JP2005223956A - Authentication system, authentication device, and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To shorten authentication time, when carrying out authentication, using two or more encryption keys. <P>SOLUTION: A data D024 from a memory 11 and a degenerate key from an encryption key K1 are generated and transmitted to an IC card 3, together with information on sequence of degeneration (Here, Provider 2, Provider 4, Provider's 1, in this order). In the IC card 3, a degeneration processing portions 32 is controlled, corresponding to these items of information, the degenerate key is formed, and data D0 is read from a memory 31. It sequentially degenerates, using an encryption key of a specified sequence and a specified provider's number.Namely, the data D0 is degenerated using an encryption key K2, and data D02 is derived. This data D02 is degenerated using an encryption key K4, and data D024 is derived. Further, an encryption key K1 is used for this data D024, and the degenerate key is generated. Thus, the degenerate key generated is the same degenerate key as the degenerate key which a degeneration processing portion 13 of a controller 1 has formed. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an authentication system, an authentication apparatus, and a method, and more particularly to an authentication system, an authentication apparatus, and a method that can perform authentication more quickly.

  FIG. 20 shows a configuration example of a conventional authentication system in an IC card. In this configuration example, authentication processing is performed between the IC card 102 and the reader / writer 101. In the IC card 102, an area for storing information is divided into five areas, area 1 to area 5. Different encryption keys 1 to 5 correspond to each area. To access area i, the corresponding encryption key i is required.

  That is, when the reader / writer 101 records data in, for example, area 1 of the IC card 102 or reads data recorded therein, mutual authentication processing is first performed. The reader / writer 101 stores in advance the same encryption key 1 to encryption key 5 as the encryption key 1 to encryption key 5 stored in the IC card 102. When accessing the area 1 of the IC card 102, the encryption key 1 corresponding to the area 1 is read out and used for authentication processing.

  For example, the reader / writer 101 generates a predetermined random number and notifies the IC card 102 of this random number and the area number 1 to be accessed. In the IC card 102, the encryption key 1 corresponding to the notified area of number 1 is read, and the notified random number is encrypted using the encryption key 1. Then, the reader / writer 101 is notified of the encrypted random number. The reader / writer 101 decrypts the encrypted random number using the encryption key. If the random number notified to the IC card 102 matches the decrypted random number, it is determined that the IC card 102 is appropriate.

  Similarly, the IC card 102 generates a predetermined random number and outputs it to the reader / writer 101. The reader / writer 101 encrypts this random number using the encryption key 1 and notifies the IC card 102 of the encrypted random number. The IC card 102 decrypts the encrypted random number using the encryption key 1. If the decrypted random number matches the random number notified to the reader / writer 101, it is determined that the reader / writer 101 is an appropriate reader / writer.

  The above processing is performed for each area.

  As described above, in the conventional system, since the mutual authentication processing is performed individually for each area, there is a problem that it is difficult to quickly access each area. As a result, for example, the reader / writer 101 accesses a predetermined area of the IC card 102 and writes or reads information during a relatively short time when a commuter passes a gate provided at a ticket gate. There was a problem that made it difficult.

  The present invention has been made in view of such a situation, and enables quicker authentication.

  In the authentication system of the present invention, the first device accesses the encryption key assigned to itself, the common data held by the second device, and each of the plurality of areas stored in the memory of the second device. A first storage unit having individual data generated using a predetermined number of keys among a plurality of keys required for the first key, and a first authentication key generated by degenerating the encryption key and the individual data Generating means, encryption means for encrypting data using the first authentication key, and first communication means for communicating with the second device, wherein the second device is a device Second storage means for storing a plurality of keys including an identification number, common data, and a predetermined number of keys necessary for accessing each of the plurality of areas; and degenerating the common data and the plurality of keys A second generation means for generating the second authentication key, and a second authentication A decryption unit that decrypts the received data using a key; and a second communication unit that communicates with the first device, wherein the first generation unit receives the second data from the second device. The first authentication key is generated using the device identification number, the individual data, and the encryption key, and the first communication means generates the second authentication corresponding to the encrypted data and the first authentication key. The information necessary for generating the key is transmitted, the second communication means receives the encrypted data and information, and the second generation means is connected to the second storage means based on the received information. A second authentication key for authenticating access to the above area at one time is generated.

  In the authentication system of the present invention, the first device corresponds to each of the encryption key assigned to itself, the common data held by the second device, and the plurality of areas stored in the memory of the second device. The first authentication key has individual data generated using a predetermined number of keys necessary for access, generates a first authentication key by degenerating the encryption key and the individual data, and generates the first authentication key. Is used to encrypt data and communicate with the second device. The second device has a device identification number, common data, and a predetermined number of keys necessary for accessing each of the plurality of areas. A second authentication key by degenerating the common data and the plurality of keys, decrypting the received data using the second authentication key, and Identifies the device received from the second device The first authentication key is generated using the number, the individual data, and the encryption key, and the information necessary for generating the encrypted data and the second authentication key corresponding to the first authentication key is generated. Transmitting and receiving encrypted data and information, and generating a second authentication key for authenticating access to two or more areas of the second storage means at a time based on the received information.

  In the first authentication method of the present invention, the individual data is generated from a predetermined number of keys among the common data and a plurality of keys, and the first authentication key is generated by degenerating the encryption key and the individual data. And a step of generating a first random number, and the first random number generated and information necessary for generating a second authentication key corresponding to the first authentication key generated in the second device And a second authentication key generated by degenerating a plurality of keys and common data based on the information, and encrypted using the second authentication key. Receiving the random number and the second random number generated in the second device; decrypting the encrypted first random number using the first authentication key; and decrypting the first random number And authenticating the second device by comparing the original first random number and the second random number encrypted with the first authentication key and transmitted to the second device And the encrypted second random number is decrypted with the second authentication key, and the decrypted second random number is compared with the original second random number to authenticate the first device. And an authentication step.

