JP2012044430A - Portable information apparatus and encrypted communication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a portable information apparatus that securely and efficiently share a session key.SOLUTION: A card (102) (portable information apparatus) communicates with a reception machine (1033) to receive a public key certificate including a public key, and on receipt of the public key, generates a session key. The card (102) then encrypts the generated session key with the received public key and stores the session key and the encrypted session key therein. When starting communicating with an ATM (1031), the card (102) transmits the stored encrypted session key to the ATM. The ATM (1031) receives the encrypted session key and decrypts the encrypted session key with a private key corresponding to the transmitted public key. The card (102) and the ATM (1031) later execute encrypted communication using both session keys.

Description

  The present invention relates to a portable information device and an encrypted communication program.

  Currently, non-contact IC (Integrated Circuit) cards are widely used in the fare settlement of railways and buses, but are expected to be widely used in financial institutions in the future. However, since communication is wireless, there is a risk of being intercepted and wiretapped. For example, there is a risk that a personal identification number transmitted from a reader / writer of ATM (Automated Teller Machine) to a non-contact IC card is wiretapped.

  Therefore, there is a method for performing encrypted communication by sharing a session key between an ATM and a non-contact IC card. For this reason, there is a method of embedding a master key in advance with an ATM and a non-contact IC card, but it is necessary to embed the same master key in all cards and ATMs (ATMs of all stores). , All encrypted communications may be decrypted.

  In addition, there is a session key sharing method that uses public key cryptography to minimize the influence even if a key leaks (for example, Patent Document 1). However, in general, since the sharing process takes time, when the user goes back and forth between the ATM and the window, it is inconvenient because the user has to wait for session key sharing each time.

JP 2002-344438 A

  As a conventional technique for key sharing between an IC card and a terminal, there is JP-A-2002-344438 (Patent Document 1). Patent Document 1 is a key sharing method that uses public key cryptography to share a session key between a terminal and an IC card. When the technique of Patent Document 1 is applied to session key sharing, there is a problem that a lot of communication commands are required, resulting in inefficiency.

  It is an object of the present invention to provide a portable information device such as an IC card that executes session key sharing safely and efficiently.

The portable information device of this invention is
A first communication unit that communicates with a first communication device and receives a public key certificate including a first public key;
A session key generation unit that generates a session key triggered by reception of the first public key by the first communication unit;
A public key cryptographic operation unit that generates an encrypted session key by encrypting the session key generated by the session key generation unit using the first public key received by the first communication unit;
A storage unit for storing the session key generated by the session key generation unit and the encrypted session key encrypted by the public key cryptographic operation unit;
A second communication unit that starts communication with a second communication device and transmits the encrypted session key stored in the storage unit to the second communication device;
Stored in the storage unit with the second communication device that has received the encrypted session key and decrypted the encrypted session key with a first secret key corresponding to the first public key And an encrypted communication unit that executes encrypted communication using the session key.

  According to the present invention, it is possible to provide a portable information device that executes session key sharing safely and efficiently.

1 is a configuration diagram of a non-contact IC card system according to Embodiment 1. FIG. FIG. 3 is a block diagram showing session key generation processing in the contactless IC card according to the first embodiment. The block diagram in which the non-contact IC card of Embodiment 1 transmits an encryption session key to ATM. The block diagram which shows the structure which the non-contact IC card of Embodiment 1 performs encryption communication with ATM. 3 is a flowchart for explaining the operation of the non-contact IC card system according to the first embodiment. FIG. 25 shows a hardware configuration of a non-contact IC card system according to the ninth embodiment.

Embodiment 1 FIG.
The first embodiment will be described with reference to FIGS.
FIG. 1 is a diagram showing a specific example of sharing a session key, which is a shared key, as a method of operating a contactless IC card. FIG. 1 illustrates a case where a user (101) enters a bank store and shares a session key.

