Communication terminal, data processing method, and program

Abstract

A communication terminal according to the present invention includes: a calculation unit that is external to a secure element, executes number-theoretic transforms and operations of a Ring-LWE scheme not using a secret key, and transmits transformed data to the secure element and an integrated circuit (IC) card; and the secure element that executes inverse conversion of number-theoretic transforms and operations of a Ring-LWE scheme using the number-theoretic transform processed data and a secret key, converts the inverse-converted data to a hash value, and outputs the converted data outside of the secure element.

Description

Communication terminal, data processing method, and program

[0001] The present disclosure relates to a communication terminal, a data processing method, and a program.

[0002] Conventionally, when performing decryption processing using a private key on a communication terminal, the private key is stored inside a secure element (hereinafter also referred to as SE) and the decryption processing is performed on the SE (Non-Patent Document 1). This is to prevent the private key from being stolen by an attacker.

[0003] However, if a communications terminal is stolen, even if the private key in the SE is unknown, the SE itself may be used to perform the decryption process, allowing an attacker to decrypt confidential information and leak it.

[0004] In contrast to this, there is a conventional technique in which an IC card 920 is used to authenticate a secure element 910, and once authentication is successful, decryption processing is performed on the secure element 910, as shown in FIG.

[0005] Schlapfer, T., & Rust, A. (2019). Security on IoT devices with secure elements. In Embedded World Conference, Nuremberg, Germany, 26-28 Februar 2019. WEKA.

[0006] An example of authentication processing on an IC card is electronic signature, but the signature processing takes longer than the signature verification processing or decryption processing. When electronic signatures are used on an IC card, the processing time is longer, and the applicable applications are limited.

[0007] Therefore, an object of the present disclosure is to provide a communication terminal that can improve security without increasing the processing costs of the SE and IC card.

[0008] The communication terminal of the present disclosure includes a computing unit, a secure element, and an IC card.

[0009] The calculation unit is located outside the secure element and IC card and performs Ring-LWE calculations and number theoretic transformations without using a private key, and transmits the transformed data to the secure element and IC card. The secure element performs Ring-LWE calculations and inverse number theoretic transformations using the number theoretic transformed data and a first private key, which is one of the divided private keys, adds a random number within a predetermined range to the inverse transformed data, and outputs the resulting data outside the secure element. The IC card performs Ring-LWE calculations and inverse number theoretic transformations using the number theoretic transformed data and a second private key, which is the other of the divided private keys, adds a random number within a predetermined range to the inverse transformed data, and outputs the resulting data outside the IC card. The calculation unit adds the output from the secure element and the output from the IC card, compresses it, and converts the compressed data into a hash value.

[0010] According to the communication terminal of the present disclosure, security can be improved without increasing the processing costs of the SE and IC card.

[0011] Fig. 1 is a diagram showing an example of authenticating an SE using an IC card in a conventional communication terminal. Fig. 2 is a diagram showing calculations in the SE, IC card, and calculation unit in the communication terminal of embodiment 1. Fig. 3 is a flowchart showing the operation of the communication terminal of embodiment 1. Fig. 4 is a block diagram showing the functional configuration of the calculation unit, SE, and IC card of embodiment 1. Fig. 5 is a sequence diagram showing the operations of the calculation unit, SE, and IC card of embodiment 1. Fig. 6 is a diagram showing an example of the functional configuration of a computer.

[0012] Hereinafter, embodiments of the present disclosure will be described in detail. Note that components having the same functions are assigned the same numbers, and redundant explanations will be omitted.

[0013] The communication terminal of the first embodiment is intended for decryption processing using a private key. The encryption method is assumed to be Ring-LWE lattice cryptography, which is a quantum-computer-resistant cryptography. The communication terminal of the first embodiment can decrypt secret information only by using both the SE and the IC card. The communication terminal of the first embodiment splits a private key into two parts, stores one of the split keys (hereinafter also referred to as the first private key) in the SE within the communication terminal, and stores the other of the split keys (hereinafter also referred to as the second private key) in the IC card. Using these split keys, both the IC card and the SE perform part of the decryption processing, and the output results are combined to obtain the decryption result. If the private key can be inferred from the outputs of both the IC card and the SE, there is a possibility that decryption could be performed even without the IC card after the communication terminal itself is stolen. Therefore, a process is added that prevents the private key from being inferred from the output results.

