阅读说明：本技术 信息处理设备、信息处理方法和程序 (Information processing apparatus, information processing method, and program ) 是由 中津留勉 下地克弥 于 2019-01-11 设计创作，主要内容包括：提供一种信息处理设备,包括：处理单元,所述处理单元被配置成使用分配给记录介质的多个区域的密钥进行计算,并生成认证密钥。所述处理单元通过使用对应于密钥的转换值进行计算来生成认证密钥,所述转换值是通过使用与在计算中所使用的密钥相关联的转换方法,转换特定于设备的信息而获得的。(There is provided an information processing apparatus including: a processing unit configured to perform calculation using keys assigned to a plurality of areas of the recording medium, and generate an authentication key. The processing unit generates an authentication key by performing calculation using a conversion value corresponding to a key, the conversion value being obtained by converting device-specific information using a conversion method associated with the key used in the calculation.)

1. An information processing apparatus comprising:

a processing unit configured to perform calculation using keys assigned to a plurality of areas of a recording medium and generate an authentication key,

wherein the processing unit generates an authentication key by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting device-specific information using a conversion method associated with the key used in the calculation.

2. The information processing apparatus according to claim 1, wherein the processing unit performs the calculation using a conversion value corresponding to a key used in the calculation, each time the calculation using the key is performed.

3. The information processing apparatus according to claim 1, wherein after performing the calculation using the key, the processing unit performs the calculation using a conversion value corresponding to the key.

4. The information processing apparatus according to claim 1, wherein the processing unit performs calculation using a synthesized value obtained by synthesizing a converted value corresponding to the key, after performing calculation using the key.

5. The information processing apparatus according to claim 1, wherein the processing unit specifies a conversion method associated with each key based on setting information associated with the area.

6. The information processing apparatus according to claim 1,

wherein the conversion method includes not converting the device-specific information, an

In a case where the conversion method associated with one key indicates that the device-specific information is not converted, the processing unit does not perform calculation using the conversion value corresponding to the one key.

7. An information processing apparatus comprising:

a processing unit configured to generate an authentication key used in an authentication process and perform the authentication process using the generated authentication key,

wherein the processing unit

A plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium are generated,

generating a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys, and

the authentication process is performed using the second degenerate key as an authentication key.

8. The information processing apparatus according to claim 7, wherein in the processing unit, encryption schemes supported by the plurality of first degenerate keys are identical to each other.

9. The information processing apparatus according to claim 7, wherein in said processing unit, the encryption schemes supported by the plurality of first degenerate keys include a plurality of encryption schemes.

10. An information processing apparatus comprising:

a processing unit configured to perform an authentication process using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of a recording medium, and to control execution of a process related to a service authenticated in the authentication process,

wherein, in a case where the authentication processing is performed a plurality of times, the processing unit makes executable a process related to a service authenticated in any one authentication processing.

11. The information processing apparatus according to claim 10, wherein in a case where the authentication process is performed a plurality of times, the processing unit changes the service-related process to be made executable based on a parameter of a command acquired from the external apparatus before the authentication process is performed.

12. The information processing apparatus according to claim 11, wherein the processing unit changes the service-related process to be made executable into a process related to the service authenticated in any one of the authentication processes, or a process related to the service authenticated in the authentication process performed most recently, based on a parameter of the command.

13. An information processing method performed by an information processing apparatus, comprising:

performing calculation using keys assigned to a plurality of areas of the recording medium, and generating an authentication key,

wherein in the generation of the authentication key, the authentication key is generated by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting device-specific information using a conversion method associated with the key used in the calculation.

14. An information processing method performed by an information processing apparatus, comprising:

generating an authentication key used in the authentication process; and

the authentication process is performed using the generated authentication key,

wherein, in the generation of the authentication key,

generating a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium, and

generating a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys, and

in performing the authentication process, the authentication process is performed using the second degenerate key as an authentication key.

15. An information processing method performed by an information processing apparatus, comprising:

performing authentication processing using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of the recording medium; and

controls execution of processes related to the service authenticated in the authentication process,

when the authentication process is performed a plurality of times, the execution control makes executable a process related to a service authenticated in any one authentication process.

16. A program that causes a computer to implement:

a function of performing calculation using keys assigned to a plurality of areas of the recording medium, and generating an authentication key,

wherein the function of generating an authentication key includes generating an authentication key by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting device-specific information using a conversion method associated with the key used in the calculation.

17. A program that causes a computer to implement:

a function of generating an authentication key used in the authentication process; and

a function of performing an authentication process using the generated authentication key,

wherein the generating function comprises

Generating a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium, and

generating a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys, and

the function of performing the authentication process includes performing the authentication process using the second degenerate key as an authentication key.

18. A program that causes a computer to implement:

a function of performing authentication processing using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of the recording medium; and

a function of controlling execution of a process related to a service authenticated in the authentication process,

wherein, in the case where the authentication process is performed a plurality of times, the function of controlling the execution includes making executable a process related to a service authenticated in any one of the authentication processes.

Technical Field

The present disclosure relates to an information processing apparatus, an information processing method, and a program.

Background

A technique for managing resources of a data storage device such as an IC card has been developed. As the above-described technique, for example, there is a technique described in the following patent document 1.

CITATION LIST

Patent document

PTL 1：JP 2000-36021A

Disclosure of Invention

Technical problem

For example, there is a device that needs to perform authentication using an authentication key in order to access an area, data, or the like of a recording medium.

The present disclosure proposes an information processing apparatus, an information processing method, and a program that are novel and improved and that are capable of improving the convenience of authentication using an authentication key.

Solution to the problem

According to an embodiment of the present disclosure, there is provided an information processing apparatus including: a processing unit configured to perform calculation using keys assigned to a plurality of areas of the recording medium, and generate an authentication key. The processing unit generates an authentication key by performing calculation using a conversion value corresponding to a key, the conversion value being obtained by converting device-specific information using a conversion method associated with the key used in the calculation.

In addition, according to an embodiment of the present disclosure, there is provided an information processing apparatus including: a processing unit configured to generate an authentication key used in an authentication process and perform the authentication process using the generated authentication key. The processing unit generates a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium, generates a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys, and performs authentication processing using the second degenerate key as an authentication key.

In addition, according to an embodiment of the present disclosure, there is provided an information processing apparatus including: a processing unit configured to perform an authentication process using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of a recording medium, and to control execution of a process related to a service authenticated in the authentication process. In the case where the authentication process is performed a plurality of times, the processing unit makes a process related to a service authenticated in any one authentication process executable.

In addition, according to an embodiment of the present disclosure, there is provided an information processing method performed by an information processing apparatus, including: a key assigned to a plurality of areas of the recording medium is used for calculation, and an authentication key is generated. In the generation of the authentication key, the authentication key is generated by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting device-specific information using a conversion method associated with the key used in the calculation.

In addition, according to an embodiment of the present disclosure, there is provided an information processing method performed by an information processing apparatus, including: generating an authentication key used in the authentication process; and performing an authentication process using the generated authentication key. In the generation of the authentication key, a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to the areas of the recording medium are generated, and a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys is generated, and in performing the authentication process, the authentication process is performed using the second degenerate key as the authentication key.

In addition, according to an embodiment of the present disclosure, there is provided an information processing method performed by an information processing apparatus, including: performing authentication processing using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of the recording medium; and controlling execution of a process related to the service authenticated in the authentication process. In the case where the authentication process is performed a plurality of times, in the control of execution, the process related to the service authenticated in any one authentication process is made executable.

Further, according to an embodiment of the present disclosure, there is provided a program that causes a computer to realize: a function of performing calculation using keys assigned to a plurality of areas of the recording medium, and generating an authentication key. The function of generating the authentication key includes generating the authentication key by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting the device-specific information using a conversion method associated with the key used in the calculation.

Further, according to an embodiment of the present disclosure, there is provided a program that causes a computer to realize: a function of generating an authentication key used in the authentication process; and a function of performing authentication processing using the generated authentication key. The generating function includes generating a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to the areas of the recording medium, and generating a second degenerate key obtained by synthesizing the plurality of generated first degenerate keys, and the performing the authentication process includes performing the authentication process using the second degenerate key as the authentication key.

Further, according to an embodiment of the present disclosure, there is provided a program that causes a computer to realize: a function of performing authentication processing using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of the recording medium; and a function of controlling execution of a process related to the service authenticated in the authentication process. In the case where the authentication process is performed a plurality of times, the function of controlling execution includes making executable a process related to a service authenticated in any one authentication process.

The invention has the advantages of

According to the embodiments of the present disclosure, the convenience of authentication using an authentication key can be improved.

Note that the above effects are not necessarily restrictive. Any one of the effects described in the present specification or other effects that can be understood from the present specification can be achieved in addition to or instead of the above-described effects.

