JP7090496B2 - Authentication method, authentication device, authenticated device and image forming device - Google Patents

Description

The present invention relates to an authentication technique for an authenticated device by an authentication device and an image forming apparatus.

The image forming apparatus has an exchange unit. For example, since the fixing unit for fixing the toner image formed on the recording material to the recording material is used in a high temperature environment, its life is shorter than that of the main body of the image forming apparatus. Therefore, the anchoring unit is usually designed as a replaceable replacement unit. Further, the image forming apparatus may optionally be provided with an expansion unit that can be attached to the image forming apparatus at the option of the user. For example, a feeder or a paper ejection unit may be prepared as an expansion unit. Counterfeit products of replacement units and expansion units designed to be removable from the main body of these image forming devices may be on the market. If such a counterfeit product is attached to an image forming apparatus and used, problems such as malfunction of the image forming apparatus main body may occur. Therefore, it is necessary to identify whether or not the unit mounted on the image forming apparatus is a genuine product.

In order to determine and certify whether the mounted unit is a genuine product, it has already been used to use authentication technology, which is a kind of encryption technology. Non-Patent Document 1 discloses an AES algorithm which is a common key cryptosystem. Non-Patent Document 2 discloses the SHA256 algorithm which is an encrypted hash function. As described in Patent Document 1, a challenge-response authentication method using a common key cryptosystem or a cryptographic hash function is generally used for authentication. Patent Document 1 has a configuration in which the authenticated device encrypts random data (challenge) received from the authentication device and sends back the encrypted data (response), and the authentication device determines whether the encrypted data is correct to perform authentication. It is disclosed. Non-Patent Document 3 discloses a method of calculating a message authentication code (response) based on common key cryptography. Further, Non-Patent Document 4 discloses a method of calculating a message authentication code (response) based on an encrypted hash function. The challenge-response authentication method presupposes that the authentication device and the non-authentication device have the same encryption key. Therefore, it is important to keep the encryption key confidential. Therefore, the encryption key is stored and the authentication process is performed by a highly secure anti-tamper chip such as a security LSI.

Japanese Patent Application Laid-Open No. 2003-162896

NIST_FIPS_PUB 180-4 NIST_FIPS_PUB 197 NIST SP 800-38B NIST_FIPS_PUB 198-1

However, analysis techniques for security LSIs are advancing year by year, and even if the security performance is high at the beginning of development, there is a risk that the security performance will deteriorate in a short period of time. In Patent Document 1, since the authentication device and the authenticated device hold a common encryption key, if the analysis for either the authentication device or the authenticated device is successful, the authenticated device that succeeds in the authentication by the authentication device is described. It will be possible to manufacture.

The present invention provides an authentication method, an authentication device, a certified device, and an image forming device that can suppress the influence on the leakage of a key.

According to one aspect of the present invention, it is a method of authenticating an authenticated device by an authentication device holding a first original key among a plurality of original keys and an identifier of the first original key, and the authenticated device. Holds a first value and a plurality of derived keys generated by using each of the plurality of original keys and the first value as an input of a unidirectional function, and the authentication method is described in the above-mentioned authentication method. The step in which the authenticated device selects a selected key from the plurality of derived keys based on the identifier of the first original key notified from the authenticated device, and the challenge data notified by the authenticated device from the authenticated device. A step of generating authentication data based on the first generated key based on the selected key, and the authentication device having the first original key and the first value notified from the authenticated device. A step of generating an authentication key as an input of the one-way function, a step of the authentication device generating comparison data based on the challenge data and a second generation key based on the authentication key, and the authentication device. However, it is characterized by including a step of authenticating the authenticated device by comparing the comparison data with the authentication data notified from the authenticated device.

According to the present invention, the influence on the leakage of the key can be suppressed.

The block diagram of the authentication system by one Embodiment. A block diagram of a chip to be authenticated and a controller according to an embodiment. An explanatory diagram of the relationship between the original key, the eigenvalues, and the derived key according to one embodiment. The figure which shows the information which the authentication chip and the authenticated chip according to one Embodiment hold. A sequence diagram of an authentication method according to an embodiment. The block diagram of the authentication system by one Embodiment. A block diagram of a chip to be authenticated and a controller according to an embodiment. The figure which shows the information held by the authenticated chip by one Embodiment. A sequence diagram of an authentication method according to an embodiment. The figure which shows the information held by the authenticated chip by one Embodiment. A sequence diagram of an authentication method according to an embodiment. The figure which shows the information held by the authenticated chip by one Embodiment. A sequence diagram of an authentication method according to an embodiment. The figure which shows the information held by the authenticated chip by one Embodiment. A sequence diagram of an authentication method according to an embodiment.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the drawings. The following embodiments are examples, and the present invention is not limited to the contents of the embodiments. Further, in each of the following figures, components not necessary for the description of the embodiment will be omitted from the drawings.

