JP2005167670A - Id automatic identification system, tag device, center device, id automatic identification method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To inexpensively and sufficiently prevent the tracking of ID information by an unauthorized third party without applying a large processing load to a center device in RFID and AutoID or the like. <P>SOLUTION: Recording ID information UIDj and temporary information CNT<SB>k</SB>are recorded in a tag device 10. A master key and its key ID number (MKj, KIDj) are recorded in the tag device 10 and the center device 30. A temporary key OSK<SB>k</SB>is generated by using the CNT<SB>k</SB>and the MKj in the tag device 10. The UIDj is encrypted by using the temporary key OSK<SB>k</SB>, and variable ID information nonceID<SB>k</SB>is generated. After the temporary information CNT<SB>k</SB>is updated to CNT<SB>k+1</SB>in the tag device 10; the generated nonceID<SB>k</SB>, the CNT<SB>k</SB>, and the KIDj are transmitted to the center device 30. The center device 30 generates the OSK<SB>k</SB>by using the nonceID<SB>k</SB>, the CNT<SB>k</SB>, the KIDj, and the recorded (MKj, KIDj) and decrypts the UIDj. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a technology for automatically identifying identification information (ID information) such as a product or a service authorized person recorded in a tag device through an external reader, and in particular, it is impossible to track unauthorized ID information. The ID automatic identification system which implement | achieves, the tag apparatus and center apparatus which comprise it, ID automatic identification method, the program for making a computer perform those functions, and the recording medium which stored this program.

  In recent years, by automatically identifying identification information (ID information) such as authorized users of products and services through an external reader (reader device), product logistics management and service user management can be efficiently performed. Systems to do so are being introduced. In particular, ID automatic identification devices such as RFID and AutoID that realize logistics management of a product by attaching a low-cost small wireless tag device in which fixed ID information different for each product is embedded to the product are efficient in stores. In addition to logistics management, it is expected to help prevent shoplifting and illegal resale of stolen goods. This is because different fixed ID information is set for each product, and a database server on the center apparatus side checks the ID information to determine whether it is an illegally resold product.

  [Conventional method 1] If it is assumed that a small wireless tag is attached to an inexpensive product, the manufacturing cost of the tag is required to be low. For this reason, as shown in FIG. 9, a small wireless tag device 310 in which only fixed ID information 311 that is different for each product is embedded is attached to the product, and the same ID information is always received in response to an ID information request from the reader device 320. A wireless transmission system is used. Here, the ID information transmitted from the small wireless tag device 310 is sent to the center device 330 through the reader device 320, and the center device 330 stores the information in the ID-product information relation database 331 and the stolen product information 332 held by itself. The product information corresponding to the sent ID information is returned to the reader device 320.

However, there is a possibility that the reader device 320 is installed everywhere such as a store entrance. In the case of this method, fixed ID information is continuously transmitted by radio every time the product passes in front of the reader device 320. This means that the product itself can be tracked by tracking the ID information. In addition, when the ID information of the product and the purchaser information are linked at the time of purchase or the like, the purchaser can be tracked by tracking the ID information.
In addition, since different fixed ID information is assigned to each product, it becomes possible to check the belongings of a person who has passed in front of the reader device 320.
The following three methods have been proposed as means for solving such privacy-related problems.

[Conventional method 2] In this method, ID information (or a small wireless tag itself) is physically revoked at the time of purchase or the like, and subsequent automatic ID identification cannot be used. That is, in this method, the small wireless tag in which the ID information is embedded is used only for logistics management up to the product manufacturing / distribution / sales stage. A typical example of this method is shown in Non-Patent Document 1, for example.
However, in this method, although the inability to trace ID information after product purchase is realized, it is impossible to construct a mechanism that can be realized as an original automatic ID identification device, such as preventing shoplifting and illegal resale of stolen goods. .

[Conventional method 3] In this method, ID information is updated at regular / irregular timing, and different ID information is allocated depending on the time even for the same product. A typical example of this method is shown in Non-Patent Document 2.
This is the same as the conventional method 1 until different fixed ID information is assigned for each product, but the fixed ID information itself is not embedded in a small wireless tag, but is encrypted after using public key cryptography. Embed encryption ID information. Then, at the regular / irregular timing, the center device or the reader device once decrypts the encrypted ID information, and overwrites it again with the re-encrypted ID information encrypted by the public key cryptosystem. Thus, the ID information cannot be tracked every time the encrypted ID information is updated. Further, the original fixed ID information cannot be read from the encrypted ID information by encrypting with the public key cryptosystem.

  The problem with this method is that it is necessary to manufacture a small wireless tag at a low cost, so that the public key encryption method cannot be incorporated into the tag itself, and re-encryption must be performed on the center device or reader device side. It is. That is, in the case of this method, the same encrypted ID information is continuously used until the update is performed. Therefore, if the update period is long, the effect is not different from the case where the conventional fixed ID information is used. On the other hand, if the update period is shortened, re-encryption requests are frequently issued. In addition, since this method uses a public key cryptosystem, the processing efficiency is low, and there is also a problem that the fixed ID information is once exposed every time it is updated. In particular, when re-encryption is performed by the reader device, it is necessary for each reader device to hold all the secret keys for decryption. Therefore, security measures on the reader device side are extremely important for safe operation. However, the cost of implementing such measures increases as the number of outlets installed in stores increases.

[Conventional method 4] In this method, ID information is updated each time using a hash function, and different ID information is assigned even for the same product. A typical example of this method is shown in Non-Patent Document 3.
This method is the same as the conventional method 1 until different fixed ID information is assigned to each product and the fixed ID information id is embedded in the small wireless tag device. However, it is different in that a random number r is generated every time an ID information request from the reader device is calculated, and a hash value H (id | r) is calculated. Then, the small wireless tag device transmits (H (id | r), r) as variable ID information to the reader device. The reader device transmits the received variable ID information (H (id | r), r) to the center device in order to obtain product information. The center device calculates H (idi | r) for all the ID information idi recorded in the database, and searches for one that matches the received H (id | r). As a result of the search, the matched ID information idi is the fixed ID information id embedded in the small wireless tag device, and the corresponding product information is returned to the reader device.

In this method, since the variable ID information (H (id | r), r) to be transmitted is different every time, the ID information cannot be traced.
However, the problem with this method is that the fixed ID information id is embedded in the small wireless tag device, so that if the tampering property of the small wireless tag device is broken and the fixed ID information id leaks, the r to H (id | r ) Can be calculated. Thereby, it is possible to determine whether or not the variable ID information (H (id | r), r) is the fixed ID information id. In addition, it is necessary to provide a small-sized wireless tag with a random number generation circuit having a relatively large circuit scale and high cost, and there is a problem in manufacturing the tag at low cost. As for the processing of the center apparatus, it is necessary to calculate the hash value for all ID information recorded in the database and search for fixed ID information whose calculation result matches the variable ID information. There is a problem in terms of mounting.

[Conventional method 5] Further, as an improved method of the conventional method 4, there is, for example, the one shown in Non-Patent Document 4. This is the same as the conventional method 4 until different fixed ID information is assigned for each product, but is different in that the ID information embedded in the small wireless tag device is sequentially updated as the update ID information idn.
That is, in response to the ID information request from the reader device, this type of small RFID device transmits the hash value H (idn) of the updated ID information idn based on the first hash function as variable ID information to the reader device. At the same time, the small wireless tag device updates the update ID information to idn + 1 = G (idn) by the second hash function, and overwrites and records the updated update ID information in the small wireless tag device.

