Communication terminal, data processing method, and program

Abstract

This communication terminal comprises: an operation unit which is located outside a secure element and in which a Ring-LWE operation and a number theoretic transform that do not use a secret key, and transmission processing of the transformed data to the secure element are executed; and the secure element in which inverse transforms of the Ring-LWE operation and the number theoretic transform that use data subjected to number theoretic transform processing and the secret key are executed, and then transform of the inverse-transformed data into a hash value is performed to output the transformed data to the outside of the secure element.

Description

Communication terminal, data processing method, and program

[0001] The present disclosure relates to a communication terminal, a data processing method, and a program.

[0002] In authenticated key exchange, leakage of the private key compromises its security (identity verification, confidentiality of information, etc.). Conventionally, to prevent the private key from being leaked to the outside, the private key has been stored in a secure element (hereinafter referred to as SE) installed in the communication terminal, and authenticated key exchange has been performed on the SE.

[0003] Schlapfer, T., & Rust, A. (2019). Security on IoT devices with secure elements. In Embedded World Conference, Nuremberg, Germany, 26-28 Februar 2019. WEKA.

[0004] Generally, processing in an SE takes longer than processing in the communications terminal itself. Therefore, if all calculations related to key exchange (CPA.Dec1, CPA.Dec2, CPA.Dec3, ...) were to be performed on a secure element 910 in a conventional communications terminal 91, as shown in Figure 1, the processing time would be long and the applicable applications would be limited.

[0005] Therefore, an object of the present disclosure is to provide a communication terminal that can reduce the amount of processing executed on an SE.

[0006] The communications terminal of the present disclosure includes a calculation unit and a secure element. The calculation unit is located outside the secure element and performs Ring-LWE calculations and number theoretic transformations that do not use a private key, and transmits the transformed data to the secure element. The secure element performs Ring-LWE calculations and number theoretic transformations that use the number theoretic transformed data and a private key, and performs an inverse transformation of the number theoretic transformation, converts the inverse transformed data into a hash value, and outputs the transformed data to outside the secure element.

[0007] According to the communication terminal of the present disclosure, it is possible to reduce the amount of processing executed on the SE.

[0008] FIG. 1 is a diagram showing an example in which all calculations related to key exchange are performed on an SE in a conventional communication terminal. FIG. 2 is a diagram showing an example of calculations on the SE and calculations outside the SE in a communication terminal of embodiment 1. FIG. 3 is a flowchart showing the operation of the communication terminal of embodiment 1. FIG. 4 is a block diagram showing the functional configuration of a calculation unit and an SE of embodiment 1. FIG. 5 is a sequence diagram showing the operation of the calculation unit and an SE of embodiment 1. FIG. 6 is a block diagram showing the functional configuration of a calculation unit and an SE of embodiment 2. FIG. 7 is a sequence diagram showing the operation of the calculation unit and an SE of embodiment 2. FIG. 8 is a diagram showing an example of the functional configuration of a computer.

[0009] Hereinafter, embodiments of the present disclosure will be described in detail. Note that components having the same functions are assigned the same numbers, and redundant explanations will be omitted.

[0010] The communication terminal of Example 1 targets decryption processing using a private key. The encryption method is assumed to be Ring-LWE lattice cryptography, which is a quantum-computer-resistant cryptography. The communication terminal of Example 1 executes everything from processing using a private key to irreversible processing (processing in which the input cannot be calculated backward from the output) on the SE, thereby utilizing the resources of the communication terminal and implementing decryption processing on the SE while maintaining the security of preventing an attacker outside the SE from guessing the private key. Since conventional CPA-secure decryption processing does not include irreversible processing, the required security is achieved by adding irreversible processing.

