JP2022077529A - Communication device, communication method, and program - Google Patents

Abstract

To provide a communication device, a communication method, and a program, capable of selectively using confidential information generated in a high authentication procedure requiring a lot of calculation amount between a plurality of devices in each device.SOLUTION: A host H acquires identification information specific for each device Dn when performing a non-contact communication between the devices Dn, determines whether or not that identification information acquired is stored so as to be associated with confidential information, executes an authentication by selecting an authentication procedure requiring a lot of calculation amounts when it is determined that the identification information acquired is not stored so as to be associated with the confidential information, and on the other hand, executes an authentication on the basis of the confidential information associated with the identification information by selecting the authentication procedure only by less calculation amount when it is determined that the identification information acquired is stored so as to be associated with the confidential information.SELECTED DRAWING: Figure 3

Description

The present invention relates to a communication device or the like that can select either an advanced authentication procedure that requires a large amount of calculation with a communication partner or a simple authentication procedure that requires a smaller amount of calculation with a plurality of communication partners. Regarding the technical field.

Among the roles of smartphones, which are increasing year by year, the role as a key to lock and unlock doors is drawing attention. Before a smartphone can be used as a door key, it is necessary to determine the combination of the lock installed on the door and the smartphone, which is the same as authenticating between an unspecified number of computers on the network. The situation. In other words, the door lock and the smartphone authenticate each other without being informed in advance that they will be combined with each other. The authentication procedure used in this situation is certificate verification using public key cryptography, and in the authentication, a technology for secretly sharing information (Diffie-Hellman, etc.) is also used, and the confidential information shared by the technology is also used. Is used as a key for common key cryptography that realizes confidential communication after authentication or as input information for generating a key. Patent Document 1 discloses a session key sharing system capable of sharing a session key without assuming that authentication at the end end is secured in advance.

Japanese Patent No. 4963425

By the way, it can be said that the authentication procedure for verifying a certificate using public key cryptography is an advanced authentication procedure that requires a large amount of calculation to obtain a verification result and requires computer resources. Therefore, in communication between an unspecified number of computers, the advanced authentication procedure is not used at the start of each communication, but the confidential information generated when the authentication is successful once is stored, and the secret information is stored at the start of the next communication. A simple authentication procedure for reusing confidential information is also available. The simple authentication procedure is composed of a common key cryptosystem that requires less calculation amount and computer resources than public key cryptography, but the secret information and the information that identifies the authentication procedure when the secret information is generated are paired. It is difficult to store the confidential information of all communication partners individually, and it is held only for a certain period of time. However, in the combination of the door lock and the smartphone, the person to be authenticated is limited, so the door lock stores the confidential information and the information that identifies the authentication procedure when the confidential information is generated as a pair. It is possible to keep it.

However, since random numbers are used for the information that identifies the authentication procedure when the confidential information is generated, the identification information changes every time the confidential information is updated through the advanced authentication procedure without changing the smartphone. , It was difficult to manage registered smartphones with locks.

Therefore, the present invention has been made in view of the above points and the like, and it is possible to properly use the confidential information generated in the advanced authentication procedure between each of a plurality of devices (communication partners) for each device. The purpose is to provide various communication devices, communication methods, and programs.

In order to solve the above problems, the invention according to claim 1 is based on an advanced authentication procedure that requires a large amount of calculation with each of a plurality of communication partners and a method for each of the plurality of communication partners. It is a communication device that can select either a simple authentication procedure that requires a small amount of calculation, and corresponds to the identification information unique to the communication partner and the secret information generated in the advanced authentication procedure for each communication partner. The storage means for attaching and storing, the acquisition means for acquiring the identification information unique to the communication partner when communication is performed with the communication partner, and the identification information acquired by the acquisition means are the secret. When it is determined that the identification information is associated with the secret information and is not stored in the storage means, and the determination means for determining whether or not the information is associated with the storage means and stored in the storage means. When the advanced authentication procedure is selected to execute authentication and it is determined that the identification information is associated with the confidential information and stored in the storage means, the simple authentication procedure is selected and the identification information is used. It is characterized by comprising an authentication means for executing authentication using the associated confidential information.

The invention according to claim 2 is the communication device according to claim 1, wherein the acquisition means transmits a predetermined command to the communication partner, and the response transmitted by the communication partner in response to the command is used. It is characterized by acquiring identification information.