  In order to obtain product information, the reader device transmits variable ID information H (idn) to the center device. The center device applies the second hash function as many times as necessary to all ID information idi recorded in the database to obtain update ID information, and variable ID information obtained by applying the first hash function to the ID information idi H (G (G (... G (idi) ...))) is calculated. A search is made for a result that matches the variable ID information sent from the reader device, and the ID information idi at the time of matching is determined to be the fixed ID information id embedded in the small wireless tag, and the corresponding product Return information to the reader.

In this method, the variable ID information is different every time communication is performed, and thus it becomes impossible to track the ID information. Further, since the update ID information is updated every time using a hash function, even if the tampering property of the small wireless tag is broken and the update ID information idn at that time leaks, the variable ID information before that is obtained. I can't.
Further, compared with the conventional method 4, fewer circuits are required for the small RFID tag device (using a relatively small hash function instead of the random number generation circuit), and even if the update ID information idn leaks, The variable ID information cannot be obtained.
SE Sarma, SA Weis, and DW Engels, “Radio-frequency identification systems,” CHES'02 A. Juels and R. Pappu, “Squealing Euros: Privacy Protection in RFID-Enabled Banknotes,” Financial Cryptography 2003 SA Weis, SE Sarma, RL Rivest, and DW Engles, “Security and Privacy Aspects of Low-Cost Radio Frequency Identification Systems,” First International Conference on Security in Pervasive Computing M. Ookubo, K. Suzuki, and S. Kinoshita, “Forward-Secure RFID Privacy Protection Scheme,” CSS2003

  However, the conventional method 5 has a problem that the load on the center device side becomes very large. That is, as described above, when providing the product information to the reader device, the center device applies the second hash function as many times as necessary to all ID information idi recorded in the database, and updates the ID. It is necessary to perform a great deal of processing to obtain information, calculate variable ID information to which the first hash function is applied, and then search for information that matches the variable ID information sent from the reader device. . In particular, if the number of repetitions of the second hash function is not known or the number is very large, it takes a considerable time to check only one ID information.

Further, if the tampering property of the small wireless tag device is broken and the update ID information idn at that time leaks, the third party who has acquired the update ID information idn can obtain the variable ID information thereafter. There is also a point.
The present invention has been made in view of such points, and an automatic ID identification system that can sufficiently prevent tracking of ID information by an unauthorized third party at a low cost without imposing a large processing burden on the center apparatus. The purpose is to provide.
Another object of the present invention is to provide a tag device that can sufficiently prevent the tracking of ID information by an unauthorized third party at a low cost without imposing a large processing burden on the center device.

Another object of the present invention is to provide a center apparatus that can sufficiently prevent the tracking of ID information by an unauthorized third party at a low cost without imposing a large processing burden on the center apparatus.
Another object of the present invention is to provide an automatic ID identification method that can sufficiently prevent the tracking of ID information by an unauthorized third party at a low cost without imposing a large processing burden on the center apparatus.

  In the present invention, in order to solve the above problems, first, recording ID information, first key information, and temporary information are recorded in the tag device, and second key information is recorded in the center device. Then, in the tag device, a first temporary key is generated using the first key information and the temporary information, and the recording ID information is encrypted by the common key encryption method using the first temporary key, Variable ID information is generated. Further, in the tag device, the temporary information recorded in the temporary information recording means is updated, and the generated variable ID information and the temporary information used for generating the first temporary key are transmitted. The transmitted variable ID information and temporary information are received by the center device. Then, the center device generates a second temporary key using the temporary information and the recorded second key information, and decrypts the variable ID information using the second temporary key.

Here, when the temporary information is updated in the tag device, the variable ID information generated before and after the update is different. As a result, it is possible to prevent a situation where an unauthorized third party tracks ID information based on the commonality of the transmitted variable ID information.
Further, as long as at least all the key information is kept secret, the variable ID information cannot be obtained from the record ID information recorded in the tag device, and the record ID information cannot be obtained from the variable ID information. Thereby, even if the tampering property of the tag device is broken and the record ID information recorded in the tag device leaks, the unauthorized third party can change the variable ID information communicated with the leaked record ID information. I cannot take correspondence with. Therefore, even if the tampering property of the tag device is broken, an unauthorized third party cannot track the ID information before and after that. From the above, it is possible to sufficiently achieve non-authoritative ID information untrackability.

On the other hand, in the center device, all of the key information, the temporary information, and the variable ID information are collected, so that the recording ID information can be restored with a very small processing load. Thereby, the ease of ID information tracking based on authority is ensured, and the processing load in the center apparatus is reduced.
Also, the encryption processing performed in the tag device is performed using a common key encryption method, and random number generation and public key encryption processing are not performed at all. As this common key encryption method, for example, Camellia or AES can be used, but high security can be achieved although it is very small. These two ciphers can be implemented with an extremely small circuit scale as compared with random number generation computation and public key cryptography computation, and the manufacturing cost of a small tag can be kept low.

  As described above, according to the present invention, tracking of ID information by an unauthorized third party can be sufficiently prevented at a low cost without imposing a large processing burden on the center apparatus.

Embodiments of the present invention will be described below with reference to the drawings.
<First Embodiment>
Hereinafter, a first embodiment of the present invention will be described.
〔Constitution〕
FIG. 1 illustrates the configuration of an automatic ID identification system 1 according to this embodiment.
As illustrated in FIG. 1, the automatic ID identification system 1 includes a tag device 10 attached to a product and the like, a reader device 20 that reads and writes information on the tag device 10, and a center device 30 that manages information related to IDs. have.

Here, the tag device 10 includes a key information recording unit 11, a temporary information recording unit 12, an ID information recording unit 13, a common key encryption unit 14, a hash function unit 15 (corresponding to a “temporary key generation unit”), an I / O Interface means 16 (corresponding to “information transmitting means”) and temporary information updating means 17 are provided.
The reader device 20 includes tag I / O interface means 21 and center I / O interface means 22.
Further, the center device 30 corresponds to a fixed ID-product information relation database 31, a key information database 32 (corresponding to “key information recording means”), a common key decryption means 33, and a hash function means 34 (corresponding to “temporary key generation means”). ), I / O interface means 35 (corresponding to “information receiving means”) and reading means 36.

The tag device 10, the reader device 20, and the center device 30 are configured by causing a known computer including, for example, a CPU (Central Processing Unit) to execute a predetermined program. In addition, the tag device 10 may be configured using hardware having only a function of performing a common key encryption operation or a hash function operation, for example, instead of a general CPU.
[Preparation]
First, in the key information database 32 of the center device 30, a master key list [MKi, KIDi] is created in which a master key MKi (corresponding to “second key information”) and its key ID number KIDi are associated with each other. (Record. Also, different fixed ID information UIDj is set for each product, and a fixed ID-product information relation list [UIDj, Infoj] in which the fixed ID information UIDj and its product information Infoj are listed in association with each other is expressed as fixed ID-product information. Record in the relational database 31.

