JP2022081456A - Communication device, communication method, and program - Google Patents

Abstract

To provide a communication device, a communication method, and a program that can perform key generation processing with higher speed without actually using DH (Diffie-Hellman key exchange) even if a command that means the use of DH for key generation is received.SOLUTION: A host H generates a random number, and molds the generated random number into a public key format by ECDH protocol to generate a pseudo public key. When confidential information is not stored, the host H selects an advanced authentication procedure and generates a session key using DH, whereas when confidential information is stored, the host H selects a simple authentication procedure and generates a session key using the confidential information and the pseudo public key.SELECTED DRAWING: Figure 2

Description

The present invention is a technical field such as a communication device that can select either an advanced authentication procedure that requires a large amount of calculation with a communication partner or a simple authentication procedure that requires a smaller amount of calculation with a communication partner. Regarding.

Among the roles of smartphones, which are increasing year by year, the role as a key to lock and unlock doors is drawing attention. In an authentication system that unlocks the entrance door of a house or the opening / closing door of a delivery locker with a device such as a smartphone, the lock is unlocked by performing mutual authentication in the authentication procedure between the lock (communication device) and the device (communication partner). Processing such as is executed. Before a smartphone can be used as a door key, it is necessary to determine the combination of the lock installed on the door and the smartphone, which is the same as authenticating between an unspecified number of computers on the network. The situation. In other words, the door lock and the smartphone authenticate each other without being informed in advance that they will be combined with each other.

The authentication procedure used in this situation is certificate verification using public key cryptography, and in the authentication, a technology for secretly sharing information (Diffie-Hellman, etc.) is also used, and the confidential information shared by the technology is also used. Is used as a key for common key cryptography that realizes confidential communication after authentication or as input information for generating a key. Therefore, it can be said that the authentication procedure for verifying a certificate using public key cryptography is an advanced authentication procedure that requires a large amount of calculation to obtain a verification result and requires computer resources. In such authentication, for example, signature verification and key exchange using an elliptic curve are executed, but there is a problem that the processing takes time because the key generation is performed by both the lock and the device in the cryptographic operation processing. rice field. Patent Document 1 discloses a key generation method for elliptic curve cryptography, which can minimize the prime number determination process performed when generating a key and can generate a key used in elliptic curve cryptography at high speed. ing.

Japanese Unexamined Patent Publication No. 2000-181351

By the way, in the key generation method disclosed in Patent Document 1, the key generation can be speeded up, but the process of the key generation itself cannot be omitted, and a dedicated device is required. Therefore, in communication between an unspecified number of computers, the advanced authentication procedure is not used at the start of each communication, but the confidential information generated when the authentication is successful once is stored, and the secret information is stored at the start of the next communication. A simple authentication procedure for reusing confidential information is also available. The simple authentication procedure is composed of a common key cryptosystem that requires less calculation amount and computer resources than public key cryptography, but the secret information and the information that identifies the authentication procedure when the secret information is generated are paired. It is difficult to store the confidential information of all communication partners individually, and it is held only for a certain period of time. However, in the combination of the door lock and the smartphone, the person to be authenticated is limited, so the door lock stores the confidential information and the information that identifies the authentication procedure when the confidential information is generated as a pair. It is possible to keep it. Therefore, it is assumed that the advanced authentication procedure that requires a large amount of calculation with the communication partner and the simple authentication procedure that requires a smaller amount of calculation with the communication partner are used properly.

However, when encrypted communication is continued after authentication, it is necessary to share confidential information by DH (Diffie-Hellman key exchange) even in the simple authentication procedure, and there is a problem that it takes time to generate a key.

Therefore, the present invention has been made in view of the above points and the like, and is a communication device capable of realizing higher-speed processing even when a secret sharing instruction by DH is used for key generation. The purpose is to provide communication methods and programs.

In order to solve the above problems, the invention according to claim 1 comprises an advanced authentication procedure that requires a large amount of calculation with the communication partner and a simple authentication that requires a smaller amount of calculation with the communication partner. A communication device capable of selecting any of the procedures, which is a storage means for storing the secret information generated in the advanced authentication procedure, a first generation means for generating a random number, and ECDH (Elliptic) for the random number. The secret information is stored in the storage means when communication is performed between the second generation means for generating a pseudo public key by molding into a public key format according to the protocol of curve Diffie-Hellman key exchange) and the communication partner. If it is not stored in, select the advanced authentication procedure to generate the key exchange and session key by the ECDH, while if the secret information is stored in the storage means, select the simple authentication procedure. It is characterized by comprising a third generation means for generating a session key using the secret information and the pseudo public key.

