JP2009128930A - Information processing apparatus, authentication method, program, and information processing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processing apparatus, an authentication method, a program, and an information processing system capable of limiting usage of a reader/writer function in each reader/writer function mounting device in the reader/writer function mounting device provided with a reader/writer function. <P>SOLUTION: The information processing apparatus capable of performing communication with the reader/writer function mounting device having the reader/writer function for transmitting a carrier wave includes a communication unit for performing the communication with the reader/writer function mounting device, a key information storing unit for storing a unique controller secret key and an authentication objected public key which is unique in each reader/writer function mounting device which becomes an authentication object, and a reader/writer function control unit for authenticating usage of the reader/writer function in the reader/writer function mounting device based on first authentication information to be transmitted in response to a request after requesting the authentication information relating to the reader/writer mounting device and the controller secret key and the authentication objected public key which are stored in the key information storing unit. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an information processing apparatus, an authentication method, a program, and an information processing system.

  In recent years, ICs that can communicate in a non-contact manner with a reader / writer (or an information processing apparatus having a reader / writer function) such as a non-contact IC (Integrated Circuit) card and a mobile phone equipped with a non-contact IC chip. Chip mounting devices are widespread. The reader / writer communicates with the IC chip mounting apparatus by using a magnetic field having a specific frequency such as 13.56 MHz as a carrier wave. Specifically, the reader / writer transmits a carrier wave carrying a carrier wave signal, and the IC chip included in the IC chip mounting device that receives the carrier wave by the antenna returns a response signal to the carrier wave signal received by load modulation, The reader / writer and the IC chip mounting device can communicate with each other.

  An IC chip mounting apparatus capable of non-contact communication with a reader / writer as described above includes a tamper-resistant IC chip, so that, for example, transmission / reception and update of data such as electronic money where data tampering is a problem Can be done safely. Therefore, the provision of various services using an IC chip mounting device on which a non-contact IC chip capable of non-contact communication with the reader / writer as described above is widely spread. With the spread of service provision, IC chip mounting devices such as mobile phones equipped with non-contact IC chips are becoming more widespread.

  Communication between the reader / writer and the IC chip mounting apparatus can be performed safely as described above. However, the communication between the reader / writer and the IC chip mounting device is performed, for example, when the user holds the IC chip mounting device over the reader / writer. Therefore, the IC chip mounting device enables use of electronic money stored in the IC chip by inputting a number (so-called PIN number) called PIN (Personal Identification Number), for example. Unauthorized use by a third party other than the user of the IC chip mounting device is prevented.

  Under such circumstances, for example, a technology for restricting the use of an IC chip mounting device (IC chip mounting device) by authentication has been developed. An example of a technique that eliminates the need for a PIN input by a user by separately providing an auxiliary device for user authentication is Patent Document 1. In addition, as a technique for safely setting security information in a security terminal device (IC chip mounting device) by performing authentication multiple times in the distribution process of the security terminal device (IC chip mounting device), for example, Patent Literature 2 is mentioned.

JP 2002-117378 A JP 2006-72565 A

  IC chip-mounted devices such as mobile phones have been increasingly multifunctional and highly functional year by year. For example, some IC chip-mounted devices have a reader / writer function (that is, a function of mainly transmitting a carrier wave). Some of them have a "reader / writer function"). By mounting the reader / writer function on the IC chip mounting device, for example, the user can read the information of the IC tag attached to the product in the store and know when and where the product is made. It is possible to provide various conveniences to the user.

  In addition, an IC chip mounted on an IC chip mounting device such as a mobile phone that is widely spread in the market has a predetermined range for the purpose of simplifying the system configuration of short-range wireless communication using a carrier wave, for example. A storage area is set in which information stored in accordance with commands according to the command specifications can be freely read and written. A conventional reader / writer is installed in a service providing place, and communication is performed between the reader / writer and the IC chip mounting device by the user voluntarily holding the IC chip mounting device over the reader / writer. Therefore, even if the reader / writer performs relatively free reading / writing as described above, the communication between the reader / writer and the IC chip mounting device is a user who holds the IC chip mounting device over the reader / writer. Dependent on the voluntary behavior of the, it did not become a big problem. However, when the reader / writer function is mounted on an IC chip mounting device such as a mobile phone, for example, a malicious third party can store information stored in the IC chip of another IC chip mounting device (for example, Such as information on the balance of electronic money) or malicious information such as computer virus is written on the IC chip.

  As described above, when a reader / writer function is mounted on an IC chip mounting device such as a mobile phone, the user may not only gain convenience but also be exposed to various dangers. However, the conventional technology for restricting the use of an IC chip mounting device by authentication is a technology for restricting the use of the device in a device that receives a carrier wave transmitted from a reader / writer. No consideration is given to restricting the use of the function in an apparatus having a reader / writer function. Therefore, even if the conventional technique for restricting the use of the IC chip mounting device by authentication is applied, the use of the reader / writer function that mainly transmits the carrier wave in the IC chip mounting device cannot always be restricted. Therefore, even if a conventional technique for restricting the use of an IC chip mounting device by authentication is used, it is not always possible to prevent malicious use by a malicious third party as described above.

  Accordingly, the present invention has been made in view of the above problems, and an object of the present invention is to determine the use of a reader / writer function in a reader / writer function-equipped device having a reader / writer function. It is an object of the present invention to provide a new and improved information processing apparatus, authentication method, program, and information processing system that can be restricted for each function-equipped apparatus.

  To achieve the above object, according to a first aspect of the present invention, there is provided an information processing apparatus capable of communicating with a reader / writer function-equipped device having a reader / writer function for transmitting a carrier wave, wherein the reader / writer A key for storing a communication unit that communicates with a function-equipped device, a unique controller secret key, and a unique authentication target public key for each reader / writer function-equipped device that is an authentication target for authenticating the use of the reader / writer function Authentication information is requested to the information storage unit and the reader / writer function mounting device, and the first authentication information transmitted from the reader / writer function mounting device in response to the request is stored in the key information storage unit. A reader / writer that authenticates the use of the reader / writer function in the reader / writer function-equipped device based on the stored controller secret key and the authentication target public key. The information processing apparatus is provided comprising a plate function control unit.

  The information processing apparatus can include a communication unit, a key information storage unit, and a reader / writer function control unit. The communication unit can communicate with a reader / writer function-equipped device having a reader / writer function. Here, the information processing device and the reader / writer function-equipped device can communicate with each other via, for example, a network or near field communication using a carrier wave, but are not limited thereto. The key information storage unit can store a controller secret key unique to the information processing apparatus and an authentication target public key unique to each authentication target (reader / writer function-equipped device) for authenticating the use of the reader / writer function. . The reader / writer function control unit can request authentication information that can be used to authenticate a reader / writer function-equipped device to be authenticated. Further, the reader / writer function control unit performs authentication based on the first authentication information transmitted from the authentication target in response to the request, and the controller private key and authentication target public key stored in the key information storage unit. The use of the reader / writer function in the target reader / writer function-equipped device can be authenticated for each authentication target. With this configuration, use of the reader / writer function in the reader / writer function-equipped device having the reader / writer function can be restricted for each reader / writer function-equipped device.

  Further, when the authentication result is normal, the reader / writer function control unit is equipped with the reader / writer function based on the first authentication information, the controller secret key, and the authentication target public key. Second authentication information for allowing the device to perform mutual authentication may be transmitted.

  With this configuration, for example, spoofing of the information processing apparatus by an apparatus used by a malicious person is prevented, and use of the reader / writer function in the reader / writer function-equipped device is strictly limited for each reader / writer function-equipped device. be able to.

  The key information storage unit further stores a reader / writer function common key for encrypting communication with the reader / writer function mounting device, and the reader / writer function control unit includes the reader / writer function The second authentication information may be encrypted and transmitted using a common key.

  With this configuration, use of the reader / writer function in the reader / writer function-equipped device can be more securely restricted for each reader / writer function-equipped device.

  Further, when the authentication result is normal, an authenticated information recording unit for recording authenticated device information indicating a reader / writer function-equipped device that has been successfully authenticated may be further provided.

  With this configuration, it is possible to grasp a reader / writer function-equipped device in a state where the reader / writer function can be used, that is, a reader / writer function-equipped device in which the reader / writer function is operating. Also, with this configuration, it is possible to centrally manage reader / writer function-equipped devices that can use the reader / writer function.

  A reader / writer function controller that stores authentication prohibition device information for restricting authentication for each reader / writer function-equipped device; and a reader / writer that requests the authentication information based on the authentication prohibition device information. An authentication target determination unit that determines whether the writer function-equipped device is an authentication target, and the reader / writer function control unit may request authentication information according to a determination result of the authentication target determination unit. Good.

  With such a configuration, it is possible to exclude a reader / writer function-equipped device whose use of the reader / writer function is restricted (for example, prohibited) from the authentication target and perform a negative check.

  The information processing apparatus may be a server.

  With this configuration, the use of the reader / writer function in one or more reader / writer function-equipped devices can be centrally managed for each reader / writer function-equipped device.

  The information processing apparatus may be a portable communication apparatus.

  With this configuration, the information processing apparatus can be carried.

  In order to achieve the above object, according to the second aspect of the present invention, a unique controller private key and a reader / writer function-equipped device to be authenticated for authenticating the use of the reader / writer function are unique. An authentication method in an information processing apparatus that has a key information storage unit that stores a public key to be authenticated and that can communicate with a reader / writer function-equipped device that has a reader / writer function for transmitting a carrier wave, the reader / writer function Requesting authentication information from the mounting device; receiving authentication information transmitted from the reader / writer function mounting device in response to the request in the requesting step; and receiving the authentication information in the receiving step Based on the authentication information, the controller private key and the authentication target public key stored in the key information storage unit, / Authentication method and a step of authenticating the use of the reader / writer function in the writer featured device is provided.

  By using this method, the use of the reader / writer function in the reader / writer function-equipped device having the reader / writer function can be restricted for each reader / writer function-equipped device.

