JP2005151004A - Radio tag privacy protection method, radio tag device, security server, program for radio tag device, and program for security server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a novel technology for avoiding such an attack as information transmitted from a radio tag is tapped and reused. <P>SOLUTION: A reciphered ID is formed by re-encrypting a ciphered tag ID stored in a radio tag using an encryption key, temporary information capable of being agreed by a server is formed, authentication information is formed for formation objects of the reciphered ID, the temporary information and the ID of a decryption key being shared among a plurality of radio tags and used for decrypting the reciphered ID, and then the decryption key ID, the temporary information and the authentication information are added to the reciphered ID to form tagged transmission information which is transmitted to the server. The server acquires the tagged ID by decrypting the reciphered ID using the decryption key obtained from the decryption key ID, verifies correctness of the tagged transmission information using an authentication information verification key and the authentication information obtained from the tagged ID and makes a decision whether the temporary information has an appropriate value or not. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a wireless tag privacy protection method used for avoiding an attack of eavesdropping and reusing information transmitted from a wireless tag, and a wireless tag device and a security server used for realizing the wireless tag privacy protection method The present invention relates to a device, a wireless tag device program used for realizing the wireless tag device, and a security server device program used for realizing the security server device.

  In recent years, research on an automatic recognition system using a radio frequency tag (Radio Frequency Tag) has been actively conducted (for example, see Non-Patent Document 1).

  This wireless tag is generally a minute device composed of an antenna and an IC chip, and can exchange information with an external reading device by wireless communication.

In an automatic recognition system using a wireless tag, a unique ID is stored in the wireless tag and is attached to a product or carried by a person. On the other hand, the reading device reads the ID from the wireless tag, uses the ID as a key to refer to and update the product related information managed in the database on the network, and detects the position of the person and identifies and authenticates the person Or
AUTO-ID CENTER, “ABOUT THE TECHNOLOGY”, [searched on November 7, 2003], Internet <URL: http://www.autoidcenter.org/aboutthetech.asp>

  For example, the ID defined by the MIT Auto-ID Center (http://www.autoidcenter.org) is made up of a manufacturer code, a product code indicating the type of product, and an individual number indicating the number of the product individual. Yes.

  Anyone who has a reader can read the ID, so there is a risk that the belongings may leak from the ID that has been wiretapped.

  Against this backdrop, the present applicant stores the concealed ID instead of the plaintext ID in the wireless tag in Japanese Patent Application Nos. 2003-111342 and 2003-113798 filed earlier. The client that has read the concealment ID requests the security server on the network to decrypt, and the security server responds to the plaintext ID that is the decryption result only for the legitimate client, thereby preventing ID leakage to a third party. A new invention was proposed.

  However, even if this invention is used, since the same concealment ID is always returned from the wireless tag, even if the plaintext ID cannot be deciphered, the person who owns the product by tracking the concealment ID There remains a problem of tracking (problem that the privacy of the RFID tag holder is not protected).

  Furthermore, when a concealed concealment ID is reused (replay attack), it is impossible to determine whether or not the concealment ID is from a genuine tag (problem that replay attack cannot be avoided) Is left.

  For example, there is a problem that impersonation by a third party cannot be prevented in a case where an entrance gate is automatically checked using a wireless tag carried by a person or in an automatic payment. Further, there is still a problem that the location is camouflaged when an eavesdropping concealment ID is retransmitted in a place where a real tag does not exist.

  The present invention has been made in view of such circumstances, and in an automatic recognition system using a wireless tag, it is possible to avoid an attack of eavesdropping and reusing information transmitted from a wireless tag. Aims to provide new technology.

[1] First Configuration [1-1] Configuration of Radio Tag Privacy Protection Method of the Present Invention To achieve the above object, the radio tag privacy protection method of the present invention according to the first configuration includes (a) a radio tag. The encrypted tag ID stored in is re-encrypted by using an encryption key to encrypt the tag ID, and the code is different from the encrypted tag ID. And (b) a decryption key that is shared by a plurality of wireless tags and used for decryption of the reconcealment ID with respect to the reconcealment ID. The tag transmission information is generated by adding the ID and transmitted to the security server device, and (c) the security server device uses the decryption key obtained from the received decryption key ID. Re Configured to include a process for obtaining the tag ID by decoding 匿化 ID.

[1-2] Operation of the RFID tag privacy protection method of the present invention In the RFID tag privacy protection method of the present invention according to the first configuration, the concealed tag ID stored in the wireless tag is regenerated using the encryption key. Encrypting generates a re-confidential ID and transmits it to make the tag ID appear variable.

  Further, at this time, an ID of a decryption key used for decryption of the reconcealment ID is added. If this decryption key ID is made unique for each wireless tag, the decryption key ID is unique. This makes it possible to track the wireless tag. Therefore, a plurality of wireless tags share the same decryption key ID so that such tracking is impossible.

  According to this configuration, according to the wireless tag privacy protection method of the present invention according to the first configuration, an attack for eavesdropping information transmitted from the wireless tag can be avoided.

