufacturing and Mounting Variations," Technical Report of the Institute of Electronics, Information and Communication Engineers, Japan, Institute of Electronics, Information and Communication Engineers, February 20, 2019, Vol. 118, No. 457, pp. 163-167

[0005] According to the conventional technology, it is necessary to place a device that performs authentication (authentication device) near a device to be authenticated (authenticated device) and compare the electromagnetic characteristics of the authenticated device measured on the spot with the electromagnetic characteristics pre-stored in the authentication device. Furthermore, if the authentication device and the authenticated device are in different locations and authentication is to be performed via a communication network, it is necessary to send the electromagnetic characteristic data of the authenticated device to the authentication device via the communication network. When communication is performed via a communication network, if communication data on the communication network is intercepted and the electromagnetic characteristic data of the authenticated device is leaked, there is a problem that a counterfeit device may be used to masquerade as the genuine authenticated device and perform authentication.

[0006] The present disclosure has been made to solve such problems, and aims to provide an authentication technology that can prevent leakage of the electromagnetic characteristics of a device to be authenticated when authentication of the device to be authenticated is performed via a communication network.

[0007] One aspect of an authentication device according to an embodiment of the present disclosure includes a first electromagnetic characteristic acquisition unit that acquires at least one recorded electromagnetic characteristic from a storage device that pre-records the electromagnetic characteristics of a first device to be authenticated; a challenge data generation unit that generates challenge data, which is a data set corresponding to the recorded electromagnetic characteristics; an expected value generation unit that compares the recorded electromagnetic characteristics with the generated challenge data and generates a response data expected value that is the result of the comparison; a challenge data transmission unit that transmits the generated challenge data to a response device; a response data receiving unit that receives response data related to a second device to be authenticated from the response device; and a response data determination unit that compares the generated response data expected value with the received response data and determines the authenticity of the second device to be authenticated, wherein the response device compares the electromagnetic characteristics acquired from the second device to be authenticated with the transmitted challenge data and generates the result of the comparison as the response data.

[0008] According to the authentication device according to the embodiment of the present disclosure, the electromagnetic characteristics of the device to be authenticated are not transmitted or received, and therefore leakage of the electromagnetic characteristics of the device to be authenticated can be prevented.

[0009] Fig. 1 is a diagram showing an example of the configuration of an authentication system including an authentication device and a response device; Fig. 2 is a diagram showing an example of the hardware configuration of the authentication device and the response device; Fig. 3 is a flowchart of an authentication method; Fig. 4 is a diagram showing examples of electromagnetic characteristics (EMCi, EMCr), challenge data, response data, and response data expected values.

[0010] Various embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Note that components with the same or similar reference numerals in the drawings have the same or similar configurations or functions, and redundant descriptions of such components will be omitted.

[0011] First Embodiment <Configuration> (Authentication System) The configuration of an authentication system including an authentication device and a response device according to a first embodiment of the present disclosure will be described with reference to Figures 1 and 2. The authentication system according to the present disclosure is a system that authenticates the authenticity of a device to be authenticated (second device to be authenticated) 100. In other words, the device to be authenticated 100 is a device that requests authentication. The device to be authenticated 100 has inherent electromagnetic characteristics (EMC: electromagnetic characteristics). Hereinafter, the inherent electromagnetic characteristics EMC will be referred to as electromagnetic characteristics EMCi, using the initial letter of "inherent," which means "inherent."

[0012] The device to be authenticated 100 has different electromagnetic characteristics EMCi due to manufacturing errors of individual components, printed wiring boards, assembly errors, etc., even if it is manufactured with the same design as other devices to be authenticated (not shown). Examples of such electromagnetic characteristics EMCi include radiative electromagnetic noise radiated into the air by the operation of the device to be authenticated 100, and conductive electromagnetic noise that is conducted through a cable when the device to be authenticated 100 is operating. Another example of electromagnetic characteristics EMCi is the reflection characteristics (S of S parameters) observed from a specific external I / F such as the power connector or signal connector of the device to be authenticated 100, regardless of the operation (power on / off) of the device to be authenticated 100. １１ characteristics), transmission characteristics between multiple external I / Fs (S of S parameters ｎｍ The electromagnetic characteristics EMCi of the device to be authenticated 100 may be expressed on a time axis, such as the reflected waveform when a step wave or impulse wave is applied to a specific external I / F of the device to be authenticated 100, or the waveform passing through another external I / F. Furthermore, a combination of multiple electromagnetic characteristics may be used as the electromagnetic characteristics EMCi. Examples of the device to be authenticated 100 include, for example, electrical or electronic devices, or electrical or electronic components, but are not limited to these examples as long as the electromagnetic characteristics can be acquired. For example, it may be a mechanical component that does not include an electrical circuit.

