JP2007140778A - Password management system and password authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a password management system without the need for managing all passwords intrinsic to respective IC loaders, and a password authentication method. <P>SOLUTION: In the IC loader and a reader-writer which communicate with each other, the IC loader stores intrinsic identification information and a password, and the reader-writer stores secret information in common to the plurality of IC loaders. The reader-writer receives the identification information intrinsic to the IC loader from the IC loader, generates a password with the identification information and the secret information as the input of a password generation function, and transmits the password to the IC loader. The IC loader judges the matching of the password received from the reader-writer and the password stored in itself and performs authentication. Also, the password stored in the IC loader is an arithmetic result obtained by inputting the identification information of the IC loader and the secret information to the password generation function. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to information security technology, and more particularly to password management technology.

  One of known authentication methods is a password method. In this method, there are a method of assigning the same password to all of the parties to be authenticated and a method of assigning a unique password for each partner to be authenticated.

  As a specific example, an RFID (Radio Frequency Identification) tag defined in ISO (International Organization for Standardization) -15693, ISO-18000, or the like will be described. In this RFID tag, password authentication is performed as an access control means. In this password authentication method, a common password is managed (stored) on both the RFID tag and the reader / writer side. When a function execution request is made, the reader / writer side presents a password to the RFID tag, and the RFID tag permits execution of the requested function only when the presented password matches the password stored in the RFID tag. Further, for example, a method defined by EPCglobal Inc. (see Non-Patent Document 1 and Non-Patent Document 2) is a function 2 for invalidating an RFID tag for the purpose of read / write control and privacy protection of a memory area mounted on the RFID tag. A password is set.

In such RFID tags, there are a method of setting the same password for a plurality of RFID tags and a method of setting a unique password for each RFID tag. In the latter case, the (permitted) reader / writer stores a correspondence table with individual passwords in the memory for all RFID tags.
What has been described above is not limited to the RFID tag, and the same applies to an IC (Integrated Circuit) card or the like. Since the entity responsible for the password authentication function and the like is an IC chip, a tag, a card or the like equipped with such an IC chip is generically called an IC loader.
"NTT Technical Journal", Telecommunications Association, November 2005 EPCglobal Inc., "EPC Radio-Frequency Identity Protocols Class-1 Generation-2 UHF RFID Protocol for Communications at 860MHz-960MHz", Version 1.0.8, EPCglobal Inc., January 2005, [November 7, 2005 Search], <http://www.epcglobalinc.org/standards_technology/specifications.html>

  When a unique password is set and managed (stored) in each IC loader, an individual IC loader and a correspondence table of the password must be prepared on the reader / writer side. Considering the physical distribution site that uses IC loaders as tags (tags), for example, the number of IC loaders handled by the reader / writer is enormous, and the number of reader / writers that manage (store) the correspondence table. Many readers / writers must share a correspondence table with a huge amount of data. A simple solution in such a case is to set the same password for all IC loaders. However, it is not an effective solution in consideration of the security problem when a password is leaked and the time taken to update the password.

  Accordingly, an object of the present invention is to provide a password management system and a password authentication method that do not require management of all passwords unique to each IC loader.

In order to solve the above problems, in an IC loader and reader / writer that can communicate with each other, the IC loader stores unique identification information and a password, and the reader / writer stores secret information common to a plurality of IC loaders. . The reader / writer receives identification information unique to the IC loader from the IC loader, generates a password using the identification information and the secret information as input of a password generation function, and transmits the password to the IC loader. The IC loader performs authentication by determining whether the password received from the reader / writer matches the password stored by itself. Note that the password stored in the IC loader is the calculation result obtained by inputting the identification information of the IC loader and the secret information into the password generation function.
As described above, the reader / writer does not store and save all passwords unique to each IC loader, but stores only secret information common to a plurality of IC loaders. The reader / writer acquires identification information unique to the IC loader when necessary, generates a password unique to the IC loader, and performs password authentication.

The reader / writer stores secret information common to a plurality of IC loaders and information (request process identification information) determined for each type of process requested to the IC loader. The IC loader stores unique identification information and request process identification. You may memorize | store the password corresponding to this for every information. In this case, the IC loader receives the requested process identification information from the reader / writer and is requested to execute a process corresponding to the requested process identification information. Therefore, the IC loader transmits identification information unique to the IC loader to the reader / writer. The reader / writer receives identification information unique to the IC loader from the IC loader, generates a password using the identification information, the secret information, and the request processing identification information transmitted to the IC loader as an input of a password generation function. Is sent to the IC loader. The IC loader performs authentication by determining whether the password received from the reader / writer matches the password stored by itself. Note that the password stored in the IC loader is the calculation result obtained by inputting the identification information of the IC loader, the secret information, and the request processing identification information into the password generation function.
Thus, since a password is defined for each type of process corresponding to the requested process identification information, password authentication is performed for a specific process. Even in such a case, the information stored in the reader / writer is Only secret information and request processing identification information common to a plurality of IC loaders are required.

In an IC loader and a server that can communicate with each other via a reader / writer, the IC loader stores unique identification information and a password, and the server stores secret information common to a plurality of IC loaders. When the reader / writer receives identification information unique to the IC loader from the IC loader, the reader / writer transmits it to the server. When the server receives the identification information from the reader / writer, the server generates a password using the identification information and the secret information as an input of a password generation function, and transmits the password to the reader / writer. The reader / writer transmits the received password to the IC loader. The IC loader performs authentication by determining whether the password received from the reader / writer matches the password stored by itself. Note that the password stored in the IC loader is the calculation result obtained by inputting the identification information of the IC loader and the secret information into the password generation function.
Since the server stores the secret information in this way, the plurality of reader / writers do not need to store the secret information independently. In other words, by storing the secret information in the server, the risk of leakage of secret information due to the storage of the secret information by a plurality of reader / writers (generally, the more the secret information is stored, the more , The possibility of leakage of the secret information due to a failure or the like increases.).