<First Embodiment>
FIG. 1 is a configuration diagram of an image forming apparatus 100 to which the authentication system according to the present embodiment is applied. The image forming apparatus 100 has a controller 101 which is an authentication apparatus. In the present embodiment, the controller 101 controls the operation of the entire image forming apparatus 100 in addition to the authentication process. The process cartridge 102 is an authenticated device and forms an image on the sheet under the control of the controller 101. The process cartridge 102 is a unit that can be attached to and detached from the image forming apparatus 100. The controller 101 authenticates the validity of the mounted process cartridge 102 and determines whether or not the process cartridge 102 is a genuine product. Therefore, the process cartridge 102 is provided with a chip 103 to be authenticated for authentication. The authenticated chip 103 is an anti-tamper chip. Further, the controller 101 is equipped with a communication I / F circuit 104 that communicates with the authenticated chip 103, a control device 105 that controls the authentication process, and an authentication chip 106 for authenticating the process cartridge 102. The authentication chip 106 is an anti-tamper chip. The communication I / F circuit 104 is configured such that the image forming apparatus 100 is electrically connected to the authenticated chip 103 in a state where the process cartridge 102 is attached to the image forming apparatus 100. Therefore, the control device 105 can communicate with the authenticated chip 103 via the communication I / F circuit 104 in a state where the process cartridge 102 is mounted on the image forming device 100.

FIG. 2 shows in more detail the connection configuration and the internal configuration of the controller 101 and the authenticated chip 103. When the authentication chip 106 receives a command from the control device 105, the authentication chip 106 returns a response to the control device 105 as a response to the command. The input / output unit 201 of the authentication chip 106 transmits / receives commands / responses to / from the control device 105. The microcomputer 202 executes internal processing according to a command from the control device 105. At that time, the microcomputer 202 stores the temporary data in the volatile memory 203. The encryption device 204 executes the encryption calculation in the authentication process according to the instruction of the microcomputer 202. The non-volatile memory 205 holds a key used in cryptographic calculation and data necessary for authentication processing.

Further, the authenticated chip 103 receives a command from the control device 105 via the communication I / F circuit 104, and transmits a response to the control device 105 via the communication I / F circuit 104 as the response. The input / output unit 301 of the authenticated chip 103 transmits / receives commands / responses to / from the communication I / F circuit 104. The microcomputer 302 executes internal processing according to a command from the control device 105. At that time, the microcomputer 302 stores the temporary data in the volatile memory 303. The cryptographic device 304 executes the cryptographic calculation in the authentication process according to the instruction of the microcomputer 302. The encryption device 204 and the encryption device 304 perform an encryption operation by the same algorithm. The non-volatile memory 305 holds a key used in cryptographic calculation and data necessary for authentication processing. The starting point of the authentication process is the control device 105. That is, the control device 105 transmits the command to the authentication chip 106 and the authenticated chip 103, and the authentication chip 106 and the authenticated chip 103 perform processing according to the command and transmit the response to the control device 105.

FIG. 3 is an explanatory diagram of a key configuration used for authentication. First, a plurality of original keys (MK) are generated in advance. An identifier (original key ID) is assigned to each original key. In FIG. 3, n original keys are shown, and their identifiers are 1 to n, respectively. Hereinafter, the original key whose identifier is i is referred to as MK_i. The values of the plurality of original keys are selected so that another original key cannot be inferred from one original key. In the non-volatile memory 205 of the authentication chip 106, one of the plurality of original keys and the identifier (original key ID) of the one original key are stored. FIG. 4A shows a state in which the value i as the original key ID and the original key MK_i are stored in the non-volatile memory 205. The original key stored in the non-volatile memory 205 is randomly selected from the n original keys generated in advance when the controller 101 is manufactured.

On the other hand, the derived key (DK) is stored in the non-volatile memory 305 of the authenticated chip 103. One derived key is derived from one original key and one eigenvalue by a one-way function. In the following, the derived key derived from the eigenvalue j and the original key MK_i will be referred to as the derived key DK_ij. The derived key DK_ij is obtained by an operation with DK_ij = F (MK_i, j). Note that F () is a one-way function, and may be a function used in a cryptographic hash function or a symmetric key cryptographic operation. As shown in FIG. 3, a total of n × m derived keys are generated from n original keys and m eigenvalues.

The non-volatile memory 305 of the authenticated chip 103 stores one eigenvalue and n derived keys generated by the eigenvalue and each of the n original keys. FIG. 4B shows a state in which the eigenvalues j and the derived keys DK_1j to DK_nj are stored in the non-volatile memory 305.

As described above, a cryptographic hash function or a common key cryptographic function can be used for the one-way function F (). In the case of the cryptographic hash function, SHA-256 disclosed in Non-Patent Document 1 can be used. In this case, the derived key DK_ij is obtained by inputting the data obtained by concatenating the original key MK_i and the eigenvalue j as the input of the encryption hash function according to SHA-256. Further, in the case of the common key cryptographic function, AES standardized in Non-Patent Document 2 can be used. In this case, the derived key DK_ij is obtained by using the eigenvalue j as a message and encrypting the message with the original key MK_i by a method according to AES. The eigenvalues stored in the non-volatile memory 305 are determined to be different for each process cartridge 102 when the process cartridge 102 is manufactured. It should be noted that instead of storing different eigenvalues in all the process cartridges 102, one eigenvalue selected from a plurality of eigenvalues may be assigned to the process cartridge 102. Then, in the manufacturing process, the eigenvalues assigned to the process cartridge 102 and the n derived keys generated from each of the eigenvalues and the n original keys are stored in the non-volatile memory 305 of the process cartridge 102.