[0013] In order to authenticate the authenticity of the device to be authenticated 100, as shown in Fig. 1, the authentication system according to the present disclosure includes an authentication device 200, a storage device 500, and a response device 300. Communication between the authentication device 200 and the response device 300 is performed via a wired or wireless communication network 400. The storage device 500 is a device that pre-records the electromagnetic characteristics EMCi of one or more devices to be authenticated. Hereinafter, the electromagnetic characteristics EMCi of the device to be authenticated (first device to be authenticated) recorded in the storage device 500 will be referred to as the electromagnetic characteristics EMCr, using the initial letter of registered, which means "recorded."

[0014] (Authentication Device) The authentication device 200 is a device that authenticates the authenticity of the device to be authenticated 100. To achieve this purpose, the authentication device 200 includes, as functional units, an electromagnetic characteristic acquisition unit (first electromagnetic characteristic acquisition unit) 210, a challenge data generation unit 220, an expected value generation unit 230, a challenge data transmission unit 240, a response data reception unit 250, and a response data determination unit 260.

[0015] (Electromagnetic Characteristic Acquisition Unit) The electromagnetic characteristic acquisition unit 210 is a functional unit that acquires at least one electromagnetic characteristic EMCr from the storage device 500. The electromagnetic characteristic acquisition unit 210 supplies the acquired electromagnetic characteristic EMCr to the challenge data generation unit 220 and the expected value generation unit 230. Note that the supply of data may be performed via a control unit (not shown) provided in the authentication device 200. The same applies hereinafter.

[0016] (Challenge Data Generation Unit) The challenge data generation unit 220 is a functional unit that generates challenge data according to the electromagnetic characteristics EMCr acquired by the electromagnetic characteristics acquisition unit 210. The challenge data generation unit 220 supplies the generated challenge data to the challenge data transmission unit 240 and the expected value generation unit 230.

[0017] (Expected Value Generation Unit) The expected value generation unit 230 is a functional unit that compares the electromagnetic characteristic EMCr acquired by the electromagnetic characteristic acquisition unit 210 with the challenge data generated by the challenge data generation unit 220, and generates a response data expected value that is the comparison result. The expected value generation unit 230 supplies the generated response data to the response data determination unit 260.

[0018] (Challenge Data Transmitting Unit) The challenge data transmitting unit 240 is a functional unit that transmits the challenge data generated by the challenge data generating unit 220 to the response device 300 via the communication network 400 .

[0019] (Response Data Receiving Unit) The response data receiving unit 250 is a functional unit that receives response data related to the device to be authenticated 100 generated by the response unit 300 from the response unit 300 via the communication network 400.

[0020] (Response data determination unit) The response data determination unit 260 is a functional unit that compares the response data expected value generated by the expected value generation unit 230 with the response data received by the response data receiving unit 250 to determine the authenticity of the device to be authenticated 100.

[0021] (Response Device) The response device 300 is a device that generates response data based on the electromagnetic characteristics EMCi of the device to be authenticated 100 and challenge data received from the authentication device 200, and responds to the authentication device 200 by transmitting the generated response data to the authentication device 200. To achieve this purpose, the response device 300 includes, as functional units, an electromagnetic characteristic acquisition unit (second electromagnetic characteristic acquisition unit) 310, a challenge data reception unit 320, a response data generation unit 330, and a response data transmission unit 340.

[0022] (Electromagnetic characteristic acquisition unit) The electromagnetic characteristic acquisition unit 310 is a functional unit that acquires the electromagnetic characteristic EMCi of the device to be authenticated 100. The electromagnetic characteristic acquisition unit 310 supplies the acquired electromagnetic characteristic EMCi to the response data generation unit 330. Note that the supply of data may be performed via a control unit (not shown) provided in the response device 300. The same applies hereinafter.

[0023] (Challenge Data Receiving Unit) The challenge data receiving unit 320 is a functional unit that receives challenge data from the authentication device 200 via the communication network 400. The challenge data receiving unit 320 supplies the received challenge data to the response data generating unit 330.

[0024] (Response Data Generation Unit) The response data generation unit 330 is a functional unit that generates response data by comparing the electromagnetic characteristics EMCi supplied from the electromagnetic characteristic acquisition unit 310 with the challenge data supplied from the challenge data reception unit 320. The response data generation unit 330 supplies the generated response data to the response data transmission unit 340.

[0025] (Response Data Transmitting Unit) The response data transmitting unit 340 is a functional unit that transmits the response data generated by the response data generating unit 330 to the authentication device 200 via the communication network 400 .

[0026] 1, the response device 300 may be a device different from the device to be authenticated 100, or may be integrated with the device to be authenticated 100. When the response device 300 is integrated with the device to be authenticated 100, for example, the device to be authenticated 100 includes the functional units of the response device 300.