The invention according to claim 3 is characterized in that, in the communication device according to claim 1, the identification information is an ID for anti-collision at the time of non-contact communication.

In the invention according to claim 4, in the communication device according to any one of claims 1 to 3, in the advanced authentication procedure, authentication is performed by signature generation and signature verification, and key exchange by a public key cryptosystem is executed. It is characterized by being done.

The invention according to claim 5 is characterized in that, in the communication device according to claim 4, one-sided authentication is executed using a random number and the confidential information in the simple authentication procedure.

The invention according to claim 6 is an advanced authentication procedure that requires a large amount of calculation with each of a plurality of communication partners, and a simple authentication procedure that requires a smaller amount of calculation with each of the plurality of communication partners. A communication device capable of selecting any of the above, and is a storage means for storing the identification information unique to the communication partner and the confidential information generated in the advanced authentication procedure in association with each communication partner. In the communication method executed by the communication device, the step of acquiring the identification information unique to the communication partner when communication is performed with the communication partner, and the acquired identification information are the secret information. When it is determined that the identification information is associated with the secret information and is not stored in the storage means, the step of determining whether or not the identification information is stored in the storage means is associated with the secret information. When the procedure is selected to execute authentication and it is determined that the identification information is associated with the confidential information and stored in the storage means, the simple authentication procedure is selected and associated with the identification information. It is characterized by including a step of performing authentication using the obtained confidential information.

The invention according to claim 7 is an advanced authentication procedure that requires a large amount of calculation with each of a plurality of communication partners, and a simple authentication procedure that requires a smaller amount of calculation with each of the plurality of communication partners. A communication device capable of selecting any of the above, and is a storage means for storing the identification information unique to the communication partner and the confidential information generated in the advanced authentication procedure in association with each communication partner. The acquisition means for acquiring the identification information unique to the communication partner when the computer included in the communication device is communicated with the communication partner, and the identification information acquired by the acquisition means are described above. When it is determined that the identification information is associated with the secret information and is not stored in the storage means, and the determination means for determining whether or not the identification information is associated with the secret information and stored in the storage means. When the advanced authentication procedure is selected to execute authentication and it is determined that the identification information is associated with the confidential information and stored in the storage means, the simple authentication procedure is selected and the identification information is determined. It is characterized in that it functions as an authentication means for executing authentication using the confidential information associated with.

According to the present invention, the confidential information generated in the advanced authentication procedure with each of a plurality of devices (communication partners) can be used properly for each device.

It is a figure which shows the outline structure example of the authentication system S which concerns on this embodiment. It is a figure which shows an example of the table which associated the identification information and secret information peculiar to a device Dn. It is a flowchart which shows an example of the authentication procedure selection process of the control unit 13 in a host H. It is a sequence diagram which shows an example of the advanced authentication procedure performed between a host H and a device Dn. It is a sequence diagram which shows an example of the simple authentication procedure 1 performed between a host H and a device Dn. It is a sequence diagram which shows an example of the simple authentication procedure 2 performed between a host H and a device Dn.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiment described below is a case where the present invention is applied to an authentication system used for unlocking a front door of a house, unlocking an opening / closing door of a delivery locker, unlocking a car door, or the like. Is an embodiment of.

[1. Overview of authentication system S]
First, with reference to FIG. 1, the outline configuration of the authentication system S according to the present embodiment will be described. FIG. 1 is a diagram showing a schematic configuration example of the authentication system S according to the present embodiment. As shown in FIG. 1, the authentication system S includes a plurality of devices Dn (n = 1, 2, 3 ...) And a host (host computer) H. Here, the host H is an example of the communication device of the present invention, and the communication partner of the host H is a plurality of devices Dn. It is assumed that the device Dn is used by different users. For example, device D1 is used by user A, device D2 is used by user B, and device D3 is used by user C. The host H and the device Dn can perform non-contact communication using, for example, NFC (Near field communication) technology.

Host H and device Dn are an advanced authentication procedure that requires a large amount of calculation (hereinafter referred to as "advanced authentication procedure") and a simple authentication procedure that requires a smaller amount of calculation (hereinafter referred to as "simple authentication procedure"). And can be selected. In the advanced authentication procedure, signature generation, authentication by signature verification, and key sharing by public key cryptosystem are performed. In the present embodiment, as an example, in the advanced authentication procedure, authentication is performed by signature generation and signature verification by ECDSA (Elliptic Curve Digital Signature Algorithm), and key exchange by ECDH (Elliptic curve Diffie-Hellman key exchange) is executed.