FIG. 5 is a sequence diagram of the authentication process. In FIG. 5, the signal starting with the letter C indicates a command, and the signal starting with the letter R indicates a response. Further, the character OP indicates a process performed by the corresponding device or chip. At C01, the control device 105 queries the authenticated chip 103 for an eigenvalue. The authenticated chip 103 reads the eigenvalue j from the non-volatile memory 305, and notifies the control device 105 of the eigenvalue j by R01. At C02, the control device 105 issues a command instructing the authentication chip 106 to generate an authentication key. This command contains the eigenvalue j. The authentication chip 106 generates an authentication key DK_ij based on the original key MK_i stored in the non-volatile memory 205 and the received eigenvalue j in accordance with the command in OP01. The method of generating the authentication key is the same as the method of generating the derived key. When the authentication key DK_ij is generated, the authentication chip 106 notifies the control device 105 of the completion of the generation of the authentication key by R02. The control device 105 inquires the authentication chip 106 for the original key ID at C03. The authentication chip 106 reads the original key ID stored in the non-volatile memory 205, and notifies the control device 105 of the original key ID by R03. In this example, the original key ID stored in the non-volatile memory 205 is i.

The control device 105 transmits the original key ID to the authenticated chip 103 at C04. The authenticated chip 103 selects the derived key corresponding to the original key ID as the selection key in OP02. Therefore, if the authenticated chip 103 is legitimate, the selection key selected by the authenticated chip 103 is the same as the authentication key DK_ij generated by the authentication chip 106 in OP01. When the selection key is selected, the authenticated chip 103 notifies the control device 105 of the completion of selection of the selection key by R04. The control device 105 generates random number data as challenge data in OP03. The control device 105 transmits a command for generating authentication data to the authenticated chip 103 at C05. This command includes random number data (challenge data).

The authenticated chip 103 uses the encryption device 304 in OP04 to generate authentication data, which is response data, from the selection key DK_ij and random number data. The authenticated chip 103 notifies the control device 105 of the authentication data (response data) by R05. The control device 105 issues a comparison data generation command to the authentication chip 106 at C06. This command includes random number data and authentication data. The authentication chip 106 uses the encryption device 204 in OP05 to generate comparison data from the authentication key DK_ij and random number data, and compares the data with the authentication data. Since the encryption device 204 and the encryption device 304 perform the same encryption operation, if the authenticated chip 103 is valid, the authentication data and the comparison data match. The authentication chip 106 notifies the control device 105 of the comparison result, that is, whether or not the comparison data and the authentication data match with R06. Upon receiving the notification that the comparison data and the authentication data match, the control device 105 determines that the authentication is OK in OP06, and determines that the authentication is NG if they do not match.

If the control device 105 determines that the authentication is OK, it determines that the process cartridge 102 is a legitimate product, and if it determines that the authentication is NG, it determines that the process cartridge 102 is not a legitimate product. When the control device 105 determines that the process cartridge 102 is not a legitimate product, for example, the control device 105 indicates to the user that the process cartridge 102 is not a legitimate product. Alternatively, when the control device 105 determines that the process cartridge 102 is not a legitimate product, for example, it determines whether or not to suspend the image forming process and allow the display unit of the image forming apparatus (not shown) to form an image. Is displayed to the user.

The sequence sequence in FIG. 5 is an example, and the present invention is not limited to the sequence sequence shown in FIG. For example, the authentication chip 103 may be made to select the selected key first, and then the authentication chip 106 may be made to calculate the authentication key. It is also possible to notify the authenticated chip 103 of the original key ID and the random number data at the same time so that the authenticated chip can generate the authentication data. Further, the unique value, the random number data, and the authentication data can be simultaneously notified to the authentication chip 106, and the authentication chip 106 can be instructed to calculate the authentication key, calculate the comparison data, and compare the authentication data with the comparison data. That is, the authentication chip 106 and the authenticated chip 103 may notify the data required for the calculation by the time the calculation is performed. Further, in the sequence of FIG. 5, the comparison data and the authentication data are compared in the authentication chip 106, but the comparison data and the authentication data can be compared by the control device 105. In this case, it is not necessary to notify the authentication data to the authentication chip 106 in C06, but in R06, the comparison data is notified to the control device 105 instead of notifying the comparison result.

For the calculation of the authentication data, for example, CMAC based on the common key cryptographic technique described in Non-Patent Document 3 can be used. In this case, the random number data is used as the message, the message is encrypted with the selection key DK_ij, and the encrypted data of the message is used as the authentication data. Further, for the calculation of the authentication data, for example, HMAC based on the cryptographic hash function described in Non-Patent Document 4 can be used. In this case, the random number data is used as text, and the encryption hash value of the message is obtained with the selection key DK_ij. The same applies to the calculation of comparative data. As a matter of course, the same algorithm is used for the calculation of the authentication data and the comparison data.

For example, it is assumed that the authentication chip 106 is attacked and the original key MK_i held by the authentication chip 106 is leaked. In this case, the attacker can generate the derived key generated by using the acquired original key MK_i, but cannot generate the derived key corresponding to the other original keys. In this case, the attacker can manufacture a unit capable of authenticating the image forming apparatus 100 in which the original key MK_i is stored in the authentication chip 106 to be legitimate, but these units can authenticate the other original keys to the authentication chip. The image forming apparatus 100 stored in 106 does not result in successful authentication.