The key information recording unit 11 of the tag device 10 records the master key (corresponding to “first key information”) and the key ID number (MKj, KIDj) in association with each other, and the ID information recording unit 13 Fixed ID information UIDj is recorded as recording ID information IDj. Further, the temporary information recording means 12 records the initial temporary information CNT ₁ .
Further, the same hash function H (corresponding to “one-way hash function”) is stored in the hash function means 15 and 34, and the common key encryption means 14 and the common key decryption means 33 have a common key corresponding to each other. An encryption function and a common key decryption function are stored. As the hash function, for example, SHA-1, MD5 or the like is used, and as the common key encryption / decryption function, for example, Camellia (“K. Aoki, et al:“ The 128-Bit Block Cipher Camellia, ”IEICE Transactions on Fundamentals, Vol. E85-A, No. 1, pp. 11-24, 2002 ") or AES (see" Specification for the ADVANCED ENCRYPTION STANDARD (Federal Information Processing Standards Publication 197) "etc.) .

[Processing operation]
Next, the processing operation of the automatic ID identification system 1 will be described.
FIG. 2 is a flowchart for explaining the processing operation of the automatic ID identification system 1. Hereinafter, the processing operation of the ID automatic identification system 1 will be described using this flowchart.
[When requesting ID information]
First, processing steps when requesting (k-th) ID information from the reader device 20 are shown.
Step S1:
First, the tag I / O interface unit 21 of the reader device 20 transmits an ID information transmission request.

Step S2:
The tag device 10 receives a request for ID information through the I / O interface means 16, and executes the following processing using this as a trigger.
Step S3:
In the hash function means 15, the temporary information CNT _k recorded in the temporary information recording means 12 and the master key MKj recorded in the key information recording means 11 are extracted, and a temporary key OSK _k is generated using them. Specifically, using the stored hash function H,
OSK _k = H (CNT _k | MKj)
The temporary key OSK _k is calculated by performing the above calculation. “Α | β” indicates a bit combination of α and β. H (γ) represents a hash value of γ.

The temporary key OSK _k generated in this way is sent to the common key encryption means 14.
Step S4:
Next, the common key encryption unit 14 extracts the recorded ID information IDj recorded in the ID information recording unit 13. Then, the common key encryption unit 14 encrypts the recording ID information IDj by the common key encryption method using the temporary key OSK _k sent from the hash function unit 15, and generates variable ID information nonceID _k . Specifically, using the stored common key encryption function Enc,
nonceID _k = Enc (IDj, OSK _k )
The variable ID information nonceID _k is generated by performing the above calculation.

Step S5:
Then, the temporary information updating unit 17, temporary information recording unit 12 extracts the temporary information CNT _k from the extracted temporary information CNT _k for 1 count up. Then, the temporary information update unit 17 overwrites and updates the temporary information CNT _k recorded in the temporary information recording unit 12 with the counted temporary information by CNT _{k + 1} . That is, the temporary information update means 17
CNT _{k + 1} = CNT _k +1
The new temporary information CNT _{k + 1} is calculated by the above calculation, and this is overwritten and stored in the temporary information recording means 12. Thus, the temporary information updating unit 17, each time a temporary information CNT _k are used to generate the temporary key OSK _k, will update the recorded temporary information CNT _k in the temporary information recording unit 12.

Step S6:
Next, in the I / O interface means 16, the variable ID information nonceID _k from the common key encryption means 14 and the temporary information CNT _k used for generating the temporary key OSK _k from the hash function means 15 (step S3) are used as the key information. The key ID information KIDj associated with the master key MKj used to generate the temporary key OSK _k is extracted from the recording unit 11. The I / O interface means 16 transmits these data (nonceID _k , KIDj, CNT _k ) to the reader device 20.

Transmission data (nonceID _k , KIDj, CNT _k )
Step S7:
This transmission data is received by the tag I / O interface unit 21 of the reader device 20 and is transmitted from the center I / O interface unit 22 to the center device 30 when tracking the ID information in the center device 30.
[When tracking ID information]
Next, processing steps when the product information (ID information) is tracked in the center apparatus 30 will be shown.

Step S8:
First, the I / O interface unit 35 of the center device 30 receives transmission data (nonceID _k , KIDj, CNT _k ) transmitted from the reader device 20 as described above. The variable ID information nonceID _k received here is sent to the common key decryption means 33, and the key ID information KIDj and the temporary information CNT _k are sent to the hash function means 34.
Step S9:
Next, the hash function means 34 searches the key information database 32 using the key ID information KIDj sent in step S8, and extracts the master key MKj recorded in association with the key ID information KIDj.

Step S10:
Further, the hash function means 34 generates a temporary key OSK _k (corresponding to “second temporary key”) using the temporary information CNT _k sent in step S8 and the master key MKj extracted in step S9. Specifically, using the stored hash function H,
OSK _k = H (CNT _k | MKj)
The temporary key OSK _k is calculated by performing the above calculation. Then, the generated temporary key OSK _k is sent to the common key decryption means 33.

Step S11:
Thereafter, the common key decryption means 33 uses the temporary key OSK _k sent in step S10 to decrypt the variable ID information nonceID _k sent in step S8 to calculate the record ID information IDj. In this example, the recording ID information IDj and the fixed ID information UIDj are the same. Specifically, using the stored common key decryption function Dec, UIDj = IDj = Dec (nonceID _k , OSK _k )
To obtain fixed ID information UIDj. The fixed ID information UIDj obtained in this way is sent to the reading means 36.

Step S12:
The reading means 36 to which the fixed ID information UIDj has been sent searches the fixed ID-product information relational database 31 using this fixed ID information UIDj, and the product information Infoj recorded in association with the fixed ID information UIDj, Extracted from the fixed ID-product information relational database 31.
Step S13:
The product information Infoj extracted in the reading unit 36 in step S12 is sent to the I / O interface unit 35, and the I / O interface unit 35 transmits the product information Infoj to the reader device 20.

Step S14:
The reader device 20 receives the product information Infoj transmitted in step S13 at the center I / O interface unit 22.
[Features of this embodiment]
As described above, in this embodiment, every time ID information is requested from the reader device 20 to the tag device 10, the temporary function CNT _k recorded in the temporary information recording unit 12 in the hash function unit 15 of the reader device 20. Is used to generate a temporary key OSK _k . The temporary information CNT _k is updated in the temporary information update unit 17 every time it is used for generating the temporary key OSK _k . This means that the value of the generated temporary key OSK _k is different for each ID information request.

Further, in response to this request for ID information, what is transmitted from the tag device 10 to the reader device 20 is variable ID information nonceID _{k obtained} by encrypting the recording ID information IDj with the temporary key OSK _k . This means that the variable ID information nonceID _k transmitted from the tag device 10 to the reader device 20 is different every time an ID information request is made. An unauthorized third party who does not know the master key MKj used to generate the temporary key OSK _k cannot know the relationship between the different variable ID information nonceID _k .
As described above, in this embodiment, it is possible to prevent a situation where an unauthorized third party tracks the tag device 10 based on the commonality of communication information.

In this embodiment, the calculation in step S3 cannot be performed unless the master key MKj recorded in the key information recording unit 11 is known. This means that an unauthorized third party who does not know the master key MKj cannot generate the variable ID information nonceID _k from the recorded ID information IDj. Similarly, an unauthorized third party who does not know the master key MKj cannot decrypt the variable ID information nonceID _k to obtain the recording ID information IDj. Further, since only the master key ID information KIDj is added to the transmission data, there is no danger of finding the master key MKj from the transmission data.

Thereby, when the tag device 10 is tampered and the recorded ID information IDj stored in the ID information recording means 13 is leaked, the attacker communicates with the tag device 10 unless the master key MKj is known. The relationship with the variable ID information nonceID _k cannot be known. This applies not only to the variable ID information nonceID _k used in the communication before the leakage of the recording ID information IDj, but also to the variable ID information nonceID _k used in the communication after the leakage of the recording ID information IDj.
As described above, in this embodiment, more advanced ID information tracking prevention can be realized.