[0027] Next, an example of the hardware configuration of the authentication device 200 and the response device 300 will be described with reference to Figures 2A and 2B. The functional units of the authentication device 200 and the response device 300 are realized by processing circuitry. The processing circuitry may be a dedicated processing circuit 600 as shown in Figure 2A, or a processor 700 that executes a program stored in a memory 800 as shown in Figure 2B.

[0028] When the processing circuitry is a dedicated processing circuit 600, the dedicated processing circuit 600 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (application specific integrated circuit), an FPGA (field-programmable gate array), or a combination thereof. The functional units of the authentication device 200 and the response device 300 may be realized by separate processing circuits, or the functional units may be collectively realized by a single processing circuit.

[0029] When the processing circuitry is a processor 700, the functional units of the authentication device 200 and the response device 300 are realized by software, firmware, or a combination of software and firmware. The software and firmware are written as programs and stored in memory 800. The processor 700 realizes the functions of each functional unit by reading and executing the programs stored in the memory. Here, examples of memory 800 include non-volatile or volatile semiconductor memory such as RAM (random access memory), ROM (read-only memory), flash memory, EPROM (erasable programmable read-only memory), and EEPROM (electrically erasable programmable read-only memory), as well as magnetic disks, flexible disks, optical disks, compact disks, minidisks, and DVDs.

[0030] It is also possible to implement some of the functional units of the authentication device 200 and the response device 300 with dedicated hardware and some with software or firmware. In this way, the processing circuit can implement each of the above-mentioned functions with hardware, software, firmware, or a combination of these.

[0031] <Operation> Next, the operation of the authentication system of the present disclosure will be described with reference to Figures 3 and 4. First, the electromagnetic characteristic EMCi of the device to be authenticated 100 is recorded in advance in the storage device 500 together with the identification information of the device to be authenticated 100. As described above, the electromagnetic characteristic EMCi of the device to be authenticated 100 recorded in the storage device 500 is referred to as the electromagnetic characteristic EMCr. The electromagnetic characteristic EMCi is recorded for each device to be authenticated that is expected to be authenticated later.

[0032] The authentication system operates in response to an authentication request for the device to be authenticated 100 from the device to be authenticated 100 or another external system (not shown) to the authentication device 200. In response to the authentication request, in step ST101, the electromagnetic characteristic acquisition unit 210 of the authentication device 200 acquires the electromagnetic characteristic EMCr of the device to be authenticated 100 from one or more electromagnetic characteristics recorded in the storage device 500.

[0033] In step ST102, the challenge data generation unit 220 generates challenge data, which is a data set corresponding to the electromagnetic characteristic EMCr. The "data set corresponding to the electromagnetic characteristic EMCr" means a data set including at least one pair (X, Y) of an X-axis value X on the X-axis of the electromagnetic characteristic EMCr and a Y-axis value Y at the X-axis value X, where the Y-axis value Y is smaller than the maximum value and larger than the minimum value of the electromagnetic characteristic EMCr in a two-dimensional graph representing the electromagnetic characteristic EMCr.

[0034] As an example, the challenge data generation unit 220 generates, as challenge data, pairs [Xn, Yn] (n is an integer) of multiple X-axis values ​​(Xn; e.g., frequency or time) of the electromagnetic characteristic EMCr and threshold values ​​for Y-axis values ​​(Yn; e.g., gain, phase, or signal waveform) at each X-axis value. When generating challenge data by combining multiple electromagnetic characteristics, the challenge data may be in the form of pairs of thresholds Y1n and Y2n of different characteristics corresponding to a common X-axis value (Xn), such as [Xn, Y1n, Y2n, ...] (n is an integer). The challenge data generation unit 220 randomly generates such challenge data each time an authentication request is issued. That is, all or part of the number n on the X-axis, the X-axis value (Xn), and the Y-axis threshold value Yn corresponding to Xn are randomly generated each time an authentication request is issued, even for the same device to be authenticated 100.

[0035] As another example, the challenge data generation unit 220 may generate, as challenge data, a set [Xn, Y] (n is an integer) of multiple X-axis values ​​Xn and a single Y-axis threshold Y that is common to the multiple X-axis values.

[0036] As another example, the challenge data generation unit 220 may generate, as challenge data, for the X-axis, multiple shared X-axis values ​​Xn, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated and shared by a common tool each time an authentication request is made, and for the Y-axis, multiple Y-axis threshold values ​​Yn that are different from each other for the multiple shared X-axis values.

[0037] As another example, the challenge data generation unit 220 may generate, as challenge data, for the X-axis, multiple shared X-axis values ​​Xn, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated and shared by a common tool each time an authentication request is made, and for the Y-axis, may generate a common and single Y-axis threshold Y for the multiple shared X-axis values.

