JP2011054014A - Equipment authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an inexpensive equipment authentication system for appropriately authenticating equipment to be connected. <P>SOLUTION: Authentication equipment includes an authentication equipment CPU, an authentication equipment controller, and an authentication equipment storage device. The authentication equipment storage device stores an encryption mark, a correct answer mark, and a manufacturer authentication key. Equipment to be authenticated includes an equipment-to-be authenticated CPU and an equipment-to-be authenticated storage device. The equipment to be authenticated storage device stores a medium ID and an encryption authentication key into a protection area. The authentication equipment decodes the encryption authentication key by the authentication equipment controller with the manufacturer authentication key and the medium ID, obtains an authentication key, uses the authentication key to decode the encryption mark, compares it with the correct answer mark, and authenticates the equipment to be authenticated. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a device authentication system that determines a device that should be allowed to be connected and a device that should not be allowed to be connected.

  A system is often configured so that other accessory devices can be connected to the main device. For example, the video playback device is configured so that a storage medium storing content such as video can be connected.

  Such connectable accessory devices are also often tampered with. For example, devices that illegally copy content and devices that operate to destroy the main device may be on the market.

  Therefore, a so-called device authentication system is required that determines an accessory device that should be connected to the main device and an accessory device that should not be connected.

  Conventionally, a special integrated circuit for authenticating a device has been created, and mutual authentication has been performed using the integrated circuit. However, producing a special integrated circuit has a problem in that the manufacturing cost increases.

  In this regard, common information is distributed to users in advance, random information encrypted with this common information is transmitted to the connected device, and the connected device is connected based on the characteristics of how the random information data is decrypted. There has been proposed a method for authenticating a device (for example, Patent Document 1).

JP 2003-198544 A

  However, depending on the technique described in Patent Document 1, there is a problem that not only the management of common information is troublesome for the user, but also the situation in which the entire connected device itself is illegally copied cannot be dealt with.

  An object of the present invention is to provide an inexpensive device authentication system capable of accurately authenticating a connected device.

  The present invention includes an authentication target device CPU that is an arithmetic device and a storage medium that stores data, and an encrypted authentication key that is encrypted and predetermined data is stored in an area where access restrictions on the storage medium are provided. When an authentication target device having an authentication target device storage device stored in a certain protection area, an encryption codebook that is data to be decrypted in advance, and an encryption codebook decrypted with a regular authentication key An authentication device storage device for storing the correct answer book, which is data obtained from the authentication device, an authentication device controller that reads the encrypted authentication key from the authentication target device storage device and obtains the authentication key by decryption, and an encryption by the authentication key An authentication device comprising: an authentication device CPU that permits a cooperative operation with a device to be authenticated when the decoded codebook obtained by decoding the codebook matches the correct codebook To provide a proof system.

  According to the present invention, if content is protected and stored in a device to be authenticated, both authentication processing and content protection recording can be realized by a method utilizing a protection area. Therefore, there is an effect that it is possible to provide an inexpensive device authentication system capable of accurately authenticating an authentication device without the need to create new hardware.

It is a schematic diagram which shows the structure of the apparatus authentication system of 1st Embodiment. It is a flowchart which shows operation | movement of the apparatus authentication system of 1st Embodiment. It is a figure which shows the modification of 1st Embodiment. It is a schematic diagram which shows the structure of the apparatus authentication system of 2nd Embodiment. It is a flowchart which shows operation | movement of the apparatus authentication system of 2nd Embodiment. It is a continuation of the flowchart which shows operation | movement of the apparatus authentication system of 2nd Embodiment. It is a figure which shows the modification of 2nd Embodiment. It is a schematic diagram which shows the structure of the apparatus authentication system of 3rd Embodiment. It is a flowchart which shows operation | movement of the apparatus authentication system of 3rd Embodiment. It is a continuation of the flowchart which shows operation | movement of the apparatus authentication system of 3rd Embodiment. It is a flowchart which shows operation | movement of the apparatus authentication system of 4th Embodiment. It is a continuation of the flowchart which shows operation | movement of the apparatus authentication system of 4th Embodiment.

  Hereinafter, a device authentication system according to an embodiment of the present invention will be described in detail with reference to the drawings.

(First embodiment)
FIG. 1 is a schematic diagram illustrating a configuration of a device authentication system according to the first embodiment. As illustrated in FIG. 1, the device authentication system includes an authentication device 10 that is a device that authenticates a device to be connected and an authentication target device 20 that is a device to be authenticated.

  The authentication device 10 includes an authentication device storage device 13 that is a storage device, an authentication device controller 12 that has a function of decrypting encrypted data using an authentication key that is predetermined data, and an authentication device CPU 11 that performs arithmetic processing. And comprising.