  The second authentication method of the present invention includes a step of generating a first degenerate key and a second degenerate key from an encryption key and individual data, generating a first random number, and encrypting with the first degenerate key. The first random number and the information necessary for generating the third degenerate key and the fourth degenerate key corresponding to the first degenerate key and the second degenerate key generated in the second device, respectively. To the second device, and based on the information, a third degenerate key and a fourth degenerate key are generated from the plurality of keys and the common data, and the encrypted first random number is the third Receiving a first random number encrypted using a fourth degenerate key after being decrypted using the degenerate key, and a second random number generated in the second device; The second random number is decrypted using the second degenerate key, the decrypted first random number is compared with the original first random number, and the memory of the second device An authentication process for authenticating access to two or more areas at once, and the second device after decrypting the encrypted second random number with the second degenerate key and then encrypting with the first degenerate key The second random number that has been decrypted and then encrypted is decrypted with the third degenerate key, and the decrypted second random number and the original second random number are compared with each other. 1 device is authenticated.

  The first authentication device of the present invention corresponds to the encryption key assigned to itself, a predetermined number of keys associated with each of a plurality of areas stored in the memory of another device, and a common area. One access to a plurality of areas stored in the memory of another device from the storage means for storing the individual data generated using the attached key, the identification number, the encryption key, and the individual data Using an authentication key generating means for generating an authentication key for authenticating with, a communication means for transmitting information necessary for generating an authentication key generated in another apparatus to the other apparatus, and an authentication key And encryption means for encrypting data and decrypting data received from another device.

  The second authentication device of the present invention corresponds to a plurality of keys associated with each of a plurality of divided areas, storage means for storing common data, and one authentication key generated by another device. The other device generates information necessary for generating an authentication key for authenticating access to two or more areas in a single area from a plurality of keys stored in the storage means. An authentication key generating means for generating an authentication key obtained from the authentication key, wherein the authentication key generated by another device is a common data and a plurality of keys associated with the area to be accessed among the plurality of areas. A communication means for communicating with another device, and decrypting encrypted data transmitted from the other device using an authentication key, and Generate the data with the authentication key There is characterized in that a decoding means for encrypting.

  According to the present invention, it is possible to perform a rapid authentication process with another device while maintaining confidentiality.

   Embodiments of the present invention will be described below, but in order to clarify the correspondence between each means of the invention described in the claims and the following embodiments, in parentheses after each means, For example, the features of the present invention are described by adding corresponding embodiments (however, by way of example). However, of course, this description does not mean that each means is limited to the description.

The authentication system according to claim 1,
The first device includes:
A predetermined key out of a plurality of keys necessary for access to each of a plurality of areas stored in the common data held by the second device and the memory stored in the memory of the second device; First storage means (eg, memory 11 of FIG. 9) having individual data generated using a number of keys;
First generation means (for example, the degeneration processing unit 13 in FIG. 9) that degenerates the encryption key and the individual data to generate a first authentication key;
Encryption means for encrypting data using the first authentication key (for example, the encryption unit 22 in FIG. 9);
First communication means for communicating with the second device (for example, the communication unit 21 in FIG. 9),
The second device includes:
Second storage means for storing a plurality of keys including a device identification number, the common data, and a predetermined number of keys necessary for accessing each of the plurality of areas (for example, the memory 31 in FIG. 9) When,
Second generation means (for example, the degeneration processing unit 32 in FIG. 9) that generates a second authentication key by degenerating the common data and the plurality of keys;
Decryption means for decrypting the received data using the second authentication key (for example, the encryption unit 34 in FIG. 9);
Second communication means for communicating with the first device (for example, the communication unit 33 in FIG. 9),
The first generation means generates the first authentication key using the device identification number received from the second device, the individual data, and the encryption key,
The first communication means transmits the encrypted data and information necessary to generate the second authentication key corresponding to the first authentication key;
The second communication unit receives the encrypted data and the information, and the second generation unit accesses the two or more areas of the second storage unit once based on the received information. Generating the second authentication key for authenticating with the method described above.

  FIG. 1 shows a configuration example of an authentication system of the present invention. In this configuration example, the system includes a controller 1, a reader / writer 2, and an IC card 3. The IC card 3 is possessed by each user instead of a commuter pass, for example. The reader / writer is provided at a ticket gate of a railway company that uses the IC card 3. In this specification, the term “system” is used as appropriate when collectively referring to the entire apparatus including a plurality of apparatuses.

  The controller 1 has a memory 11 in which an encryption key necessary for accessing each area of the memory 31 of the IC card 3 and a provider number corresponding to the encryption key are stored. The communication unit 12 performs wired or wireless communication with the communication unit 21 of the reader / writer 2. The degeneration processing unit 13 reads a predetermined number of encryption keys from a plurality of encryption keys stored in the memory 11 and performs a process of generating one degenerate key. The control unit 14 controls the operation of each unit of the controller 1 and performs an authentication process.

  The communication unit 21 of the reader / writer 2 communicates with the communication unit 12 of the controller 1 or the communication unit 33 of the IC card 3 in a wired or wireless manner. The encryption unit 22 performs a process of encrypting the random number generated by the random number generation unit 23 and decrypting the encrypted random number transmitted from the IC card 3. The control unit 24 controls the operation of each unit of the reader / writer 2 and performs an authentication process.

  The IC card 3 has a memory 31, and the memory 31 is divided into a plurality of areas (in the example of FIG. 1, five areas). Each area is individually accessed by each provider (for example, each railway company), and data is appropriately written or read. However, different encryption keys are associated with each area, and the corresponding encryption key i is required to access the predetermined area i.

  The degeneration processing unit 32 performs a process of degenerating a plurality of encryption keys and generating one degenerate key. The encryption unit 34 performs a process of encrypting the random number generated by the random number generation unit 35 and performs a process of decrypting the encrypted data supplied from the reader / writer 2. The control unit 36 controls the operation of each unit of the IC card 3 and performs an authentication process.

  FIG. 2 shows a more detailed example of the data structure of the memory 31 of the IC card 3. In this example, the area 51 is a common area, and data common to each provider is stored. The area 52 is an area dedicated to each provider, and only each corresponding provider can access the area.

  In the area 53, information necessary for managing the area 51 and the area 52 is recorded. In this example, the information is the provider number assigned to each provider, block allocation information indicating the area assigned to the provider, read only, write only, both read and write The permission information, the secret key, and the secret key version.

