Portable electronic device, information processing device, information processing system, and information processing method

Abstract

Provided is a portable electronic device on which a prescribed encryption algorithm can be installed using limited hardware resources.　A portable electronic device according to an embodiment comprises a memory, an interface, and a processor. The memory stores encryption information including an encryption algorithm. The interface communicates with an information processing device. The processor generates a random number. The interface transmits the encryption information to the information processing device, and receives a public key transmitted by the information processing device from among public keys and secret keys generated on the basis of the encryption algorithm. The processor generates an encrypted random number from the random number by means of encryption processing based on the aforementioned public key. The interface transmits the encrypted random number to the information processing device. The processor generates, on the basis of the random number, a session key to be used for communication with the information processing device.

Description

Portable electronic device, information processing device, information processing system, and information processing method

[0001] FIELD Embodiments of the present invention relate to a portable electronic device, an information processing device, an information processing system, and an information processing method.

[0002] Security devices such as IC cards equipped with an IC (Integrated Circuit) chip have become widespread and are used as credit cards and IC passports. IC cards are also called portable electronic devices because they are carried by users.

[0003] For example, each time an ePassport and a reader generate an elliptic curve cryptography key, exchange their public keys, and generate a session key for encrypting subsequent communications. This session key is used to ensure confidentiality and integrity, and is used not only for encryption but also for generating authenticators. In a passport, session keys for encryption and authenticators are simultaneously generated and shared. In this system, since only the public keys are exchanged, it is extremely difficult to identify the session key.

[0004] Japanese Patent Publication No. 2022-537733 International Publication No. 2021 / 029173 Japanese Patent Publication No. 7004654

[0005] With the advent of quantum computers, there is an increasing need to transition to cryptography that is considered difficult to calculate using quantum computers (Post-Quantum Cryptography: PQC (Post-Quantum Cryptography)). In this context, although security devices such as IC cards are extremely secure, compared to reading devices, their volatile and non-volatile memories are smaller and the calculation speed of their CPUs (Central Processing Units) is not sufficient to incorporate PQC. In other words, the hardware resources of IC cards are a hurdle to incorporating PQC. There is a demand for technology that enables the incorporation of predetermined cryptographic algorithms such as PQC into devices with limited hardware resources.

[0006] The problem to be solved by the present invention is to provide a portable electronic device, an information processing device, an information processing system, and an information processing method that enable a predetermined encryption algorithm to be installed using limited hardware resources.

[0007] A portable electronic device according to an embodiment includes a memory, an interface, and a processor. The memory stores cryptographic information including a cryptographic algorithm. The interface communicates with an information processing device. The processor generates a random number. The interface also transmits the cryptographic information to the information processing device and receives the public key transmitted from the information processing device from among a public key and a private key generated based on the cryptographic algorithm. The processor generates an encrypted random number from the random number by encryption processing based on the public key. The interface transmits the encrypted random number to the information processing device. The processor generates a session key to be used for communication with the information processing device based on the random number.

[0008] FIG. 1 is a block diagram showing an example of an information processing system including an IC card as a portable electronic device according to an embodiment, and an IC card processing device as an information processing device that communicates with the IC card. FIG. 2 is a block diagram showing a schematic configuration example of an IC card according to an embodiment. FIG. 3 is a diagram showing a first example of a session key sharing processing sequence according to an embodiment. FIG. 4 is a diagram showing a second example of a session key sharing processing sequence according to an embodiment. FIG. 5 is a diagram showing a third example of a session key sharing processing sequence according to an embodiment. FIG. 6 is a diagram showing a fourth example of a session key sharing processing sequence according to an embodiment. FIG. 7 is a diagram showing a fifth example of a session key sharing processing sequence according to an embodiment. FIG. 8 is a diagram showing a sixth example of a session key sharing processing sequence according to an embodiment. FIG. 9 is an example of Algorithm 1 of the PQC standard method (Kyber). FIG. 10 is an example of Algorithm 2 of the PQC standard method (Kyber). Embodiment

[0009] Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a block diagram showing an example of an information processing system including an IC card as a portable electronic device according to the embodiment, and an IC card processing device as an information processing device that communicates with the IC card. As shown in Fig. 1, the information processing system includes an IC card processing device 1 and an IC card 2. The IC card processing device 1 is a higher-level device that supplies commands to the IC card 2 and receives responses from the IC card 2.

[0010] In the configuration example shown in FIG. 1, the IC card processing device 1 includes a CPU (Central Processing Unit) 11, a display 12, an operation unit 13, a card reader / writer 14, an OCR (Optical Character Recognition or Optical Character Reader) 15, and a memory unit 16.

[0011] The CPU 11 is a processor that controls the overall operation of the IC card processing device 1. The CPU 11 performs various processes based on the control programs and control data stored in the storage unit 16. For example, the CPU 11 executes programs stored in a memory such as the storage unit 16 to control the operation of the IC card processing device 1 or to perform various processes according to the operating mode of the IC card processing device 1. Note that some of the various functions may be realized by hardware circuits. In this case, the CPU 11 controls the functions executed by the hardware circuits.