[0038] As another example, the challenge data generation unit 220 may generate multiple X-axis values ​​Xn and some or all of the Y-axis thresholds Y or Yn for each X-axis value as random values ​​each time an authentication request occurs.

[0039] In step ST103, the expected value generation unit 230 compares the electromagnetic characteristic EMCr with the generated challenge data and generates a response data expected value, which is the result of the comparison. That is, the expected value generation unit 230 generates a response data expected value for the generated challenge data. For example, the expected value generation unit 230 compares the electromagnetic characteristic EMCr of the device to be authenticated 100 with the generated challenge data, and generates an n-bit bit string (first data) as the response data expected value, with "1" if the level of the electromagnetic characteristic EMCr corresponding to the specified Xn is Yn or higher, and "0" if it is less than Yn. Note that this method of generating response data from the electromagnetic characteristic and challenge data is also set in advance in the response data generation unit 330 of the response device 300.

[0040] In step ST104, the challenge data transmitting unit 240 transmits the challenge data to the response device 300 via the communication network 400 in parallel with or before or after the generation of the response data expected value.

[0041] The challenge data transmitted from the authentication device 200 in this manner is received by the challenge data receiving unit 320 of the response device 300 via the communication network 400 (step ST201).

[0042] In step ST202, based on the received challenge data, the electromagnetic characteristic acquisition unit 310 acquires the electromagnetic characteristic EMCi of the device to be authenticated 100. For example, it extracts the electromagnetic characteristic EMCi recorded as data in the device to be authenticated 100, measures characteristics such as S parameters using a function equivalent to a network analyzer (and performs conversions for characteristics such as F, Z, and Y parameters), or measures response characteristics to a step wave or impulse wave using a function equivalent to a signal generator and a function equivalent to an oscilloscope.

[0043] Next, in step ST203, the response data generation unit 330 compares the acquired electromagnetic characteristic EMCi of the device to be authenticated 100 to be authenticated with the received challenge data, and generates the comparison result as response data. Following the above example, similar to the operation of the expected value generation unit 230, if the level of the electromagnetic characteristic EMCi corresponding to Xn specified in the challenge data is Yn or higher, it generates an n-bit bit string (second data) as response data, with "1" if the level is less than Yn, and "0" if the level is lower than Yn. The response data generation unit 330 passes the generated response data to the response data transmission unit 340.

[0044] Next, in step ST204, the response data transmitting unit 340 transmits the generated response data to the authentication device 200 via the communication network 400.

[0045] The response data transmitted from response device 300 in this manner is received by response data receiving section 250 of authentication device 200 via communication network 400 (step ST105).

[0046] Finally, in step ST106, the response data determination unit 260 compares the response data expected value generated by the expected value generation unit 203 with the response data received by the response data reception unit 250 to determine the authenticity of the device to be authenticated 100. For example, the response data expected value of n-bit generated by the expected value generation unit 230 is compared with the n-bit response data received by the response data reception unit 250, and if there is a perfect match or a certain number of bits (for example, 85% or more of the total bits) match, the device to be authenticated is authenticated as authentic. The authentication result is transmitted to the device to be authenticated 100 that generated the authentication request or to another external system (not shown), etc.

[0047] FIG. 4 is a diagram showing examples of the electromagnetic characteristics (EMCi, EMCr), challenge data, response data, and response data expected values ​​exemplified in the above operation description.

[0048] Reference numeral 211 denotes an example of the recorded electromagnetic characteristic EMCr of the device to be authenticated, acquired by the electromagnetic characteristic acquisition unit 210 of the authentication device 200. As shown in Fig. 4, the electromagnetic characteristic EMCr is a characteristic expressed as a two-dimensional graph consisting of an X axis and a Y axis.

[0049] Reference number 221 is an example of challenge data generated by the challenge data generation unit 220 of the authentication device 200, and is shown as challenge data consisting of a set of multiple X-axis values ​​of electromagnetic characteristics (the X-axis is, for example, frequency or time) and threshold values ​​for the Y-axis values ​​on the X-axis [Xn, Yn] (n is an integer).

[0050] Reference numeral 311 denotes an example of the electromagnetic characteristic EMCi of the device to be authenticated 100 acquired by the electromagnetic characteristic acquisition unit 310 of the response device 300. As shown in Fig. 4, the electromagnetic characteristic EMCi is a characteristic expressed as a two-dimensional graph consisting of an X axis and a Y axis.