[1-3] Configuration of Radio Tag Device When realizing the radio tag privacy protection method of the present invention according to the first configuration, the radio tag device of the present invention is (a) a concealment stored in the radio tag. The tag ID is re-encrypted using an encryption key, and the tag ID is encrypted. The tag ID is different from that of the concealed tag ID and is different each time. A means for generating a re-confidential ID indicating a code, and (b) adding a decryption key ID that is shared by a plurality of wireless tags and used for decrypting the re-confidential ID to the re-confidential ID A means for generating tag transmission information and (c) means for transmitting the tag transmission information to the security server device are provided.

  Each of the processing means described above can be realized by a computer program, and this computer program can be provided by being recorded on a recording medium such as a semiconductor memory or via a network.

[1-4] Configuration of Security Server Device When realizing the wireless tag privacy protection method of the present invention according to the first configuration, the security server device of the present invention provides the wireless communication device according to (1) [1-3]. The decryption key included in the received tag transmission information from the means for receiving the tag transmission information transmitted from the tag device, and (b) the storage means for storing the correspondence between the decryption key ID and the decryption key associated therewith. Means for obtaining a decryption key pointed to by ID, and (c) means for obtaining a tag ID by decrypting a re-confidential ID included in the received tag transmission information using the obtained decryption key. Constitute.

  Each of the processing means described above can be realized by a computer program, and this computer program can be provided by being recorded on a recording medium such as a semiconductor memory or via a network.

[2] Second Configuration [2-1] Configuration of Radio Tag Privacy Protection Method of the Present Invention To achieve the above object, the radio tag privacy protection method of the present invention according to the second configuration includes (a) a radio tag. The encrypted tag ID stored in is re-encrypted by using an encryption key to encrypt the tag ID, and the code is different from the encrypted tag ID. And (b) the ID of a decryption key that is shared by a plurality of wireless tags and is used for decryption of the reconcealment ID. The process of generating authentication information using a different authentication information generation key for each wireless tag, and (c) tag transmission by adding a decryption key ID and authentication information to the re-confidential ID Generate information and secure And (d) in the security server device, using the decryption key obtained from the received decryption key ID, the tag ID is obtained by decrypting the received re-confidential ID, The authentication information verification key obtained from the tag ID and the received authentication information are used to verify the validity of the received tag transmission information.

[2-2] Operation of RFID Tag Privacy Protection Method of the Present Invention In the RFID tag privacy protection method of the present invention according to the second configuration, in addition to the basic configuration of the RFID tag privacy protection method of the present invention according to the first configuration. Then, the authentication information is generated using the authentication information generation key that is different for each wireless tag with the re-encryption ID and the decryption key ID being generated, and the tag transmission information is also added to the re-encryption ID. Generate and send it.

  At this time, since the plurality of wireless tags share the same decryption key ID, it is impossible to relate the authentication key verification key unique to the wireless tag to the decryption key ID. Therefore, an ID for specifying the authentication information verification key needs to be included in the tag transmission information. However, if it is included as it is, there is a risk that this ID is used for tracking as a unique ID.

  Therefore, in the wireless tag privacy protection method of the present invention according to the second configuration, the authentication information verification key is acquired using the tag ID decrypted from the re-confidential ID indicating a different value each time, and is used. The validity of tag transmission information is verified.

  According to this configuration, according to the wireless tag privacy protection method of the present invention according to the second configuration, an attack for eavesdropping information transmitted from the wireless tag more reliably than the wireless tag privacy protection method of the present invention according to the first configuration. Will be able to avoid.

[2-3] Configuration of Radio Tag Device When realizing the radio tag privacy protection method of the present invention according to the second configuration, the radio tag device of the present invention is (a) a concealment stored in the radio tag. The tag ID is re-encrypted using an encryption key, and the tag ID is encrypted. The tag ID is different from that of the concealed tag ID and is different each time. A wireless tag having a means for generating a re-confidential ID indicating a code, and (b) a re-confidential ID and a decryption key ID that is shared by a plurality of wireless tags and used for decrypting the re-confidential ID. Means for generating authentication information using a different authentication information generation key for each, and (c) means for generating tag transmission information by adding a decryption key ID and authentication information to the re-confidential ID; (D) Secure tag transmission information And a means for transmitting to the server device.

  Each of the processing means described above can be realized by a computer program, and this computer program can be provided by being recorded on a recording medium such as a semiconductor memory or via a network.

[2-4] Configuration of Security Server Device When realizing the wireless tag privacy protection method of the present invention according to the second configuration, the security server device of the present invention provides the wireless server described in (a) [2-3]. The decryption key included in the received tag transmission information from the means for receiving the tag transmission information transmitted from the tag device, and (b) the storage means for storing the correspondence between the decryption key ID and the decryption key associated therewith. Means for obtaining a decryption key pointed to by ID, (c) means for obtaining a tag ID by decrypting a re-confidential ID included in received tag transmission information using the obtained decryption key, and (d) Means for obtaining an authentication information verification key pointed to by the acquired tag ID from storage means for storing a correspondence relationship between the tag ID and the authentication information verification key associated therewith; (e) receiving the acquired authentication information verification key And means for verifying the validity of the received tag transmission information using the authentication information included in the tag transmission information.