[0011] As shown in Fig. 2, the communication terminal 11 of the first embodiment includes a secure element 110 and an arithmetic unit 115. As shown in Fig. 2, the arithmetic unit 115 is located outside the secure element 110, and as shown in Fig. 3, the arithmetic unit 115 performs Ring-LWE arithmetic and number theoretic transformation without using a private key, and transmits the transformed data to the secure element 110 (S115, CPA.Dec1, CPA.Dec2, ...). The secure element 110 performs Ring-LWE arithmetic and number theoretic transformation using a private key and the data that has been number theoretic transformed, converts the transformed data into a hash value, and outputs the transformed data to the outside of the secure element 110 (S110, CPA.Dec3, CPA.Dec4, ...).

[0012] More specifically, the communication terminal 11 of this embodiment can be implemented using, for example, the CRYSTALS-Kyber algorithm. When implemented using the CRYSTALS-Kyber algorithm, as shown in Fig. 4, the calculation unit 115 includes a decompression unit 111, a number theoretic transformation unit 112, a data transmission unit 113, and a data storage unit 114, and the secure element 110 includes a product calculation unit 1101, an inverse transformation unit 1102, an addition unit 1103, a compression unit 1104, a hash value conversion unit 1105, and a data output unit 1106.

[0013] In this embodiment, the communication terminal 91, which is the communication partner of the communication terminal 11, transmits CRYSTALS-Kyber public key information u, v and authentication information crt to the communication terminal 11 (S91, FIG. 5). The operation of each component will be described below with reference to FIG.

[0014] <Decompression Unit 111> The decompression unit 111 receives the public key information u, v and the authentication information crt from the communication terminal 91. The decompression unit 111 decompresses the CRYSTALS-Kyber public key information u, v (S111, formulas (1) and (2)). The decompressed public key information is denoted as u' and v'.

[0015] <Number Theoretic Transformation Unit 112> The number theoretic transformation unit 112 performs number theoretic transformation on the decompressed public key information u' (S112, equation (3)). The public key information that has undergone number-theoretic transformation is denoted as u”.

[0016] <Data Transmission Unit 113> The data transmission unit 113 transmits the number-theoretically transformed public key information u", the decompressed public key information u', the undecompressed public key information v, and the authentication information crt to the secure element 110 (S113).

[0017] <Product Calculation Unit 1101> The product calculation unit 1101 receives the number-theoretically transformed public key information u", the decompressed public key information u', the public key information v before decompression, and the authentication information crt, verifies that u" and v have been sent from the target communication terminal 91 based on the authentication information crt, and calculates the product of u" and the private key sk (S1101, equation (4)). The product of the number-theoretically transformed public key information u″ and the private key sk is denoted as mp′. It is assumed that the private key sk is stored in advance in the secure element 110.

[0018] <Inverse Transformation Unit 1102> The inverse transformation unit 1102 performs an inverse transformation of the number theoretic transformation on the product mp' (S1102, equation (5)). The inversely transformed value is denoted as mp.

[0019] <Addition Unit 1103> The addition unit 1103 adds the public key information v to the inversely transformed value mp to update mp (S1103, equation (6)). <Compression Unit 1104> The compression unit 1104 compresses the updated mp (S1104, equation (7)). The value in parentheses to the right of Compress represents the number of bits of the compressed result. According to equation (7), mp is compressed to 1 bit. The compressed value is denoted as m.

[0020] <Hash Value Converter 1105> The hash value converter 1105 converts the compressed value m into a hash value (S1105, equation (8)). The hash value of value m is denoted as G(m).

[0021] <Data Output Unit 1106> The data output unit 1106 outputs the hash value G(m) to the outside of the secure element 110 (S1106). The output hash value G(m) is stored in the data storage unit 114.

[0022] According to the communication terminal 11 of this embodiment, only public information is used in the decryption process that handles the private key of the Ring-LWE method, and number theoretic transforms (NTT), which have a high processing cost, are calculated outside the secure element 110. This makes it possible to reduce the processing time by reducing the number of processes that need to be executed on the secure element 110 while preventing the private key from leaking.

[0023] Furthermore, by adding irreversible processing, that is, a hash value, to the output of the secure element 110, the private key is prevented from leaking from the output, thereby improving security.

[0024] Furthermore, by verifying that the input value to the secure element 110 is sent from the intended communication terminal, it is possible to prevent an attacker from easily calculating the private key using a value that has been altered.