  In FIG. 1, when the user (101) enters the store (103) of a financial institution, once the contactless IC card (102) is touched on the reception device (1033), the store (103) and the contactless IC are contacted. The session key (104) is shared with the card (102). The ATM (1031) and the window device (1032) immediately perform encrypted communication using the shared session key (104). The case of FIG. 1 will be described below.

  First, it is assumed that the user (101) enters the bank store (103) with the contactless IC card (102). Next, the user (101) touches the reception machine (1033) with the non-contact type IC card (102). Then, the session key (104) is shared between the non-contact type IC card (102) and the system on the store (103) side, and the session key (104) is stored in the ATM (1031) in the store (103) The device (1032) is notified using the network of the store (103) or the like.

  In the ATM (1031) and the window device (1032), this session key (104) is used to perform prompt encryption communication with the non-contact IC card (102). For example, when the non-contact IC card (102) is held over the reader / writer (10313) of the ATM (1031), the message "Please enter your password" is displayed on the input screen (10311). When the user (101) inputs a personal identification number (PIN), a session key (shared) between the IC card use S / W (Software) (10312) and the non-contact IC card (102) is already shared. 104) is immediately established, and the password is securely transmitted to the contactless IC card (102).

  In this case, the encryption algorithm uses a common key cryptosystem such as AES (Advanced Encryption Standard) in consideration of the processing speed.

  When the technology of Patent Document 1 shown in the background art is used for sharing the session key (104) between the accepting device (1033) and the non-contact IC card (102) in FIG. It is considered inefficient. Further, each time the contactless IC card is touched, the accepting device needs to notify the ATM / window of the session key shared for each contactless IC card. That is, it is necessary to share the session key with the ATM / window as many as the number of users who have entered the store, and facilities and management for that purpose are required. Therefore, the processing time for session key sharing is reduced, and the facility for notifying and managing the session key (104) from the accepting device (1033) to the ATM (1031) / gateway device (1032) is reduced. The mechanism for sharing the session key is described below. In the following description, the non-contact IC card (102) may be simply referred to as “card (102)”.

  The non-contact IC card system according to the first embodiment will be described below with reference to FIGS. The outline of the system (system) described below is as follows. When there are a plurality of terminal devices in a certain area, the non-contact IC card (102) is touched to the accepting device (example of the first communication device) when entering the area. The public key certificate of the public key encryption common to the area is transmitted from the accepting machine to the card (102). The card (102) encrypts and stores the session key generated internally with the public key obtained from the public key certificate. After that, when the non-contact IC card (102) is touched in a terminal device (example of second communication device) such as ATM or counter device in the area, the encrypted session key is read and installed in the terminal in advance. Decrypt with the private key of the public key cryptography common to all areas. As a result, the session key is quickly shared between the contactless IC card (102) and the terminal device, and thereafter encrypted communication is possible.

(Card function)
FIG. 2 shows a functional configuration on the card (102) side when the card (102) communicates with the accepting device (1033) in the first embodiment. The function of each component is as follows.
(A) The communication unit (301) communicates with the accepting device (1033). (B) The command analysis / generation unit (302) analyzes the command (APDU 311) received from the accepting device (1033). The response of the card (102) is generated as a command (APDU 319).
(C) The certificate verification unit (303) verifies the public key certificate (PKC_s) (312) sent from the accepting device (1033). If the verification is successful, the public key (PubKey_s) (314) is output.
(D) The random number generation unit (304) generates a random number Rc (315).
(E) The session key generation unit (305) generates a session key SK (316) from the random number Rc (315) and the random number Rs (313) sent from the accepting device (1033).
(F) The session key storage unit (308) stores the session key SK (316) in the storage unit (332). Alternatively, the session key SK (316) is read from the storage unit (332) and transferred to the decryption unit (351) and the encryption unit (353).
(G) The public key cryptographic operation unit (306) encrypts the session key SK (316) by using the public key (PubKey_s) (314) output from the certificate verification unit (303). Output as session key SK (317).
(H) The encrypted session key storage unit (307) stores the encrypted session key SK (317) in the storage unit (332), reads it from the storage unit (332), and responds (318). To the command analysis / generation unit (302).
(I) The clock unit (331) measures time.
(J) The storage unit (332) stores a session key, an encrypted session key, and other information.