  Each of the processing means described above can be realized by a computer program, and this computer program can be provided by being recorded on a recording medium such as a semiconductor memory or via a network.

[3] Third Configuration [3-1] Configuration of Radio Tag Privacy Protection Method of the Present Invention To achieve the above object, the radio tag privacy protection method of the present invention according to the third configuration includes: The encrypted tag ID stored in is re-encrypted by using an encryption key to encrypt the tag ID, and the code is different from the encrypted tag ID. And (b) a process of generating temporary information that can be agreed with the security server device, and (c) Authentication information using a different authentication information generation key for each wireless tag, with a re-confidential ID, temporary information, and an ID of a decryption key shared by a plurality of wireless tags used for decryption of the re-confidential ID. And the process of generating (D) a process of generating tag transmission information by adding a decryption key ID, temporary information and authentication information to the re-encryption ID and transmitting the tag transmission information to the security server device; In the server device, the decryption key obtained from the received decryption key ID is used to obtain the tag ID by decrypting the received re-encryption ID, and the authentication information verification key obtained from the tag ID and the received authentication. And verifying the validity of the received tag transmission information using the information, and further determining whether or not the received temporary information is an appropriate value.

[3-2] Operation of RFID Tag Privacy Protection Method of the Present Invention In the RFID tag privacy protection method of the present invention according to the third configuration, in addition to the basic configuration of the RFID tag privacy protection method of the present invention according to the second configuration. The wireless tag device generates temporary information that can be agreed with the security server device, and generates a re-confidential ID, temporary information, and a decryption key ID for each wireless tag. Authentication information is generated using different authentication information generation keys, and tag transmission information is also generated by adding the authentication information to the re-confidential ID, and the tag transmission information is transmitted.

  In the wireless tag privacy protection method of the present invention according to the third configuration, similarly to the wireless tag privacy protection method of the present invention according to the second configuration, the tag ID decoded from the reconcealment ID indicating a different value each time is used. The authentication information verification key is acquired, and the validity of the tag transmission information is verified using the key. However, after that, the temporary information included in the verified tag transmission information is valid. It is determined whether it is a value.

  For example, time information that is synchronized with the security server device as time information (such as reading time information engraved by a clock provided inside the device or time information engraved by a clock provided outside the device) The security server device uses the temporary information by comparing the time information included in the received tag transmission information with the time information when the tag transmission information is received. It is determined whether or not is a valid value.

  In addition, for example, when the wireless tag device uses counter information synchronized with the security server device as temporary information, the security server device automatically recognizes the counter information included in the received tag transmission information. By comparing with the counter information managed by the apparatus, it is determined whether or not the temporary information is an appropriate value.

  In addition, for example, when the wireless tag device uses the challenge data received from the security server device as temporary information, the security server device uses the challenge data included in the received tag transmission information and the challenge data transmitted by the device itself. To determine whether or not the temporary information is a reasonable value.

  According to this configuration, according to the wireless tag privacy protection method of the present invention according to the third configuration, an attack for eavesdropping information transmitted from the wireless tag more reliably than the wireless tag privacy protection method of the present invention according to the first configuration. The information transmitted from the wireless tag is valid by using temporary information that can be agreed between the wireless tag device and the security server device. Therefore, an attack that reuses information transmitted from the wireless tag can be avoided.

[3-3] Configuration of Radio Tag Device When realizing the radio tag privacy protection method of the present invention according to the third configuration, the radio tag device of the present invention is (a) concealment stored in the radio tag. The tag ID is re-encrypted using an encryption key, and the tag ID is encrypted. The tag ID is different from that of the concealed tag ID and is different each time. Means for generating a re-confidential ID indicating a code, (b) means for generating temporary information that can be agreed with the security server device, and (c) a re-confidential ID and a temporary Means for generating authentication information using a different authentication information generation key for each wireless tag, with the information and a decryption key ID shared by a plurality of wireless tags and used for decryption of the re-encryption ID as a generation target; D) For the re-confidential ID The means for generating the tag transmission information by adding the decryption key ID, the temporary information and the authentication information, and (e) means for transmitting the tag transmission information to the security server device are provided.

  Each of the processing means described above can be realized by a computer program, and this computer program can be provided by being recorded on a recording medium such as a semiconductor memory or via a network.

[3-4] Configuration of Security Server Device When realizing the wireless tag privacy protection method of the present invention according to the third configuration, the security server device of the present invention provides the wireless server described in (a) [3-3]. The decryption key included in the received tag transmission information from the means for receiving the tag transmission information transmitted from the tag device, and (b) the storage means for storing the correspondence between the decryption key ID and the decryption key associated therewith. Means for obtaining a decryption key pointed to by ID, (c) means for obtaining a tag ID by decrypting a re-confidential ID included in received tag transmission information using the obtained decryption key, and (d) Means for obtaining an authentication information verification key pointed to by the acquired tag ID from storage means for storing a correspondence relationship between the tag ID and the authentication information verification key associated therewith; (e) receiving the acquired authentication information verification key Means for verifying the validity of the received tag transmission information using the authentication information included in the received tag transmission information, and (f) whether the temporary information included in the received tag transmission information is a valid value. And a means for determining whether or not.

