JP2018093372A - Authentication method, authenticated device and authentication device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the volume of information stored, in an authentication device and an authenticated device, for authentication of the authenticated device by the authentication device.SOLUTION: An authenticated device holds multiple master keys and multiple descendant keys corresponding, respectively, to the multiple master keys and generated with any one of one or more descendant values, smaller than the number of the multiple master keys, as an input of unidirectional function as non-publication information. An authentication method includes a step of notifying an authenticated device of the identifier of a first master key that is one of the master keys from an authentication device, a step of acquiring a first authentication value, generated by the authentication device on the basis of a first descendant key corresponding to the first master key, by the authentication device, a step of acquiring the first descendant value used for generation of the first descendant key from the authenticated device by the authentication device, a step of obtaining a second authentication value on the basis of the first master key and the first descendant value by the authentication device, and a step of comparing the first authentication value and the second authentication value.SELECTED DRAWING: Figure 4

Description

  The present invention relates to an authentication technique for a device to be authenticated by an authentication device.

  Japanese Patent Application Laid-Open No. 2005-228561 discloses a configuration for identifying whether or not a cartridge that is a component mounted on an image forming apparatus is a regular one. According to Patent Document 1, an IC chip is provided in a regular cartridge, and whether or not the cartridge is a genuine product by collating secret authentication data stored in the IC chip with secret authentication data stored in the image forming apparatus. Judging. Further, Patent Document 2 discloses a configuration that improves identification performance by switching a plurality of secret authentication data according to applications.

  When a component including an IC chip is an authenticated device, an apparatus on which the component is mounted is an authentication device, and the authentication device verifies the authenticity of the authenticated device, the secret authentication data differs for each authenticated device. In this way, authentication can be advanced and diversified. In addition, for example, a plurality of secret authentication data is stored in the device to be authenticated, and the authentication is advanced by changing the secret authentication data used for authentication according to the number of times the device to be authenticated is attached to the authentication device.・ Can be diversified.

JP 2009-163208 A JP 2013-62780 A

  However, when the secret authentication data to be used is different for each device to be authenticated, or when a plurality of secret authentication data is used in the authentication device, the amount of information stored in each of the device to be authenticated and the authentication device is large. Become.

  The present invention reduces the amount of information stored in the authentication device and the device to be authenticated for authentication of the device to be authenticated by the authentication device.

According to one aspect of the present invention, there is provided an authentication method for an authenticated device by an authentication device, wherein the authenticated device includes a plurality of master keys and one or more derived values that are less than the number of master keys. A plurality of derived keys corresponding to each of the plurality of master keys generated as one-way function input as private information, the identifiers of the plurality of master keys, and the one or more As a public information, the authentication device holds at least one master key of the plurality of master keys as private information, and the authentication method is performed by the authentication device. A step of notifying the device to be authenticated of an identifier of one of the master keys held as information, and the device to be authenticated as a response to the step of notifying by the authentication device. Obtaining a first authentication value generated by the device to be authenticated based on a first derivative key corresponding to the first master key; and generating the first derivative key from the device to be authenticated by the authentication device Obtaining a first derived value used for the first authentication value, a step in which the authentication device obtains a second authentication value based on the first master key and the first derived value, and the first authentication value and the first 2 comparing authentication values;
It is characterized by including.

  According to the present invention, it is possible to reduce the amount of information stored in the authentication device and the device to be authenticated for authentication.

The block diagram of the authentication system by one Embodiment. The block diagram of the IC chip and authentication value generation part by one Embodiment. Explanatory drawing of each information by one Embodiment. The flowchart of the authentication method by one Embodiment. Explanatory drawing of each information by one Embodiment.

  Hereinafter, exemplary embodiments of the present invention will be described with reference to the drawings. In addition, the following embodiment is an illustration and does not limit this invention to the content of embodiment. In the following drawings, components that are not necessary for the description of the embodiments are omitted from the drawings.