In an IC loader and a server that can communicate with each other via a reader / writer, the IC loader stores unique identification information and a password, and the server stores secret information common to a plurality of IC loaders. When receiving an access from the reader / writer, the IC loader generates a random number and transmits the random number and identification information unique to the IC loader to the reader / writer. When the reader / writer receives identification information and random numbers unique to the IC loader from the IC loader, it transmits them to the server. When the server receives the identification information and the random number from the reader / writer, the server generates a password using the identification information and the secret information as an input of a password generation function, and generates a masking password using the password and the random number as an input of a masking function. Then, the server transmits this masking password to the reader / writer. The reader / writer transmits the received masking password to the IC loader. The IC loader takes out the password using the masking password received from the reader / writer and the random number as inputs of the masking inverse function. Then, the IC loader performs authentication by determining whether the extracted password matches the password stored by itself. Note that the password stored in the IC loader is the calculation result obtained by inputting the identification information of the IC loader and the secret information into the password generation function.
In this way, the server masks the password using the random number generated by the IC loader every time the reader / writer accesses, and transmits the masked password to the reader / writer. Therefore, unauthorized access (replay attack) to the IC loader by the reader / writer using the password previously received from the server is prevented.

  According to the present invention, the reader / writer or the server stores only the secret information, and generates the password unique to the IC loader from the identification information unique to the IC loader and the secret information. There is no need to manage passwords, and password authentication can be performed by comparing a password generated by a reader / writer or server with a unique password stored in the IC loader.

<IC loader>
The IC loader in the present invention is an RFID tag (2) in each embodiment. Of course, it is not intended to be limited to the RFID tag (2), and may be a mobile terminal (for example, a mobile phone, a PDA, etc.) that cannot be equipped with abundant IC cards and computation functions, and further, a high-performance with abundant computation functions It may be a performance computer.
Hereinafter, the RFID tag (2) is abbreviated as a tag (2).

  As illustrated in FIGS. 1 and 3, the tag (2) includes a power supply circuit (21), a modulation / demodulation circuit (22), a CPU (Central Processing Unit) (23), a RAM (24) and a ROM (25 ), An antenna (28) capable of communicating with the nonvolatile memory (27) and the reader / writer (3).

The antenna (28) generates an induced electromotive force when it receives an electromagnetic wave applied from an antenna (38) of a reader / writer (3) described later, and power is supplied to the power supply circuit (21). In addition, predetermined data or the like is modulated and placed on the electromagnetic wave applied from the reader / writer (3), and the modulation / demodulation circuit (22) transmits the predetermined data to the electromagnetic wave applied from the reader / writer (3). Demodulate and take out. The CPU (23) executes appropriate information processing (calculation) on the extracted data. Conversely, data obtained by the calculation of the CPU (23) is modulated by the modulation / demodulation circuit (22) and sent as electromagnetic waves from the antenna (28) to the reader / writer (3).
Hereinafter, the modem circuit (22) and the antenna (28) are collectively referred to as a communication unit (29).

  The ROM (25) of the tag (2) stores and saves a program for executing password authentication and processing requested by the reader / writer (3), data necessary for processing of this program, and the like. Further, data obtained by the processing of these programs is appropriately stored and saved in the RAM (24) and the nonvolatile memory (27).

  In the tag (2), each program stored in the ROM (25) and data necessary for processing of each program are read into the RAM (24) as necessary, and interpreted and executed by the CPU (23). The As a result, the CPU (23) realizes predetermined functions (determination unit, random number generation unit, XOR operation unit, control unit), thereby realizing password authentication and the like in the tag (2).

<Reader / Writer>
As shown in FIGS. 2 and 3, the hardware configuration of the reader / writer (3) includes a modulation / demodulation circuit (32), a CPU (33), a memory RAM (34), a ROM (35), and a one-way function. A coprocessor (36) capable of computing at high speed, a non-volatile memory (37), an antenna (38) capable of communicating with the tag (2), and a communication means capable of transmitting / receiving data to / from the server (1) described later ( 31). In the tag (2), the induced electromotive force of the antenna (28) is used as a power source. However, the reader / writer (3) is supplied with power from a power supply device (not shown).

Data obtained by the operation of the CPU (33) and the coprocessor (36) is modulated by the modulation / demodulation circuit (32) and sent as electromagnetic waves from the antenna (38) to the tag (2). On the other hand, the electromagnetic wave given from the tag (2) is loaded with predetermined data and the like, and when this is received by the antenna (38), the modem circuit (32) receives the predetermined data. Demodulated and extracted from the electromagnetic wave applied from the tag (2). The CPU (33) and the coprocessor (36) perform appropriate calculations on the extracted data.
Hereinafter, the modem circuit (32) and the antenna (38) are collectively referred to as a communication unit (39).

  The ROM (35) of the reader / writer (3) stores and saves a program for executing processing such as password authentication and data necessary for processing of this program. Further, data obtained by the processing of these programs is appropriately stored and saved in the RAM (34) and the nonvolatile memory (37).

  In the reader / writer (3), each program stored in the ROM (35) and data necessary for processing each program are read into the RAM (34) as necessary, and the CPU (34) and the coprocessor (36) are read. ) Is interpreted and executed. As a result, the CPU (34) and the coprocessor (36) realize predetermined functions (one-way function calculation unit, control unit), thereby realizing password authentication and the like in the reader / writer (3).

((First Embodiment))
First, a first embodiment of the present invention will be described with reference to FIGS.
《Password management system》
A password management system according to the first embodiment will be described with reference to FIG.
In the ROM (35) of the reader / writer (3), a tag-password correspondence table in which each tag (2) and a unique password are associated with each tag (2) is stored as in the prior art. Rather, only secret information s common to all tags (2) is stored and saved. In this specification, the secret information s is common to all the tags (2). For example, the tag (2) may be divided into a plurality of groups, and different secret information may be assigned to each group. Good.

On the other hand, in the ROM (25) of the tag (2), an ID (identification) that is identification information unique to each tag (2) and a unique password are stored in advance. For convenience, the ID of the _nth tag T _n (2) will be expressed as ID _n . Although all IDs _n are different, some of them may be the same. Here, the password is a calculation result of a one-way function (password generation function) using the identification information ID _n and the secret information s as inputs. Although the password generation function that gives the password is not limited to the one-way function, it is difficult to at least reverse the password generation function from the viewpoint of preventing unauthorized use of identification information and secret information obtained by the reverse operation. Is desirable.

The reader / writer (3) does not store and save all the passwords unique to each tag (2), but generates a password unique to the tag (2) and performs password authentication when necessary. . For this reason, the coprocessor (36) of the reader / writer (3) is assumed to be a processor capable of high-speed computation of a one-way function (password generation function) that gives a computation result that is a password. Since the secret information s common to all the tags (2) is stored and stored in the ROM (35) of the reader / writer (3), the reader / writer (3) has identification information unique to the tag T _n (2). By obtaining ID _n , a password unique to the tag T _n (2) can be generated.