Furthermore, in the present embodiment, the center device 30 searches the key information database 32 for the master key MKj corresponding to the received master key ID information KIDj, and performs a process of one hash function and one decryption of the common key encryption. The fixed ID information UIDj can be obtained only by the above.
As described above, in the present embodiment, a legitimate ID information tracking process can be realized without imposing a heavy burden on the center device 30.
In this embodiment, the cryptographic processing means required in the tag device 10 are the common key encryption means 14 and the hash function means 15. In particular, if Camellia or AES is used as the common key encryption means, high security can be achieved even though it is very small. Furthermore, these two ciphers can be implemented with a circuit scale that is extremely small compared to the random number generation means and public key encryption means, and the manufacturing cost of the tag device 10 can be reduced.

In the present embodiment, the method of updating the temporary information CNT _k by incrementing the temporary information CNT _k by 1 has been described (step S5). This is because the tag device 10 can be manufactured at a low cost. However, since it is essential that the temporary information CNT _k can be updated to a different value, the value of CNT _{k + 1} may be determined using, for example, random number generation means.
Further, in this embodiment, in the temporary information updating unit 17, each time the temporary information CNT _k are used to generate the temporary key OSK _k, it was decided to update the recorded temporary information CNT _k in the temporary information recording unit 12 (Step S5). This is because the tag device 10 generates variable ID information nonceID _k that is different every time communication is performed, thereby preventing sufficient tracking of ID information. However, the temporary information CNT _k recorded in the temporary information recording means 12 is updated every time the temporary information CNT _k is used several times to generate the temporary key OSK _k in order to reduce the calculation burden on the tag device 10. Also good.

Furthermore, in this embodiment, the temporary key OSK _k is generated using a hash function (steps S3 and S10). However, may be possible to generate a temporary key OSK _k using other one-way function may generate a temporary key OSK _k by the common key encryption method such as Camellia and AES. However, in the case of the common key cryptosystem, the tag device 10 and the center device 30 have to share the secret key used for it.
<Second Embodiment>
Next, a second embodiment of the present invention will be described.

This embodiment is a modification of the first embodiment and is characterized in that the recording ID information is updated in the tag device. Below, it demonstrates centering around difference with 1st Embodiment, and abbreviate | omits description about the matter which is common in 1st Embodiment.
〔Constitution〕
FIG. 3 illustrates the configuration of the automatic ID identification system 100 in this embodiment. In FIG. 3, the same reference numerals as those in FIG. 1 are assigned to configurations common to the first embodiment.

As illustrated in FIG. 3, in the automatic ID identification system 100 of this embodiment, the tag device 10 in the automatic ID identification system 1 of the first embodiment is replaced with the tag device 110, and the center device 30 is replaced with the center device 130. Is.
Further, the difference between the tag device 10 of the first embodiment and the tag device 110 of the present embodiment is that an ID information recording unit 113 is provided instead of the ID information recording unit 13, and the common key encryption unit 14 is provided. Instead, the common key encryption means 114 is provided.
Further, the difference between the center apparatus 30 of the first embodiment and the center apparatus 130 of the present embodiment is that a key information database 132 (corresponding to “key information recording means”) is provided instead of the key information database 32. A common key decryption unit 133 instead of the common key decryption unit 33, a temporary information retrospective unit 137, an ID information retrospective unit 138, a decryption unit 139 And the counting means 140 are provided.

[Preparation]
In the key information database 132 of the center apparatus 130, a master key list [MKi, KIDi] in which the master key MKi and the key ID number KIDi are associated with each other is constructed (recorded). Further, different fixed ID information UIDj is set for each product, and a fixed ID-product information relation list [UIDj, Infoj] in which the fixed ID information UIDj and product information Infoj are associated with each other and listed is a fixed ID-product information relation database. 31. Further, virtual ID information nonceUIDj obtained by encrypting fixed ID information UIDj with predetermined center secret information CSK is calculated and recorded in tag device 110 as follows. Note that the encryption method here is not limited, and may be a common key encryption method or a public key encryption method. In this example, a common key cryptosystem is used, and the center secret information CSK used for the encryption / decryption is recorded in the key information database 132.

Further, in the tag device 110, the key information recording means 11 to the master key and the key ID number as key information (MKj, KIDj) recorded in association with the virtual above the ID information storage unit 13 as the recording ID information IDj ₁ ID information nonceUIDj is recorded. Further, initial temporary information CNT ₁ is recorded in the temporary information recording means 12.
Further, the hash function means 15 and 34 store the same hash function H, and the common key encryption means 114 and the common key decryption means 133 respectively store a mutually corresponding common key encryption function and common key decryption function. .

[Processing operation]
Next, the processing operation of the automatic ID identification system 100 will be described.
FIG. 4 is a flowchart for explaining the processing operation of the automatic ID identification system 100. Hereinafter, the processing operation of the ID automatic identification system 100 will be described using this flowchart.
[When requesting ID information]
First, processing steps when requesting (k-th) ID information from the reader device 20 are shown.

Step S21:
First, the tag I / O interface unit 21 of the reader device 20 transmits an ID information transmission request.
Step S22:
The tag device 110 receives a request for ID information through the I / O interface means 16, and executes the following processing using this as a trigger.
Step S23:
In the hash function means 15, the temporary information CNT _k recorded in the temporary information recording means 12 and the master key MKj recorded in the key information recording means 11 are extracted, and a temporary key OSK _k is generated using them. Specifically, using the stored hash function H,
OSK _k = H (CNT _k | MKj)
The temporary key OSK _k is calculated by performing the above calculation. The temporary key OSK _k generated in this way is sent to the common key encryption unit 114.

Step S24:
Then, the common key encryption unit 114 extracts the record ID information IDj _k which is recorded in the ID information storage unit 113. Then, the common key encryption unit 14 encrypts the recording ID information IDj _k by the common key encryption method using the temporary key OSK _k sent from the hash function unit 15 to generate variable ID information nonceID _k . Specifically, using the stored common key encryption function Enc,
nonceID _k = Enc (IDj _k , OSK _k )
The variable ID information nonceID _k is generated by performing the above calculation.

Step S25:
Then, the temporary information updating unit 17, temporary information recording unit 12 extracts the temporary information CNT _k from the extracted temporary information CNT _k for 1 count up. Then, the temporary information update unit 17 overwrites and updates the temporary information CNT _k recorded in the temporary information recording unit 12 with the counted temporary information by CNT _{k + 1} . That is, the temporary information update means 17
CNT _{k + 1} = CNT _k +1 (1)
The new temporary information CNT _{k + 1} is calculated by the above calculation, and this is overwritten and stored in the temporary information recording means 12. As a result, the temporary information updating unit 17 uses the rule (1) to express the temporary information CNT _k recorded in the temporary information recording unit 12 every time the temporary information CNT _k is used to generate the temporary key OSK _k ( It is updated based on “predetermined rule”. The temporary information CNT _k includes information that can specify the value of k (the number of times of communication).