Further, it is assumed that the authenticated chip 103 is attacked and the derived key held by the authenticated chip 103 is leaked. Here, as shown in the sequence of FIG. 5, the selection key is selected from a plurality of derived keys held by the authenticated chip 103 according to the original key ID held by the authentication chip 106. Therefore, unless all the derived keys are leaked from the authenticated chip 103, it is not possible to manufacture a unit capable of successful authentication with all the image forming apparatus 100. Here, since the destructive attack, which is an amazing analysis technique for anti-tamper chips, cuts or scrapes the chip, it is necessary to acquire multiple keys stored in the authenticated chip before the chip is destroyed. Is extremely difficult.

With the above configuration, it is possible to suppress the influence of the attack on the leakage of the original key or the derived key. As described above, according to the present embodiment, it is possible to increase the difficulty of analysis to the authenticated chip 106 and the authenticated chip 103 as compared with the conventional case. Particularly for the analysis of the authentication chip 106, it is possible to provide an authentication system that makes it virtually meaningless.

<Second embodiment>
Subsequently, the second embodiment will be described focusing on the differences from the first embodiment. The same reference numerals are used for the same components as those described in the first embodiment, and the description thereof will be omitted. FIG. 6 shows an example in which the authentication system according to the present embodiment is applied to the image forming apparatus 800. Unlike the first embodiment, the controller 101 authenticates the fuser 802, which is a unit detachable from the image forming apparatus 800. The fuser 802 has a chip 803 to be certified, which is an anti-tamper chip. FIG. 7 shows in more detail the connection configuration and the internal configuration of the controller 101 and the authenticated chip 803. The configuration of the controller 101 of this embodiment is the same as that of the first embodiment, and the information shown in FIG. 4A is stored in the non-volatile memory 205. On the other hand, as shown in FIG. 8, the non-volatile memory 905 of the authenticated chip 803 stores the eigenvalues j, the derived keys DK_1j to DK_nj, and the unit identifier UID. The unit identifier UID is data assigned to a unit that can be attached to the image forming apparatus 800 and for identifying the unit. The method of generating the derived keys DK_1j to DK_nj is the same as that of the first embodiment.

FIG. 9 is a sequence diagram of the authentication process according to the present embodiment. The processing up to C05 is the same as that of the first embodiment, and the description thereof will be omitted. When the authenticated chip 803 receives the random number data, the OP24 uses the encryption device 304 to generate the authentication data. In the present embodiment, the encryption device 304 generates authentication data by combining random data, unit identifiers stored in the non-volatile memory 905, and selection key DK_ij. The authenticated chip 803 notifies the control device 105 of the authentication data and the unit identifier by R25. The control device 105 issues a comparison data generation command to the authentication chip 106 at C26. This command includes random number data, authentication data and unit identifiers. The authentication chip 106 uses the encryption device 204 in OP25 to generate comparison data by the combined data in which the random number data and the unit identifier are combined and the authentication key DK_ij. Since the encryption device 204 and the encryption device 304 perform the same encryption operation, if the authenticated chip 803 is valid, the authentication data and the comparison data match. The authentication chip 106 notifies the control device 105 of the comparison result, that is, whether or not the comparison data and the authentication data match with R06. Upon receiving the notification that the comparison data and the authentication data match, the control device 105 determines that the authentication is OK in OP06, and determines that the authentication is NG if they do not match.

For the calculation of the authentication data, for example, CMAC based on the common key cryptographic technique described in Non-Patent Document 3 can be used. In this case, the combined data obtained by combining the random number data and the unit identifier is used as a message, and the message is encrypted with the selection key DK_ij. Further, for the calculation of the authentication data, for example, HMAC based on the cryptographic hash function described in Non-Patent Document 4 can be used. In this case, the combined data obtained by combining the random number data and the unit identifier is used as the text, and the encrypted hash value of the text is obtained with the selection key DK_ij. The same applies to the calculation of comparative data. As a matter of course, the same algorithm is used for the calculation of the authentication data and the comparison data.

In this embodiment, the unit identifier is also used to generate the authentication data and the comparison data. Therefore, in addition to the same effect as in the first embodiment, it is possible to verify whether the unit identifier is a value used in the genuine product. That is, for example, although not shown in FIG. 9, even if the authentication data and the comparison data match, if the unit identifier is not used in the fuser 802, it can be determined that the authentication is NG.

<Third embodiment>
Subsequently, the third embodiment will be described focusing on the differences from the first embodiment. The authentication system according to the present embodiment has the same configuration as that of FIGS. 1 and 2, and the information shown in FIG. 4A is stored in the non-volatile memory 205 of the authentication chip 106. Further, as shown in FIG. 10, the non-volatile memory 305 of the authenticated chip 103 stores the eigenvalues j and the derived keys DK_1j to DK_nj as in the first embodiment. Further, in the present embodiment, the registers Rg_1j to Rg_nj are provided in the non-volatile memory 305 of the chip 103 to be authenticated. The register Rg_ij (i is an integer from 1 to n) corresponds to the derived key DK_ij and the original key ID whose value is i. As will be described later, the register value corresponding to the derived key DK_ij is stored in the register Rg_ij, and the register value of the derived key DK_ij is updated every time the derived key DK_ij is used in the authentication process. In the present embodiment, when the derived key DK_ij is used in the authentication process, the register value of the register Rg_ij is incremented by 1. The initial value of the register Rg_ij is determined at random, for example.