On the other hand, in the simple authentication procedure, the calculation according to the ECDH protocol (hereinafter referred to as "ECDH calculation") is not performed, and the secret information and the random number generated in the advanced authentication procedure and stored in the host H and the device Dn are used. Mutual authentication using the common key cryptosystem (in other words, based on confidential information, etc.) is executed. Here, the host H may perform one-sided authentication for authenticating the device Dn. Further, the confidential information is information that is shared only by the host H and the device D1 when, for example, the host H and the device D1 perform the advanced authentication procedure. In ECDH, confidential information is called a shared-secret.

When the authentication system S is used to unlock the entrance door of a house or the opening / closing door of a delivery locker, the host H is applied to the door control device. Alternatively, if the authentication system S is used to unlock the door of the car, the host H is applied to the in-vehicle computer. On the other hand, when the authentication system S is used for unlocking the entrance door of a house, the opening / closing door of a delivery locker, or the door of a car, the device Dn is a mobile terminal (for example, a smartphone), an IC card, or an IC card carried by the user. Applies to key holders, etc.

As shown in FIG. 1, the device Dn includes a communication module 1, a control module 2, an IC (Integrated Circuit) module 3, and the like. The control module 2 and the IC module 3 may be integrated. The communication module 1 is, for example, a non-contact IC chip (for example, CLF (ContactLess Front-end)) that performs non-contact communication using NFC technology, and is provided in the host H in a non-contact field. Communicate with the rider.

Although not shown, the control module 2 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), an NVM (Nonvolatile Memory), and the like, and is stored in the ROM or the NVM. Execute various processes according to the program. For example, the control module 2 executes arithmetic processing such as key generation in response to a command from the host H in each of the simple authentication procedure and the advanced authentication procedure with the host H, and outputs a response indicating the processing result. Send to host H.

The IC module 3 is, for example, a secure element having high tamper resistance. The IC module 3 may be mounted on the device Dn as a detachable small IC card, or may be mounted on the embedded board as an eSIM (Subscriber Identity Module) so that it cannot be easily removed or replaced from the device Dn. good. The secure memory in the IC module 3 stores a key pair of a public key and a private key unique to each device Dn, and secret information generated in the advanced authentication procedure. Here, the public key included in the key pair and the key ID for identifying the public key are shared in advance with the host H. Further, a device ID unique to the device Dn is stored in the secure memory. The device ID unique to the device Dn may be a unique value distributed by a server or the like, or may be a hash value obtained by hashing the public key or private key of the device Dn.

As shown in FIG. 1, the host H includes a communication unit 11, a storage unit 12 (an example of storage means), a control unit 13, and the like. The communication unit 11 is, for example, a non-contact reader / rider that performs non-contact communication using NFC technology, and communicates with a non-contact IC chip provided in the device Dn in a non-contact field. When the device Dn enters the non-contact field of the communication unit 11, an initial response sequence is performed between the host H and the device Dn. In the initial response sequence, the communication unit 11 transmits a request command from the host H to the device Dn, and receives a response from the device Dn, so that the device Dn is identified and transitioned to the active state. After that, a high-level authentication procedure or a simple authentication procedure is performed between the host H and the device Dn. If necessary, parameters may be exchanged between the host H and the device Dn to mutually confirm communication conditions such as communication speed before the transition to the active state.

By the way, when a plurality of devices Dn are entered in the non-contact field of the communication unit 11, the communication unit 11 cannot correctly recognize the device Dn as the communication partner because the plurality of devices Dn simultaneously transmit a response to the request command. A state (collision) occurs. Anti-collision is implemented as a measure to prevent this. For example, in a time slot type anti-collision, each device Dn assigns an ID for anti-collision (an ID different for each device Dn) in a response time zone corresponding to a random number. Send the including response. As a result, the communication unit 11 can recognize each device Dn. Even in the bit collision type anti-collision, the anti-collision ID (hereinafter referred to as “anti-collision ID”) is transmitted from the device Dn to the host H.