Step S26:
Thereafter, the common key encryption unit 114 sends the variable ID information nonceID _k generated in step S24 to the ID information recording unit 113, and the ID information recording unit 113 sends the variable ID information nonceID _k to the new recording ID information IDj _{k +. As 1} , the record ID information IDj _k recorded in the variable ID information nonceID _k is updated. That is,
IDj _{k + 1} = nonceID _k
And

Step S27:
Next, in the I / O interface means 16, the variable ID information nonceID _k from the common key encryption means 114, and the temporary information CNT _k used for generating the temporary key OSK _k from the hash function means 15 (step S23) are used as the key information. The key ID information KIDj associated with the master key MKj used to generate the temporary key OSK _k is extracted from the recording unit 11. The I / O interface means 16 transmits these data (nonceID _k , KIDj, CNT _k ) to the reader device 20.

Transmission data (nonceID _k , KIDj, CNT _k )
Step S28:
This transmission data is received by the tag I / O interface unit 21 of the reader device 20 and is transmitted from the center I / O interface unit 22 to the center device 130 when tracking the ID information in the center device 130.
[When tracking ID information]
Next, processing steps when product information (ID information) is tracked in the center apparatus 130 are shown.

Step S29:
First, the I / O interface unit 35 of the center device 130 receives the transmission data (nonceID _k , KIDj, CNT _k ) transmitted from the reader device 20 as described above. The variable ID information nonceID _k received here is sent to the common key decryption means 133, and the key ID information KIDj and the temporary information CNT _k are sent to the hash function means 34. Further, the value of _{k included} in the temporary information CNT _k is sent to the counting means 140, and the initial value of the counter in the counting means 140 is set to k.

Step S30:
Next, the hash function means 34 searches the key information database 132 using the key ID information KIDj sent in step S29, and extracts the master key MKj recorded in association with the key ID information KIDj.
Step S31:
Further, the hash function means 34 generates a temporary key OSK _k (corresponding to “second temporary key”) using the temporary information CNT _k sent in step S29 and the master key MKj extracted in step S30. Specifically, using the stored hash function H,
OSK _k = H (CNT _k | MKj)
The temporary key OSK _k is calculated by performing the above calculation. Then, the generated temporary key OSK _k is sent to the common key decryption means 133. Also,
Step S32:
Thereafter, the common key decryption means 133 uses the temporary key OSK _k sent in step S31 to decrypt the variable ID information nonceID _k sent in step S29 to calculate the record ID information IDj _k . Specifically, IDj _k = Dec (nonceID _k , OSK _k ) using the stored common key decryption function Dec.
It calculates the obtained recording ID information IDj _k.

Step S33:
Next, in the temporary information retroactive means 137, the temporary information CNT _k used in step S23 is acquired from the hash function means 34, and this temporary information CNT _k is stored for one time on the basis of the rule shown in the above formula (1). The state is converted to the state CNT _k−1 before update. That is, CNT _k-1 ← CNT _k -1
Temporary information is converted by the above operation. The converted temporary information CNT _k−1 is sent to the hash function means 34.

Further, in the ID information retroactive means 138, the decryption result (record ID information IDj _k : step S32) in the common key decryption means 133 is set as variable ID information nonceID _{k−1 in} a state before one update is performed. That is, the record ID information IDj _k is substituted into the variable ID information nonceID _k−1 (nonceID _k−1 ← IDj _k ), and the variable ID information nonceID _k−1 as the substitution result is sent to the common key decryption means 133.
Step S34:
Next, the counting means 140 determines whether or not the count value k is 1. If k = 1, the process proceeds to step S36. On the other hand, if k is not 1, the process proceeds to step S35.

Step S35:
In the counting means 140, k is counted down by 1 (k ← k−1), and the process returns to step S31. Thereafter, the processes of steps S31 to S33 are repeated until the condition of step S34 is satisfied.
This means that the hash function means 34 (corresponding to the “second temporary key generating means”) is further replaced with the master key MKj (corresponding to “second key information”) and the temporary information until the condition of step S34 is satisfied. This means that the temporary key OSK _k (corresponding to “second temporary key”) is sequentially generated as many times as necessary using the temporary information CNT _k before update sequentially converted by the retroactive means 137.

Further, until the condition of step S34 is satisfied, the common key decryption unit 134 further generates temporary keys OSK _k (“second second key” sequentially generated by the hash function unit 34 (corresponding to “second temporary key generation unit”). This means that the process of sequentially decrypting the variable ID information nonceID _k sequentially generated in the ID information retroactive means 138 is repeated as many times as necessary.
Step S36:
If it is determined in step S34 that k = 1, the record ID information IDj ₁ finally obtained by the common key decryption means 133 is sent to the decryption means 139. Here, the obtained recording ID information IDj ₁ is the same as the virtual ID information nonceUIDj. Therefore, the decoding means 139 which has received this, by extracting the center secret information CSK from the key information database 132, decodes the recording ID information IDj ₁ using the center secret information CSK, determining the fixed ID information UIDj Can do.

That is, the center apparatus 130 searches the key information database 132 for the corresponding master key MKj from the master key ID information KIDj, and decrypts the hash function and the common key encryption k times (temporary information CNT _k becomes CNT ₁₎ . The virtual ID information nonceUIDj can be obtained by performing the process (1). Further, the center device 130 can obtain the fixed ID information UIDj from the nonceUIDj using the center secret information CSK.
The fixed ID information UIDj obtained as described above is sent to the reading means 36.
Step S37:
The reading means 36 that has received the fixed ID information UIDj searches and extracts the product information Infoj corresponding to the fixed ID information UIDj from the fixed ID-product information relational database 31. The extracted product information Infoj is sent to the I / O interface means 35.

Step S38:
The I / O interface unit 35 that has received the product information Infoj transmits the product information Infoj to the reader device 20.
Step S39:
The product information Infoj transmitted from the I / O interface unit 35 is received by the center I / O interface unit 22 of the reader device 20.
[Features of this embodiment]
As described above, also in this embodiment, each time a request for ID information is made, a temporary key OSK _k is generated using different temporary information CNT _k recorded in the temporary information recording means 12. Therefore, unlike the value of temporary key OSK _k is generated each time, so that different the different every time temporary key OSK _k recording ID information IDj _k each time the value of the variable ID information NonceID _k generated by encrypting .

Further, since the calculation of step S23 cannot be performed unless the master key MKj recorded in the key information recording unit 11 is known, an unauthorized third party cannot generate the variable ID information nonceID _k from the recorded ID information IDj _k . Similarly, the person can not also be determined recording ID information IDj _k and decodes the nonceID _k. In addition, since only the master key ID information KIDj is added to the transmission data, there is no danger of searching for the master key MKj from the transmission data.
As described above, similarly to the first embodiment, tracking of ID information by an unauthorized third party can be sufficiently prevented.

Furthermore, in the present embodiment records ID information IDj _k which is recorded in the ID information storage unit 113 is overwritten in step S26. Therefore, even if the attacker reads the record ID information IDj _k for a plurality of times (a plurality of record ID information IDj _k corresponding to different _k ) by some means, as long as the master key MKj is not known, they are of the same tag device It is not possible to judge whether or not.
As described above, tracking of ID information by an unauthorized third party can be more effectively prevented.

<Third Embodiment>
Next, a third embodiment of the present invention will be described.
This embodiment is a modification of the first embodiment and is characterized in that the recording ID information is updated in the tag device. Below, it demonstrates centering around difference with 1st Embodiment, and abbreviate | omits description about the matter which is common in 1st Embodiment.
〔Constitution〕
5 and 6 illustrate the configuration of the automatic ID identification system 200 in this embodiment. In FIGS. 5 and 6, the same reference numerals as those in FIG. 1 are assigned to configurations common to the first embodiment.