The invention according to claim 2 comprises a step of storing confidential information generated in the advanced authentication procedure in a computer included in the device to be a communication partner of the communication device according to claim 1, and a step from the communication device. The step of receiving the command including the pseudo public key, and the encrypted data for confirming the validity of the key value generated by the secret information and the pseudo public key according to the received command. It is characterized in that a step of generating and a step of transmitting a response including the encrypted data to the communication device are executed.

The invention according to claim 3 can select either an advanced authentication procedure that requires a large amount of calculation with the communication partner or a simple authentication procedure that requires a smaller amount of calculation with the communication partner. In a communication method executed by the communication device, which is a communication device and includes a storage means for storing the secret information generated in the advanced authentication procedure, a step of generating a random number and the random number are used as ECDH (Elliptic). The secret information is stored in the storage means when a step of generating a pseudo-public key by molding into a public key format according to the protocol of curve Diffie-Hellman key exchange) and communication with the communication partner is performed. If not, the advanced authentication procedure is selected to generate the key exchange and session key by the ECDH, while the secret information is stored in the storage means, the simple authentication procedure is selected to generate the secret. It is characterized by including a step of generating a session key using the information and the pseudo-public key.

The invention according to claim 4 can select either an advanced authentication procedure that requires a large amount of calculation with the communication partner or a simple authentication procedure that requires a smaller amount of calculation with the communication partner. A storage means for storing secret information generated in the advanced authentication procedure, a first generation means for generating a random number, and an ECDH (Elliptic curve Diffie-Hellman key exchange) for the computer included in the communication device. ), The secret information is not stored in the storage means when communication is performed between the second generation means for generating a pseudo public key by molding into a public key format according to the protocol of) and the communication partner. , The advanced authentication procedure is selected to exchange the key by the ECDH and the session key is generated, while the secret information is stored in the storage means, the simple authentication procedure is selected and the secret information and the secret information are generated. It is characterized in that it functions as a third generation means for generating a session key using a pseudo public key.

According to the present invention, even when a command indicating the use of DH is received for key generation, it is possible to realize a faster key generation process that does not actually use DH.

It is a figure which shows the outline structure example of the authentication system S which concerns on this embodiment. It is a flowchart which shows an example of the authentication procedure selection process of the control unit 13 in a host H. It is a sequence diagram which shows an example of the advanced authentication procedure performed between a host H and a device D. It is a sequence diagram which shows an example of the simple authentication procedure 1 performed between a host H and a device D. It is a figure which shows an example of the public key format (A) by ECDH, the data structure (B) of a pseudo public key H generated by a host H, and the data structure (C) of a pseudo public key D generated by a device D. .. It is a sequence diagram which shows an example of the simple authentication procedure 2 performed between a host H and a device D.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiments described below relate to an authentication system used, for example, for unlocking a car door, starting a car engine, unlocking a house entrance door, or unlocking an opening / closing door of a delivery locker. It is an embodiment when the present invention is applied.

[1. Overview of authentication system S]
First, with reference to FIG. 1, the outline configuration of the authentication system S according to the present embodiment will be described. FIG. 1 is a diagram showing a schematic configuration example of the authentication system S according to the present embodiment. As shown in FIG. 1, the authentication system S includes a device D and a host (host computer) H. Here, the host H is an example of the communication device of the present invention, and the communication partner of the host H is the device D. The host H and the device D can perform non-contact communication using, for example, NFC (Near field communication) technology. Further, Bluetooth (registered trademark), ZigBee, LoRa, and UWB (Ultra Wide Band) may be used for communication between the host H and the device D.

Host H and device D have an advanced authentication procedure that requires a large amount of calculation (hereinafter referred to as "advanced authentication procedure") and a simple authentication procedure that requires a smaller amount of calculation (hereinafter referred to as "simple authentication procedure"). It is designed to be selectively implemented. In the advanced authentication procedure, signature generation, authentication by signature verification, and key sharing by public key cryptosystem are performed. In the present embodiment, as an example, in the advanced authentication procedure, authentication by signature generation and signature verification in ECDSA (Elliptic Curve Digital Signature Algorithm) and key exchange by ECDH (Elliptic curve Diffie-Hellman key exchange) are executed. do.

On the other hand, in the simple authentication procedure, mutual authentication by the common key cryptosystem is executed using the secret information and random numbers generated in the advanced authentication procedure and stored in the host H and the device D (in other words, based on the secret information). Will be done. Here, the host H may perform one-sided authentication for authenticating the device D. Further, the confidential information is information that is shared only by the host H and the device D, for example, when the host H and the device D perform the advanced authentication procedure. In ECDH, it is called shared-secret.

