JP7400444B2 - Public key certificate generation method for IoT key management system, secure device, IoT device, device management device, and secure element - Google Patents

Description

The present invention relates to the technical field of generating a public key certificate for a public key generated by a secure element incorporated in an IoT device.

The 5th generation mobile communication system (commonly known as 5G), which will start operating in Japan from 2020, will be able to connect more than 1 million mobile devices per square kilometer to one relay base at the same time. It is said that the Internet of Things (IoT) will rapidly spread with the start of operation of physical communication systems.

Depending on the application of IoT, such as payment, medical care, or transportation, secure IoT operation is required. For secure IoT operations, it has become common to utilize PKI (public key infrastructure), which is based on public key certificates with digital signatures from CAs (Certification Authorities). There is.

IoT devices used in IoT, which requires secure operation, incorporate secure elements that are compatible with PKI. The secure element built into an IoT device has PKI-related functions such as a function to generate a cryptographic key pair (private key and public key) for asymmetric cryptography, a function to secretly store a private key, a function to output a public key, It also has functions such as performing cryptographic operations using private keys and public keys.

PKI requires a public key certificate of the secure element with a CA's digital signature attached so that the communication partner of the IoT device can confirm the validity of the secure element installed in the IoT device. The format of the public key certificate is arbitrary, but for example, X. 509 defines a standard format for public key certificates.

As described in Patent Document 1, the general procedure for generating a public key certificate for a secure element is as follows.

Step 1) A secure element built into an IoT device generates a private key and a public key for an asymmetric cryptosystem.

Step 2) The IoT device acquires the public key from the secure element, and transmits the public key acquired from the secure element to the device management device that centrally manages the IoT devices.

Step 3) The device management device applies to the CA for issuance of a public key certificate.

Patent No. 6465426 (paragraph 0018)

However, in the conventional procedure for generating public key certificates for IoT devices, the device management device must check whether the public key for which the CA is applying for issuance of a public key certificate was generated by a valid secure element or not. Another problem is that it is not possible to determine whether the public key has been tampered with.

Therefore, when generating a public key certificate for a secure element incorporated in an IoT device, the device management device, which applies to the CA for issuance of the public key certificate, requests the CA to issue the public key certificate. The purpose is to be able to verify the validity of the public key being applied for.

An IoT key management system according to a first aspect of the invention that solves the above problems is a system in which an IoT device incorporating a secure element and a device management device are connected via a network.

The secure element according to the first invention generates a pair of a private key and a public key in an asymmetric cryptographic system, and uses a basic key for generating an authentication code to authenticate a public key file containing the public key. After calculating the code, an encryption key generation means outputs the public key file and the authentication code, and a signature generation means generates a signature of the instructed message using the private key generated by the encryption key generation means. Be prepared.

The IoT device according to the first invention instructs the secure element to generate a pair of private key and public key for an asymmetric cryptographic method, and generates a CSR file of the public key included in the public key file received from the secure element. After the generation, the secure element is instructed to generate a signature for the CSR file, and the signed CSR file in which the public key file, this authentication code, and the signature generated by the secure element are added to the CSR file is managed by the device. A CSR file generating means for transmitting to the device is provided.

The device management apparatus according to the first invention verifies the validity of the authentication code received from the IoT device using the basic key shared with the secure element, and if the validity verification is successful, the The certificate application means includes a certificate application means for transmitting the attached CSR file to a predetermined certification authority.

The device management device can verify whether the data included in the public key file has been tampered with by verifying the authentication code of the public key file generated by the secure element, and furthermore, can verify whether the data included in the public key file has been tampered with. , by using the basic key shared by the secure element and the device management device, the device management device can identify that the secure element that generated the public key is the secure element managed by the device management device. Can be verified.

Further, in a second invention, in the IoT key management system described in the first invention, the cryptographic key generation means of the secure element generates the basic key and the derived key according to a derivation algorithm for deriving the derived key when calculating the authentication code. Deriving a derived key using parameters required by the derivation algorithm, calculating an authentication code from the public key file including the parameters and the derived key, and the certificate application means of the device management device: Using the basic key and the parameters included in the public key file, generate a derived key using the same derivation algorithm as the secure element, and use the derived key to verify the validity of the authentication code received from the IoT device. It is characterized by

By deriving a derived key using a derivation algorithm using the basic key and the parameters, it becomes more difficult to decrypt the basic key, and the effect of detecting falsification of the public key file increases.