  Each of the processing means described above can be realized by a computer program, and this computer program can be provided by being recorded on a recording medium such as a semiconductor memory or via a network.

  In this way, according to the present invention, the tag ID transmitted from the wireless tag is concealed, and it looks as if it is different, and further, the information necessary for decoding the tag ID Therefore, an attack for eavesdropping information transmitted from the wireless tag can be avoided.

  In addition, at this time, authentication information that enables detection of tampering or the like is added to information transmitted from the wireless tag, and a key used for verification of the authentication information is determined from information transmitted from the wireless tag. Therefore, it is possible to avoid an attack for falsifying information transmitted from the wireless tag.

  Further, at this time, temporary information that is valid only for a certain period is added to the information transmitted from the wireless tag, and based on the temporary information, the validity of the information transmitted from the wireless tag is determined. Therefore, it is possible to avoid an attack that reuses (replay attack) information transmitted from the wireless tag.

  Hereinafter, the present invention will be described in detail according to embodiments.

  FIG. 1 illustrates an example of a system to which the present invention is applied.

  As shown in this figure, in a system to which the present invention is applied, a wireless tag 10 such as an active tag is carried by a person and stored in the wireless tag 10 and a client computer 20 having a wireless tag reader 21. A security server 30 that performs decryption processing and authentication processing of the encrypted ID and an information management server 40 that manages various types of information are connected via the Internet 50.

  In the system to which the present invention is configured as described above, when the client computer 20 receives tag transmission information from the wireless tag 10, the client computer 20 transfers the tag transmission information to the security server 30, thereby decrypting the security server 30. Upon receiving an authentication request, the security server 30 executes decryption and authentication processing, and returns the result to the client computer 20.

  FIG. 2 illustrates an example of an apparatus configuration of the wireless tag 10.

  In the figure, 100 is an encryption ID storage area, which is an encryption ID storage area (encrypted original tag ID), and 101 is an encryption public key storage area for encryption. A public key storage area, 102 is a re-encryption unit that re-encrypts an encryption ID, and 103 is a re-encryption ID storage area, which is a storage area for a re-encryption ID. 104, a decryption key ID storage area, which is a storage area for the ID of a decryption key used for decryption of the re-encryption ID, 105, a clock unit, which records time, and 106, a damper An authentication private key storage area configured by a memory, which is an authentication private key storage area used for generating authentication information, and 107 is an authentication information generation unit for generating authentication information and tagging The one that generates transmission information, 108 is a wireless transmission unit I, and transmits the tag sends information to the client computer 20.

  Some probabilistic ciphers or similar ciphers can convert a ciphertext into another ciphertext of the same plaintext without knowing the content of the plaintext. In other words, when a plaintext is a and an encrypted version is A, there is one that can convert the ciphertext A into another ciphertext A ′ of the same plaintext a without knowing the contents of the plaintext a. . Public key cryptography that enables such re-encryption includes, for example, E1Gamal cryptography (for example, ISBN4-7828-5353-X “Modern Cipher” p118-126) and higher-order residue cryptography.

  This re-encryption is a kind of probabilistic encryption, and by entering a random number element from now on, even when re-encrypting the same encryption ID, a different code is generated each time re-encryption is performed. Become. From now on, every time re-encryption is performed, the re-encryption ID is transmitted as a different code. Therefore, when transmitting the encryption ID stored in the encryption ID storage area 100, the encryption ID is related to the encryption ID. Information can be kept secret from third parties.

  The re-encryption unit 102 uses re-encryption having such a property, and the encryption ID stored in the encryption ID storage area 100 and the encryption public key stored in the encryption public key storage area 101 And re-encrypting the read encryption ID using the read encryption public key to generate a re-encryption ID.

  The decryption key ID storage area 104 stores the ID of the decryption key used for decrypting the re-encryption ID generated by the re-encryption unit 102. This decryption key ID is prepared as a unique ID. There is a risk that the behavior of the person who owns the wireless tag 10 will be tracked using it. Therefore, the present invention employs a configuration in which a plurality of wireless tags 10 share the same decryption key ID. Thus, the decryption key ID stored in the decryption key ID storage area 104 is also used by other wireless tags 10.

  Upon receiving the re-encryption ID generated by the re-encryption unit 102, the authentication information generation unit 107 generates the generated re-encryption ID (read from the re-encryption ID storage area 103) as shown in FIG. From the authentication private key storage area 106, the ID of the decryption key (read from the decryption key ID storage area 104) used to decrypt the re-encryption ID and the time information engraved by the clock unit 105 are generated. By generating authentication information using the read secret key for authentication, tag transmission information (shown in FIG. 3) combining these is generated.

  FIG. 4 illustrates an example of an apparatus configuration of the security server 30.