The storage unit 12 is composed of, for example, a non-volatile memory, an HDD (Hard Disk Drive), an SSD (Solid State Drive), or the like, and stores various programs (including the program of the present invention) such as an operating system and an application. Further, the storage unit 12 stores a host ID unique to the host H, a key pair of a public key and a private key unique to the host H, and the like. Here, the public key included in the key pair and the key ID for identifying the public key are shared in advance with each device Dn. Further, in the storage unit 12, the identification information unique to the device Dn that has communicated with the host H and the secret information generated in the advanced authentication procedure are stored in association with each device Dn. Here, the identification information unique to the device Dn may be an anti-collision ID or a device ID unique to the device Dn. The public key and key ID of each device Dn may be managed in association with the identification information unique to each device Dn.

FIG. 2 is a diagram showing an example of a table in which identification information unique to the device Dn and confidential information are associated with each other. The example of FIG. 2 is an example after the advanced authentication procedure is performed between the host H and the device D1 and the device D2. In the table shown in FIG. 2, the identification information "0001" of the device D1 is associated with the secret information "AA BB CC..FF" and registered, and the identification information "0002" of the device D2 is the secret information. It is registered in association with "44 55 66..99". On the other hand, since the host H does not perform non-contact communication with the device D3, the device ID and the secret information of the device D3 are not registered in the table shown in FIG.

The control unit 13 (an example of a computer) is composed of a CPU, RAM, ROM, and the like, and functions as an acquisition means, a determination means, and an authentication means in the present invention according to, for example, a program stored in the storage unit 12. Specifically, the control unit 13 acquires the identification information unique to the device Dn from the response transmitted by the device Dn when the non-contact communication with the device Dn is performed. Subsequently, the control unit 13 determines whether or not the identification information acquired from the device Dn is associated with the secret information and stored in the storage unit 12 before the authentication procedure is started with the device Dn. Is determined. That is, it is determined whether or not the identification information acquired from the device Dn and the secret information are associated and stored in the storage unit 12.

Then, when the control unit 13 determines that the acquired identification information is associated with the confidential information and is not stored, the control unit 13 selects an advanced authentication procedure, performs authentication processing including signature generation and signature verification by ECDSA, and Key exchange by ECDH. On the other hand, when the control unit 13 determines that the acquired identification information is associated with the secret information and stored, the control unit 13 selects a simple authentication procedure and selects the secret information and the random number associated with the identification information. It is used to execute authentication processing by common key cryptography. That is, the control unit 13 selects an advanced authentication procedure when the first communication is performed with the device Dn, executes mutual authentication, for example, and uses the confidential information generated in the advanced authentication procedure for the device Dn. It is stored in association with the identification information unique to the device Dn, and when the second and subsequent communications are performed with the device Dn, the simple authentication procedure is selected and associated with the identification information unique to the device Dn. Perform mutual authentication using confidential information and random numbers. The simple authentication procedure may be one-sided authentication in which the control unit 13 authenticates only the device Dn.

[2. Operation of authentication system S]
Next, the operation of the authentication system S will be described with reference to FIGS. 3 to 6. FIG. 3 is a flowchart showing an example of the authentication procedure selection process of the control unit 13 in the host H. FIG. 4 is a sequence diagram showing an example of an advanced authentication procedure performed between the host H and the device Dn. FIG. 5 is a sequence diagram showing an example of the simple authentication procedure 1 performed between the host H and the device Dn. FIG. 6 is a sequence diagram showing an example of the simple authentication procedure 2 performed between the host H and the device Dn. In the simple authentication procedure 1, mutual authentication is executed, and in the simple authentication procedure 2, one-sided authentication is executed.

In the process shown in FIG. 3, for example, the device Dn is held by the communication unit 11 (non-contact reader / rider) by the user, so that the device Dn (any of D1 to D3) is not the communication unit 11 of the host H. It is started by entering the field of contact. When the process shown in FIG. 3 is started, the control unit 13 of the host H transmits a request command to the device Dn via the communication unit 11 (step S1).

The process of step S1 is repeated until only one anti-collision ID is read while the plurality of devices Dn simultaneously respond to the anti-collision ID. When the control module 2 of the device Dn receives the request command from the host H via the communication module 1, the control module 2 sends a response including the anti-collision ID to the host H via the communication module 1 in response to the request command. Transmit (step S2).