Drawings

Fig. 1 is an explanatory diagram illustrating an example of the configuration of an information processing system according to the present embodiment.

Fig. 2 is a functional block diagram illustrating an example of the configuration of an information processing apparatus according to the present embodiment.

Fig. 3 is an explanatory diagram illustrating an example of the hardware configuration of the information processing apparatus according to the present embodiment.

Fig. 4 is an explanatory diagram illustrating an example of the configuration of the IC chip and the antenna illustrated in fig. 3.

Fig. 5 is an explanatory diagram illustrating an example of a hardware configuration of a reader/writer (relay device) according to the present embodiment.

Fig. 6 is an explanatory diagram illustrating an example of the hardware configuration of the server according to the present embodiment.

Fig. 7 is an explanatory diagram for describing the information processing method according to the present embodiment.

Fig. 8 is an explanatory diagram illustrating a first generation example of the authentication key relating to the information processing method according to the first embodiment.

Fig. 9 is an explanatory diagram illustrating a second generation example of the authentication key related to the information processing method according to the first embodiment.

Fig. 10 is an explanatory diagram illustrating a third generation example of the authentication key relating to the information processing method according to the first embodiment.

Fig. 11 is an explanatory diagram illustrating an example of generation of an authentication key related to the information processing method according to the second embodiment.

Fig. 12 is an explanatory diagram for describing processing corresponding to the information processing method according to the third embodiment.

Detailed Description

Hereinafter, preferred embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. Note that in the present specification and the drawings, structural elements having substantially the same functions and structures are denoted by the same reference numerals, and repeated descriptions of these structural elements are omitted.

Further, the following description will be made in the following order.

1. Information processing system according to the present embodiment and information processing method according to the present embodiment

(1) Configuration of information processing system according to the present embodiment

(1-1) information processing apparatus 100

(1-2) reader/writer 200 (Relay device)

(1-3) Server 300

(1-4) application examples of respective devices constituting the information processing system according to the present embodiment

(2) Processing corresponding to the information processing method according to the present embodiment

(2-1) information processing method according to the first embodiment

(2-2) information processing method according to the second embodiment

(2-3) information processing method according to the third embodiment

(2-4) information processing method according to other embodiment

2. The procedure according to the present embodiment

(information processing system according to the present embodiment and information processing method according to the present embodiment)

Next, an example of the information processing system according to the present embodiment will be described first, and then the information processing method according to the present embodiment will be described by taking as an example a case applied to the information processing system according to the present embodiment.

(1) Configuration of information processing system according to the present embodiment

Fig. 1 is an explanatory diagram illustrating an example of the configuration of an information processing system 1000 according to the present embodiment. The information processing system 1000 includes, for example, the information processing apparatus 100, the reader/writer 200 (relay apparatus), and the server 300.

Further, the configuration of the information processing system according to the present embodiment is not limited to the example illustrated in fig. 1. For example, the information processing system according to the present embodiment may include a plurality of information processing apparatuses 100. Further, the information processing system according to the present embodiment may include a plurality of readers/writers 200 or a plurality of servers 300.

The information processing apparatus 100 and the reader/writer 200 communicate via Near Field Communication (NFC) such as a type, B type, F type, or the like.

Further, in the information processing system according to the present embodiment, for example, the information processing apparatus 100 and the reader/writer 200 may communicate in "wireless communication according to an arbitrary communication scheme, such as wireless communication using IEEE802.15.1 such as Bluetooth Low Energy (BLE), wireless communication or infrared communication using IEEE 802.11", or "wired communication using communication via a communication interface based on a Universal Serial Bus (USB) or ISO 7816 standard, or the like".

The server 300 and the reader/writer 200 are connected in a wireless or wired manner, for example, via a network, and communicate by communication via the network (hereinafter referred to as "network communication"). Examples of the network according to the present embodiment include a wired network such as a Local Area Network (LAN) or a Wide Area Network (WAN), a wireless network such as a Wireless Local Area Network (WLAN), and the internet using a communication protocol such as transmission control protocol/internet protocol (TCP/IP).

Further, in the information processing system according to the present embodiment, the server 300 and the reader/writer 200 may also directly communicate with each other without a network.

The server 300 and the information processing apparatus 100 communicate via the reader/writer 200. In other words, in the information processing system 1000, the reader/writer 200 functions as a relay device that relays communication between the server 300 and the information processing device 100.

Further, in the information processing system according to the present embodiment, the server 300 and the information processing apparatus 100 may also communicate with each other without passing through the reader/writer 200. For example, in the case where the information processing system according to the present embodiment has a "configuration in which the server 300 and the information processing apparatus 100 directly communicate without passing through the reader/writer 200", the server 300 may have the function of the reader/writer 200. In other words, the information processing system according to the present embodiment may not have a device that functions as a relay device such as the reader/writer 200.

Next, a case where "the information processing apparatus 100 and the reader/writer 200 communicate in accordance with NFC, and the server 300 and the reader/writer 200 communicate in accordance with network communication" as illustrated in fig. 1 will be described as an example. Further, as described above, the example of communication in the information processing system according to the present embodiment is not limited to the example illustrated in fig. 1.

(1-1) information processing apparatus 100

Fig. 2 is a functional block diagram illustrating an example of the configuration of the information processing apparatus 100 according to the present embodiment.

The information processing apparatus 100 includes, for example, a first communication unit 102, a second communication unit 104, and a control unit 106.

In addition, the information processing apparatus 100 may include, for example, a Read Only Memory (ROM) (not shown), a Random Access Memory (RAM) (not shown), an operation unit (not shown) operable by a user of the information processing apparatus 100, a display unit (not shown) that displays various screens on a display screen, and the like. For example, the respective components of the information processing apparatus 100 are connected to each other via a bus serving as a data transmission path.

The ROM (not shown) stores programs used by the control unit 106 and control data such as calculation parameters. The RAM (not shown) temporarily stores programs executed by the control unit 106 and the like.

An operation input device illustrated in a hardware configuration example of the information processing apparatus 100 to be described later may be used as an operation unit (not illustrated). Further, a display device illustrated in a hardware configuration example of the information processing device 100 to be described later may be used as a display unit (not illustrated).

(example of hardware configuration of information processing apparatus 100)

Fig. 3 is an explanatory diagram illustrating an example of the hardware configuration of the information processing apparatus 100 according to the present embodiment. Fig. 3 illustrates an example of a hardware configuration of the information processing apparatus 100 in the case where communication with the reader/writer 200 is performed in accordance with NFC.

The information processing apparatus 100 includes, for example, an MPU 150, a ROM 152, a RAM 154, a recording medium 156, an input/output interface 158, an operation input device 160, a display device 162, a communication interface 164, an IC chip 166, and an antenna 168. Further, for example, the respective components of the information processing apparatus 100 are connected to each other via a bus 170 serving as a data transmission path. Further, the information processing apparatus 100 is driven by, for example, power supplied from an internal power supply such as a battery included in the information processing apparatus 100, power supplied from a connected external power supply, or the like.

The MPU 150 is configured by one or more processors configured by a Microprocessor (MPU) or the like, various processing circuits, and the like, and functions as the control unit 106 that generally controls the information processing apparatus 100. Further, in the information processing apparatus 100, the MPU 150 also functions as, for example, a processing unit 110 to be described later.

The ROM 152 stores programs used by the MPU 150, control data such as calculation parameters, and the like. The RAM 154 temporarily stores, for example, programs executed by the MPU 150, and the like.

The recording medium 156 is a single recording medium that functions as a storage unit (not shown). The recording medium 156 stores, for example, various types of data such as various types of applications. Here, examples of the recording medium 156 include a magnetic recording medium such as a hard disk and a nonvolatile memory such as a flash memory. Further, the recording medium 156 may be removable from the information processing apparatus 100.

The input/output interface 158 is connected to, for example, an operation input device 160 or a display device 162. The operation input device 160 functions as an operation unit (not shown), and the display device 162 functions as a display unit (not shown). Here, examples of the input/output interface 158 include a Universal Serial Bus (USB) terminal, a Digital Visual Interface (DVI) terminal, a high-definition multimedia interface (HDMI) (registered trademark) terminal, and various processing circuits.

Further, for example, an operation input device 160 is mounted on the information processing apparatus 100, and is connected to the input/output interface 158 in the information processing apparatus 100. For example, a button, a direction key, a rotary selector such as a dial (jog dial), or a combination thereof may be used as the operation input device 160.

Further, for example, the display device 162 is mounted on the information processing device 100, and is connected to the input/output interface 158 in the information processing device 100. For example, a liquid crystal display, an organic EL display, or the like may be used as the display device 162.