<First embodiment>
FIG. 1 shows an authentication system according to this embodiment. The authentication system includes an authentication target device 100 to be authenticated and an authentication device 102 that authenticates the authentication target device 100. For example, the device to be authenticated 100 operates by being attached to the authentication device 102. As an example, the authentication apparatus 102 is an image forming apparatus, and the authentication target apparatus 100 is a toner cartridge of the image forming apparatus. In this case, when the authentication device 102 that is an image forming apparatus authenticates the toner cartridge that is the authentication target device 100 that is attached and determines that the authentication is successful, that is, the toner cartridge is valid, the authentication device 102 uses the cartridge. Enable the operation. On the other hand, if the authentication is unsuccessful, that is, it is determined that the toner cartridge is unauthorized, the operation using the cartridge is prohibited, and for example, the user is notified of the unauthorized product. The device to be authenticated 100 includes an IC chip 101 that generates an authentication value for authentication and communicates with the authentication device 102. The authentication device 102 is a communication unit 103 that communicates with the IC chip 101, a control unit of the authentication device 102, a control CPU 104 that controls authentication processing, and an authentication value that generates an authentication value for authentication of the IC chip 101. A generation unit 105.

  The configurations of the IC chip 101 and the authentication value generation unit 105 are the same as shown in FIG. The CPU 201 executes a program stored in the program memory 202 and performs an authentication value calculation process and the like. The private memory 203 is a private information storage unit that stores data kept secret from the outside. The public memory 204 is a public information storage unit that stores data that is not secret and can be read from the outside. The communication unit 205 outputs a command received from the outside to the CPU 201 and outputs a response to the command received from the CPU 201 to the outside. Note that the private memory 203 and the public memory 204 do not need to be physically different memories, but use an area of the physically identical memory for storing secret data, and other areas are secret. It may be a configuration used for storing public data.

  3A shows information stored in the public memory 204 and the private memory 203 of the IC chip 101, and FIG. 3B shows the information stored in the public memory 204 and the private memory 203 of the authentication value generation unit 105. Information to be displayed. In the present embodiment, n (n is an integer of 2 or more) master keys are used. Hereinafter, the n master keys are denoted as master keys # 1 to #n. Each master key is given an identifier (key ID) for identifying the key. Hereinafter, the identifier of the master key #x (x is an integer from 1 to n) will be referred to as a key ID #x. As shown in FIG. 3C, the key IDs # 1 to #n and the master keys # 1 to #n are held by an external device omitted in FIG. In the present embodiment, as shown in FIG. 3B, the private memory 203 of the authentication value generation unit 105 stores one master key #k (k is any number from 1 to n) out of n master keys. Or one integer) is stored. In the public memory 204 of the authentication value generation unit 105, the master key identifier stored in the private memory 203 is stored. In FIG. 3B, the master key stored in the private memory 203 of the authentication value generation unit 105 is the master key # 1, and thus the public memory 204 stores the key ID # 1.

  In the present embodiment, n derived keys are generated from each of n master keys and derived values. Then, as shown in FIG. 3A, the n derived keys are stored in the private memory 203 of the IC chip 101 in advance. The n derived keys are denoted as derived keys # 1 to #n. Derived key #x is generated by using master key #x and a derived value as inputs for one-way function f. That is, derived key # x = f (master key #x, derived value). In this way, the derived keys # 1 to #n are generated with the same derived value and different master keys. Even if the derived key #x and the derived value are known due to the characteristic of the one-way function, it is very difficult to obtain the master key #x. The public memory 204 of the IC chip 101 also stores the key ID #x of the master key #x that is the source for generating the derived key #x. Furthermore, the derived value is also stored in the public memory 204 of the IC chip 101.

