JP2015002374A - Method, device and system for authentication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide technical means for performing authentication of high confidentiality, by making it difficult to acquire a key for authenticating a device to be authenticated, without performing the calculation based on a cryptographic algorithm.SOLUTION: Specific key data is associated with a voltage value, and this voltage value is stored in a controller 20. When being authenticated, the controller 20 generates voltage control data that is used in the control for generating the voltage value thus stored, and transmits the voltage control data to a security device 10. The security device 10 generates a voltage in accordance with a voltage control signal thus received, determines specific key data associated with that voltage value, and then authenticates the controller 20 by comparing this specific key data with prestored specific key data.

Description

  The present invention relates to a method, apparatus and system for performing authentication between two apparatuses.

  There is an authentication technique for confirming whether or not various control devices (for example, inverter devices) are genuine products. In this type of technology, generally, a key for authenticating the device to be authenticated is stored in various control devices that are devices to be authenticated, and the device to be authenticated is included in an authentication device that authenticates the device to be authenticated. Remember the key. The authentication device collates the key stored in the device to be authenticated with the key stored in the authentication device, and determines that the device to be authenticated is a genuine product if they match.

  Patent Document 1 discloses a system that authenticates whether or not the device to be authenticated is a genuine product by using an encryption algorithm. In the authentication system of Patent Document 1, an authentication device (host computer) generates a plurality of random numbers, stores them, and transmits them to an authenticated device (small information device). The device to be authenticated selects any one of the plurality of received random numbers, performs a calculation based on a predetermined encryption algorithm on the selected random number, generates a processed signal, and transmits the generated processed signal to the authentication device . The authentication device receives the processed signal from the device to be authenticated, and performs a calculation based on a predetermined encryption algorithm on the plurality of stored random numbers to generate a plurality of determination calculation results used for determining a genuine product. Then, the security device collates the received processed signal with the generated plurality of determination calculation results, and when the processed signal matches any of the plurality of determination calculation results, the device to be authenticated is a genuine product. Judge.

  Patent Document 2 discloses a technology in which a microprocessor unit (hereinafter referred to as MPU) that executes an authentication / encryption algorithm, a program that executes the algorithm, and a memory that records an encryption key are integrated into an IC. According to this technique, it is possible to make it difficult to read the encryption key to the outside of the IC.

JP 2008-187679 A JP 2005-94128 A

  In the authentication technology that collates the key stored in the device to be authenticated and the key stored in the device, the communication frame including information indicating the key is generally exchanged between the authentication device and the device to be authenticated. ing. For this reason, there exists a problem that a key is easily acquired by eavesdropping etc.

  Since the technology disclosed in Patent Document 1 cannot determine which random number the authenticated device has selected even if the contents of the communication frame are known by eavesdropping or the like, the authentication algorithm can be easily decoded. There is an effect that it is not possible. In addition, since the technique disclosed in Patent Document 2 is difficult to read out the encryption key outside the IC, it is difficult to receive unauthorized authentication. However, since the techniques disclosed in Patent Documents 1 and 2 need to be provided with a function to execute an encryption algorithm in the device to be authenticated, there is no memory capacity capable of storing an encryption program, and the operation clock frequency is low. There is a problem that it cannot be applied to authentication of a device to be authenticated that is equipped with an inexpensive microprocessor unit with low calculation capability.

  The present invention has been made in view of the above circumstances, and makes it difficult to obtain a key for authenticating a device to be authenticated without performing an operation based on an encryption algorithm, and has high confidentiality. The purpose is to provide technical means for authentication.

  According to the authentication method of the present invention, an analog signal value is associated with key data, the analog signal value is stored in the device to be authenticated, and a digital signal indicating the analog signal value is transmitted from the device to be authenticated to the authentication device. The authentication device converts the digital signal transmitted by the device to be authenticated into an analog signal value, obtains key data associated with the analog signal value, and compares the key data with previously stored key data. The authentication target device is authenticated. Here, although expressed as a method, it may be realized by an apparatus and a system.

  According to the present invention, the digital signal sent from the device to be authenticated to the authentication device indicates an analog signal value and does not indicate key data. Therefore, even if this digital signal is intercepted, the key data cannot be obtained directly from this digital signal. In order to restore the key data, it is necessary to acquire both the analog signal value indicated by the digital signal and information on the method for generating the key data from the analog signal value. Have difficulty. Therefore, it is possible to effectively prevent a third party from receiving unauthorized authentication.