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the control unit 13 selects the device including the anti-collision ID (command) via the communication unit 11 (D1). (Any of D3)) (step S3). When the control unit 13 of the host H receives the responses transmitted from the plurality of devices Dn in step S2, a timing may occur in which the 0/1 bit of the anti-collision ID cannot be read due to collision. In this case, in step S3, the control unit 13 of the host H transmits the device selection including the identifier consisting of the read bit string to all the devices Dn. Then, when the control module 2 of each device Dn matches its own anti-collision ID with the identifier included in the device selection, the control module 2 again sends a response including the anti-collision ID to the host H (matches). If not, it will not respond). By repeating this, only the device Dn whose identifier included in the device selection matches its own anti-collision ID will continue to respond. As a result, one device Dn (any of D1 to D3) is selected from the plurality of devices Dn.

Next, when the control module 2 of the device Dn receives the device selection from the host H via the communication module 1, the response including the communication condition is sent to the host H via the communication module 1 according to the device selection. Transmit (step S4). Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the control unit 13 issues a SELECT command (including the Application ID) via the communication unit 11 and the device Dn via the communication unit 11. (Step S5).

Next, when the control module 2 of the device Dn receives the SELECT command from the host H via the communication module 1, the control module 2 selects an application according to the SELECT command, and sends a response to the SELECT command via the communication module 1. Is transmitted to the host H (step S6). Such a response includes, for example, SW (Status Word) “9000” and FCI (File Control Information) in TLV format.

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, it transmits a read command to the device Dn via the communication unit 11 (step S7). Next, when the control module 2 of the device Dn receives the read command from the host H via the communication module 1, the device ID (an example of the identification information unique to the device Dn) is received from the IC module 3 in response to the read command. ), And the response including the device ID is transmitted to the host H via the communication module 1 (step S8).

Even if the control module 2 of the device Dn reads the device ID from the IC module 3 in response to the SELECT command transmitted from the host H in step S5 and transmits a response including the device ID to the host H in step S6. good. In this case, the processing of steps S7 and S8 becomes unnecessary. Further, even when the anti-collision ID is used as the identification information unique to the device Dn, the processing of steps S7 and S8 becomes unnecessary.

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the control unit 13 acquires the device ID or the anti-collision ID as the identification information unique to the device Dn (step S9).

Next, the control unit 13 of the host H determines whether or not the identification information acquired in step S9 is associated with the secret information and registered in the table as shown in FIG. 2 (step S10). That is, it is determined whether or not the identification information acquired in step S9 and the secret information are associated with each other and registered in the table as shown in FIG. Then, when the control unit 13 of the host H determines that the identification information acquired in step S9 is associated with the secret information and is not stored (step S10: NO), the control unit 13 selects the advanced authentication procedure and selects the advanced level. The authentication procedure is started (step S11).

On the other hand, when the control unit 13 of the host H determines that the identification information acquired in step S9 is associated with the secret information and stored (step S10: YES), the secret associated with the identification information is determined. Information is acquired from the table (step S12). Next, the control unit 13 of the host H selects a simple authentication procedure, and starts the simple authentication procedure using the confidential information acquired in step S12 (step S13).

(2.1 Advanced certification procedure)
In the advanced authentication procedure, as shown in FIG. 4, the control unit 13 of the host H generates a random number H (step S21). Next, the control unit 13 of the host H transmits an authentication start command to the device Dn (any of D1 to D3) via the communication unit 11 (step S22). Such an authentication start command includes a host ID unique to the host H, a random number H generated in step S21, and information indicating that the command is for an advanced authentication procedure.

Next, when the control module 2 of the device Dn receives the authentication start command from the host H via the communication module 1 and determines that it is the authentication start command for the advanced authentication procedure, the host ID and the host ID and the authentication start command are determined from the authentication start command. The random number H is acquired, and further, the random number Dn is generated (step S23). Next, the control module 2 of the device Dn signs the random number H and the random number Dn with the secret key of the device Dn (step S24). That is, the signature Dn is generated (signature generation) by ECDSA. Next, the control module 2 of the device Dn transmits a response to the authentication start command to the host H via the communication module 1 (step S25). Such a response includes a signature Dn and a random number Dn.

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the signature Dn and the random number Dn are acquired from the response, and the signature Dn is verified by the public key of the device Dn. (Step S26). That is, the signature Dn is verified (signature verification) by ECDSA. Then, when the verification of the signature Dn is successful (authentication success), the control unit 13 of the host H signs the random number Dn and the random number H with the private key of the host H (step S27). That is, the signature H is generated by ECDSA. Next, the control unit 13 of the host H transmits an authentication completion command to the device Dn via the communication unit 11 (step S28). Such an authentication completion command includes signature H.