  The authentication device controller 12 has a function of reading data stored from the authentication target device storage device 23 that is a storage device of the connected authentication target device 20.

  The authentication device storage device 13 provides a memory area necessary for the authentication device CPU 11 and the authentication device controller 12 to operate, and authenticates the encryption codebook, which is data for the decryption test, and the encryption codebook. A correct answer book, which is data obtained when decrypted with a key, and a manufacturer authentication key, which is data for predetermined encryption, are stored.

  The authentication target device 20 includes an authentication target device storage device 23 and an authentication target device CPU 21 that is an arithmetic device.

  The authentication target device storage device 23 provides a memory area necessary for the authentication target device CPU 21 to operate. The authentication target device storage device 23 is encrypted in the protected area 23A, which is an area where access restriction is provided, with a medium ID 23I that is an ID unique to the authentication target device storage device 23, the medium ID 23I, and the manufacturer authentication key. And an encrypted authentication key 23K, which is an authentication key.

  FIG. 2 is a flowchart illustrating the operation of the device authentication system according to the first embodiment. As shown in FIG. 2, in step 201, the authentication device 10 reads the encrypted authentication key 23 </ b> K stored in the authentication target device storage device 23 by the authentication device controller 12. That is, a read command is transmitted from the authentication device controller 12 to the authentication target device 20.

  In step 202, the authentication target device 20 transmits the encrypted authentication key 23K to the authentication device 10. At this time, the medium ID 23I is also transmitted to the authentication device 10 at the same time.

  In step 203, the authentication device 10 uses the authentication device controller 12 to decrypt the encrypted authentication key 23K with the manufacturer authentication key and the medium ID 23I to obtain an authentication key.

  Here, since the medium ID 23I is unique to the medium and has access restrictions, even if the entire authentication target device 20 is copied or the entire authentication target device storage device 23 is copied, it cannot be copied. Therefore, the encrypted authentication key 23K illegally copied is not correctly decrypted.

  In step 204, the authentication device 10 uses the authentication device CPU 11 to decrypt the encrypted code book stored in the authentication device storage device 13 using the authentication key to obtain a decrypted code book.

  In step 205, the authentication device 10 reads the correct answer book from the authentication device storage device 13.

  In step 206, the authentication device 10 determines whether the decrypted codebook and the correct codebook match. If the decryption codebook and the correct codebook do not match, the authentication device 10 determines that the authentication has failed, and proceeds to step 209, and if the decryption codebook and the correct codebook match, the authentication is successful. And proceed to step 207.

  In step 207, the authentication device 10 transmits various commands from the authentication device CPU 11 to the authentication target device CPU 21. In step 208, the authentication target device 20 receives the command from the authentication device 10, and thereafter authenticates with the authentication device 10. The target device 20 operates in cooperation.

  In step 209, the authentication device 10 does not accept access from the authentication target device CPU 21 by the authentication device CPU 11.

  FIG. 3 is a diagram illustrating a modification of the first embodiment. As shown in FIG. 3, in the present embodiment, the authentication device 10 can be configured to further include authentication device CPU protection means 14.

  The authentication device CPU protection means 14 may be configured by hardware, realized by software, or configured by hardware and software. For example, the authentication device CPU protection unit 14 may handle a program that operates in the authentication device CPU 11 in an encrypted state until just before execution, and safely decrypts a necessary minimum part at the time of execution to advance the process.

  The authentication device CPU protection means 14 is provided to safely protect the decryption of the encrypted authentication key 23K and the verification process of the decryption code and the correct codebook.

  As described above, in the device authentication system of the present embodiment, the authentication device 10 includes the authentication device CPU 11, the authentication device controller 12, and the authentication device storage device 13, and the authentication device storage device 13 is encrypted. The authentication target device 20 includes an authentication target device CPU 21 and an authentication target device storage device 23, and the authentication target device storage device 23 has a medium ID 23I in the protection area 23A. And the encrypted authentication key 23K. The authentication device 10 uses the authentication device controller 12 to decrypt the encrypted authentication key 23K using the manufacturer authentication key and the medium ID 23I to obtain an authentication key, and decrypts the encrypted code using the authentication key and compares it with the correct code By doing so, device authentication of the device to be authenticated is performed.

  Therefore, there is an effect that it is possible to provide an inexpensive device authentication system capable of accurately authenticating an authentication device without the need to create new hardware.

(Second Embodiment)
FIG. 4 is a schematic diagram illustrating the configuration of the device authentication system according to the second embodiment. As illustrated in FIG. 4, the device authentication system includes an authentication device 10 that is a device that authenticates a connected device, and an authentication target device 20 that is a device to be authenticated.