It is a block diagram which shows the structure of the authentication system 1 which is one Embodiment of this invention. It is a block diagram which shows the structure of the communication data conversion part 150 (250) of the security apparatus 10 in the embodiment. It is a waveform diagram which shows the charge waveform of the electrical storage apparatus 11 of the communication data conversion part 150 (250). It is a waveform diagram which shows the charge waveform of the electrical storage apparatus 11 of the communication data conversion part 150 (250). It is a waveform diagram which shows the charge waveform of the electrical storage apparatus 11 of the communication data conversion part 150 (250). It is a sequence diagram which shows the authentication flow of the control apparatus 20 in the embodiment. It is a sequence diagram which shows the update flow of the specific key data of the control apparatus 20 in the embodiment. It is a figure which illustrates the content of the voltage correspondence table used in other embodiment of this invention.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of an authentication system 1 according to an embodiment of the present invention. The authentication system 1 includes a security device 10, a control device 20, and a communication line 30 connecting both. Here, the control device 20 is a device to be authenticated that is an electronic device to be authenticated, such as an inverter device or a vending machine. The security device 10 is an authentication device that authenticates the control device 20. The security device 10 and the control device 20 perform bidirectional serial communication via the communication line 30. The communication line 30 may be capable of bidirectional communication, or may be provided with separate communication lines for transmission and reception. Further, in FIG. 1, one control device 20 and one security device 10 are illustrated, but normally, one security device 10 can perform authentication of a plurality of control devices 20.

  In the present embodiment, the security device 10 stores unique key data of the regular control device 20. On the other hand, the control device 20 stores not the unique key data itself but voltage data which is an analog signal value within a range associated with the unique key data, specifically, a digital signal indicating a voltage value. When receiving the authentication of the security device 10, the control device 20 transmits voltage control data (digital signal) for generating a voltage indicated by the stored voltage data to the security device 10 via the communication line 30. The security device 10 generates a voltage according to the voltage control data received from the control device 20, and generates unique key data associated with the range to which the voltage value belongs. Then, the security device 10 compares the generated unique key data with the unique key data of the regular control device 20 stored in advance, and if the two match, the authentication result is passed, and the control device 20 is permitted to operate. give. The above is the outline of the authentication system 1.

  Next, the configuration of each of the security device 10 and the control device 20 in the present embodiment will be described. The control device 20 includes a control unit 210, a communication interface (hereinafter referred to as communication I / F) 220, a storage unit 230, a communication data generation unit 240, and a communication data conversion unit 250.

  The control unit 210 is configured by, for example, a CPU (Central Processing Unit) and the like. The control unit 210 controls each unit in the control device 20 for receiving authentication of the security device 10 and functions original to the control device 20. (For example, in the case of an inverter device, control for performing power conversion) is performed.

  The communication I / F 220 exchanges communication frames with the security device 10 according to a predetermined communication protocol under the control of the control unit 210. The storage unit 230 includes a volatile storage unit 231 and a nonvolatile storage unit 232. The volatile storage unit 231 is, for example, a RAM (Random Access Memory), and is used as a work area by the control unit 210. The nonvolatile storage unit 232 is, for example, a hard disk drive. In the nonvolatile storage unit 232, voltage data 232a corresponding to the unique key data of the control device 20 is stored. The relationship between the unique key data and the voltage data 232a will be described as follows.

  In the present embodiment, the unique key data consists of n symbols, and each symbol takes one of m values. Here, n is an integer of 1 or more and m is an integer of 2 or more. In this example, n is an integer of 2 or more, and m is 2 (that is, symbol = bit).

  In the present embodiment, voltage data 232a is generated for each of n symbols constituting the unique key data. Each voltage data 232a represents a value of each of n symbols constituting the unique key data. In the present embodiment, a certain voltage range is divided into m ranges corresponding to the m values of the symbol. Then, for each symbol constituting the unique key data, a voltage range associated with the value of the symbol is obtained, and voltage data 232a indicating one voltage value belonging to the range is generated.

  Here, the voltage data 232a generated for one symbol may indicate an arbitrary voltage value within a range associated with the value of the symbol. That is, the voltage data 232a is redundant with respect to the symbol value, and one symbol value can be expressed by a plurality of types of voltage data 232a.