  In the figure, 300 is a decryption private key table that manages the decryption private key in association with the decryption key ID, and 301 is a verification public key table that is associated with the tag ID and is made public for verification. A key management unit 302 is a clock unit that records time, and a decryption unit 303 executes decryption processing of a re-encryption ID included in tag transmission information transferred from the client computer 20. Thus, the tag ID is decrypted, 304 is a tag ID storage area, which is a storage area for the tag ID decrypted by the decryption unit 303, and 305 is an authentication information verification unit from the client computer 20. The one for verifying the validity of the tag transmission information transferred, 306 is a one-time determination unit, which transmits the tag transmitted from the client computer 20. It is to determine the validity of time information included in the information (confirmation).

  FIG. 5 illustrates an example of a processing flow executed by the wireless tag 10 configured as illustrated in FIG. 2, and FIG. 6 illustrates an example of a processing flow performed by the security server 30 configured as illustrated in FIG. To do.

  Next, according to these processing flows, the processing of the present invention will be described in detail.

  When there is a transmission request for tag transmission information, the wireless tag 10 first, at step 10, first, the encryption ID stored in the encryption ID storage area 100 and the encryption The encryption public key stored in the public key storage area 101 is read, and in the subsequent step 11, the read encryption ID is re-encrypted by using the read encryption public key to re-encrypt the ID. Is generated.

  Subsequently, in step 12, the decryption key ID stored in the decryption key ID storage area 104, the time information engraved by the clock unit 105, and the authentication private key stored in the authentication private key storage area 106 are read out, In the subsequent step 13, authentication information is generated using the read private key for authentication with the generated re-encryption ID and the read decryption key ID / time information as a generation target.

  Subsequently, in step 14, tag decryption information as shown in FIG. 3 is generated by adding a decryption key ID, time information, and authentication information to the re-encryption ID. The generated tag transmission information is transmitted to the client computer 20, and the process is terminated.

  When the client computer 20 receives the tag transmission information from the wireless tag 10, the client computer 20 transfers the tag transmission information to the security server 30, thereby issuing a decryption / authentication request to the security server 30.

  Upon receiving this decryption / authentication request, the security server 30 receives the tag transmission information, and as shown in the processing flow of FIG. 6, first, in step 20, the decryption key ID included in the tag transmission information is keyed. Then, the decryption private key is obtained by referring to the decryption private key table 300, and in the subsequent step 21, the recursive encryption ID included in the tag transmission information is decrypted using the obtained decryption private key. Thus, the tag ID is decrypted.

  Subsequently, in step 22, a verification public key is obtained by referring to the verification public key table 301 using the decrypted tag ID as a key, and in step 23, the acquired verification public key is used. The received tag transmission information is obtained by decrypting the authentication information included in the tag transmission information and determining whether or not it matches the decryption key ID / re-encryption ID / time information included in the tag transmission information. Verification processing is performed to determine whether or not the tag transmission information is not falsified.

  Subsequently, in step 24, it is determined whether or not it is verified that the tag transmission information is legitimate tag transmission information that has not been falsified by the verification processing in step 23, and it is determined that the tag transmission information has been falsified. When the process proceeds to step 28, the client computer 20 is replied that the tag transmission information requested for decryption / authentication is not valid, and the process is terminated.

  On the other hand, when it is determined in step 24 that the tag transmission information that has not been tampered with by the verification processing in step 23 has been verified, the process proceeds to step 25 to validate the time information included in the tag transmission information. By determining the property, it is determined whether or not the received tag transmission information is valid tag transmission information.

  For example, a difference time between the time information included in the tag transmission information and the time information read from the clock unit 302 in the own device is detected, and the difference time is within a predetermined range such as, for example, within one minute ( Whether the received tag transmission information is legitimate tag transmission information by determining whether the time information included in the tag transmission information is valid by checking whether it is entered (determined by the service content etc.) Determine whether.

  Subsequently, in step 26, it is determined whether or not the time information included in the tag transmission information is valid by the determination process in step 25, and it is determined that the time information is not valid. When it is determined that the received tag transmission information is not valid tag transmission information, the process proceeds to step 28, and the tag transmission information requested for decryption / authentication to the client computer 20 is not valid. Is returned and the processing is terminated.

  On the other hand, when it is determined in step 26 that the time information is valid, it is determined that the received tag transmission information is valid tag transmission information, and the process proceeds to step 27 where the client computer 20 is decrypted. A reply that the tag transmission information requested for authentication is valid and the decrypted tag ID is returned, and the process is terminated.

  In this way, in the present invention, as a basic configuration, a re-encryption ID is generated by re-encrypting the encryption ID stored in the wireless tag 10 using the public key for encryption. Is transmitted so that the tag ID looks variable.

  Further, at this time, an ID of a decryption key used for decryption of the re-encryption ID is added. If this decryption key ID is made unique for each wireless tag 10, this decryption key ID Considering that tracking of a wireless tag becomes possible due to uniqueness, a plurality of wireless tags 10 share the same decryption key ID, and the security server 30 re-encrypts from the decryption key ID. Such a tracking is made impossible by obtaining a decryption key used for decryption of the encrypted ID.

  According to this basic configuration, according to the present invention, an attack for eavesdropping on information transmitted from the wireless tag 10 can be avoided.

  In addition to adopting this basic configuration, the present invention generates a re-encryption ID and a decryption key ID, and generates authentication information by using a different authentication private key for each wireless tag 10, The tag transmission information is also generated by adding it to the re-encryption ID and transmitted.