In the first embodiment, the one-way function is a hash function H.
As a specific example of a password, a value ID _n ‖s [symbol _した represents a combination of a binary sequence of ID _{n and} a binary sequence of s, in which identification information ID _n and secret information s are combined in a binary sequence. ] Is the calculation result H (ID _n ‖s) of the hash function H. Of course, s‖ID _n may be input to the hash function H, or for example, t‖ID _n ‖s obtained by combining the binary sequence of the two secret information s and t with the identification information ID _n may be input. With this intent, the password is simply expressed as H (ID _n , s).

《Password authentication method》
Next, with reference to FIG. 5, the flow of the password authentication process in the password management system of the first embodiment will be sequentially described.

First, the control unit of the reader-writer (3) (340) controls the communication unit (39), the n-th tag _T n (2), initiates access of the tag _T n (2) Information (access start information) is transmitted (step S100). At this time, for example, a command identifier of a process (request process) desired to be executed by the tag T _n (2) such as a write process to the nonvolatile memory (27) may be transmitted simultaneously.
In this specification, the type of access start information and the like are not particularly limited, and may be information indicating that a transaction described below is started.

Next, the communication unit (29) of the tag T _n (2) receives the access start information transmitted in step S100 (step S101). Then, the control unit (240) of the tag T _n (2) reads the identification information ID _n from the ROM (25) triggered by the received access start information, and further controls the communication unit (29) to identify the identification information. ID _n is transmitted to the reader / writer (3) (step S102).

Next, the communication unit (39) of the reader / writer (3) receives the identification information ID _n transmitted in step S102 (step S103). Then, the control unit (340) of the reader / writer (3) stores the secret information s read from the ROM (35) and the received identification information ID _n in the RAM (34) (intermediate process; step S104).

Next, the one-way function calculation unit (341) of the reader / writer (3) reads the identification information ID _n and the secret information s stored in the RAM (34), and calculates a hash function H using these as input. The calculation result is stored in the RAM (34) (step S105). For convenience, this calculation result is expressed as H _RW (ID _n , s).

Next, the control unit (340) of the reader / writer (3) controls the communication unit (39) so that the calculation result H _RW (ID _n , s) stored in the RAM (34) is stored in the tag T _n. It transmits with respect to (2) (step S106).

Next, the communication unit (29) of the tag T _n (2) receives the calculation result H _RW (ID _n , s) transmitted in step S106 (step S107). Then, the control unit (240) of the tag T _n (2) stores the password H (ID _n , s) read from the ROM (25) and the received calculation result H _RW (ID _n , s) in the RAM (24). Store (intermediate processing; step S108).

Next, the determination unit (241) of the tag T _n (2) reads the password H (ID _n , s) and the calculation result H _RW (ID _n , s) stored in the RAM (24), and these match. It is determined whether or not to perform (step S109). If they match, the reader / writer (3) is permitted to access the tag T _n (2) (step S110). If the CPU (23) of the tag T _n (2) has also received the command identifier of the request processing in step S101, the command corresponding to this command identifier (for example, the command identifier stored and saved in the ROM (25)) -Identify by referring to the command correspondence table). If they do not match, the reader / writer (3) is not permitted to access the tag T _n (2) (step S111). For example, the reader / writer (3) is not authorized, and thus the secret information s is not stored and held, or the calculation of the predetermined hash function H is not performed.

As described above, the reader-writer (3) if obtained with merely keep storing secret information s, unique from the tag T _{n (2)} identification information ID _n, tag T _{n (2)} A unique password H (ID _n , s) can be generated and password authentication can be performed.

((Second Embodiment))
Next, a second embodiment of the present invention will be described with reference to FIGS.
The second embodiment is an extended form of the first embodiment, and is a case where a password is defined for each type of request processing from the reader / writer (3).
The same reference numerals are assigned to the same hardware configurations, functions, processes, and the like as in the first embodiment, and a duplicate description is omitted.

《Password management system》
With reference to FIG. 6, the password management system of the first embodiment will be described.
The ROM (35) of the reader / writer (3) contains secret information s common to all tags (2), request processing identification information determined for each type of request processing, and a command identifier corresponding to the request processing identification information. The associated correspondence table (350) is also stored and saved (see FIG. 7). For example, when the request process is a process for invalidating the function of the tag T _n (2), the request process identification information is a _k , and when the request process is a read process from the nonvolatile memory (27), the request process identification is performed. If the information is a _r and the request process is a write process to the nonvolatile memory (27), the request process identification information is a _w . Then, a command identifier corresponding to the request processing identification information a _k is c _k , a command identifier corresponding to the request processing identification information a _r is c _r , and a command identifier corresponding to the request processing identification information a _w is c _w . Of course, the types of request processing are not limited to these.
The request processing identification information and the command identifier are common to all the tags (2).
Further, the coprocessor (36) of the reader / writer (3) is assumed to be a processor capable of calculating a hash function H, which is a one-way function, at high speed as in the first embodiment.

On the other hand, the ROM (25) of the tag _T n (2), in advance, identification information unique ID _n in each tag _T n (2), unique password for each type of request processing, the command identifier and command and password Is stored (see FIG. 8).
As a specific example of the password unique to each type of request processing, the password for the processing for invalidating the function of the tag T _n (2) is H (ID _n ‖a _k ‖s), from the nonvolatile memory (27). The password for the read process is H (ID _n ‖ a _r ‖s), and the password for the write process to the nonvolatile memory (27) is H (ID _n ‖ a _w ‖s). The password is not limited to the same as in the first embodiment, and for this purpose, a unique password for each type of request processing is referred to as H (ID _n , a _i , s) [i = K, r, w].

《Password authentication method》
Next, with reference to FIG. 9, the flow of the password authentication process in the password management system of the second embodiment will be sequentially described.

First, the control unit (340) of the reader / writer (3) controls the communication unit (39) to start access to the tag T _n (2) for the tag T _n (2) (access). (Start information) and a command identifier for request processing are transmitted (step S100a). For example, when the request process is a process for invalidating the function of the tag T _n (2), the command identifier _ck is transmitted. In the following, in consideration of a general case, a command identifier for request processing is expressed as c _i [i = k, r, w].