[0014] As shown in Fig. 2, the communication terminal 11 of the first embodiment includes a secure element 110, an arithmetic unit 115, and an IC card 120. As shown in the figure, the arithmetic unit 115 is located outside the secure element 110 and the IC card 120, and performs Ring-LWE arithmetic and number theoretic transformation without using a private key, and transmits the converted data to the secure element 110 and the IC card 120 (step S1 in Fig. 3). The secure element 110 performs Ring-LWE arithmetic and inverse transformation of the number theoretic transformation using the number theoretic transformed data and a first private key that is one of the divided private keys, adds a random number within a predetermined range of values ​​to the inverse transformed data, and outputs the added data to the outside of the secure element 110 (step S2 in Fig. 3). The IC card 120 performs a Ring-LWE calculation using the number-theoretic transformed data and the second private key, which is the other divided part of the private key, and an inverse transformation of the number-theoretic transformation, adds a random number within a predetermined range of values ​​to the inversely transformed data, and outputs the added data to the outside of the IC card 120 (step S3 in FIG. 3). The calculation unit 115 adds and compresses the output from the secure element 110 and the output from the IC card 120, and converts the compressed data into a hash value (step S4 in FIG. 3).

[0015] More specifically, the communication terminal 11 of this embodiment can be implemented using, for example, the CRYSTALS-Kyber algorithm. When implemented using the CRYSTALS-Kyber algorithm, as shown in FIG. 4 , the calculation unit 115 includes a decompression unit 111, a number theoretic transformation unit 112, a data transmission unit 113, a compression unit 114, and a hash value conversion unit 110. The secure element 110 includes a product calculation unit 1101, an inverse transformation unit 1102, a random number generation unit 1103, an addition unit 1104, and a data output unit 1105. The IC card 120 includes a product calculation unit 1201, an inverse transformation unit 1202, a random number generation unit 1203, an addition unit 1204, and a data output unit 1205.

[0016] In this embodiment, the communication terminal 91, which is the communication partner of the communication terminal 11, transmits CRYSTALS-Kyber public key information u, v, authentication information crt, and count information cnt to the communication terminal 11 (S91, FIG. 5).

[0017] The Ring-LWE problem requires that the value shared with the attacker be different each time (otherwise, a Reply attack will occur). Therefore, to ensure that the value is different each time, count information cnt is added to the data sent by the communication terminal 91. cnt is an integer value that the communication terminal 91 counts up each time and sends it to the communication terminal 11. The secure element 110 and IC card 120 store the previous cnt and will not accept count information unless it exceeds the stored cnt value.

[0018] The operation of each component will be described below with reference to FIG.

[0019] <Decompression Unit 111> The decompression unit 111 receives the public key information u, v, the authentication information crt, and the count information cnt from the communication terminal 91. The decompression unit 111 decompresses the CRYSTALS-Kyber public key information u, v (S111, formulas (1) and (2)). The decompressed public key information is denoted as u' and v'.

[0020] <Number Theoretic Transformation Unit 112> The number theoretic transformation unit 112 performs number theoretic transformation on the decompressed public key information u' (S112, equation (3)). The public key information that has undergone number-theoretic transformation is denoted as u”.

[0021] <Data Transmission Unit 113> The data transmission unit 113 transmits the number-theoretically transformed public key information u", the decompressed public key information v', the authentication information crt, and the count information cnt to the secure element 110 and the IC card 120 (S113). The operation of the secure element 110 is as follows.

[0022] <Product Calculation Unit 1101> The product calculation unit 1101 receives the number-theoretically transformed public key information u", the decompressed public key information v', the authentication information crt, and the count information cnt, verifies that u" and v' have been sent from the target communication terminal 91 based on the authentication information crt, verifies the count information cnt, and calculates the product of u" and the first private key sk1 (S1101, equation (4)). The product of the number-theoretically transformed public key information u″ and the first private key sk1 is denoted as mp″.

[0023] The private key sk is split into a first private key sk1 and a second private key sk2 so that sk = sk1 + sk2, and these are pre-stored in the secure element 110 and the IC card 120, respectively. Examples include a method using a secret sharing scheme and a method utilizing the properties of Kyber's private key. When the properties of Kyber's private key are used, sk = sk1 + sk2 is realized by setting sk1 = (u1, 0, 0) and sk2 = (0, u2, u3) for the Kyber private key format sk = (u1, u2, u3). <Inverse Transformation Unit 1102> The inverse transformation unit 1102 performs an inverse transformation of the number theoretic transformation on the product mp″ (S1102, equation (5)). The inversely transformed value is denoted as mp'.

