JP2007019824A - Token authentication method and system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a token authentication method and system capable of authenticating an IC card even between IC card systems having different authentication methods and authentication keys.
In order to enable authentication of an IC card belonging to the own system by another system, an authentication program unique to the other system is stored in the card management apparatus in the own system, and for authentication of the other system. And, if necessary, download an authentication program specific to the other system to the IC card managed by the management device from the card management device, and set an authentication key for the other system, Generate a token for authentication using the authentication program and key [selection figure]

Description

  The present invention relates to a token authentication method and system in an IC card system.

In recent years, the use of IC cards that are safe for security is becoming widespread in the fields of public, finance, communication, transportation, medical care, and electronic commerce on the Internet. In the conventional IC card system, in order to provide various services safely and surely to the card user, the IC card is authenticated using a system-specific authentication method (see, for example, Patent Document 1). IC cards cannot be authenticated in different systems, and IC cards cannot be used mutually between different systems. In addition, even if the same authentication method is used, authentication cannot be performed if the registration authority of the key used for authentication in each system is different. For example, in the case of a system that uses an authentication method based on PKI (public key infrastructure), an authentication key that is valid in one system is invalid in another system in a system with a different registration certificate authority, and therefore belongs to a certain system. The IC card cannot be authenticated in other systems, and the IC card cannot be used between different systems. In addition, since it is based on public key cryptography, it takes time to perform encryption / signature computation, and the storage capacity of authentication keys and programs increases when IC cards are used interchangeably among many systems. There is a problem that it cannot be realized with an IC card.

Japanese Patent Laid-Open No. 2001-069140

  An object of the present invention is to provide a token authentication method and system capable of mutual authentication of IC cards even between IC card systems having different authentication methods and different authentication keys.

  The present invention provides an authentication method for authenticating an IC card between at least two IC card systems having different authentication methods and authentication keys, so that the IC card belonging to the own system can be authenticated by another system. An IC card that stores an authentication program unique to another system and stores an authentication key for the other system in the card management apparatus in the system, and is managed by the management apparatus from the card management apparatus as necessary In addition, an authentication program unique to another system is downloaded, an authentication key for the other system is set, and a token for authentication is generated using the authentication program and the key.

  In the authentication method of the present invention, it is preferable that the certificate authority in the system issues a certificate of the token program when the card management device in the own system stores a token program unique to another system. . As a result, the card management apparatus can authenticate the authenticity by using this certificate when storing an authentication program unique to another system. Further, when an IC card downloads an authentication program specific to another system from a card management device in its own system, the validity of the IC card can be authenticated by this program certificate.

A system for implementing the token authentication method of the present invention includes:
The card management device in each system comprises means for storing a token authentication program and an authentication key unique to other systems,
The IC card managed by the management device uses a means for downloading an authentication program and an authentication key specific to another system from the card management device as needed, and uses the authentication key for the downloaded authentication program. And a means for generating a token for authentication.

  The authentication system of the present invention further comprises means for issuing a certificate of the program when the card management device in the own system stores a program unique to the other system. Is preferred.

  In this case, the card management apparatus in the own system is provided with means for authenticating the validity by the program certificate when storing a program unique to another system. When downloading a program specific to another system from a card management device in the system, it is preferable to provide means for authenticating the validity of the program certificate.

  According to the authentication method and system of the present invention, when an IC card belonging to the own system wants to receive a service belonging to another system, the IC card is removed from the card management apparatus that manages the IC card as necessary. It is possible to download an authentication program unique to another system, set an authentication key for the other system, generate a token using the authentication program and the key, and authenticate with the other system. In addition, since the authentication program generates a token, the program size can be reduced as compared with a PKI-based authentication program, which is suitable for an IC card having a limited memory capacity and processing. Is light and enables high-speed processing. The token may be based not only on a common key but also on a hash or password.