[0012] For example, the CPU 11 has a function of acquiring encryption information transmitted from the IC card 2 via the card reader / writer 14 and generating a PQC key pair (public key and secret key) based on the PQC encryption algorithm and key length included in the encryption information. The CPU 11 also has a function of transmitting various data, such as a public key or an encrypted public key, to the IC card 2 via the card reader / writer 14. The CPU 11 also has a function of encrypting various data, such as a public key, to be transmitted to the IC card 2 via the card reader / writer 14. The CPU 11 also has a function of decrypting various encrypted data, such as an encrypted random number, transmitted from the IC card 2 via the card reader / writer 14. The CPU 11 also has a function of generating a session key based on the decrypted random number. The CPU 11 may also operate based on input from the operation unit 13 via the card reader / writer 14. For example, the CPU 11 transmits a write command including data input via the operation unit 13 to the IC card 2, thereby requesting the IC card 2 to write the data. In this embodiment, a case where the PQC encryption algorithm is installed will be described, but the encryption algorithm is not limited to the PQC encryption algorithm, and the mechanism of this embodiment can be applied to any predetermined encryption algorithm.

[0013] The display 12 is a display device that displays various information under the control of the CPU 11. The display 12 is, for example, a liquid crystal monitor.

[0014] The operation unit 13 is used by a user of the IC card processing device 1 to input various operation instructions, data, etc. The operation unit 13 transmits the input operation instructions, data, etc. to the CPU 11. The operation unit 13 is, for example, a keyboard, a numeric keypad, or a touch panel.

[0015] The card reader / writer 14 is an interface (second interface) that communicates with the IC card 2. The card reader / writer 14 is configured by an interface that complies with a predetermined communication protocol of the IC card 2, etc.

[0016] For example, if the IC card 2 is a contact-type IC card, the card reader / writer 14 conforms to, for example, ISO / IEC 7816 and is composed of a contact section for physically and electrically connecting to the contact section of the IC card 2. If the IC card 2 is a contactless IC card, the card reader / writer 14 conforms to, for example, ISO / IEC 14443 and is composed of an antenna and a communication control section for wireless communication with the IC card 2.

[0017] Furthermore, if the IC card 2 is a dual card that supports both contact and contactless types, the card reader / writer 14 of the IC card processing device 1 is configured to support the dual card. That is, the card reader / writer 14 is configured with a communication control unit and contact unit for physically and electrically contacting the communication unit 25 of the IC card 2 to send and receive signals, and a communication control unit such as a modulation / demodulation circuit for wireless communication with the communication unit 25 of the IC card 2, and an antenna.

[0018] The card reader / writer 14 also supplies power, clocks, performs reset control, and transmits and receives data to and from the IC card 2. For example, under the control of the CPU 11, the card reader / writer 14 activates (starts up) the IC card 2, transmits various commands, and receives responses to the transmitted commands.

[0019] The OCR 15 is an interface (external interface) that acquires information from the IC card 2. Optically readable information, such as a combination of letters, numbers, and symbols, a barcode, or a QR code (registered trademark), is printed on the IC card 2, and the OCR 15 optically reads this information and outputs the read result to the CPU 11. For example, the CPU 11 generates a random number from the encrypted random number by performing a decryption process based on the read result.

[0020] The IC card processing device 1 includes a card reader / writer 14 and an OCR 15, and acquires information from the IC card 2 via these two independent paths.

[0021] The storage unit 16 comprises non-volatile and volatile memory, the non-volatile memory pre-stores control programs and control data, and the volatile memory temporarily stores data being processed by the CPU 21, and functions as a receiving buffer, a calculation buffer, and a sending buffer.

[0022] Next, we will explain the IC card 2. The IC card 2 is activated and put into an operable state when it receives a supply of power and the like from a higher-level device such as the IC card processing device 1. For example, when the IC card 2 is connected to the IC card processing device 1 by contact-type communication, that is, when the IC card 2 is configured as a contact-type IC card, the IC card 2 is activated by receiving an operating power supply and an operating clock from the IC card processing device 1 via a contact unit serving as a communication interface.

[0023] Furthermore, when the IC card 2 is connected to the IC card processing device 1 using a contactless communication method, that is, when the IC card 2 is configured as a contactless IC card, the IC card 2 receives radio waves from the IC card processing device 1 via an antenna and a modulation / demodulation circuit as a communication interface, and activates itself by generating operating power and an operating clock from the radio waves using the power supply unit.

[0024] The IC card 2 also has a machine readable zone (MRZ) 20 on one or both sides of the card, and the MRZ contains optically readable printed information such as a combination of letters, numbers and symbols, a barcode or a QR code.

[0025] Next, an example of the configuration of the IC card 2 will be described. FIG. 2 is a block diagram schematically illustrating an example of the configuration of an IC card according to an embodiment. The IC card 2 has a card-shaped main body C made of plastic or the like. The IC card 2 has a module M built into the main body C. The module M is integrally formed with one or more IC chips Ca and an external interface for communication, connected to each other, and is embedded in the main body C of the IC card 2. As shown in FIG. 2, the module M of the IC card 2 includes a CPU 21, a ROM 22, a RAM 23, an NVM 24, and a communication unit 25. These units are connected to each other via a data bus.