[0024] <Random Number Generation Unit 1103> The random number generation unit 1103 generates a random number b within a predetermined range of values ​​(S1103). For example, the random number generation unit 1103 generates a set β of values ​​in a normal distribution as shown in Equation (6). η The random number b may be generated by randomly selecting a value from <Addition Unit 1104> The addition unit 1104 subtracts the inversely transformed value mp' from the decompressed public key information v', and adds the random number b (S1104). The value after adding the random number b is denoted as mp.

[0025] Step S1104 (and step S1204 described later) is an operation intended to add a small value to the result of the inverse transformation, and the random number b to be added (random number b2 described later) is generated randomly so as to follow, for example, a normal distribution (binomial distribution) centered at 0. This prevents the secret key from leaking from the output result under the Ring-LWE assumption.

[0026] <Data Output Unit 1105> The data output unit 1105 outputs mp to the outside of the secure element 110 (S1105). The operation of the IC card 120 will be described below.

[0027] <Product Calculation Unit 1201> The product calculation unit 1201 receives the number-theoretically transformed public key information u", the decompressed public key information v', the authentication information crt, and the count information cnt, verifies that u" and v' have been sent from the target communication terminal 91 based on the authentication information crt, verifies the count information cnt, and calculates the product of u" and the second private key sk2 (S1201, equation (8)). The product of the number-theoretically transformed public key information u" and the second secret key sk2 is denoted as mp2". As described above, the second secret key sk2 is stored in the IC card 120 in advance.

[0028] <Inverse Transformation Unit 1202> The inverse transformation unit 1202 performs an inverse transformation of the number theoretic transformation on the product mp2″ (S1202, equation (9)). The inversely converted value is denoted as mp2'.

[0029] <Random Number Generation Unit 1203> The random number generation unit 1203 generates a random number b2 within a predetermined range of values ​​(S1203). For example, the random number generation unit 1203 generates a set β of normally distributed values ​​in the same way as in step S1103. η The random number b2 may be generated by randomly selecting a value from (Equation 10). <Adder 1204> The adder 1204 inverts the sign of mp2' and adds the random number b2 (S1204, equation (11)). The value after adding the random number b2 is denoted as mp2.

[0030] <Data Output Unit 1205> The data output unit 1205 outputs the mp2 to the outside of the IC card 120 (S1205). The operation of the calculation unit 115 will be described below.

[0031] <Compression Unit 114> The compression unit 114 adds and compresses the output mp from the secure element 110 and the output mp2 from the IC card 120 (S114, equation (12)). The value in parentheses to the right of Compress represents the number of bits of the compressed result. According to equation (12), mp+mp2 is compressed to 1 bit. The compressed value is denoted as m.

[0032] <Hash Value Converter 110> The hash value converter 110 converts the compressed value m into a hash value and outputs it (S110, equation (13)). The hash value of value m is denoted as G(m).

[0033] According to the communication terminal 11 of this embodiment, only public information is used in the decryption process that handles the private key of the Ring-LWE method, and number theoretic transformations (NTT), which have a high processing cost, are calculated outside the secure element 110 and the IC card 120. This makes it possible to reduce the processing time by reducing the number of processes that need to be executed on the secure element 110 and the IC card 120 while preventing the private key from leaking.

[0034] Furthermore, according to the communication terminal 11 of this embodiment, the private key is divided and stored in the secure element 110 and the IC card 120, and the processing is divided, so that even if the communication terminal 11 is stolen and the SE is used, data is prevented from being decrypted, thereby improving security.

[0035] <Additional Notes> The device disclosed herein may, for example, be a single hardware entity that includes an input unit to which a keyboard or the like can be connected, an output unit to which an LCD display or the like can be connected, a communication unit to which a communication device (e.g., a communication cable) capable of communicating with an external device of the hardware entity can be connected, a CPU (which may also include a central processing unit, cache memory, registers, etc.), memories such as RAM and ROM, an external storage device such as a hard disk, and buses connecting these input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so as to enable data exchange. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing recording media such as a CD-ROM. An example of a physical entity equipped with such hardware resources is a general-purpose computer.