When the authentication system S is used to unlock the entrance door of a house or the opening / closing door of a delivery locker, the host H is applied to the door control device. Alternatively, when the authentication system S is used to unlock the car door or start the engine, the host H is applied to the in-vehicle computer. On the other hand, when the authentication system S is used for unlocking the entrance door of a house, the opening / closing door of a delivery locker, or the door of a car, the device D is a mobile terminal (for example, a smartphone), an IC card, or an IC card carried by the user. Applies to key holders, etc.

As shown in FIG. 1, the device D includes a communication module 1, a control module 2, an IC (Integrated Circuit) module 3, and the like. The control module 2 and the IC module 3 may be integrated. The communication module 1 is, for example, a non-contact IC chip (for example, CLF (ContactLess Front-end)) that performs non-contact communication using NFC technology, and is provided in the host H in a non-contact field. Communicate with the rider.

Although not shown, the control module 2 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), an NVM (Nonvolatile Memory), and the like, and is stored in the ROM or the NVM. Various processes are executed according to a program (including the program of the present invention). For example, the control module 2 executes arithmetic processing such as key generation in response to a command from the host H in each of the simple authentication procedure and the advanced authentication procedure with the host H, and outputs a response indicating the processing result. Send to host H.

The IC module 3 is, for example, a secure element having high tamper resistance. The IC module 3 may be mounted on the device D as a detachable small IC card, or may be mounted on the embedded board as an eSIM (Subscriber Identity Module) so that it cannot be easily removed or replaced from the device D. good. The secure memory in the IC module 3 stores a key pair of a public key and a private key unique to the device D, secret information generated in the advanced authentication procedure, and the like. Further, a device ID unique to the device D is stored in the secure memory. Here, the public key included in the key pair and the key ID for identifying the public key are shared in advance with the host H. The device ID unique to the device D may be a unique value distributed by a server or the like, or may be a hash value obtained by hashing the public key or private key of the device D.

As shown in FIG. 1, the host H includes a communication unit 11, a storage unit 12 (an example of storage means), a control unit 13, and the like. The communication unit 11 is, for example, a non-contact reader / rider that performs non-contact communication using NFC technology, and communicates with a non-contact IC chip provided in the device D in a non-contact field. When the device D enters the non-contact field of the communication unit 11, an initial response sequence is performed between the host H and the device D. In the initial response sequence, the communication unit 11 sends a request command from the host H to the device D, and receives a response from the device D, so that the device D is identified and transitioned to the active state. After that, a high-level authentication procedure or a simple authentication procedure is performed between the host H and the device D. If necessary, parameters may be exchanged between the host H and the device D and communication conditions such as the communication speed may be mutually confirmed before the transition to the active state.

By the way, when a plurality of devices D are entered in the non-contact field of the communication unit 11, the communication unit 11 cannot correctly recognize the device D as the communication partner because the plurality of devices D simultaneously transmit a response to the request command. A state (collision) occurs. Anti-collision is implemented as a measure to prevent this. For example, in a time slot type anti-collision, each device D transmits a response including an ID for anti-collision in a response time zone corresponding to a random number. As a result, the communication unit 11 can recognize each device D. Even in the bit collision type anti-collision, the anti-collision ID (hereinafter referred to as “anti-collision ID”) is transmitted from the device D to the host H.

The storage unit 12 is composed of, for example, a non-volatile memory, an HDD (Hard Disk Drive), an SSD (Solid State Drive), or the like, and stores various programs (including the program of the present invention) such as an operating system and an application. Further, the storage unit 12 stores a key pair of a public key and a private key unique to the host H. Here, the public key included in the key pair and the key ID for identifying the public key are shared in advance with the device D. Further, the storage unit 12 stores the identification information unique to the device D that has communicated with the host H in association with the secret information generated in the advanced authentication procedure. Here, the identification information unique to the device D may be an anti-collision ID or a device ID unique to the device D. The public key and key ID of the device D may be managed in association with the identification information unique to the device D.

The control unit 13 (an example of a computer) is composed of a CPU, RAM, ROM, and the like, and according to, for example, a program stored in the storage unit 12, the first generation means, the second generation means, and the third generation in the present invention. Functions as a means. Specifically, the control unit 13 generates a random number by, for example, a random number generation algorithm, and molds (forms) the generated random number into a public key format according to the ECDH protocol to generate a pseudo public key. Here, the format of the temporary public key by the ECDH protocol is composed of the X-coordinate value and the Y-coordinate value on the elliptic curve according to ECDH, for example, a format such as (x, y). It is represented by. The control unit 13 generates a pseudo public key by setting a random number for each of the X coordinate value and the Y coordinate value, for example. Therefore, the X-coordinate value and the Y-coordinate value do not have to be the coordinates on the elliptic curve according to ECDH.