  The authentication device 10 includes an authentication device storage device 13 that is a storage device, an authentication device controller 12 that has a function of decrypting encrypted data using an authentication key that is predetermined data, and an authentication device CPU 11 that performs arithmetic processing. And comprising.

  The authentication device controller 12 has a function of reading data stored from the authentication target device storage device 23 that is a storage device of the connected authentication target device 20.

  The authentication device storage device 13 provides a memory area necessary for the authentication device CPU 11 and the authentication device controller 12 to operate, and authenticates the encryption codebook, which is data for the decryption test, and the encryption codebook. A correct answer book, which is data obtained when decrypted with a key, and a manufacturer authentication key, which is data for predetermined encryption, are stored.

  The authentication device storage device 13 has an authentication device ID 13I, which is an ID unique to the authentication device storage device 13, and an authentication device ID 13I and a predetermined encryption in the protected area 13A, which is an area with access restrictions. The authentication device encryption authentication key 13K, which is an authentication key encrypted with the authentication device manufacturer authentication key that is the data of the authentication device, is stored.

  The authentication target device 20 includes an authentication target device storage device 23, an authentication target device CPU 21 that is an arithmetic device, and an authentication target device controller 22 that has a function of decrypting encrypted data using an authentication key.

  The authentication target device controller 22 has a function of reading data stored from the authentication device storage device 13 which is a storage device of the connected authentication device 10.

  The authentication target device storage device 23 provides a memory area required for the authentication target device CPU 21 and the authentication target device controller 22 to operate. The authentication target device storage device 23 is encrypted in the protected area 23A, which is an area where access restriction is provided, with a medium ID 23I that is an ID unique to the authentication target device storage device 23, and the medium ID and the manufacturer authentication key. And an encrypted authentication key 23K, which is an authentication key.

  The authentication target device storage device 23 includes an authentication device encryption codebook that is data for a decryption test, and an authentication device correct codebook that is data obtained when the authentication device encryption codebook is decrypted with a regular authentication key. The authentication device manufacturer authentication key is stored.

  FIG. 5 is a flowchart illustrating the operation of the device authentication system according to the second embodiment. As shown in FIG. 5, in step 501, the authentication device 10 reads the encrypted authentication key 23 </ b> K stored in the authentication target device storage device 23 by the authentication device controller 12. That is, a read command is transmitted from the authentication device controller 12 to the authentication target device 20.

  In step 502, the authentication target device 20 transmits the encrypted authentication key 23K to the authentication device 10. At this time, the medium ID 23I is also transmitted to the authentication device 10 at the same time.

  In step 503, the authentication device 10 uses the authentication device controller 12 to decrypt the encrypted authentication key 23K using the manufacturer authentication key and the medium ID 23I to obtain an authentication key.

  Here, since the medium ID 23I is unique to the medium and has access restrictions, even if the entire authentication target device 20 is copied or the entire authentication target device storage device 23 is copied, it cannot be copied. Therefore, the encrypted authentication key 23K illegally copied is not correctly decrypted.

  In step 504, the authentication device 10 uses the authentication device CPU 11 to decrypt the encryption code book stored in the authentication device storage device 13 using the authentication key to obtain a decryption code book.

  In step 505, the authentication device 10 reads the correct answer book from the authentication device storage device 13.

  In step 506, the authentication device 10 determines whether the decrypted codebook and the correct codebook match. If the decryption code and the correct codebook do not match, the authentication device 10 determines that the authentication has failed, and proceeds to step 509. If the decryption code and the correct codebook match, the authentication is successful. And proceed to step 507.

  In step 507, the authentication device 10 transmits an authentication command for authenticating the authentication device from the authentication device CPU 11 to the authentication target device CPU. In step 508, the authentication target device 20 receives the authentication command from the authentication device 10. .

  In step 209, the authentication device 10 does not accept access from the authentication target device CPU by the authentication device CPU 11.

  FIG. 6 is a continuation of the flowchart showing the operation of the device authentication system of the second embodiment. As shown in FIG. 6, in step 601, the authentication target device 20 reads the authentication device encryption authentication key 13K stored in the authentication device storage device 13 by the authentication target device controller 22. That is, a read command is transmitted from the authentication target device controller 22 to the authentication device 10.

  In step 602, the authentication device 10 transmits the authentication device encryption authentication key 13 </ b> K to the authentication target device 20. At this time, the authentication device ID 13I is also transmitted to the authentication target device 20 at the same time.

  In step 603, the authentication target device 20 uses the authentication target device controller 22 to decrypt the authentication device encrypted authentication key 13K using the authentication device manufacturer authentication key and the authentication device ID 13I to obtain an authentication device authentication key.