  The nonvolatile storage unit 232 stores voltage data 232a for n symbols generated in this way.

  When the control device 20 receives authentication of the security device 10, the communication data generation unit 240 reads the voltage data 232 a for n symbols from the nonvolatile storage unit 232 according to an instruction from the control unit 210, and each voltage data 232 a indicates This is a device that generates voltage control data for generating a voltage of a voltage value on the security device 10 side and transmits the voltage control data to the security device 10 via the communication I / F 220.

The communication data conversion unit 250 is a means provided in the control device 20 for key update. In this embodiment, the unique key data of the control device 20 may be updated. In this case, voltage control data for n symbols corresponding to the new unique key data is transmitted from the security device 10 to the control device 20. In that case, the communication data conversion unit 250 receives the voltage control data for n symbols transmitted from the security device 10 via the communication I / F 220 and generates a voltage according to each of the voltage control data for n symbols. . Then, each voltage data 232 a indicating a voltage for n symbols generated according to each voltage control data is stored in the nonvolatile storage unit 232.
The above is the configuration of the control device 20.

  The security device 10 includes a control unit 110, a communication I / F 120, a storage unit 130, a communication data generation unit 140, a communication data conversion unit 150, an authentication unit 160, and a key generation unit 170.

  The control unit 110 includes, for example, a CPU and controls each unit of the security device 10 for authenticating the control device 20. The communication I / F 120 exchanges communication frames with the control device 20 according to a predetermined communication protocol under the control of the control unit 110. The storage unit 130 includes a volatile storage unit 131 and a nonvolatile storage unit 132. The volatile storage unit 131 is, for example, a RAM, and is used as a work area by the control unit 110. The nonvolatile storage unit 132 is, for example, a hard disk drive. The non-volatile storage unit 132 stores unique key data 132a and a voltage correspondence table 132b of the control device 20. Here, the voltage correspondence table 132b is a table showing a voltage range corresponding to each of m values (here m = 2, symbol values = 0, 1) that each symbol of the unique key data can take. .

  When the control device 20 is authenticated, the communication data conversion unit 150 receives voltage control data for n symbols from the control device 20 via the communication I / F 120, generates a voltage according to each voltage control data, and stores it in a nonvolatile memory. Based on the voltage correspondence table 132b in the unit 132, the value of each symbol associated with each range to which those voltage values belong is obtained.

  The authentication unit 160 compares the unique key data composed of n symbols obtained by the communication data conversion unit 150 with the unique key data 132a in the nonvolatile storage unit 132. If the two match, the authentication passes, and if they do not match, the authentication passes. Outputs the fail judgment result.

The key generation unit 170 and the communication data generation unit 140 are means for updating the unique key data 132a of the control device 20. When updating the unique key data 132 a applied to the control device 20, the key generation unit 170 generates unique key data 132 a to be newly applied and stores it in the nonvolatile storage unit 132. The communication data generation unit 140 generates voltage data for each symbol of the unique key data 132a newly applied to the control device 20, and generates voltage indicated by each voltage data for the voltage data for n symbols on the control device 20 side. Voltage control data is generated and transmitted to the control device 20 via the communication I / F 120. The communication data generation unit 140 has the same configuration as the communication data generation unit 240 of the control device 20.
The above is the configuration of the security device 10.

  FIG. 2 is a block diagram illustrating the configuration of the communication data conversion unit 150 of the security device 10 and the communication data conversion unit 250 of the control device 20. As illustrated in FIG. 2, the communication data conversion unit 150 (250) includes a power storage device 11 such as a battery and a capacitor, a charge control circuit 12 that performs charge control of the power storage device 11, and a discharge that performs discharge control of the power storage device 11. It has a control circuit 13 and an MPU (Micro Processor Unit) 14 that controls the charge control circuit 12 and the discharge control circuit 13. Here, the MPU 14 includes an A / D converter 15 that converts the charging voltage of the power storage device 11 into a digital signal.