As illustrated in FIGS. 5 and 6, the automatic ID identification system 200 of this embodiment includes the tag device 10 in the automatic ID identification system 1 of the first embodiment as the tag device 210 and the center device 30 as the center device 230. It has been replaced with.
Further, the difference between the tag device 10 of the first embodiment and the tag device 210 of the present embodiment is that a key information recording unit 211 is provided instead of the key information recording unit 11, and the ID information recording unit 13 Instead, an ID information recording unit 213 is provided, a common key encryption unit 214 is provided instead of the common key encryption unit 14, and a hash function unit 215 is provided instead of the hash function unit 15. The point is that a common key decryption means 218 is provided. The I / O interface means 16 corresponds to “update information receiving means”.

  Also, the difference between the center device 30 of the first embodiment and the center device 230 of the present embodiment is that a key information database 232 (corresponding to “key information recording means”) is provided instead of the key information database 32. A common key decryption means 233a instead of the common key decryption means 33, a hash function means 234b instead of the hash function means 34, a common key decryption means 233b ("unique ID" A common key encryption unit 237a, a hash function unit 234a (corresponding to a “temporary key information generation unit”, and an “ID information update unit”). , 237b (which constitutes “ID information updating means”). The fixed ID-product information relational database 31 corresponds to “unique ID information recording means”, and the I / O interface means 35 corresponds to “update information transmitting means”.

[Preparation]
First, a system common master key SMK (corresponding to “system common master key information”) and a center secret key CSK (corresponding to “center secret key information”) are determined and stored (recorded) in the key information database 232 of the center device 230. . Next, a temporary key list [CTKi, KIDi, in which a plurality of center temporary keys CTKi (corresponding to “second center temporary key information” and “third key information”) and their key ID numbers KIDi are associated and listed. ] Is built (recorded) in the key information database 232. Further, different fixed ID information UIDj is set for each product, and a fixed ID-product information relation list [UIDj, Infoj] in which the fixed ID information UIDj and product information Infoj are associated with each other and listed is a fixed ID-product information relation database. 31.

Further, the system common master key SMK is registered (recorded) as key information in the key information recording means 211 of the tag device 210. Further, initial temporary information CNT ₁ is set (recorded) in the temporary information recording means 12.
[Processing operation]
Next, the processing operation of the automatic ID identification system 200 will be described.
7 and 8 are flowcharts for explaining the processing operation of the automatic ID identification system 200. FIG. The processing operation of the automatic ID identification system 200 will be described below using this flowchart.

[When updating tag data]
First, processing steps when updating small tag data are shown.
Step S41:
First, in the common key encryption unit 237b (corresponding to “center temporary key selection unit”) of the center apparatus 230, any one of the center temporary keys CTKn from the temporary key list [CTKi, KIDi] recorded in the key information database 232 is obtained. The selected center temporary key CTKn and the corresponding key ID information KIDn are extracted.

Step S42:
Next, the common key encryption means 237b extracts the system common master key SMK from the key information database 232, and encrypts the center temporary key CTKn selected in step S41 using this system common master key SMK (new ) Generate the encryption center temporary key ECTKn. That is,
ECTKn = Enc (CTKn, SMK)
To obtain the encryption center temporary key ECTKn.

Step S43:
Next, the hash function means 234a extracts the center temporary key CTKn selected by the common key encryption means 237b (step S41) and the center secret key CSK from the key information database 232. Then, using the extracted center temporary key CTKn and center secret key CSK, a (new) update temporary key NTK is generated. In particular,
NTK = H (CTKn | CSK)
The updated temporary key NTK is obtained by the above calculation. The obtained update temporary key NTK is sent to the common key encryption means 237a.

Step S44:
Next, the reading means 36 extracts the fixed ID information UIDj from the fixed ID-product information relation database 31 and sends it to the common key encryption means 237a. Thereafter, the common key encryption unit 237a calculates (new) recording ID information nonceUIDn obtained by encrypting the fixed ID information UIDj using the updated temporary key NTK obtained in step S43. That is,
nonceUIDn = Enc (UIDj, NTK)
The record ID information nonceUIDn is obtained by the above calculation.

Step S45:
Thereafter, the I / O interface unit 35 obtains the encryption center temporary key ECTKn obtained in step S42 and the corresponding key ID information KIDn (the key ID information KIDn extracted in step S41) from the common key encryption unit 237b. . Further, the I / O interface unit 35 acquires the recording ID information nonceUIDn obtained in step S44 from the common key encryption unit 237a.
Then, the I / O interface unit 35 transmits the acquired transmission data (nonceUIDn, KIDn, ECTKn) to the reader device 20.

Step S46:
The reader device 20 receives the transmission data (nonceUIDn, KIDn, ECTKn) at the center I / O interface means 22, and further tags the transmission data (nonceUIDn, KIDn, ECTKn) at the tag I / O interface means 21. To device 210.
Step S47:
The tag device 210 receives the transmission data (nonceUIDn, KIDn, ECTKn) in the I / O interface unit 16, sends the received recording ID information nonceUIDn to the ID information recording unit 213, and encrypts the encryption center temporary key ECTKn and the key ID. Information KIDn is sent to the key information recording means 211.

Step S48:
The key information recording unit 211 overwrites and updates the encryption center temporary key and key ID information recorded therein with the received new encryption center temporary key ECTKn and key ID information KIDn.
Step S49:
Further, the ID information recording unit 213 overwrites and updates the record ID information recorded therein with the received new record ID information nonceUIDn.

In the above-described processing step [when tag data is updated], nothing is mentioned regarding the temporary information CNT _k recorded in the temporary information recording means 12 in the tag device 210. The temporary information recorded in the information recording unit 12 may be overwritten and updated by the temporary information updating unit 17.
[When requesting ID information]
Next, processing steps when requesting (k-th) ID information from the reader device 20 will be described.
Step S51:
First, the tag I / O interface unit 21 of the reader device 20 transmits an ID information transmission request.

Step S52:
The tag device 210 receives a request for ID information through the I / O interface means 16, and executes the following processing using this as a trigger.
Step S53:
First, the common key decryption means 218 extracts the system common master key SMK and the encryption center temporary key ECTKn recorded in the key information recording means 211, and uses this system common master key SMK to encrypt the encryption center temporary key ECTKn. Is decrypted to generate a center temporary key CTKn (corresponding to “first center temporary key information”). That is,
CTKn = Dec (ECTKn, SMK)
The center temporary key CTKn is obtained by the following calculation. The obtained center temporary key CTKn is sent to the hash function means 215.

Step S54:
The hash function means 215 generates a temporary key OSK _k (corresponding to “first temporary key”) using the sent center temporary key CTKn and the temporary information CNT _k extracted from the temporary information recording means 12. In particular,
OSK _k = H (CNT _k | CTKn)
The temporary key OSK _k is obtained by the following calculation. The obtained temporary key OSK _k is sent to the common key encryption means 214.

Step S55:
Next, the common key encryption unit 214 extracts the record ID information nonceUIDn from the ID information recording unit 213. Thereafter, the common key encryption unit 214 encrypts the recording ID information nonceUIDn using the temporary key OSK _k received from the hash function unit 215 to generate variable ID information nonceID _k . That is,
nonceID _k = Enc (nonceUIDn, OSK _k )
The variable ID information nonceID _k is obtained by the following calculation.