Next, the communication unit (29) of the tag T _n (2) receives the access start information and the command identifier c _i transmitted in step S100a (step S101a). Then, the control unit (240) of the tag T _n (2) reads the identification information ID _n from the ROM (25) triggered by the received access start information, and further controls the communication unit (29) to identify the identification information. ID _n is transmitted to the reader / writer (3) (step S102). The control unit (240) of the tag T _n (2) stores the received command identifier c _i in the RAM (24).

Next, the communication unit (39) of the reader / writer (3) receives the identification information ID _n transmitted in step S102 (step S103). Then, the control unit of the reader-writer (3) (340), ROM read secret information s from (35), corresponding to the command identifier _{c i} obtained by referring to the correspondence table (350) request process identification information _{a i} The received identification information ID _n is stored in the RAM (34) (intermediate process; step S104a).

Next, the one-way function calculation unit (341) of the reader / writer (3) reads the identification information ID _n, secret information s, and request processing identification information a _i stored in the RAM (34), and inputs them. The calculated hash function H is calculated, and the calculation result is stored in the RAM (34) (step S105a). This calculation result is expressed as H _RW (ID _n , a _i , s).

Next, the control unit (340) of the reader / writer (3) controls the communication unit (39) to obtain the calculation result H _RW (ID _n , a _i , s) stored in the RAM (34). sending the tag _T n (2) (step S 106 a).

Next, the communication unit (29) of the tag T _n (2) receives the calculation result H _RW (ID _n , a _i , s) transmitted in step S106a (step S107a). Then, the control unit (240) of the tag T _n (2) stores the received calculation result H _RW (ID _n , a _i , s) in the RAM (24). Further, the control unit (240) of the tag T _n (2) refers to the correspondence table (250) stored in the ROM (25), and the password corresponding to the command identifier c _i stored in the RAM (24). H (ID _n , a _i , s) is stored in the RAM (24) (intermediate processing; step S108a).

Next, the determination unit (241) of the tag T _n (2) uses the password H (ID _n , a _i , s) stored in the RAM (24) and the operation result H _RW (ID _n , a _i , s). Is read and it is determined whether or not they match (step S109a). If they match, access is granted to the tag _T n interrogator (3) (2), CPU (23) of the tag _T n (2) is identified by referring to the correspondence table (250) a command identifier c _The request process is realized by executing a command corresponding to _i (step S110a). If they do not match, the reader / writer (3) is not permitted to access the tag T _n (2) (step S111).

  In the second embodiment, assuming that the communication section of the antenna (28) and the antenna (38) is not a secure communication section, a command identifier is sent from the reader / writer (3) to the tag (2) from the viewpoint of improving safety. However, the request processing identification information itself may be transmitted. In this case, the reader / writer (3) stores and saves the request processing identification information itself, not the correspondence table (350) shown in FIG. The tag (2) stores and saves a correspondence table in which the command identifier column of the correspondence table (250) shown in FIG. 8 is replaced with request processing identification information.

  By defining a password for each type of request processing, for example, when the reader / writer (3) who has only the authority to read from the nonvolatile memory (27) accesses the tag (2) as the read processing, Unauthorized acts such as executing invalidation processing of the tag function, for example, can be prevented.

((Third Embodiment))
Next, a third embodiment of the present invention will be described with reference to FIGS.
The third embodiment is a type of the first embodiment and the second embodiment, and an encryption function E _d ( _d is a common key) in a common key cryptosystem or a cipher in a public key cryptosystem as a one-way function. , E _p , E _q (p: public key, q: secret key) are used.
Here, it demonstrates as a typical form of 2nd Embodiment. The same reference numerals are assigned to the same hardware configurations, functions, processes, and the like as in the second embodiment, and a duplicate description is omitted. Note that the first embodiment substantially corresponds to the case where the request processing identification information a _i = 0 [i = k, r, w] in the second embodiment.

First, the case of using the encryption function E _d in a common key cryptosystem as a one-way function.
The reader / writer (3) stores and saves the common key d used for encryption in the ROM (35) in addition to the secret information s and the request processing identification information. In addition, the coprocessor (36) of the reader / writer (3) is assumed to be a processor that can calculate the encryption function _Ed at high speed.

Specific password that definite for each type of request processing stored in advance stored in the ROM (25) of the tag _T n (2), the tag _T n (2) is the password of the process to disable the function of _E d (ID _{n ‖a k ‖s),} reading processing of password _E d (ID _{n ‖a r ‖s} from the non-volatile memory (27)), the password of the process of writing to the non-volatile memory (27) _E d (ID _n ‖a _w ‖s). It is to be noted that the password is not limited to the same as in the second embodiment, and for this purpose, a unique password for each type of request processing is hereinafter referred to as E _d (ID _n , a _i , s) [ i = k, r, w].

In this case, in the process of step S105a, the one-way function calculation unit (341) of the reader / writer (3) performs identification information ID _n and secret information s, request processing identification information a _i stored in the RAM (34). And the encryption function E _d using these as inputs is calculated, and the calculation results E _{d, RW} (ID _n , a _i , s) are stored in the RAM (34) (step S105b).
Other processing is the same as that of the second embodiment except that the password is E _d (ID _n , a _i , s) and the calculation result is E _{d, RW} (ID _n , a _i , s). The description will be omitted (see the portion where the subscript is b in FIG. 10).

Further, the secret key s can be made secret information without using the secret information s. In this case, the password is E _d (ID _n , a _i ) [i = k, r, w].

Next, the case where the encryption functions E _p and E _q in the public key cryptosystem are used as the one-way function will be described. When using public key cryptography, there are two patterns.
[Pattern 1]
The reader / writer (3) stores the public key p used for encryption in addition to the secret information s and request processing identification information in the ROM (35). Further, it is assumed that the coprocessor (36) of the reader / writer (3) is a processor capable of calculating the encryption function _Ep at high speed.

Tag _T n (2) unique password that definite in advance for each storage conserved request processing type of the ROM (25) of the tag _T n (2) Password _E p (ID of a process of invalidating the function of the _n ‖a _k ‖s), the password for reading from the nonvolatile memory (27) is E _p (ID _{n a r} s), and the password for writing to the nonvolatile memory (27) is E _p (ID _n ‖a _w ‖s). It is to be noted that the password is not limited to the same as in the second embodiment, and for this purpose, a unique password is designated for each type of request processing E _p (ID _n , a _i , s) [ i = k, r, w].