Furthermore, a third invention is the IoT key management system described in the second invention, wherein the derivation algorithm is an algorithm for deriving a derived key from the basic key using a pseudo-random number function, and the parameter is set to the pseudo-random number function. It is characterized in that the number of repetitions is set to .

In an algorithm that derives a derived key from the basic key using a pseudo-random number function, security is increased by the number of iterations, so it is preferable that the parameter included in the public key file is the number of iterations.

Furthermore, a fourth invention is the IoT key management system described in the second invention, wherein the derivation algorithm is an algorithm that generates a derived key by calculating the parameters using the basic key, and the parameters are random numbers. It is characterized by being information.

By using the random number information to generate the derived key, the key used to calculate the authentication code can be changed every time a public key is generated, even if the secure element is the same.

Furthermore, a fifth invention provides the IoT key management system according to any one of the first to fourth inventions, wherein the secure element stores the basic key individually for each secure element, and the cryptographic key generation means The secure element includes an individual element ID in the public key file, and the certificate application means of the device management device stores the basic key stored in the secure element in association with the element ID. and verifying the validity of the authentication code received from the IoT device by using the basic key associated with the element ID included in the public key file received from the IoT device. .

The device management device generates a public key from the element ID included in the public key file received from the IoT device by separating the basic keys stored in the secure element into individual keys in the secure element. The secure element can be specified.

Furthermore, a sixth invention is a method for generating a public key certificate for a secure element, wherein an IoT device incorporating the secure element causes the secure element to generate a pair of a private key and a public key for an asymmetric cryptographic system. The secure element generates a pair of private key and public key for the asymmetric encryption method, and uses the basic key for generating the authentication code to generate the authentication code of the public key file containing the public key. After the calculation, step a of outputting the public key file and this authentication code; and when the IoT device receives the public key file and this authentication code from the secure element, it outputs the public key included in the public key file. step b of generating a CSR file, the IoT device instructs the secure element to generate a signature for the CSR file, and the secure element generates a signature for the CSR file using the private key generated in step a; Step c of generating and outputting a CSR file, the IoT device adding the public key file, this authentication code, and the signature generated by the secure element to the CSR file, and transmitting the signed CSR file to the device management device. step d, the device management device verifies the validity of the authentication code received from the IoT device using the basic key shared with the secure element, and if the validity verification is successful, the device management device verifies the validity of the authentication code received from the IoT device; This is a public key certificate generation method for a secure element, characterized in that it includes a step e of transmitting a CSR file with an attached CSR to a predetermined certification authority.

The sixth invention is an invention of a method corresponding to the first invention.

Furthermore, a seventh invention provides a method for generating a public key certificate for a secure element according to the sixth invention, in which, in step a, the secure element calculates the basic key according to a derivation algorithm for deriving a derived key when calculating the authentication code. Derive a derived key using the key and parameters required by the derivation algorithm, calculate an authentication code from the public key file including the parameters and the derived key, and in step e, the device management device , using the basic key and the parameters included in the public key file, generate a derived key using the same derivation algorithm as the secure element, and authenticate the authentication code received from the IoT device using the derived key. It is characterized by verification.

The seventh invention is an invention of a method corresponding to the second invention.

Furthermore, an eighth invention is the method for generating a public key certificate for a secure element according to the seventh invention, wherein the derivation algorithm is an algorithm for deriving a derived key from the basic key using a pseudo-random number function, The method is characterized in that the parameter is the number of repetitions of the pseudorandom number function.

The eighth invention is an invention of a method corresponding to the third invention.

Furthermore, a ninth invention is the method for generating a public key certificate for a secure element according to the seventh invention, in which a derived key is generated by using the derivation algorithm to perform arithmetic processing on the parameters using the basic key. The algorithm is characterized in that the parameters are random number information.

The ninth invention is an invention of a method corresponding to the fourth invention.