  FIG. 3 shows a configuration of a functional unit when the card (102) shares a session key with the ATM (1031) in the first embodiment. The configuration of the functional unit in FIG. 3 is the same as that in FIG. The difference from FIG. 2 is that the encrypted session key storage unit (307) receives the read command (322) of the encrypted session key SK, which is a command from the ATM, and upon receiving this command, the storage unit ( 332) to obtain an encrypted session key SK, and output the encrypted session key SK (323) to the command analysis / generation unit (302) as a response.

FIG. 4 shows a configuration of a functional unit when the card (102) performs encrypted communication using the ATM (1031) and a session key in the first embodiment.
(A) The communication unit (301) is the same as FIG.
(B) The command analysis / generation unit (302) analyzes the decoded APDU (3502) and outputs an instruction (3504). Also, it receives a processing result (3505) that is an output of the instruction processing unit (352), and outputs a response (3506) (APDU).
(C) The decryption unit (351) decrypts the encrypted APDU (3501) with the session key SK (3503), and outputs the decrypted APDU (3502).
(D) The session key storage unit (308) retrieves the session key SK (3503) stored in the storage unit (332) and outputs it to the decryption unit (351) and the encryption unit (353). (E) Command processing The unit (352) interprets the instruction (3504), executes the corresponding instruction, and outputs the processing result (3505).
(F) The encryption unit (353) encrypts the response (3506) (APDU) with the session key SK (3503), and outputs the encrypted APDU (response) (3507).
(G) In FIG. 4, the encryption unit (353), the decryption unit (351), the instruction processing unit (352), etc. constitute an encrypted communication unit (333) that executes encrypted communication.

  Next, processing between the card (102) and the accepting machine (1033) will be described with reference to S401 to 408 of FIG. 5 corresponding to FIGS. It is assumed that a reader / writer is built in the accepting machine (1033). The system configuration in the following description is the same as the “apparatus arrangement” shown on the left side of FIG.

  When the user touches the reception device (1033) with the card (102), the reception device (1033) sends an APDU including the store public key certificate (PKC_s) and the random number Rs (313) to the card (102). To do. (S401). The card (102) receives the public key certificate (PKC_s) (312) and Rs (313) as an APDU (311) through the communication unit (301). The command analysis / generation unit (302) extracts the public key certificate (PKC_s) (312) and Rs (313) from the APDU (311). The card (102) verifies the public key certificate (PKC_s) (312). This is performed by the certificate verification unit (303). (S402) The verification verifies the signature. The signature of the public key certificate (PKC_s) is verified using the public key of a reliable certificate authority embedded in the card (102) in advance. That is, it is the public key of the CA (Certificate Authority) that issued the public key certificate (PKC_s). When the certificate verification unit (303) succeeds in verifying the public key certificate (PKC_s) (312), the certificate verification unit (303) extracts the public key (PubKey_s) (314). (S403). The card (102) generates a random number Rc (315). This is performed by the random number generation unit (304). (S404). The card (102) generates a session key SK (316). This is performed by the session key generation unit (305). As an implementation example, Rs (313) and Rc (315) are concatenated and input to a one-way hash function such as SHA-1, and the output is set as a session key SK (316) (h (Rs, Rc) (S405)

  The card (102) stores a session key SK (316). This is performed by the session key storage unit (308) (S406). At this time, the session key SK (316) can be encrypted / decrypted using this key, but cannot be read out of the card (102). The card (102) encrypts the session key SK (316) with the public key (PubKey_s), and outputs the encrypted session key SK (317). This is performed by the public key cryptographic operation unit (306) (S407). The card (102) stores the encrypted session key SK (317) in the card (102). This is performed by the encrypted session key storage unit (307) and outputs a response (318). This response is a content indicating that the processing is successful (S408). The response (318) is output as an APDU (319) by the command analysis / generation unit (302) and transmitted to the accepting device (1033) through the communication unit (301).