  At this time, since the plurality of wireless tags 10 share the same decryption key ID, a verification public key unique to the wireless tag 10 cannot be related to the decryption key ID. Therefore, an ID for specifying the verification public key needs to be included in the tag transmission information. However, if the ID is included as it is, there is a risk that this ID is used for tracking as a unique ID.

  Therefore, the security server 30 acquires a verification public key using a tag ID that is decrypted from a re-encryption ID that shows a different value each time, and uses it to verify the validity of the tag transmission information. I have to.

  By adding the verification function based on the authentication information to the basic configuration, according to the present invention, it is possible to more reliably avoid an attack of eavesdropping information transmitted from the wireless tag 10.

  Furthermore, in addition to the verification function based on the authentication information, the present invention uses time information, uses a re-encryption ID, time information, and a decryption key ID as a generation target and uses a different authentication secret key for each wireless tag 10. Then, authentication information is generated, and it is also added to the re-encryption ID to generate tag transmission information and transmit it. On the security server 30 side, the validity of the transmitted tag transmission information is further verified using the time information included in the tag transmission information.

  By further adding a verification function based on this time information, according to the present invention, in addition to being able to avoid an eavesdropping on information transmitted from the wireless tag 10, it is transmitted from the wireless tag 10. It is possible to avoid attacks that reuse information (replay attack).

  The radio tag 10 shown in FIG. 2 employs a configuration in which the clock unit 105 is provided inside the radio tag 10, but as shown in FIG. 7, a radio reception unit 110 that receives time information transmitted from the outside by radio transmission. And a time information storage area 111 that temporarily stores the received time information and provides it to the authentication information generation unit 107 may be adopted.

  For example, the wireless reception unit 110 receives time information notified at the time of a reading request from the wireless tag reading device 21 included in the client computer 20 and writes the time information in the time information storage area 111.

  Thus, according to the configuration shown in FIG. 7, the wireless tag 10 can omit the clock unit 105 required by the wireless tag 10 according to the configuration shown in FIG.

  Further, in the wireless tag 10 shown in FIG. 2, the time information is used as information synchronized with the security server 30, and the validity of the tag transmission information is determined using the time information. It is also possible to use information other than time information as information synchronized with the time 30.

  FIG. 8 illustrates an embodiment in which a counter value is used as information that is synchronized with the security server 30. FIG. 9 illustrates information that is synchronized with the security server 30, for example, An embodiment example in the case of using challenge data such as a random number value (giving data and seeing a response to the challenge data is referred to as challenge data) is shown.

  That is, in the embodiment shown in FIG. 8, the wireless tag 10 has a configuration including a counter value holding unit 1000 that holds a counter value, and the authentication information generating unit 107 replaces the time information with the counter value holding unit 1000. The authentication information is generated using the counter value held by the counter value, and when the authentication information is generated, the counter value held by the counter value holding unit 1000 is increased by one.

  On the other hand, the security server 30 includes a counter value management unit 3000 that manages the counter value of each wireless tag 10, and a counter value that compares the counter value included in the tag transmission information with the counter value managed by the counter value management unit 3000. When the tag transmission information is transmitted from the wireless tag 10 via the client computer 20 using the configuration including the comparison unit 3001, the counter value comparison unit 3001 displays the counter value and the counter value included in the tag transmission information. The counter value held by the management unit 3000 is compared, and if it is within a predetermined range, it is determined that the tag transmission information is valid, and the counter value management unit 3000 manages it according to the transmitted counter value. Process to update the counter value.

  According to this configuration, in the embodiment shown in FIG. 8, the security server 30 can detect whether or not the tag transmission information transmitted from the wireless tag 10 has been reused (replay attack). .

  The predetermined range used for determining whether or not the counter value included in the tag transmission information transmitted from the wireless tag 10 is valid depends on the operation method and the service content. The counter value included in the information may be larger than the counter value managed by the security server 30.

  Here, as a reason that the strict condition that the counter value included in the tag transmission information is only one larger than the counter value managed by the security server 30 is not imposed, the counter value of the wireless tag 10 is not synchronized with the security server 30. This is because it may increase. For example, in the case of a tag that sends data indefinitely in response to a request from a wireless reader such as a passive tag, only the counter of the wireless tag 10 may increase in response to a read request from an unauthorized reader. Because there is. Further, even when there is no reading device such as an active tag, only the counter value of the wireless tag 10 increases when the wireless tag 10 regularly sends data regularly.

  In the exemplary embodiment shown in FIG. 9, the wireless tag 10 holds a challenge data receiving unit 1100 that receives challenge data (for example, a random value) broadcast from the security server 30 and the latest challenge data that has been broadcast. The authentication data generating unit 107 has a configuration including a challenge data holding unit 1101 that performs a challenge data update unit 1102 that updates challenge data held by the challenge data holding unit 1101 according to the challenge data received by the challenge data receiving unit 1100. However, instead of the time information, the authentication data is generated using the challenge data held by the challenge data holding unit 1101.