  FIG. 4 is a flowchart of an authentication method executed by the control CPU 104 of the authentication device 102. The process of FIG. 4 can be executed, for example, when the device to be authenticated 100 is attached to the authentication device 102. If the authentication apparatus 102 is turned off when the authentication target apparatus 100 is attached to the authentication apparatus 102, the process shown in FIG. 4 is executed when the authentication apparatus 102 is turned on after the authentication target apparatus 100 is attached. can do. In step S <b> 10, the control CPU 104 acquires information in the public memory 204 of the IC chip 101 from the IC chip 101. In the present embodiment, derived values and key IDs # 1 to #n are acquired. In S <b> 11, the control CPU 104 acquires information stored in the public memory 204 of the authentication value generation unit 105. In the present embodiment, the key ID # 1 is acquired. In S12, the control CPU 104 notifies the IC chip 101 of the key ID # 1 stored in the public memory 204 of the authentication value generation unit 105. The CPU 201 of the IC chip 101 uses the derived key # 1 corresponding to the notified key ID # 1 to generate a first authentication value. How to calculate the first authentication value from the derived key # 1 is determined in advance. The IC chip 101 transmits the obtained first authentication value to the control CPU 104. In addition, the control CPU 104 notifies the authentication value generation unit 105 of the key ID # 1 and the derived value acquired from the IC chip 101. The CPU 201 of the authentication value generation unit 105 can obtain the derived key # 1 using the one-way function from the master key # 1 corresponding to the notified key ID # 1 and the derived value. Then, the CPU 201 of the authentication value generation unit 105 generates the second authentication value by the same calculation method as the calculation method in the IC chip 101 using the obtained derivative key # 1. The control CPU 104 acquires the second authentication value from the authentication value generation unit 105. In step S14, the control CPU 104 determines whether the first authentication value and the second authentication value match. If the first authentication value matches the second authentication value, the control CPU 104 determines that the authentication is successful in S15, that is, the device 100 to be authenticated is valid. On the other hand, if the first authentication value and the second authentication value do not match, the control CPU 104 determines that the authentication is unsuccessful in S16, that is, the device to be authenticated 100 is not valid. For example, a message authentication code (MAC) can be used for the calculation of the first authentication value and the second authentication value.

  In this embodiment, since only one master key is stored in the authentication value generation unit 105, the control CPU 104 acquires only the derived value stored in the public memory 204 of the IC chip 101 in S10. It may be configured to do so. Further, in S13, only the derived value may be notified to the authentication value generation unit 105.

  For example, when the master key # 1 is leaked, the external device causes the authentication device 102 to delete the master key # 1 via the network or the like, and any one of the master keys # 2 to #n is authenticated. Are stored in the private memory 203 and the public memory 204 is also updated accordingly. With this configuration, even when the master key of the authentication device 102 is leaked, it is possible to verify the validity of the authenticated device 100 that is already distributed. The external device is a device owned by the manufacturer of the authentication device. Further, for example, the derived value of the IC chip 101 included in each authentication target device 100 may be a value that differs for each IC chip. In this case, the derived key #x stored in each IC chip 101 is generated using the same master key #x, but differs because the derived values are different. Therefore, authentication can be advanced and diversified. For example, it is assumed that the derived value and the derived keys # 1 to #n of a certain device to be authenticated 100 have flowed out, and the authentication value calculation method has also flowed out. In this case, the authentication by the authentication device 102 can be successful by attaching the counterfeit IC chip having the derivative value and the derivative keys # 1 to #n and calculating the same authentication value to the counterfeit product. However, for example, when the external device notifies the authentication device 102 of the derived value that has flowed out, and the authentication device 102 receives the derived value that has been notified of the outflow from the device to be authenticated 100, authentication failure can be achieved. Thereby, the authenticity of the to-be-authenticated apparatuses 100 already distributed can be verified. Note that the data length of the derived value is sufficiently long in order to make the derived value of each authenticated device 100 different. However, in the present embodiment, one derivative value is stored in one IC chip 101, and the memory capacity required for the IC chip 101 is smaller than using a different derivative value for each derivative key.

<Second embodiment>
Next, the second embodiment will be described focusing on the differences from the first embodiment. FIG. 5 shows information stored in the public memory 204 and the private memory 203 of the authentication value generation unit 105 in the present embodiment. In this embodiment, the information stored in the public memory 204 and the private memory 203 of the IC chip 101 is the same as that in the first embodiment, that is, as shown in FIG. In the first embodiment, the authentication value generation unit 105 holds one master key #k (k is any one of 1 to n). In the present embodiment, the authentication value generation unit 105 holds m master keys (m is an integer of 2 or more and n or less) among the master keys # 1 to #n. In FIG. 5, the private memory 203 of the authentication value generation unit 105 holds master keys # 1 to #m. Thereby, the public memory 204 of the authentication value generation unit 105 holds the key IDs # 1 to #m.