  Here, the authentication device ID 13I is unique to the authentication device and has access restrictions. Therefore, even if the authentication device 10 is copied in its entirety or the authentication device storage device 13 is copied in its entirety, it cannot be copied. Therefore, the authentication device encryption authentication key 13K illegally copied is not correctly decrypted.

  In step 604, the authentication target device 20 causes the authentication target device CPU 21 to decrypt the authentication device encryption code stored in the authentication target device storage device 23 using the authentication device authentication key, and to generate the authentication device decryption code. obtain.

  In step 605, the authentication target device 20 reads the authentication device correct answer book from the authentication target device storage device 23.

  In step 606, the authentication target device 20 determines whether the authentication device decoding codebook and the authentication device correct codebook match. If the authentication device decryption code and the authentication device correct codebook do not match, the authentication target device 20 determines that the authentication has failed, and proceeds to step 609, where the authentication device decryption code, the authentication device correct codebook, If they match, it is determined that the authentication is successful, and the process proceeds to step 607.

  In step 607, the authentication device 20 receives various instructions from the authentication target device CPU 21 to the authentication device CPU 11, and in step 608, the authentication device 10 receives the command from the authentication target device 20, and thereafter authenticates with the authentication device 10. The target device 20 operates in cooperation.

  In step 609, the authentication target device 20 does not accept access from the authentication device CPU 11 by the authentication target device CPU 21.

  FIG. 7 is a diagram illustrating a modification of the second embodiment. As shown in FIG. 7, in this embodiment, the authentication device 10 may further include an authentication device CPU protection unit 14, and the authentication target device 20 may further include an authentication target device CPU protection unit 24.

  The authentication device CPU protection unit 14 and the authentication target device CPU protection unit 24 may be configured by hardware, realized by software, or configured by hardware and software. The authentication device CPU protection unit 14 and the authentication target device CPU protection unit 24 handle, for example, the programs operating in the authentication device CPU11 to the authentication target device CPU21 as encrypted until immediately before execution, and safely secure the minimum necessary part at the time of execution. There is a mechanism that decrypts and advances the process.

  The authentication device CPU protection means 14 is provided to safely protect the decryption of the encrypted authentication key 23K and the verification process of the decryption code and the correct codebook. The authentication target device CPU protection means 24 is provided to safely protect the decryption of the authentication device encryption authentication key 13K and the verification process between the authentication device decryption code and the authentication device correct code.

  As described above, in the device authentication system of this embodiment, the authentication device 11 includes the authentication device CPU 11, the authentication device controller 12, and the authentication device storage device 13, and the authentication device storage device 13 is encrypted. An authentication device encryption authentication key which is an authentication key encrypted by the authentication device ID 13I and the authentication device ID 13I and the authentication device manufacturer authentication key. 13K, the authentication target device 20 includes an authentication target device CPU 21, an authentication target device controller 22, and an authentication target device storage device 23. The authentication target device storage device 23 is an authentication device encryption codebook. The authentication device correct answer book and the authentication device manufacturer authentication key are stored, and the medium ID 23I and the encrypted authentication key 23K are stored in the protection area 23A.

  The authentication device 10 uses the authentication device controller 12 to decrypt the encrypted authentication key 23K using the manufacturer authentication key and the medium ID 23I to obtain an authentication key, and decrypts the encrypted code using the authentication key and compares it with the correct code By doing so, device authentication of the device to be authenticated is performed.

  The authentication target device 20 uses the authentication target device controller 22 to decrypt the authentication device encryption authentication key 13K using the authentication device manufacturer authentication key and the authentication device ID 13I to obtain an authentication device authentication key, and uses the authentication device authentication key to authenticate the authentication device. Device authentication of the authentication device is performed by decrypting the encrypted codebook and comparing it with the authentication device correct codebook.

  Therefore, there is an effect that it is possible to provide an inexpensive device authentication system that can authenticate the authentication device more strictly.

(Third embodiment)
FIG. 8 is a schematic diagram illustrating the configuration of the device authentication system according to the third embodiment. As shown in FIG. 8, the device authentication system of the present embodiment includes a display 80 that is a device that reproduces content including images such as videos and characters, and an attachment 90 that is a medium for storing the content.

  The display 80 includes a display storage device 83 that is a storage device, a display controller 82 that has a function of decrypting encrypted data using an authentication key that is predetermined data, a display CPU 81 that performs arithmetic processing, and an input signal. And a switch B84 for switching ON / OFF.

  The display controller 82 has a function of reading data stored from an attachment storage device 93 that is a storage device of the connected attachment 90.

  The display storage device 83 provides a memory area necessary for the operation of the display CPU 81 and the display controller 82, and uses the encryption codebook 83A, which is data for the decryption test, and the encryption codebook 83A as a regular authentication key. The correct answer book 83S, which is data obtained when decrypted by the above, and the access key 83K for accessing the protection area inside the attachment are stored.