[0036] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required for processing these programs (the programs may be stored in a ROM, which is a read-only storage device, for example, instead of an external storage device). Data obtained by processing these programs is stored in RAM, the external storage device, etc. as appropriate.

[0037] In a hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as needed, and interpreted, executed, and processed by the CPU as appropriate, resulting in the CPU realizing a predetermined function (each component represented as a unit, means, etc.).

[0038] The present disclosure is not limited to the above-described embodiments, and modifications can be made as appropriate without departing from the spirit of the present disclosure. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capabilities of the devices that execute the processes or as needed.

[0039] As described above, when the processing functions of the hardware entities (apparatuses of the present disclosure) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program, and the processing functions of the hardware entities are realized on the computer by executing this program.

[0040] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 6, and operating the control unit 10010, input unit 10030, output unit 10040, etc.

[0041] The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories. Specifically, examples of magnetic recording devices include hard disk drives, flexible disks, and magnetic tapes; optical disks include DVDs (Digital Versatile Discs), DVD-RAMs (Random Access Memory), CD-ROMs (Compact Disc Read Only Memory), and CD-Rs (Recordable / Rewritable) / RWs; magneto-optical recording media include MOs (Magneto-Optical Discs), and semiconductor memories include EEP-ROMs (Electrically Erasable and Programmable-Read Only Memory).

[0042] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0043] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with each program transferred from the server computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. In this embodiment, the program includes information used for processing by a computer that is equivalent to a program (e.g., data that is not a direct instruction to the computer but has properties that define computer processing).

[0044] In addition, in this embodiment, a hardware entity is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. A communications terminal comprising: a calculation unit that is external to a secure element and an IC card and performs Ring-LWE calculations and number theoretic transformations without using a private key, and transmits the converted data to the secure element and the IC card; a secure element that performs Ring-LWE calculations and an inverse transformation of the number theoretic transformation using the number theoretic transformed data and a first private key that is one of the divided private keys, adds a random number within a predetermined value range to the inverse transformed data, and outputs the added data to the outside of the secure element; and an IC card that performs Ring-LWE calculations and an inverse transformation using the number theoretic transformed data and a second private key that is the other of the divided private keys, adds a random number within a predetermined value range to the inverse transformed data, and outputs the added data to the outside of the IC card, wherein the calculation unit adds the output from the secure element and the output from the IC card, compresses them, and converts the compressed data into a hash value.

2. A communications terminal according to claim 1, wherein the calculation unit includes: a decompression unit that decompresses CRYSTALS-Kyber public key information; a number theoretic transformation unit that performs number theoretic transformation on the decompressed public key information; and a data transmission unit that transmits the number theoretic transformed public key information to the secure element and the IC card.

3. A communications terminal as claimed in claim 2, wherein the secure element includes: a product calculation unit which calculates the product of the number-theoretically transformed public key information and the first private key; an inverse transformation unit which performs an inverse transformation of the number-theoretic transformation on the product; a random number generation unit which generates a random number within a prescribed range of values; an addition unit which adds the random number to the inversely transformed value; and a data output unit which outputs the value obtained by adding the random number to the secure element; and the IC card includes: a product calculation unit which calculates the product of the number-theoretically transformed public key information and the second private key; an inverse transformation unit which performs an inverse transformation of the number-theoretic transformation on the product; a random number generation unit which generates a random number within a prescribed range of values; an addition unit which adds the random number to the inversely transformed value; and a data output unit which outputs the value obtained by adding the random number to the IC card.

4. A data processing method executed by a communications terminal, comprising: steps executed by a calculation unit external to a secure element and an IC card, performing Ring-LWE calculation and number theoretic transformation without using a private key, and transmitting the converted data to the secure element and the IC card; steps executed by the secure element, performing Ring-LWE calculation and inverse transformation of the number theoretic transformation using the number theoretic transformed data and a first private key that is one of the divided private keys of the private key, adding a random number within a predetermined value range to the inverse transformed data, and outputting the added data to outside the secure element; steps executed by the IC card, performing Ring-LWE calculation and inverse transformation of the number theoretic transformation using the number theoretic transformed data and a second private key that is the other of the divided private key, adding a random number within a predetermined value range to the inverse transformed data, and outputting the added data to outside the IC card; and steps executed by the calculation unit, adding and compressing the output from the secure element and the output from the IC card, and converting the compressed data into a hash value.

5. A program for causing a computer to function as the communication terminal according to any one of claims 1 to 3.

Images