  In this way, when the card (102) is touched on the accepting machine (1033), a session key is generated and stored in the card (102). In addition, a session key encrypted with the store public key is also stored in the card (102).

  Next, processing between the card (102) and the ATM will be described with reference to FIG. 3 and S501 to S503 in FIG. 5 corresponding to FIG. First, when the card (102) is touched to the reader / writer of the ATM (1031), an instruction for reading from the card (102) the session key encrypted with the store public key (PubKey_s) from the ATM (1031). Is transmitted as APDU (321) to the card (102). The card (102) receives the APDU (321) through the communication unit (301), and the command analysis / generation unit (302) analyzes it as a read command (322) of the encrypted session key SK (317). The encrypted session key storage unit (307) is a session key SK encrypted with the store public key (PubKey_s), which is stored with the read command (322) of the encrypted session key SK as an input. The encrypted session key SK (323) is output to the command analysis / generation unit (302). The command analysis / generation unit (302) transmits this as an APDU (324) to the ATM through the communication unit (301). This is a series of operations for transmitting the session key SK encrypted with the store public key (PubKey_s) from the card (102) to the ATM (1031) (the trigger of the process is from the ATM side) (S501).

  When the ATM (1031) receives the session key SK encrypted with the store public key (PubKey_s), the ATM (1031) decrypts it with the store private key (PriKey_s) stored in advance to obtain the session key SK (S502). ). At this point, the session key SK is shared between the card (102) and the ATM, and thereafter, the ATM (1031) and the card (102) can execute encrypted communication using the session key SK (S503). ).

  Regarding the encrypted communication using the session key SK, the operation of the card (102) will be described with reference to FIG. This is a detailed description of the operation of S503 in FIG.

  First, when the session key SK is obtained by the ATM (1031), the APDU that is subsequently transmitted by the ATM (1031) is encrypted by the session key SK and transmitted to the card (102). At this time, the encryption algorithm is common key encryption, and is common to the card (102) and the ATM (1031). In FIG. 4, the encrypted APDU (3501) transmitted from the ATM (1031) is received by the card (102). This is received through the communication unit (301) and input to the decoding unit (351). The session key storage unit (308) outputs the stored session key SK (3503) to the decryption unit (351). The decryption unit (351) decrypts the encrypted APDU (3501) with the session key SK (3503), and outputs the decrypted APDU (3502) to the command analysis / generation unit (302). The command analysis / generation unit (302) extracts the instruction (3504) from the decoded APDU (3502) and outputs it to the instruction processing unit (352). Here, the command is, for example, “read a specific file on the card (102)”. The instruction processing unit (352) processes the instruction (3504), and outputs the result as a processing result (3505) to the command analysis / generation unit (302). The command analysis / generation unit (302) outputs the processing result (3505) as a response (3506) (APDU). The response (3506) is an APDU (the response is in the APDU format). The encryption unit (353) encrypts the response (3506) using the session key SK (3503), and outputs an encrypted APDU (response) (3507). The session key SK (3503) is obtained from the session key storage unit (308). The encrypted APDU (response) (3507) is transmitted to the ATM (1031) by the communication unit (301).

  As described above, communication in which the APDU is encrypted can be realized between the ATM and the card (102).

  By installing the private key (PriKey_s) of the store securely in advance at each ATM or counter terminal, it is possible to immediately perform encrypted communication at any ATM or counter terminal after touching the reception machine (1033). Is possible.

  In the first embodiment described above, the accepting machine and the ATM are separate devices. However, the ATM may have the function of the accepting machine.