Next, when the control module 2 of the device Dn receives the authentication completion command from the host H via the communication module 1, the signature H is acquired from the authentication completion command, and the signature H is verified with the public key of the host H. (Step S29). That is, the signature H is verified by ECDSA. Then, when the verification of the signature H is successful (authentication successful), the mutual authentication is completed, and the control module 2 of the device Dn sends a response to the authentication completion command to the host H via the communication module 1 (step S30). ..

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, it generates a temporary key pair of the temporary public key H and the temporary private key H unique to the host H (step S31). ). Here, the temporary public key H is a temporary public key and is distinguished from a public key that is shared and managed in advance. Similarly, the temporary private key H is a temporary private key and is distinguished from a private key that is shared and managed in advance. The temporary public key H is generated by an ECDH operation based on a previously generated temporary secret key H (for example, a random numerical value) and a point on an elliptic curve according to the ECDH protocol. In the ECDH operation, for example, the temporary public key H is generated from the temporary secret key H by performing scalar multiplication to calculate the k times point kp of the point p on the elliptic curve. The parameters of the elliptic curve are known between the host H and the device Dn. Next, the control unit 13 of the host H transmits a key sharing command to the device Dn via the communication unit 11 (step S32). Such a key sharing command includes a temporary public key H.

Next, when the control module 2 of the device Dn receives the key sharing command from the host H via the communication module 1, the temporary public key H is acquired from the key sharing command, and further, the ECDH calculation is performed as in the host H. Generates a temporary key pair of a temporary public key Dn and a temporary private key Dn unique to the device Dn (step S33). The temporary public key Dn is generated by an ECDH operation based on a previously generated temporary secret key Dn (for example, a random numerical value) and a point on an elliptic curve according to the ECDH protocol. Next, the control module 2 of the device Dn generates a shared secret (an example of secret information) from the temporary public key H and the temporary public key Dn by ECDH calculation (step S34).

Next, the control module 2 of the device Dn records the host ID and the shared secret generated in step S34 in the non-volatile memory (step S35). Next, the control module 2 of the device Dn generates a session key used for a secure session between the host H and the device Dn from the random number H, the random number Dn, and the shared secret generated in step S34 (step S36). Next, the control module 2 of the device Dn transmits a response to the key exchange command to the host H via the communication module 1 (step S37). Such a response includes the temporary public key Dn.

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the temporary public key Dn is acquired from the response, and the temporary public key H and the temporary public key Dn are obtained by ECDH calculation. Generate a shared secret from (step S38). Since the shared secret generated here is generated by the same generation method as the shared secret generated in step S34, they match. Next, the control unit 13 of the host H associates the device ID with the shared secret generated in step S38 and records it in a memory (for example, RAM or non-volatile memory) (step S39). For example, a device ID (an example of identification information) and a shared secret (an example of secret information) are associated and registered in a table as shown in FIG. Next, the control unit 13 of the host H generates a session key from the random number H, the random number Dn, and the shared secret generated in step S38 (step S40). Since the session key generated here is generated by the same generation method as the session key generated in step S36, they match.

Next, the control unit 13 of the host H starts a secure session with the device Dn using the session key generated in step S40. When the secure session is started in this way, for example, a read command and its response are transmitted and received between the host H and the device Dn through the encryption path in which the session key is used. As a result, data exchange and the like are carried out.

(2.2 Simple authentication procedure 1)
In the simple authentication procedure 1, as shown in FIG. 5, the control unit 13 of the host H generates a random number H (step S51). Next, the control unit 13 of the host H transmits an authentication start command to the device Dn (any of D1 to D3) via the communication unit 11 (step S52). The authentication start command includes a host ID unique to the host H, a random number H generated in step S51, and information indicating that the command is for the simple authentication procedure 1.