In this case, in the process of step S105a, the one-way function calculation unit (341) of the reader / writer (3) performs identification information ID _n and secret information s, request processing identification information a _i stored in the RAM (34). And the encryption function E _p using these as inputs is calculated, and the calculation result E _{p, RW} (ID _n , a _i , s) is stored in the RAM (34) (step S105c).
The other processing is the same as that of the second embodiment except that the password is E _p (ID _n , a _i , s) and the operation result is E _{p, RW} (ID _n , a _i , s). The description will be omitted (see the portion of FIG. 11 where the subscript is c).

The secret key q is in principle secret (if it leaks to the outside, the plaintext of the operation result E _{p, RW} (ID _n , a _i , s) —for example, ID _n ‖a _i −s— is found. May be used fraudulently.) In this embodiment, since the ciphertext is not decrypted, only the secret key q may be deleted after the public key p and the secret key q are generated.
However, even such a secret key q may be exceptionally known to the (regular) reader / writer (3). In this case, the secret key q can be used as the secret information instead of the secret information s, and the password is E _p (ID _n , a _i , q) [i = k, r, w].

Furthermore, the secret information s can be made unnecessary and the public key p can be made secret information without being disclosed. In this case, the password is E _p (ID _n , a _i ) [i = k, r, w].

[Pattern 2]
The reader / writer (3) stores, in the ROM (35), the secret key q used for encryption in addition to the secret information s and the request processing identification information. In addition, the coprocessor (36) of the reader / writer (3) is assumed to be a processor that can calculate the encryption function _Eq at high speed.

Specific password that definite for each type of request processing stored in advance stored in the ROM (25) of the tag _T n (2), the tag _T password processing to disable the function of n (2) is _E q (ID _n ‖a _k ‖s), the password for the reading process from the non-volatile memory (27) is E _q (ID _n ‖a _r ‖s), and the password for the writing process to the non-volatile memory (27) is E _q (ID _n ‖a _w ‖s). It is to be noted that the password is not limited to the same as in the second embodiment, and for this purpose, a unique password for each type of request processing will be referred to as E _q (ID _n , a _i , s) [ i = k, r, w].

In this case, in the process of step S105a, the one-way function calculation unit (341) of the reader / writer (3) performs identification information ID _n and secret information s, request processing identification information a _i stored in the RAM (34). And the encryption function E _q using these as inputs is calculated, and the calculation results E _{q, RW} (ID _n , a _i , s) are stored in the RAM (34) (step S105d).
Other processing is the same as that of the second embodiment except that the password is E _q (ID _n , a _i , s) and the calculation result is E _{q, RW} (ID _n , a _i , s). The description will be omitted (see the portion where the subscript is d in FIG. 12).

It is also possible to make the secret key q secret information without using the secret information s. In this case, the password is E _q (ID _n , a _i ) [i = k, r, w]. In this case, the public key p corresponding to the secret key p is not disclosed in order to prevent plaintext from being determined from the operation result E _{q, RW} (ID _n , a _i ).

((Fourth embodiment))
Next, a fourth embodiment of the present invention will be described with reference to FIGS.
The fourth embodiment is a form for realizing password management and password authentication in which the function of the reader / writer (3) described in each of the above embodiments is assigned to a server (1) to be described later, and is a modification of the above embodiments. Here, it will be described as a modification of the first embodiment. The fourth embodiment corresponds to a case where the reader / writer (3) cannot be trusted, and the reader / writer (3) does not perform a one-way function calculation. Further, it is assumed that the tag (2) has an XOR operation function as in the method disclosed in Non-Patent Document 2. XOR represents exclusive OR. This XOR operation corresponds to the masking function and the masking inverse function.
Also, the same hardware configuration, function, processing, etc. as in the first embodiment are assigned the same reference numerals, and redundant description is omitted.

<Server>
As illustrated in FIG. 13, the server (1) includes a communication unit (13) to which a communication device (for example, a communication cable) that can communicate with the reader / writer (3) can be connected, and a CPU (14) [cache memory and the like. It may be. ] RAM (15), which is a memory, ROM (16), external storage device (17) which is a hard disk, and communication unit (13), CPU (14), RAM (15), ROM (16), external storage A bus (18) is connected so that data can be exchanged between the devices (17). If necessary, the server (1) may be provided with a device (drive) that can read and write a storage medium such as a CD-ROM.

  The external storage device (17) of the server (1) stores and saves a program for executing processing such as password authentication and data necessary for processing of this program. Further, data obtained by the processing of these programs is appropriately stored and saved in the RAM (15).

  In the server (1), each program stored in the external storage device (17) and data necessary for processing of each program are read into the RAM (15) as necessary, and interpreted and executed by the CPU (14). It is processed. As a result, the CPU (14) implements predetermined functions (one-way function calculation unit, XOR calculation unit, control unit).

《Password management system》
A password management system according to the fourth embodiment will be described with reference to FIGS.
The external storage device (17) of the server (1) stores a tag-password correspondence table in which each tag (2) and a password unique to each tag (2) are associated with each other as in the prior art. Instead, only the secret information s common to all the tags (2) is stored and saved.

The ROM (25) of the tag T _n (2) stores in advance ID _n which is identification information unique to each tag (2) and a unique password. The password is a calculation result of a one-way function (referred to as a hash function H as in the first embodiment) with the identification information ID _n and the secret information s as inputs. That is, as in the first embodiment, the password is H (ID _n , s).

The server (1) does not store and save all the passwords unique to each tag (2), but generates a password unique to the tag (2) and performs password authentication when necessary. Since the secret information s common to all the tags (2) is stored and stored in the external storage device (17) of the server (1), the server (1) has identification information unique to the tag T _n (2). By obtaining ID _n , a password unique to the tag T _n (2) can be generated.

《Password authentication method》
Next, with reference to FIGS. 16 and 17, the flow of password authentication processing in the password management system of the fourth embodiment will be sequentially described.

First, the control unit of the reader-writer (3) (340) controls the communication unit (39), the n-th tag _T n (2), initiates access of the tag _T n (2) Information (access start information) is transmitted (step S400). At this time, for example, a command identifier of a process (request process) desired to be executed by the tag T _n (2) such as a write process to the nonvolatile memory (27) may be transmitted simultaneously.