[0026] The CPU 21 is a processor that functions as a control unit that controls the entire IC card 2. The CPU 21 performs various processes based on control programs and control data stored in the ROM 22 or the NVM 24. For example, the CPU 21 executes a program stored in the ROM 22 to control the operation of the IC card 2 or to perform various processes according to the operating mode of the IC card 2. Note that some of the various functions may be realized by hardware circuits. In this case, the CPU 21 controls the functions executed by the hardware circuits.

[0027] For example, the CPU 21 has a function of reading out encryption information from the ROM 22 and transmitting the encryption information, including the PQC encryption algorithm and key length supported by the IC card 2, to the IC card processing device 1 via the communication unit 25. The CPU 21 also has a function of generating an encrypted random number from a random number by encryption processing based on a public key transmitted from the IC card processing device 1. The CPU 21 also has a function of transmitting the encrypted random number to the IC card processing device 1 via the communication unit 25. The CPU 21 also has a function of generating a session key, etc., based on the random number.

[0028] The ROM 22 is a non-volatile memory that stores control programs, control data, encryption information, identification information, and the like in advance. The ROM 22 is incorporated into the IC card 2 during the manufacturing stage with the control programs, control data, and the like stored therein. That is, the programs, control data, encryption information, and identification information stored in the ROM 22 are incorporated in advance according to the specifications of the IC card 2. The ROM 22 may be configured as a flash memory, and may be written during the manufacturing stage, or may be written and rewritten in a subsequent phase. Information regarding encryption may be written during the manufacturing stage, or may be written and updated in a subsequent phase.

[0029] The encryption information includes the PQC encryption algorithm and key length supported by the IC card 2. The identification information is unique information that can identify the IC card 2. The MRZ 20 includes the identification information as optically readable printed information such as a combination of letters, numbers, and symbols, a barcode, or a QR code. The MRZ 20 may include all or part of the identification information. The MRZ 20 may include the identification information in a form other than printing. For example, if the identification information is a combination of letters, numbers, and symbols, the MRZ 20 may include embossing corresponding to this identification information.

[0030] The RAM 23 is a volatile memory. The RAM 23 temporarily stores data being processed by the CPU 21. For example, the RAM 23 includes a receiving buffer, a calculation buffer, a sending buffer, and the like. The receiving buffer holds data sent from the IC card processing device 1 and received via the communication unit 25. The calculation buffer holds temporary results for the CPU 21 to perform various calculations. The sending buffer holds data to be sent to the IC card processing device 1 via the communication unit 25.

[0031] The NVM 24 is configured by a nonvolatile memory such as an EEPROM or a flash ROM, to which data can be written and rewritten. The NVM 24 stores control programs, applications, and various data according to the operational use of the IC card 2. For example, program files and data files are created in the NVM 24. The control programs and various data are written to each created file. The NVM 24 may also store encryption information and identification information.

[0032] The communication unit 25 communicates with the card reader / writer 14 of the IC card processing device 1 and is composed of an interface (first interface) according to a predetermined communication protocol, etc. When the IC card 2 is realized as a contact-type IC card, the communication unit 25 is composed of a communication control unit and a contact unit for physically and electrically contacting the card reader / writer 14 of the IC card processing device 1 to send and receive signals. When the IC card 2 is realized as a contactless IC card, the communication unit 25 is composed of a communication control unit such as a modulation / demodulation circuit for wireless communication with the card reader / writer 14 of the IC card processing device 1 and an antenna.

[0033] In addition, if the IC card 2 is a dual card that supports both contact and contactless types, the communication unit 25 is composed of a communication control unit and contact unit for physically and electrically contacting the card reader / writer 14 of the IC card processing device 1 to send and receive signals, and a communication control unit such as a modulation / demodulation circuit and an antenna for wireless communication with the card reader / writer 14 of the IC card processing device 1.

[0034] A session key sharing process according to an embodiment will now be described. In the IC card processing system according to the embodiment, the IC card processing device 1 generates a new public key and private key pair of PQC keys each time based on the PQC encryption algorithm and key length transmitted from the IC card 2, and transmits the public key to the IC card 2. This eliminates the need to store a fixed key in the IC card 2, thereby reducing non-volatile memory consumption. The IC card 2 generates a random number and generates an encrypted random number from the random number by encryption processing based on the received public key, and transmits the encrypted random number to the IC card processing device 1. The IC card 2 generates a session key from the random number, and the IC card processing device 1 generates a random number from the encrypted random number by decryption processing based on the private key, and generates a session key from the random number. The session key is then shared between the IC card processing device 1 and the IC card 2. The IC card processing device 1 may transmit information for generating the public key to the IC card 2, and the IC card 2 may generate the public key based on the received information. That is, the IC card processing device 1 is not necessarily limited to a method of transmitting the public key itself to the IC card 2, as long as it can share the generated public key with the IC card 2.

[0035] Since the IC card processing device 1 has more hardware resources than the IC card 2, the IC card processing device 1 can handle the process of generating a PQC key pair, thereby enabling the information processing system to support PQC. Also, the IC card 2 does not need to store a fixed PQC key pair, reducing the load on memory. Furthermore, since a new PQC key pair is generated each time, the risk of the private key being identified can be reduced.