  The operation of each of the above units will be described with the communication data conversion unit 150 of the security device 10 as an example. First, during authentication of the control device 20, the MPU 14 of the communication data conversion unit 150 monitors communication data received from the security device 10 via the communication I / F 120. When the MPU 14 detects that a data frame is received from the control device 20 in accordance with a communication protocol negotiated between the security device 10 and the control device 20, the MPU 14 determines a period during which the voltage control data in the data frame is received. Then, the MPU 14 sends a charge permission command to the charge control circuit 12 at the timing when reception of the voltage control data is started. When a charge permission command is given, the charge control circuit 12 monitors each bit of the voltage control data received by serial communication, and charges the power storage device 11 according to each bit.

  FIG. 3 is a waveform diagram showing a charging voltage waveform of the power storage device 11 in this case. In this example, when a charge permission instruction is given (“charge start” timing in the figure), the charge control circuit 12 thereafter stores the power storage device 11 only during a period in which the received voltage control data continues to be “1”. Charging is performed, and charging is not performed while the voltage control data is “0”. However, instead of doing this, the power storage device 11 may be charged only during a period in which the received voltage control data is maintained at “0”.

  When the MPU 14 detects that the reception period of the voltage control data has ended, the MPU 14 causes the A / D converter 15 to perform A / D conversion of the charging voltage of the power storage device 11 at that time (“voltage value” in the figure). Read timing) Voltage data for one symbol is output to the A / D converter 15. In addition, the MPU 14 sends a discharge permission command to the discharge control circuit 13. Upon receiving this discharge permission command, the discharge control circuit 13 discharges the charge accumulated in the power storage device 11. The above operation is performed each time voltage control data for one symbol is received from the control device 20.

  The MPU 14 refers to the voltage correspondence table 132b in FIG. 1, converts the voltage data for n symbols thus obtained into the value of each symbol, and restores the unique key data composed of n symbols.

  The above is the configuration and operation of the communication data conversion unit 150. The communication data conversion unit 250 is the same as the communication data conversion unit 150.

  Next, the communication data generation unit 140 of the security device 10 and the communication data generation unit 240 of the control device 20 will be described. The communication data generation unit 140 (240) uses the communication data conversion unit 250 (150) of the opposite device 20 (10) to generate voltage control data for charging the power storage device 11 to the voltage indicated by the voltage data. Means for generating. If the circuit system in which the charging time is proportional to the charging voltage or the voltage region that can be regarded as proportional is selected and the voltage correspondence table 132b is set, the charging voltage is simply expressed by the number of bits that instruct charging. That is, when the charge control circuit 12 performs the power storage device 11 only during a period in which the voltage control data is “1”, for example, the number of bits “1” in the voltage control data can be increased in proportion to the voltage value indicated by the voltage data. That's fine. Such processing can also be executed by an inexpensive MPU. In addition, since there may be a plurality of patterns of voltage control data capable of generating the voltage indicated by the same voltage data, the unique key data is estimated from the voltage control data if the pattern of the voltage control data is changed each time authentication is performed. Can be extremely difficult.

  Various modes of transmission of voltage control data between the control device 20 and the security device 10 can be considered. In the example shown in FIG. 4, the voltage control data is divided into a plurality of data frames and transmitted. In FIG. 4, a start data frame ST is a data frame indicating that voltage control data starts from the next data frame. In the illustrated example, the data frames D0 and D1 after the start data frame ST and the subsequent end data frame ED include each part of the bit string of the voltage control data. When the MPU 14 receives the start data frame ST, the MPU 14 cancels the discharge permission for the discharge control circuit 13 and permits the charge control circuit 12 to perform the charge control. Thereafter, the charge control circuit 12 monitors the voltage control data included in the received data frames D0, D1, and ED, and charges the power storage device 11 while the voltage control data is “1”. When the MPU 14 receives the end data frame ED, the MPU 14 cancels the charging permission for the charging control circuit 12, converts the charging voltage of the power storage device 11 into voltage data that is a digital signal by the A / D converter 15, and discharge control. The circuit 13 is allowed to discharge.

  After the end data frame ED is received, the power storage device 11 is not charged by the charge control circuit 12 until the start data frame ST is received. Therefore, the data frame D2 after the end data frame ED becomes invalid data for charge control.

  Note that when the charge control circuit is configured to perform charging even when there is no communication between reception of the start data frame ST and reception of the end data frame ED, the communication interval is also a factor in charge control.