  For example, provider number 00 is common to all providers, and the address of area 51 as a common area is written in the block allocation information. As the permission information, information accessible to the area 51 as the common area is defined. Further, as the encryption key and its version, an encryption key and its version necessary for accessing the area 51 as the common area are defined.

  The area 54 is a system ID block, and an ID of a system to which the IC card 3 is applied is written.

  The memory 11 of the controller 1 stores the provider number, permission information, encryption key version, and encryption key shown in FIG.

  FIG. 3 shows a configuration example of the degeneration processing unit 13 (or the degeneration processing unit 32). However, this processing is actually performed by software.

  That is, in the degeneration processing unit 13 or 32, when there are n encryption keys in the IC card 3, (n-1) circuits of the 2-input degeneration circuits 81-1 to 81- (n-1) are included. Are provided, each of which receives two data and outputs one data. The encryption key of provider 1 (railway company 1) and the encryption key of provider 2 (railway company 2) are input to the 2-input degeneration circuit 81-1. The 2-input degeneration circuit 81-1 generates one degenerate key from these two encryption keys, and supplies it to the subsequent 2-input degeneration circuit 81-2. The 2-input degeneration circuit 81-2 degenerates the degenerate key input from the 2-input degeneration circuit 81-1 and the encryption key of the provider 3 (railway company 3), and the subsequent 2-input degeneration circuit 81-3 ( (Not shown). Thereafter, similar processing is performed in each 2-input degeneration circuit 81-i, and the degenerate key generated by the last 2-input degeneration circuit 81- (n-1) is used as one final degenerate key. .

  When n = 1 (when there is one encryption key), the input encryption key is output as it is as a degenerate key.

  4 to 6 show configuration examples of the 2-input degeneration circuit 81-i shown in FIG. The encryption circuit 81-i in FIG. 4 encrypts the input from the previous stage in correspondence with the encryption key prepared in advance, and outputs it to the subsequent stage. For example, when the 2-input degeneration circuit 81-1 is configured by the encryption circuit 81-i, the encryption key of the provider 1 is input as data, and the encryption key of the provider 2 is input as the encryption key. Then, the encryption key (data) of provider 1 is encrypted using the encryption key of provider 2 and is output to 2-input degeneration circuit 81-2.

  The encryption circuit 81-i in FIG. 5 receives the input from the previous stage as an encryption key, receives an encryption key prepared in advance as data, performs encryption processing, and outputs it to the subsequent stage. For example, when this encryption circuit 81-i is applied to the 2-input degeneration circuit 81-1, the encryption key of provider 2 is input as data, and the encryption key of provider 1 is input as the encryption key. Then, the encryption key of provider 2 is encrypted using the encryption key of provider 1, and is output to the subsequent 2-input degeneration circuit 81-2 as a degenerate key.

  As the encryption method shown in FIGS. 4 and 5, for example, DES (Data Encryption Standard), FEAL (Fast Data Encipherment Algorithm), or the like can be used.

  In FIG. 6, the encryption circuit 81-i is configured by an exclusive OR circuit (XOR). For example, when this encryption circuit 81-i is applied to the 2-input degeneration circuit 81-1, the exclusive OR of the encryption key of provider 1 and the encryption key of provider 2 is calculated. As a degenerate key, it is output to the subsequent two-input degenerate circuit 81-2.

  In FIG. 3, the encryption key of each provider is, for example, one of digital data represented by 30 bytes. In this case, the degenerate key is also digital data having the same number of bytes. Since the encryption key is one of the numbers defined by 30 bytes, if one predetermined number is selected from all combinations and tested in order, the encryption key can be found out. It is theoretically possible. However, it takes an enormous amount of time to perform the operation, and it is practically impossible to check which of the 30-byte numbers is the actual encryption key.

  Next, the operation will be described with reference to the timing chart of FIG. The controller 1 and the reader / writer 2 are shown as separate devices here, but may be integrated devices.

  In step S1, the control unit 14 of the controller 1 controls the communication unit 12 to detect that the reader / writer 2 has a sufficiently short period (a user having the IC card 3 passes through the ticket gate of the railway station. Command) When the control unit 24 of the reader / writer 2 receives this command via the communication unit 21, the control unit 24 controls the communication unit 21 and performs polling of the IC card 3 in step S2. When receiving a polling command from the communication unit 21 of the reader / writer 2 via the communication unit 33, the control unit 36 of the IC card 3 notifies the presence of itself in step S3. When the control unit 24 of the reader / writer 2 receives this notification from the IC card 3 via the communication unit 21, it notifies the controller 1 of the presence of the IC card 3 in step S4.

  When receiving the notification via the communication unit 12, the control unit 14 of the controller 1 controls the degeneration processing unit 13 in step S5, and stores the encryption key of the area to be accessed in the memory 31 of the IC card 3 as the memory. 11 to read. For example, in the example of FIG. 1, the encryption key 1, the encryption key 2, and the encryption key 4 are called by the degeneration processing unit 13 in order to access the area 1, the area 2, and the area 4. The degeneration processing unit 13 performs degeneration processing using these three encryption keys. That is, as shown in FIG. 3, in the 2-input degeneration circuit 81-1, the encryption key 1 is encrypted with the encryption key 2, and is output to the 2-input degeneration circuit 81-2. The 2-input degeneration circuit 81-2 encrypts the degenerate key obtained as a result of degenerating the encryption key 1 and the encryption key 2 supplied from the 2-input degeneration circuit 81-1 with the encryption key 3. The obtained degenerate key is the final degenerate key.

  When one degenerate key is generated in this way, the control unit 14, along with the provider number (key number), the number of providers (number of keys), and the order of the degeneration process, in step S 6, the reader / writer 2 is notified. When receiving the input of this information from the communication unit 12 of the controller 1 via the communication unit 21, the control unit 24 of the reader / writer 2 causes the random number generation unit 23 to generate a random number r1 in step S7. The control unit 24 notifies the random number r1 from the communication unit 21 to the IC card 3 in step S8. At this time, the control unit 24 notifies the IC card 3 of the provider number and the provider number provided from the controller 1 together.