Furthermore, a tenth invention is the method for generating a public key certificate for a secure element according to any one of the sixth to ninth inventions, wherein in step a, the secure element generates a public key certificate for each secure element. In step e, the device management device generates an authentication code for the public key file that includes the individual element ID in the secure element using the individual basic key, and in step e, the device management device Authentication received from the IoT device using the basic key associated with the element ID included in the public key file received from the IoT device from among the basic keys stored in the IoT device. It is characterized by validating the code.

The tenth invention is an invention of a method corresponding to the fifth invention.

As described above, according to the present invention, when generating a public key certificate for an IoT device, the device management device that applies to the CA for issuance of the public key certificate applies to the CA for issuance of the public key certificate. The validity of the public key can be verified.

FIG. 1 is a diagram showing the configuration of an IoT key management system. FIG. 2 is a block diagram of a secure element implemented in an IoT device. A block diagram of an IoT device. FIG. 2 is a block diagram of a device management device. FIG. 3 is a diagram illustrating a procedure for generating a public key certificate for a secure element.

From here, embodiments according to the present invention will be described. This embodiment is provided to facilitate understanding of the present invention, and the present invention is not limited to this embodiment. Further, unless otherwise specified, the drawings are schematic diagrams drawn to facilitate understanding of the present invention.

FIG. 1 shows the configuration of an IoT key management system 1. The IoT key management system 1 illustrated in FIG. 1 includes a plurality of IoT devices 3, a secure element 2 built into each IoT device 3, and a device management device 4. In FIG. 1, in addition to these, a gateway 6, a network 7, and a CA5 (Certification Authority, in Japanese) are included in the IoT key management system 1.

The IoT device 3 is a device that acquires data according to the purpose of the IoT device 3 and transmits the acquired data to a predetermined device (here, the device management device 4). The specific form of the IoT device 3 will change depending on the user and the like. Examples of the IoT device 3 include a tablet computer, a POS terminal (POS: Point of Sales), or a car.

The IoT key management system 1 has enhanced security by utilizing PKI that supports signatures, authentication, and encryption. Since the private key 22 of the asymmetric encryption method that uses separate encryption keys for encryption and decryption is securely stored in the IoT device 3, the IoT device 3 is required to have tamper resistance. In order to achieve this, the IoT device 3 according to this embodiment is equipped with a secure element 2 that is an IC chip having tamper resistance.

The secure element 2, which is a tamper-resistant IC chip, has the form of an eSE (embedded secure element), but the secure element 2 shown in Fig. 1 is in the form of a SIM card (Subscriber Identity Module Card). There is.

The device management device 4 is a device that provides various services related to the operation and management of the IoT device 3. In this embodiment, in this service, when the IoT device 3 causes the secure element 2 to generate a private key 22 and a public key 23 using an asymmetric encryption method, the secure element 2 issues a public key certificate 27 for the public key 23 generated. Includes the service to apply for.

The gateway 6 is a device that can connect to multiple IoT devices 3 at the same time. The network 7 may be a local network, but if the area where the IoT device 3 is placed is a wide area, the network 7 will be the Internet. The CA 5 is an institution that issues the public key certificate 27 for the public key 23 generated by the secure element 2.

The devices that play a central role in the service for acquiring the public key certificate 27 of the public key 23 generated by the secure element 2 are the secure element 2, the IoT device 3, and the device management device 4. These devices will now be explained in detail.

FIG. 2 is a block diagram of the secure element 2 implemented in the IoT device 3. This is a device issued by the operating company of the device management device 4. The secure element 2 is configured so that only applications and users authenticated by the operating company of the device management device 4 can access it.

As illustrated in FIG. 2, the secure element 2 includes a processor 200 that performs data arithmetic processing, and a coprocessor 210 that performs processing specialized for cryptographic operations (for example, surplus operations) in an asymmetric cryptographic system. Furthermore, the secure element 2 includes a RAM 220 (Random Access Memory) that is a volatile memory, a UART 230 (Universal Asynchronous Receiver/Transmitter) that is a circuit that communicates with an external device (here, the IoT device 3), and a circuit that generates random numbers. It includes an RNG 240 (Random Number Generator) and an electrically rewritable non-volatile memory NVM 250 (Non-volatile memory).