  FIG. 5 is a waveform diagram showing an operation when the voltage control data is transmitted without using the end data frame ED while fixing the number of data frames carrying the voltage control data. In this aspect, the MPU 14 knows the reception end timing of all voltage control data by counting the number of received data frames from the reception of the start data frame ST, and performs A / D conversion on the A / D converter 15 at that timing. Since it can be executed, it is not necessary to use the end data frame ED.

  FIG. 6 is a sequence diagram showing an authentication flow of the control device 20 by the security device 10 in the present embodiment. In the present embodiment, an authentication start request is transmitted from the security device 10 to the control device 20 in response to an irregular event such as the installation of the control device 20 or a periodic event by a timer, and the control device 20 by the security device 10 Authentication starts.

  In order for the control device 20 to be authenticated by the security device 10, it is necessary to notify the security device 10 of the unique key data of the control device 20. Therefore, the control device 20 generates and transmits voltage control data for generating a voltage value representing each symbol of the unique key data in the security device 10.

  In the example of FIG. 6, the unique key data is configured by eight symbols (bits), and eight voltage data 232 a indicating the value of each symbol is stored in the nonvolatile storage unit 232 of the control device 20. Then, the security device 10 sends a key request to the control device 20 as a response request (Request), and generates a voltage value associated with each symbol of the unique key data as a response (Response) to the key request. The operation of receiving is repeated.

  The voltage data of the first symbol of the unique key data has a voltage value of 1.25V. The communication data generation unit 240 of the control device 20 generates voltage control data 10000001b (b is a binary number) for generating the voltage value 1.25 V in the security device 10, and the security device 10 via the communication I / F 220. Send to.

When the communication data conversion unit 150 of the security device 10 receives the voltage control data 10000001b, the communication data conversion unit 150 performs charge control of the power storage device 11 in accordance with the voltage control data 10000001b, and performs A / D conversion on the charge voltage value of the power storage device 11 to generate a voltage. Get the data. The obtained voltage data of 1.25V is converted to 1 according to the voltage correspondence table 132b, and bit 0 of the unique key data becomes 1.
The control device 20 and the security device 10 repeat this procedure eight times in total.

  In the example shown in FIG. 6, in the voltage correspondence table 132b, all the voltage values in the range of 0.30V or more and 2.50V or less are associated with 1, and the voltage value in the range of 2.50V or more and 4.70V or less. Is associated with 0. Accordingly, eight voltage control data for generating the eight voltage values shown in FIG. 6 are sent to the security device 10, and charging voltages 1.25V, 1.875V, 0, for example, according to the eight voltage control data. .625V, 4.375V, 1.25V, 1.875V, 0.625V, and 4.375V are obtained, three of these voltages 1.25V, 1.875V, and 0.625V are converted to 1. The voltage 4.375V is converted to zero. As a result, 1-byte unique key data 01110111b is obtained.

  In the example shown in FIG. 6, the unique key data is 1 byte, but the size of the unique key data may be freely defined in the authentication system 1. Further, in the example shown in FIG. 6, the security device 10 assigns 1.25 V charged first to bit 0, but the order of assignment may be freely defined in the authentication system 1.

  The security device 10 compares the unique key data obtained by such means with the unique key data 132a stored in advance in the nonvolatile storage unit 132, and the result is sent to the control device 20 as an authentication result notification (Request). send. The control device 20 determines the operation of the control device 20 based on the authentication result.

FIG. 7 is a sequence diagram showing an operation flow when the unique key data of the control device 20 is updated. As a premise of the key update, the security device 10 authenticates the control device 20 before performing the key update so that the key update is not performed on the illegally installed control device (see FIG. 6).
When an irregular event such as the installation of the control device 20 or a periodic event by a timer occurs, the security device 10 sends a key update request (Request) to the control device 20. Upon receiving this key update request, the control device 20 returns a key update request response (Response) to the security device 10.

  In order to update the unique key data of the control device 20, it is necessary to notify the unique key data generated inside the security device 10 to the control device 20. Specifically, the security device 10 converts each symbol of the generated new unique key data into a voltage using the voltage correspondence table 132b, and generates and transmits voltage control data for causing the control device 20 to generate the voltage. .