Further, it is to be understood that the input/output interface 158 may be connected to an external device such as an external operation input device (e.g., a keyboard or a mouse) or an external display device serving as an external device of the information processing device 100. Further, for example, the display device 162 may be a device on which display and user operation may be performed, such as a touch screen.

The communication interface 164 is a communication device for performing communication of one communication scheme supported by the information processing device 100, and functions as the first communication unit 102. Here, for example, a communication antenna and a Radio Frequency (RF) circuit (wireless communication), an IEEE802.15.1 port and a transceiver circuit (wireless communication), an IEEE 802.11 port and a transceiver circuit (wireless communication), a LAN terminal and a transceiver circuit (wired communication), and the like may be used as the communication interface 164.

The IC chip 166 and the antenna 168 are communication devices that perform communication of other communication schemes supported by the information processing device 100, and function as the second communication unit 104. For example, the IC chip 166 and the antenna 168 perform NFC communication with an external device having a reader/writer function such as the reader/writer 200 by a carrier wave of a predetermined frequency such as 13.56 MHz.

The antenna 168 functions to receive a carrier wave and transmit a response signal. Further, the IC chip 166 demodulates and processes a carrier signal transmitted from an external device such as the reader/writer 200 based on the received carrier, and causes a response signal to be transmitted by load modulation.

Fig. 4 is an explanatory diagram illustrating an example of the configuration of the IC chip 166 and the antenna 168 illustrated in fig. 3. Further, for example, the information processing apparatus 100 may not have the configuration of the IC chip 166 illustrated in fig. 3 in the form of an IC chip.

The antenna 168 is constituted by a resonance circuit including, for example, a coil (inductor) L1 having a predetermined inductance and a capacitor C1 having a predetermined capacitance, and generates an induced voltage by electromagnetic induction in response to reception of a carrier wave. Further, the antenna 168 outputs a reception voltage obtained by resonating the induced voltage at a predetermined resonance frequency. Here, the resonance frequency of the antenna 168 is set in accordance with the frequency of the carrier wave (such as 13.56MHz, for example). The antenna 168 receives the carrier wave by the above configuration and transmits the response signal by load modulation performed in the load modulation circuit 182 of the IC chip 166.

The IC chip 166 includes, for example, a carrier detection circuit 172, a detection circuit 174, a regulator 176, a demodulation circuit 178, an MPU180, and a load modulation circuit 182. Further, although not illustrated in fig. 4, the IC chip 166 may further include, for example, a protection circuit (not illustrated) for preventing overvoltage or overcurrent from being applied to the MPU 180. Here, for example, a clamp circuit or the like formed of a diode or the like may be used as a protection circuit (not shown).

Further, the IC chip 166 includes, for example, a ROM 184, a RAM 186, and a nonvolatile memory 188. For example, the MPU180, ROM 184, RAM 186, and nonvolatile memory 188 are connected via a bus 190 as a data transmission path. Further, bus 190 is connected to bus 170.

The ROM 184 stores programs used by the MPU180 and control data such as calculation parameters. The RAM 186 temporarily stores programs executed by the MPU180, calculation results, execution states, and the like.

The nonvolatile memory 188 is another recording medium functioning as a storage unit (not shown). The nonvolatile memory 188 stores various types of data such as, for example, "data related to an information processing method in the information processing apparatus 100 such as key information (described later) or setting information (described later)", electronic values (money or data having a value corresponding to the money), data corresponding to various services, and various applications. The key information according to the present embodiment is data used in communication authentication of an arbitrary communication scheme such as NFC (including authentication for accessing an area of a recording medium), processing related to arbitrary encryption/decryption, and the like. Hereinafter, a key used for authentication in the key information is referred to as an "authentication key". Further, the authentication key according to the present embodiment and the key used for encryption or decryption may be the same key, or may be different keys. In other words, the key indicated by the key information according to the present embodiment may function as an authentication key and/or a key for encryption or decryption.

Here, examples of the nonvolatile memory 188 include an Electrically Erasable Programmable Read Only Memory (EEPROM), a flash memory, and the like. For example, the nonvolatile memory 188 has tamper resistance, and corresponds to an example of a secure recording medium.

For example, the carrier detection circuit 172 generates a rectangular detection signal based on the reception voltage transmitted from the antenna 168, and transmits the detection signal to the MPU 180. Further, for example, the MPU180 uses the transferred detection signal as a processing clock for data processing. Here, since the detection signal is a signal based on the reception voltage transmitted from the antenna 168, the detection signal is synchronized with the frequency of the carrier wave transmitted from the external device such as the reader/writer 200. Thus, since the carrier detecting circuit 172 is mounted, the IC chip 166 can perform processing together with an external device such as the reader/writer 200 in synchronization with the external device.

The detection circuit 174 rectifies the reception voltage output from the antenna 168. Here, the detection circuit 174 includes, for example, a diode D1 and a capacitor C2.

The regulator 176 smoothes the reception voltage to a constant voltage, and outputs a driving voltage to the MPU 180. Here, the regulator 176 uses the DC component of the reception voltage as the driving voltage.

The demodulation circuit 178 demodulates the carrier signal based on the reception voltage, and outputs data (for example, binary data signals of high level and low level) corresponding to the carrier signal contained in the carrier wave. Here, the demodulation circuit 178 outputs the AC component of the reception voltage as data.

The MPU180 is driven using the driving voltage output from the regulator 176 as power, and processes data demodulated in the demodulation circuit 178. Here, the MPU180 includes one or more processors configured by a calculation circuit such as, for example, an MPU, various processing circuits, and the like.

Further, the MPU180 generates a control signal for controlling load modulation associated with a response to an external device such as the reader/writer 200 according to the processing result. Then, the MPU180 outputs a control signal to the load modulation circuit 182.

The load modulation circuit 182 includes, for example, a load Z and a switch SW1, and selectively connects (activates) the load Z in accordance with a control signal transmitted from the MPU180 and performs load modulation. Here, the load Z includes, for example, a resistor having a predetermined resistance value. Further, the switch SW1 is constituted by, for example, a p-channel Metal Oxide Semiconductor Field Effect Transistor (MOSFET) or an n-channel MOSFET.

With the above configuration, the IC chip 166 processes the carrier signal received by the antenna 168, and causes the antenna 168 to transmit the response signal by load modulation.

The IC chip 166 and the antenna 168 have, for example, the configuration illustrated in fig. 4, and perform NFC communication with an external device such as the reader/writer 200 using a carrier wave of a predetermined frequency. Further, it is to be understood that the configurations of the IC chip 166 and the antenna 168 according to the present embodiment are not limited to the example illustrated in fig. 4.

The information processing apparatus 100 communicates with an external apparatus such as the reader/writer 200, for example, using a hardware configuration illustrated in fig. 3. Further, the information processing apparatus 100 performs processing according to an information processing method in the information processing apparatus 100 described later, for example, using a hardware configuration illustrated in fig. 3. Further, the hardware configuration of the information processing apparatus 100 according to the present embodiment is not limited to the configuration illustrated in fig. 3.

For example, in the case where communication with an external apparatus is performed via an external communication apparatus having a function and configuration similar to those of the communication interface 164, or in the case where communication of one of the communication schemes described above is not performed, the information processing apparatus 100 may not include the communication interface 164.

Further, for example, in the case where communication with an external apparatus is performed via an external communication apparatus similar in function and configuration to the IC chip 166 and the antenna 168, the information processing apparatus 100 may not include the IC chip 166 and the antenna 168.

Further, in the case where communication with an external device is performed in a communication scheme other than NFC (such as wireless communication using IEEE 802.15.1), the information processing device 100 may not include the IC chip 166 and the antenna 168. With the above-described example, the information processing apparatus 100 performs communication with an external apparatus by a communication apparatus supporting a communication scheme other than NFC or an external communication apparatus supporting a communication scheme other than NFC.

Further, the information processing apparatus 100 may have a configuration in which some or all of the recording medium 156, the operation input apparatus 160, and the display apparatus 162 are not included, for example.

Further, for example, the information processing apparatus 100 may have a hardware configuration according to an application example of the information processing apparatus 100 to be described later. As an example, for example, in the case where the information processing apparatus 100 is an IC card, the information processing apparatus 100 may be configured by an IC chip 166 and an antenna 168. In the case where the information processing apparatus 100 is an IC card, for example, the MPU180 constituting the IC chip 166 performs processing according to an information processing method in the information processing apparatus 100 to be described later.

Further, for example, the configuration illustrated in fig. 3 (or the configuration according to the modification) may be realized by one or two or more Integrated Circuits (ICs).

Referring back to fig. 2, an example of the configuration of the information processing apparatus 100 will be explained. The first communication unit 102 communicates with an external device according to communication of one communication scheme. For example, the communication in the first communication unit 102 is controlled by the control unit 106.