The NVM of the secure element 2 stores an element ID 252 and a basic key 251 as individual data for each secure element 2. The basic key 251 may be the same for each secure element 2, but in this embodiment, the basic key 251 is unique for each secure element 2.

Further, the NVM 250 of the secure element 2 stores a plurality of commands 253 that cause the processor 200 of the secure element 2 to operate. The commands 253 stored in the NVM 250 include an encryption key generation command 253a and a signature generation command 253b.

The encryption key generation command 253a is a command to generate the private key 22 and public key 23 of the asymmetric encryption method. By executing the encryption key generation command 253a, the processor 200 of the secure element 2 generates the private key 22 and the public key 23 of the asymmetric encryption method. 22 and a public key 23, calculates an authentication code 25 of a public key file 24 containing the public key 23, etc., and then outputs the public key file 24 and this authentication code 25. Functions as 20.

The private key 22 and public key 23 of the asymmetric cryptosystem generated by the cryptographic key generation means 20 are stored in the NVM 250 of the secure element 2. The private key 22 of the asymmetric cryptosystem is stored in the NVM 250 of the secure element 2 in a state that cannot be read from the secure element 2, but the public key 23 of the asymmetric cryptosystem is stored in the secure element 2 in a state that can be read from the secure element 2. The data is stored in the NVM 250 of No. 2.

Although the algorithm for calculating the authentication code 25 is arbitrary, the secure element 2 according to the present embodiment uses at least the basic key 251 stored in the NVM 250 of the secure element 2 to derive a derived key according to a predetermined derivation algorithm, An authentication code is calculated using this derived key. By using the basic key 251 to derive the derived key, only a legitimate entity (device management device 4 in this case) who knows the basic key 251 can derive the derived key used to generate the authentication code 25. Note that the public key file 24 can include parameters necessary for the derivation algorithm used to derive the derived key.

The element ID 252 included in the public key file 24 for which the authentication code 25 is calculated is individual data for each secure element 2. The secure element 2 that generated the public key 23 of the asymmetric cryptosystem can be identified from the element ID 252 included in the public key file 24 output by the secure element 2 when the private key 22 and public key 23 of the asymmetric cryptosystem are generated.

The signature generation command 253b is a command for generating a digital signature for a message sent from the IoT device 3 implementing the secure element 2, using the private key 22 generated by the encryption key generation means 20 (cipher key generation command 253a). be. By executing the signature generation command 253b, the processor 200 of the secure element 2 functions as the signature generation means 21 according to the present invention.

FIG. 3 is a block diagram of the IoT device 3. As illustrated in FIG. 3, the IoT device 3 includes an MCU 300 (Micro Control Unit), a mobile communication unit 310, a sensor hub 320, and an interface 330, and a sensor 321 that senses predetermined data is connected to the sensor hub 320. The secure element 2 is connected to the interface 330.

The MCU 300 is an embedded microprocessor in which a computer system including an application processor 301 and a memory unit 302 capable of processing various applications is integrated into one integrated circuit. The mobile communication unit 310 is a circuit for communicating in accordance with a predetermined mobile communication standard. The mobile communication unit 310 is preferably compatible with 5G.

The sensor hub 320 is an IC chip that converts the signal of the sensor 321 connected to the sensor hub 320 and sends it to the MCU 300, or switches the sensor 321 connected to the sensor hub 320. Any sensor 321 may be connected to the sensor hub 320. The sensors 321 connected to the sensor hub 320 include a temperature sensor, humidity sensor, current sensor, optical sensor, and position sensor.

The interface 330 is an input/output circuit for connecting peripheral devices to the MCU 300. In this embodiment, the interface 330 includes one for connecting to the secure element 2. In this embodiment, the secure element 2 is in the form of a SIM, so the interface 330 includes an ISO7816 interface.

The memory unit 302 of the MCU 300 stores an application 303 that operates the application processor 301 of the MCU 300 and a public key certificate 424 of the device management device 4 distributed from the device management device 4. Note that data acquired by the sensor 321 can also be stored in the memory unit 302 of the MCU 300.