The control unit 13 acquires the identification information unique to the device D from the response transmitted by the device D when the non-contact communication with the device D is performed. Subsequently, the control unit 13 determines whether or not the secret information is stored in the storage unit 12 in association with the identification information acquired from the device D before the authentication procedure is started with the device D. Is determined. Then, when the control unit 13 determines that the secret information is not stored in association with the acquired identification information, the control unit 13 selects an advanced authentication procedure to exchange the key by ECDH and generate a session key.

On the other hand, when the control unit 13 determines that the secret information is stored in association with the acquired identification information, the control unit 13 selects a simple authentication procedure and uses the secret information and the pseudo public key for a session. A simple authentication procedure for generating a key is selected, and a session key is generated using the secret information associated with the identification information and the pseudo-public key generated above. For example, when the first communication with the device D is performed, the control unit 13 selects an advanced authentication procedure and executes authentication, and the secret information generated in the advanced authentication procedure is unique to the device D. The secret information associated with the identification information unique to the device D is stored by associating it with the identification information of the device D, and when the second and subsequent communications are performed with the device D, the simple authentication procedure is selected. And perform authentication (mutual authentication or one-sided authentication) using the pseudo public key.

[2. Operation of authentication system S]
Next, the operation of the authentication system S will be described with reference to FIGS. 2 to 6. FIG. 2 is a flowchart showing an example of the authentication procedure selection process of the control unit 13 in the host H. FIG. 3 is a sequence diagram showing an example of an advanced authentication procedure performed between the host H and the device D. FIG. 4 is a sequence diagram showing an example of the simple authentication procedure 1 performed between the host H and the device D. FIG. 5 shows an example of the public key format (A) by ECDH, the data structure (B) of the pseudo public key H generated by the host H, and the data structure (C) of the pseudo public key D generated by the device D. It is a figure which shows. FIG. 6 is a sequence diagram showing an example of the simple authentication procedure 2 performed between the host H and the device D.

The process shown in FIG. 2 is started by, for example, the device D being held by the communication unit 11 (non-contact reader / rider) by the user, and the device D entering the non-contact field of the communication unit 11 of the host H. Will be done. When the process shown in FIG. 3 is started, the control unit 13 of the host H transmits a request command to the device D via the communication unit 11 (step S1).

In addition, a plurality of devices D may respond to the anti-collision ID at the same time. In this case, the process of step S1 is repeated until only one anti-collision ID is read. When the control module 2 of the device D receives the request command from the host H via the communication module 1, the control module 2 sends a response including the anti-collision ID to the host H via the communication module 1 in response to the request command. Transmit (step S2).

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the control unit 13 transmits the device selection (command) including the anti-collision ID to the device D via the communication unit 11. (Step S3). When the control unit 13 of the host H receives the responses transmitted from the plurality of devices D in step S2, a timing may occur in which the 0/1 bit of the anti-collision ID cannot be read due to collision. In this case, in step S3, the control unit 13 of the host H transmits the device selection including the identifier consisting of the read bit string to all the devices D. Then, when the control module 2 of each device D matches its own anti-collision ID with the identifier included in the device selection, the control module 2 again sends a response including the anti-collision ID to the host H (matches). If not, it will not respond). By repeating this, only the device D whose identifier included in the device selection matches its own anti-collision ID will continue to respond. As a result, one device D is selected from the plurality of devices D.

Next, when the control module 2 of the device D receives the device selection from the host H via the communication module 1, a response including communication conditions is sent to the host H via the communication module 1 according to the device selection. Transmit (step S4). Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the control unit 13 issues a SELECT command (including the Application ID) via the communication unit 11 and the device D via the communication unit 11. (Step S5).

Next, when the control module 2 of the device D receives the SELECT command from the host H via the communication module 1, the control module 2 selects an application according to the SELECT command, and sends a response to the SELECT command via the communication module 1. Is transmitted to the host H (step S6). Such a response includes, for example, SW (Status Word) “9000” and FCI (File Control Information) in TLV format.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the control unit 13 transmits a read command to the device D via the communication unit 11 (step S7). Next, when the control module 2 of the device D receives the read command from the host H via the communication module 1, the device ID (an example of the identification information unique to the device D) is received from the IC module 3 in response to the read command. ), And the response including the device ID is transmitted to the host H via the communication module 1 (step S8).

Even if the control module 2 of the device D reads the device ID from the IC module 3 in response to the SELECT command transmitted from the host H in step S5 and transmits a response including the device ID to the host H in step S6. good. In this case, the processing of steps S7 and S8 becomes unnecessary. Further, even when the anti-collision ID is used as the identification information unique to the device D, the processes of steps S7 and S8 become unnecessary.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the device ID or the anti-collision ID is acquired as the identification information unique to the device D (step S9).