[0051] Reference numeral 331 denotes response data consisting of a 7-bit bit string generated by the response data generation unit 330 when the challenge data 221 received by the challenge data receiving unit 320 is matched with the electromagnetic characteristic 311 of the device to be authenticated 100 acquired by the electromagnetic characteristic acquisition unit 310, and the response data generation unit 330 sets the level of the unique electromagnetic characteristic 311 corresponding to Xn on the X-axis specified in the challenge data 221 to Yn or higher, and sets the level to "1" if the level is lower than Yn, and sets the level to "0" if the level is lower than Yn. In this way, the response data generation unit 330 compares the Y-axis threshold Yn with the Y-axis values ​​at the multiple X-axis values ​​Xn of the electromagnetic characteristic 311, and determines which of the Y-axis threshold Yn or the Y-axis value of the electromagnetic characteristic 311 is larger, thereby generating 7-bit data.

[0052] Reference numeral 231 denotes a response data expected value consisting of a 7-bit bit string that is generated by the expected value generation unit 230 when the electromagnetic characteristic 211 acquired by the electromagnetic characteristic acquisition unit 210 is matched with the challenge data 221 generated by the challenge data generation unit 220, and the expected value generation unit 230 sets the value to "1" if the level of the electromagnetic characteristic 211 corresponding to Xn on the X-axis specified in the challenge data 221 is Yn or higher, and sets the value to "0" if the level is less than Yn. In this way, the expected value generation unit 230 compares the Y-axis threshold Yn with the Y-axis values ​​at multiple X-axis values ​​Xn of the electromagnetic characteristic 211, and determines which of the Y-axis threshold Yn or the Y-axis value of the electromagnetic characteristic 211 is larger, thereby generating 7-bit data.

[0053] The response data 331 is received by the response data receiving unit 250 of the authentication device 200 via the communication network 400 by the response data transmitting unit 340 of the response device 300. The response data determining unit 260 compares the response data 331 with the response data expected value 231 generated by the expected value generating unit 230. If the response data 331 and the response data expected value 231 match perfectly, or if a certain number of bits match between the response data 331 and the response data expected value 231, the authentication device 200 certifies that the device to be authenticated is genuine.

[0054] As described above, when authenticating an electronic device using its unique electromagnetic characteristics, challenge data corresponding to the unique electromagnetic characteristics of the device to be authenticated is randomly generated each time an authentication request is made, transmitted via a communication network, and authentication is performed using response data corresponding to the challenge data, so authentication can be performed via a communication network. Furthermore, even if the challenge data or response data is intercepted on the communication network, the unique electromagnetic characteristics of the device are kept secret, preventing false authentication attempts due to spoofing, etc.

[0055] Second Embodiment In the second and subsequent embodiments, overlapping explanations of commonalities with the first embodiment will be omitted, and only differences from the first embodiment will be explained.

[0056] The overall configuration of an authentication system including an authentication device and a response device according to the second embodiment is as shown in FIG. 1, similar to the first embodiment.

[0057] In the second embodiment, the challenge data generation unit 220 may generate a set [Xn, Y] (n is an integer) of multiple X-axis values ​​(Xn; the X-axis represents, for example, frequency or time) of the electromagnetic characteristic EMCr and a single Y-axis threshold value (Y) that is common to the multiple X-axis values ​​as challenge data each time an authentication request occurs.

[0058] The challenge data generator 220 may randomly generate a plurality of X-axis values ​​Xn and a common single Y-axis threshold Y each time an authentication request occurs.

[0059] The expected value generating unit 230 compares the Y-axis threshold Y with the Y-axis value at multiple X-axis values ​​Xn of the electromagnetic characteristic 211 to determine which is larger: the Y-axis threshold Y or the Y-axis value of the electromagnetic characteristic 211.

[0060] The response data generation unit 330 compares the Y-axis threshold Y with the Y-axis value at multiple X-axis values ​​Xn of the electromagnetic characteristic 311 to determine which is larger: the Y-axis threshold Y or the Y-axis value of the electromagnetic characteristic 311.

[0061] By generating the challenge data in this manner, it is possible to obtain the effect of reducing the amount of challenge data compared to the first embodiment.

[0062] Third Embodiment The overall configuration of an authentication system including an authentication device and a response device according to a third embodiment is as shown in FIG. 1, similar to the first embodiment.

[0063] In the third embodiment, it is assumed that a plurality of X-axis values ​​are shared in advance between the authentication device 200 and the response device 300. The challenge data generation unit 220 acquires the shared plurality of X-axis values ​​by referring to memory. The shared plurality of X-axis values ​​may always be the same, or may be changed according to a predetermined rule each time an authentication request is generated.

[0064] When multiple X-axis values ​​are shared in this manner, the challenge data generation unit 220 may generate multiple shared X-axis values ​​Xn for the X-axis, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated and shared by a common tool each time an authentication request is made, and may generate multiple Y-axis threshold values ​​Yn that are different from each other for the multiple shared X-axis values ​​for the Y-axis.