The application 303 stored in the memory unit 302 of the MCU 300 causes the secure element 2 to generate the private key 22 and public key 23 of the asymmetric encryption method, and stores the public key 23 generated by the secure element 2 in a CSR file 31 (CSR: Certificate Signing A CSR file generation application 303a that executes a process of generating a Request (Certificate Signing Request in Japanese) and transmitting it to the device management apparatus 4 is included. This CSR file generation application 303a is distributed from the device management device 4 to the IoT device 3. By executing the CSR file generation application 303a, the application processor 301 of the MCU 300 functions as the CSR file generation means 30 according to the present invention. The operation of the CSR file generation means 30 included in the IoT device 3 will be described later.

FIG. 4 is a block diagram of the device management apparatus 4. The device management device 4 is a device composed of one or more servers. In FIG. 4, the device management apparatus 4 includes one server. As illustrated in FIG. 4, the device management device 4 includes one or more processors 400 and various components connected to the processors 400 via a bus 430. Although FIG. 4 shows only the network communication unit 410 and storage 420 as components connected to the processor 400 via the bus 430, in reality, various components other than these are connected to the processor 400 via the bus 430. is connected to.

The storage 420 of the device management device 4 includes a management application 421 that performs processing related to management and operation of the IoT device 3, and a secure element DB 422 (DataBase) that stores various data for each secure element 2 managed by the device management device 4. ), the private key 423 of the device management device 4, and the public key certificate 424 of the device management device 4 are stored.

When the management application 421 stored in the storage 420 of the device management device 4 receives the public key file 24, the authentication code 25, and the CSR file 31, it verifies the validity of the authentication code 25. A certificate application application 421a is included that verifies the validity of the key 23 and, if the secure element 2 is valid, applies to the CA 5 for issuance of the public key certificate 27. By executing the certificate application application 421a, the processor 400 of the device management apparatus 4 functions as the certificate application means 40 according to the present invention. The operation of the certificate application means 40 according to the present invention will be described later.

In the secure element DB 422 stored in the storage 420 of the device management device 4, each secure element 2 installed in the IoT device 3 to be managed by the device management device 4 is associated with the element ID 252 stored in the secure element 2. In this state, the basic key 251 stored in the secure element 2 is stored.

FIG. 5 is a diagram illustrating a procedure for generating the public key certificate 27 of the secure element 2. The explanation referring to FIG. 5 includes the explanation of the public key certificate generation method of the secure element 2 according to the present invention related to the method category, the explanation of the CSR file generation means 30 provided in the IoT device 3, and the explanation of the CSR file generation means 30 provided in the IoT device 3. It also serves as an explanation of the certificate application means 40 provided.

In S1, which is the first step in FIG. 5, the CSR file generation means 30 of the IoT device 3 instructs the secure element 2 installed in the IoT device 3 to generate a private key 22 and a public key 23 using an asymmetric cryptographic method. do. The private key 22 and public key 23 of the asymmetric cryptographic system are generated by the cryptographic key generation means 20 included in the secure element 2. When instructing the generation of the private key 22 and public key 23 of the asymmetric encryption method in order to activate the encryption key generation means 20, the IoT device 3 securely sends the command APDU (Application Protocol Data Unit) of the encryption key generation command 253a. Send to element 2.

In S2 in FIG. 5, the cryptographic key generation means 20 of the secure element 2 generates a private key 22 of the asymmetric cryptosystem and a public key 23 of the asymmetric cryptosystem.

In S3 in FIG. 5, the encryption key generation means 20 of the secure element 2 reads the basic key 251 and the element ID 252 from the NVM 250, and generates the basic key 251 and the parameters necessary for the derivation algorithm according to the derivation algorithm for deriving the derived key. to derive the derived key.

Although the derivation algorithm for deriving the derived key is arbitrary, it is preferable to use an algorithm that derives the derived key from the basic key 251 using a pseudo-random number function. As such a derivation algorithm, the algorithm disclosed in NIST Special Publication 800-108 can be used.

In a derivation algorithm that derives a derived key from the basic key 251 using a pseudo-random number function, the salt and the number of iterations that serve as input data for the derivation algorithm are parameters of the derivation algorithm. For security reasons, it is desirable that the salt, which is one of the parameters of this derivation algorithm, be known only to the secure element 2 and the device management device 4. Therefore, in this embodiment, the number of iterations, which is one of the parameters of this derivation algorithm, is made public. Included in the key file.