Next, when the control module 2 of the device Dn receives the authentication start command from the host H via the communication module 1 and determines that it is the authentication start command for the simple authentication procedure 1, the host ID is determined from the authentication start command. And the random number H is acquired, and further, the random number Dn is generated (step S53). Next, the control module 2 of the device Dn acquires the shared secret recorded in association with the host ID of the host H, and performs a session from the random number H, the random number Dn, and the shared secret by AES (Advanced Encryption Standard) operation. Generate a key (step S54). Next, the control module 2 of the device Dn generates the authentication code Dn by encrypting the random number Dn, the random number H, and the specific value agreed in advance with the session key (step S55). Next, the control module 2 of the device Dn transmits a response to the authentication start command to the host H via the communication module 1 (step S56). Such a response includes an authentication code Dn and a random number Dn.

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the control unit 13 acquires the authentication code Dn and the random number Dn from the response, and is further associated with the device ID of the device Dn. The shared secret recorded in the above is acquired, and a session key is generated from the random number H, the random number Dn, and the shared secret by the AES operation (step S57). Next, the control unit 13 of the host H verifies the authentication code Dn with the session key (step S58). In such verification, the control unit 13 decodes the authentication code Dn with the session key by the AES operation, and the decoded authentication code Dn, the “random number Dn (that is, the random number Dn obtained from the above response), and the random number”. It is determined whether or not H and the specific value previously agreed upon match. Then, when the verification of the authentication code Dn is successful (authentication successful), the control unit 13 of the host H encrypts the random number Dn, the random number H, and the specific value previously agreed with the session key by the AES operation. The authentication code H is generated by the above (step S59). Next, the control unit 13 of the host H transmits an authentication completion command to the device Dn via the communication unit 11 (step S60). The authentication completion command includes the authentication code H.

Next, when the control module 2 of the device Dn receives the authentication completion command from the host H via the communication module 1, the authentication code H is acquired from the authentication completion command, and the authentication code H is verified by the session key. (Step S61). In such verification, the control unit 13 decodes the authentication code H with the session key by AES calculation, and the decoded authentication code H and "random number Dn, random number H, and a specific value previously agreed upon". It is determined whether or not matches with. Then, when the verification of the authentication code H is successful (authentication successful), mutual authentication is completed, and the control module 2 of the device Dn sends a response to the authentication completion command to the host H via the communication module 1 (step S62). ).

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the control unit 13 starts a secure session with the device Dn using the session key generated in step S57.

(2.3 Simple authentication procedure 2)
In the simple authentication procedure 2, as shown in FIG. 6, the control unit 13 of the host H generates a random number H (step S71). Next, the control unit 13 of the host H transmits an authentication start command to the device Dn (any of D1 to D3) via the communication unit 11 (step S72). The authentication start command includes a host ID unique to the host H, a random number H generated in step S71, and information indicating that the command is for the simple authentication procedure 2.

Next, when the control module 2 of the device Dn receives the authentication start command from the host H via the communication module 1 and determines that it is the authentication start command for the simple authentication procedure 2, the host ID is determined from the authentication start command. And the random number H is acquired, and further, the random number Dn is generated (step S73). Next, the control module 2 of the device Dn acquires the shared secret recorded in association with the host ID of the host H, and generates a session key from the random number H, the random number Dn, and the shared secret by AES operation ( Step S74). Next, the control module 2 of the device Dn generates the authentication code Dn by encrypting the random number Dn, the random number H, and the specific value agreed in advance with the session key (step S75). Next, the control module 2 of the device Dn transmits a response to the authentication start command to the host H via the communication module 1 (step S76). Such a response includes an authentication code Dn and a random number Dn.

Next, when the control unit 13 of the host H receives the response from the device Dn via the communication unit 11, the control unit 13 acquires the authentication code Dn and the random number Dn from the response, and is further associated with the device ID of the device Dn. The shared secret recorded in the above is acquired, and a session key is generated from the random number H, the random number Dn, and the shared secret by the AES operation (step S77). Next, the control unit 13 of the host H verifies the authentication code Dn with the session key (step S78). Then, when the verification of the authentication code H is successful (authentication successful) (that is, when one-sided authentication is completed), the control unit 13 of the host H secures with the device Dn using the session key generated in step S77. Start a session.

As described above, according to the above embodiment, the host H acquires the identification information unique to the device Dn when the non-contact communication with the device Dn is performed, and the acquired identification information is obtained. If it is determined whether or not the acquired identification information is associated with the confidential information and stored, and if it is determined that the acquired identification information is associated with the confidential information and is not stored, select the advanced authentication procedure and perform mutual authentication. On the other hand, if it is determined that the acquired identification information is associated with the confidential information and stored, select the simple authentication procedure and perform mutual authentication using the confidential information associated with the identification information. Since it is configured to be executed, the confidential information generated in the advanced authentication procedure between each of the plurality of devices Dn can be used properly for each device Dn, and the processing related to the authentication procedure is shortened for each device Dn. be able to. Further, the simple authentication procedure can further shorten the process as one-sided authentication in which the host H authenticates only the device Dn.