Next, the control unit 13 of the host H determines whether or not the secret information is stored in the storage unit 12 in association with the identification information acquired in step S9 (step S10). Then, when the control unit 13 of the host H determines that the identification information acquired in step S9 is associated with the secret information and is not stored (step S10: NO), the control unit 13 selects the advanced authentication procedure and selects the advanced level. The authentication procedure is started (step S11).

On the other hand, when the control unit 13 of the host H determines that the identification information acquired in step S9 is associated with the secret information and stored (step S10: YES), the secret associated with the identification information is determined. Information is acquired from the storage unit 12 (step S12). Next, the control unit 13 of the host H selects a simple authentication procedure, and starts the simple authentication procedure using the confidential information acquired in step S12 (step S13).

(2.1 Advanced certification procedure)
In the advanced authentication procedure, as shown in FIG. 3, the control unit 13 of the host H generates a random number H (step S21). Next, the control unit 13 of the host H transmits an authentication start command to the device D via the communication unit 11 (step S22). Such an authentication start command includes a host ID unique to the host H, a random number H generated in step S21, and information indicating that the command is for an advanced authentication procedure.

Next, when the control module 2 of the device D receives the authentication start command from the host H via the communication module 1 and determines that it is the authentication start command for the advanced authentication procedure, the host ID and the host ID and the authentication start command are determined from the authentication start command. A random number H is acquired, and a random number D is further generated (step S23). Next, the control module 2 of the device D signs the random number H and the random number D with the private key of the device D (step S24). That is, the signature D is generated (signature generation) by ECDSA. Next, the control module 2 of the device D transmits a response to the authentication start command to the host H via the communication module 1 (step S25). Such a response includes a signature D and a random number D.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the signature D and the random number D are acquired from the response, and the signature D is verified by the public key of the device D. (Step S26). That is, the signature D is verified (signature verification) by ECDSA. Then, when the verification of the signature D is successful (authentication successful), the control unit 13 of the host H signs the random number D and the random number H with the private key of the host H (step S27). That is, the signature H is generated by ECDSA. Next, the control unit 13 of the host H transmits an authentication completion command to the device D via the communication unit 11 (step S28). Such an authentication completion command includes signature H.

Next, when the control module 2 of the device D receives the authentication completion command from the host H via the communication module 1, the signature H is acquired from the authentication completion command, and the signature H is verified with the public key of the host H. (Step S29). That is, the signature H is verified by ECDSA. Then, when the verification of the signature H is successful (authentication successful), the mutual authentication is completed, and the control module 2 of the device D sends a response to the authentication completion command to the host H via the communication module 1 (step S30). ..

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the control unit 13 generates a temporary key pair of the temporary public key H and the temporary private key H unique to the host H (step S31). ). Here, the temporary public key H is a temporary public key and is distinguished from a public key that is shared and managed in advance. Similarly, the temporary private key H is a temporary private key and is distinguished from a private key that is shared and managed in advance. The temporary public key H is generated by an ECDH operation based on a previously generated temporary secret key H (for example, a random numerical value) and a point on an elliptic curve according to the ECDH protocol. In the ECDH operation, for example, the temporary public key H is generated from the temporary secret key H by performing scalar multiplication to calculate the k times point kp of the point p on the elliptic curve. The parameters of the elliptic curve are known between host H and device D. Next, the control unit 13 of the host H transmits a key sharing command to the device D via the communication unit 11 (step S32). Such a key sharing command includes a temporary public key H.

Next, when the control module 2 of the device D receives the key sharing command from the host H via the communication module 1, the temporary public key H is acquired from the key sharing command, and further, the ECDH calculation is performed as in the host H. Generates a temporary key pair of a temporary public key D and a temporary private key D unique to the device D (step S33). The temporary public key D is generated by an ECDH operation based on a previously generated temporary secret key D (for example, a random numerical value) and a point on an elliptic curve according to the ECDH protocol. Next, the control module 2 of the device D generates a shared secret (an example of secret information) from the temporary public key H and the temporary public key D by ECDH calculation (step S34).

Next, the control module 2 of the device D records the host ID and the shared secret generated in step S34 in the non-volatile memory (step S35). Next, the control module 2 of the device D generates a session key used for a secure session between the host H and the device D from the random number H, the random number D, and the shared secret generated in step S34 (step S36). Next, the control module 2 of the device D transmits a response to the key exchange command to the host H via the communication module 1 (step S37). Such a response includes the temporary public key D.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the temporary public key D is acquired from the response, and the temporary public key H and the temporary public key D are obtained by ECDH calculation. Generate a shared secret from (step S38). Since the shared secret generated here is generated by the same generation method as the shared secret generated in step S34, they match. Next, the control unit 13 of the host H associates the device ID with the shared secret generated in step S38 and records it in a memory (for example, RAM or non-volatile memory) (step S39). For example, a device ID (an example of identification information) and a shared secret (an example of secret information) are associated and registered in a table. Next, the control unit 13 of the host H generates a session key from the random number H, the random number D, and the shared secret generated in step S38 (step S40). Since the session key generated here is generated by the same generation method as the session key generated in step S36, they match.