Further, an algorithm that generates a derived key by calculating parameters using the basic key 251 can be used as a derived key derivation algorithm. In this case, the random number information generated by the RNG 240 can be used as a parameter, and exclusive OR or cryptographic operation can be used for this calculation process.

In S4 in FIG. 5, the encryption key generation means 20 of the secure element 2 uses the derived key generated in S3 in FIG. The authentication code 25 of the public key file 24 is calculated. As an algorithm for generating the authentication code 25 using a derived key, CBC-MAC (Cipher Block Chaining Message Authentication Code) or CMAC (Cipher-based Message Authentication Code) can be used.

In S5 in FIG. 5, the encryption key generation means 20 of the secure element 2 includes the public key file 24 and the authentication code 25 in response data as a response to the command APDU of the encryption key generation command 253a received in S1 in FIG. The received response APDU is output to the IoT device 3.

In S6 in FIG. 5, the CSR file generation means 30 of the IoT device 3 generates a CSR file 31 containing the public key 23 included in the public key file 24 received from the secure element 2. Note that the CSR file 31 includes a distinguished name (common name, department name, organization name, etc.) in addition to the public key 23.

In S7 in FIG. 5, the CSR file generation means 30 of the IoT device 3 instructs the secure element 2 installed in the IoT device 3 to generate a signature for the CSR file 31 generated in S7 in FIG. Signature generation for the CSR file 31 is performed by the signature generation means 21 included in the secure element 2. When instructing signature generation of the CSR file 31 in order to activate the signature generation means 21, the IoT device 3 transmits a command APDU of the signature generation command 253b including the CSR file 31 in the command data to the secure element 2. .

At S8 in FIG. 5, the signature generation means 21 of the secure element 2 generates the signature 26 of the CSR file 31 received from the IoT device 3 using the private key 22 of the asymmetric encryption system generated at S2 of FIG. Note that the signature 26 of the CSR file 31 is calculated by encrypting the hash value of the CSR file 31 calculated using a one-way hash function using the private key 22 of the asymmetric encryption method.

In S9 in FIG. 5, the signature generation means 21 of the secure element 2 sends the response APDU of the signature generation command 253b, which uses the signature 26 of the CSR file 31 calculated in S9 in FIG. 5 as response data, to the IoT device 3. , the signature 26 of the CSR file 31 is output.

In S10 in FIG. 5, the IoT device 3 receives the public key file 24 acquired from the secure element 2 in S5 in FIG. 5, the authentication code 25 of the public key file 24, and the signature output by the secure element 2 in S10 in FIG. 26 is added to the CSR file 31 and the signed CSR file 31a is sent to the device management apparatus 4.

In order to ensure the security of communication between the IoT device 3 and the device management device 4, data sent from the IoT device 3 to the device management device 4 must be encrypted. In S10 of FIG. 5, the IoT device 3 encrypts data such as the public key file 24 to be sent from the IoT device 3 to the device management device 4 using the public key included in the public key certificate 424 of the device management device 4. .

In S11 in FIG. 5, the certificate application means 40 of the device management device 4 decrypts the data sent from the IoT device 3 using the private key 423 of the device management device 4, and then decrypts the authentication code 25 sent from the IoT device 3. Verify the validity of.

When verifying the authentication code 25 sent from the IoT device 3, the certificate application means 40 of the device management device 4 uses the basic key 251 associated with the element ID 252 included in the public key file 24 sent from the IoT device 3. is acquired from the secure element DB 422. Next, the certificate application means 40 of the device management device 4 uses the same derivation algorithm as the secure element 2 to obtain the parameters of the derivation algorithm (for example, the number of repetitions) sent from the IoT device 3 and the basic key obtained from the secure element DB 422. After generating a derived key from 251 and calculating the authentication code 25 of the public key file 24 sent from the IoT device 3, the authentication code 25 sent from the IoT device 3 and the authentication code calculated on the device management device 4 side are Check if 25 matches. If the authentication codes 25 match, the certificate application means 40 of the device management apparatus 4 determines that the public key 23 included in the signed CSR file 31a was generated by a legitimate secure element 2.