Next, the communication unit (29) of the tag T _n (2) receives the access start information transmitted in step S400 (step S401). Then, the control unit (240) of the tag T _n (2) reads the identification information ID _n from the ROM (25) triggered by the received access start information, and stores it in the RAM (24). Further, the control of the control unit of the tag _{T n (2) (240)} , random number generation unit is a pseudo-random number generator tag _T n (2) (242) is, then, this generates a random number _{r n} RAM ( 24) (step S402). Next, the control unit of the tag _T n (2) (240) controls the communication unit (29), a random number _{r n} and the identification information ID _n read from RAM (24) to the reader-writer (3) Transmit (step S403).

Next, the communication unit of the reader-writer (3) (39) receives the random number _{r n} and the identification information ID _n transmitted in step S403 (step S404). Then, the control unit of the reader-writer (3) (340) controls the communication unit (31), and transmits the random number _{r n} and the identification information ID _n received to the server (1) (step S405) .

Next, the communication unit of the server (1) (13) receives the random number _{r n} and the identification information ID _n transmitted in step S405 (step S406). Then, the server (1) control unit (140) of the stores the random number _{r n} and the identification information ID _n and the received secret information s read from the external storage device (17) to the RAM (15) (intermediate processing; Step S407).

Next, the one-way function calculation unit (141) of the server (1) reads the secret information s and the identification information ID _n stored in the RAM (15) and calculates a hash function H using these as inputs. The calculation result is stored in the RAM (15) (step S408). This calculation result is expressed as H _RW (ID _n , s).

Then, XOR operation unit of the server (1) (142), RAM is stored in (15) the _H RW _(ID n, s) and reads the random number _{r n,} by calculating these exclusive XOR The operation result [H _RW (ID _n , s)] XOR [r _n ] is stored in the RAM (15) (step S409). The calculation result [H _RW (ID _n , s)] XOR [r _n ] is the masking password. That was masked _H RW _(ID n, s) by the XOR operation between the random number _{r n.} The XOR operation here corresponds to a masking function.

Next, the control unit (140) of the server (1) controls the communication unit (13) to calculate the exclusive OR XOR stored in the RAM (15) [H _RW (ID _n , s ]] XOR [r _n ] is transmitted to the reader / writer (3) (step S410).

Next, the communication means (31) of the reader / writer (3) receives the calculation result [H _RW (ID _n , s)] XOR [r _n ] transmitted in step S410 (step S411). Then, the control unit (340) of the reader / writer (3) controls the communication unit (39) to tag the calculation result [H _RW (ID _n , s)] XOR [r _n ] received in step S411. Transmit to T _n (2) (step S412).

Next, the communication unit (29) of the tag T _n (2) receives the calculation result [H _RW (ID _n , s)] XOR [r _n ] transmitted in step S412 (step S413). Then, the control unit (240) of the tag T _n (2) reads the password H (ID _n , s) read from the ROM (25) and the received calculation result [H _RW (ID _n , s)] XOR [r _n ] Is stored in the RAM (24) (intermediate processing; step S414).

Then, XOR operation unit of the tag _T n (2) (243) reads the RAM (24) stored random number _{r n} and the calculation result to the _[H RW _(ID n, s)] XOR _{[r n],} The exclusive OR XOR is calculated, and the operation result [H _RW (ID _n , s)] XOR [r _n ] XOR [r _n ] = H _RW (ID _n , s) is stored in the RAM (24). Store (step S415). In this process, the property of exclusive OR XOR is used. That is, it obtains the calculation result by the XOR operation between the random number _{r n [H} RW _(ID n, s)] _H RW from XOR _{[r n] (ID} n, s). The XOR operation here corresponds to an inverse masking function.
Masking function and masking inverse function is thus _H RW _(ID n, s) masked, if the relationship can be extracted again _H RW _(ID n, s), but is not limited to the XOR operation. If the computing capability of the tag (2) is high, the encryption function and the decryption function can be used as the masking function and the masking inverse function.

Next, the determination unit (241) of the tag T _n (2) reads the password H (ID _n , s) and the calculation result H _RW (ID _n , s) stored in the RAM (24), and these match. It is determined whether or not to perform (step S416). If they match, the reader / writer (3) is permitted to access the tag T _n (2) (step S417). If the CPU (23) of the tag T _n (2) has also received the command identifier of the request processing in step S401, the command corresponding to this command identifier (for example, the command identifier stored and saved in the ROM (25)) -Identify by referring to the command correspondence table). If not, access to the tag T _n (2) of the reader / writer (3) is not permitted (step S418).

A random number is generated (see step S402) every time access start information is received from the reader / writer (3). In this way, the reader / writer (3) performs the same access result (H _RW (ID _n , s)) XOR [r _n ] as before (unauthorized access without intervening the server (1)). Even if the random number value is different, access to the tag T _n (2) is not permitted by the determination process in step S416 after the process in step S415. That is, it has tamper resistance against a replay attack using the previous calculation result [H _RW (ID _n , s)] XOR [r _n ].

Specifically, when the function of the tag (2) is kept valid and the memory read / write processing is temporarily entrusted to another party—for example, the entire operation of the tag (2) in the distribution field. Although the authority is in the manufacturer, in order to temporarily permit access to the reader / writer (3) of the wholesaler or retail store in order to read / write information in the distribution process, the secret information common to the tags for password calculation If this is disclosed, the reader / writer (3) can perform unauthorized access (replay attack) to the target tag. Therefore, as in the fourth embodiment, a random number is generated every time the reader / writer accesses, and the operation result H _RW (ID _n , s) is masked with the random number, thereby making the unauthorized access (replay attack). Can be prevented.

The fourth embodiment has been described as a modified embodiment of the first embodiment. Of course, a fourth embodiment as a modification of the second embodiment in which a password is defined for each type of request processing is also conceivable. In this case, the reader / writer (3) stores the command identifier, transmits the command identifier to the tag (2) in step S400, and transmits the command identifier transmitted in step S400 to the server in step S405. In step S408, it is assumed that the one-way function calculation unit (141) of the server obtains H _RW (ID _n , a _i , s) using the request processing identifier a _i corresponding to the command identifier. Alternatively, request the reader-writer (3) stores the request processing identification information _{a i,} request processing identification information to the tag (2) in step S400 _{a i} also transmitted, further transmitted in step S400 even step S405 The process identification information a _i is transmitted to the server, and in step S408, the one-way function calculation unit (141) of the server also uses the request process identifier a _i received from the reader / writer (3) to _generate H _RW (ID _n , A _i , s) may be obtained.