Next, the control unit 13 of the host H starts a secure session with the device D using the session key generated in step S40. When the secure session is started in this way, for example, a read command and its response are transmitted and received between the host H and the device D through the encryption path in which the session key is used. As a result, data exchange and the like are carried out.

(2.2 Simple authentication procedure 1)
In the simple authentication procedure 1, as shown in FIG. 4, the control unit 13 of the host H generates a random number H (step S51). Next, the control unit 13 of the host H transmits an authentication start command to the device D via the communication unit 11 (step S52). The authentication start command includes a host ID unique to the host H, a random number H generated in step S51, and information indicating that the command is for the simple authentication procedure 1.

Next, when the control module 2 of the device D receives the authentication start command from the host H via the communication module 1 and determines that it is the authentication start command for the simple authentication procedure 1, the host ID is determined from the authentication start command. And the random number H is acquired, and the random number D is further generated (step S53). Next, the control module 2 of the device D acquires the shared secret associated with the host ID of the host H and is authenticated from the random number H, the random number D, and the shared secret by the AES (Advanced Encryption Standard) operation. Generate a key (step S54). Next, the control module 2 of the device D generates the authentication code D by encrypting the random number H, the random number D, and the specific value agreed in advance with the authentication key by the AES operation (step S55). ). Next, the control module 2 of the device D transmits a response to the authentication start command to the host H via the communication module 1 (step S56). Such a response includes an authentication code D and a random number D.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the control unit 13 acquires the authentication code D and the random number D from the response, and is further associated with the device ID of the device D. The shared secret recorded in the above is acquired, and an authentication key is generated from the random number H, the random number D, and the shared secret by the AES operation (step S57). Next, the control unit 13 of the host H verifies the authentication code D with the authentication key (step S58). In such verification, the control unit 13 decodes the authentication code D with the authentication key by AES calculation, and the decoded authentication code D, "random number D (that is, random number D obtained from the above response), and random number". It is determined whether or not H and the specific value previously agreed upon match. Then, when the verification of the authentication code D is successful (authentication success), the control unit 13 of the host H encrypts the random number D, the random number H, and the specific value previously agreed with the authentication key by the AES calculation. The authentication code H is generated by the above (step S59). Next, the control unit 13 of the host H transmits an authentication completion command to the device D via the communication unit 11 (step S60). The authentication completion command includes the authentication code H.

Next, when the control module 2 of the device D receives the authentication completion command from the host H via the communication module 1, the control module 2 acquires the authentication code H from the authentication completion command and uses the authentication key generated in step S54. The authentication code H is verified (step S61). In such verification, the control unit 13 decodes the authentication code H with the authentication key by AES calculation, and the decoded authentication code H and "random number D, random number H, and a specific value previously agreed upon". It is determined whether or not matches with. Then, when the verification of the authentication code H is successful (authentication success), the control unit 13 of the host H transmits a response to the authentication completion command to the host H via the communication module 1 (step S62).

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, it generates a random number Rh (step S63). Next, the control unit 13 of the host H molds the random number Rh into a pseudo public key H as shown in FIG. 5 (B) according to the public key format by ECDH as shown in FIG. 5 (A) (that is,). Pseudo public key H is generated) (step S64). Here, "xx" and "yy" in the public key format shown in FIG. 5A are not all the same value, but some numerical value (hexadecimal number) of 1 byte. Further, when the X coordinate is "x" and the Y coordinate is "y", it is necessary to satisfy the following equation (1).

y ^ 2 ≡ x ^ 3 ＋ ax ＋ b (mod p) ・ ・ ・ (1)

Here, "a" and "b" are constants predetermined as curve parameters, respectively, and "p" is an arbitrary prime number predetermined as curve parameters. Further, "rh" in the pseudo public key H shown in FIG. 5 (B) is not all the same value, but may be some numerical value (hexadecimal number) of 1 byte, or '00' '00' ..'. It may be 00'. In the pseudo public key H, it is not necessary to satisfy the relationship (1) above with the numerical value representing the X coordinate and the numerical value representing the Y coordinate. Next, the control unit 13 of the host H transmits a key sharing command to the device D via the communication unit 11 (step S65). Such a key sharing command includes the pseudo public key H generated in step S64.