In S12 in FIG. 5, the certificate application means 40 of the device management apparatus 4 branches the process depending on the validity verification result of the authentication code 25. If the certificate application means 40 of the device management device 4 fails to verify the validity of the authentication code 25, the certificate application means 40 of the device management device 4 does not apply to the CA 5 for issuance of the public key certificate 27 of the public key 23 generated by the secure element 2. The procedure ends.

If the validity verification of the authentication code 25 is successful, in S13 in FIG. Apply for issuance. When applying for issuance of the public key certificate 27, the certificate application means 40 of the device management apparatus 4 transmits the signed CSR file 31a to the CA 5.

In S14 in FIG. 5, the CA5 examines the signed CSR file 31a by verifying the signature 26 of the signed CSR file 31a using the public key 23 included in the signed CSR file 31a, and then files the CSR file. If the examination passes, the signature of the public key 23 included in the signed CSR file 31a is calculated using CA5's private key, and CA5's signature is used in place of the signature 26 added to the signed CSR file 31a. A public key certificate 27 for the added public key 23 is issued.

In S15 in FIG. 5, the certificate application means 40 of the device management apparatus 4 uses the public key certificate 27 corresponding to the signed CSR file 31a sent to the CA5 in S13 in FIG. After downloading the certificate 27 from the public location, the public key certificate 27 is registered in the secure element DB 422 of the device management apparatus 4 in association with the element ID 252, and the procedure of FIG. 5 ends.

In the IoT key management system 1 according to the present embodiment, the public key generated by the secure element 2 is stored between the device management device 4 that applies to the CA 5 for issuance of the public key certificate 27 and the secure element 2 that generates the public key 23. There is an IoT device 3 that generates a signed CSR file 31a from 23. Therefore, the device management apparatus 4 needs to be able to verify the validity of the public key 23 included in the signed CSR file 31a sent to the CA 5.

In the IoT key management system 1 according to the present embodiment, the secure element 2 generates the authentication code 25 of the public key file 24 including the public key 23, and the device management device 4 side generates the authentication code 25 of the public key file 24. By verifying this, the device management apparatus 4 can at least verify the validity of the public key 23 included in the signed CSR file 31a sent to the CA 5.

By verifying the authentication code 25 of the public key file 24 on the device management device 4 side, it is possible to verify whether the data included in the public key file 24 has been tampered with. Furthermore, by using the basic key 251 shared by the secure element 2 and the device management device 4 to generate the authentication code 25, the secure element 2 can use the basic key 251 used to generate the authentication code 25 and the device management device A condition for successfully verifying the validity of the authentication code 25 is that the basic keys 251 stored by the authentication codes 4 and 4 are the same. Therefore, by verifying the authentication code 25, the device management device 4 can verify that the secure element 2 that generated the public key 23 is the secure element 2 managed by the device management device 4.

In addition, by separating the basic key 251 stored in the secure element 2 in the secure element 2, the device management device 4 can extract the public key from the element ID 252 included in the public key file 24 received from the IoT device 3. The secure element 2 that generated 23 can be identified.

1 IoT key management system 2 Secure element 20 Encryption key generation means 21 Signature generation means 22 Private key 23 Public key 24 Public key file 25 Authentication code 3 IoT device 30 CSR file generation means 31 CSR file 31a Signed CSR file 4 Device management device 40 Certificate application means

Claims (10)