Here, for example, a communication antenna and an RF circuit (wireless communication), an IEEE802.15.1 port and a transceiver circuit (wireless communication), an IEEE 802.11 port and a transceiver circuit (wireless communication), a LAN terminal and a transceiver circuit (wired communication), and the like may be used as the first communication unit 102.

The second communication unit 104 communicates with the external device according to communication of another communication scheme. For example, communication in the second communication unit 104 is controlled by the control unit 106.

Here, for example, an NFC-enabled communication device such as the IC chip 166 and the antenna 168 illustrated in fig. 3 may be used as the second communication unit 104. Further, as described above, the second communication unit 104 may be a communication device that supports a communication scheme other than NFC (such as, for example, wireless communication using ieee802.15.1).

The control unit 106 is constituted by, for example, an MPU or the like, and functions to control the information processing apparatus 100 as a whole. Further, the control unit 106 includes, for example, a processing unit 110, and plays a dominant role in performing processing in accordance with an information processing method in the information processing apparatus 100 to be described later.

The processing unit 110 plays a dominant role in processing according to the information processing method in the information processing apparatus 100. An example of processing according to the information processing method in the information processing apparatus 100 will be described later in each embodiment to be explained.

Further, the configuration of the information processing apparatus according to the present embodiment is not limited to the configuration illustrated in fig. 2.

For example, the information processing apparatus according to the present embodiment may include the processing unit 110 illustrated in fig. 2 separately from the control unit 106 (which is implemented by another processing circuit, for example).

Further, the configuration of the information processing apparatus according to the present embodiment is not limited to the configuration illustrated in fig. 2, and a configuration corresponding to a manner of separating processing according to an information processing method in the information processing apparatus 100 to be described later may be employed.

Further, for example, in the case where communication with an external apparatus is performed via an external communication apparatus similar in function and configuration to the first communication unit 102, or in the case where it is a configuration in which communication of one of the communication schemes described above is not performed, the information processing apparatus according to the present embodiment may not include the first communication unit 102.

Further, for example, in the case where communication with an external apparatus is performed via an external communication apparatus having a function and constitution similar to the second communication unit 104, the information processing apparatus according to the present embodiment may not include the second communication unit 104.

(1-2) reader/writer 200 (Relay device)

The reader/writer 200 (relay device) is a device that functions as a relay device that relays communication between the server 300 and the information processing device 100.

(hardware configuration example of the reader/writer 200)

Fig. 5 is an explanatory diagram illustrating an example of the hardware configuration of the reader/writer 200 (relay apparatus) according to the present embodiment.

The reader/writer 200 includes, for example, an MPU 250, ROM 252, RAM 254, recording medium 256, communication interface 258, carrier wave transmission circuit 260, and antenna 262. Further, for example, the respective components of the reader/writer 200 are connected to each other via a bus 264 serving as a data transmission path. Further, the reader/writer 200 is driven by, for example, power supplied from an internal power supply such as a battery included in the reader/writer 200, power supplied from a connected external power supply, or the like.

The MPU 250 is configured by one or more processors configured by a calculation circuit such as, for example, an MPU, various processing circuits, and the like, and functions as a control unit (not shown) that controls the reader/writer 200 as a whole.

The ROM 252 stores programs used by the MPU 250, control data such as calculation parameters, and the like. The RAM 254 temporarily stores, for example, programs executed by the MPU 250, and the like.

The recording medium 256 functions as a storage unit (not illustrated), and stores various types of data such as, for example, various types of applications. Here, examples of the recording medium 256 include a magnetic recording medium such as a hard disk, and a nonvolatile memory such as a flash memory. Further, the recording medium 256 is detachable from the reader/writer 200.

The communication interface 258 is a communication device that performs communication of one communication scheme supported by the reader/writer 200, and functions as a first communication unit (not shown) that performs communication with an external device such as the server 300 in a wireless or wired manner via a network (or directly). Here, for example, a communication antenna and an RF circuit (wireless communication), an IEEE802.15.1 port and a transceiver circuit (wireless communication), an IEEE 802.11 port and a transceiver circuit (wireless communication), a LAN terminal and a transceiver circuit (wired communication), or the like may be used as the communication interface 258. Further, the communication interface 258 may be any configuration corresponding to the network according to the present embodiment.

The carrier wave transmission circuit 260 and the antenna 262 are communication devices that perform communication of other communication schemes supported in the reader/writer 200, and function as a second communication unit (not shown) that performs communication with an external device such as the information processing device 100 in a wireless or wired manner.

The antenna 262 is constituted by, for example, a resonance circuit including a coil having a predetermined inductance serving as a transmitting and receiving antenna and a capacitor having a predetermined capacitance, and a demodulation circuit. Further, the antenna 262 receives a carrier wave of a predetermined frequency such as, for example, 13.56MHz, and demodulates data or the like transmitted from an external apparatus such as the information processing apparatus 100 by load modulation or the like. Further, for example, in the case where the carrier transmission circuit 260 includes a demodulation circuit, the antenna 262 may be constituted by a resonance circuit.

The carrier transmission circuit 260 includes, for example, a modulation circuit that performs modulation such as Amplitude Shift Keying (ASK) and an amplification circuit that amplifies an output of the modulation circuit, and causes a carrier carrying a carrier signal from a transmitting/receiving antenna of the antenna 262 to be transmitted. Further, the carrier transmission circuit 260 may include, for example, a demodulation circuit that demodulates a signal received by the antenna 262. For example, the demodulation circuit envelope-detects a change in the amplitude of a voltage between the modulation circuit (or the amplification circuit) and the resonance circuit of the antenna 262, binarizes the detection signal, and demodulates the signal received by the antenna 262. Further, the demodulation circuit may demodulate a signal received by the antenna 262, for example, by using a phase change of a voltage between the modulation circuit (or the amplification circuit) and the resonance circuit of the antenna 262.

Since the carrier transmission circuit 260 is installed, the reader/writer 200 has an initiator function in NFC and functions as a so-called reader/writer. Here, various signals such as, for example, a polling signal and a signal indicating various requests such as a read request can be used as the carrier signal transmitted from the antenna 262 by the carrier transmission circuit 260. Further, the carrier transmission circuit 260 controls transmission of the carrier by the MPU 250, for example.

The reader/writer 200 has a hardware configuration such as that illustrated in fig. 5, thereby functioning as a relay device. Further, the hardware configuration of the reader/writer 200 according to the present embodiment is not limited to the configuration illustrated in fig. 5.

For example, in the case where communication with an external device is performed via an external communication device having a function similar to that of the communication interface 258, the reader/writer 200 may not include the communication interface 258.

Further, in the case where communication with an external apparatus is performed via an external communication apparatus having a function similar to that of the carrier transmission circuit 260 and the antenna 262, the reader/writer 200 may not include the carrier transmission circuit 260 and the antenna 262.

Further, in the case where communication with an external device is performed in accordance with a communication scheme other than NFC (such as wireless communication using IEEE 802.15.1), the reader/writer 200 may not include the carrier transmission circuit 260 and the antenna 262. In the case of the above-described example, the reader/writer 200 performs communication with an external device through a communication device supporting a communication scheme other than NFC or an external communication device supporting a communication scheme other than NFC.

Further, the reader/writer 200 may have a configuration in which the recording medium 256 is not contained, for example.

Further, for example, the reader/writer 200 may have a hardware configuration according to an application example of the reader/writer 200 to be described later.

Further, for example, the configuration illustrated in fig. 5 (or the configuration according to the modification) may be realized by one or two or more Integrated Circuits (ICs).

(1-3) Server 300

The server 300 is a device that communicates with the information processing device 100 via the reader/writer 200 (or directly). The server 300 can perform various processes such as a payment process using, for example, electronic value by communicating with the information processing apparatus 100.

(hardware configuration example of the Server 300)

Fig. 6 is an explanatory diagram illustrating an example of the hardware configuration of the server 300 according to the present embodiment. The server 300 includes, for example, an MPU 350, ROM 352, RAM 354, a recording medium 356, an input/output interface 358, an operation input device 360, a display device 362, and a communication interface 364. Further, for example, the respective components of the server 300 are connected to each other via a bus 366 serving as a data transmission path. Further, the server 300 is driven by, for example, power supplied from an internal power source such as a battery included in the server 300, power supplied from a connected external power source, or the like.

The MPU 350 is configured by one or more processors configured by a calculation circuit such as, for example, an MPU, various processing circuits, and the like, and functions as a control unit (not shown) that controls the server 300 as a whole.

The ROM 352 stores programs used by the MPU 350, control data such as calculation parameters, and the like. The RAM 354 temporarily stores programs executed by the MPU 350, for example.

The recording medium 356 functions as a storage unit (not illustrated), and stores various types of data such as, for example, data related to an information processing method in the server 300 or various types of applications. Here, examples of the recording medium 356 include a magnetic recording medium such as a hard disk and a nonvolatile memory such as a flash memory. Further, the recording medium 356 may be removed from the server 300.