[0025] The communication terminal of the present disclosure is not limited to the CRYSTALS-Kyber algorithm of the first embodiment, and other algorithms may be implemented. For example, the NewHope algorithm may be used. Hereinafter, the functional configuration of a communication terminal of a second embodiment implemented using the NewHope algorithm will be described with reference to FIG. 6 .

[0026] As shown in the figure, the communication terminal 21 of this embodiment includes an arithmetic unit 215 and a secure element 210, the arithmetic unit 215 includes a number theoretic transformation unit 112, a data transmission unit 113, and a data storage unit 114, and the secure element 210 includes a product calculation unit 1101, an inverse transformation unit 1102, a Rev calculation unit 2103, a hash value conversion unit 1105, and a data output unit 1106.

[0027] In this embodiment, communication terminal 91, which is the communication partner of communication terminal 21, transmits NewHope's public key information u and r and authentication information crt to communication terminal 21 (S91, FIG. 7). The operation of each component will be described below with reference to FIG. 7.

[0028] <Number Theoretic Transformation Unit 112> The number theoretic transformation unit 112 performs number theoretic transformation on the public key information u of NewHope (S112, equation (9)). The public key information that has undergone number-theoretic transformation is denoted as u'.

[0029] <Data Transmission Unit 113> The data transmission unit 113 transmits the number-theoretically transformed public key information u', the pre-decompression public key information r, and the authentication information crt to the secure element 210 (S113).

[0030] <Product Calculation Unit 1101> The product calculation unit 1101 receives the number-theoretically transformed public key information u', the public key information r before decompression, and the authentication information crt, verifies that u' and r have been sent from the target communication terminal 91 based on the authentication information crt, and calculates the product of the number-theoretically transformed public key information u' and the private key sk (S1101, equation (10)). The product of the number-theoretically transformed public key information u′ and the private key sk is denoted as mp′. It is assumed that the private key sk is stored in the secure element 210 in advance.

[0031] <Inverse Transformation Unit 1102> The inverse transformation unit 1102 performs an inverse transformation of the number theoretic transformation on the product mp' (S1102, equation (11)). The inversely transformed value is denoted as mp.

[0032] <Rev Calculation Unit 2103> The Rev calculation unit 2103 calculates the Rev of the inversely transformed value mp (S2103, equation (12)). The calculated value of Rev is denoted as m.

[0033] <Hash Value Conversion Unit 1105> The hash value conversion unit 1105 converts the calculated value m into a hash value (S1105, equation (8)).

[0034] <Data Output Unit 1106> The data output unit 1106 outputs the hash value G(m) to the outside of the secure element 210 (S1106).

[0035] According to the communication terminal 21 of this embodiment, as in the first embodiment, only public information is used in the decryption process that handles the private key of the Ring-LWE method, and number theoretic transformations (NTT), which have a high processing cost, are calculated outside the secure element 210, thereby making it possible to reduce the processing time by reducing the number of processes that need to be executed on the secure element 210 while preventing the private key from leaking.

[0036] Furthermore, by adding irreversible processing, that is, a hash value, to the output of the secure element 210, the private key is prevented from leaking from the output, thereby improving security.

[0037] Furthermore, by verifying that the input value to the secure element 210 is sent from the intended communication terminal, it is possible to prevent an attacker from easily calculating the private key using a value that has been altered.

[0038] The original NewHope CPA.Dec does not use irreversible processing like Kyber, so the private key can be guessed from the output value. Also, the original algorithm was designed to execute all processing in a single environment, but by distributing the processing across multiple environments (secure elements in this disclosure), the processing time could be shortened.

[0039] <Additional Notes> The device disclosed herein may, for example, be a single hardware entity that includes an input unit to which a keyboard or the like can be connected, an output unit to which an LCD display or the like can be connected, a communication unit to which a communication device (e.g., a communication cable) capable of communicating with an external device of the hardware entity can be connected, a CPU (which may also include a central processing unit, cache memory, registers, etc.), memories such as RAM and ROM, an external storage device such as a hard disk, and buses connecting these input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so as to enable data exchange. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing recording media such as a CD-ROM. An example of a physical entity equipped with such hardware resources is a general-purpose computer.