  The attachment 90 includes an attachment storage device 93, an attachment CPU 91 that is a computing device, an attachment controller 92 having a function of decrypting content, a switch A94 that switches ON / OFF of an input signal, and an attachment secret recording unit 95. The attachment secret recording unit 95 includes an access key 95K for accessing a protected area inside the attachment recording device 93. The access key 95K is different from the display access key 83K, but the protected area can be accessed by a predetermined process. For example, “4C Entity, LLC.“ Content Protection for Recordable Media Specification, SD Memory Card Book, Common Part ”, Revision 0.961, May 3, 2007. <http://www.4centity.com/>” This corresponds to the region 93A. It should be noted that in order to restrict access to the protected area to only a predetermined device, it is required to mount the access key recorded on the display and the attachment so that it cannot be read from the outside.

  The attachment storage device 93 is used to protect and record content and an authentication key. The attachment storage device 93 includes a medium ID 93I that is an ID unique to the attachment storage device 93, a normal region 93B that has no access restriction, and a protection region 93A that is a region where access restriction is provided. The authentication key 93K and contents are stored in this protected area. In some cases, the authentication key and the content are each encrypted with an intermediate key and stored in the normal area, and the intermediate key is stored in the protected area. In that case, when performing the work of retrieving the authentication key or content from the protected area using the access key in the following description, the intermediate key is read, and the encrypted authentication key or encrypted content written in the normal area is read. It is assumed that the work is to read out and decrypt to extract the authentication key or content. By this method, the effect of reducing the size of the necessary protection area can be obtained.

  FIG. 9 is a flowchart illustrating the operation of the device authentication system according to the third embodiment. As shown in FIG. 9, in step 901, the display 80 sends some predetermined commands to the attachment 90 to read the key stored in the protected area of the attachment storage device 93 by the display controller 92, and accesses it. Process. If the access process is successful, the attachment 90 transmits a response including the authentication key 93K to the display.

  In step 904, after receiving the response, the display 80 turns on the switch A94.

  In step 905, the display 80 obtains the authentication key 93 </ b> K by the display controller 82.

  In step 906, the display 80 uses the authentication key by the display CPU 81 to decrypt the encrypted code book stored in the display storage device 83 to obtain a decrypted code book. Here, the decryption code may be an activation screen of the display 80 which is an authentication device, or a sound effect reproduced when the display 80 is activated.

  In step 907, the display 80 reads the correct note book stored in the display storage device 83.

  In step 908, the display 80 determines whether the decoded codebook and the correct codebook match. The display 80 determines that the authentication has failed if the decrypted codebook and the correct codebook do not match, and proceeds to step 911. If the decrypted codebook and the correct codebook match, the display 80 determines that the authentication has succeeded. Determine and proceed to step 909. It is also possible to treat a value obtained by performing a certain operation such as the Hash function after obtaining the decrypted codebook as a correct codebook. In this case, there is an effect that the size of the correct answer book can be reduced.

  In step 909, the display 80 transmits an authentication success to the attachment 90, and in step 910, the attachment 90 receives the authentication success.

  In step 911, the display 80 does not accept access from the attachment CPU 91 by the display CPU 81.

  FIG. 10 is a continuation of the flowchart showing the operation of the device authentication system of the third exemplary embodiment. As shown in FIG. 10, in step 1001, the display 80 turns on the switch B84.

  In step 1002, the attachment 90 activates the attachment controller 92. In step 1003, the attachment 90 reads out the content 93 </ b> C from the attachment recording device by the attachment controller 92 and performs a decoding process or the like to generate output content that can be displayed. In step 1004, the attachment 90 transmits the output content to the display 80.

  In step 1005, the display 80 receives the output content, and in step 1006, the output content is displayed.

  As described above, in the device authentication system of the present embodiment, the display 80 includes the display CPU 81, the display controller 82, and the display storage device 83, and the display storage device 83 is an encryption codebook and a correct codebook. And the access key, the attachment 90 includes an attachment CPU 91 and an attachment storage device 93, and the attachment storage device 93 stores the authentication key 93K in the protection area 93A. The display 80 obtains an authentication key 93K from the display controller 82, decrypts the encrypted codebook using the authentication key, and compares it with the correct codebook to perform device authentication of the device to be authenticated. Since the authentication key is recorded in the protected area, it cannot be read or written without knowing the access key.

  Therefore, only an attachment having an authentication key in the protected area used for content protection recording can be connected to the display.

(Fourth embodiment)
The configuration of the device authentication system according to the fourth embodiment is the same as that of the first embodiment.