[0036] Next, the session key sharing process according to the embodiment will be described in detail. <Concept 1> Fig. 3 is a diagram showing a first example of a session key sharing process sequence according to the embodiment. The first example described here is a higher-level concept than the second example and subsequent examples described later. In order to encrypt communication using a session key between the IC card processing device 1 and the IC card 2, the CPU 21 of the IC card 2 reads encryption information from the ROM 22. The encryption information includes a PQC encryption algorithm and key length supported by the IC card 2. The CPU 21 controls to transmit the read encryption information to the IC card processing device 1, and the communication unit 25 transmits the encryption information to the IC card processing device 1 (ST101).

[0037] The card reader / writer 14 of the IC card processing device 1 receives the encryption information. The CPU 11 generates a public key and a private key based on the PQC encryption algorithm and key length included in the received encryption information. That is, the CPU 11 generates a public key and a private key, which are a PQC key pair, for the PQC encryption algorithm and key length included in the received encryption information (ST102).

[0038] The CPU 11 controls the public key to be transmitted to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST103).

[0039] The communication unit 25 receives the public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received public key.

[0040] The CPU 21 generates a random number and generates an encrypted random number from the random number by encryption processing based on the acquired public key. For example, the CPU 21 generates an encrypted random number from the random number by encryption processing based on the public key (ST104). Alternatively, the CPU 21 generates an encrypted random number from the random number and identification information by encryption processing based on the public key.

[0041] The CPU 21 controls the communication unit 25 to transmit the encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the encrypted random number to the IC card processing device 1 (ST105).

[0042] The CPU 21 generates a session key based on the random number (ST106). The CPU 21 encrypts data to be transmitted in the subsequent processes using the session key, and the communication unit 25 transmits the data encrypted using the session key.

[0043] The card reader / writer 14 of the IC card processing device 1 receives the encrypted random number. The CPU 11 generates a random number from the encrypted random number by decryption processing based on the private key (ST107). Alternatively, the CPU 11 generates a random number and identification information from the encrypted random number by decryption processing based on the private key.

[0044] The CPU 11 generates a session key based on the random number (ST108). The CPU 11 encrypts data to be transmitted in the subsequent processing using the session key, and the card reader / writer 14 transmits the data encrypted using the session key.

[0045] For example, the IC card 2 encrypts data received from the IC card processing device 1 with the session key and transmits the encrypted data to the IC card processing device 1. The IC card processing device 1 encrypts data received from the IC card 2 with the session key and transmits the encrypted data to the IC card 2. The IC card 2 and the IC card processing device 1 verify whether the session key has been generated correctly based on the received encrypted data.

[0046] The above processing provides the following advantageous effects: Multiple PQC methods are standard, and different methods may be installed depending on the issuer (e.g., issuing country) of the IC card 2 (e.g., IC passport), but the information processing system can absorb differences in IC passport methods based on the PQC encryption algorithm and key length included in the encryption information transmitted from the IC card 2.

[0047] Furthermore, with the information processing system, the public key is used disposably, which eliminates concerns about the long-term use of fixed keys.

[0048] <Concept 2-1> Fig. 4 is a diagram showing a second example of a session key sharing process sequence according to the embodiment. Note that the second example described here is a sub-concept of the first example described above, and the description will focus on the differences, omitting the description of the common parts as appropriate.

[0049] The operator of the IC card processing device 1 holds the reading unit of the OCR 15 over the MRZ 20 of the IC card 2, or holds the MRZ 20 of the IC card 2 over the reading unit of the OCR 15. This causes the OCR 15 to read the identification information from the MRZ 20 of the IC card 2. The CPU 11 acquires the read identification information (ST201). In FIG. 4, the identification information read from the MRZ 20 and the identification information read from the ROM 22 are denoted as MRZ.

[0050] The CPU 21 of the IC card 2 reads out the encryption information from the ROM 22 and controls the transmission of the read encryption information to the IC card processing device 1, and the communication unit 25 transmits the encryption information to the IC card processing device 1 (ST202).

[0051] The card reader / writer 14 of the IC card processing device 1 receives the encrypted information.

[0052] The CPU 21 generates a first random number (RND) (ST203), reads the identification information (MRZ) from the ROM 22, and encrypts the first random number with the identification information (MRZ) (E(RND, MRZ)). That is, the CPU 21 generates a first encrypted random number from the first random number by encryption processing based on the read identification information (MRZ) (ST204).

[0053] The CPU 21 controls the transmission of the generated first encrypted random number (Encrypted RND) to the IC card processing device 1, and the communication unit 25 transmits the first encrypted random number to the IC card processing device 1 (ST205).

[0054] The card reader / writer 14 receives the first encrypted random number.

[0055] The CPU 11 decrypts (D(RND, MRZ)) the first encrypted random number obtained via the card reader / writer 14 using the identification information (MRZ) obtained from the IC card 2 via the OCR 15. That is, the CPU 11 generates a first random number from the first encrypted random number by decryption processing based on the obtained identification information (MRZ) (ST206).