In the above-described embodiment, an authentication method having two types of authentication processes, an advanced authentication procedure and a simple authentication procedure, has been described as an example, but the present invention has an authentication method in which three or more types of authentication processes exist. It can also be applied to. Further, in the above embodiment, the case where the non-contact communication is performed between the host H and the device Dn has been described as an example, but the present invention is the case where the contact communication is performed between the host H and the device Dn. It is also applicable in. Further, in the above embodiment, FIGS. 3 to 6 show the processing of the control unit 13 of the host H and the control module 2 of the device Dn, but the processing of the control module 2 of the device Dn is executed by the IC module 3. May be good.

1 Communication module 2 Control module 3 IC module 11 Communication unit 12 Storage unit 13 Control unit Dn device H Host S Authentication system

Claims (7)

Communication that can be selected between an advanced authentication procedure that requires a large amount of calculation with each of a plurality of communication partners and a simple authentication procedure that requires a smaller amount of calculation with each of the plurality of communication partners. It ’s a device,
A storage means for storing the identification information unique to the communication partner and the confidential information generated in the advanced authentication procedure in association with each other for each communication partner.
An acquisition means for acquiring identification information unique to the communication partner when communication is performed with the communication partner, and
A determination means for determining whether or not the identification information acquired by the acquisition means is associated with the secret information and stored in the storage means.
When it is determined that the identification information is associated with the confidential information and is not stored in the storage means, the advanced authentication procedure is selected to execute authentication, and the identification information is associated with the confidential information. When it is determined that the information is stored in the storage means, an authentication means that selects the simple authentication procedure and executes authentication using the confidential information associated with the identification information.
A communication device characterized by being provided with. The communication device according to claim 1, wherein the acquisition means transmits a predetermined command to the communication partner, and acquires the identification information from a response transmitted by the communication partner in response to the command. The communication device according to claim 1, wherein the identification information is an ID for anti-collision during non-contact communication. The communication device according to any one of claims 1 to 3, wherein in the advanced authentication procedure, authentication is performed by signature generation and signature verification, and key exchange by a public key cryptosystem is executed. The communication device according to claim 4, wherein in the simple authentication procedure, one-sided authentication is executed using a random number and the secret information. Communication that can be selected between an advanced authentication procedure that requires a large amount of calculation with each of a plurality of communication partners and a simple authentication procedure that requires a smaller amount of calculation with each of the plurality of communication partners. The device is executed by the communication device provided with a storage means for storing the identification information unique to the communication partner and the confidential information generated in the advanced authentication procedure in association with each other for each communication partner. In the communication method
A step of acquiring identification information unique to the communication partner when communication is performed with the communication partner, and
A step of determining whether or not the acquired identification information is associated with the secret information and stored in the storage means, and
When it is determined that the identification information is associated with the confidential information and is not stored in the storage means, the advanced authentication procedure is selected to execute authentication, and the identification information is associated with the confidential information. When it is determined that the information is stored in the storage means, a step of selecting the simple authentication procedure and executing authentication using the confidential information associated with the identification information, and a step of executing authentication.
A communication method characterized by including. Communication that can be selected between an advanced authentication procedure that requires a large amount of calculation with each of a plurality of communication partners and a simple authentication procedure that requires a smaller amount of calculation with each of the plurality of communication partners. A computer included in the communication device, which is a device and includes a storage means for storing identification information unique to the communication partner and confidential information generated in the advanced authentication procedure in association with each other for each communication partner. of,
An acquisition means for acquiring identification information unique to the communication partner when communication is performed with the communication partner, and
A determination means for determining whether or not the identification information acquired by the acquisition means is associated with the secret information and stored in the storage means.
When it is determined that the identification information is associated with the confidential information and is not stored in the storage means, the advanced authentication procedure is selected to execute authentication, and the identification information is associated with the confidential information. When it is determined that the information is stored in the storage means, the simple authentication procedure is selected and the secret information associated with the identification information is used to function as an authentication means for executing authentication. Program to do.

Images