Embodiment 2. FIG.
Embodiments 2 to 9 will be described below, but the system configuration is the same as the “device arrangement” on the left side of FIG. The clock unit and storage unit that appear below are shown in FIG. In the first embodiment, in the communication between the card (102) and the ATM (1031), the ATM does not perform “authentication” of the card (102). When authentication of the card (102) is necessary, the ATM can be obtained by adding a digital signature with the private key of the public key encryption of the card (102) to the data (encrypted data) transmitted from the card (102). It can be confirmed whether the data is transmitted from the correct card (102). In this case, the private key and public key certificate for the public key encryption for the card (102) are stored in advance in the card (102). A signature may be attached to each data transmitted from the card (102). In addition, if a signature is given only to data that is most authentic in a transaction, for example, payment data, the processing time can be reduced.

  This operation will be described. The storage unit (332) stores the card public key (second public key) for the card and the card private key (second secret key) corresponding to the card public key. The encrypted communication unit (333) attaches a digital signature created using the card secret key to the communication data to the ATM (1031) (second communication device) that is the object of the encrypted communication, and attaches the digital signature. The transmitted communication data is transmitted to the ATM (1031). The encrypted communication unit (333) transmits the card public key to the ATM (1031).

Embodiment 3 FIG.
In the second embodiment, the digital signature is used for the authentication of the card (102). However, in the third embodiment, the card ID and the personal identification number (which are recorded on the card (102) are transmitted from the card side during the encrypted communication. PIN) is passed to ATM (1031). The ATM side confirms that the user of the card (102) is an authorized user who knows the personal identification number. In this case, the ATM side can refer to the card ID / password pair at the bank side facility.

This operation will be described.
The storage unit (332) stores “card ID and personal identification number (PIN)” (an example of predetermined authentication information) as authentication information. The encrypted communication unit (333) transmits communication data to the ATM (1031) (second communication device) to be encrypted communication to the ATM (1031). The encrypted communication unit (333) transmits the authentication data stored in the storage unit (332) to the ATM (1031).

Embodiment 4 FIG.
In the first embodiment, management of the private key (PriKey_s) at the store (bank side) is not particularly mentioned. The private key (PriKey_s) is shared by “ATM and window terminal” (an example of the second communication device) that is equipment in the store, but it can be shared because these facilities are a securely managed environment of the store. Is possible. In the fourth embodiment, in order to increase the security of the private key (PriKey_s), for example, the public key (PubKey_s) / private key (PriKey_s) pair is updated once a week, and public key certification is performed each time. The lifetime of the private key (PriKey_s) is shortened by receiving the reissue of the certificate (PKC_s). In the unlikely event that the secret key (PriKey_s) is leaked, at worst, the affected communications are limited to one week. Note that the lifetime is not limited to one week, and may be set to an appropriate period. Each time the secret key (PriKey_s) is updated, it is safely updated to the ATM / window terminal of the store. The public key (PubKey_s) / private key (PriKey_s) pair may be updated by a worker in charge or automatically by a program. What is necessary is just to update a public key / private key pair, and who updates it is not particularly limited.

Embodiment 5 FIG.
In the first embodiment, verification is performed when the card (102) receives the public key certificate (PKC_s) from the accepting device (1033). In the fifth embodiment, the card (102) stores the public key certificate (PKC_s) once it has been verified. When the public key certificate (PKC_s) is received after the second time, if it is the same as the stored data (public key certificate), the card (102) is not verified and the stored public key A certificate (PKC_s) is used. If not, the card (102) verifies and overwrites the saved public key certificate (PKC_s) with the new public key certificate.

  This operation will be described. The storage unit (332) stores the public key certificate determined to be valid by the certificate verification unit (303). When a new public key certificate is received by the communication unit (301) next time, the certificate verification unit (303) receives the newly received public key certificate and the public stored in the storage unit (332). When it is determined that they are the same, the newly received public key certificate is discarded without being verified, and the public key certificate stored in the storage unit (332) is used. If it is determined that they are different, it is overwritten as described above.