Step S56:
Next, the temporary information update unit 17 extracts the temporary information CNT _k from the temporary information recording unit 12,
CNT _{k + 1} = CNT _k +1
The new temporary information CNT _{k + 1} is calculated by the above calculation, whereby the temporary information in the temporary information recording means 12 is overwritten and updated.
Step S57:
Thereafter, the I / O interface means 16 receives the variable ID information nonceID _k generated in step S55 from the common key encryption means 214, receives the temporary information CNT _k used in step S54 from the hash function means 215, and receives the key information recording means. The key ID information KIDn recorded therein is extracted from 211. The I / O interface unit 16 transmits the received data (nonceID _k , KIDn, CNT _k ) to the reader device 20.

Step S58:
The data transmitted in step S57 is received by the tag I / O interface means 21 of the reader apparatus 20, and is transmitted from the center I / O interface means 22 to the center apparatus 230 when tracking the ID information in the center apparatus 230.
Thereafter, the above-mentioned process [when tag data is updated] is executed at regular or irregular timings.
[When tracking ID information]
Next, processing steps when product information (ID information) is tracked in the center device 230 will be described.

Step S59:
First, the I / O interface means 35 of the center device 230 receives the transmission data (nonceID _k , KIDk, CNT _k ) transmitted from the reader device 20 as described above. The variable ID information nonceID _k received here is sent to the common key decryption means 233a, the key ID information KIDn is sent to the hash function means 234a and 234b, and the temporary information CNT _k is sent to the hash function means 234b.
Step S60:
Next, the hash function means 234b searches the key information database 232 using the key ID information KIDn sent in step S59, and extracts the center temporary key CTKn recorded in association with the key ID information KIDn.

Step S61:
Next, the hash function means 234b generates a temporary key OSK _k (corresponding to a “second temporary key”) using the center temporary key CTKn extracted in step S60 and the temporary information CNT _k sent in step S59. . In particular,
OSK _k = H (CNT _k | CTKn)
The temporary key OSK _k is obtained by the following calculation. The generated temporary key OSK _k is sent to the common key decryption means 233a.

Step S62:
The common key decryption means 233a decrypts the variable ID information nonceID _k sent in step S59 by using the temporary key OSK _k sent in step S61, and calculates recording ID information nonceUIDn. That is,
nonceUIDn = Dec (nonceID _k , OSK _k )
The record ID information nonceUIDn is obtained by the above calculation. The obtained recording ID information nonceUIDn is sent to the common key decryption means 233b.

Step S63:
Next, the hash function means 234a extracts the center temporary key CTKn corresponding to the key ID information KIDn sent in step S59 and the center secret key CSK from the key information database 232. Then, using the extracted center temporary key CTKn and center secret key CSK, an update temporary key NTK (corresponding to “update temporary key information”) is generated. In particular,
NTK = H (CTKn | CSK)
The updated temporary key NTK is obtained by the above calculation. The obtained update temporary key NTK is sent to the common key decryption means 233b.

Step S64:
The common key decryption means 233b uses the updated temporary key NTK sent from the hash function means 234a in step S63, and decrypts the recording ID information nonceUIDn sent from the common key decryption means 233a in step S62 to obtain the fixed ID information UIDj. Generate. That is,
UIDj = Dec (nonceUIDn, NTK)
The fixed ID information UIDj is obtained by the following calculation. The determined fixed ID information UIDj is sent to the reading means 36.

Step S65:
Next, the reading means 36 uses the fixed ID information UIDj sent from the common key decryption means 233b to search and extract the product information Infoj corresponding to the fixed ID information UIDj from the fixed ID-product information relational database 31. The extracted product information Infoj is sent to the I / O interface means 35.
Step S66:
The I / O interface unit 35 transmits the sent product information Infoj to the reader device 20.

Step S67:
The reader device 20 receives the product information Infoj transmitted in step S66 at the center I / O interface means 22.
<Features of this embodiment>
As described above, also in this embodiment, each time a request for ID information is made, a temporary key OSK _k is generated using different temporary information CNT _k recorded in the temporary information recording means 12. Therefore, unlike the value of temporary key OSK _k is generated every time, a value of the variable ID information NonceID _k generated also each time differs by encrypting recording ID information nonceUIDn this each time different temporary key OSK _k.

Also, unless the system common master key SMK recorded in the key information recording unit 211 is known, the calculation in step S53 cannot be performed, and therefore an unauthorized third party cannot generate the variable ID information nonceID _k from the recorded ID information nonceUIDn. Can not. Similarly, this person cannot obtain the recorded ID information nonceUIDn by decoding from the nonceID _k . Since only the key ID information KIDj is added to the transmission data, there is no danger of searching for the system common master key SMK and the center temporary key CTKn from the transmission data.
As described above, similarly to the first embodiment, tracking of ID information by an unauthorized third party can be sufficiently prevented.

  Furthermore, in this embodiment, the process of [when tag data is updated] is executed for the recording ID information nonceUIDn recorded in the ID information recording unit 213 and the encryption center temporary key ECTKn recorded in the key information recording unit 211. Each time it is overwritten and updated. For this reason, even if an unauthorized third party can read a plurality of updated record ID information nonceUIDn and encryption center temporary key ECTKn by some means, he or she cannot know the system common master key SMK. It is impossible to determine the relevance of these pieces of information before and after the [tag data update] process, that is, whether or not they belong to the same tag device.

As described above, tracking of ID information by an unauthorized third party can be more effectively prevented.
Further, in this embodiment, the center device 230 searches the key information database 232 for the corresponding center temporary key CTKn from the key ID information KIDn, and performs two processes of hash function calculation and decryption of common key encryption twice. That is, the fixed ID information UIDj can be obtained.
As described above, in this embodiment, it is possible to implement a legitimate ID information tracking process without imposing a heavy burden on the center device 230.

In the present embodiment, the method of incrementing the temporary information by 1 in step S56 has been described so that the tag device 210 can be manufactured at low cost. However, essentially, the temporary information may be updated to a different value. Therefore, for example, the value of CNT _{k + 1} may be determined using random number generation means.
In this embodiment, the center temporary key CTKn is determined in step S41, the encryption center temporary key ECTKn is generated in step S42, the update temporary information NTK is generated in step S43, and the fixed ID information UIDj is updated in step S44. The record ID information nonceUIDn is generated by encryption with the temporary information NTK. In this case, even if the attacker acquires the center temporary key CTKn, the attacker cannot decrypt the fixed ID information UIDj from the recorded ID information nonceUIDn unless the center secret key CSK is known. Therefore, a higher tracking prevention characteristic can be realized.

As a modification, the recording ID information nonceUIDn may be generated by encrypting the fixed ID information UIDj with the center temporary key CTKn.
The present invention is not limited to the above-described embodiments, and for example, the above-described embodiments may be appropriately combined. Needless to say, other modifications are possible without departing from the spirit of the present invention. In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary.

Further, when the above-described configurations are realized by a computer, the processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.
The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, as the magnetic recording device, a hard disk device, a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.
A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  Fields of application of the present invention include, for example, RFID and AutoID. By applying the present invention, a privacy protection function related to ID information such as RFID and AutoID can be realized at high speed and at low cost.