  In the example of FIG. 7, the security device 10 converts each bit of the new unique key data 01110111b into a voltage value using the voltage correspondence table 132b. Then, the security device 10 generates voltage control data 00000011b for causing the control device 20 to generate the first voltage value of 1.25 V, and transmits a response request (Request) including this voltage control data to the control device 20. When the control device 20 receives the voltage control data 00000011b, it returns a receipt notification Ack to the security device 10 as a response. In addition, control device 20 obtains a digital value of a charging voltage value obtained by charging power storage device 11 in accordance with voltage control data 00000011b.

  When the unique key data consists of 8 symbols, the above procedure is repeated 8 times. As a result, the control device 20 acquires eight voltage values representing each bit of the new unique key data, and stores the voltage data indicating each voltage value in the nonvolatile storage unit 232. The authentication of the control device 20 from the next time is performed using new unique key data (voltage data).

  As described above, in the present embodiment, not the unique key data but the digital signal indicating the voltage value associated with the unique key data (more specifically, the voltage control for controlling the operation for obtaining the voltage value). Data) is sent from the control device 20 to the security device 10, and the security device 10 generates a voltage value from the received digital signal and obtains unique key data associated with this voltage value. Even if a digital signal transmitted to is intercepted, it is difficult to generate unique key data from the digital signal, and it is possible to prevent a third party from being authenticated illegally.

  In the present embodiment, the control device 20 stores voltage data indicating an arbitrary voltage value within the voltage value range associated with the symbol value of the unique key data, and generates a voltage indicated by the voltage data. Voltage control data is generated and sent from the control device 20 to the security device 10. Therefore, even if the voltage control data sent from the control device 20 to the security device 10 is intercepted by a third party, it is extremely difficult to generate unique key data from this voltage control data. Therefore, it is possible to effectively prevent a third party from receiving unauthorized authentication.

  In this embodiment, no encryption program is used for the authentication process. Therefore, the present embodiment can also be applied to authentication of a device to be authenticated having an inexpensive and low-performance MPU and a small-capacity program memory.

<Other embodiments>
Although one embodiment of the present invention has been described above, other embodiments are conceivable for the present invention. For example:

(1) In the above embodiment, each symbol constituting the unique key data is a binary symbol (bit). However, the unique key data may be composed of multi-value symbols other than binary. FIG. 8 is a diagram showing an example of the voltage correspondence table 132b when each symbol of the unique key data is 10 values (decimal number). The m value symbol m may be set to 16, for example, other than 10. This m may be determined according to the resolution of the A / D converter 15 and the allowable error between the security device 10 and the control device 20.

(2) For example, depending on parameters relating to the circuit configuration of the communication data conversion unit 250, such as a current value and input voltage used by the communication data conversion unit 250 of the control device 20 to charge the power storage device 11, circuit parameters of the charge control circuit 12, etc. The charging time until the charging voltage of the device 11 reaches a specific voltage value changes. For this reason, if these parameters change, it is necessary to change the voltage control data generated from the voltage data accordingly. Therefore, the communication data conversion unit 250 is configured so that the method and circuit constants of the charging control circuit 12 can be changed, and the control device 20 notifies the security device 10 of parameters relating to the circuit configuration of the communication data conversion unit 250. . The security device 10 notifies the content of the voltage control data generated from the voltage data by the communication data generation unit 140 so that the communication data conversion unit 250 of the control device 20 can generate the voltage value indicated by the voltage data. Change based on the specified parameters. In this way, the security device 10 sends voltage control data that can generate a voltage value corresponding to the unique key data to the control device 20 having the communication data conversion unit 250 having various configurations. be able to.

(3) In the authentication system 1 according to the above embodiment, the communication between the security device 10 and the control device 20 is wired communication via the communication line 30, but is not limited to this mode. For example, communication between the security device 10 and the control device 20 may be wireless communication or infrared communication.

(4) In the above embodiment, the symbol of the unique key data is associated with the voltage value, but may be associated with an analog signal value other than the voltage value, for example, a current value. Specifically, the range that the current value can take is divided into m ranges each corresponding to the m value of the symbol. Then, for each symbol constituting the unique key data applied to the control device 20, a current value range corresponding to the value of the symbol is obtained, and an arbitrary current value within the range is used as a current value indicating the symbol. 20 is stored. At the time of authentication, the control device 20 generates current control data for generating a current having a current value corresponding to each symbol of the unique key data on the security device 10 side, and transmits the current control data to the security device 10. The security device 10 generates a current according to the current control data received from the control device 20, and obtains the symbol value of the unique key data corresponding to the range to which the current value belongs. In this aspect, the same effect as the above embodiment can be obtained.