[0056] The CPU 11 also generates a public key and a private key based on the PQC encryption algorithm and key length included in the received encryption information. That is, the CPU 11 generates a public key and a private key that are a PQC key pair for the PQC encryption algorithm and key length included in the received encryption information (ST207).

[0057] The CPU 11 controls the public key to be transmitted to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST209).

[0058] The communication unit 25 receives the public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received public key.

[0059] The CPU 21 generates a second random number and generates a second encrypted random number from the second random number by encryption processing based on the acquired public key (ST211).

[0060] The CPU 21 controls the communication unit 25 to transmit the second encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the second encrypted random number to the IC card processing device 1 (ST212).

[0061] The CPU 21 also generates a session key based on the first and second random numbers (ST213). The CPU 21 encrypts data to be transmitted in the subsequent processing using the session key, and the communication unit 25 transmits the data encrypted using the session key.

[0062] Furthermore, the CPU 21 generates encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST214).

[0063] The card reader / writer 14 receives the second encrypted random number. The CPU 11 generates a second random number from the second encrypted random number by decryption processing based on the private key (ST215).

[0064] The CPU 11 generates a session key based on the first and second random numbers (ST216). The CPU 11 encrypts data to be transmitted in the subsequent processing using the session key, and the card reader / writer 14 transmits the data encrypted using the session key.

[0065] Furthermore, the CPU 21 generates encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST217).

[0066] The above process provides the following advantageous effects: According to the information processing system, by using both the identification information read via the OCR 15 and the encryption information read via the card reader / writer 14, the final session key can be protected as long as either of the information is secure.

[0067] Furthermore, according to the information processing system, by disposing of the public key, even if an attack on the public key is discovered, security can be ensured until the public key can be decrypted instantly before a session is established.

[0068] <Concept 2-2> Fig. 5 is a diagram showing a third example of a session key sharing process sequence according to the embodiment. Note that the third example described here is a variation of the second example described above, and the description will focus on the differences, omitting the description of the common parts as appropriate.

[0069] As described in the second example, the processes of ST201 to ST207 are executed, and the CPU 11 generates an encrypted public key from the public key by encryption processing based on the first random number (ST208a). For example, the CPU 11 uses the Advanced Encryption Standard (AES) to encrypt the public key using the first random number as a key.

[0070] The CPU 11 controls the transmission of the encrypted public key to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST209).

[0071] The communication unit 25 receives the encrypted public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received encrypted public key.

[0072] The CPU 21 generates a public key from the encrypted public key by decryption processing based on the first random number (ST210a). For example, the CPU 21 uses AES to extract the public key from the encrypted public key using the first random number as a key.

[0073] The CPU 21 generates a second random number and generates a second encrypted random number from the second random number by encryption processing based on the acquired public key (ST211).

[0074] The CPU 21 controls the communication unit 25 to transmit the second encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the second encrypted random number to the IC card processing device 1 (ST212).

[0075] The CPU 21 also generates a session key based on the first and second random numbers (ST213). The CPU 21 encrypts data to be transmitted in the subsequent processing using the session key, and the communication unit 25 transmits the data encrypted using the session key.

[0076] Furthermore, the CPU 21 generates encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST214).

[0077] The card reader / writer 14 receives the second encrypted random number. The CPU 11 generates a second random number from the second encrypted random number by decryption processing based on the private key (ST215).

[0078] The CPU 11 generates a session key based on the first and second random numbers (ST216). The CPU 11 encrypts data to be transmitted in the subsequent processing using the session key, and the card reader / writer 14 transmits the data encrypted using the session key.

[0079] Furthermore, the CPU 21 generates encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST217).

[0080] The above process provides the following advantageous effects: Unless the first encrypted random number is decrypted, a third party cannot know the public key encrypted with the first random number. Therefore, the information processing system provides no clues for decryption, thereby improving security.

[0081] 6 is a diagram showing a fourth example of a session key sharing process sequence according to an embodiment. Note that the fourth example is a variation of the third example described above, and the following description will focus on the differences, omitting the description of the common parts as appropriate.

[0082] As explained in the second example, the processes in ST201 to ST207 are executed, and the CPU 11 generates an encrypted public key from the public key through encryption processing based on MRZ (ST208b).

[0083] The CPU 11 controls the transmission of the encrypted public key to the IC card 2, and the card reader / writer 14 transmits the public key to the IC card 2 (ST209).

[0084] The communication unit 25 receives the encrypted public key transmitted from the IC card processing device 1, and the CPU 21 acquires the received encrypted public key.

[0085] The CPU 21 generates a public key from the encrypted public key through decryption processing based on MRZ (ST210b).

[0086] Thereafter, the processes of ST212 to ST217 are executed as described in the second example.

[0087] <Concept 3-1> Fig. 7 is a diagram showing a fifth example of a session key sharing process sequence according to an embodiment. Note that the fifth example is a variation of the second to fourth examples described above, and the following description will focus on the differences, omitting explanations of the common parts as appropriate.

[0088] In the fifth example, the PQC standard method (Kyber) is used. Fig. 9 shows an example of Algorithm 1 of the PQC standard method (Kyber), and Fig. 10 shows an example of Algorithm 2 of the PQC standard method (Kyber).