  In the present embodiment, the processing executed by the control CPU 104 of the authentication apparatus 102 is the same as that of the first embodiment, and will be described below with reference to the flowchart of FIG. In step S <b> 10, the control CPU 104 acquires information in the public memory 204 of the IC chip 101 from the IC chip 101. In the present embodiment, derived values and key IDs # 1 to #n are acquired. In S <b> 11, the control CPU 104 acquires information stored in the public memory 204 of the authentication value generation unit 105. In this embodiment, key IDs # 1 to #m are acquired. In S12, the control CPU 104 selects any one key ID among the key IDs # 1 to #m. Here, it is assumed that the key ID #y (y is any one of 1 to m) is selected. In this case, the control CPU 104 notifies the IC chip 101 of the key ID #y in S12. The CPU 201 of the IC chip 101 uses the derived key #y corresponding to the notified key ID #y to generate a first authentication value. How to calculate the first authentication value from the derived key #y is determined in advance. The control CPU 104 acquires the first authentication value from the IC chip 101. In addition, the control CPU 104 notifies the authentication value generation unit 105 of the key ID #y and the derived value acquired from the IC chip 101. The CPU 201 of the authentication value generation unit 105 can obtain the derived key #y using the one-way function from the master key #y corresponding to the notified key ID #y and the derived value. Then, the CPU 201 generates a second authentication value by the same calculation as the calculation method in the IC chip 101 using the derived key #y that has been obtained. The control CPU 104 acquires the second authentication value from the authentication value generation unit 105. In step S14, the control CPU 104 determines whether the first authentication value and the second authentication value match. If the first authentication value matches the second authentication value, the control CPU 104 determines that the authentication is successful in S15, that is, the device 100 to be authenticated is valid. On the other hand, if the first authentication value does not match the second authentication value, the control CPU 104 determines that the authentication is unsuccessful in S16, that is, the device to be authenticated 100 is not valid.

  In the present embodiment, since the authentication value generation unit 105 holds m master keys, the amount of information stored in the authentication value generation unit 105 is larger than that in the first embodiment. However, the combination of the master key and the derived key used for authentication is different each time the device to be authenticated is attached, for example, so that authentication can be advanced and diversified. In the present embodiment, the control CPU 104 may acquire only the derived value stored in the public memory 204 of the IC chip 101 in S10.

  In each of the above embodiments, the IC chip 101 stores one derived value and n master keys generated by the derived value. However, for example, it may be configured to store two derived values of a first derived value and a second derived value. In this case, for example, the IC chip 101 is generated with the n first derived keys generated with the first derived value and each of the n master keys, and with the second derived value and each of the n master keys. A total of 2n derived keys of the n second derived keys can be stored. In this case, the IC chip 101 selects and notifies the authentication device 102 of either the first derivation value or the second derivation value during the authentication process. The calculation of the first authentication value is performed using a derived key generated based on the derived value notified to the authentication apparatus 102 and the master key of the key ID notified from the authentication apparatus 102. In this case, compared with the configuration of each embodiment, the amount of information to be stored is increased by the amount of information of the derived value, but stored in the IC chip 101 as compared with the case where each derived key is generated with a different derived value. The amount of information to be reduced can be reduced.

  Further, it is possible to generate half of the n derived keys using the first derived value and generate the remaining derived keys using the second derived value. In the authentication process in this case, the IC chip 101 first acquires the key ID used for calculating the first authentication value from the authentication device 102, and generates a derived key from the master key corresponding to the acquired key ID. The authentication device 102 is notified of the derived value used for the above. When two derived values are used, the amount of information to be stored is increased by the amount of information of the derived value as compared with the configuration of each of the above embodiments, but compared to the case where each derived key is generated with a different derived value. Thus, the amount of information stored in the IC chip 101 can be reduced. More generally, by reducing the number of derived values to be stored than the derived key, the amount of information stored in the IC chip 101 is reduced as compared with the case where each derived key is generated with a different derived value. Can be made.