FIG. 11 is a sequence diagram of the authentication process according to the present embodiment. At C31, the control device 105 queries the authenticated chip 103 for an eigenvalue. The authenticated chip 103 reads the eigenvalue j from the non-volatile memory 305, and notifies the control device 105 of the eigenvalue j by R31. The control device 105 inquires the authentication chip 106 for the original key ID at C32. The authentication chip 106 reads the original key ID stored in the non-volatile memory 205, and notifies the control device 105 of the original key ID by R32. In this example, the original key ID stored in the non-volatile memory 205 is i. The control device 105 transmits the original key ID to the authenticated chip 103 at C33, and inquires the authenticated chip 103 of the register value corresponding to the transmitted original key ID. In the present embodiment, since the original key ID is i, this corresponds to inquiring the register value stored in the register Rg_ij. It is also possible to notify the authenticated chip 103 of the original key ID by notifying the authenticated chip 103 of the address of the register Rg_ij of the non-volatile memory 305 instead of directly transmitting the original key ID. .. In this case, the relationship between the original key ID and the address of the register Rg_ij corresponding to the original key ID in the non-volatile memory 305 is stored in the control device 105. The authenticated chip 103 reads the register value of the register Rg_ij from the non-volatile memory 305, and notifies the control device 105 of the register value of the register Rg_ij by R33.

At C34, the control device 105 issues a command instructing the authentication chip 106 to generate an authentication key. This command contains the eigenvalue j. The authentication chip 106 generates an authentication key DK_ij based on the original key MK_i stored in the non-volatile memory 205 and the received eigenvalue j according to the command in OP32. The method of generating the authentication key is the same as the method of generating the derived key. When the authentication key DK_ij is generated, the authentication chip 106 notifies the control device 105 of the completion of the generation of the authentication key by R34.

At C35, the control device 105 issues a command instructing the authenticated chip 103 to generate a generated key. The authenticated chip 103 first selects the derived key corresponding to the original key ID as the selection key in OP33. The original key ID is notified by C33. If the authenticated chip 103 is legitimate, the selection key selected by the authenticated chip 103 is the same as the authentication key DK_ij generated by the authentication chip 106 in OP32. Subsequently, the authenticated chip 103 updates the register value stored in the register Rg_ij corresponding to the selected key so as to increase by one. Then, the generated key is generated by using the updated register value and the selected key as the input of the one-way function. When the generated key is generated, the authenticated chip 103 notifies the control device 105 of the completion of generation of the generated key by R35.

At C36, the control device 105 issues a command instructing the authentication chip 106 to generate the generated key. This command contains the register value. It is also possible to notify the authentication chip 106 of the register value in advance at the timing of C34. In this case, only the command instruction is given in C36. In OP34, the authentication chip 106 generates a generated key based on the authentication key DK_ij generated in OP32 and the value obtained by increasing the notified register value by 1. The generated key generation algorithm is the same as the generated key generation algorithm in the authenticated chip 103 in OP33. When the generation key is generated, the authentication chip 106 notifies the control device 105 of the completion of generation of the generation key on R36.

At OP35, the control device 105 generates a predetermined fixed value as challenge data. At C37, the control device 105 transmits an authentication data generation command to the authenticated chip 103. This command contains a fixed value (challenge data). In OP36, the authenticated chip 103 uses the encryption device 304 to generate authentication data, which is response data, from the generated key and the fixed value. At R37, the authenticated chip 103 notifies the control device 105 of the authentication data (response data).

Similarly, at C38, the control device 105 sends a comparison data generation command to the authentication chip 106. This command includes a fixed value (challenge data) generated by OP35. At OP37, the authentication chip 106 uses the encryption device 204 to generate comparison data from the generated key and the fixed value. In R38, the authentication chip 106 notifies the control device 105 of the comparison data (response data).

In OP38, the control device 105 compares the authentication data received from the authenticated chip 103 with the comparison data received from the authentication chip 106. Since the encryption device 204 and the encryption device 304 perform the same encryption operation, if the authenticated chip 103 is valid, the authentication data and the comparison data match. The control device 105 determines that the authentication is OK if they match, and determines that the authentication is NG if they do not match.

If the control device 105 determines that the authentication is OK, it determines that the process cartridge 102 is a legitimate product, and if it determines that the authentication is NG, it determines that the process cartridge 102 is not a legitimate product. When the control device 105 determines that the process cartridge 102 is not a legitimate product, for example, it suspends the image forming process and uses a determination as to whether or not to allow the display unit of the image forming apparatus (not shown) to form an image. Display to be entrusted to the person.

The sequence sequence in FIG. 11 is an example, and the present invention is not limited to the sequence sequence shown in FIG. Specifically, as long as the control device 105 notifies the authentication chip 106 / the authenticated chip 103 of the data required for the calculation by the authentication chip 106 / the authenticated chip 103 by the time the calculation is performed, the sequence order is Optional. Further, in the present embodiment, an operation for increasing the register value by 1 is performed, and a generation key is generated based on the register value after the operation. However, as long as the authentication chip 106 and the authenticated chip 103 perform the same predetermined calculation, the register value calculation method (update method) is not limited to increasing the register value by 1, and any calculation method is used. be able to. Further, the calculation method of the authentication data and the comparison data is the same except that the selection key / authentication key in the first embodiment is the generation key. In other words, in the present embodiment, the generation key is generated from the selection key / authentication key, but in the first embodiment and the second embodiment, the selection key / authentication key is used as the generation key.