The input/output interface 358 connects, for example, an operation input device 360 or a display device 362. The operation input device 360 functions as an operation unit (not shown), and the display device 362 functions as a display unit (not shown). Here, examples of the input/output interface 358 include a USB terminal, a DVI terminal, an HDMI (registered trademark) terminal, and various processing circuits.

Further, for example, an operation input device 360 is mounted on the server 300, and is connected to the input/output interface 358 in the server 300. For example, a button, a direction key, a rotary selector such as a dial, a combination thereof, or the like may be used as the operation input device 360.

Further, for example, a display device 362 is mounted on the server 300, and is connected to the input/output interface 358 in the server 300. For example, a liquid crystal display or an organic EL display may be used as the display device 362.

Further, it is to be appreciated that the input/output interface 358 can be connected to an external device, such as an operational input device (e.g., keyboard, mouse, etc.) external to the server 300 or an external display device. Further, the display device 362 may be a device on which display and user operation may occur, such as a touch screen.

The communication interface 364 is a communication device for performing communication of one communication scheme supported by the server 300, and functions as a communication unit (not shown) for performing wireless or wired communication with an external device such as the reader/writer 200 via a network (or directly). Here, for example, a communication antenna and an RF circuit (wireless communication), an IEEE802.15.1 port and a transceiver circuit (wireless communication), an IEEE 802.11 port and a transceiver circuit (wireless communication), a LAN terminal and a transceiver circuit (wired communication), and the like may be used as the communication interface 164. Further, the communication interface 364 may be any configuration corresponding to the network according to the present embodiment.

The server 300 performs various processes such as a settlement process, for example, by a hardware configuration illustrated in fig. 6. Further, the hardware configuration of the server 300 according to the present embodiment is not limited to the configuration illustrated in fig. 6.

For example, in the case where communication with an external device or the like is performed via a connected external communication device, the server 300 may not include the communication interface 364. Further, the communication interface 364 may have a configuration capable of performing communication with one or more external devices or the like in accordance with various communication schemes.

Further, the server 300 may have a configuration in which some or all of the recording medium 356, the operation input device 360, and the display device 362 are not included, for example.

Further, for example, the server 300 may have a hardware configuration according to an application example of the server 300 to be described later.

Further, for example, part or all of the hardware configuration illustrated in fig. 6 (or a configuration according to a modification) may be realized by one or two or more ICs.

(1-4) application examples of respective devices constituting the information processing system according to the present embodiment

Although the information processing apparatus 100 has been described above as a component of the information processing system according to the present embodiment, the present embodiment is not limited to such a form. The present embodiment can be applied to various devices capable of performing processing according to an information processing method (described later) in the information processing device 100, such as, for example, "communication device such as smartphone", "IC card", "tablet device", or "game machine". Furthermore, the present embodiment can also be applied to a processing IC that can be incorporated into, for example, the above-described apparatus.

Further, although the reader/writer 200 (relay apparatus) has been described as a component of the information processing system according to the present embodiment, the present embodiment is not limited to such a form. For example, the present embodiment can be applied to any device having a function of relaying communication between devices such as "reader/writer", "device having a reader/writer function", and "communication device communicating in accordance with wireless communication using IEEE802.15.1 such as BLE". Furthermore, the present embodiment can also be applied to a processing IC that can be incorporated into, for example, the above-described apparatus.

Further, although the server 300 has been described as a component of the information processing system according to the present embodiment, the present embodiment is not limited to such a form. The present embodiment is applicable to various devices such as "a computer such as a Personal Computer (PC) or a server", "a tablet device", "a communication device such as a smartphone", "a game machine", and the like. Furthermore, the present embodiment can also be applied to a processing IC that can be incorporated into, for example, the above-described apparatus.

(2) Information processing method according to the present embodiment

Next, processing corresponding to the information processing method according to the present embodiment will be described using the information processing system 1000 illustrated in fig. 1 as an example.

(2-1) information processing method according to the first embodiment

(2-1-1) overview of information processing System 1000 to which information processing method according to the first embodiment is applied

For example, patent document 1 describes the following:

-generating an authentication key using a plurality of hierarchical keys or storage area keys; and

-transforming the authentication key based on the device specific information and using the transformation result for authentication.

Fig. 7 is an explanatory diagram for explaining an information processing method according to the present embodiment, and schematically illustrates an authentication key described in patent document 1.

For example, as illustrated in steps S10, S12, S14, … illustrated in fig. 7, in the technique disclosed in patent document 1, for example, a degenerate key that can function as an authentication key is generated by performing calculation using a plurality of hierarchical keys or storage area keys on a value serving as a base (such as a random number). For example, a degenerate key is generated by sequentially encrypting each key with a value serving as a basis.

Further, as illustrated in step S16 of fig. 7, in the technique disclosed in patent document 1, a degenerate key is converted based on device-specific information (i.e., device-specific data such as a manufacturing ID), and the conversion result is used as an authentication key. In the technique disclosed in patent document 1, the degenerate key is converted, for example, by performing exclusive or between the degenerate key and device-specific information, or by encrypting the degenerate key using device-specific information as a key.

For example, as illustrated in fig. 7, since the degenerate key is converted using the device-specific information, the authentication key is different for each device, so that security can be improved.

Here, when the authentication key is converted using device-specific information as in the technique disclosed in patent document 1, the conversion method is generally kept secret. One of the reasons why the conversion method is kept secret is, for example, because in the case of conversion according to a public key encryption scheme, if the conversion method is known, reverse conversion can be performed.

In the case where the recording medium installed in one apparatus includes areas of a plurality of business operators, or in the case where the secret of the conversion method is leaked from one business operator, it affects all the other business operators. Thus, it is technically possible, but in practice difficult, to share the secrets of the conversion method between a plurality of business operators.

In this regard, the information processing apparatus 100 to which the information processing method according to the first embodiment is applied realizes "generation of an authentication key based on apparatus-specific information without sharing a secret of the conversion method between business operators".

Since the authentication key is generated based on the device-specific information, the authentication key is different for each device, and thus security can be improved. Further, since the authentication key is generated based on the device-specific information without sharing the secret of the conversion method between the business operators, the influence when the secret of the conversion method is leaked can be reduced, so that "convenience of authentication using the authentication key" in "each business operator and each user of the information processing device 100" can be improved as compared with the case of using the related art.

Thus, the information processing apparatus 100 to which the information processing method according to the first embodiment is applied can improve the convenience of authentication using the authentication key.

(2-1-2) processing corresponding to the information processing method in the information processing apparatus 100 according to the first embodiment

Next, an example of processing corresponding to the information processing method in the information processing apparatus 100 according to the first embodiment will be described.

The information processing apparatus 100 performs calculation using a key assigned to each of a plurality of areas of the recording medium, and generates an authentication key. Examples of the area of the recording medium according to the present embodiment include an area of a recording medium (such as the nonvolatile memory 188 illustrated in fig. 4) mounted in the information processing apparatus 100, and an area of an external recording medium that the information processing apparatus 100 can access (the same applies hereinafter).

As the key related to the present embodiment, for example, an area key for allowing access to a specific area of the recording medium and/or a service key for allowing access to specific data stored in the area of the recording medium may be used. Further, the key according to the present embodiment is not limited to the above-described example, but may be, for example, a hierarchical key described in patent document 1.

In this specification, there is a case where "region" indicates "region" in a file system such as FeliCa (registered trademark) OS. In this case, the "area" corresponds to a directory (or folder).

Further, in this specification, there is a case where "service" indicates "service" in a file system such as FeliCa (registered trademark) OS. In this case, the "service" corresponds to data (or a file) for providing a predetermined service.

As the calculation using the key according to the present embodiment, for example, encryption according to an arbitrary encryption scheme may be used.

Further, when generating the authentication key, the information processing apparatus 100 performs calculation using "a conversion value corresponding to the key used in the calculation".

Encryption according to an arbitrary encryption scheme can be used as the calculation using the conversion value according to the present embodiment.

The conversion value corresponding to the key according to the present embodiment is a value obtained by converting device-specific information using a conversion method associated with each key used in calculation. As the device-specific information in the present embodiment, for example, data specific to the information processing device 100, such as a manufacturing ID stored in an arbitrary recording medium installed in the information processing device 100, may be used.

The information processing apparatus 100 specifies a conversion method associated with each key, for example, based on setting information associated with an area of the recording medium.

The setting information according to the present embodiment is data indicating a setting related to an area of the recording medium.

As the setting information, for example, "a table (or a database) in which an address indicating an area of the recording medium, a key, and data indicating a conversion method are recorded in association with each area" may be used. As the data indicating the conversion method, for example, data indicating a conversion algorithm using at least device-specific information as an input may be used. The conversion method associated with each key may be the same or may include multiple conversion methods.