  When receiving such notification, the control unit 36 of the IC card 3 first executes a degenerate key generation process in step S9. That is, the control unit 36 reads the encryption key corresponding to the provider number (key number) transferred from the reader / writer 2 from the memory 31, supplies this to the degeneration processing unit 32, and executes the degeneration process. In the case of the example of FIG. 1, the provider numbers corresponding to the encryption key 1, the encryption key 2, and the encryption key 4 are transferred, so that the degeneration processing unit 32 uses the encryption key 1, the encryption key corresponding to these provider numbers. 2 and the encryption key 4 are read from the memory 31 and supplied to the degeneration processing unit 32. The degeneration processing unit 32 degenerates these three encryption keys in a designated order (for example, the order of the input providers), and finally generates one degenerate key. As a result, a degenerate key identical to the degenerate key generated by the controller 1 in step S5 is generated in the IC card 3.

  Next, in step S10, the control unit 36 outputs the random number r1 received from the reader / writer 2 and the degenerated key generated by the degeneration processing unit 32 to the encryption unit 34, and encrypts the random number r1 with the degenerated key. Make it. Then, an encrypted random number R1 is generated.

  Next, in step S11, the control unit 36 causes the random number generation unit 35 to generate a predetermined random number r2. In step S12, the control unit 36 controls the communication unit 33 to transfer the encrypted random number R1 and the random number r2 generated in step S11 to the reader / writer 2 in step S10.

  When receiving the supply of the random number r2 and the encrypted random number R1 via the communication unit 21, the control unit 24 of the reader / writer 2 controls the encryption unit 22 in step S13, thereby encrypting the random number. R1 is decrypted using the degenerate key supplied from the controller 1. The control unit 24 further checks whether or not the random number obtained as a result of the decryption is equal to the random number r1 generated in step S7. If not, it is determined that the IC card 3 is not an appropriate IC card, and step S14. Then, the controller 1 is notified of this. At this time, the controller 1 executes error processing (for example, prohibiting the user from passing through the ticket gate).

  On the other hand, if it is determined in step S13 that the decrypted random number and the random number r1 are equal, the process proceeds to step S15, and the control unit 24 controls the encryption unit 22 and receives the supply from the IC card 3. The random number r2 is encrypted using the degenerate key supplied from the controller 1, and the encrypted random number R2 is generated. Further, the control unit 24 causes the encrypted random number R2 generated in this way to be transferred to the IC card 3 in step S16.

  When the control unit 36 of the IC card 3 receives the supply of the encrypted random number R2, in step S17, the control unit 36 controls the encryption unit 34 to generate the encrypted random number R2 in step S9. Decrypt using the degenerated key. Then, it is determined whether or not the decrypted random number is equal to the random number r2 generated in step S11. The determined result is transferred to the reader / writer 2 through the communication unit 33 in step S18.

  When receiving the notification of the authentication result from the IC card 3, the control unit 24 of the reader / writer 2 further notifies the controller 1 from the communication unit 21 in step S19.

  When the control unit 14 of the controller 1 receives this notification via the communication unit 12, if the notification is determined to be NG, it executes error processing. On the other hand, if it is determined to be OK (when the IC card 3 is appropriate), a necessary command such as reading or writing is output to the reader / writer 2 in step S20. Upon receiving this command transfer, the reader / writer 2 further outputs a read or write command to the IC card 3 in step S21. In this case, reading or writing of the area 1, area 2, and area 4 of the IC card 3 is instructed in this way.

  As a result, the control unit 36 of the IC card 3 executes the writing process when the writing is instructed to the area 1, the area 2, or the area 4. If reading is instructed, a reading process is executed. The read data is transferred from the IC card 3 to the reader / writer 2 in step S22, and further transferred from the reader / writer 2 to the controller 1 in step S23.

  As described above, when accessing a plurality of areas, the personal identification key required individually is not individually authenticated (for example, in the case of FIG. 1, the encryption key 1, the encryption key 2, and the encryption key 4). , Instead of performing authentication processing individually (that is, performing authentication processing three times in total), one degenerate key is generated from a plurality of secret keys, and authentication processing is performed only once with this one degenerate key. As a result, a quick authentication process is possible.

  Note that the degenerate key has the same number of bytes (length) as the encryption key, but it can also have a different number of bytes. However, since this degenerate key is only used for authentication, it is not necessary to be able to restore the original plurality of encryption keys from the degenerate key.

  FIG. 8 shows another method for generating a degenerate key. In this example, the encryption keys K1 to Kn are assigned to the providers 1 to n, respectively, and the secret included in the first 2-input degeneration circuit 81-1 (because the data is common to the providers). The data D0 (which is not necessarily secret) is input, and the two-input degeneration circuit 81-1 encrypts the data D0 based on the encryption key K1 of the provider 1. Then, the 2-input degeneration circuit 81-2 encrypts the output D1 of the 2-input degeneration circuit 81-1 based on the encryption key K2 of the provider 2. Thereafter, the same processing is sequentially performed in the 2-input degeneration circuit 81-i, and the output of the 2-input degeneration circuit 81-n at the final stage is used as the final degeneration key.

  When generating the degenerate key as shown in FIG. 3, the provider 2 cannot generate the degenerate key without knowing the encryption key of the provider 1. Basically, since each provider is independent, it is not preferable for ensuring confidentiality to inform other providers of the encryption key of a predetermined provider.

  On the other hand, when the degenerate key is generated as shown in FIG. 8, the other provider can generate the degenerate key without notifying the other provider of his / her own encryption key.

  9 to 11 show configuration examples of the controller 1, the reader / writer 2, and the IC card 3 of the provider 1, the provider 2, or the provider 4 when generating a degenerate key, as shown in FIG. .

  As shown in these drawings, in the IC card 3, predetermined data (common data) D0 is stored in advance in the memory 31 in addition to the encryption keys K1 to K5 corresponding to the areas 1 to 5. .

  The provider 11 memory 11 stores its own encryption key K1 and data D024 (FIG. 9), and the provider 2 memory 11 stores its own encryption key K2 and data D014. In FIG. 10, the memory 11 of the provider 4 stores its own encryption key K4 and data D012 (FIG. 11).