[0065] In addition, the challenge data transmission unit 240 may transmit only the generated multiple Y-axis threshold values ​​Yn out of the multiple X-axis values ​​Xn and multiple Y-axis threshold values ​​Yn generated by the challenge data generation unit 220 as [Yn] (n is an integer).

[0066] With this configuration, it is possible to obtain the effect of further reducing the amount of challenge data compared to the second embodiment.

[0067] Fourth Embodiment The overall configuration of an authentication system including an authentication device and a response device according to a fourth embodiment is as shown in FIG. 1, similar to the first embodiment.

[0068] In the fourth embodiment, it is assumed that a plurality of X-axis values ​​are shared in advance between the authentication device 200 and the response device 300. The challenge data generation unit 220 acquires the shared plurality of X-axis values ​​by referring to memory. The shared plurality of X-axis values ​​may always be the same, or may be changed according to a certain rule each time an authentication request occurs.

[0069] When multiple X-axis values ​​are shared in this manner, the challenge data generation unit 220 may generate multiple shared X-axis values ​​Xn for the X-axis, which are fixed values ​​shared in advance between the authentication device 200 and the response device 300, or variable values ​​generated and shared using a common tool each time an authentication request is made, and may generate a common and single Y-axis threshold Y for the shared multiple X-axis values ​​Xn for the Y-axis.

[0070] Furthermore, the challenge data transmitting unit 240 may transmit only the generated single Y-axis threshold Y from among the generated multiple X-axis values ​​Xn and the single Y-axis threshold Y as [Y].

[0071] This configuration has the effect of significantly reducing the amount of challenge data.

[0072] Fifth Embodiment The overall configuration of an authentication system including an authentication device and a response device according to a fifth embodiment is as shown in FIG. 1, similar to the first embodiment.

[0073] In the fifth embodiment, the challenge data generator 220 may randomly generate a Y-axis threshold value for the X-axis value of the electromagnetic characteristic EMCr outside a certain percentage range, for example, outside a range of ±10% of the Y value of the electromagnetic characteristic EMCr. The challenge data generators 220 in the first to third embodiments may also generate a Y-axis threshold value outside a certain percentage range.

[0074] This provides the effect of reducing the influence on threshold determination even if the electromagnetic characteristics EMCi change slightly due to environmental changes or deterioration over time.

[0075] Sixth Embodiment The overall configuration of an authentication system including an authentication device and a response device according to a sixth embodiment is as shown in FIG. 1, similar to the first embodiment.

[0076] In the sixth embodiment, the expected value generation unit 230 and the response data generation unit 330 may perform an operation according to a predetermined rule on a bit string resulting from a comparison of the generated X-axis value with a Y-axis threshold, and use the result as response data. For example, the expected value generation unit 230 and the response data generation unit 330 may encode or encrypt the bit string resulting from the comparison. The expected value generation unit 230 and the response data generation unit 330 in the first to fifth embodiments may operate in a similar manner.

[0077] This has the effect of making it difficult to estimate the electromagnetic characteristics EMCi or EMCr of the device to be authenticated even if the challenge data and response data are intercepted multiple times.

[0078] It is possible to combine the embodiments, and to modify or omit each embodiment as appropriate.

[0079] The authentication system of the present disclosure can be used as an authentication system for a device to be authenticated via a communication network.

[0080] 100 Authentication target device, 200 Authentication device, 203 Expected value generation unit, 210 Electromagnetic characteristic acquisition unit (first electromagnetic characteristic acquisition unit), 211 Electromagnetic characteristic EMCr, 220 Challenge data generation unit, 221 Challenge data, 230 Expected value generation unit, 231 Response data expected value, 240 Challenge data transmission unit, 250 Response data reception unit, 260 Response data determination unit, 300 Response device, 310 Electromagnetic characteristic acquisition unit (second electromagnetic characteristic acquisition unit), 311 Electromagnetic characteristic EMCi, 320 Challenge data reception unit, 330 Response data generation unit, 331 Response data, 340 Response data transmission unit, 400 Communication network, 500 Storage device, 600 Processing circuit, 700 Processor, 800 Memory.