[Other Embodiments]
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program This process can be realized. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

  101: IC chip, 104: Control CPU, 105: Authentication value generation unit

Claims (11)

An authentication method for a device to be authenticated by an authentication device,
The authentication target device generates the master keys generated by using any one of a plurality of master keys and one or more derived values less than the number of master keys as an input of a one-way function. Holding a plurality of derived keys corresponding to each as private information, holding each identifier of the plurality of master keys and the one or more derived values as public information,
The authentication device holds at least one master key of the plurality of master keys as private information,
The authentication method is:
The authenticating device notifying the authenticated device of an identifier of one first master key of master keys held as the non-public information;
Obtaining a first authentication value generated by the device to be authenticated based on a first derived key corresponding to the first master key from the device to be authenticated as a response to the step of notifying the authentication device;
The authenticating device obtaining a first derived value used to generate the first derived key from the authenticated device;
The authentication device determining a second authentication value based on the first master key and the first derived value;
Comparing the first authentication value and the second authentication value;
An authentication method characterized by comprising: The determining step includes:
2. The authentication method according to claim 1, further comprising the step of generating the first derived key using the first master key and the first derived value as an input of the one-way function. . Non-public information storage means for storing confidential information;
Public information storage means for storing information to be disclosed;
Computing means;
With
The private information storage means stores a plurality of derived keys,
The public information storage means stores an identifier of each of the plurality of derived keys and a number of derived values less than the number of the plurality of derived keys used to generate the plurality of derived keys,
The computing means generates an authentication value using a derivative key indicated by the identifier notified from the authentication device during authentication by the authentication device, and generates the authentication value and a derivative key indicated by the identifier notified from the authentication device. A derived value used for the authentication is transmitted to the authentication device.   4. The authenticated device according to claim 3, wherein the plurality of derived keys are generated by using each of a plurality of master keys and the derived value as an input of a one-way function. The authentication device is an image forming device,
5. The device to be authenticated according to claim 3, wherein the device to be authenticated is a component mounted on the image forming apparatus.   The apparatus to be authenticated according to claim 5, wherein the apparatus to be authenticated is a toner cartridge attached to the image forming apparatus. An authentication device comprising an authentication value generating means and an authentication processing means,
The authentication value generating means includes
Non-public information storage means for storing information concealed to the outside of the authentication value generation means;
Public information storage means for storing information to be disclosed to the outside of the authentication value generation means;
Computing means;
With
The private information storage means stores one or more master keys;
The public information storage means stores an identifier of each of the one or more master keys stored by the private information storage means;
The authentication processing means acquires a derived value from the authenticated device when authenticating the authenticated device, and notifies the authenticated device of an identifier of a first master key of the one or more master keys. Then, a first authentication value is acquired as a response, and the identifier of the first master key and the derived value are notified to the authentication value generating means, and the computing means receives the identifier of the first master key from the authentication processing means. And the derived value is notified, a second authentication value is obtained using the first master key and the derived value;
The authentication processing means authenticates the device to be authenticated by comparing the first authentication value and the second authentication value. The device to be authenticated generates one or more derived keys corresponding to the one or more master keys generated by using the one or more master keys and the derived value as inputs of a one-way function. And store as
The authentication apparatus according to claim 7, wherein the first authentication value is generated based on a first derivative key corresponding to the first master key.   The computing means generates the first derived key using the first master key and the derived value as an input of the one-way function, and obtains the second authentication value based on the first derived key. The authentication device according to claim 8.   The authentication processing means determines that the authentication of the device to be authenticated is successful when the first authentication value and the second authentication value match, and the first authentication value and the second authentication value do not match. The authentication apparatus according to claim 7, wherein authentication of the authentication target apparatus is determined to be unsuccessful. The device to be authenticated is used by being attached to the authentication device,
The authentication device enables an operation to use the device to be authenticated if the authentication of the device to be authenticated is successful, and prohibits an operation to use the device to be authenticated if the authentication of the device to be authenticated is unsuccessful. The authentication apparatus according to claim 10, wherein:

Images