Next, when the control module 2 of the device D receives the key sharing command from the host H via the communication module 1, the control module 2 acquires the pseudo public key H from the key sharing command and further generates a random number Rd (step). S66). Next, the control module 2 of the device D acquires the shared secret recorded in association with the host ID of the host H, and performs the pseudo public key H, the random number Rd, and the session key (secret) from the shared secret by AES operation. An example of a key value generated using the information and the pseudo public key) is generated (step S67). Next, the control module 2 of the device D generates encrypted data D for confirming the validity of the session key (key value) from the session key and the fixed value by AES calculation (step S68). Next, the control module 2 of the device D converts the random number Rd and the encrypted data D into the pseudo public key D as shown in FIG. 5 (C) according to the public key format by ECDH as shown in FIG. 5 (A). Molding (that is, generating a pseudo public key D) is performed (step S69). The "rd" and "ct" in the pseudo public key D shown in FIG. 5B are not all the same value, but may be some numerical value (hexadecimal number) of 1 byte. Next, the control module 2 of the device D transmits a response to the key sharing command to the host H via the communication module 1 (step S70). Such a response includes a pseudo public key D.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the pseudo public key D is acquired from the response and further recorded in association with the device ID of the device D. The shared secret is acquired, and a session key is generated from the random number Rh, the pseudo public key D, and the shared secret by AES operation (step S71). Next, the control unit 13 of the host H generates the encrypted data H from the session key and the fixed value by the AES operation (step S72). Next, the control unit 13 of the host H verifies the pseudo public key D with the encrypted data H (in other words, verifies the encrypted data D), and determines whether or not the encrypted communication can be performed (step S73). In this verification, it is confirmed whether or not the encrypted data H and the encrypted data D included in the pseudo public key D match. Then, when the verification of the pseudo public key D is successful, the control unit 13 of the host H determines that the implementation is feasible, and starts a secure session with the device D using the session key generated in step S71. .. On the other hand, if the verification of the pseudo public key D fails, the control unit 13 of the host H determines that the implementation is unsuccessful and executes error processing.

(2.3 Simple authentication procedure 2)
In the simple authentication procedure 2, as shown in FIG. 6, the control unit 13 of the host H generates a random number H (step S81). Next, the control unit 13 of the host H transmits an authentication start command to the device D via the communication unit 11 (step S82). The authentication start command includes a host ID unique to the host H, a random number H generated in step S81, and information indicating that the command is for the simple authentication procedure 2.

Next, when the control module 2 of the device D receives the authentication start command from the host H via the communication module 1 and determines that it is the authentication start command for the simple authentication procedure 2, the host ID is determined from the authentication start command. And the random number H is acquired, and the random number D is further generated (step S83). Next, the control module 2 of the device D acquires the shared secret recorded in association with the host ID of the host H, and generates an authentication key from the random number H, the random number D, and the shared secret by AES operation ( Step S84). Next, the control module 2 of the device D generates the authentication code D by encrypting the random number H, the random number D, and the specific value agreed in advance with the authentication key by the AES operation (step S85). ). Next, the control module 2 of the device D transmits a response to the authentication start command to the host H via the communication module 1 (step S86). Such a response includes an authentication code D and a random number D.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the control unit 13 acquires the authentication code D and the random number D from the response, and is further associated with the device ID of the device D. The shared secret recorded in the above is acquired, and an authentication key is generated from the random number H, the random number D, and the shared secret by the AES operation (step S87). Next, the control unit 13 of the host H verifies the authentication code D with the authentication key by the AES operation in the same manner as in step S58 described above (step S88). Then, when the verification of the authentication code D is successful (authentication success), the control unit 13 of the host H generates a random number Rh (step S89). Next, the control unit 13 of the host H molds the random number Rh into a pseudo public key H according to the public key format by ECDH (step S90). Next, the control unit 13 of the host H transmits a key sharing command to the device D via the communication unit 11 (step S91). Such a key sharing command includes the pseudo public key H generated in step S90.

Next, when the control module 2 of the device D receives the key sharing command from the host H via the communication module 1, the control module 2 acquires the pseudo public key H from the key sharing command and further generates a random number Rd (step). S92). Next, the control module 2 of the device D acquires the shared secret recorded in association with the host ID of the host H, and generates a session key from the pseudo public key H, the random number Rd, and the shared secret by AES operation. (Step S93). Next, the control module 2 of the device D generates encrypted data D for confirming the validity of the session key (key value) from the session key and the fixed value by AES calculation (step S94). Next, the control module 2 of the device D molds the random number Rd and the encrypted data D into the pseudo public key D according to the public key format by ECDH (step S95). Next, the control module 2 of the device D transmits a response to the key sharing command to the host H via the communication module 1 (step S96). Such a response includes a pseudo public key D.