[0040] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required for processing these programs (the programs may be stored in a ROM, which is a read-only storage device, for example, instead of an external storage device). Data obtained by processing these programs is stored in RAM, the external storage device, etc. as appropriate.

[0041] In a hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as needed, and interpreted, executed, and processed by the CPU as appropriate, resulting in the CPU realizing a predetermined function (each component represented as a unit, means, etc.).

[0042] The present disclosure is not limited to the above-described embodiments, and modifications can be made as appropriate without departing from the spirit of the present disclosure. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capabilities of the devices that execute the processes or as needed.

[0043] As described above, when the processing functions of the hardware entities (apparatuses of the present disclosure) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program, and the processing functions of the hardware entities are realized on the computer by executing this program.

[0044] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 8, and operating the control unit 10010, input unit 10030, output unit 10040, etc.

[0045] The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories. Specifically, examples of magnetic recording devices include hard disk drives, flexible disks, and magnetic tapes; optical disks include DVDs (Digital Versatile Discs), DVD-RAMs (Random Access Memory), CD-ROMs (Compact Disc Read Only Memory), and CD-Rs (Recordable / Rewritable) / RWs; magneto-optical recording media include MOs (Magneto-Optical Discs), and semiconductor memories include EEP-ROMs (Electrically Erasable and Programmable-Read Only Memory).

[0046] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0047] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with each program transferred from the server computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. In this embodiment, the program includes information used for processing by a computer that is equivalent to a program (e.g., data that is not a direct instruction to the computer but has properties that define computer processing).

[0048] In addition, in this embodiment, a hardware entity is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. A communications terminal including: an arithmetic unit that is external to a secure element and performs Ring-LWE arithmetic and number theoretic transformation without using a private key, and transmits the transformed data to the secure element; and a secure element that performs Ring-LWE arithmetic and inverse transformation using the number theoretic transformed data and a private key, converts the inverse transformed data into a hash value, and outputs the transformed data outside the secure element.

2. A communications terminal according to claim 1, wherein the calculation unit includes: a decompression unit that decompresses CRYSTALS-Kyber public key information; a number theoretic transformation unit that performs number theoretic transformation on the decompressed public key information; and a data transmission unit that transmits the number theoretic transformed public key information to the secure element.

3. A communications terminal as claimed in claim 2, wherein the secure element includes: a product calculation unit which calculates the product of the number-theoretically transformed public key information and a private key; an inverse transformation unit which performs an inverse transformation of the number-theoretic transformation on the product; an addition unit which adds the public key information to the inversely transformed value; a compression unit which compresses the added value; a hash value conversion unit which converts the compressed value into a hash value; and a data output unit which outputs the hash value outside the secure element.

4. A communications terminal according to claim 1, wherein the calculation unit includes: a number theoretic conversion unit that performs number theoretic conversion on NewHope's public key information; and a data transmission unit that transmits the number theoretic converted public key information to the secure element.

5. A communications terminal as described in claim 4, wherein the secure element includes a product calculation unit that calculates the product of the number-theoretically transformed public key information and a private key, an inverse transformation unit that performs an inverse transformation of the number-theoretic transformation on the product, a Rev calculation unit that calculates the Rev of the inversely transformed value, a hash value conversion unit that converts the calculated value into a hash value, and a data output unit that outputs the hash value to the outside of the secure element.

6. A data processing method executed by a communications terminal, comprising: a step executed by an arithmetic unit outside a secure element, which executes Ring-LWE arithmetic and number theoretic transformation without using a private key, and a process for transmitting the converted data to the secure element; and a step executed by the secure element, which executes Ring-LWE arithmetic and number theoretic transformation using the number theoretic transformed data and a private key, converts the inversely transformed data into a hash value, and outputs the converted data outside the secure element.

7. A program for causing a computer to function as a communication terminal according to any one of claims 1 to 5.

Images