  On the other hand, the security server 30 includes a challenge data broadcasting unit 3100 that broadcasts challenge data, a challenge data holding unit 3101 that holds challenge data broadcast by the challenge data broadcasting unit 3100, and challenge data and challenge data included in the tag transmission information. When the tag transmission information is transmitted from the wireless tag 10 via the client computer 20 using a configuration including a challenge data comparison unit 3102 that compares the challenge data held by the holding unit 3101, the challenge data comparison unit 3102 compares the challenge data included in the tag transmission information with the challenge data held in the challenge data holding unit 3101. For example, the challenge data included in the tag transmission information is stored in the challenge data holding unit 3101. When matching the challenge data is processed to determine as a valid tag transmission information.

  According to this configuration, in the exemplary embodiment shown in FIG. 9, the security server 30 can detect whether the tag transmission information transmitted from the wireless tag 10 has been reused (replay attack). .

It is a figure which shows an example of the system to which this invention is applied. It is an example of an apparatus configuration of a wireless tag. It is explanatory drawing of the tag transmission information which an authentication information generation part produces | generates. It is an example of an apparatus configuration of a security server. It is a processing flow which a wireless tag performs. It is the processing flow which a security server performs. It is another example of an apparatus configuration of a wireless tag. It is a block diagram of an apparatus structure in case a counter value is used. It is a block diagram of an apparatus structure in the case of using challenge data.

Explanation of symbols

10 wireless tag 20 client computer 21 wireless tag reader 30 security server 40 information management server 50 internet

Claims (19)