  The password management system and password authentication method according to the present invention are not limited to the above-described embodiments, and can be appropriately changed without departing from the spirit of the present invention. For example, the RFID may be a contact type or a non-contact type, and communication between the IC loader and the reader / writer may be wired communication instead of wireless communication. In addition, the processes described in the above embodiments may be executed not only in time series according to the order of description but also in the processing capability of the apparatus that executes the processes or in parallel or individually as required. Good. In the above embodiment, a predetermined function (for example, an XOR operation unit) is realized by executing a predetermined program. However, at least a part of these processing contents is realized by hardware. It is good.

  The present invention is useful for password management and password authentication, for example, for IC tags on the logistics market and IC cards used for human management.

The hardware structural example of a tag (2). The hardware structural example of a reader / writer (3). The schematic diagram of communication with a tag (2) and a reader / writer (3). Functional block diagram of a tag (2) and a reader / writer (3) according to the first embodiment. 6 is a process flow of password authentication according to the first embodiment. The functional block diagram of the tag (2) and reader / writer (3) concerning 2nd Embodiment. An example of a correspondence table in which command identifiers are associated with request processing information. An example of the correspondence table which matched the command identifier, the command, and the password. The processing flow of the password authentication concerning 2nd Embodiment. Processing flow of password authentication according to the third embodiment (in the case of a common key encryption function). Processing flow of password authentication according to the third embodiment (pattern 1 in the case of a public key encryption function). Processing flow of password authentication according to the third embodiment (pattern 2 in the case of a public key encryption function). The hardware structural example of a server (1). The functional block diagram of the server (1), tag (2), and reader / writer (3) concerning 4th Embodiment. The schematic diagram of communication between a server (1), a tag (2), and a reader / writer (3). Process flow (part 1) for password authentication according to the fourth embodiment. Process flow (2) of password authentication concerning 4th Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Server 13 Communication part 140 Control part 141 Unidirectional function calculating part 142 XOR calculating part 17 External storage device 2 RFID tag 240 Control part 241 Determination part 242 Random number generation part 243 XOR calculating part 25 ROM
29 Communication Unit 3 Reader / Writer 31 Communication Unit 340 Control Unit 341 Unidirectional Function Calculation Unit 35 ROM
39 Communication Department

Claims (8)