Embodiment 6 FIG.
In the first embodiment, the signature is verified in the “verification” of the certificate of the public key certificate (PKC_s). In general, the validity period is also verified. When the expiration date is verified, the card (102) does not have a “clock function”. Therefore, the accepting machine (1033) sends the current time information to the card (102) together with the public key certificate (PKC_s). The card (102) uses this time to verify the certificate expiration date. This process is performed by the certificate verification unit (303). That is, the certificate verification unit (303) acquires date / time information indicating the current date / time from the accepting device (133) via the communication unit (301), and verifies the public key certificate based on the acquired date / time information. .

Embodiment 7 FIG.
In the sixth embodiment, the “current time information” sent from the accepting machine (1033) is used in the verification of the certificate expiration date of the public key certificate (PKC_s). In the seventh embodiment, the card ( If 102) is equipped with a clock, this is used.

  The card (102) further includes a clock unit (331) for measuring time. The certificate verification unit (303) verifies the public key certificate based on the current time information (measurement information) measured by the clock unit (331). Others are the same as in the sixth embodiment.

Embodiment 8 FIG.
In Embodiments 1 to 7, the non-contact IC card (102) is assumed as the card (102), but it may be replaced with a contact IC card. In that case, it is assumed that the reader / writer of the accepting machine, ATM, and window terminal is compatible with the contact type. In addition, touch on the accepting machine, ATM, and touch on the reader / writer of the window terminal are replaced with insertion of a card into the reader / writer.

  As described above, in the method (system) described in the first to second embodiments, the safety of communication is ensured for the following reason.

(A. Threats to contactless IC cards)
[A1. Fake reception machine]
Consider a case where an attacker installs a fake acceptance machine in a store and touches a non-contact IC card.
-Even if the counterfeit machine sends a “public key certificate of a counterfeit store convenient for attackers” to the contactless IC card, it can be detected by verifying the public key certificate in the card.
・ If a fake acceptor sends a "legitimate store public key certificate" to a contactless IC card, there is no problem in the contactless IC card, just by performing the same process as when communicating with a legitimate acceptor. . [A2. For fake ATM (or fake window terminal)]
Consider a case where an attacker crafts an ATM, prepares a fake reader / writer and a fake ATM application, and touches a non-contact IC card.
As long as the fake ATM does not hold the store private key (PriKey), the “session key (SK) encrypted with the store public key” transmitted from the contactless IC card cannot be decrypted. Therefore, the session key is not leaked.
・ The fake ATM receives the "session key (SK) encrypted with the store's public key" sent from the contactless IC card, ignores it, and encrypts it with the fake session key (SK ') Even if the communication is started, since it is different from the session key (SK) stored in the contactless IC card, the encrypted communication fails and an abnormality is detected.

(B. Threat to the reception machine)
[B1. Fake non-contact IC card]
Only the store public key certificate (PKC_s) is sent, and there is no problem even if the other party is counterfeit.

(C. Threat to ATM (or counter terminal))
[C1. Fake non-contact IC card]
Assume a fake non-contact IC card forged as follows.
-Card ID (eg, record Taro's card ID and pretend to be Taro's cash card)
・ "Fake session key (SK ') encrypted with the store's public key"
That is, it is assumed that the criminal performs a patent Taro transaction using a fake non-contact IC card. In this case, the ATM decrypts the fake session key (SK ′) and starts encrypted communication normally. However, in the transaction, since the signature by the user's private key recorded on the contactless IC card is given to the transaction data, it is detected as an abnormality unless the user's private key is copied. Since the user's private key in the non-contact IC card is generally secured by the tamper resistance of the non-contact IC card, it cannot be extracted and transferred to another card.