  These data (individual data) D024, D014, and D012 are generated by the method shown in FIGS.

  That is, the provider 1 uses the encryption key K2 by the provider 2 to degenerate the data D024 by the 2-input degeneration circuit 81-1, in order to obtain the data D024, thereby generating the data D02. get. Then, the data D02 is provided to the provider 4, and the data D024 is generated by degenerating the data D02 with the encryption key K4 by the 2-input degeneration circuit 81-2. The provider 1 receives the data D024 from the provider 4 and stores it in the memory 11.

  In this case, the data D0 is first provided to the provider 4 and degenerated with the encryption key K4 to generate the data D04. The data D04 is provided to the provider 2 and degenerated with the encryption key K2. The data D042 may be generated and stored in the memory 11. Therefore, the provider 1 also stores in the memory 11 the order of reduction indicating in which order the reduction has been performed.

  Further, as shown in FIG. 13, the provider 2 requests the provider 1 to generate data D01 in which the data D0 is degenerated with the encryption key K1. Then, the data D01 is provided to the provider 4, and is degenerated with the encryption key K4, and the data D014 is generated. Then, the data D014 is stored in the memory 11. In this case also, the provider 4 is first requested to perform the degeneration process, the data D04 generated using the encryption key K4 is provided to the provider 1, and this is further degenerated using the encryption key K1, Data D041 may be obtained and stored in the memory 11. The provider 2 also stores the order of degeneration in the memory 11.

  Further, as shown in FIG. 14, the provider 4 requests the provider 1 to degenerate the data D0 using the encryption key K1, and to generate the data D01. Then, the data D01 is provided to the provider 2 and is degenerated using the encryption key K2, and the data D012 is generated. This data D012 is stored in the memory 11. Similarly, in this case, the data D0 is first degenerated to the provider 2 using the encryption key K2, and the data D02 is generated. The data D02 is degenerated by the provider 1 using the encryption key K1, and the data D021 is generated. You may be allowed to ask. The provider 4 also stores the degeneration order in the memory 11.

  Each provider can perform an authentication process as follows. For example, in the provider 1, as shown in FIG. 9, the control unit 14 controls the degeneration processing unit 13, reads the data D024 and the encryption key K1 from the memory 11, and generates a degenerated key. This degenerate key is transferred to the reader / writer 2. At this time, the reader / writer 2 includes the number of providers (in this example, 3), the provider number (in this case, provider 1, provider 2, and provider 4), and the order of degeneration (in this case, provider 2 in the order of provider 4, provider 1). The control unit 24 controls the communication unit 21 and notifies the IC card 3 of the number of providers, the provider number, and the degeneration order transferred from the control unit 14 of the controller 1.

  In the IC card 3, when the communication unit 33 receives these pieces of information, the control unit 36 controls the reduction processing unit 32 corresponding to these pieces of information to generate a reduction key. The degeneration processing unit 32 reads the data D0 from the memory 31, and sequentially degenerates the data using the specified order and the encryption key of the specified provider number. That is, the data D0 is degenerated using the encryption key K2, and data D02 is obtained. The data D02 is degenerated using the encryption key K4 to obtain data D024. Further, a degenerate key is generated from the data D024 using the encryption key K1. The degenerate key generated in this way is the same degenerate key as the degenerate key generated by the degeneration processing unit 13 of the controller 1.

  Accordingly, similarly to the case described with reference to FIG. 7, the authentication processing can be performed by performing the processing after step S10. Then, the reader / writer 2 of the provider 1 can access the areas 1, 2, and 4 of the memory 31 of the IC card 3.

  On the other hand, in the provider 2, as shown in FIG. 10, the control unit 14 controls the degeneration processing unit 13, reads the data D 014 from the memory 11, and uses the encryption key K 2 read from the memory 11. Degenerate. Then, the generated degenerate key is transferred to the reader / writer 2. At this time, the reader / writer 2 includes the number of providers (in this case, 3), the provider number (in this case, provider 1, provider 2, and provider 4), and the order of degeneration processing (in this case, provider 1, The order of provider 4 and provider 2) is notified to the reader / writer 2.

  The reader / writer 2 transfers these information to the IC card 3. In the IC card 3, a degenerate key is generated corresponding to these pieces of information.

  That is, the degeneration processing unit 32 of the IC card 3 reads the data D0 from the memory 31, and first degenerates this using the encryption key K1 to obtain data D01. Then, the data D01 is further degenerated using the encryption key K4, and data D014 is generated. This data D014 is further degenerated using the encryption key K2. The degenerate key generated in this way is the same degenerated key as the degenerated key generated in the controller 1. Accordingly, the reader / writer 2 of the provider 2 can access the area 1, area 2, and area 4 of the memory 31 of the IC card 3.

  Furthermore, as shown in FIG. 11, also in the provider 4, the control unit 14 of the controller 1 controls the degeneration processing unit 13, and generates a degenerate key from the data D012 stored in the memory 11 using the encryption key K4. This is transferred to the reader / writer 2. At this time, the number of providers (in this case, 3), the provider number (in this case, provider 1, provider 2, and provider 4), and the degeneration order (in this case, the order of provider 1, provider 2, and provider 4) Will be notified. These pieces of information are transferred to the IC card 3. The IC card 3 performs a degeneration process based on these pieces of information.

  That is, the degeneration processing unit 32 reads the data D0 from the memory 31, and generates data D01 using the data D0 using the encryption key K1. Next, the data D01 is degenerated using the encryption key K2, and data D012 is generated. The data D012 is further degenerated using the encryption key K4, and a final degenerated key is generated. The degenerate key generated in this way is the same as the degenerate key generated in the controller 1. Accordingly, the reader / writer 2 can access the area 1, area 2, and area 4 of the memory 31 of the IC card 3.

  FIG. 15 shows still another degenerate key generation method. In this method, the data Dn-1 input to the 2-input degeneration circuit 81-n that generates the final degenerate key and the ID number held in advance by the IC card 3 are calculated, and the calculation result is obtained. In contrast, a degenerate key is generated using the encryption key Kn. Other processes are the same as those in FIG.