  In order to achieve the above object, according to the third aspect of the present invention, a unique controller private key and a reader / writer function-equipped device to be authenticated for authenticating the use of the reader / writer function are unique. A program that can be used for an information processing device that includes a key information storage unit that stores the authentication target public key and that can communicate with a reader / writer function-equipped device that has a reader / writer function for transmitting a carrier wave, Received in the step of requesting authentication information from the reader / writer function-equipped device, the step of receiving authentication information transmitted from the reader / writer function-equipped device in response to the request in the requesting step, and the receiving step. Based on the authentication information and the controller private key and the authentication target public key stored in the key information storage unit. Program for executing the steps of authenticating the use of the reader / writer function in the reader / writer featured device to a computer is provided.

  With such a program, use of the reader / writer function in the reader / writer function-equipped device having the reader / writer function can be restricted for each reader / writer function-equipped device.

  In order to achieve the above object, according to the fourth aspect of the present invention, a reader / writer function-equipped device having a reader / writer function for transmitting a carrier wave, and communication with the reader / writer function-equipped device are possible. An information processing system including an information processing device, wherein the information processing device authenticates use of a communication unit that communicates with the reader / writer function-equipped device, a unique controller secret key, and a reader / writer function. A key information storage unit that stores a unique authentication target public key for each reader / writer function-equipped device to be authenticated, and requests authentication information from the reader / writer function-equipped device, and in response to the request, Based on the first authentication information transmitted from the reader / writer function-equipped device, and the controller secret key and the authentication target public key stored in the key information storage unit. A reader / writer function control unit that authenticates use of the reader / writer function in the reader / writer function-equipped device and transmits second authentication information according to the authentication result. A carrier transmitting unit capable of transmitting a carrier, a communication unit communicating with the information processing device, a unique reader / writer function secret key, and a storage unit storing a controller public key corresponding to the information processing device An authentication information generation unit that generates and transmits the first authentication information based on the request transmitted from the information processing apparatus, the reader / writer function secret key, and the controller public key; and transmission from the information processing apparatus And authenticating the information processing apparatus based on the second authentication information, the reader / writer function secret key and the controller public key, The information processing system comprising a function control unit for enabling the transmission of the carrier in the carrier transmitting section is provided in response.

  With this configuration, mutual authentication can be performed between the information processing device and the reader / writer function-equipped device, and the reader / writer function usage of the reader / writer function-equipped device is determined based on the result of the mutual authentication. It can be limited for each writer function-equipped device. In addition, with this configuration, for example, it is possible to prevent spoofing of an information processing apparatus by an apparatus used by a malicious person, and to strictly use the reader / writer function in each reader / writer function-equipped device. Can be limited.

  ADVANTAGE OF THE INVENTION According to this invention, use of the reader / writer function in the reader / writer function mounting apparatus provided with the reader / writer function can be restricted for each reader / writer function mounting apparatus.

  Exemplary embodiments of the present invention will be described below in detail with reference to the accompanying drawings. In the present specification and drawings, components having substantially the same functional configuration are denoted by the same reference numerals, and redundant description is omitted.

(Example of problems targeted by embodiments of the present invention)
Before describing an information processing system according to an embodiment of the present invention, first, an example of a problem targeted by an information processing system according to an embodiment of the present invention will be described.

  FIG. 1 is an explanatory diagram for explaining an example of a problem targeted by the information processing system according to the embodiment of the present invention.

[First example]
FIG. 1A is an explanatory diagram showing a case where a user receives a purchasing service using electronic money. As shown in FIG. 1A, when a user holds a mobile phone 12 equipped with an IC chip over a reader / writer 10 (a reader / writer function-equipped device) set at a service providing place such as a storefront, The user can receive a purchase service using electronic money. This is because the reader / writer 10 (device equipped with a reader / writer function) and the mobile phone 12 can perform communication using a magnetic field (hereinafter referred to as “carrier wave”) having a predetermined frequency such as 13.56 MHz, for example. It is. More specifically, the reader / writer 10 (device equipped with a reader / writer function) transmits a carrier wave carrying a carrier wave signal, and the carrier wave signal received by load modulation by the IC chip included in the mobile phone 12 that has received the carrier wave by the antenna. By returning a response signal to, the reader / writer 10 and the mobile phone 12 can communicate with each other.

  In the case of FIG. 1A, the user voluntarily holds the mobile phone 12 over the reader / writer 10 in order to receive a purchase service using electronic money. That is, in the case of FIG. 1A, the user can control whether or not to perform communication between the reader / writer 10 and the mobile phone 12, although the specific contents of the communication cannot be grasped. it can. Therefore, in the case of FIG. 1A, the possibility that an unexpected disadvantage is caused to the user of the mobile phone 12 is small.

[Second example]
FIG. 1B is an explanatory diagram showing communication using a carrier wave between a mobile phone 20 (reader / writer function-equipped device) having a reader / writer function and a mobile phone 12 having an IC chip. Even when the user of the mobile phone 12 does not hold the mobile phone 12 as shown in FIG. 1B, when receiving the carrier wave emitted from the mobile phone 20 having the reader / writer function, the mobile phone 12 Processing corresponding to the received carrier wave (for example, data reading processing or writing processing) is performed, and the mobile phone 20 is responded. Here, since the carrier wave is not visible to the user, the user of the mobile phone 12 has room to know not only the specific contents of the communication between the mobile phone 20 and the mobile phone 12 but also the fact that the communication has been performed. There is no. In other words, in the case of FIG. 1B, the user cannot grasp the specific contents of the communication, and the mobile phone 20 (reader / writer function-equipped device) having the reader / writer function and the mobile phone 12 are provided. It is also not possible to control whether or not to communicate with the.

  Therefore, in the case of FIG. 1B, when a malicious third party maliciously uses the mobile phone 20 (reader / writer function-equipped device) having a reader / writer function, for example, the IC of the mobile phone 22 It is unexpected for the user of the mobile phone 22 that information stored in the chip (for example, information on the balance of electronic money) is read without permission, or malicious information such as a computer virus is written on the IC chip. It can happen that there are disadvantages.

  In the information processing system according to the embodiment of the present invention, the case of FIG. 1B is regarded as a problem, and the use of the reader / writer function in the reader / writer function-equipped device is restricted, thereby solving the problem. The information processing system according to the embodiment of the present invention is not limited to restricting the use of the reader / writer function in the case of FIG. 1B. For example, the information processing system in the reader / writer 10 shown in FIG. It goes without saying that the use of the reader / writer function can also be restricted.

(Solution approach according to an embodiment of the present invention)
The information processing system according to the embodiment of the present invention has the information processing device for restricting the use of the reader / writer function in the reader / writer function mounting device, thereby solving the above-described problems. Here, as an approach for solving the above-described problem in the information processing system according to the embodiment of the present invention, for example, the following methods [1] to [4] may be mentioned.

[1] First Solution Approach FIG. 2 is an explanatory diagram for explaining a first solution approach in the information processing system according to the embodiment of the present invention. In FIG. 2, an information processing device for restricting the use of the reader / writer function in the reader / writer function-equipped device is shown as a reader / writer function control device, and the reader / writer function control device is used in the reader / writer function-equipped device. It shows how to control access to an IC chip included in a non-contact IC chip mounting apparatus. The reader / writer function control device and the reader / writer function mounting device in FIG. 2 can communicate, for example, by wired / wireless, and the reader / writer function mounting device and the non-contact IC chip mounting device are: For example, although communication can be performed using a carrier wave, it is not limited to the above.

  The reader / writer function control device issues an access command for accessing the non-contact IC chip mounting device to the reader / writer function mounting device (S10). The reader / writer function mounting device that has received the access command in step S10 accesses the IC chip of the non-contact IC chip mounting device in accordance with the access command. Then, communication between the reader / writer function mounting device and the non-contact IC chip mounting device is started.

  By using the first solution approach shown in FIG. 2, the reader / writer function mounting device can access the IC chip of the non-contact IC chip mounting device without an access command from the reader / writer function control device. Disappear. Therefore, since the reader / writer function control device can control the use of the reader / writer function in the reader / writer function mounting device, it is possible to solve the above-described problems.

[2] Second Solution Approach FIG. 3 is an explanatory diagram for explaining a second solution approach in the information processing system according to the embodiment of the present invention. In FIG. 3, as in FIG. 2, the information processing apparatus is shown as a reader / writer function control apparatus, and the reader / writer function control apparatus applies to the IC chip included in the non-contact IC chip mounting apparatus in the reader / writer function mounting apparatus. It shows how access is controlled. Also, the reader / writer function control device and the non-contact IC chip mounting device in FIG. 3 can communicate wirelessly using radio waves, for example. The reader / writer function-equipped device can communicate with, for example, wired / wirelessly, and the reader / writer function-equipped device and the non-contact IC chip-equipped device communicate with each other using, for example, a carrier wave. However, it is not limited to the above.

  The reader / writer function control device performs mutual authentication with the non-contact IC chip, for example, using a public key (S20). Examples of the mutual authentication method in step S20 include a method standardized in ISO (International Organization for Standardization) / IEC (International Electrotechnical Commission) 9798-3, but are not limited thereto.

  The reader / writer function control device encrypts the access command using the encryption key obtained in the authentication in step S20, and encrypts the reader / writer function mounted device for accessing the contactless IC chip mounted device. The issued access command is issued (S22). The reader / writer function mounting device that has received the access command in step S22 accesses the IC chip of the non-contact IC chip mounting device in accordance with the access command. Then, communication between the reader / writer function mounting device and the non-contact IC chip mounting device is started.

  Even when the second solution approach shown in FIG. 3 is used, as in the first solution approach shown in FIG. 2, the reader / writer function-equipped device is contactless unless there is an access command from the reader / writer function control device. It becomes impossible to access the IC chip of the IC chip mounting device. Therefore, since the reader / writer function control device can control the use of the reader / writer function in the reader / writer function mounting device, it is possible to solve the above-described problems.