  FIG. 11 is a flowchart illustrating the operation of the device authentication system according to the fourth embodiment. As shown in FIG. 11, in step 1101, the authentication target device 20 is attached to the authentication device 10.

  In step 1102, the authentication device 10 determines whether the authentication target device 20 is attached. If the authentication device 10 determines that the authentication target device 20 is attached, the process proceeds to step 1103. If it is determined that the authentication target device 20 is not attached, the process returns to step 1102.

  The authentication device controller 12 reads the encrypted authentication key from the authentication target device storage device 23 using the encryption codebook (x) and decrypts it to obtain the authentication key (Np). The procedure is described below.

  In step 1103, the authentication device 10 transmits an arbitrary numerical value (x) that is an encryption codebook to the authentication target device 20.

  In step 1104, the authentication target device 20 determines whether the numerical value (x) has been received. If received, the process proceeds to step 1105, and if not, the process proceeds to step 1104.

  In step 1105, the authentication target device 20 performs an authentication operation using the authentication value of the authentication target device, which is an authentication key, using (x), and obtains a calculation result f (Np, x).

  Here, the authentication calculation f (a, b) is an arithmetic expression that can be calculated by the authentication device 10 and the authentication target device 20.

  In step 1106, the authentication target device 20 transmits the authentication calculation result f (Np, x) to the authentication device 10.

  In step 1107, the authentication device 10 determines whether or not the authentication calculation result f (Np, x) has been received. If it has been received, the process proceeds to step 1108, and if not, the process returns to step 1107.

  In step 1108, the authentication device 10 performs an inverse operation on f (Np, x) to obtain (Np).

  The correct answer book transmission means performs an authentication operation on the correct answer book (Nc) using an authentication key f (a, b) determined in advance using an authentication key (Np), and obtains an authentication result f (Nc, Np). It transmits to the device 20 to be authenticated.

  In step 1109, the authentication device 10 performs an authentication operation on the eigenvalue (Nc) of the authentication device, which is a correct answer book, using (Np), and obtains an operation result f (Nc, Np).

  FIG. 12 is a continuation of the flowchart showing the operation of the device authentication system of the fourth exemplary embodiment. As shown in FIG. 12, in step 1201, the authentication device 10 transmits an authentication calculation result f (Nc, Np) to the authentication target device 20.

  In step 1202, the authentication target device 20 determines whether or not the authentication calculation result f (Nc, Np) has been received. If received, the process proceeds to step 1203. If not received, the process returns to step 1202.

  In step 1203, the authentication target device 20 inversely calculates the authentication calculation result f (Nc, Np) to obtain (Nc).

  The correct code comparison means reads the correct code (Nc) obtained by the authentication target device 20 performing the reverse operation of the authentication result from the authentication target device storage device 23 using the encrypted code (x) and decrypts it ( Nc) ′ is obtained and compared with the correct codebook (Nc) before transmission.

  In step 1204, the authentication target device 20 performs an authentication operation on (Nc) using (x), and obtains an operation result f (Nc, x).

  In step 1205, the authentication target device 20 transmits the authentication calculation result f (Nc, x) to the authentication device 10.

  In step 1206, the authentication device 10 determines whether or not the authentication calculation result f (Nc, x) has been received. If received, the process proceeds to step 1207. If not received, the process returns to step 1206.

  In step 1207, the authentication device 10 reversely calculates the authentication calculation result f (Nc, x) to obtain (Nc) '.

  The determination permitting unit permits the cooperative operation with the authentication target device 20 when the read correct codebook (Nc) 'matches the correct codebook before transmission (Nc).

  In step 1208, the authentication device 10 determines whether (Nc) and (Nc) ′ match, and if they match, the process proceeds to step 1209 as authentication success, and if they do not match, the process proceeds to step 1211 as authentication failure.

  In step 1209, the authentication device 10 transmits a command from the authentication device CPU 11 to the authentication target CPU 21. In step 1210, the authentication target device 20 receives a command from the authentication device CPU 11, and the authentication device 10 and the authentication target device 20 are hereinafter described. Operate in cooperation.

  In step 1211, the authentication device 10 does not accept access from the authentication target device CPU 21 by the authentication device CPU 11.

  As described above, the device authentication system of this embodiment realizes device authentication by software processing in which the authentication device 10 and the authentication target device 20 use common arithmetic processing.

  Therefore, there is an effect that accurate device authentication can be performed without adding new hardware.

10: Authentication device,
11: Authentication device CPU,
12: Authentication device controller,
13: Authentication device storage device,
20: Authentication target device,
21: Authentication target device CPU,
23: Authentication target device storage device.