A system in which an IoT device incorporating a secure element and a device management device are connected via a network,
The secure element generates a pair of private key and public key for an asymmetric encryption method, uses the basic key to generate an authentication code, and calculates an authentication code for a public key file containing the public key. , comprising an encryption key generation means for outputting the public key file and the authentication code, and a signature generation means for generating a signature of an instructed message using the private key generated by the encryption key generation means,
The IoT device instructs the secure element to generate a pair of private key and public key for an asymmetric cryptographic method, generates a CSR file of the public key included in the public key file received from the secure element, and then generates a CSR file. A CSR that instructs the secure element to generate a signature for a file, and sends the public key file, this authentication code, and a signed CSR file in which the signature generated by the secure element is added to the CSR file to the device management device. Equipped with file generation means,
The device management device verifies the validity of the authentication code received from the IoT device using the basic key shared with the secure element, and if the validity verification is successful, stores the signed CSR file in a predetermined manner. a certificate application means for sending the certificate to the certificate authority of
An IoT key management system characterized by: When calculating an authentication code, the cryptographic key generation means of the secure element derives a derived key using the basic key and parameters required by the derivation algorithm according to a derivation algorithm that derives the derived key, and calculates the derived key using the basic key and parameters required by the derivation algorithm. Calculate an authentication code from the public key file containing the derived key and the derived key,
The certificate application means of the device management device generates a derived key using the same derivation algorithm as the secure element, using the basic key and the parameters included in the public key file, and uses the derived key to generate a derived key. verifying the validity of the authentication code received from the IoT device;
The IoT key management system according to claim 1, characterized in that: The IoT key according to claim 2, wherein the derivation algorithm is an algorithm for deriving a derived key from the basic key using a pseudo-random number function, and the parameter is the number of repetitions of the pseudo-random number function. management system. The IoT key management system according to claim 2, wherein the derivation algorithm is an algorithm that generates a derived key by arithmetic processing of the parameters using the basic key, and the parameters are random number information. . The secure element stores the basic key that is individual for each secure element, and the encryption key generation means includes an element ID that is individual for the secure element in the public key file,
The certificate application means of the device management device stores the basic key stored in the secure element in association with the element ID, and applies the element included in the public key file received from the IoT device. verifying the validity of the authentication code received from the IoT device using the basic key associated with the ID;
The IoT key management system according to any one of claims 1 to 4, characterized in that: A method for generating a public key certificate for a secure element, the method comprising:
The IoT device incorporating the secure element instructs the secure element to generate a private key and public key pair for an asymmetric cryptographic system, and the secure element generates a private key and public key pair for an asymmetric cryptographic system. , step a of calculating an authentication code for a public key file containing a public key using a basic key for generating an authentication code, and then outputting the public key file and this authentication code;
step b, when the IoT device receives the public key file and the authentication code from the secure element, generating a CSR file of the public key included in the public key file;
step c, wherein the IoT device instructs the secure element to generate a signature for the CSR file, and the secure element generates and outputs a signature for the CSR file using the private key generated in step a;
The IoT device transmits the public key file, the authentication code, and a signed CSR file in which the signature generated by the secure element is added to the CSR file to a device management device that manages the secure element. Step d and
The device management device verifies the validity of the authentication code received from the IoT device using the basic key shared with the secure element, and if the validity verification is successful, the signed CSR file is sent to the designated CSR file. Step e of transmitting to the certificate authority of
A method for generating a public key certificate for a secure element, the method comprising: In step a, when calculating the authentication code, the secure element derives a derived key using the basic key and parameters required by the derived algorithm according to a derivation algorithm for deriving a derived key, and calculates the parameters. Calculate an authentication code from the included public key file and the derived key,
In step e, the device management apparatus generates a derived key using the same derivation algorithm as the secure element using the basic key and the parameters included in the public key file, and uses the derived key to generate the derived key. Verify the validity of the authentication code received from the IoT device,
7. The method for generating a public key certificate for a secure element according to claim 6 . 8. The secure element according to claim 7 , wherein the derivation algorithm is an algorithm for deriving a derived key from the basic key using a pseudo-random number function, and the parameter is the number of repetitions of the pseudo-random number function. How to generate a public key certificate. The derivation algorithm is an algorithm that generates a derived key by arithmetic processing of the parameters using the basic key, and the parameters are random number information,
A public key certificate generation method for a secure element according to claim 7 . In step a, the secure element generates an authentication code for the public key file that includes an individual element ID in the secure element using the basic key that is individual for each secure element,
In step e, the device management device selects a basic key associated with the element ID included in the public key file received from the IoT device, from among the basic keys stored in association with the element ID. Using the basic key in
Verify the validity of the authentication code received from the OT device,
A public key certificate generation method for a secure element according to any one of claims 6 to 9 , characterized in that:

Images