[0089] Because PQC has a large data (public key) size, data communication volume and calculation time increase. Therefore, in the fifth example, seed information for generating the public key is shared in advance to reduce communication volume, and the IC card processing device 1 performs pre-calculation to generate part of the public key. That is, the storage unit 16 of the IC card processing device 1 stores part or all of the PQC standard method, which is the seed information for generating the public key, and the ROM 22 or NVM 24 of the IC card 2 stores part or all of the PQC standard method.

[0090] As shown in Fig. 7, the operator of the IC card processing device 1 holds the reading unit of the OCR 15 over the MRZ 20 of the IC card 2, or holds the MRZ 20 of the IC card 2 over the reading unit of the OCR 15. This causes the OCR 15 to read the identification information from the MRZ 20 of the IC card 2. The CPU 11 acquires the read identification information (ST301). In Fig. 7, the identification information read from the MRZ 20 and the identification information read from the ROM 22 are denoted as MRZ.

[0091] The CPU 21 generates a first random number (RND) (ST302), reads the identification information (MRZ) from the ROM 22, and encrypts the first random number with the identification information (MRZ) (E(RND, MRZ)). That is, the CPU 21 generates a first encrypted random number from the first random number by encryption processing based on the read identification information (MRZ) (ST303).

[0092] The CPU 21 controls the transmission of the generated first encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the first encrypted random number to the IC card processing device 1 (ST304).

[0093] The card reader / writer 14 receives the first encrypted random number.

[0094] The CPU 11 decrypts (D(RND, MRZ)) the first encrypted random number obtained via the card reader / writer 14 using the identification information (MRZ) obtained from the IC card 2 via the OCR 15. That is, the CPU 11 generates a first random number from the first encrypted random number by decryption processing based on the obtained identification information (MRZ) (ST305).

[0095] The CPU 11 also generates a Kyber key pair, a public key (pk = (t, ρ)) and a private key (sk = s), based on the PQC standard (RND = ρ (part of Kyber’s public key and the source of matrix A)) stored in the storage unit 16 (ST306).

[0096] The CPU 11 sets plaintext t (part of the public key) (ST307) and controls so that t is transmitted to the IC card 2, and the card reader / writer 14 transmits t to the IC card 2 (ST308). Alternatively, the CPU 11 encrypts t (ST307) and controls so that the encrypted t is transmitted to the IC card 2, and the card reader / writer 14 transmits the encrypted t to the IC card 2 (ST308).

[0097] The communication unit 25 receives t or the encrypted t transmitted from the IC card processing device 1, and the CPU 21 acquires the received t or the encrypted t.

[0098] When the CPU 21 obtains the encrypted t, it decrypts t from the encrypted t based on the PQC standard method (RND = ρ (part of Kyber's public key and the source of generation of matrix A)) stored in the ROM 22 or NVM 22 (ST309).

[0099] The CPU 21 also generates a second random number and generates a second encrypted random number from the second random number by encryption processing based on the public key (ST310).

[0100] The CPU 21 controls the communication unit 25 to transmit the second encrypted random number to the IC card processing device 1, and the communication unit 25 transmits the second encrypted random number to the IC card processing device 1 (ST311).

[0101] The CPU 21 also generates a session key based on the first and second random numbers (ST312). The CPU 21 encrypts data to be transmitted in the subsequent processing using the session key, and the communication unit 25 transmits the data encrypted using the session key.

[0102] Furthermore, the CPU 21 generates encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST313A).

[0103] The card reader / writer 14 receives the second encrypted random number. The CPU 11 generates a second random number from the second encrypted random number by decryption processing based on the secret key (sk=s) (ST314).

[0104] The CPU 11 generates a session key based on the first and second random numbers (ST315). The CPU 11 encrypts data to be transmitted in the subsequent processing using the session key, and the card reader / writer 14 transmits the data encrypted using the session key.

[0105] Furthermore, the CPU 21 generates encrypted MRZ (authentication data) from the MRZ by encryption processing based on the second random number (ST316A).

[0106] The above process provides the following advantageous effects. According to the information processing system, as with the introduction of the first encrypted random number, a third party cannot know ρ, which is part of the public key. Therefore, the information processing system does not provide any clues for decryption, thereby improving security. Furthermore, according to the information processing system, since there is no need to send or receive ρ, which is part of the public key, the data size of communication can be reduced. Furthermore, after sending the first encrypted random number (RND=ρ) to the reader, the IC card 2 can proactively generate ciphertext using ρ during the waiting time.

[0107] <Concept 3-2> Fig. 8 is a diagram showing a sixth example of a session key sharing process sequence according to the embodiment. Note that the sixth example is a variation of the fifth example described above, and the following description will focus on the differences, omitting the description of the common parts as appropriate.

[0108] As explained in the fifth example, the processes of ST301 to ST312, ST314, and ST315 are executed.

[0109] Meanwhile, the CPU 21 generates encrypted MRZ (first authentication data) from the MRZ by encryption processing based on the second random number (ST316B).

[0110] The card reader / writer 14 transmits the first authentication data to the IC card 2 (ST317).