[3] Third Solution Approach FIG. 4 is an explanatory diagram for explaining a third solution approach in the information processing system according to the embodiment of the present invention. In FIG. 4, as in FIG. 2, the information processing apparatus is shown as a reader / writer function control apparatus, and the reader / writer function control apparatus applies to the IC chip provided in the non-contact IC chip mounting apparatus in the reader / writer function mounting apparatus. It shows how access is controlled. Also, communication between the devices in FIG. 4 can be performed in the same manner as in FIG.

  The reader / writer function control device performs mutual authentication with the reader / writer function mounting device using, for example, a public key (S30). Further, the reader / writer function mounting device performs mutual authentication with the non-contact IC chip mounting device using, for example, a public key (S32).

  When mutual authentication is performed in step S32, the reader / writer function-equipped device transmits a processing result to the reader / writer function control device (S34).

  The reader / writer function control device that has received the processing result transmitted in step S34 encrypts the access command using the encryption key obtained in the authentication in step S30, and does not contact the reader / writer function mounting device. An encrypted access command for accessing the IC chip mounting device is issued (S34). The reader / writer function mounting device that has received the access command in step S34 accesses the IC chip of the non-contact IC chip mounting device using the encryption key obtained in the authentication in step S32 in accordance with the access command. Then, communication between the reader / writer function mounting device and the non-contact IC chip mounting device is started.

  When the third solution approach shown in FIG. 4 is used, as in the first solution approach shown in FIG. 2, the reader / writer function-equipped device is contactless unless there is an access command from the reader / writer function control device. It becomes impossible to access the IC chip of the IC chip mounting device. Therefore, since the reader / writer function control device can control the use of the reader / writer function in the reader / writer function mounting device, it is possible to solve the above-described problems.

[4] Fourth Solution Approach By using the first to third solution approaches described above, the information processing device (reader / writer function control device shown in FIGS. 2 to 4) is different from the reader / writer function mounting device. Communication with the contact IC chip mounting device can be controlled. However, for example, since communication encryption is not performed in the first solution approach, it is impossible to deny the possibility that the contents of communication leak to a third party or that data is falsified. Further, for example, mutual authentication in the second and third solution approaches uses a common key for a plurality of reader / writer function-equipped devices and a plurality of non-contact IC chip-equipped devices, so that each device is individually authenticated. Can not do it. Therefore, in the information processing system according to the embodiment of the present invention, as a fourth solution approach, by individually authenticating each reader / writer function-equipped device, the reader / writer function-equipped device has a reader / writer function-equipped device. Control usage.

  The information processing system according to the embodiment of the present invention using the fourth solution approach will be described below.

(First embodiment)
FIG. 5 is a block diagram showing the information processing system according to the first embodiment of the present invention. The information processing system according to the first embodiment includes an information processing device 100 and reader / writer function mounting devices 200, 300,..., And the information processing device 100 and reader / writer function mounting devices 200, 300,. Are communicably connected via a network 350. Here, as the network 350, for example, a wired network such as a LAN (Local Area Network) or a WAN (Wide Area Network), or a wireless network such as a WLAN (Wireless Local Area Network) using MIMO (Multiple-Input Multiple-Output). Or, the Internet (Internet) using a communication protocol such as TCP / IP (Transmission Control Protocol / Internet Protocol) may be used, but the present invention is not limited thereto. Further, the information processing apparatus 100 and the reader / writer function mounting apparatuses 200, 300,... May be connected via a base station (not shown).

[Information processing apparatus 100]
The information processing apparatus 100 includes a communication unit 102, a reader / writer function control unit 104, a key information storage unit 106, a storage unit 108, an authenticated information recording unit 110, and an authentication target determination unit 112. it can.

  The information processing apparatus 100 is configured by an MPU (Micro Processing Unit) or the like, and performs a variety of arithmetic processing using a control program or the like to control the information processing apparatus 100 as a whole. A ROM (Read Only Memory; not shown) in which control data such as a program used by (not shown) and calculation parameters are recorded, and a RAM that temporarily stores a program executed by a control unit (not shown) (Random Access Memory; not shown), an operation unit (not shown) operable by the user, a display unit (not shown), and the like may be provided. For example, the information processing apparatus 100 can connect the constituent elements with a bus as a data transmission path.

  Here, examples of the operation unit (not shown) include an operation input device such as a keyboard and a mouse, a rotary selector such as a button, a direction key, and a jog dial, or a combination thereof. Not limited. Examples of the display unit (not shown) include an LCD (Liquid Crystal Display), an organic EL display (Organic Light Emitting Diode display), and the like. However, it is not limited to the above. Note that the operation unit (not shown) and the display unit (not shown) may be an integrated unit configured by, for example, a touch screen.

  In addition, the information processing apparatus 100 may be configured such that, for example, the control unit (not shown), the authenticated information recording unit 110, and the authentication target determination unit 112 each include a separate MPU. Not limited to. For example, in the information processing apparatus 100, the control unit (not shown), the authenticated information recording unit 110, and the authentication target determination unit 112 may be an integrated unit configured by an MPU or the like. Further, for example, the information processing apparatus 100 can integrate the reader / writer function control unit 104, the authenticated information recording unit 110, and the authentication target determination unit 112 as an integrated unit.

  The communication unit 102 is a unit for communicating with the reader / writer function mounting devices 200, 300,... Via the network 350, and can have an interface corresponding to a connection form with the network 350.

  The reader / writer function control unit 104 authenticates the use of the reader / writer function included in each reader / writer function-equipped device for each reader / writer function-equipped device. More specifically, the reader / writer function control unit 104 is equipped with a reader / writer function according to the following procedures (A) to (C), for example, when there is a request for authentication from the reader / writer function-equipped device. The use of the reader / writer function provided in the apparatus is authenticated for each apparatus equipped with the reader / writer function. In the following, the reader / writer function-equipped device to be authenticated may be referred to as “authentication target”.

(A) Authentication information is requested to the authentication target (the reader / writer function-equipped device that performs authentication) (hereinafter, the authentication information required for the authentication target is referred to as “first authentication information”).
(B) Authentication is performed using the first authentication information acquired from the authentication target, the controller secret key, and the authentication target public key corresponding to the authentication target. (C) If the authentication is normal according to the authentication result, Authentication information for mutual authentication is transmitted to the authentication target (hereinafter, the authentication information transmitted to the authentication target is referred to as “second authentication information”).

  Here, the controller private key used for authentication in the above (B) is an encryption key unique to the information processing apparatus 100, and the authentication target public key is a unique encryption key for each reader / writer function mounting apparatus to be authenticated. Is the key. The reader / writer function control unit 104 uses a public key to be authenticated for each reader / writer function-equipped device to be authenticated, so that the reader / writer function-equipped device has a reader / writer function-equipped device for each reader / writer function-equipped device. Use of the writer function can be authenticated. The first authentication information, the specific example of the second authentication information, and the authentication method according to the embodiment of the present invention will be described later.

  Further, the reader / writer function control unit 104 stores various encryption key information such as a controller private key used for authentication, an authentication target public key, or a reader / writer function common key used for encryption of communication with the authentication target. The key information storage unit 106 can be provided inside. By appropriately reading and using various key information from the key information storage unit 106 provided in the reader / writer function control unit 104, leakage of key information can be prevented, for example. Needless to say, the reader / writer function control unit 104 according to the first embodiment of the present invention is not limited to the configuration including the key information storage unit 106 therein. In addition, the first information processing system further includes, for example, a key information storage device that stores key information, and the information processing device 100 can acquire the key information from the key information storage device.

  Furthermore, the reader / writer function control unit 104 can be configured by an IC chip having tamper resistance, but is not limited thereto.

[Hardware Configuration Example of Reader / Writer Function Control Unit 104]
Here, a hardware configuration example of the reader / writer function control unit 104 is shown. FIG. 6 is an explanatory diagram illustrating an example of a hardware configuration of the reader / writer function control unit 104 in the information processing apparatus 100 according to the first embodiment of the present invention.

  Referring to FIG. 6, the reader / writer function control unit 104 can include, for example, an MPU 150, a ROM 152, a RAM 154, a non-volatile memory 156, and a UART (Universal Asynchronous Receiver Transmitter) 158. The elements are connected by a chip internal bus 160. The reader / writer function control unit 104 is connected to the bus 162 of the information processing apparatus 100 via the UART 158. In FIG. 6, for example, the nonvolatile memory 156 can correspond to the key information storage unit 106, but it goes without saying that the present invention is not limited to the above.

  The MPU 150 requests the first authentication information from the authentication target via the UART 158 (makes the communication unit transmit a request). Further, the MPU 150 performs authentication using the first authentication information transmitted from the authentication target via the UART 158 and the controller secret key read from the nonvolatile memory 156 and the authentication target public key corresponding to the authentication target. be able to.

  The ROM 192 can store control data such as programs and calculation parameters used by the MPU 191, and the RAM 193 can temporarily store programs executed by the MPU 191.

  The nonvolatile memory 156 is a storage unit provided in the reader / writer function control unit 104. Nonvolatile memory 156 includes, for example, EEPROM (Electronically Erasable and Programmable Read Only Memory), flash memory (flash memory), MRAM (Magnetoresistive Random Access Memory), FeRAM (Ferroelectric Random Access Memory), PRAM (Phase change Random Access Memory). ) Etc., but is not limited to the above.

  The reader / writer function control unit 104 can realize the functions described above with a hardware configuration as shown in FIG. Needless to say, the hardware configuration of the reader / writer function control unit 104 according to the embodiment of the present invention is not limited to FIG. 3. Further, the reader / writer function control unit 104 may realize the configuration of FIG. 3 with an integrated circuit (IC).

  Further, the reader / writer function control unit 104 is not limited to a configuration in which authentication is performed when an authentication request is issued from an authentication target. For example, the reader / writer function control unit 104 is authenticated according to the determination result in the authentication target determination unit 112 described later. It is also possible to switch whether or not to perform the authentication.