For example, as a conversion method stored in the setting information, for example, any algorithm capable of converting a value indicated by the device-specific information into another value may be used.

Further, the conversion method according to the present embodiment is not limited to the above example. For example, the conversion method according to the present embodiment may include not converting the device-specific information into another value.

For example, in the case where the conversion method associated with one key indicates that the device-specific information is not converted, the information processing device 100 does not perform calculation using the conversion value corresponding to one key.

Next, an example of generation of an authentication key corresponding to the information processing method according to the first embodiment will be described.

(A) First generation example of authentication key according to first embodiment

Fig. 8 is an explanatory diagram illustrating a first generation example of an authentication key corresponding to the information processing method according to the first embodiment.

The "area/service key a" illustrated in fig. 8 indicates an area key or service key assigned to the area a in the recording medium such as the nonvolatile memory 188. Further, "area/service key B" illustrated in fig. 8 indicates an area key or service key allocated to the area B in the recording medium such as the nonvolatile memory 188, and "area/service key C" illustrated in fig. 8 indicates an area key or service key allocated to the area C in the recording medium such as the nonvolatile memory 188. In other words, the "area/service key" illustrated in fig. 8 is an example of a key assigned to each area. The same applies to the other figures below.

Further, the "random number" illustrated in fig. 8 is an example of a value serving as a basis of the authentication key. Further, it is to be understood that according to the present embodiment, the value serving as the basis of the authentication key including the examples illustrated in fig. 9 to 12 to be described later is not limited to the random number. The following description will be continued with a case in which the value serving as the basis of the authentication key is a random number.

The information processing apparatus 100 performs calculation using the random number and the key assigned to the area a (S100). Hereinafter, the calculation result of the calculation performed in the authentication key generation process, such as the calculation result of step S100, is referred to as an "intermediate key".

The information processing apparatus 100 converts the apparatus-specific information using the conversion method a associated with the key assigned to the area a used in step S100, and obtains a conversion value a (S102).

The information processing apparatus 100 performs calculation using the intermediate key and the conversion value a obtained in the process of step S100 (S104).

The information processing apparatus 100 performs calculation using the intermediate key obtained in the process of step S104 and the key assigned to the area B (S106).

The information processing apparatus 100 converts the apparatus-specific information using the conversion method B associated with the key assigned to the area B used in step S106, and obtains a conversion value B (S108).

The information processing apparatus 100 performs calculation using the intermediate key and the conversion value B obtained in the process of step S106 (S110).

The information processing apparatus 100 performs calculation using the intermediate key obtained in the process of step S110 and the key assigned to the area C (S112).

The information processing apparatus 100 converts the apparatus-specific information using the conversion method C associated with the key assigned to the region C used in step S112, and obtains a conversion value C (S114).

The information processing apparatus 100 performs calculation using the intermediate key and the conversion value C obtained in the process of step S114 (S116). In the example illustrated in fig. 8, the result of the processing in step S116 corresponds to the authentication key.

For example, as illustrated in fig. 8, each time calculation using a key is performed, the information processing apparatus 100 generates an authentication key by performing calculation using a conversion value corresponding to the key used in the performed calculation. The conversion value used in the first generation example of the authentication key is a value obtained by conversion using a conversion method associated with each key used in each calculation using the key. Thus, in the first generation example of the authentication key illustrated in fig. 8, it is not necessary to share the secret of the conversion method between the business operators in order to generate the authentication key. Thus, in the first generation example of the authentication key illustrated in fig. 8, "the authentication key is generated based on the device-specific information without sharing the secret of the conversion method between the business operators" is realized.

Further, the first generation example of the authentication key according to the first embodiment is not limited to the example illustrated in fig. 8.

For example, in the example illustrated in fig. 8, an example is illustrated in which the calculation using the key is sequentially performed three times, but the number of times of the calculation using the key may be any number of times, which is two or more times.

Further, as described above, the conversion method according to the present embodiment may include not converting the device-specific information into another value. Further, in the case where the conversion method associated with one key indicates that the device-specific information is not converted, the information processing device 100 may not perform calculation using the conversion value corresponding to one key.

(B) Second generation example of authentication key according to first embodiment

Fig. 9 is an explanatory diagram illustrating a second generation example of the authentication key corresponding to the information processing method according to the first embodiment.

The information processing apparatus 100 performs calculation using the random number and the key assigned to the area a (S200).

The information processing apparatus 100 performs calculation using the intermediate key obtained in the process of step S200 and the key assigned to the area B (S202).

The information processing apparatus 100 performs calculation using the intermediate key obtained in the process of step S202 and the key assigned to the area C (S204). The result of sequentially performing the calculations using the keys illustrated in steps S200 to S204 corresponds to, for example, a degenerate key in which a plurality of keys are synthesized.

The information processing apparatus 100 converts the apparatus-specific information using the conversion method a associated with the key assigned to the area a used in step S200, and obtains a conversion value a (S206).

The information processing apparatus 100 performs calculation using the intermediate key and the conversion value a obtained in the process of step S204 (S208).

The information processing apparatus 100 converts the apparatus-specific information using the conversion method B associated with the key assigned to the area B used in step S202, and obtains a conversion value B (S210).

The information processing apparatus 100 performs calculation using the intermediate key and the conversion value B obtained in the process of step S208 (S212).

The information processing apparatus 100 converts the apparatus-specific information using the conversion method C associated with the key assigned to the region C used in step S204, and obtains a conversion value C (S214).

The information processing apparatus 100 performs calculation using the intermediate key and the conversion value C obtained in the process of step S212 (S216). In the example illustrated in fig. 9, the processing result of step S216 corresponds to the authentication key.

For example, as illustrated in fig. 9, the information processing apparatus 100 generates an authentication key by performing calculation using a key, and subsequently performing calculation using a conversion value corresponding to each key. Similarly to the first generation example of the authentication key illustrated in fig. 8, the conversion value used in the second generation example of the authentication key is a value obtained by conversion using a conversion method associated with each key used in each calculation using the key. Thus, in the second generation example of the authentication key illustrated in fig. 9, it is not necessary to share the secret of the conversion method between business operators in order to generate the authentication key. Thus, in the second generation example of the authentication key illustrated in fig. 9, "the authentication key is generated based on the device-specific information without sharing the secret of the conversion method between the business operators" is realized.

Further, the second generation example of the authentication key according to the first embodiment is not limited to the example illustrated in fig. 9.

In the second generation example of the authentication key, for example, similarly to the first generation example of the authentication key, the calculation using the key may be performed any number of times, which is two or more times. Further, in the second generation example of the authentication key, similarly to the first generation example of the authentication key, for example, in a case where the conversion method associated with one key indicates that the device-specific information is not converted, calculation using the conversion value corresponding to one key may not be performed.

(C) Third example of generation of authentication key according to the first embodiment

Fig. 10 is an explanatory diagram illustrating a third generation example of an authentication key corresponding to the information processing method according to the first embodiment.

The information processing apparatus 100 performs calculation using the random number and the key assigned to the area a (S300).

The information processing apparatus 100 performs calculation using the intermediate key obtained in the process of step S300 and the key assigned to the area B (S302).

The information processing apparatus 100 performs calculation using the intermediate key obtained in the process of step S302 and the key assigned to the area C (S304). The result of sequentially performing the calculations using the keys illustrated in steps S300 to S304 corresponds to, for example, a degenerate key in which a plurality of keys are synthesized.

The information processing apparatus 100 converts the apparatus-specific information using the conversion method a associated with the key assigned to the area a used in step S300, and obtains a conversion value a (S306).

The information processing apparatus 100 converts the apparatus-specific information using the conversion method B associated with the key assigned to the area B used in step S302, and obtains a conversion value B (S308).

The information processing apparatus 100 converts the apparatus-specific information using the conversion method C associated with the key assigned to the area C used in step S304, and obtains a conversion value C (S310).

The information processing apparatus 100 performs arbitrary calculation capable of generating one value from the converted value a, the converted value B, and the converted value C, and calculates one value based on the converted value a, the converted value B, and the converted value C (S312). Here, one value generated in the processing in step S312 corresponds to a synthesized value obtained by synthesizing the converted value a, the converted value B, and the converted value C.

The information processing apparatus 100 performs calculation using the intermediate key obtained in the process of step S304 and the composite value obtained in the process of step S312 (S314). Here, since the composite value is a value based on the converted value a, the converted value B, and the converted value C, the processing of step S314 corresponds to an example of calculation using converted values respectively corresponding to a plurality of keys. Further, in the example illustrated in fig. 10, the processing result of step S314 corresponds to the authentication key.