[0111] Furthermore, the CPU 21 generates an encrypted public key (second authentication data) from the public key by encryption processing based on the second random number (ST313B).

[0112] The communication unit 25 transmits the second authentication data to the IC card processing device 1 (ST318).

[0113] According to the information processing systems of the first to fifth examples described above, it is possible to provide a portable electronic device, an information processing device, an information processing system, and an information processing method that enable PQC to be installed with limited hardware resources.

[0114] The following are variations regarding the public key: (1) The IC card processing device 1 transmits the public key in plain text. (2) The IC card processing device 1 encrypts the public key with a first random number and transmits the encrypted public key. (3) The IC card processing device 1 encrypts the public key with identification information read from the MRZ 20 and transmits the encrypted public key. (4) The IC card processing device 1 generates ρ, generates t from ρ, and transmits t in plain text. (5) The IC card processing device 1 generates ρ, generates t from ρ, encrypts t, and transmits the encrypted t. (6) The IC card 2 generates ρ and a first random number and transmits both ρ and the first random number. The IC card processing device 1 generates t from ρ. (7) The IC card 2 generates ρ, sets ρ as the first random number, and transmits ρ. The IC card processing device 1 generates t from ρ. (8) The IC card 2 does not set the first random number itself to ρ, but hashes the first random number to set ρ. (9) The IC card processing device 1 and the IC card 2 set the second random number as the session key. (10) The IC card processing device 1 and the IC card 2 generate the session key from the exclusive OR (XOR) of the first random number and the second random number.

[0115] Variations of the session key verification means include the following: (1) The IC card processing device 1 and the IC card 2 exchange authentication data obtained by encrypting the identification information read from the MRZ 20 with a second random number, and verify the session key. (2) The IC card processing device 1 and the IC card 2 encrypt the identification information read from the MRZ 20 with the result of performing an exclusive OR on the first random number and the second random number, and verify the session key.

[0116] The following are examples of variations in the presentation of the encryption algorithm and key length: (1) The IC card 2 presents encryption information including the encryption algorithm and key length together with the MRZ 20. For example, the OCR 15 of the IC card processing device 1 optically reads the MRZ 20, and the card reader / writer 14 of the IC card processing device 1 receives the encryption information. (2) The IC card 2 presents encryption information including the encryption algorithm and key length together with the first random number. For example, the IC card 2 encrypts and presents information including the first random number and encryption information. (3) The IC card 2 presents encryption information including the encryption algorithm and key length in plain text, separately from the first random number.

[0117] In the above description, the IC card processing device 1 acquires identification information via the OCR 15, but the present invention is not limited to this. For example, the communication unit 25 of the IC card 2 may transmit identification information stored in the ROM 22 or the like, and the card reader / writer 14 of the IC card processing device 1 may receive the identification information transmitted from the IC card 2. In this case, the CPU 21 of the IC card 2 may transmit and receive the encrypted random number and plain text or the encrypted key, and transmit the identification information, using different communication methods (contact communication and contactless communication).

[0118] For example, the communication unit 25 of the IC card 2 transmits and receives encrypted random numbers and plain text or encrypted keys by contact communication (a communication control unit and contact unit for transmitting and receiving signals through physical and electrical contact), and transmits identification information by contactless communication (a communication control unit such as a modulation / demodulation circuit for wireless communication and an antenna).On the other hand, the card reader / writer 14 of the IC card processing device 1 transmits and receives encrypted random numbers and plain text or encrypted keys by contact communication, and receives identification information by contactless communication.

[0119] Alternatively, the communication unit 25 of the IC card 2 transmits identification information by contact communication, and transmits and receives encrypted random numbers and plain text or encrypted keys by contactless communication. On the other hand, the card reader / writer 14 of the IC card processing device 1 receives identification information by contact communication, and transmits and receives encrypted random numbers and plain text or encrypted keys by contactless communication.

[0120] As described above, the information processing system according to the embodiment uses different communication methods for transmitting and receiving random numbers and keys and for transmitting and receiving identification information, which significantly reduces the risk of the random numbers, keys, and identification information being stolen at the same time, thereby improving security.

[0121] The program according to this embodiment may be transferred in a state stored in an electronic device such as the IC card processing device 1 and the IC card 2, or may be transferred in a state not stored in the electronic device. In the latter case, the program may be transferred via a network or in a state stored in a storage medium. The storage medium is a non-transitory tangible medium. The storage medium is a computer-readable medium. The storage medium may be any medium, such as an optical disk or a memory card, that can store a program and is readable by a computer, and its form is not important. The electronic device downloads the program transferred (provided) via a network and installs it in its memory, or reads the program from the storage medium and installs it in its memory.

[0122] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims.

Claims

1. A portable electronic device comprising: a memory for storing cryptographic information including a cryptographic algorithm; an interface for communicating with an information processing device; and a processor for generating random numbers, wherein the interface transmits the cryptographic information to the information processing device and receives the public key from the information processing device of a public key and a private key generated based on the cryptographic algorithm, the processor generates an encrypted random number from the random number by encryption processing based on the public key, the interface transmits the encrypted random number to the information processing device, and the processor generates a session key to be used for communication with the information processing device based on the random number.