  With reference to FIG. 5 again, the components of the information processing apparatus 100 will be described. The key information storage unit 106 stores various encryption key information such as a controller secret key, an authentication target public key unique to each authentication target, or a reader / writer function common key used for encryption of communication with the authentication target. be able to. In FIG. 5, the key information storage unit 106 includes a reader / writer function common key 120, a controller secret key 122, an authentication target public key A124 corresponding to the reader / writer function mounting device 200, and a reader / writer function mounting device 300. Shows an example in which authentication target public keys B126,.

  Here, the controller secret key can be generated by the reader / writer function control unit 104 and stored in the key information storage unit 106, for example, but is not limited thereto. If the authentication target public key unique to each authentication target and the reader / writer function common key used for encryption of communication with the authentication target can be securely stored in the key information storage unit 106, the storage method is Not limited.

  The storage unit 108 is a storage unit included in the information processing apparatus 100. For example, authenticated device information in which authentication target information generated by the authenticated information recording unit 110 is recorded, or an authentication target determination unit 112 is stored. Can store various types of information such as authentication-prohibited device information that can be used to determine an authentication target. 5 shows an example in which one authenticated device information 130 and one authentication prohibited device information 132 are stored in the storage unit 108. However, the present invention is not limited to the above. Information and authentication prohibition device information can be stored. Moreover, although the said control prohibition apparatus information can be produced | generated and recorded by a control part (not shown) according to the user input using an operation part (not shown), for example, it is not restricted above. For example, the authentication prohibition device information can be transmitted from an external device (not shown) and stored in the storage unit 108 via the communication unit 102.

  Examples of the storage unit 108 include a magnetic recording medium such as a hard disk, and a non-volatile memory such as an EEPROM and a flash memory, but are not limited thereto. In FIG. 5, the key information storage unit 106 and the storage unit 108 are shown as separate bodies. However, the information processing apparatus 100 according to the embodiment of the present invention includes, for example, the key information storage unit 106 and the storage unit 108. Can be provided as an integral part.

  When the reader / writer function control unit 104 normally authenticates the reader / writer function, that is, when the authentication process is completed normally, the authenticated information recording unit 110 is an authenticated device corresponding to the authentication target that has been authenticated. Record information. Here, the authenticated apparatus information can identify on the information processing apparatus 100 side whether the apparatus with the reader / writer function to be authenticated is the authentication object that has been normally authenticated to use the reader / writer function. Information. The authenticated device information includes, for example, an authentication target MAC address (Media Access Control address), but is not limited to the above, and may be information unique to each authentication target that can identify each authentication target. .

  Based on the authentication prohibition device information stored in the storage unit 108, the authentication target determination unit 112 determines whether the authentication target to be authenticated is a target to be authenticated, and the result of the determination is the reader / writer function control unit 104. To communicate. The reader / writer function control unit 104 executes an authentication process according to the determination result transmitted from the authentication target determination unit 112.

  For example, when the authentication target determination unit 112 determines that the authentication target is not a target to be authenticated, that is, when authentication prohibition device information indicating the authentication target is stored in the storage unit 108, the reader / writer function control is performed. The unit 104 does not perform authentication processing related to the use of the reader / writer function to be authenticated. Further, when the authentication target determination unit 112 determines that the authentication target is to be authenticated, that is, when the authentication prohibition device information indicating the authentication target is not stored in the storage unit 108, the reader / writer function control is performed. The unit 104 performs an authentication process related to the use of the reader / writer function to be authenticated. Therefore, the information processing apparatus 100 can flexibly control the use of the reader / writer function in the authentication target by using the authentication prohibition apparatus information.

  The information processing apparatus 100 can control the use of the reader / writer function for each reader / writer function-equipped device, for example, with the configuration shown in FIG.

[Device with reader / writer function]
Next, the reader / writer function mounting device according to the first embodiment of the present invention will be described. Hereinafter, the reader / writer function mounting device 200 will be described as an example, but the reader / writer function mounting device 300,... Can also have the same configuration, so that the reader / writer function mounting device 300,. Description is omitted. In the following description, the reader / writer function mounting apparatus 200 includes an IC chip, and the IC chip has a reader / writer function as an example. However, the reader / writer function mounting according to the embodiment of the present invention is described. The device is not limited to such a configuration. For example, the reader / writer function mounting device according to the embodiment of the present invention can also realize the reader / writer function by a unit separate from the IC chip.

  The reader / writer function mounting device 200 can include an off-chip communication unit 202 and an IC chip 204.

  The reader / writer function-equipped device 200 is configured by an MPU or the like, and a control unit (not shown) that controls the reader / writer function-equipped device 200 as a whole by performing various arithmetic processes using a control program or the like. ROM for storing control data such as programs and calculation parameters used by the control unit (not shown), RAM for temporarily storing programs executed by the control unit (not shown), and operations that can be operated by the user A unit (not shown), a display unit (not shown), an internal power source (not shown) for supplying power to each component of the reader / writer function mounting device 200, and the like may be provided. The reader / writer function-equipped device 200 can connect each component with a bus as a data transmission path, for example.

  Here, examples of the operation unit (not shown) include, but are not limited to, buttons, direction keys, rotary selectors such as a jog dial, or combinations thereof. In addition, examples of the display unit (not shown) include an LCD and an organic EL display, but are not limited thereto. Note that the operation unit (not shown) and the display unit (not shown) may be an integrated unit configured by, for example, a touch screen.

  The off-chip communication unit 202 is a unit for communicating with the information processing apparatus 100 via the network 350, and can have an interface corresponding to a connection form with the network 350.

  The IC chip 204 is obtained by realizing various parts related to short-distance wireless communication using a carrier wave of a predetermined frequency such as 13.56 MHz with an integrated circuit, and can have tamper resistance. The IC chip 204 includes various commands and data transmitted from an external device having a reader / writer function (for example, the reader / writer 10 shown in FIG. 1A, etc .; hereinafter referred to as “external device”), or a chip. Various commands such as various commands (for example, transmitted by a control unit (not shown)) received from the information processing apparatus 100 via the external communication unit 202, depending on commands from the outside of the IC chip 204, and the like. Data processing can be performed.

[IC chip 204]
The IC chip 204 can include an in-chip communication unit 206, a carrier wave transmission unit 208, an internal memory 210, an authentication information generation unit 212, and a function control unit 214.

  The IC chip 204 is configured by an MPU or the like, and controls the entire IC chip 204. Also, an in-chip control unit (not shown) that executes predetermined arithmetic processing, command generation, and the like, and an in-chip communication unit 206 A data receiving unit (not shown) for extracting (demodulating) a binarized data signal of a high level (High) and a low level (Low) from the received carrier wave, based on the carrier wave received by the in-chip communication unit 206 In-chip power supply unit (not shown) that outputs a driving voltage for driving an in-chip control unit (not shown), a clock generation unit (not shown) that generates a rectangular clock signal, and in-chip control A ROM for storing management data and programs used by a unit (not shown), a UART that serves as an interface with components outside the IC chip 204, etc. It can also be provided.

  The in-chip communication unit 206 includes a resonance circuit including a coil having a predetermined inductance as a transmission / reception antenna and a capacitor having a predetermined capacitance, and can receive a carrier wave transmitted from an external device. it can. Further, the in-chip communication unit 206 performs load modulation by providing a load modulation circuit, for example, and changes the impedance of the reader / writer function mounting device 200 viewed from the external device, thereby communicating with the external device via a carrier wave. be able to. 5 shows a configuration in which the in-chip communication unit 206 is provided in the IC chip 204, the configuration of the reader / writer function mounting device according to the first embodiment of the present invention is not limited to the above. I can't. For example, the reader / writer function-equipped device according to the first embodiment of the present invention can include a transmission / reception antenna outside the IC chip 204, or can include a transmission / reception antenna and an IC chip as an integrated package. .

  The carrier wave transmission unit 208 transmits a carrier wave carrying a carrier wave signal from a resonance circuit (transmission / reception antenna) included in the in-chip communication unit 206. The reader / writer function-equipped device 200 includes the carrier wave transmission unit 208, thereby having a reader / writer function, that is, a function of transmitting a carrier wave mainly. Here, the carrier transmission unit 208 can include, for example, a modulation circuit that performs ASK modulation (Amplitude Shift Keying) and an amplification circuit that amplifies the output of the modulation circuit, but the carrier transmission unit 208 according to the embodiment of the present invention. The configuration is not limited to the above.

  In addition, the carrier wave transmission unit 208 is controlled to transmit a carrier wave by a function control unit 214 described later. Therefore, the reader / writer function mounting device 200 can restrict the use of the reader / writer function by controlling the transmission of the carrier wave by the function control unit 214.

  The internal memory 210 is a storage unit provided in the IC chip 204 and can have tamper resistance. In the internal memory 210, for example, an application (not shown) for realizing the function of the reader / writer function mounting device 200 or a service for receiving services using an IC chip provided in the reader / writer function mounting device 200 is used. Data (service data; not shown), a code (for example, service code, system code, etc .; not shown) indicating a service to which the IC chip 204 corresponds can be stored.

  The internal memory 210 also includes a reader / writer function private key unique to the reader / writer function mounting apparatus 200, a controller public key corresponding to the information processing apparatus 100, and a reader used for encryption of communication with the information processing apparatus 100. / Various function key information such as a writer function common key can be stored. Furthermore, the internal memory 210 can also store reader / writer function mutual authentication information generated by the function control unit 214 described later. Here, in FIG. 5, an example in which the reader / writer function common key 120, the reader / writer function secret key 220, the controller public key 222, and the reader / writer function mutual authentication information 224 are stored in the internal memory 210. Show.

  Examples of the internal memory 210 include non-volatile memories such as EEPROM, flash memory, MRAM, FeRAM, and PRAM, but are not limited thereto.