The IC loader and reader / writer can communicate with each other.
IC loader
Storage means for storing identification information and password unique to the IC loader;
Transmitting means for transmitting identification information to a reader / writer;
Receiving means for receiving a password from the reader / writer;
A determination means for determining whether or not the password stored in the storage means of the IC loader matches the password received by the reception means of the IC loader,
Reader / writer
Storage means for storing secret information common to a plurality of IC loaders;
Receiving means for receiving identification information of the IC loader from the IC loader;
Password generation means for generating a password using the identification information received by the reader / writer receiving means and the secret information stored in the reader / writer storage means as an input of a password generation function;
Transmission means for transmitting the password generated by the password generation means to the IC loader,
A password management system characterized in that the password stored in the storage means of the IC loader is a calculation result obtained by inputting the identification information of the IC loader and the secret information into the password generation function. The IC loader and the reader / writer can communicate with each other, and the IC loader can execute processing requested by the reader / writer.
IC loader
Storage means for storing identification information unique to the IC loader and password corresponding to information (request processing identification information) determined for each type of processing requested from the reader / writer;
Transmitting means for transmitting identification information to a reader / writer;
Receiving means for receiving a password or request processing identification information from a reader / writer;
A determination means for determining whether or not the password stored in the storage means of the IC loader matches the password received by the reception means of the IC loader,
Reader / writer
Storage means for storing secret information and request processing identification information common to a plurality of IC loaders;
Receiving means for receiving identification information of the IC loader from the IC loader;
Identification information received by the reader / writer receiving means, secret information stored in the storage means of the reader / writer, request processing identification information transmitted to the IC loader, and password generation means for generating a password using the password generation function as input,
A transmission means for transmitting the password generated by the password generation means or the request processing identification information to the IC loader,
The password corresponding to the request processing identification information stored in the storage means of the IC loader is a calculation result obtained by inputting the identification information of the IC loader, the secret information, and the request processing identification information into the password generation function. A password management system characterized by being. The server and the IC loader can communicate with each other via a reader / writer.
IC loader
Storage means for storing identification information and password unique to the IC loader;
Transmitting means for transmitting identification information to a reader / writer;
Receiving means for receiving a password from the reader / writer;
A determination means for determining whether or not the password stored in the storage means of the IC loader matches the password received by the reception means of the IC loader,
Reader / writer
First receiving means for receiving identification information from the IC loader;
First transmitting means for transmitting the identification information received by the first receiving means of the reader / writer to the server;
Second receiving means for receiving a password from the server;
Second transmission means for transmitting a password to the IC loader,
The server
Storage means for storing secret information common to a plurality of IC loaders;
Receiving means for receiving the identification information of the IC loader from the reader / writer;
Password generation means for generating a password using the identification information received by the server reception means and the secret information stored in the server storage means as an input of a password generation function;
Transmission means for transmitting the password generated by the password generation means to the reader / writer,
A password management system characterized in that the password stored in the storage means of the IC loader is a calculation result obtained by inputting the identification information of the IC loader and the secret information into the password generation function. The server and the IC loader can communicate with each other via a reader / writer.
IC loader
Storage means for storing identification information and password unique to the IC loader;
Random number generating means for generating a random number;
Transmitting means for transmitting the identification information stored in the storage means to the reader / writer and the random number generated by the random number generating means;
Receiving means for receiving the masking password from the reader / writer;
A masking password function received by the receiving unit of the IC loader and a random number generated by the random number generator, and a masking inverse function calculator that outputs the password as an input of the masking inverse function;
A determination means for determining whether or not the password stored in the storage means of the IC loader matches the password output by the masking inverse function calculation means of the IC loader,
Reader / writer
First receiving means for receiving identification information and a random number from an IC loader;
First transmitting means for transmitting the identification information and the random number received by the first receiving means of the reader / writer to the server;
Second receiving means for receiving a masking password from the server;
Second transmission means for transmitting a masking password to the IC loader,
The server
Storage means for storing secret information common to a plurality of IC loaders;
Receiving means for receiving identification information and random numbers of the IC loader from the reader / writer;
Password generation means for generating a password using the identification information received by the server reception means and the secret information stored in the server storage means as an input of a password generation function;
A masking function calculating means for generating a masking password using the password generated by the server password generating means and the random number received by the server receiving means as an input of the masking function;
Transmission means for transmitting the masking password generated by the masking function calculation means of the server to the reader / writer,
A password management system characterized in that the password stored in the storage means of the IC loader is a calculation result obtained by inputting the identification information of the IC loader and the secret information into the password generation function. The IC loader and reader / writer can communicate with each other.
The storage means of the IC loader stores identification information and a password unique to the IC loader,
The storage means of the reader / writer stores secret information common to a plurality of IC loaders,
An identification information transmission step in which the transmission means of the IC loader transmits identification information unique to the IC loader to the reader / writer;
An identification information receiving step in which the receiving means of the reader / writer receives the identification information of the IC loader transmitted in the identification information transmitting step;
A password generation step in which the password generation means of the reader / writer generates the password using the identification information received in the identification information reception step and the secret information stored in the storage means of the reader / writer as an input of a password generation function;
A password transmission step in which the transmission means of the reader / writer transmits the password generated in the password generation step to the IC loader;
A password receiving step in which the receiving means of the IC loader receives the password transmitted in the password transmitting step;
A password authentication method, wherein the determination unit of the IC loader includes a determination step of determining whether or not the password received in the password reception step matches the password stored in the storage unit of the IC loader. The IC loader and the reader / writer can communicate with each other, and the IC loader can execute processing requested by the reader / writer.
The storage means of the IC loader stores identification information unique to the IC loader and a password corresponding to information determined for each type of processing requested from the reader / writer (request processing identification information).
The storage means of the reader / writer stores secret information and request processing identification information common to a plurality of IC loaders,
A request processing identification information transmission step in which the transmission means of the reader / writer transmits the request processing identification information to the IC loader;
A request processing identification information receiving step in which the receiving means of the IC loader receives the request processing identification information transmitted in the request processing identification information transmitting step;
An identification information transmission step in which the transmission means of the IC loader transmits identification information unique to the IC loader to the reader / writer;
An identification information receiving step in which the receiving means of the reader / writer receives the identification information of the IC loader transmitted in the identification information transmitting step;
The password generation function of the identification information received in the identification information reception step by the reader / writer password generation means, the secret information stored in the storage means of the reader / writer, and the request processing identification information transmitted to the IC loader in the request processing identification information transmission step A password generation step for generating a password as input,
A password transmission step in which the transmission means of the reader / writer transmits the password generated in the password generation step to the IC loader;
A password receiving step in which the receiving means of the IC loader receives the password transmitted in the password transmitting step;
Determination that the determination unit of the IC loader determines whether or not the password received in the password reception step matches the password stored in the storage unit corresponding to the request processing identification information received in the request processing identification information reception step And a password authentication method. The server and the IC loader can communicate with each other via a reader / writer.
The storage means of the IC loader stores identification information and a password unique to the IC loader,
The server storage means stores secret information common to a plurality of IC loaders,
A first identification information transmission step in which the transmission means of the IC loader transmits identification information unique to the IC loader to the reader / writer;
A first identification information receiving step in which the first receiving means of the reader / writer receives the identification information of the IC loader transmitted in the first identification information transmitting step;
A second identification information transmission step in which the first transmission means of the reader / writer transmits the identification information of the IC loader received in the first identification information reception step to the server;
A second identification information receiving step in which the receiving means of the server receives the identification information of the IC loader transmitted in the second identification information transmitting step;
A password generation step in which the password generation means of the server generates a password using the identification information of the IC loader received in the second identification information reception step and the secret information stored in the storage means of the server as an input of a password generation function;
A first password transmission step in which the transmission means of the server transmits the password generated in the password generation step to the reader / writer;
A first password receiving step in which the second receiving means of the reader / writer receives the password transmitted in the first password transmitting step;
A second password transmitting step in which the second transmitting means of the reader / writer transmits the password received in the first password receiving step to the IC loader;
A second password receiving step in which the receiving means of the IC loader receives the password transmitted in the second password transmitting step;
The password authentication characterized in that the determination unit of the IC loader has a determination step of determining whether or not the password received in the second password reception step matches the password stored in the storage unit of the IC loader Method. The server and the IC loader can communicate with each other via a reader / writer.
The storage means of the IC loader stores identification information and a password unique to the IC loader,
The server storage means stores secret information common to a plurality of IC loaders,
A random number generation means for generating random numbers by the random number generation means of the IC loader;
A first identification information transmission step in which the transmission means of the IC loader transmits identification information unique to the IC loader and the random number generated in the random number generation step to the reader / writer;
A first identification information receiving step in which the first receiving means of the reader / writer receives the identification information and random number of the IC loader transmitted in the first identification information transmitting step;
A second identification information transmission step in which the first transmission means of the reader / writer transmits the identification information and random number of the IC loader received in the first identification information reception step to the server;
A second identification information receiving step in which the receiving means of the server receives the identification information and random number of the IC loader transmitted in the second identification information transmitting step;
A password generation step in which the password generation means of the server generates a password using the identification information of the IC loader received in the second identification information reception step and the secret information stored in the storage means of the server as an input of a password generation function;
A masking function calculation step in which a masking function calculation means of the server generates a masking password using the password generated in the password generation step and the random number received in the second identification information reception step as an input of the masking function;
A first password transmission step in which the transmission means of the server transmits the masking password generated in the masking function calculation step to the reader / writer;
A first password receiving step in which the second receiving means of the reader / writer receives the masking password transmitted in the first password transmitting step;
A second password transmitting step in which the second transmitting means of the reader / writer transmits the masking password received in the first password receiving step to the IC loader;
A second password receiving step in which the receiving means of the IC loader receives the masking password transmitted in the second password transmitting step;
A masking inverse function calculation means for outputting a password by using the masking password received in the second password receiving step and the random number generated in the random number generation step as an input of the masking inverse function;
A password characterized in that the determination means of the IC loader has a determination step of determining whether or not the password output in the masking inverse function calculation step matches the password stored in the storage means of the IC loader Authentication method.

Images