One of the methods for decrypting the key for encryption is to observe the input / output to and from the encryption device while repeatedly operating the encryption device. For example, in the same combination of the image forming apparatus 100 and the process cartridge 102, the authentication key / selection key used for authentication is always the same, so that the authentication key / selection key may be leaked by this method. However, in the present embodiment, the authentication data / comparison data is generated by using the generation key derived from the authentication key / selection key instead of the authentication key / selection key of the first embodiment. Since a register value whose value changes each time authentication is used to generate this generated key, the generated generated key changes each time authentication is performed. Therefore, in the configuration of the present embodiment, it is extremely difficult to derive the authentication key / selection key for the method of observing the input / output to and from the encryption device while repeatedly operating the encryption device. Further, in the present embodiment, the generation key is generated based on the value obtained by performing a predetermined operation on the register value, not the register value transmitted / received between the control device 105 and the authentication chip 106 / authenticated chip 103. .. Therefore, unless the contents of a predetermined operation are leaked, the updated register value used for generating the generated key is unknown even if the transmitted and received register values can be acquired, and there is a risk of leaking the authentication key / selection key. The sex can be reduced.

In this embodiment, since the generation key used to generate the authentication data / comparison data changes each time authentication is performed, the challenge data is set as fixed predetermined data, but the same as in the first embodiment. Challenge data can also be random data. Further, in the present embodiment, the authentication data and the comparison data are compared in the control device 105, but the authentication chip 106 may be used for comparison in the same manner as in the first embodiment.

<Fourth Embodiment>
Subsequently, the fourth embodiment will be described focusing on the differences from the third embodiment. The authentication system according to the present embodiment has the same configuration as that of FIGS. 1 and 2, and the information shown in FIG. 4A is stored in the non-volatile memory 205 of the authentication chip 106. On the other hand, as shown in FIG. 12, the unit identifier UID is stored in the non-volatile memory 305 of the authenticated chip 103 in addition to the same information as in the third embodiment. The unit identifier UID is data assigned to a unit that can be attached to the image forming apparatus 100 and for identifying the unit.

FIG. 13 is a sequence diagram of the authentication process according to the present embodiment. The processing up to C37 is the same as that of the third embodiment, and the description thereof will be omitted. When the authenticated chip 103 receives the challenge data, the OP 51 uses the encryption device 304 to generate the authentication data. In the present embodiment, the encryption device 304 generates authentication data by the challenge data, the combination data in which the unit identifier stored in the non-volatile memory 305 is combined, and the generation key. The authenticated chip 103 notifies the control device 105 of the authentication data and the unit identifier by R51. At C51, the control device 105 transmits a comparison data generation command to the authentication chip 106. This command contains challenge data and a unit identifier. In OP52, the authentication chip 106 uses the encryption device 204 to generate comparison data by combining the received challenge data and the unit identifier, and the generated key. In R38, the authentication chip 106 notifies the control device 105 of the comparison data (response data). Subsequent processing is the same as in the third embodiment.

In this embodiment, the unit identifier is also used to generate the authentication data / comparison data. Therefore, in addition to the same effect as in the third embodiment, it is possible to verify whether the unit identifier is a value used in the genuine product. That is, for example, although not shown in FIG. 13, even if the authentication data and the comparison data match, if the unit identifier is not used, it can be determined that the authentication is NG.

<Fifth Embodiment>
Next, the fifth embodiment will be described focusing on the differences from the third embodiment. The authentication system according to the present embodiment has the same configuration as that of FIGS. 1 and 2, and the information shown in FIG. 4A is stored in the non-volatile memory 205 of the authentication chip 106. On the other hand, as shown in FIG. 14, the non-volatile memory 305 of the chip 103 to be authenticated is provided with one register Rg instead of the registers Rg_1j to Rg_nj of the third embodiment.

FIG. 15 is a sequence diagram of the authentication process according to the present embodiment. The processing from C41 to R42 is the same as that from C31 to R32 of the third embodiment, and the description thereof will be omitted. At C43, the control device 105 inquires about the register value from the authenticated chip 103. First, the authenticated chip 103 internally generates a random number in OP41, and stores the generated random number in the register Rg. Further, the authenticated chip 103 notifies the control device 105 of the register value stored in the register Rg by R43. Subsequent processing of C44 and R44 is the same as that of C34 and R34 of the third embodiment.

At C45, the control device 105 transmits the original key ID to the authenticated chip 103, and issues a command instructing the authenticated chip 103 to generate the generated key. The authenticated chip 103 first selects the derived key corresponding to the original key ID as the selection key in OP43. Therefore, if the authenticated chip 103 is legitimate, the selection key selected by the authenticated chip 103 is the same as the authentication key DK_ij generated by the authentication chip 106 in OP42. Subsequently, the authenticated chip 103 generates a generated key based on the selected key and the register value. The method of generating the generated key is the same as that of the third embodiment except that the register value is used as it is. When the generated key is generated, the authenticated chip 103 notifies the control device 105 of the completion of generation of the generated key by R45. The processing from C46 to R46 is the same as the processing from C36 to R36 in the third embodiment. In OP44, the authentication chip 106 generates the generated key by using the notified register value as it is.