[A] Example of Memory Format in Internal Memory 210 Here, an example of a memory format in the internal memory 210 is shown. FIG. 7 is an explanatory diagram showing an example of a memory format in the internal memory 210 of the reader / writer function mounting device 200 according to the first embodiment of the present invention. Here, FIG. 7 shows an example of a memory format for storing the reader / writer function common key, the reader / writer function secret key, and the controller public key.

  The internal memory 210 according to the embodiment of the present invention can store a reader / writer function common key, a reader / writer function secret key, and a controller public key, for example, in a hierarchical structure as shown in FIG. Here, “area 1000” in FIG. 7 is a management area for the reader / writer function. “Service 1008” indicates a reader / writer function secret key storage service, and “Krw” as a reader / writer function common key and “sKrw” as a reader / writer function secret key are stored. “Service 100B” indicates a controller public key storage service, and “pKcnt” is stored as a controller public key.

[B] Registration Method of “Krw”, “sKrw”, and “pKcnt” to Internal Memory 210 Next, the registration method of “Krw”, “sKrw”, and “pKcnt” to the internal memory 210 will be described. In the following, an example in which the issuing reader / writer (not shown) stores the above “Krw”, “sKrw”, and “pKcnt” in the reader / writer function mounting device 200 will be described. The configuration is not limited to this. For example, the information processing apparatus 100 can also serve as the issuing reader / writer. The communication between the issuing reader / writer and the reader / writer function-equipped device 200 can be performed, for example, by short-range wireless communication using a carrier wave. Therefore, the reader / writer function-equipped device 200 can securely store the “Krw”, “sKrw”, and “pKcnt”.

[B-1] Method for Registering Reader / Writer Function Common Key “Krw” FIG. 8 shows a method for registering a reader / writer function common key in the reader / writer function mounting device 200 according to the first embodiment of the present invention. It is explanatory drawing which shows an example.

  The issuing reader / writer transmits a service 1008 registration (Krw designation) command to the IC chip 204 included in the reader / writer function mounting device 200 (S100).

  The IC chip 204 that has received the command in step S100 creates a service 1008 in the area 1000 based on the command and writes the reader / writer function common key “Krw” (S102). Then, the IC chip 204 transmits the processing result to the issuing reader / writer (S104). Here, the processing result in step S104 is, for example, 1-bit data indicating whether or not the processing is normally completed (for example, “0” indicates processing failure and “1” indicates processing completion). Yes, but not limited to the above. If the processing result transmitted in step S104 indicates that the processing has not been completed normally, the issuing reader / writer can perform the processing from step S100 again, for example.

  In the internal memory 210 of the reader / writer function mounting device 200, for example, the reader / writer function common key “Krw” is registered by the method shown in FIG.

[B-2] Registration Method of Reader / Writer Function Secret Key “sKrw” FIG. 9 shows a method of registering a reader / writer function secret key to the reader / writer function mounting device 200 according to the first embodiment of the present invention. It is explanatory drawing which shows an example.

  For example, the issuing reader / writer performs mutual authentication with the IC chip 204 for the service 1008 registered by the method shown in FIG. 8 (S200). When mutual authentication is established in step S200, the issuing reader / writer transmits a session encryption key for encrypting the session (S202), and the IC chip 204 returns a receipt report (S204). As described above, the communication path between the issuing reader / writer and the IC chip 204 can be encrypted.

  The issuing reader / writer encrypts the communication path and transmits a command for writing the reader / writer function secret key “sKrw” (S206). The IC chip 204 that has received the command in step S206 writes the reader / writer function secret key “sKrw” based on the command (S208), and transmits the processing result in the same manner as in step S104 in FIG. S210).

  In the internal memory 210 of the reader / writer function mounting device 200, for example, the reader / writer function secret key “sKrw” is securely registered (encrypting the communication path) by the method shown in FIG.

[B-3] Controller Public Key “pKcnt” Registration Method FIG. 10 is an explanatory diagram showing an example of a controller public key registration method in the reader / writer function mounting device 200 according to the first embodiment of the present invention. is there.

  The issuing reader / writer transmits a command to write the controller public key “pKcnt” to the IC chip 204 (S300). Here, in FIG. 10, since the controller public key “pKcnt” is a public key, the communication path for transmitting the controller public key “pKcnt” is not encrypted, but the communication path may be encrypted. Needless to say.

  The IC chip 204 that has received the command in step S300 writes the controller public key “pKcnt” based on the command (S302). Then, the IC chip 204 transmits the processing result to the issuing reader / writer as in step S104 of FIG. 8 (S304).

  For example, the controller public key “pKcnt” is registered in the internal memory 210 of the reader / writer function mounting device 200 by the method shown in FIG.

  The reader / writer function mounting apparatus 200 uses, for example, the method shown in FIGS. 8 to 10 to perform the reader / writer function common key, the reader / writer function secret key, and the controller disclosure in the memory format shown in FIG. The key can be stored. Needless to say, the memory format of the internal memory 210 and the method of registering various key information in the internal memory 210 according to the first embodiment of the present invention are not limited to the above.

  The components of the reader / writer function mounting device 200 will be described with reference to FIG. 5 again. The authentication information generation unit 212 generates the first authentication information in response to the request for the first authentication information transmitted from the information processing apparatus 100, and sends the first authentication information to the information processing apparatus 100 via the off-chip communication unit 202. Send authentication information. Here, the authentication information generation unit 212 generates the first authentication information using the request for the first authentication information transmitted from the information processing apparatus 100, the reader / writer function secret key 222, and the controller public key 224. Can do. A specific example of the first authentication information will be described later.

  The function control unit 214 authenticates the information processing apparatus 100 based on the second authentication information transmitted from the information processing apparatus 100, the reader / writer function secret key 222, and the controller public key 224 (that is, performs mutual authentication). ). A specific example of the second authentication information will be described later.

  When the mutual authentication is normally completed, the function control unit 214 generates reader / writer function mutual authentication completed information for enabling the reader / writer function and records the information in the internal memory 210. Here, in the reader / writer function mutual authentication completed information, for example, in accordance with a command from the information processing apparatus 100 (for example, transmitted together with the second authentication information), certain restrictions such as an expiration date and the number of valid times. May be provided. For example, when the mutual authentication is normally performed by the function control unit 214 generating the reader / writer function mutual authentication information provided with a certain restriction, the reader / writer function mounting apparatus 200 can read the reader / writer. It is possible to prevent the function from being used without limitation, and for example, it is possible to prevent the use of a malicious reader / writer function as described in FIG. 1B.

  Further, the function control unit 214 transmits the carrier wave of the carrier wave transmission unit 208 based on the reader / writer function mutual authentication information stored in the internal memory 210, that is, the reader / writer function of the reader / writer function mounting device 200. Control the use of. Here, examples of the control in the function control unit 214 include the following (1) and (2).

(1) When the reader / writer function mutual authentication information is not stored in the internal memory 210 When the reader / writer function mutual authentication information is not stored in the internal memory 210, the function control unit 214 transmits the carrier wave Transmission of the carrier wave in the unit 208 is not permitted. Therefore, the use of the reader / writer function in the reader / writer function-equipped device 200 is limited. For example, the use of the reader / writer function having malicious intent of a malicious person as described in FIG. Can be prevented.

(2) When reader / writer function mutual authentication information is stored in the internal memory 210 When the reader / writer function mutual authentication information is stored in the internal memory 210, the function control unit 214 Read reader / writer function mutual authentication information from 210.

(2-1) When the conditions such as the expiration date / validity number are not set in the reader / writer function mutual authentication information, the expiration date / validity number, etc. are read in the reader / writer function mutual authentication information read from the internal memory 210. When the condition is not set, the function control unit 214 permits the carrier wave transmission unit 208 to transmit the carrier wave. Therefore, the user can enjoy various conveniences by using the reader / writer function.

(2-2) When the conditions such as the expiration date / validity number are set in the reader / writer function mutual authentication information, the expiration date / validity number, etc. are set in the reader / writer function mutual authentication information read from the internal memory 210. If the condition is set, the function control unit 214 determines whether the condition is satisfied. If the condition is satisfied as a result of the determination, the function control unit 214 permits the carrier wave transmission unit 208 to transmit a carrier wave. If the condition is not satisfied, the function control unit 214 causes the carrier wave transmission unit 208 to transmit the carrier wave. Do not allow transmission of carrier waves in

  For example, as shown in (1) and (2) above, the function control unit 214 controls transmission of the carrier wave of the carrier wave transmission unit 208 based on the reader / writer function mutual authentication information stored in the internal memory 210. can do.

[Hardware configuration example of IC chip 204]
Here, a hardware configuration example of the IC chip 204 is shown. FIG. 11 is an explanatory diagram showing an example of a hardware configuration of the IC chip 204 in the reader / writer function mounting device 200 according to the first embodiment of the present invention.

  Referring to FIG. 11, the IC chip 204 can include, for example, a wireless communication antenna 250, a carrier wave transmission circuit 252, an MPU 254, a ROM 256, a RAM 258, a nonvolatile memory 260, and a UART 262. The components are connected by a chip internal bus 264. The IC chip 204 is connected to the bus 266 on the reader / writer function mounting device side (outside the IC chip) via the UART 262. 11, for example, the wireless communication antenna 250 corresponds to the in-chip communication unit 206 in FIG. 5, the carrier wave transmission circuit 252 is the carrier wave transmission unit 208 in FIG. 5, and the MPU 254 is the authentication information generation unit 212 and the function control unit in FIG. 214 and the non-volatile memory 260 may correspond to the internal memory 210 of FIG.

  The request for the first authentication information transmitted from the information processing apparatus 100 and received by the off-chip communication unit 202 is transmitted to the MPU 262 via the UART 262. Further, the MPU 262 can transmit the generated first authentication information to the bus 266 via the UART 262. Accordingly, the reader / writer function-equipped device 200 can communicate with the information processing device 100 via the network 350 and perform mutual authentication.