Claims

1. a challenge data generating unit that generates challenge data, which is a data set according to at least one electromagnetic characteristic of a first device to be authenticated, the challenge data being acquired from the first device to be authenticated; an expected value generating unit that compares the electromagnetic characteristic of the first device to be authenticated with the challenge data generated by the challenge data generating unit, and generates a response data expected value that is a result of the comparison; a response data determination unit that compares the response data expected value generated by the expected value generation unit with response data related to a second device to be authenticated transmitted from a response device, and determines authenticity of the second device to be authenticated; Equipped with transmitting the challenge data generated by the challenge data generation unit to the response device; receiving, from the response device, a result of a comparison between the electromagnetic characteristics of the second device to be authenticated acquired from the second device to be authenticated and the challenge data transmitted, as the response data; the electromagnetic characteristics of the first device to be authenticated and the electromagnetic characteristics of the second device to be authenticated are characteristics expressed as a two-dimensional graph having an X-axis and a Y-axis, The challenge data is generated as a set [Xn, Yn] (n is an integer) of a plurality of X-axis values ​​Xn and a Y-axis threshold value Yn at each X-axis value. Authentication device.

2. The Y-axis threshold Yn of the challenge data is a common and single Y-axis threshold Y for the multiple X-axis values.

2. The authentication device according to claim 1.

3. An authentication device as described in claim 1, The challenge data generation unit: For the X-axis, the authentication device and the response device generate a plurality of shared X-axis values ​​Xn, which are fixed values ​​shared in advance or variable values ​​generated by a common tool and shared each time an authentication request is made; generating a plurality of different Y-axis thresholds Yn for the shared plurality of X-axis values ​​with respect to the Y-axis; The authentication device transmits only the generated Y-axis threshold values ​​Yn out of the generated X-axis values ​​Xn and Y-axis threshold values ​​Yn as [Yn] (n is an integer).

2. The authentication device according to claim 1.

4. An authentication device as described in claim 1, The challenge data generation unit: For the X-axis, the authentication device and the response device generate a plurality of shared X-axis values ​​Xn, which are fixed values ​​shared in advance or variable values ​​generated by a common tool and shared each time an authentication request is made; generating a common and single Y-axis threshold Y for the shared multiple X-axis values ​​Xn for the Y-axis; The authentication device transmits only the generated single Y-axis threshold value Y as [Y] among the generated multiple X-axis values ​​Xn and the single Y-axis threshold value Y.

2. The authentication device according to claim 1.

5. A part or all of the plurality of X-axis values ​​Xn and the Y-axis threshold value Y or Yn at each X-axis value are generated as random values ​​every time an authentication request is generated. An authentication device according to any one of claims 1 to 4.

6. The electromagnetic characteristics of the first authenticated device acquired from the first authenticated device include two electromagnetic characteristics, The challenge data generation unit: generating a plurality of X-axis values ​​Xn and a Y-axis threshold Y or Yn at the plurality of X-axis values ​​Xn for each of the two or more electromagnetic characteristics, and generating a combination of the X-axis value Xn and the Y-axis threshold Y or Yn as the challenge data; 6. An authentication device according to claim 5.

7. the expected value generating unit compares the Y-axis threshold Yn or Y with a Y-axis value in the multiple X-axis values ​​Xn of the electromagnetic characteristic of the first device to be authenticated, and determines which of the Y-axis threshold Yn or Y and the Y-axis value of the electromagnetic characteristic of the first device to be authenticated is larger, thereby generating n-bit first data; the response device compares the Y-axis threshold Yn or Y with the Y-axis value of the multiple X-axis values ​​Xn of the electromagnetic characteristic of the second device to be authenticated, and determines which of the Y-axis threshold Yn or Y and the Y-axis value of the electromagnetic characteristic of the second device to be authenticated is larger, thereby generating n-bit second data; 7. An authentication device according to claim 6.

8. the expected value generation unit compares the Y-axis threshold Yn or Y with a Y-axis value in the multiple X-axis values ​​Xn of the electromagnetic characteristic of the first device to be authenticated, determines which of the Y-axis threshold Yn or Y and the Y-axis value of the electromagnetic characteristic of the first device to be authenticated is larger, generates n-bit first data, and performs a predetermined operation on the generated first data; the response device compares the Y-axis threshold value Yn or Y with the Y-axis value of the multiple X-axis values ​​Xn of the electromagnetic characteristic of the second device to be authenticated, determines which of the Y-axis threshold value Yn or Y and the Y-axis value of the electromagnetic characteristic of the second device to be authenticated is larger, generates n-bit second data, and performs the predetermined calculation on the generated second data.

7. An authentication device according to claim 6.

9. An authentication device according to claim 1; A response device according to claim 1; An authentication system comprising: The response device is a response data generating unit that compares an electromagnetic characteristic of the second device to be authenticated acquired from the second device to be authenticated with the challenge data transmitted from the authentication device, and generates a result of the comparison as the response data; Equipped with Authentication system.

10. 10. The authentication system according to claim 9, wherein the response device and the second authenticated device are integrated together.