The example of a structure of the ID automatic identification system in 1st Embodiment. The flowchart for demonstrating the processing operation of the ID automatic identification system in 1st Embodiment. The example of a structure of the ID automatic identification system in 2nd Embodiment. The flowchart for demonstrating the processing operation of the ID automatic identification system in 2nd Embodiment. The example of a structure of the ID automatic identification system in 3rd Embodiment. The example of a structure of the ID automatic identification system in 3rd Embodiment. The flowchart for demonstrating the processing operation of the ID automatic identification system in 3rd Embodiment. The flowchart for demonstrating the processing operation of the ID automatic identification system in 3rd Embodiment. The figure which showed an example of the product management by the conventional small radio | wireless tag apparatus.

Explanation of symbols

10, 110, 210 Tag device 20 Reader device 30, 130, 230 Center device 12 Temporary information recording means 17 Temporary information updating means

Claims (13)

ID information recording means for recording record ID information;
First key information recording means for recording first key information;
Temporary information recording means for recording temporary information;
First temporary key generating means for generating a first temporary key using the first key information and the temporary information;
First common key encryption means for generating variable ID information obtained by encrypting the recording ID information by a common key encryption method using the first temporary key;
Temporary information updating means for updating the temporary information recorded in the temporary information recording means;
Information transmission means for transmitting the temporary information used for generating the variable ID information and the first temporary key;
A tag device comprising:
Second key information recording means for recording second key information;
Information receiving means for receiving the variable ID information and the temporary information;
Second temporary key generating means for generating a second temporary key using the second key information and the temporary information;
Common key decryption means for decrypting the variable ID information using the second temporary key;
A center device comprising:
The ID automatic identification system characterized by having. The ID automatic identification system according to claim 1,
The ID information recording means includes
Updating the record ID information using the variable ID information generated in the first common key encryption means as new record ID information;
The temporary information update means includes
Updating the temporary information based on a predetermined rule,
The center device is
Temporary information retroactive means for converting the temporary information into a state before one update is performed based on the predetermined rule;
An ID retroactive means that uses the decryption result in the common key decryption means as variable ID information in a state before one update is performed;
Further comprising
The second temporary key generation means includes
Furthermore, using the second key information and the temporary information before update sequentially converted by the temporary information retroactive means, the process of sequentially generating the second temporary key is repeated as many times as necessary.
The common key decryption means includes:
Further, using the second temporary key sequentially generated by the second temporary key generating means, the process of sequentially decrypting the variable ID information sequentially generated by the ID retroactive means is repeated as many times as necessary.
ID automatic identification system characterized by the above. The ID automatic identification system according to claim 1 or 2,
The center device is
Third key information recording means for recording a plurality of third key information;
Unique ID information recording means for recording the unique ID information;
ID information updating means for generating new record ID information from the unique ID information using any of the third key information;
Update information transmitting means for transmitting the new record ID information;
Further comprising
The tag device is
Update information receiving means for receiving the new record ID information is further provided,
The ID information recording means includes
Updating the recorded record ID information with the new record ID information;
The center device is
A unique ID information reproducing means for generating the unique ID information from the decryption result in the common key decrypting means using the third key information;
ID automatic identification system characterized by the above. ID information recording means for recording record ID information;
First key information recording means for recording system common master key information and encryption center temporary key information;
Temporary information recording means for recording temporary information;
Common key decryption means for decrypting the encryption center temporary key information using the system common master key information and generating first center temporary key information;
First temporary key generation means for generating a first temporary key using the first center temporary key information and the temporary information;
First common key encryption means for generating variable ID information obtained by encrypting the recording ID information by a common key encryption method using the first temporary key;
Temporary information updating means for updating the temporary information recorded in the temporary information recording means;
Information transmission means for transmitting the temporary information used for generating the variable ID information and the first temporary key;
A tag device comprising:
Second key information recording means for recording system common master key information, center secret key information, and second center temporary key information;
Information receiving means for receiving the variable ID information and the temporary information;
Second temporary key generation means for generating a second temporary key using the second center temporary key information and the temporary information;
Common key decryption means for decrypting the variable ID information using the second temporary key and generating the recording ID information;
Second temporary key information generating means for generating updated temporary key information using the second center temporary key information and the center secret key information;
Unique ID information reproducing means for generating unique ID information from the recorded ID information using the updated temporary key information;
A center device comprising:
The ID automatic identification system characterized by having. The ID automatic identification system according to claim 4,
The second key information recording means is
Recording a plurality of second center temporary key information;
The center device is
Unique ID information recording means for recording unique ID information;
Center temporary key selection means for selecting any of the second center temporary key information from the second key information recording means;
A second encryption center temporary key information is generated by encrypting the second center temporary key information selected by the center temporary key selection means using the system common master key information by a common key encryption method. Symmetric key encryption means of
Third temporary key information generating means for generating new updated temporary key information using the second center temporary key information selected by the center temporary key selecting means and the center secret key information;
A third common key encryption means for generating new record ID information obtained by encrypting the unique ID by a common key encryption method using the new updated temporary key information;
Update information transmitting means for transmitting the new encryption center temporary key information and the new recording ID information;
Further comprising
The tag device is
Update information receiving means for receiving the new encryption center temporary key information and the new record ID information;
The first key information recording means includes
Updating the recorded encryption center temporary key information with the new encryption center temporary key information received by the update information receiving means;
The ID information recording means includes
Updating the recorded first record ID information with the new record ID information received by the update information receiving means;
ID automatic identification system characterized by the above. An ID automatic identification system according to any one of claims 1 to 5,
The temporary information update means includes
Updating the temporary information recorded in the temporary information recording means each time the temporary information is used to generate the first temporary key;
ID automatic identification system characterized by the above. The ID automatic identification system according to any one of claims 1 to 6,
The temporary key generation means includes
Generating the temporary key using a one-way hash function;
ID automatic identification system characterized by the above. ID information recording means for recording record ID information;
Key information recording means for recording key information;
Temporary information recording means for recording temporary information;
Temporary key generating means for generating a temporary key using the key information and the temporary information;
Common key encryption means for generating variable ID information obtained by encrypting the recording ID information by a common key encryption method using the temporary key;
Temporary information updating means for updating the temporary information recorded in the temporary information recording means;
Information transmission means for transmitting the temporary information used for generating the variable ID information and the first temporary key;
A tag device comprising: Key information recording means for recording key information;
Information receiving means for receiving variable ID information and temporary information;
Temporary key generating means for generating a temporary key using the key information and the temporary information;
Common key decryption means for decrypting the variable ID information using the temporary key;
The center apparatus characterized by having. Recording ID information is recorded in the ID information recording means of the tag device, the first key information is recorded in the first key information recording means, and the temporary information is recorded in the temporary information recording means.
Second key information is recorded in the second key information recording means of the center device,
The tag device has,
In the first temporary key generation means, the first temporary key is generated using the first key information and the temporary information,
In the first common key encryption means, variable ID information obtained by encrypting the recording ID information is generated by a common key encryption method using the first temporary key,
In the temporary information update means, update the temporary information recorded in the temporary information recording means,
In the information transmitting means, the variable ID information and the temporary information used for generating the first temporary key are transmitted,
The center device has,
In the information receiving means,
Receiving the variable ID information and the temporary information;
In the second temporary key generation means, a second temporary key is generated using the second key information and the temporary information,
In the common key decryption means, the variable ID information is decrypted using the second temporary key.
ID automatic identification method characterized by the above.   A program for causing a computer to function as the tag device according to claim 8.   A program for causing a computer to function as the center device according to claim 9.   A computer-readable recording medium storing the program according to claim 11 or 12.

Images