Claims (14)

An authentication target device CPU that is a computing device;
An authentication target device storage device comprising a storage medium for storing data, and storing an encrypted authentication key, which is encrypted and predetermined data, in a protection area that is an area in which access restriction is provided for the storage medium;
An authentication target device comprising:
An authentication device storage device that stores an encryption codebook that is data to be decrypted in advance, and a correct codebook that is data obtained when the encryption codebook is decrypted with a normal authentication key;
An authentication device controller that reads the encrypted authentication key from the authentication target device storage device and decrypts it to obtain an authentication key;
An authentication device CPU that permits a cooperative operation with the device to be authenticated when the decryption codebook obtained by decrypting the encryption codebook with the authentication key matches the correct codebook;
An authentication device comprising:
A device authentication system comprising: An authentication target device CPU that is a computing device;
A storage medium for storing data, and a medium ID unique to the storage medium and an encrypted authentication key that is encrypted by the medium ID and is predetermined data are provided for restricting access to the storage medium. Authentication target device storage device to be stored in the protected area,
An authentication target device comprising:
An authentication device storage device that stores an encryption codebook that is data to be decrypted in advance, and a correct codebook that is data obtained when the encryption codebook is decrypted with a normal authentication key;
An authentication device controller that reads out the medium ID and the encrypted authentication key from the authentication target device storage device, decrypts the encrypted authentication key with the medium ID, and obtains an authentication key;
An authentication device CPU that permits a cooperative operation with the device to be authenticated when the decryption codebook obtained by decrypting the encryption codebook with the authentication key matches the correct codebook;
An authentication device comprising:
A device authentication system comprising: The authentication device storage device
A storage medium for storing data, and an authentication device ID unique to the storage medium, and an authentication device encryption authentication key that is encrypted by the authentication device ID and is predetermined data. Store it in a protected area, which is a restricted area,
The authentication target device storage device is:
An authentication device encryption codebook that is predetermined data to be decrypted, and an authentication device correct codebook that is data obtained when the authentication device encryption codebook is decrypted with a normal authentication device authentication key. Store and
The authentication target device controller is:
Reading the authentication device ID and the authentication device encryption authentication key from the authentication device storage device, decrypting the authentication device encryption authentication key by the authentication device ID, and calculating an authentication device authentication key,
The authentication target device CPU is:
Permitting a collaborative operation with the authentication device when the authentication device decryption code obtained by decrypting the authentication device encryption code with the authentication device authentication key matches the authentication device correct code book. 3. The device authentication system according to claim 2, wherein   4. The device authentication system according to claim 2, wherein the authentication device is a display that reproduces content including an image, and the authentication target device is an attachment that stores the content. An authentication target device CPU that is a computing device;
An authentication target device storage device comprising a storage medium for storing data, and storing an encrypted authentication key, which is encrypted and predetermined data, in a protection area that is an area in which access restriction is provided for the storage medium;
An authentication target device comprising:
An authentication device storage device for storing an encryption codebook that is arbitrary data and a correct codebook that is uniquely allocated data;
An authentication device controller that reads the encrypted authentication key from the authentication target device storage device using the encryption codebook and decrypts it to obtain an authentication key;
An authentication device CPU that is a computing device;
An authentication device comprising:
With
The authentication device is
The correct codebook is subjected to an authentication calculation using a predetermined authentication formula using the authentication key, and correct codebook transmitting means for transmitting an authentication result to the authentication target device;
The correct answer that the authentication target device reversely calculates the authentication result is read out from the authentication target device storage device using the encrypted code book, and is decoded and compared with the correct code book before transmission. A notepad comparison means;
A determination permitting unit for permitting a cooperative operation with the authentication target device when the read correct codebook and the correct codebook before transmission match;
A device authentication system comprising: An authentication target device CPU that is a computing device;
An authentication target device storage device comprising a storage medium for storing data, and storing an encrypted authentication key, which is encrypted and predetermined data, in a protection area that is an area in which access restriction is provided for the storage medium;
An authentication target device comprising:
An authentication device storage device that stores an encryption codebook that is data to be decrypted in advance, and a correct codebook that is data obtained when the encryption codebook is decrypted with a normal authentication key;
An authentication device controller that reads the encrypted authentication key from the authentication target device storage device and decrypts it to obtain an authentication key;
An authentication device CPU that permits a cooperative operation with the device to be authenticated when the decryption codebook obtained by decrypting the encryption codebook with the authentication key matches the correct codebook;
An authentication device comprising:
A device to be authenticated by a device authentication system comprising: An authentication target device CPU that is a computing device;
A storage medium for storing data, and a medium ID unique to the storage medium and an encrypted authentication key that is encrypted by the medium ID and is predetermined data are provided for restricting access to the storage medium. Authentication target device storage device to be stored in the protected area,
An authentication target device comprising:
An authentication device storage device that stores an encryption codebook that is data to be decrypted in advance, and a correct codebook that is data obtained when the encryption codebook is decrypted with a normal authentication key;
An authentication device controller that reads out the medium ID and the encrypted authentication key from the authentication target device storage device, decrypts the encrypted authentication key with the medium ID, and obtains an authentication key;
An authentication device CPU that permits a cooperative operation with the device to be authenticated when the decryption codebook obtained by decrypting the encryption codebook with the authentication key matches the correct codebook;
An authentication device comprising:
An authentication target device of an authentication target device of a device authentication system comprising: The authentication device storage device
A storage medium for storing data, and an authentication device ID unique to the storage medium, and an authentication device encryption authentication key that is encrypted by the authentication device ID and is predetermined data. Store it in a protected area, which is a restricted area,
The authentication target device storage device is:
An authentication device encryption codebook that is predetermined data to be decrypted, and an authentication device correct codebook that is data obtained when the authentication device encryption codebook is decrypted with a normal authentication device authentication key. Store and
The authentication target device controller is:
Reading the authentication device ID and the authentication device encryption authentication key from the authentication device storage device, decrypting the authentication device encryption authentication key by the authentication device ID, and calculating an authentication device authentication key,
The authentication target device CPU is:
Permitting a collaborative operation with the authentication device when the authentication device decryption code obtained by decrypting the authentication device encryption code with the authentication device authentication key matches the authentication device correct code book. The device to be authenticated by the device authentication system according to claim 7, wherein the device is an authentication target device. An authentication target device CPU that is a computing device;
An authentication target device storage device comprising a storage medium for storing data, and storing an encrypted authentication key, which is encrypted and predetermined data, in a protection area that is an area in which access restriction is provided for the storage medium;
An authentication target device comprising:
An authentication device storage device that stores an encryption codebook that is arbitrary data and a correct codebook that is uniquely allocated data;
An authentication device controller that reads the encrypted authentication key from the authentication target device storage device using the encryption codebook and decrypts it to obtain an authentication key;
An authentication device CPU that is a computing device;
An authentication device comprising:
With
The authentication device is
The correct codebook is subjected to an authentication calculation using a predetermined authentication formula using the authentication key, and a correct codebook transmitting means for transmitting an authentication result to the authentication target device;
The correct answer that the authentication target device reversely calculates the authentication result is read out from the authentication target device storage device using the encrypted code book, and is decoded and compared with the correct code book before transmission. A notepad comparison means;
A determination permitting unit for permitting a cooperative operation with the authentication target device when the read correct codebook and the correct codebook before transmission match;
A device to be authenticated by a device authentication system comprising: An authentication target device recording unit, which is a storage device having a protection area in which an authentication key, content, and first secret information are recorded and accessible only in a predetermined procedure using the secret information;
An authentication target device calculation processing unit for performing calculation processing;
An authentication target device comprising:
A correct codebook obtained as a result of computing the data codebook with a predetermined function, an encrypted codebook obtained by encrypting the data codebook with the authentication key, a recording unit for recording second secret information,
An arithmetic processing unit for performing arithmetic processing;
An authentication device comprising:
An authentication system comprising:
The authentication target device performs the predetermined procedure using the second secret information, and the authentication device reads the authentication key from the protection area,
The authentication target device decrypts the encryption codebook with the authentication key, verifies that the result calculated by the predetermined function matches the correct codebook, and only matches if it matches To the authentication device,
The authentication device receives the notification only when the predetermined procedure reaches the last procedure,
Only when the authentication device receives the notification, the content is read and processed using the first secret information, and then output to the authentication target device.
The authentication target device accepts content that is output only when the verification matches.
An authentication system characterized by that. The authentication target device recording area includes a normal area that does not require the predetermined procedure,
The normal area is stored as an encrypted authentication key in which the authentication key is encrypted with an authentication encryption key,
The protected area stores the authentication encryption key,
The authentication device is
Reading the authentication encryption key by the predetermined procedure using the second secret information,
Read the encrypted authentication key from the normal area,
Decrypting the encrypted authentication key;
The authentication system according to claim 10, wherein an authentication key is extracted. The authentication target device recording area includes a normal area that does not require the predetermined procedure,
The normal area stores encrypted content obtained by encrypting the content with a content key,
The protected area stores the content key,
The authentication target device is:
The content key is read by the predetermined procedure,
Read the encrypted content from the normal area,
12. The authentication system according to claim 10, wherein the encrypted content is decrypted and the content is extracted.   The authentication system according to any one of claims 10 to 12, wherein the data codebook is a screen display object when the authentication device is activated.   The authentication system according to any one of claims 10 to 12, wherein the data codebook is a sound reproduced when the authentication device is activated.

Images