For example, as illustrated in fig. 10, the information processing apparatus 100 generates an authentication key by performing calculation using a key, and then performing calculation using a synthesized value obtained by synthesizing converted values corresponding to the respective keys. The synthesized value used in the third generation example of the authentication key is a value obtained by synthesizing converted values obtained by converting using the conversion methods associated with the keys used in the respective calculations. Thus, in the third generation example of the authentication key illustrated in fig. 10, it is not necessary to share the secret of the conversion method between business operators in order to generate the authentication key. Thus, in the third generation example of the authentication key illustrated in fig. 10, "the authentication key is generated based on the device-specific information without sharing the secret of the conversion method between the business operators" is realized.

Further, the third generation example of the authentication key according to the first embodiment is not limited to the example illustrated in fig. 10.

In the third generation example of the authentication key, for example, similarly to the first generation example of the authentication key, the calculation using the key may be performed any number of times, which is two or more times. Further, in the third generation example of the authentication key, similarly to the first generation example of the authentication key, for example, in a case where the conversion method associated with one key indicates that the device-specific information is not converted, calculation using the conversion value corresponding to one key may not be performed.

(2-2) information processing method according to the second embodiment

(2-2-1) overview of information processing System 1000 to which information processing method according to the second embodiment is applied

For example, patent document 1 describes the following:

-generating a degenerate key using the plurality of region keys or service keys and authenticating using the degenerate key

Here, in the case where a degenerate key different from the area key and the service key is used in authentication like the technique disclosed in patent document 1, since it is sufficient to store only the degenerate key in the reader/writer, the security of the entire system is improved.

However, in the case of authentication using a degenerate key in accordance with the technique disclosed in patent document 1, services accessible in a device are limited to services corresponding to a service key used to generate the degenerate key. Further, in the case where authentication using a degenerate key according to the technique disclosed in patent document 1 is performed two or more times, only a service corresponding to the degenerate key used in the last authentication is accessible.

Further, in general, a service operator (reader/writer service operator) who develops and installs the reader/writer receives disclosure of the degenerate key from a manager (service provider) of the region key and the service key. Then, in the case where the reader/writer writes a plurality of services managed by a plurality of service providers, respectively, since the number of degenerate keys is two or more, authentication is performed two or more times.

Here, among NFC-enabled devices such as IC cards, there are devices that can write a plurality of services simultaneously in response to a single write command and have a feature that can guarantee atomicity of processing. However, in the conventional technique, when a plurality of degenerate keys are generated and authentication is performed a plurality of times, writing having atomicity cannot be performed.

In this regard, the information processing apparatus 100 to which the information processing method according to the second embodiment is applied generates a synthesized degenerate key (second degenerate key, hereinafter referred to as "re-degenerate key") obtained by synthesizing a plurality of degenerate keys (first degenerate key) into one degenerate key. Further, the information processing apparatus 100 performs authentication processing using the re-degenerate key as an authentication key.

Since the re-degenerate key is a key in which a plurality of degenerate keys are synthesized, authentication using the re-degenerate key corresponds to "authentication using a degenerate key of a synthesis source is performed a plurality of times".

Then, when authentication using the re-degenerate key corresponding to the information processing method according to the second embodiment is performed, all services corresponding to the degenerate key of the synthetic source become accessible.

Further, since authentication using the re-degenerate key corresponds to "authentication using the degenerate key of the synthetic source is performed a plurality of times", writing having atomicity can be realized by a single authentication using the re-degenerate key.

Thus, according to the information processing apparatus 100 to which the information processing method according to the second embodiment is applied, it is possible to improve the convenience of authentication using an authentication key.

(2-2-2) processing corresponding to the information processing method in the information processing apparatus 100 according to the second embodiment

Next, an example of processing corresponding to the information processing method in the information processing apparatus 100 according to the second embodiment will be described.

The information processing apparatus 100 generates an authentication key to be used in the authentication process.

More specifically, the information processing apparatus 100 generates a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium. The first degenerate key is generated by sequentially performing encryption using respective keys on values as bases (such as random numbers), for example.

Here, the encryption schemes supported by the plurality of first degenerate keys may be the same as or different from each other. In other words, the plurality of encryption schemes supported by the plurality of first degenerate keys may include a plurality of encryption schemes.

Then, the information processing apparatus 100 generates a re-degenerate key (second degenerate key) obtained by synthesizing the generated plurality of first degenerate keys as an authentication key. For example, the re-degenerate key is generated by performing encryption using a plurality of first degenerate keys. Further, the process related to the generation of the re-degenerate key is not limited to the above-described example, and any reversible calculation process capable of synthesizing a plurality of first degenerate keys and obtaining one re-degenerate key may be used.

Fig. 11 is an explanatory diagram illustrating an example of generation of an authentication key corresponding to the information processing method according to the second embodiment.

The information processing apparatus 100 generates a degenerate key 1 (an example of a first degenerate key) by sequentially performing encryption using keys (the area key 1, the service key 2, and the service key 3 illustrated in fig. 11) assigned to the area 1 of the recording medium on a random number (an example of a value serving as a basis) (S400).

The information processing apparatus 100 generates a degenerate key 2 (another example of the first degenerate key) by sequentially performing encryption using keys (the area key 4, the service key 4, and the service key 6 illustrated in fig. 11) assigned to the area 4 of the recording medium on a random number (an example of a value serving as a basis) (S402).

The information processing apparatus 100 performs calculation using the degenerate key 1 generated in step S400 and the degenerate key 2 generated in step S402, and generates a re-degenerate key (second degenerate key) (S404). In the example illustrated in fig. 11, the re-degenerate key generated in the process of step S404 corresponds to an authentication key.

For example, as illustrated in fig. 11, the information processing apparatus 100 generates a plurality of first degenerate keys, and generates a re-degenerate key as an authentication key by synthesizing the generated plurality of first degenerate keys.

Further, the generation example of the authentication key according to the second embodiment is not limited to the example illustrated in fig. 11.

For example, the example illustrated in fig. 11 illustrates an example in which two first degenerate keys are generated, but the information processing apparatus 100 may generate three or more first degenerate keys and generate re-degenerate keys.

If a re-degenerate key (second degenerate key) is generated as the authentication key, the information processing apparatus 100 performs the authentication process using the re-degenerate key.

Further, it is to be understood that the information processing apparatus 100 may perform the authentication process using a separate key such as a region key or a service key as the authentication key, and perform the authentication process using the first degenerate key as the authentication key.

(2-3) information processing method according to the third embodiment

(2-3-1) overview of information processing System 1000 to which information processing method according to the third embodiment is applied

As described in the information processing method according to the second embodiment, in the case where authentication using a degenerate key related to the technique disclosed in patent document 1 is performed a plurality of times, only a service corresponding to the degenerate key used in the last authentication is accessible. Further, as described in the information processing method according to the second embodiment, in the case where authentication using a plurality of degenerate keys is performed a plurality of times in the related art, writing having atomicity cannot be performed.

In this regard, the information processing apparatus 100 to which the information processing method according to the third embodiment is applied controls processing relating to an executable service in the case of performing authentication processing using a degenerate key as an authentication key.

More specifically, for example, in the case where the authentication process is performed a plurality of times, the information processing apparatus 100 makes executable a process related to a service authenticated in any one authentication process.

Thus, in the case where authentication according to the information processing method according to the third embodiment is performed, even if authentication using a degenerate key is performed a plurality of times, all services corresponding to the degenerate key used in the plurality of times of authentication are accessible.

Further, since all services corresponding to the degenerate key used in the plurality of authentications are accessible, writing with atomicity can be realized.

Thus, the information processing apparatus 100 to which the information processing method according to the third embodiment is applied can improve the convenience of authentication using the authentication key.

(2-3-2) processing corresponding to the information processing method in the information processing apparatus 100 according to the third embodiment

Next, an example of processing corresponding to the information processing method in the information processing apparatus 100 according to the third embodiment will be described. The information processing apparatus 100 performs authentication processing using the degenerate key as an authentication key. Further, it is to be understood that the information processing apparatus 100 may perform authentication processing using a separate key such as an area key or a service key as an authentication key.

Further, the information processing apparatus 100 controls execution of processing related to a service authenticated in the authentication processing. For example, the information processing apparatus 100 controls execution of processing related to a service by changing an accessible service according to the authentication result.

For example, in the case where the authentication process is performed a plurality of times, the information processing apparatus 100 makes executable a process related to a service authenticated in any one authentication process.

Here, the encryption schemes supported by the degenerate key used in the authentication process performed a plurality of times may be the same as or different from each other. In other words, similar to the plurality of first degenerate keys according to the second embodiment, a plurality of encryption schemes may be included in the encryption scheme supported by the plurality of degenerate keys according to the third embodiment.

Fig. 12 is an explanatory diagram for describing processing corresponding to the information processing method according to the third embodiment.