At OP45, the control device 105 generates random number data as challenge data. At C47, the control device 105 transmits an authentication data generation command to the authenticated chip 103. This command includes random number data (challenge data). In OP46, the authenticated chip 103 uses the encryption device 304 to generate authentication data, which is response data, from the generated key and random number data. In R47, the authenticated chip 103 notifies the control device 105 of the authentication data (response data).

Similarly, at C48, the control device 105 sends a comparison data generation command to the authentication chip 106. This command includes random number data (challenge data) and authentication data generated by OP45. In OP47, the authentication chip 106 uses the encryption device 204 to generate comparison data from the generated key and random number data, and compares it with the received authentication data. Since the encryption device 204 and the encryption device 304 perform the same encryption operation, if the authenticated chip 103 is valid, the authentication data and the comparison data match. In R48, the authentication chip 106 notifies the control device 105 of the comparison result, that is, whether or not the comparison data and the authentication data match.

Upon receiving the notification that the comparison data and the authentication data match in OP48, the control device 105 determines that the authentication is OK, and determines that the authentication is NG if they do not match. In the present embodiment, the authentication data and the comparison data are compared with the authentication chip 106 as in the first embodiment, but the control device 105 may be used as in the third embodiment. Further, also in the present embodiment, as in the third embodiment, since the generated key changes randomly each time of authentication, a fixed value can be used as the challenge data instead of the random number. Further, in the present embodiment, the register value is randomly generated each time of authentication, but as in the third embodiment, a predetermined operation may be performed and updated each time of authentication. That is, in the third embodiment, the register corresponding to each derived key is provided, but it is also possible to provide one register common to all the derived keys. Further, in the present embodiment as well, as in the second embodiment and the fourth embodiment, the unit identifier UID can be further used to generate authentication data / comparison data.

[Other embodiments]
In the above embodiment, the process cartridge 102 and the fuser 802 of the image forming apparatus are authenticated as the exchange unit, but any exchange unit (expansion unit) of the image forming apparatus can be authenticated as the authenticated device. .. Further, the present invention can be applied not only to the image forming apparatus but also to the case where an arbitrary device is used as an authentication device and an arbitrary unit detachable from the main body of the arbitrary device is used as an authenticated device.

The present invention supplies a program that realizes one or more functions of the above-described embodiment to a system or device via a network or storage medium, and one or more processors in the computer of the system or device reads and executes the program. It can also be realized by the processing to be performed. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

103: Certified chip, 106: Certified chip, 205, 305: Non-volatile memory, 204, 304: Cryptographic device

Claims (38)