A wireless tag privacy protection method used for avoiding an attack of eavesdropping information transmitted from a wireless tag,
The encrypted tag ID stored in the wireless tag is re-encrypted by using an encryption key to encrypt the tag ID, and the anonymized tag ID is A process of generating a re-confidential ID indicating a different code and indicating a different code each time,
Tag transmission information is generated by adding a decryption key ID that is shared by a plurality of wireless tags and used for decryption of the re-confidential ID to the re-confidential ID, toward the security server device Sending process,
In the security server device, comprising a step of obtaining a tag ID by decrypting the re-encrypted ID using a decryption key obtained from the decryption key ID,
A wireless tag privacy protection method. A wireless tag privacy protection method used for avoiding an attack of eavesdropping information transmitted from a wireless tag,
The encrypted tag ID stored in the wireless tag is re-encrypted by using an encryption key to encrypt the tag ID, and the anonymized tag ID is A process of generating a re-confidential ID indicating a different code and indicating a different code each time,
Generate authentication information using a different authentication information generation key for each wireless tag with the re-confidential ID and a decryption key ID shared by a plurality of wireless tags used for decryption of the re-confidential ID as a generation target The process of
A process of generating tag transmission information by adding the decryption key ID and the authentication information to the re-confidential ID and transmitting the tag transmission information to the security server device;
In the security server device, a tag ID is obtained by decrypting the re-encryption ID using a decryption key obtained from the decryption key ID, and an authentication information verification key obtained from the tag ID, the authentication information, And verifying the validity of the tag transmission information using
A wireless tag privacy protection method. A wireless tag privacy protection method used to eavesdrop on and reuse information transmitted from a wireless tag,
The encrypted tag ID stored in the wireless tag is re-encrypted by using an encryption key to encrypt the tag ID, and the anonymized tag ID is A process of generating a re-confidential ID indicating a different code and indicating a different code each time,
A process of generating temporary information that can be agreed with the security server device;
Using different authentication information generation keys for each wireless tag, with the re-concealment ID, the temporary information, and the ID of a decryption key shared by a plurality of wireless tags and used for decrypting the re-concealment ID used as a generation target The process of generating authentication information
A process of generating tag transmission information by adding the decryption key ID, the temporary information, and the authentication information to the re-encryption ID, and transmitting the tag transmission information to the security server device;
In the security server device, a tag ID is obtained by decrypting the re-encryption ID using a decryption key obtained from the decryption key ID, and an authentication information verification key obtained from the tag ID, the authentication information, And verifying the validity of the tag transmission information, and further comprising determining whether or not the temporary information is a valid value,
A wireless tag privacy protection method. A wireless tag device used in an automatic recognition system using a wireless tag that makes it possible to avoid an attack of eavesdropping information transmitted from the wireless tag,
The encrypted tag ID stored in the wireless tag is re-encrypted by using an encryption key to encrypt the tag ID, and the anonymized tag ID is Means for generating a re-confidential ID indicating a different code and indicating a different code each time;
Means for generating tag transmission information by adding an ID of a decryption key shared by a plurality of wireless tags and used for decryption of the reconcealment ID to the reconcealment ID;
Means for transmitting the tag transmission information toward the security server device,
A wireless tag device. A security server device used in an automatic recognition system using a wireless tag that can avoid an attack of eavesdropping information transmitted from the wireless tag,
Means for receiving tag transmission information transmitted from the wireless tag device according to claim 4;
Means for obtaining a decryption key pointed to by the decryption key ID included in the received tag transmission information from a storage means for storing the correspondence between the decryption key ID and the decryption key associated therewith;
Means for obtaining a tag ID by decrypting the re-confidential ID included in the received tag transmission information using the obtained decryption key,
A security server device. A wireless tag device used in an automatic recognition system using a wireless tag that makes it possible to avoid an attack of eavesdropping information transmitted from the wireless tag,
The encrypted tag ID stored in the wireless tag is re-encrypted by using an encryption key to encrypt the tag ID, and the anonymized tag ID is Means for generating a re-confidential ID indicating a different code and indicating a different code each time;
Generate authentication information using a different authentication information generation key for each wireless tag with the re-confidential ID and a decryption key ID shared by a plurality of wireless tags used for decryption of the re-confidential ID as a generation target Means to
Means for generating tag transmission information by adding the decryption key ID and the authentication information to the re-confidential ID;
Means for transmitting the tag transmission information toward the security server device,
A wireless tag device. A security server device used in an automatic recognition system using a wireless tag that can avoid an attack of eavesdropping information transmitted from the wireless tag,
Means for receiving tag transmission information transmitted from the wireless tag device according to claim 6;
Means for obtaining a decryption key pointed to by the decryption key ID included in the received tag transmission information from a storage means for storing the correspondence between the decryption key ID and the decryption key associated therewith;
Means for obtaining a tag ID by decrypting the re-confidential ID included in the received tag transmission information using the obtained decryption key;
Means for obtaining an authentication information verification key pointed to by the acquired tag ID from a storage means for storing a correspondence relationship between the tag ID and an authentication information verification key associated therewith;
Means for verifying the validity of the received tag transmission information using the obtained authentication information verification key and the authentication information included in the received tag transmission information;
A security server device. A wireless tag device used in an automatic recognition system using a wireless tag that allows an eavesdropping on information transmitted from the wireless tag and avoids an attack to be reused,
The encrypted tag ID stored in the wireless tag is re-encrypted by using an encryption key to encrypt the tag ID, and the anonymized tag ID is Means for generating a re-confidential ID indicating a different code and indicating a different code each time;
Means for generating temporary information that can be agreed with the security server device;
Using different authentication information generation keys for each wireless tag, with the re-concealment ID, the temporary information, and the ID of a decryption key shared by a plurality of wireless tags and used for decrypting the re-concealment ID used as a generation target Means for generating authentication information,
Means for generating tag transmission information by adding the decryption key ID, the temporary information, and the authentication information to the re-confidential ID;
Means for transmitting the tag transmission information to the security server device,
A wireless tag device. The wireless tag device according to claim 8, wherein
The means for generating the temporary information uses time information synchronized with the security server device as the temporary information.
A wireless tag device. The wireless tag device according to claim 9,
The means for generating the temporary information generates the temporary information by reading time information engraved by a clock provided in the device itself.
A wireless tag device. The wireless tag device according to claim 9,
The means for generating the temporary information generates the temporary information by receiving time information engraved by a clock provided outside the device.
A wireless tag device. The wireless tag device according to claim 8, wherein
The means for generating the temporary information uses counter information synchronized with the security server device as the temporary information.
A wireless tag device. The wireless tag device according to claim 8, wherein
The means for generating the temporary information uses the challenge data received from the security server device as the temporary information.
A wireless tag device. A security server device used in an automatic recognition system using a wireless tag that enables eavesdropping on information transmitted from the wireless tag and avoiding an attack to be reused,
Means for receiving tag transmission information transmitted from the wireless tag device according to claim 8;
Means for obtaining a decryption key pointed to by the decryption key ID included in the received tag transmission information from a storage means for storing the correspondence between the decryption key ID and the decryption key associated therewith;
Means for obtaining a tag ID by decrypting the re-confidential ID included in the received tag transmission information using the obtained decryption key;
Means for obtaining an authentication information verification key pointed to by the acquired tag ID from a storage means for storing a correspondence relationship between the tag ID and an authentication information verification key associated therewith;
Means for verifying the validity of the received tag transmission information using the acquired authentication information verification key and the authentication information included in the received tag transmission information;
Means for determining whether or not the temporary information included in the received tag transmission information is a valid value,
A security server device. The security server device according to claim 14,
When the time information is used as the temporary information, the means for determining whether or not the temporary information is an appropriate value includes the time information included in the received tag transmission information and the tag transmission information. Determining whether or not the temporary information is a reasonable value by comparing with the time information when received,
A security server device. The security server device according to claim 14,
The means for determining whether or not the temporary information is a valid value is the received tag when counter information synchronized with the own device is used as the temporary information. Determining whether or not the temporary information is an appropriate value by comparing the counter information included in the transmission information with the counter information managed by the own device;
A security server device. The security server device according to claim 14,
The means for determining whether or not the temporary information is a valid value is that the challenge data transmitted by the device itself is used as the temporary information, the challenge included in the received tag transmission information Determining whether the temporary information is a reasonable value by comparing the data with the challenge data transmitted by the device itself,
A security server device.   14. A wireless tag device program for causing a computer to execute processing used to realize the wireless tag device according to claim 4, 6, 8, 9, 10, 11, 12, or 13.   18. A security server device program for causing a computer to execute processing used to realize the security server device according to claim 5, 7, 14, 15, 16, or 17.

Images