  The ROM 256 can store control data such as programs and calculation parameters used by the MPU 254, and the RAM 258 can temporarily store programs executed by the MPU 254. Needless to say, the hardware configuration of the IC chip 204 according to the embodiment of the present invention is not limited to FIG. 11.

  The reader / writer function mounting device 200 according to the first embodiment of the present invention has a reader / writer function based on the authentication result of the information processing device 100, that is, the second authentication information, for example, with the configuration shown in FIG. The use of can be controlled.

[Authentication method]
Next, an authentication method according to the information processing system according to the first embodiment of the present invention will be described. FIG. 12 is a flowchart showing an example of the authentication method in the information processing apparatus 100 according to the first embodiment of the present invention.

  The information processing apparatus 100 determines whether or not an authentication request for use of the reader / writer function mounting apparatus, that is, the reader / writer function transmitted from the authentication target is detected (S400). If an authentication request is not detected in step S400, the process cannot proceed until it is detected.

  When an authentication request is detected in step S400, the information processing apparatus 100 determines whether or not the authentication target is an authentication prohibition apparatus in which authentication is prohibited (that is, use of the reader / writer function is prohibited). (S402). Here, the determination in step S402 can be performed based on, for example, information for specifying an authentication target included in the authentication request and authentication prohibited apparatus information. By performing the determination in step S402, the information processing apparatus 100 can exclude a reader / writer function-equipped device that is prohibited from using the reader / writer function from the authentication target, and can perform a so-called negative check. .

  If it is determined in step S402 that the authentication target is an authentication prohibition device, the information processing apparatus 100 does not perform authentication processing on the authentication target (S410). At this time, the information processing apparatus 100 may notify the authentication target that the authentication is prohibited.

  If it is determined in step S402 that the authentication target is not an authentication prohibited apparatus, the information processing apparatus 100 performs an authentication process on the authentication target (S404).

<Authentication process>
Here, an example of the authentication process in the information processing system according to the first embodiment of the present invention will be described. FIG. 13 is a sequence diagram illustrating an example of authentication processing in the information processing system according to the first embodiment of the present invention. Hereinafter, an authentication process between the information processing apparatus 100 and the reader / writer function mounting apparatus 200 will be described as an example. FIG. 13 shows an example in which the reader / writer function control unit 104 included in the information processing apparatus 100 and the IC chip 204 included in the reader / writer function mounting apparatus 200 perform processing. Description will be made assuming that the information processing apparatus 100 and the reader / writer function mounting apparatus 200 perform processing.

  The information processing apparatus 100 performs random number generation processing, generates a random number Ra (S500), and transmits it to the reader / writer function-equipped device 200 (S502). Here, the random number Ra transmitted in step S502 corresponds to the request for the first authentication information described above. Note that the information processing apparatus 100 includes, for example, a random number generation circuit and can generate a random number using the random number generation circuit, but is not limited thereto. For example, the information processing apparatus 100 can generate a random number when the reader / writer function control unit 104 executes a program for generating a random number.

  When the random number Ra is received in step S502, the reader / writer function-equipped device 200 performs a random number generation process to generate a random number Rb (S504). Note that the reader / writer function-equipped device 200 may generate random numbers by hardware or software.

  The reader / writer function-equipped device 200 combines the random number Ra received in step S502 with the random number Rb generated in step S504, and encrypts the combination result with the controller public key “pKcnt” (S506). Here, the value encrypted in step S506 can be expressed as “Enc {PKcnt (Ra | Rb)}” (hereinafter referred to as “value A”).

  The reader / writer function-equipped device 200 signs the hash value of the combination of the random number Ra received in step S502 and the random number Rb generated in step S504 with the reader / writer function secret key “sKrw”. (S508). Here, the value signed in step S508 can be expressed as “sign-rw (Ra | Rb)” (hereinafter referred to as “value B”).

  The reader / writer function-equipped device 200 combines the “value A” encrypted in step S506 and the “value B” signed in step S508, and transmits them to the information processing apparatus 100 (S510). Here, “Enc {PKcnt (Ra | Rb)} | sign-rw (Ra | Rb)” (hereinafter referred to as “value A | value B”) transmitted in step S510 is the first authentication described above. Applicable to information.

  The information processing apparatus 100 that has received “value A | value B” (first authentication information) transmitted from the reader / writer function-equipped device 200 in step S510 decrypts “value A” using the controller secret key. Then, it is confirmed that the random number Ra is included in the decrypted data (S512; first authentication process). Then, the information processing apparatus 100 calculates a hash value of the data obtained by decrypting in step S512 (S514).

  The information processing apparatus 100 decrypts “value B” using the authentication target public key corresponding to the reader / writer function mounting apparatus 200, and the obtained result is the same as the hash value calculated in step S514. (S516; second authentication processing).

  The information processing apparatus 100 can recognize that the reader / writer function-equipped device 200 is a valid apparatus that can use the reader / writer function when Steps S512 to S516 are normally performed. Note that when steps S512 to S516 are not performed normally, the information processing apparatus 100 may notify the authentication target that the authentication has failed.

  When Steps S512 to S516 are normally performed, the information processing apparatus 100 determines the order of the random number Rb generated by the reader / writer function mounting apparatus 200 in Step S504 and the random number Ra generated by the information processing apparatus 100 in Step S500. Combine. Then, the combined value is encrypted with the authentication target public key corresponding to the reader / writer function mounting device 200 (S518). Here, the value encrypted in step S512 can be expressed as “Enc {PKrw (Rb | Ra)}” (hereinafter referred to as “value C”).

  Further, the information processing apparatus 100 signs the hash value of the combination of the random number Rb and the random number Ra in order with the controller secret key (S520). Here, the value signed in step S514 can be expressed as “sign-cnt (Rb | Ra)” (hereinafter referred to as “value D”).

  The information processing apparatus 100 combines the “value C” encrypted in step S518 and the “value D” signed in step S520, and transmits them to the reader / writer function mounting apparatus 200 (S522). Here, “Enc {PKrw (Rb | Ra)} | sign-cnt (Rb | Ra)” (hereinafter referred to as “value C | value D”) transmitted in step S522 is the second authentication described above. Applicable to information.

  The reader / writer function mounting device 200 that has received the “value C | value D” (second authentication information) transmitted from the information processing apparatus 100 in step S522 uses the reader / writer function secret key “sKrw”. The value “C” is decrypted, and it is confirmed that the random number Rb is included in the decrypted data (S524; third authentication process). The reader / writer function-equipped device 200 calculates a hash value of the data obtained by decrypting in step S524 (S526).

  Further, the reader / writer function-equipped device 200 decrypts “value D” using the controller public key “pKcnt” corresponding to the information processing device 100, and the obtained result is the same as the hash value calculated in step S526. It is confirmed that there is (S528; fourth authentication processing).

  The reader / writer function-equipped device 200 can recognize that the information processing device 100 is a legitimate device that can authenticate the reader / writer function when steps S524 to S528 are normally performed. As shown in steps S524 to S528, the reader / writer function-equipped device 200 side also performs authentication on the information processing device 100 (that is, by performing mutual authentication), thereby achieving the first embodiment of the present invention. Such an information processing system can more strictly control the use of the reader / writer function in the reader / writer function mounting apparatus 200.

  When Steps S524 to S528 are normally performed, the reader / writer function mounting device 200 generates and records reader / writer function mutual authentication completed information (S530). Then, the reader / writer function-equipped device 200 transmits a completion report to the information processing device 100 (S532). Here, examples of the format of the reader / writer function mutual authentication information generated in step S530 include a flag format and a certificate format using a public encryption key, but are not limited thereto. When the reader / writer function mutual authentication completed information takes the form of a flag, for example, processing using the reader / writer function mutual authentication completed information can be performed in a short time. Further, when the reader / writer function mutual authentication completed information takes the form of a certificate, for example, processing with higher reliability can be performed.

  The information processing system according to the first embodiment of the present invention performs authentication for using the reader / writer function in the reader / writer function-equipped device for each reader / writer function-equipped device, for example, by the process shown in FIG. It can be carried out. It goes without saying that the authentication process in the information processing system according to the first embodiment of the present invention is not limited to the example shown in FIG.

<Other examples of authentication processing>
In the above description, the authentication process for using the reader / writer function in the reader / writer function-equipped device has been described. However, the authentication process according to the first embodiment of the present invention is not limited to the above. For example, the information processing system according to the first exemplary embodiment of the present invention performs mutual authentication using a public key in the same manner as the process illustrated in FIG. The use of the reader / writer function can be stopped for each reader / writer function-equipped device.

  For example, when the reader / writer function-equipped device is a device corresponding to the authentication prohibition device information, the information processing device 100 performs an authentication process for stopping the use of the reader / writer function in the reader / writer function-equipped device. be able to. In the above case, the information processing apparatus 100 can stop using the reader / writer function even if the reader / writer function of the reader / writer function-equipped device is enabled. Therefore, the information processing apparatus 100 can restrict the use of the reader / writer function in the reader / writer function-equipped device for each reader / writer function-equipped device.

  With reference to FIG. 12 again, an example of the authentication method in the information processing apparatus 100 will be described. The information processing apparatus 100 determines whether a completion report has been transmitted from the authentication target (S406). When it is determined in step S406 that the completion report has not been transmitted, that is, when the completion report is not detected, the information processing apparatus 100 performs the authentication process in step S404 again. Although not shown in FIG. 12, for example, when a completion report is not transmitted from the authentication target even after a predetermined time has elapsed since the start of the process in step S404, or when the process in step S404 is repeated a predetermined number of times. The process can also be terminated.

  If it is determined in step S406 that a completion report has been transmitted, the information processing apparatus 100 records authenticated apparatus information corresponding to the authentication target for which authentication has been performed (S408).

  The information processing apparatus 100 authenticates the use of the reader / writer function in each reader / writer function-equipped device for each reader / writer function-equipped device by using, for example, the authentication method shown in FIGS. The use of the function can be controlled.