DESCRIPTION OF SYMBOLS 1 ... Authentication system, 10 ... Security apparatus, 20 ... Control apparatus, 30 ... Communication line, 110, 210 ... Control part, 120, 220 ... Communication I / F, 130, 230 ... Memory | storage part, 131,231 ... Volatile memory , 132, 232 ... non-volatile storage unit, 132b ... voltage correspondence table, 132a ... unique key data of control device, 140, 240 ... communication data generation unit, 150, 250 ... communication data conversion unit, 160 ... authentication unit, 170 ... Key generator.

Claims (10)

Associating the analog signal value with the key data, storing the analog signal value in the device to be authenticated,
A digital signal indicating the analog signal value is transmitted from the device to be authenticated to the authentication device;
The authentication device converts the digital signal transmitted by the device to be authenticated into an analog signal value, obtains key data associated with the analog signal value, and compares the key data with key data stored in advance. An authentication method characterized by authenticating a device to be authenticated. Associating a range of analog signal values with key data, storing any analog signal value belonging to the range associated with the key data in the device to be authenticated,
Transmitting a digital signal indicating the analog signal value from the device to be authenticated to the authentication device;
The authentication device converts a digital signal transmitted by the device to be authenticated into an analog signal value, obtains key data associated with a range to which the analog signal value belongs, and compares the key data with previously stored key data The authentication method according to claim 1, wherein the authentication target device is authenticated. The key data is composed of one or a plurality of m-value symbols (m is an integer of 2 or more),
Dividing the possible range of analog signal values into m ranges each corresponding to the m value of the symbol,
For each symbol constituting the key data applied to the device to be authenticated, a range of analog signal values corresponding to the value of the symbol is obtained, and an arbitrary analog signal value within the range is used as an analog signal value indicating the symbol. Store it in the device to be authenticated,
A digital signal indicating an analog signal value indicating each symbol of the key data is transmitted from the device to be authenticated to the authentication device;
The authentication device converts each digital signal transmitted by the device to be authenticated into an analog signal value indicating each symbol, and determines each symbol of key data associated with a range to which the analog signal value indicating each symbol belongs, The authentication method according to claim 2, wherein the authentication target device is authenticated by comparing the key data with previously stored key data. An authenticated device that stores an analog signal value associated with key data and transmits a digital signal indicating the analog signal value;
An authentication device that obtains key data associated with an analog signal value indicated by a digital signal transmitted by the device to be authenticated, and authenticates the device to be authenticated by comparing the key data with key data stored in advance. An authentication system characterized by that.   The authentication device includes means for measuring a voltage value of an analog signal obtained from a digital signal transmitted by the device to be authenticated, and converts the measurement result of the voltage value based on a correspondence table stored in advance. The authentication system according to claim 4, wherein key data is generated. The authentication device generates an analog signal value from key data applied to authentication of the device to be authenticated, transmits a digital signal indicating the analog signal value to the device to be authenticated,
The authentication system according to claim 4 or 5, wherein the authentication target device converts a digital signal transmitted by the authentication device into an analog signal value and stores the analog signal value. The device to be authenticated transmits a parameter of a circuit that converts a digital signal transmitted by the authentication device into an analog signal value to the authentication device,
The authentication apparatus changes a digital signal generated from the analog signal value so that the analog signal value is generated in the authenticated apparatus based on a parameter received from the authenticated apparatus. The authentication system according to any one of claims 4 to 6. Storage means for storing key data of the device to be authenticated;
Communication means for receiving a digital signal from the device to be authenticated;
A communication data conversion means for converting a digital signal received from the device to be authenticated into an analog signal value, and converting the analog signal value into key data;
An authentication device comprising: authentication means for authenticating the device to be authenticated by comparing the key data obtained by the communication data conversion means and the key data stored in the storage means.   The communication data conversion unit includes a charge / discharge circuit that charges and discharges the power storage device according to the digital signal received by the communication unit, and generates key data based on a charge voltage value of the power storage device. The authentication device according to claim 8.   10. A communication data generating unit that generates an analog signal value from key data applied to the authentication target device and transmits a digital signal indicating the analog signal value to the authentication target device. The authentication device described in 1.

Images