2. The portable electronic device according to claim 1, wherein the encryption algorithm is an encryption algorithm using quantum-computer-resistant cryptography.

3. The portable electronic device of claim 1, wherein the interface transmits the encrypted random number to the information processing device so that the random number is generated from the encrypted random number by a decryption process based on the private key, and the session key to be used for communication with the portable electronic device is generated based on the random number.

4. The portable electronic device of claim 1, wherein the cryptographic information includes a key length, and the public key and the private key are generated based on the cryptographic algorithm and the key length included in the cryptographic information.

5. The portable electronic device of claim 1, wherein the memory stores identification information capable of identifying the portable electronic device; the processor generates a first random number and generates a first encrypted random number from the first random number by an encryption process based on the identification information; the interface transmits the first encrypted random number to the information processing device and receives the public key transmitted from the information processing device; the processor generates a second random number and generates a second encrypted random number from the second random number by an encryption process based on the public key; the interface transmits the second encrypted random number to the information processing device; and the processor generates the session key based on the first and second random numbers.

6. The portable electronic device of claim 5, wherein the interface transmits the first and second encrypted random numbers to the information processing device so that the information processing device generates the first random number from the first encrypted random number by a decryption process based on the identification information obtained from the portable electronic device, generates the second random number from the second encrypted random number by a decryption process based on the private key, and generates the session key based on the first and second random numbers.

7. The portable electronic device of claim 5, wherein the information processing device generates an encrypted public key from the public key by an encryption process based on the first random number and transmits the encrypted public key in place of the public key, the interface receives the encrypted public key transmitted from the information processing device, and the processor generates the public key from the encrypted public key by a decryption process based on the first random number.

8. The portable electronic device of claim 5, further comprising a readable zone on which the identification information is printed, wherein the information processing device acquires the identification information from the readable zone via an optically readable external interface and generates the first random number from the first encrypted random number by a decryption process based on the identification information.

9. The portable electronic device of claim 5, wherein the interface is an interface for communicating with the information processing device by contact or contactless means based on a predetermined communication protocol, the processor transmits the identification information to the information processing device via the interface, and the information processing device acquires the identification information via the interface and generates the first random number from the first encrypted random number by a decryption process based on the identification information.

10. The portable electronic device of claim 9, wherein the interface: transmits the identification information to the information processing device by contact communication; and transmits the first encrypted random number to the information processing device, receives the public key transmitted from the information processing device, and transmits the second encrypted random number to the information processing device by non-contact communication; or transmits the identification information to the information processing device by non-contact communication; transmits the first encrypted random number to the information processing device by contact communication, receives the public key transmitted from the information processing device, and transmits the second encrypted random number to the information processing device.

11. An information processing device comprising: an interface for communicating with a portable electronic device; and a processor for generating keys, wherein the interface receives cryptographic information transmitted from the portable electronic device; the processor generates a public key and a private key based on a cryptographic algorithm contained in the cryptographic information; the interface transmits the public key to the portable electronic device and receives an encrypted random number generated from a random number by an encryption process based on the public key in the portable electronic device; the processor generates the random number from the encrypted random number by a decryption process based on the private key, and generates a session key to be used for communication with the portable electronic device based on the random number.

12. An information processing system comprising a portable electronic device and an information processing device, wherein the portable electronic device comprises: a memory for storing cryptographic information including a cryptographic algorithm; a first interface for communicating with the information processing device; and a processor for generating random numbers, wherein the first interface transmits the cryptographic information to the information processing device and receives the public key transmitted from the information processing device among a public key and a private key generated based on the cryptographic algorithm, the processor generates an encrypted random number from the random number by encryption processing based on the public key, the first interface transmits the encrypted random number to the information processing device, and the processor generates a session key to be used for communication with the information processing device based on the random number, and the information processing device comprises: a second interface for communicating with the portable electronic device; and a second processor for generating keys, wherein the second interface receives the cryptographic information transmitted from the portable electronic device, and the second processor generates the public key and the private key based on the cryptographic algorithm included in the cryptographic information, An information processing system, wherein the second interface transmits the public key to the portable electronic device and receives the encrypted random number generated from the random number by an encryption process based on the public key in the portable electronic device, and the second processor generates the random number from the encrypted random number by a decryption process based on the private key, and generates the session key to be used for communication with the portable electronic device based on the random number.

13. An information processing method executed by a portable electronic device and an information processing device, wherein the portable electronic device transmits cryptographic information including an encryption algorithm to the information processing device; the information processing device receives the cryptographic information transmitted from the portable electronic device, generates a public key and a private key based on the cryptographic algorithm included in the cryptographic information, and transmits the public key to the portable electronic device; the portable electronic device receives the public key transmitted from the information processing device, generates an encrypted random number from a random number by encryption processing based on the public key, transmits the encrypted random number to the information processing device, and generates a session key to be used for communication with the information processing device based on the random number; and the information processing device receives the encrypted random number transmitted from the portable electronic device, generates the random number from the encrypted random number by decryption processing based on the private key, and generates the session key to be used for communication with the portable electronic device based on the random number.

Images