  Furthermore, in the authentication method and system of the present invention, the downloaded authentication program can be deleted after use, thereby reducing the used memory capacity of the IC card. This authentication program can be deleted when it is no longer necessary, when the memory capacity is insufficient, or after a certain period of time.

  As described above, according to the present invention, an IC card of an authentication system using a PKI-based authentication method is authenticated by the card management apparatus of another authentication system using a common key-based token authentication method, and the other system Can receive services. In addition, a token program specific to another system may be downloaded if necessary, and the token program has a smaller program size than a PKI-based authentication program, which is suitable for an IC card with a limited memory capacity. . In addition, the processing is light and high-speed processing is possible.

  FIG. 1 is a block diagram of a system that implements the token authentication method of the present invention, where I is an IC card system in one organization or region, and II is an IC card system in another organization or region. The system I and II have different authentication methods. In this example, the system I uses a PKI-based authentication method, and the system II uses a common key-based authentication method.

  In the figure, reference numeral 100 denotes an IC card belonging to the system I, and reference numeral 200 denotes a card management apparatus that manages the IC card belonging to the system I. Specifically, a card issuing apparatus or a service providing apparatus that provides a service to the managed IC card. A certificate authority 300 registers and manages the IC card 100 and the card management apparatus 200 belonging to the system I. Reference numeral 400 denotes a card management device that manages IC cards (not shown) belonging to the system II, and more specifically, a card issuing device and a service providing device that provide services to the IC cards to be managed. Uses a common key-based authentication scheme, so there is no certificate authority in System II. Note that since the present invention relates to an authentication method of an IC card system, only the configuration necessary for understanding the authentication method of the present invention is shown in the figure.

  The certificate authority 300 in the system I includes a key management unit 311 for registering and managing the public keys of the card management device 200 and the IC card 100 belonging to the system I, and a certificate issuing unit for issuing the registered public key certificate. 312, a certificate verification unit 313, and a storage unit 314. The card management device 200 manages the public key of the card management device registered in the key management unit 311 of the certificate authority 300, the public key of the IC card 100 managed by the management device, and the public key of the certificate authority 300. Unit 211, a card authentication unit 212 that authenticates the IC card 100 managed by the management apparatus, and a program management unit 213 that manages various programs. The program management unit 213 includes a program verification unit 214 and a storage unit 215. Yeah.

The IC card 100 includes a card management device 200 registered in the key management unit 311 of the certification authority 300, a key management unit 111 that manages the public key key of the IC card 100, the public key of the certification authority, and the like, and a card in the system I. An authentication unit 112 that authenticates the management apparatus 200, a program verification unit 113 that verifies various programs, a storage unit 114 that stores various programs, and a program execution unit 115 that executes various programs.
Therefore, the IC card 100 and the card management apparatus 200 in the system I can perform PKI-based authentication using the respective public keys in the respective authentication units 112 and 212.

  The card management device 400 in the system II includes a program management unit 410 and a token authentication unit 420. The program management unit 410 includes a key management unit 411, a program verification unit 412, a storage unit 413, a program identification information management unit 414, and a hash calculation unit 415. The token authentication unit 420 includes a token generation information management unit 421, a storage unit 422 that stores a system II authentication key (common key) generated by the token generation information management unit 421, a token verification unit 423, A key management unit 424 and an authentication information generation unit 425; an authentication information generation unit 425 includes a random number generation unit 426 and a timer 427; Do.

Therefore, the IC card 100 and the card management apparatus 200 in the system I can perform PKI-based authentication, and the IC card (not shown) and the card management apparatus 400 in the system II can perform token authentication based on the common key. It can be performed.
However, since the IC card 100 in the system I does not have an authentication program (token program) unique to the system II and does not have an authentication key (common key) for the system II, the card management apparatus 400 in the system II. You will not be able to receive System II services.