  FIG. 16 illustrates a configuration example of the controller 1, the reader / writer 2, and the IC card 3 when a degenerate key is generated according to the method illustrated in FIG. This configuration represents the configuration of the provider 4. As shown in the figure, the memory 11 of the controller 1 stores data D012, an encryption key K4, and a degenerate order. The reader / writer 2 has an ID acquisition unit 211 that acquires an ID from data received by the communication unit 21. Further, the IC card 3 has an ID number unique to the IC card 3 stored in advance in the memory 201 (which may be the same memory as the memory 31).

  As described above, when the authentication process is performed using the ID number, a plurality of users having IC cards of the same provider combination (for example, the combination of provider 1, provider 2, and provider 4) are in proximity to each other. In this state, it is possible to avoid confusion when passing through a ticket gate of a predetermined provider.

  That is, when a plurality of IC cards 3 pass in the vicinity of the reader / writer 2 of a predetermined provider, the plurality of IC cards 3 respond to requests from the reader / writer 2, respectively. It is not possible to determine whether the response is from the IC card, and there is a risk that erroneous processing will be performed. On the other hand, if the ID number is used, such confusion can be avoided.

For example, as shown in FIG. 17, when the IC card 3A and the IC card 3B try to pass near the reader / writer 2, the reader / writer 2 requests an ID from the IC card 3 in step S41. This request is received not only by the communication unit 33 of the IC card 3A but also by the communication unit 33 of the IC card 3B. When receiving the ID request signal in this way, the control unit 36 of the IC card 3A controls the random number generation unit 35 to generate a predetermined random number in step S42. In step S43, time slot allocation processing corresponding to the generated random number is executed. That is, communication between the reader / writer 2 and the IC card 3 is performed by time division multiplexing operation, and the IC card 3A uses the time slot corresponding to the generated random number among the plurality of time slots as its own communication. Assign as a time slot. Then, at the timing of the assigned time slot, the control unit 36 of the IC card 3A transmits the ID number (ID _A ) read from the memory 201 to the reader / writer 2 through the communication unit 33 in step S44.

Similar processing is executed in the other IC card 3B. That is, when receiving the ID request signal from the reader / writer 2, the control unit 36 of the IC card 3B controls the random number generation unit 35 in step S45 to generate a random number. In step S46, the time slot corresponding to the generated random number is assigned as its own time slot. In step S47, the ID number (ID _B ) stored in the memory 201 is read and transferred to the reader / writer 2 at the timing of the assigned time slot.

  In the reader / writer 2, when the ID number transmitted from the IC cards 3A and 3B is received by the communication unit 21, this is supplied to the ID acquisition unit 211 and stored therein. In step S48, the control unit 24 controls the random number generation unit 23 to generate the random number r1. Furthermore, in step S49, the control unit 24 selects, for example, the previously acquired one of the acquired IDs. The control unit 24 further receives the data D012, the encryption key K4, and the information on the degeneration order from the memory 11 of the controller 1. Then, a degenerate key is generated corresponding to these pieces of information.

First, the control unit 24 performs a predetermined calculation on the selected ID (for example, ID _{A of the} IC card 3) on the data D012. This operation can be addition, exclusive OR operation, or the like. The control unit 24 degenerates the calculation result using the encryption key K4 and generates a degenerate key.

Further, in step S50, the number of providers, the provider number, the degeneration order, and the random number r1 are transmitted to the IC card 3. This information is received by both the IC card 3A and the IC card 3B. When receiving this information, in step S51, the IC card 3B degenerates the data D0 with the encryption key K1 according to the designated order, obtains the data D01, degenerates it with the encryption key K2, and stores the data D012 obtain. Further, ID _B is read from the memory 201, and the result calculated with the data D012 is degenerated with the encryption key K4.

Using the degenerate key generated in this manner, the encryption unit 34 decrypts the encrypted random number r1. However, since the random number r1 is encrypted with the degenerate key generated using ID _A , it cannot be decrypted with the degenerate key generated using ID _B. Therefore, the IC card 3B does not respond to transmission from the reader / writer 2 thereafter.

On the other hand, in the IC card 3A, in step S52, the control unit 36 generates a degenerate key corresponding to the information transferred from the reader / writer 2. That is, in accordance with the designated degeneration order, the degeneration processing unit 32 of the IC card 3A degenerates the data D0 first read from the memory 31 using the encryption key K1 read from the area 1, and generates data D01. Then, the data D01 is degenerated using the encryption key K2 read from the area 2, and data D012 is generated. Further, a predetermined calculation is performed on the data D012 and the ID number (ID _A ) read from the memory 201, and the result of the calculation is reduced using the encryption key K4 read from the area 4 of the memory 31. To generate a degenerate key. The degenerate key generated in this way is the same degenerate key as the degenerate key generated by the reader / writer 2 in step S49.

  Therefore, the authentication process can be performed by executing the processes corresponding to steps S10 to S17 in FIG. 7 shown in steps S53 to S59. Since the process is the same as that described in FIG. 7, the description thereof is omitted.

  FIG. 18 shows a method for changing the encryption key. For example, when the provider 1 intends to change the encryption key K1, a predetermined random number e1 is generated and used as a new key K1 '. As described above, when the encryption key of the provider 1 is changed, the provider 1 uses the encryption key K1 of the area 1 stored in the memory 31 of the user's IC card 3 using the reader / writer 2 of the provider as appropriate. You can update this at However, the encryption key K1 of the IC card 3 of the user who uses the reader / writer 2 of the other provider 2 or the provider 4 also needs to be updated. In this case, the provider 1 can update the encryption key K1 to the new encryption key K1 'without teaching the other provider 2 or the provider 4 the new encryption key K1'.

In this case, the provider 1 first calculates the following equation to generate data C1 and C2.
C1 = E (e1, K1)
C2 = E (e2, K1)

  Here, E (A, B) means that the data A is encrypted using the key B. As an encryption method, DES, FEAL, or the like can be used.

E2 is a value that satisfies the following equation.
e1 + e2 = F

  Note that this value F is a predetermined value, and the other provider 2 and provider 4 are also known to be used when changing their own encryption keys. , Stored in the memory 31 in advance.