Next, when the control unit 13 of the host H receives the response from the device D via the communication unit 11, the pseudo public key D is acquired from the response and further recorded in association with the device ID of the device D. The shared secret is acquired, and a session key is generated from the random number Rh, the pseudo public key D, and the shared secret by AES operation (step S97). Next, the control unit 13 of the host H generates the encrypted data H from the session key and the fixed value by the AES operation (step S98). Next, the control unit 13 of the host H verifies the pseudo public key D with the encrypted data H (in other words, verifies the encrypted data D), and determines whether or not the encrypted communication can be performed (step S99). In this verification, it is confirmed whether or not the encrypted data H and the encrypted data D included in the pseudo public key D match. Then, when the verification of the pseudo public key D is successful, the control unit 13 of the host H determines that the implementation is feasible, and starts a secure session with the device D using the session key generated in step S97. .. On the other hand, if the verification of the pseudo public key D fails, the control unit 13 of the host H determines that the implementation is unsuccessful and executes error processing.

As described above, according to the above embodiment, the host H generates a random number, molds the generated random key into a public key format according to the ECDH protocol, generates a pseudo public key, and performs an advanced authentication procedure. Since the session key is generated using the shared secret information and the pseudo public key, DH is not actually used even if an instruction indicating the use of DH is received for key generation. It is possible to realize a faster key generation process.

In the above-described embodiment, an authentication method having two types of authentication processes, an advanced authentication procedure and a simple authentication procedure, has been described as an example, but the present invention has an authentication method in which three or more types of authentication processes exist. It can also be applied to. Further, in the above embodiment, the case where the non-contact communication is performed between the host H and the device D has been described as an example, but the present invention is the case where the contact communication is performed between the host H and the device D. It is also applicable in. Further, in the above embodiment, FIGS. 2 to 6 show the processing of the control unit 13 of the host H and the control module 2 of the device D, but the processing of the control module 2 of the device D is executed by the IC module 3. May be good.

1 Communication module 2 Control module 3 IC module 11 Communication unit 12 Storage unit 13 Control unit D Device H Host S Authentication system

Claims (4)

A communication device capable of selecting either an advanced authentication procedure that requires a large amount of calculation with a communication partner or a simple authentication procedure that requires a smaller amount of calculation with the communication partner.
A storage means for storing confidential information generated in the advanced authentication procedure, and
The first means of generating random numbers and
A second generation means for generating a pseudo-public key by molding the random number into a public key format according to the ECDH (Elliptic curve Diffie-Hellman key exchange) protocol.
If the secret information is not stored in the storage means when communication is performed with the communication partner, the advanced authentication procedure is selected to generate the key exchange by the ECDH and the session key, while the said. When the secret information is stored in the storage means, a third generation means that selects the simple authentication procedure and generates a session key using the secret information and the pseudo public key, and a third generation means.
A communication device characterized by being provided with. The computer included in the device to be the communication partner of the communication device according to claim 1.
The step of storing the confidential information generated in the advanced authentication procedure and
A step of receiving a command including the pseudo public key from the communication device, and
In response to the received command, a step of generating encrypted data for confirming the validity of the key value generated by using the secret information and the pseudo public key, and
A step of transmitting a response including the encrypted data to the communication device,
A program characterized by executing. A communication device capable of selecting either an advanced authentication procedure that requires a large amount of calculation with a communication partner or a simple authentication procedure that requires a smaller amount of calculation with the communication partner. In a communication method performed by the communication device comprising a storage means for storing confidential information generated in an authentication procedure.
Steps to generate random numbers and
A step of molding the random number into a public key format according to the ECDH (Elliptic curve Diffie-Hellman key exchange) protocol to generate a pseudo public key, and
If the secret information is not stored in the storage means when communication is performed with the communication partner, the advanced authentication procedure is selected to generate the key exchange by the ECDH and the session key, while the said. When the secret information is stored in the storage means, the step of selecting the simple authentication procedure and generating the session key using the secret information and the pseudo public key, and
A communication method characterized by including. A computer included in a communication device that can select either an advanced authentication procedure that requires a large amount of calculation with a communication partner or a simple authentication procedure that requires a smaller amount of calculation with the communication partner.
A storage means for storing confidential information generated in the advanced authentication procedure, and
The first means of generating random numbers and
A second generation means for generating a pseudo-public key by molding the random number into a public key format according to the ECDH (Elliptic curve Diffie-Hellman key exchange) protocol.
If the secret information is not stored in the storage means when communication is performed with the communication partner, the advanced authentication procedure is selected to generate the key exchange by the ECDH and the session key, while the said. When the secret information is stored in the storage means, the simple authentication procedure is selected to function as a third generation means for generating a session key using the secret information and the pseudo public key. program.

Images