In the method of the present invention, in order to solve this problem, a token program unique to the system II is first registered in the certificate authority 300 of the system I and then stored in the card management device 200. It is assumed that the card management device 400 of the system II has the public key of the certificate authority 300 of the system I in the key management unit 411 in advance.
Details of this procedure are shown in FIG. First, the card management apparatus 400 of the system II generates a program identification ID in the program identification information management unit 414 in the program management unit 410, generates a hash value of the program in the hash calculation unit 415, and stores the storage unit. After being stored in 413, it is transmitted to the certificate authority 300 of the system I.

  The certificate authority 300 of the system I stores the received program identification information in the storage unit 314, generates a signature with the received information, the certificate authority identification information of the system I, the key information of the certificate authority, and the secret key of the certificate authority, A program certificate is created, stored (registered) in the storage unit 314, and then transmitted to the card management apparatus 400 of the system II.

  The system II card management device 400 verifies the received program certificate with the public key of the system I certification authority stored in the key management unit 411 in the program management unit 410 and stores it in the storage unit 413. Store.

  Next, the card management device 400 reads the token program, program identification information, and program certificate from the storage unit 413 of the program management unit 410, and at the token generation information management unit 421 of the token authentication unit 420, the token generation information (Service identification ID, key ID, key) is generated, stored in the storage unit 422, and then transmitted to the card management apparatus 200 of the system I together with the token program, program identification information, and program certificate.

  The card management apparatus 200 of the system I verifies the received program certificate with the public key of the certification authority of the system I at the program verification unit 214. If the verification is correct, the received token program, program identification information, program certificate The token generation information (service identification ID, key ID, key) is stored in the storage unit 215, and the result is notified to the card management apparatus 400 of the system II.

  Next, in the method of the present invention, a token program and a key specific to the system II stored in the card management apparatus 200 of the system I are downloaded to the IC card 1 of the system I as necessary.

  Details of this procedure are shown in FIG. First, the card management apparatus 200 and the IC card 100 perform mutual authentication using the respective public keys in the respective authentication units 112 and 212.

  After the mutual authentication, the card management apparatus 200 uses the token program, program identification information, program certificate, and token generation information (service identification ID, key ID, key ID) unique to the system II stored in the storage unit 215 of the program management unit 213. Key) to the IC card 100.

  The IC card 100 verifies the received program certificate with the public key of the certificate authority 300 stored in the key management unit 111 by the program verification unit 113, and if the verification is correct, the token program and token generation information unique to the system II (Service identification ID, key ID, key) is downloaded to the storage unit 114.

  In this way, the IC card in the system I in which the token program and key unique to the system II are downloaded can receive a specific service upon receiving the authentication of the card management device 400 in the system II.

  This procedure is shown in FIG. The card management device 400 in the system II sends a token program selection command from the token authentication unit 420 to the IC card 100 of the system I. The IC card 100 reads the token program selected in response to this command from the storage unit 114 to the program execution unit 115.

  Next, the card management apparatus 400 of the system II generates authentication information by the authentication information generation unit 425 of the token authentication unit 420 and transmits it to the IC card 100. In the illustrated example, the authentication information is composed of a random number generated by the random number generation unit 426 in the authentication information generation unit 425 and a current time generated by the timer unit 427, but is not limited thereto.

When receiving the authentication information, the IC card 100 of the system I reads the token generation information (service identification ID, key ID, key) received and stored at the time of loading the program from the storage unit 114 into the program execution unit 115, and the program execution unit At 115, the received authentication information (random number, time information) and the service ID are encrypted with the read key, and the token is generated by adding the service identification ID and the key ID, and the token authentication of the card management apparatus 400 of the system II To the unit 420.

  The token authentication unit 420 of the system II card management device 400 searches the token generation information management unit 421 for the received service identification ID and checks whether it exists in the storage unit 422. The management unit 424 searches, reads the corresponding key from the storage unit 422 into the token verification unit 423, decrypts the encrypted information received using this key, and matches the transmitted random number, time information, and service identification ID. Token verification is performed by checking whether or not, and if the verification is correct, the card management device 400 starts the service.