  When the provider 1 generates the data C1 and C2 in this way, this value is notified to other providers together with the key number (in this case, the key number 1) assigned to its own encryption key K1. To do. Each provider uses the data to update the key K1 in the memory 31 of the IC card 3 that uses the reader / writer 2 as follows. This update process will be described below using the provider 4 as an example.

That is, the reader / writer 2 of the provider 4 transmits data C1 and C2 to the IC card 3. The encryption unit 34 of the IC card 3 calculates the following expression to obtain e1 and e2.
e1 = D (C1, K1)
e2 = D (C2, K1)

  Here, D (A, B) means that data A is decrypted using the key B.

  That is, the IC card 3 can decrypt the data C1 and C2 using the key K1 stored in the memory 31, and obtain data e1 and e2.

  The controller 36 further adds e1 and e2 obtained as described above, and determines whether or not the addition result is equal to a predetermined value F stored in the memory 31 in advance. If equal, the data e1 obtained by decrypting the data C1 is updated as a new key K1 'instead of the key K1.

  On the other hand, if the sum of e1 and e2 is different from F, it is determined that the request is an unauthorized update and the update process is not performed.

For example, it is assumed that a malicious provider tries to falsify the encryption key K1 of provider 1 and calculates e1 ′ and e2 ′ by calculating the following equation.
e1 ′ = D (C1 ′, K1)
e2 ′ = D (C2 ′, K1)

  These C1 'and C2' are values appropriately set by the provider who attempted the alteration.

  However, even if e1 'and e2' generated in this way are added, the addition result is generally not equal to the value F. It takes a considerable amount of time to find a combination of e1 'and e2' having this value F, which is practically extremely difficult. Therefore, a third party is prevented from falsifying another person's encryption key.

  The provider 2 also performs the same processing to update the encryption key K1 of the memory 31 of the IC card 3 that uses the reader / writer 2.

  When the encryption key K1 of the provider 1 is changed as described above, the provider 1, the provider 2, and the provider 4 perform the same process as described with reference to FIGS. 12 to 14 again. The data D024, D014, D012 stored in each of them are updated.

  FIG. 19 shows still another method of authentication processing. Note that the reader / writer 2 in FIG. 19 represents the reader / writer of the provider 4.

In this example, the control unit 24 generates a degenerate key Ks using the encryption key K4 and data D012 stored in the memory 11. Then, for example, the control unit 24 _combines the even number bits of the encryption key K4 and the odd number bits of the degenerate key Ks to generate the first degenerate key K _4s1, and the odd number bits of the encryption key K4 and the even number of the degenerate key Ks. A second degenerate key K _4s2 is generated by combining the bits.

The first degenerate key K _4s1 is input to the encryption unit 22A of the encryption unit 22 and used to encrypt the random number generated by the random number generation unit 23. This encrypted random number is transmitted to the IC card 3. At this time, the information necessary for generating the degenerate key is simultaneously transmitted to the IC card 3 in the same manner as described above.

  Using this information, the IC card 3 reads the data D0 from the memory 31, and further applies the encryption keys K1, K2, and K4 in order to generate the degenerate key Ks. This degenerate key Ks has the same value as the degenerate key Ks generated by the reader / writer 2.

Control unit 36, by performing the same processing as the reader writer 2, to generate a first degenerate key K _4s1 the second degenerate key K _4s2.

Then, the decryption unit 34B of the encryption unit 34 decrypts the encrypted random number transmitted from the reader / writer 2, and transfers the decrypted random number to the encryption unit 34A. The encryption unit 34A encrypts the data using the second degenerate key K _4s2 and transmits it to the reader / writer 2.

In the reader / writer 2, the decryption unit 22B of the encryption unit 22 decrypts the encrypted random number transmitted from the IC card 3 using the second degenerate key K _4s2 . The decryption result is transferred to the control unit 24.

  The random number decoded in this way is the same random number as the random number generated by the random number generation unit 23 if the IC card 3 is appropriate. Therefore, authentication processing can be performed by checking whether or not the received random number is equal to the generated random number.

It is a block diagram which shows the structural example of the authentication system of this invention. It is a figure which shows the example of the data structure of the memory 31 of FIG. It is a figure which shows the structural example of the degeneracy process part 13 of FIG. It is a figure which shows the structural example of the 2 input degeneracy circuit of FIG. It is a figure which shows the structural example of the 2 input degeneracy circuit of FIG. It is a figure which shows the structural example of the 2 input degeneracy circuit of FIG. It is a timing chart explaining operation | movement of the authentication system of FIG. It is a figure which shows the other structural example of the degeneracy process part 13 of FIG. It is a block diagram which shows the structural example of the authentication system of the provider 1 in the case of producing | generating a degenerate key with the structural example shown in FIG. It is a block diagram which shows the structural example of the authentication system of the provider 2 in the case of producing | generating a degenerate key with the structural example shown in FIG. It is a block diagram which shows the structural example of the authentication system of the provider 4 in the case of producing | generating a degenerate key with the structural example shown in FIG. It is a figure explaining the production | generation of the data memorize | stored in the memory 11 of FIG. It is a figure explaining the production | generation of the data memorize | stored in the memory 11 of FIG. It is a figure explaining the production | generation of the data memorize | stored in the memory of FIG. It is a figure which shows the further another structural example of the degeneration process part 13 of FIG. It is a block diagram which shows the structural example of the authentication system of the provider 4 at the time of producing | generating a degenerate key with the method shown in FIG. FIG. 17 is a timing chart for explaining the operation of the example of FIG. 16. FIG. It is a figure explaining the operation | movement in the case of changing a key. It is a block diagram explaining other authentication processing. It is a figure which shows the structure of the conventional authentication system.