  As described above, the information processing system according to the first embodiment of the present invention is information for authenticating the use of the reader / writer function for each apparatus in the reader / writer function-equipped apparatus having the reader / writer function. A processing apparatus 100 is included. The information processing apparatus 100 can store a controller private key unique to the information processing apparatus 100 and an authentication target public key corresponding to each reader / writer function-equipped device having a reader / writer function. Then, the information processing apparatus 100, for example, (A) requests the first authentication information from the reader / writer function mounting apparatus that performs authentication, and (B) acquires the first authentication information acquired from the reader / writer function mounting apparatus that performs authentication. Authenticates the use of the reader / writer function for each authentication / reader-equipped device by a series of processes of authenticating using the authentication information, the controller private key, and the authentication target public key corresponding to the authentication target can do. Therefore, the information processing apparatus 100 according to the first embodiment can restrict the use of the reader / writer function in the reader / writer function-equipped device having the reader / writer function for each reader / writer function-equipped device.

  In addition to the processes (A) and (B) described above, the information processing apparatus 100 further authenticates the second authentication information for mutual authentication when authentication is normal according to the authentication result (C). To the reader / writer function loading device to be performed. When the information processing apparatus 100 transmits the second authentication information to the reader / writer function mounting apparatus, the reader / writer function mounting apparatus can authenticate the information processing apparatus 100. That is, in the information processing system according to the first embodiment, mutual authentication is performed between the information processing apparatus 100 and the reader / writer function-equipped device, and the reader / writer function of the reader / writer function-equipped device is the mutual authentication. Use is limited based on the results. Therefore, the information processing apparatus 100 transmits the second authentication information for mutual authentication to the authentication / reader / writer function-equipped apparatus, for example, by the information processing apparatus 100 by an apparatus used by a malicious person. Impersonation can be prevented, and use of the reader / writer function in the reader / writer function-equipped device can be strictly limited for each reader / writer function-equipped device.

  The information processing apparatus 100 can store authenticated apparatus information corresponding to each reader / writer function-equipped apparatus that has been successfully authenticated. Therefore, the information processing apparatus 100 is based on the stored authenticated apparatus information, and the reader / writer function-equipped apparatus in which the reader / writer function is usable, that is, the reader / writer in which the reader / writer function is operating. It is possible to grasp the function-equipped device. Furthermore, since the information processing apparatus 100 can authenticate each of the plurality of reader / writer function mounting devices 200, 300,... Via the network 350, the reader / writer function mounting device that can use the reader / writer function. Can be centrally managed.

  Further, the information processing apparatus 100 can store authentication prohibited apparatus information that defines a reader / writer function-equipped apparatus for which authentication is prohibited. The information processing apparatus 100 determines whether the authentication target reader / writer function-equipped device is an authentication target by using the authentication prohibition device information, and uses the reader / writer function based on the determination result. Authentication processing can be performed. Therefore, the information processing apparatus 100 can exclude a reader / writer function-equipped device that is prohibited from using the reader / writer function from the authentication target, and can perform a so-called negative check. The information processing apparatus 100 can also perform authentication processing for stopping the reader / writer function of the authentication target reader / writer function-equipped device by using the authentication prohibition apparatus information.

  As described above, the information processing apparatus 100 has been described as a constituent element of the information processing system according to the first embodiment of the present invention. However, the first embodiment of the present invention is not limited to such a configuration, for example, It can be applied to computers such as PCs (Personal Computers) and servers (Servers).

  Moreover, although the reader / writer function mounting apparatuses 200, 300,... Have been described as the constituent elements of the information processing system according to the first embodiment of the present invention, the first embodiment of the present invention For example, a reader / writer installed at a service providing place such as a storefront, a portable communication device such as a mobile phone having a reader / writer function, an IC card having a reader / writer function, a reader / writer The present invention can be applied to computers such as PCs equipped with a writer function, automatic ticket gates for transportation facilities, security devices used for entering and entering rooms, and the like.

(Program according to the first embodiment)
For each reader / writer function-equipped device, use of the reader / writer function in the reader / writer function-equipped device having the reader / writer function is performed by a program for causing the information processing apparatus 100 according to the first embodiment to function as a computer. Can be limited.

(Second Embodiment)
In the above, as the information processing system according to the first embodiment, the information processing apparatus 100 communicates with each of the reader / writer function mounting apparatuses 200, 300,... Via the network 350, and the reader in the reader / writer function mounting apparatus. A configuration has been shown in which the use of the / writer function is restricted for each reader / writer function-equipped device. However, the information processing system according to the embodiment of the present invention is not limited to the configuration in which the information processing device and the reader / writer function-equipped device communicate via the network. Therefore, next, an information processing system according to a second embodiment in which the information processing apparatus and the reader / writer function-equipped apparatus communicate using a carrier wave will be described.

  FIG. 14 is a block diagram showing an information processing system according to the second embodiment of the present invention. Referring to FIG. 14, the information processing system according to the second embodiment includes an information processing device 400 and a reader / writer function mounting device 200. Here, the reader / writer function mounting device 200 shown in FIG. 14 can have the same configuration as the reader / writer function mounting device 200 according to the first embodiment shown in FIG.

[Information processing apparatus 400]
The information processing apparatus 400 includes a communication unit 102, a reader / writer function control unit 402, a key information storage unit 106, a storage unit 108, an authenticated information recording unit 110, and an authentication target determination unit 112. it can. Here, the information processing apparatus 400 can have basically the same configuration as the information processing apparatus 100 according to the first embodiment shown in FIG. 5, but communication means with the reader / writer function mounting apparatus 200 is provided. Different from the information processing apparatus 100. That is, the information processing apparatus 100 according to the first embodiment is configured to communicate with the reader / writer function mounting apparatus 200 via the network 350, whereas the information processing apparatus 400 uses a carrier wave. Communication with the reader / writer function mounting device 200 is performed by distance wireless communication.

  More specifically, the information processing apparatus 400 includes a reader / writer function that mainly transmits, for example, a 13.56 MHz carrier wave. For example, a reader / writer like the mobile phone 20 shown in FIG. Communicating with the reader / writer function-equipped device 200 by transmitting a carrier wave to the reader / writer function-equipped device 200 that authenticates the use of the function (for example, corresponds to the mobile phone 22 in FIG. 1B). Can do.

[First authentication pattern]
For example, the information processing apparatus 400 transmits a transmission command for transmitting an authentication request to the reader / writer function-equipped device 200, thereby causing the reader / writer function-equipped device 200 to transmit the authentication request. When an authentication request is transmitted from the reader / writer function-equipped device 200 in response to the transmission command, the information processing device 400 is similar to the information processing device 100 according to the first embodiment, for example, FIG. By using the authentication method shown in FIG. 13, the use of the reader / writer function in the reader / writer function-equipped device 200 can be restricted for each reader / writer function-equipped device. The information processing apparatus 400 can also disable the reader / writer function of the reader / writer function mounting apparatus 200 that is in an effective state, as in the information processing apparatus 100 according to the first embodiment. .

[Second authentication pattern]
In the above, a pattern in which the information processing apparatus 400 transmits a transmission command for transmitting an authentication request to the reader / writer function mounting apparatus 200 is taken as an example of the first authentication pattern. However, the authentication pattern in the information processing system according to the second embodiment of the present invention is not limited to the above. For example, the reader / writer function-equipped device 200 in a state where the reader / writer function is valid transmits an authentication request to the information processing device 400 using a carrier wave, so that the information processing device 400 and the reader / writer function-equipped device are transmitted. Communication with 200 may be initiated.

  Even in the above case, the information processing apparatus 400 uses the reader / writer function mounting apparatus 200 in the reader / writer function mounting apparatus 200 by using the authentication method shown in FIGS. Can be limited for each. In the above case, the information processing apparatus 400 can also limit the reader / writer function of the reader / writer function mounting apparatus 200 that is in an effective state to an invalid state.

  As shown by the first and second authentication patterns, the information processing apparatus 400 and the reader / writer function mounting apparatus 200 communicate by short-range wireless communication using a carrier wave, and the information processing apparatus 400 is communicated by the communication. Can restrict the use of the reader / writer function in the reader / writer function mounting apparatus 200.

  Since the information processing apparatus 400 performs short-range wireless communication using a carrier wave with the reader / writer function mounting apparatus 200, for example, the reader / writer function control unit 402 can have a communication function (that is, a reader / writer). The function control unit 402 can also serve as a communication unit.) Here, the reader / writer function control unit 402 can be realized by, for example, an IC chip having a hardware configuration as shown in FIG. 11, but is not limited thereto. Note that the information processing apparatus according to the second embodiment of the present invention is not limited to the configuration in which the reader / writer function control unit 402 has a function of performing short-range wireless communication using a carrier wave. Needless to say, it may have a function of performing short-distance wireless communication using.

  The information processing apparatus 400 can control the use of the reader / writer function for each reader / writer function-equipped device, for example, with the configuration illustrated in FIG. 14, as in the information processing apparatus 100 according to the first embodiment.

  As described above, the information processing system according to the second embodiment of the present invention provides information for authenticating the use of the reader / writer function in each reader / writer function-equipped device having the reader / writer function for each device. A processing apparatus 400 is included. The information processing apparatus 400 has basically the same configuration and functions as the information processing apparatus 100 according to the first embodiment, and communicates with the reader / writer function-equipped device by short-range wireless communication using a carrier wave. Can do. In addition, the information processing apparatus 400 is similar to the information processing apparatus 100 according to the first embodiment, for each controller private key unique to the information processing apparatus 400 and each reader / writer function-equipped device having a reader / writer function. The corresponding authentication target public key can be stored. And the information processing apparatus 400 requests | requires 1st authentication information with respect to the reader / writer function mounting apparatus which performs (A) authentication similarly to the information processing apparatus 100 which concerns on 1st Embodiment, ( B) Reader that performs authentication through a series of processes in which authentication is performed using the first authentication information acquired from the reader / writer function-equipped device that performs authentication, the controller secret key, and the authentication target public key corresponding to the authentication target. / Use of the reader / writer function can be authenticated for each device equipped with the writer function. Therefore, the information processing apparatus 400 according to the second embodiment can restrict the use of the reader / writer function in the reader / writer function-equipped device having the reader / writer function for each reader / writer function-equipped device.