  The token authentication method and system configuration and processing procedure according to the present invention have been described above. The various components of the IC card, certificate authority, and card management apparatus that constitute the token authentication system of the present invention shown in FIG. 2 to 4, the processing procedure of the token authentication method of the present invention shown in FIGS. 2 to 4 is executed by a certificate authority, a card management device, and a computer constituting an IC card, and the present invention is a computer for executing these processing procedures. A program and a recording medium recording the computer program are also included in the scope of the present invention.

It is a block diagram of the system which implements the token authentication method of this invention. It is a figure which shows the procedure which downloads to the card | curd management apparatus after registering the token program intrinsic | native to system II in the certification | authentication authority of system I in the token authentication method of this invention. It is a figure which shows the procedure which downloads the token program intrinsic | native to the system II from the card management apparatus of the system I to an IC card in the token authentication method of this invention. It is a figure which shows the procedure which authenticates the IC card of the system I by the system II.

Explanation of symbols

I system
II system 100 IC card 200 card management device 300 certificate authority 400 card management device 111 key management unit 112 authentication unit 113 program verification unit 114 storage unit 115 program execution unit 211 key management unit 212 card authentication unit 213 program management unit 214 program verification unit 215 Storage unit 311 Key management unit 312 Certificate issue unit 313 Certificate verification unit 314 Storage unit 410 Program management unit 411 Key management unit 412 Program verification unit 413 Storage unit 414 Program identification information management unit 415 Hash operation unit 420 Token authentication unit 421 Token generation information management unit 422 Storage unit 423 Token verification unit 425 Authentication information generation unit

Claims (9)

  In an authentication method for authenticating an IC card between at least two IC card systems having different authentication methods and authentication keys, in order to enable an IC card belonging to the own system to be authenticated by another system, the card in the own system An authentication program unique to another system is stored in the management apparatus, and an authentication key for the other system is stored. If necessary, an IC card managed by the management apparatus is transferred from the card management apparatus to another IC card. A token authentication method comprising downloading an authentication program unique to a system, setting a key for authentication of another system, and generating a token for authentication using the authentication program and the key.   When the card management device in its own system stores a program specific to another system, the certificate authority in its own system issues a certificate for the program, and the card management device in its own system is unique to the other system. 2. The method according to claim 1, wherein when the program is stored, the validity is authenticated by the program certificate.   3. The method according to claim 2, wherein when the IC card downloads a program specific to another system from a card management apparatus in the system, the validity of the IC card is verified by the program certificate. The token authentication system for implementing the method according to claim 1, wherein the card management device in each system comprises means for storing a token authentication program and an authentication key unique to another system,
The IC card managed by the management device uses a means for downloading an authentication program and an authentication key specific to another system from the card management device as needed, and uses the authentication key for the downloaded authentication program. And a means for generating a token for authentication.   When the card management device in each system stores a program specific to the other system, the certificate authority in the system has means for issuing a certificate of the program, and the card management device is unique to the other system. 5. The system according to claim 4, further comprising means for authenticating the validity of the program by using the certificate.   6. The IC card according to claim 5, further comprising means for authenticating the legitimacy by the program certificate when a state-owned program is downloaded from a card management device in the own system to another system. system.   A computer program for executing the method according to claim 1, wherein an authentication program specific to another system is stored in a card management device in the own system, and an authentication key for the other system is stored. If necessary, an authentication program specific to the other system is downloaded from the card management device to the IC card managed by the management device, and an authentication key for the other system is set. A computer program for executing a procedure for generating a token for authentication using a computer.   When the card management device in its own system stores a program specific to another system, the certificate authority in the system issues a certificate for the program, and the card management device issues a program specific to the other system. 8. The computer program according to claim 7, wherein, when storing, causes the card management device to execute a procedure for authenticating the validity by the certificate.   When an IC card downloads a program specific to another system from a card management device in its own system, the IC card is caused to execute a procedure for authenticating its validity with the program certificate. Item 9. The computer program according to Item 8.

Images