Explanation of symbols

  1 controller, 2 reader / writer, 3 IC card, 11 memory, 12 communication unit, 13 degeneration processing unit, 14 control unit, 21 communication unit, 22 encryption unit, 23 random number generation unit, 24 control unit, 31 memory, 32 degeneration Processing unit, 33 communication unit, 34 encryption unit, 35 random number generation unit, 36 control unit

Claims (10)

In an authentication system that performs an authentication process between a first device and a second device,
The first device includes:
A predetermined key out of a plurality of keys necessary for access to each of a plurality of areas stored in the common data held in the second device and the memory stored in the memory of the second device; First storage means having individual data generated using a number key;
First generation means for generating a first authentication key by degenerating the encryption key and the individual data;
Encryption means for encrypting data using the first authentication key;
First communication means for communicating with the second device,
The second device includes:
Second storage means for storing a plurality of keys including a device identification number, the common data, and the predetermined number of keys necessary for access to each of the plurality of areas;
Second generation means for generating a second authentication key by degenerating the common data and the plurality of keys;
Decryption means for decrypting the received data using the second authentication key;
Second communication means for communicating with the first device,
The first generation means generates the first authentication key using the device identification number received from the second device, the individual data, and the encryption key,
The first communication means transmits the encrypted data and information necessary to generate the second authentication key corresponding to the first authentication key;
The second communication unit receives the encrypted data and the information, and the second generation unit accesses the two or more areas of the second storage unit once based on the received information. An authentication system, characterized in that the second authentication key for authenticating with is generated. The first authentication key includes at least a first degenerate key and a second degenerate key generated from a degenerate key generated using the individual data and the encryption key, and the second authentication key. The authentication system according to claim 1, wherein the authentication system includes a third degenerate key and a fourth degenerate key generated based on the received information. The first device sends a random number encrypted with the first degenerate key to the second device, and the second device decrypts the encrypted random number with the third degenerate key Thereafter, encryption is performed using the fourth degenerate key, the encrypted random number is transmitted to the first device, and the first device decrypts the received encrypted random number using the second degenerate key. The authentication system according to claim 2, wherein the decrypted random number is compared with the original random number. The first device storing the encryption key assigned to itself and the individual data authenticates the second device storing the identification number, the plurality of keys, and the common data, and the first device. Is an authentication method for authenticating to the second device,
The individual data is generated from a predetermined number of keys among the common data and the plurality of keys,
Degenerating the encryption key and the individual data to generate a first authentication key;
A first random number is generated, and the generated first random number and information necessary for generating a second authentication key corresponding to the first authentication key generated in the second device are Transmitting to the second device;
Based on the information, the plurality of keys and the common data are degenerated to generate the second authentication key, the first random number encrypted using the second authentication key, and the first Receiving a second random number generated in the device of 2;
The encrypted first random number is decrypted using the first authentication key, and the second device is authenticated by comparing the decrypted first random number and the original first random number. An authentication process,
Encrypting the second random number with the first authentication key and transmitting to the second device;
The encrypted second random number is decrypted with the second authentication key, and the decrypted second random number is compared with the original second random number to authenticate the first device. An authentication method comprising: an authentication step. Individually generated using a predetermined number of keys among a plurality of keys necessary for access to each of a plurality of areas stored in the common data and each of a plurality of areas stored in the memory of the second device, and an encryption key assigned to the device A first device storing data authenticates a second device storing a plurality of keys including the predetermined number of keys and the common data, and the first device stores the first device 2. An authentication method for authenticating to the device of 2,
Generating a first degenerate key and a second degenerate key from the encryption key and the individual data;
Generates a first random number and corresponds to the first random number encrypted with the first degenerate key and the first degenerate key and the second degenerate key generated in the second device, respectively. Transmitting information necessary to generate the third degenerate key and the fourth degenerate key to the second device;
Based on the information, the third degenerate key and the fourth degenerate key are generated from the plurality of keys and the common data, and an encrypted first random number is generated using the third degenerate key. Receiving the first random number encrypted with the fourth degenerate key after being decrypted and the second random number generated in the second device;
The encrypted first random number is decrypted using the second degenerate key, and the decrypted first random number is compared with the original first random number in the memory of the second device. An authentication process that authenticates access to two or more areas at once,
Decrypting the encrypted second random number with the second degenerate key, then encrypting with the first degenerate key and transmitting to the second device;
The decrypted and then encrypted second random number is decrypted with the third degenerate key, the decrypted second random number is compared with the original second random number, and the first random number is compared. And a method for authenticating the device. An authentication device that performs an authentication process with another device having a unique identification number,
Generated using an encryption key assigned to itself, a predetermined number of keys associated with each of a plurality of areas stored in the memory of the other device, and a key associated with a common area Storage means for storing the individual data obtained
An authentication key generating means for generating an authentication key for authenticating access to a plurality of areas stored in a memory of the other device at a time from the identification number, the encryption key, and the individual data;
Communication means for transmitting information necessary for generating an authentication key generated in the other device to the other device;
An authentication apparatus comprising: encryption means for encrypting data using the authentication key and decrypting data received from the other apparatus. The plurality of areas include a first area and a second area that can be accessed by a first provider and a second provider, respectively, and a first key and a second key respectively corresponding to the first and second areas 2. The apparatus according to claim 1, further comprising: a second key, wherein the individual data generated by receiving the first key from the first provider in advance and degenerating the second key is held. 6. The authentication device according to 6. The plurality of areas include a first area and a second area that can be accessed by a first provider and a second provider, respectively, and a first key and a second key respectively corresponding to the first and second areas The individual data generated by sequentially degenerating the first key and the second key into secret data received in advance, having a second key. Authentication device. The authentication apparatus according to claim 8, wherein the other apparatus is an IC card, and the authentication apparatus reads / writes data from / to the IC card. An authentication device that performs an authentication process with another device and is assigned a unique identification number,
A plurality of keys associated with each of a plurality of divided areas, storage means for storing common data,
An authentication key for authenticating access to two or more areas out of the plurality of divided areas corresponding to one authentication key generated by the other device is stored in the storage means. Authentication key generating means for generating the authentication key by obtaining information necessary for generating from the plurality of keys from the other device, wherein the authentication key generated by the other device is the common data And generated by degenerating at least one of the plurality of keys associated with the area to be accessed among the plurality of areas,
Communication means for communicating with the other device;
Decrypting means for decrypting encrypted data transmitted from the other device using the authentication key, and for encrypting internally generated data using the authentication key An authentication device.

Images