It is a method of authenticating an authenticated device by an authentication device that holds the first original key among a plurality of original keys and the identifier of the first original key.
The authenticated device holds a first value and a plurality of derived keys generated by using each of the plurality of original keys and the first value as an input of a one-way function.
The authentication method is
A step in which the authenticated device selects a selected key from the plurality of derived keys based on the identifier of the first original key notified from the authenticated device.
A step in which the authenticated device generates authentication data based on the challenge data notified from the authentication device, the first generation key based on the selection key, and the step.
A step in which the authentication device generates an authentication key by using the first original key and the first value notified from the authenticated device as an input of the one-way function.
A step in which the authentication device generates comparison data based on the challenge data and the second generation key based on the authentication key.
A step in which the authentication device authenticates the authenticated device by comparing the comparison data with the authentication data notified from the authenticated device.
An authentication method characterized by including. The first aspect of claim 1, wherein the selection key is a derived key generated by using the first original key and the first value as inputs of the one-way function among the plurality of derived keys. The authentication method described. The first generated key is the selected key and
The authentication method according to claim 1 or 2, wherein the second generated key is the authentication key. The authentication method according to claim 3, wherein the challenge data is data randomly generated by the authentication device. A step in which the authenticated device generates the first generated key based on the second value and the selected key.
A step in which the authentication device generates the second generated key based on the second value notified from the authenticated device and the authentication key.
The authentication method according to claim 1 or 2, further comprising. The authenticated device generates the first generated key based on the third value obtained by performing a predetermined operation on the second value and the selected key.
The fifth aspect of claim 5, wherein the authentication device generates the second generated key based on the third value obtained by performing the predetermined operation on the second value and the authentication key. Authentication method. The authenticated device has a register corresponding to each of the plurality of derived keys.
The second value is the value of the register corresponding to the derived key selected as the selection key.
The authenticated device is characterized in that when the first generated key is generated, the value of the register corresponding to the derived key selected as the selected key is updated from the second value to the third value. The authentication method according to claim 6 . The authentication method according to claim 5, wherein the second value is a value randomly generated by the authenticated device. The authentication method according to any one of claims 5 to 8, wherein the challenge data is data randomly generated by the authentication device or predetermined data. The authentication method according to any one of claims 1 to 9, wherein the authentication data and the comparison data are generated by the same algorithm. The authentication method according to claim 10, wherein the authentication data is encrypted data or an encrypted hash value of the challenge data by the first generation key. The authenticated device holds a fourth value and has a fourth value.
The authentication method according to claim 10, wherein the authentication data is encrypted data or an encrypted hash value of the data obtained by combining the challenge data and the fourth value with the first generation key. The authentication method according to any one of claims 1 to 12, wherein the one-way function is an encryption hash function or a function used in common key cryptography. A holding means for holding the first original key among a plurality of original keys and the identifier of the first original key.
A notification means for notifying the authenticated device of the identifier of the first original key and the challenge data.
A receiving means for receiving the authentication data and the first value from the authenticated device, and
An authentication key is generated by using the first original key and the first value as input of a unidirectional function, and comparison data is generated based on the challenge data and the authentication key or the generation key generated from the authentication key. The first generation means to generate and
An authentication means for authenticating the authenticated device by comparing the authentication data with the comparison data,
An authentication device characterized by being equipped with. Further, a second generation means for randomly generating the challenge data is provided.
The authentication device according to claim 14, wherein the first generation means generates the comparison data based on the challenge data and the authentication key. The receiving means receives the second value from the authenticated device and receives the second value.
The first generation means is characterized in that the generation key is generated based on the second value and the authentication key, and the comparison data is generated based on the challenge data and the generation key. Item 14. The authentication device according to item 14. 16. The 16th aspect of the present invention, wherein the first generation means generates the generation key based on the third value obtained by performing a predetermined operation on the second value and the authentication key. Authentication device. The authentication device according to claim 16 or 17, wherein the second value is updated by the certified device each time the certified device is certified by the certified device. The authentication device according to claim 16, wherein the second value is a value randomly generated by the authenticated device. The authentication device according to any one of claims 16 to 19, wherein the challenge data is predetermined data. The authentication device according to any one of claims 14 to 20, wherein the comparison data is encrypted data or an encrypted hash value of the challenge data using the authentication key or the generation key. The authenticated device holds a plurality of derived keys generated by inputting each of the plurality of original keys and the first value as an input of the one-way function.
The authentication data is the same algorithm as the comparison data based on the selection key selected from the plurality of derived keys based on the identifier of the first original key or the key generated based on the selection key and the challenge data. 21. The authentication device according to claim 21, wherein the data is generated by. The receiving means receives the fourth value from the authenticated device and receives the fourth value.
Any of claims 14 to 20, wherein the comparison data is encrypted data or encrypted hash value by the authentication key or the generation key of the data obtained by combining the challenge data and the fourth value. The authentication device according to item 1. The authenticated device holds a plurality of derived keys generated by inputting each of the plurality of original keys and the first value as an input of the one-way function.
The authentication data includes a selection key selected from the plurality of derived keys based on the identifier of the first original key or a key generated based on the selection key, the challenge data, and the fourth value. 23. The authentication device according to claim 23, wherein the data is generated by the same algorithm as the comparison data. An image forming apparatus having the authentication apparatus according to any one of claims 14 to 24. The image forming apparatus according to claim 25, wherein the authenticated apparatus is a unit that can be attached to and detached from the image forming apparatus. A holding means for holding a plurality of derived keys generated by inputting a first value, each of the plurality of original keys, and the first value as an input of a one-way function.
A selection means for selecting a selection key from the plurality of derived keys based on the identifier of the first original key among the plurality of original keys notified from the authentication device, and
A first generation means for generating authentication data based on the challenge data notified from the authentication device, the selection key or the generation key generated from the selection key, and
A notification means for notifying the authentication device of the authentication data and the first value, and
A device to be authenticated, which is characterized by being equipped with. The first generation means generates the authentication data based on the challenge data and the selection key.
The authenticated device according to claim 27, wherein the challenge data is data randomly generated by the authentication device. The first generation means generates the generation key based on the second value and the selection key, and generates the authentication data based on the challenge data and the generation key.
The authenticated device according to claim 27, wherein the notification means notifies the authentication device of the second value. The subject according to claim 29, wherein the first generation means generates the generation key based on the third value obtained by performing a predetermined operation on the second value and the selection key. Authentication device. Further having a register corresponding to each of the plurality of derived keys,
The second value is a value stored in the register corresponding to the derived key selected as the selection key.
30. The authenticated person according to claim 30, wherein the first generation means updates the value of the register corresponding to the derived key selected as the selection key from the second value to the third value. Device. The authenticated device according to claim 29, further comprising a second generation means for randomly generating the second value. The authenticated device according to any one of claims 27 to 32, wherein the challenge data is data randomly generated by the authentication device or predetermined data. The authenticated device according to any one of claims 27 to 33, wherein the authentication data is encrypted data or an encrypted hash value by the selected key of the challenge data or the generated key. The holding means holds a fourth value, and the holding means holds a fourth value.
The notification means notifies the authentication device of the fourth value, and the notification means notifies the authentication device.
13. The device to be certified according to item 1. The authenticated device according to any one of claims 27 to 35, wherein the authenticated device is a unit that can be attached to and detached from the image forming device. The authenticated device is a unit that can be attached to and detached from the image forming device.
The authenticated device according to claim 35, wherein the fourth value is an identifier of the unit. The authenticated device according to any one of claims 27 to 37, wherein the one-way function is an encryption hash function or a function used in common key cryptography.

Images