11. An authentication method performed by an authentication system including an authentication device having a challenge data generation unit, an expectation value generation unit, and a response data determination unit, and a response device having a response data generation unit, comprising: A step in which the challenge data generation unit of the authentication device generates challenge data, which is a data set according to at least one electromagnetic characteristic of a first authenticated device acquired from the first authenticated device; the expected value generating unit of the authentication device compares the electromagnetic characteristic of the first device to be authenticated with the challenge data generated by the challenge data generating unit to generate a response data expected value that is a result of the comparison; a step of the authentication device transmitting the challenge data generated by the challenge data generation unit to the response device; the response data generating unit of the response device comparing the electromagnetic characteristics of the second device to be authenticated acquired from the second device to be authenticated with the challenge data transmitted from the authentication device, and generating a result of the comparison as response data; a step of the response device transmitting the response data generated by the response data generation unit to the authentication device; the response data determination unit of the authentication device comparing the response data expected value generated by the expected value generation unit with the response data transmitted from the response device to determine authenticity of the second device to be authenticated; Equipped with the electromagnetic characteristics of the first device to be authenticated and the electromagnetic characteristics of the second device to be authenticated are characteristics expressed as a two-dimensional graph having an X-axis and a Y-axis, The challenge data is generated as a set [Xn, Yn] (n is an integer) of a plurality of X-axis values ​​Xn and a Y-axis threshold value Yn at each X-axis value. Authentication method.

12. The Y-axis threshold Yn of the challenge data is a common and single Y-axis threshold Y for the multiple X-axis values.

12. The authentication method according to claim 11.

13. The challenge data generation unit: For the X-axis, the authentication device and the response device generate a plurality of shared X-axis values ​​Xn, which are fixed values ​​shared in advance or variable values ​​generated by a common tool and shared each time an authentication request is made; generating a plurality of different Y-axis thresholds Yn for the shared plurality of X-axis values ​​with respect to the Y-axis; The authentication device transmits only the generated Y-axis threshold values ​​Yn out of the generated X-axis values ​​Xn and Y-axis threshold values ​​Yn as [Yn] (n is an integer).

12. The authentication method according to claim 11.

14. The challenge data generation unit: For the X-axis, the authentication device and the response device generate a plurality of shared X-axis values ​​Xn, which are fixed values ​​shared in advance or variable values ​​generated by a common tool and shared each time an authentication request is made; generating a common and single Y-axis threshold Y for the shared multiple X-axis values ​​Xn for the Y-axis; The authentication device transmits only the generated single Y-axis threshold value Y as [Y] among the generated multiple X-axis values ​​Xn and the single Y-axis threshold value Y.

12. The authentication method according to claim 11.

15. A part or all of the plurality of X-axis values ​​Xn and the Y-axis threshold value Y or Yn at each X-axis value are generated as random values ​​every time an authentication request is generated. An authentication method according to any one of claims 11 to 14.

16. The electromagnetic characteristics of the first authenticated device acquired from the first authenticated device include two electromagnetic characteristics, The challenge data generation unit: generating a plurality of X-axis values ​​Xn and a Y-axis threshold Y or Yn at the plurality of X-axis values ​​Xn for each of the two or more electromagnetic characteristics, and generating a combination of the X-axis value Xn and the Y-axis threshold Y or Yn as the challenge data; 16. The authentication method according to claim 15.

17. the expected value generating unit compares the Y-axis threshold Yn or Y with a Y-axis value in the multiple X-axis values ​​Xn of the electromagnetic characteristic of the first device to be authenticated, and determines which of the Y-axis threshold Yn or Y and the Y-axis value of the electromagnetic characteristic of the first device to be authenticated is larger, thereby generating n-bit first data; the response data generation unit compares the Y-axis threshold Yn or Y with a Y-axis value in the multiple X-axis values ​​Xn of the electromagnetic characteristic of the second device to be authenticated, and determines which of the Y-axis threshold Yn or Y and the Y-axis value of the electromagnetic characteristic of the second device to be authenticated is larger, thereby generating n-bit second data.

17. The authentication method according to claim 16.

18. the expected value generation unit compares the Y-axis threshold Yn or Y with a Y-axis value in the multiple X-axis values ​​Xn of the electromagnetic characteristic of the first device to be authenticated, determines which of the Y-axis threshold Yn or Y and the Y-axis value of the electromagnetic characteristic of the first device to be authenticated is larger, generates n-bit first data, and performs a predetermined operation on the generated first data; the response data generation unit compares the Y-axis threshold Yn or Y with a Y-axis value in the multiple X-axis values ​​Xn of the electromagnetic characteristic of the second device to be authenticated, determines which of the Y-axis threshold Yn or Y and the Y-axis value of the electromagnetic characteristic of the second device to be authenticated is larger, generates n-bit second data, and performs the predetermined calculation on the generated second data.

17. The authentication method according to claim 16.