  Since the fake session key SK ′ is generated by itself, the encrypted communication can be decrypted. Information obtained by decoding is data transmitted / received to / from ATM. However, since the information of genuine patent Taro is notified from ATM only when the signature of a valid patent Taro can be given to the transaction data, the legitimate signature cannot be generated, so the data that is advantageous to the attacker is obtained. Absent.

(D. Management of Private Key PrivateKey)
Giving a private key PrivateKey to a plurality of devices (ATM / counter terminal) in the store contributes to the reduction of processing time, which is a problem of the prior art. If you are in a limited area of a store, you can share it safely in operation. In order to increase security, the key pair (public key, private key) is periodically updated, and the public key certificate is updated from the certificate authority. For example, if the secret key PrivateKey updated once a week and updated before the opening of the Monday at the beginning of the week is shared, the security is enhanced.

Embodiment 9 FIG.
In the ninth embodiment, the hardware configuration of an IC card will be briefly described.
FIG. 8 is a diagram illustrating hardware resources of the IC card. The IC card includes a CPU 810 (Central Processing Unit) that executes a program. The CPU 810 is connected to a ROM (Read Only Memory) 811, a RAM (Random Access Memory) 812, and a communication unit 816 via the bus 825, and controls these hardware devices.

  The RAM 812 is an example of a volatile memory. The ROM 811 is an example of a nonvolatile memory. These are examples of the storage unit. The communication unit 816 is an example of an input unit or an output unit.

  The ROM 811 stores a program group 823. The programs in the program group 823 are executed by the CPU 810.

  The program group 823 stores programs that execute the functions described as “˜units” in the description of the above embodiments. It is read and executed by the CPU 810.

  In the above description of the embodiment, what has been described as “to part” may be “to means”, “to circuit”, and “to device”, and “to step” and “to”. “Procedure” and “˜Process” may be used.

  In the above embodiment, the IC card has been described. However, the operation of the IC card can be grasped as an encryption communication method, an encryption communication program, or a recording medium recording the encryption communication program.

  In the above first to ninth embodiments, the card is described as the portable information device, but this is an example. Of course, not only a card but also a mobile phone or other portable information terminal device may be used.

In the non-contact IC card systems of Embodiments 1 to 9 described above, when a user enters a bank store, the non-contact IC card is touched with a reception machine to complete the reception process. After that, when the user presents the contactless IC card at the ATM (or window terminal), encrypted communication is performed between the contactless IC card and the ATM (or window terminal) without the key exchange process, and the data is protected. Operation. This non-contact IC card system has the following features.
(1) Generation of Session Key SK When a contactless IC card is touched on the reader / writer of the store reception device, the store public key certificate (PKC_s) is transmitted from the reception device to the contactless IC card. The contactless IC card verifies the public key certificate (PKC_s), generates a session key (SK) only when it is successful, and stores the session key SK in itself. The session key SK is stored as an attribute “cannot be read, but encryption / decryption processing is executable”. The contactless IC card encrypts and stores the session key SK with the store public key (PubKey_s) obtained from the public key certificate (PKC_s).
(2) After the processing of (1), when using a non-contact IC card in ATM, if the non-contact IC card is touched to the ATM reader / writer, it is encrypted from the non-contact IC card with the public key (PubKey_s). The session key SK is sent to the ATM. The ATM decrypts the session key SK with the store secret key (PriKey_s). Since the session key SK is shared by the non-contact IC card and the ATM, thereafter, encrypted communication is performed with the non-contact IC card and the ATM.
The ATM may be replaced with a window terminal.
(3) The card signature is given to the transaction data transmitted to the ATM.
(4) The private key (PriKey_s), which is the private key of the store, is distributed in advance to the ATM / counter terminal, thereby realizing the decryption of (2).
By these (1) to (4), the contactless IC card system reduces the processing time of session key sharing, reduces the session key notification and management facilities from the reception machine to the ATM / window, and is safe and simple. Session keys can be shared.