  In addition to the processes (A) and (B) described above, the information processing apparatus 400, in addition to the processes (A) and (B), further (C) when authentication is normal according to the authentication result The second authentication information for mutual authentication can be transmitted to the reader / writer function-equipped device that performs authentication. When the information processing apparatus 400 transmits the second authentication information to the reader / writer function mounting apparatus, the reader / writer function mounting apparatus can authenticate the information processing apparatus 400. That is, in the information processing system according to the second embodiment, mutual authentication is performed between the information processing apparatus 400 and the reader / writer function-equipped device, as in the information processing system according to the first embodiment. The reader / writer function of the / writer function-equipped device is restricted based on the result of mutual authentication. Therefore, the information processing apparatus 400 transmits the second authentication information for mutual authentication to the reader / writer function-equipped apparatus that performs the authentication, for example, by the information processing apparatus 400 by an apparatus used by a malicious person. Impersonation can be prevented, and use of the reader / writer function in the reader / writer function-equipped device can be strictly limited for each reader / writer function-equipped device.

  Also, the information processing apparatus 400 stores authenticated apparatus information corresponding to each of the reader / writer function-equipped apparatuses that have been successfully authenticated, as in the information processing apparatus 100 according to the first embodiment. Can do. Therefore, the information processing device 400 is based on the stored authenticated device information, and the reader / writer function-equipped device in which the reader / writer function can be used, that is, the reader / writer in which the reader / writer function is operating. It is possible to grasp the function-equipped device.

  Furthermore, the information processing apparatus 400 can store authentication prohibition apparatus information that defines a reader / writer function-equipped apparatus for which authentication is prohibited, as in the information processing apparatus 100 according to the first embodiment. The information processing apparatus 400 determines whether the authentication target reader / writer function-equipped device is an authentication target by using the authentication prohibition device information, and uses the reader / writer function based on the determination result. Authentication processing can be performed. Therefore, the information processing apparatus 400 can exclude a reader / writer function-equipped device from which the use of the reader / writer function is prohibited from the authentication target. The information processing apparatus 400 can also perform authentication processing for stopping the reader / writer function of the authentication target reader / writer function-equipped device by using the authentication prohibition apparatus information.

  As described above, the information processing apparatus 400 has been described as a constituent element of the information processing system according to the second embodiment of the present invention. However, the second embodiment of the present invention is not limited to such a form, for example, The present invention can be applied to a portable communication device such as a mobile phone having a reader / writer function and a computer such as a UMPC (Ultra Mobile Personal Computer) having a reader / writer function.

(Program according to the second embodiment)
For each reader / writer function-equipped device, use of the reader / writer function in the reader / writer function-equipped device having the reader / writer function is performed by a program for causing the information processing apparatus 400 according to the second embodiment to function as a computer. Can be limited.

  As mentioned above, although preferred embodiment of this invention was described referring an accompanying drawing, it cannot be overemphasized that this invention is not limited to the example which concerns. It will be apparent to those skilled in the art that various changes and modifications can be made within the scope of the claims, and these are naturally within the technical scope of the present invention. Understood.

  For example, the public key mutual authentication as shown in FIG. 13 has been described as an example of the authentication process in the information processing system according to the embodiment of the present invention, but the authentication process according to the embodiment of the present invention is illustrated in FIG. It is not restricted to the example shown. For example, various encryption algorithms, key lengths, mutual authentication methods, and the like can be applied in the authentication process according to the information processing system according to the embodiment of the present invention.

  The configuration described above shows an example of the embodiment of the present invention, and naturally belongs to the technical scope of the present invention.

It is explanatory drawing for demonstrating an example of the problem which the information processing system which concerns on embodiment of this invention makes object. It is explanatory drawing for demonstrating the 1st solution approach in the information processing system which concerns on embodiment of this invention. It is explanatory drawing for demonstrating the 2nd solution approach in the information processing system which concerns on embodiment of this invention. It is explanatory drawing for demonstrating the 3rd solution approach in the information processing system which concerns on embodiment of this invention. 1 is a block diagram illustrating an information processing system according to a first embodiment of the present invention. It is explanatory drawing which shows an example of the hardware constitutions of the reader / writer function control part in the information processing apparatus which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the memory format in the internal memory of the reader / writer function mounting apparatus which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the registration method of the reader / writer function common key to the reader / writer function mounting apparatus which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the registration method of the reader / writer function private key to the reader / writer function mounting apparatus which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the registration method of the controller public key to the reader / writer function mounting apparatus which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the hardware constitutions of IC chip in the reader / writer function mounting apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows an example of the authentication method in the information processing system which concerns on the 1st Embodiment of this invention. It is a sequence diagram which shows an example of the authentication process in the information processing system which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the information processing system which concerns on the 2nd Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100,400 Information processing apparatus 102 Communication part 104,402 Reader / writer function control part 106 Key information storage part 108 Storage part 110 Authenticated information recording part 112 Authentication object determination part 200,300 Reader / writer function mounting apparatus 202 Off-chip communication Unit 204 IC chip 206 In-chip communication unit 208 Carrier wave transmission unit 210 Internal memory 212 Authentication information generation unit 214 Function control unit

Claims (10)

An information processing apparatus capable of communicating with a reader / writer function-equipped device having a reader / writer function for transmitting a carrier wave:
A communication unit for communicating with the reader / writer function-equipped device;
A key information storage unit for storing a unique controller secret key and a unique authentication target public key for each reader / writer function-equipped device to be authenticated for authenticating use of the reader / writer function;
Requesting authentication information to the reader / writer function mounting device, first controller information transmitted from the reader / writer function mounting device in response to the request, and the controller stored in the key information storage unit A reader / writer function control unit that authenticates use of the reader / writer function in the reader / writer function-equipped device based on a secret key and the authentication target public key;
An information processing apparatus comprising:   When the authentication result is normal, the reader / writer function control unit determines whether the reader / writer function-equipped device is based on the first authentication information, the controller secret key, and the authentication target public key. The information processing apparatus according to claim 1, wherein second authentication information for mutual authentication is transmitted. The key information storage unit further stores a reader / writer function common key for encrypting communication with the reader / writer function-equipped device;
The information processing apparatus according to claim 2, wherein the reader / writer function control unit encrypts the second authentication information and transmits the encrypted information using the reader / writer function common key. The apparatus further comprises an authenticated information recording unit that records authenticated apparatus information indicating a reader / writer function-equipped apparatus that has been successfully authenticated when the authentication result is normal. The information processing apparatus described in 1. A storage unit for storing authentication prohibition device information for limiting authentication in the reader / writer function control unit for each reader / writer function-equipped device;
An authentication target determination unit that determines whether the reader / writer function-equipped device that requests the authentication information is an authentication target based on the authentication prohibition device information;
The information processing apparatus according to claim 1, wherein the reader / writer function control unit requests authentication information according to a determination result of the authentication target determination unit.   The information processing apparatus according to claim 1, wherein the information processing apparatus is a server.   The information processing apparatus according to claim 1, wherein the information processing apparatus is a portable communication apparatus. A reader that includes a key information storage unit that stores a unique controller secret key and a unique authentication target public key for each reader / writer function-equipped device to be authenticated to authenticate use of the reader / writer function, and transmits a carrier wave / Authentication method in an information processing apparatus capable of communicating with a reader / writer function-equipped device having a writer function:
Requesting authentication information from the reader / writer function-equipped device;
Receiving authentication information transmitted from the reader / writer function-equipped device in response to the request in the requesting step;
Based on the authentication information received in the receiving step, the controller secret key and the authentication target public key stored in the key information storage unit, the reader / writer function loading device in the reader / writer function mounting device Authenticating use; and
An authentication method characterized by comprising: A reader that includes a key information storage unit that stores a unique controller secret key and a unique authentication target public key for each reader / writer function-equipped device to be authenticated to authenticate use of the reader / writer function, and transmits a carrier wave / A program that can be used for an information processing apparatus that can communicate with a reader / writer function-equipped device having a writer function:
Requesting authentication information from the reader / writer function-equipped device;
Receiving authentication information transmitted from the reader / writer function-equipped device in response to the request in the requesting step;
Based on the authentication information received in the receiving step, the controller secret key and the authentication target public key stored in the key information storage unit, the reader / writer function loading device in the reader / writer function mounting device Authenticating use;
A program that causes a computer to execute. An information processing system comprising a reader / writer function-equipped device having a reader / writer function for transmitting a carrier wave, and an information processing device capable of communicating with the reader / writer function-equipped device:
The information processing apparatus includes:
A communication unit for communicating with the reader / writer function-equipped device;
A key information storage unit for storing a unique controller secret key and a unique authentication target public key for each reader / writer function-equipped device to be authenticated for authenticating use of the reader / writer function;
Requesting authentication information to the reader / writer function mounting device, first controller information transmitted from the reader / writer function mounting device in response to the request, and the controller stored in the key information storage unit A reader / writer function control unit that authenticates use of the reader / writer function in the reader / writer function-equipped device based on a secret key and the authentication target public key, and transmits second authentication information according to an authentication result; ;
With
The reader / writer function-equipped device is:
A carrier wave transmission unit capable of transmitting a carrier wave;
A communication unit that communicates with the information processing apparatus;
A storage unit for storing a unique reader / writer function secret key and a controller public key corresponding to the information processing apparatus;
An authentication information generation unit that generates and transmits the first authentication information based on the request transmitted from the information processing apparatus, the reader / writer function secret key, and the controller public key;
The information processing device is authenticated based on the second authentication information transmitted from the information processing device, the reader / writer function secret key, and the controller public key, and a carrier wave in the carrier wave transmission unit according to an authentication result A function control unit that enables transmission of
An information processing system comprising:

Images