The information processing apparatus 100 generates a degenerate key 1 by sequentially performing encryption using keys (area key 1, service key 2, and service key 3 illustrated in fig. 12) assigned to the area 1 of the recording medium for a random number (an example of a value serving as a base) (S500).

Subsequently, the information processing apparatus 100 performs authentication using the degenerate key 1 (S502). Since the degenerate key 1 is a degenerate key based on the service key 2 corresponding to the service 2 and the service key 3 corresponding to the service 3, the service 2 and the service 3 become accessible by the authentication using the degenerate key 1 in step S502.

The information processing apparatus 100 generates a degenerate key 2 by sequentially performing encryption using keys (the area key 4, the service key 5, and the service key 6 illustrated in fig. 12) assigned to the area 4 of the recording medium for a random number (an example of a value serving as a base) (S504).

Subsequently, the information processing apparatus 100 performs authentication using the degenerate key 2 (S506).

Here, since the degenerate key 2 is a degenerate key based on the service key 5 corresponding to the service 5 and the service key 6 corresponding to the service 6, the service 5 and the service 6 are services that become accessible by the authentication using the degenerate key 2 in step S506. Further, the service 2 and the service 3 become accessible by the authentication using the degenerate key 1 in step S502.

Then, in the example illustrated in fig. 12, in the case where authentication using the degenerate key 2 is performed in step S506, all services (service 2, service 3, service 5, and service 6) that become accessible by authentication using the degenerate key 1 and authentication using the degenerate key 2 become services accessible in the information processing apparatus 100.

For example, as illustrated in fig. 12, in the case where the authentication process is performed a plurality of times, the process related to the service authenticated in any one authentication process is executable in the information processing apparatus 100.

Further, the processing corresponding to the information processing method according to the third embodiment is not limited to the above-described example.

For example, in the case where the authentication process is performed a plurality of times, the information processing apparatus 100 may change the service-related process to be made executable based on the parameter of the command acquired from the external apparatus before performing the authentication process.

Specifically, the information processing apparatus 100 changes the service-related process to be made executable to "a process related to a service authenticated in any one authentication process" as in the example illustrated in fig. 12, or "a process related to a service authenticated in an authentication process performed most recently" as in the case of using the related art, based on the parameter of the command.

In other words, in the information processing system 1000 to which the information processing method according to the third embodiment is applied, at the time of authentication, whether to add or replace an accessible service can be specified by a command parameter.

(2-4) information processing method according to other embodiment

The processing corresponding to the information processing method according to the present embodiment is not limited to the processing corresponding to the information processing method according to the first to third embodiments.

For example, the process corresponding to the information processing method according to the present embodiment may be a process obtained by combining two or more processes from among the processes according to the information processing methods of the first to third embodiments.

(procedure according to the present example)

When a program that causes a computer system to function as the information processing apparatus according to the present embodiment (for example, a program that can realize some or all of the functions of the processing unit 110 that performs processing corresponding to the information processing method according to the first embodiment, the functions of the processing unit 110 that performs processing corresponding to the information processing method according to the second embodiment, and the functions of the processing unit 110 that performs processing corresponding to the information processing method according to the third embodiment) is executed by a processor or the like in the computer system, the convenience of authentication using an authentication key can be improved. Here, a single computer or a plurality of computers may be used as the computer system according to the present embodiment. A series of processing is performed by the computer system according to the present embodiment.

Further, when a program that causes the computer system to function as the information processing apparatus according to the present embodiment is executed by a processor or the like in the computer system, the effects obtained by the processing corresponding to the information processing method according to the above-described respective embodiments can be obtained.

It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations, and variations may occur depending on design requirements and other factors insofar as they are within the scope of the appended claims or the equivalents thereof.

For example, an example (computer program) in which a program that causes a computer system to function as the information processing apparatus according to the present embodiment is provided has been described above, but in the present embodiment, a recording medium in which the program is stored may be provided together.

The above-described configuration indicates an example of the present embodiment, and it naturally belongs to the technical scope of the present disclosure.

Further, the effects described in the present specification are merely illustrative or exemplary effects, and are not restrictive. That is, other effects that are obvious to those skilled in the art from the description of the present specification may be achieved according to the technology of the present disclosure in addition to or instead of the above-described effects.

In addition, the present technology may also be configured as follows.

(1) An information processing apparatus comprising:

a processing unit configured to perform calculation using keys assigned to a plurality of areas of a recording medium and generate an authentication key,

wherein the processing unit generates the authentication key by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting the device-specific information using a conversion method associated with the key used in the calculation.

(2) The information processing apparatus according to (1), wherein the processing unit performs the calculation using the conversion value corresponding to the key used in the calculation, each time the calculation using the key is performed.

(3) The information processing apparatus according to (1), wherein the processing unit performs calculation using a conversion value corresponding to the key after performing calculation using the key.

(4) The information processing apparatus according to (1), wherein the processing unit performs calculation using a synthesized value obtained by synthesizing a converted value corresponding to the key, after performing calculation using the key.

(5) The information processing apparatus according to any one of (1) to (4), wherein the processing unit specifies a conversion method associated with each key based on the setting information associated with the area.

(6) The information processing apparatus according to any one of (1) to (5),

wherein the conversion method includes not converting device-specific information, an

In a case where the conversion method associated with one key indicates that the device-specific information is not converted, the processing unit does not perform calculation using the conversion value corresponding to the one key.

(7) An information processing apparatus comprising:

a processing unit configured to generate an authentication key used in an authentication process and perform the authentication process using the generated authentication key,

wherein the processing unit

A plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium are generated,

generating a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys, and

the authentication process is performed using the second degenerate key as an authentication key.

(8) The information processing apparatus according to (7), wherein in the processing unit, encryption schemes supported by the plurality of first degenerate keys are identical to each other.

(9) The information processing apparatus according to (7), wherein in the processing unit, the encryption schemes supported by the plurality of first degenerate keys include a plurality of encryption schemes.

(10) An information processing apparatus comprising:

a processing unit configured to perform an authentication process using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of a recording medium, and to control execution of a process related to a service authenticated in the authentication process,

wherein, in a case where the authentication processing is performed a plurality of times, the processing unit makes executable a process related to a service authenticated in any one authentication processing.

(11) The information processing apparatus according to (10), wherein, in a case where the authentication process is performed a plurality of times, the processing unit changes the service-related process to be made executable based on a parameter of a command acquired from the external apparatus before the authentication process is performed.

(12) The information processing apparatus according to (11), wherein the processing unit changes the service-related process to be made executable to a process related to the service authenticated in any one of the authentication processes, or a process related to the service authenticated in the authentication process performed most recently, based on the parameter of the command.

(13) An information processing method performed by an information processing apparatus, comprising:

performing calculation using keys assigned to a plurality of areas of the recording medium, and generating an authentication key,

wherein in the generation of the authentication key, the authentication key is generated by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting the device-specific information using a conversion method associated with the key used in the calculation.

(14) An information processing method performed by an information processing apparatus, comprising:

generating an authentication key used in the authentication process; and

the authentication process is performed using the generated authentication key,

wherein, in the generation of the authentication key,

generating a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium, and

generating a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys, and

when performing the authentication process, the authentication process is performed using the second degenerate key as the authentication key.

(15) An information processing method performed by an information processing apparatus, comprising:

performing authentication processing using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of the recording medium; and

controls execution of processes related to the service authenticated in the authentication process,

when the authentication process is performed a plurality of times, the execution control makes executable a process related to a service authenticated in any one authentication process.

(16) A program that causes a computer to implement:

a function of performing calculation using keys assigned to a plurality of areas of the recording medium, and generating an authentication key,

wherein the function of generating the authentication key includes generating the authentication key by performing calculation using a conversion value corresponding to the key, the conversion value being obtained by converting the device-specific information using a conversion method associated with the key used in the calculation.

(17) A program that causes a computer to implement:

a function of generating an authentication key used in the authentication process; and

a function of performing an authentication process using the generated authentication key,

wherein the generating function comprises

Generating a plurality of first degenerate keys obtained by synthesizing a plurality of keys assigned to areas of the recording medium, and

generating a second degenerate key obtained by synthesizing the generated plurality of first degenerate keys, and,

the function of performing the authentication process includes performing the authentication process using the second degenerate key as an authentication key.

(18) A program that causes a computer to implement:

a function of performing authentication processing using, as an authentication key, a degenerate key obtained by synthesizing a plurality of keys assigned to areas of the recording medium; and

a function of controlling execution of a process related to a service authenticated in the authentication process,

wherein, in the case where the authentication process is performed a plurality of times, the function of controlling the execution includes making executable a process related to a service authenticated in any one of the authentication processes.

List of reference numerals

100 information processing apparatus

200 reader/writer

300 server

102 first communication unit

104 second communication unit

106 control unit

110 processing unit

1000 information processing system