  102 Card, 301 Communication Unit, 303 Certificate Verification Unit, 305 Session Key Generation Unit, 306 Public Key Cryptographic Operation Unit, 331 Clock Unit, 332 Storage Unit, 333 Encrypted Communication Unit, 1033 Acceptance Machine, 1031 ATM, 1032 Window Device .

Claims (9)

A first communication unit that communicates with a first communication device and receives a public key certificate including a first public key;
A session key generation unit that generates a session key triggered by reception of the first public key by the first communication unit;
A public key cryptographic operation unit that generates an encrypted session key by encrypting the session key generated by the session key generation unit using the first public key received by the first communication unit;
A storage unit for storing the session key generated by the session key generation unit and the encrypted session key encrypted by the public key cryptographic operation unit;
A second communication unit that starts communication with a second communication device and transmits the encrypted session key stored in the storage unit to the second communication device;
Stored in the storage unit with the second communication device that has received the encrypted session key and decrypted the encrypted session key with a first secret key corresponding to the first public key A portable information device comprising: an encrypted communication unit that performs encrypted communication using the session key. The storage unit
Storing a second public key and a second secret key corresponding to the second public key;
The encrypted communication unit is
A digital signature created using the second secret key is attached to communication data to the second communication device that is the target of the encrypted communication, and the communication data with the digital signature is added to the second communication device. 2. The portable information device according to claim 1, wherein the second public key is transmitted to the second communication device while the second public key is transmitted to the second communication device. The storage unit
Store predetermined authentication information,
The encrypted communication unit is
The communication data to the second communication device that is the target of the encrypted communication is transmitted to the second communication device, and the predetermined authentication data stored in the storage unit is transmitted to the second communication device. The portable information device according to claim 1, wherein the portable information device is a portable information device. The first public key transmitted from the first communication device and the first public key corresponding to the first public key and used for decrypting the encrypted session key by the second communication device What is a private key?
The portable information device according to claim 1, wherein the portable information device is updated when a predetermined period elapses. The portable information device further includes:
A certificate verification unit that verifies the public key certificate including the first public key received by the first communication unit;
The storage unit
Storing the public key certificate determined to be valid by the certificate verification unit;
The certificate verification unit
When the public key certificate is newly received by the first communication unit next time, the newly received public key certificate is compared with the public key certificate stored in the storage unit, 5. The public key certificate stored in the storage unit is discarded without verifying the newly received public key certificate when determined to be the same, and the public key certificate stored in the storage unit is used. A portable information device according to claim 1. The certificate verification unit
The date and time information indicating the current date and time is acquired from the first communication device via the first communication unit, and the public key certificate is verified based on the acquired date and time information. The portable information device described. The portable information device further includes:
It has a clock unit that measures the date and time,
The certificate verification unit
6. The portable information device according to claim 5, wherein the public key certificate is verified based on date information measured by the clock unit. The portable information device includes:
The portable type according to any one of claims 1 to 7, wherein a communication method with the first communication device and the second communication device is either a non-contact type or a contact type. Information device. Computer
A first communication unit that communicates with a first communication device and receives a public key certificate including a first public key;
A session key generation unit that generates a session key triggered by reception of the first public key by the first communication unit;
A public key cryptographic operation unit that generates an encrypted session key by encrypting the session generated by the session key generation unit using the first public key received by the first communication unit;
A storage unit for storing the session key generated by the session key generation unit and the encrypted session key encrypted by the public key cryptographic operation unit;
A second communication unit that starts communication with a second communication device and transmits the encrypted session key stored in the storage unit to the second communication device;
Stored in the storage unit with the second communication device that has received the encrypted session key and decrypted the encrypted session key with a first secret key corresponding to the first public key An encrypted communication unit that performs encrypted communication using the session key;
An encrypted communication program characterized in that it functions as a computer program.

Images