JP3390380B2 - Cryptographic processing method and system device - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic processing method for an authentication procedure in a communication network and a cryptographic processing system device used directly for implementing the method.

[0002]

2. Description of the Related Art In a cash card, authentication is performed by the identification information recorded on the card and the personal identification number entered by the user. However, as a safer authentication method, the encrypted information is recorded on the card so that the center information can be used at the time of use. An authentication method is known as a well-known technique in which the encrypted information is decrypted by the device and only when the encrypted information is matched with the collation information managed by the center device, the card is judged to be a valid card.

Although the security of the authentication system concerned depends on the strength of the encryption system, the encryption system may be broken due to the improvement of the calculation capability of the electronic computer. As a countermeasure against this, switching to a stronger encryption method is effective. By managing the information that identifies the encryption method used on the center device side and storing the update information encrypted with the new encryption method on the card side. Will be realized.

Switching of the cryptographic processing method can be realized by providing an expiration date on the card and issuing a card in which information encrypted by the new encryption processing method is recorded when the card is updated after the expiration date. Since the period is restricted to the valid period and it is not possible to switch immediately, there is a method of notifying the center device side of the information encrypted by the new encryption method at the time of use and writing it to the card.

[0005]

In the above system, it is necessary to match the encryption system identification information managed on the side of the center device with the encryption information stored on the card side, and inconsistency may occur due to communication interruption or the like. If it occurs, there is a problem that the encrypted information cannot be correctly decrypted on the side of the center device and the card cannot be used.

The main objects to be solved by the present invention are as follows. That is, the first object of the present invention is due to inconsistency between the encryption method identification information managed by the data processing center device and the encryption information stored on the information storage medium side even if the encryption method is changed. It is an object of the present invention to provide a cryptographic processing method and a system device capable of avoiding an unavailable state.

A second object of the present invention is to provide a cryptographic processing method and a system apparatus which enable centralized centralized management by a data processing center apparatus connected via a communication network.

A third object of the present invention is to provide a cryptographic processing method and a system apparatus capable of updating the encrypted information by the latest cryptosystem to the information storage medium.

Other objects of the present invention will be apparent from the description, drawings, and particularly the description of each claim.

[0010]

In order to solve the above-mentioned problems, the method of the present invention interrupts communication / notification / writing associated with the encryption method change from the center means to the information storage means inserted in the communication terminal providing the service. If it is not possible due to the above, the encryption method identification of the identification information of the inserted information storage means in the encryption method information management table storing the encryption method identification information / old encryption method identification information / verification information for each information storage means identification information A method for avoiding inconsistency between the information and the encrypted information stored in the inserted information storage means, which is based on the information storage means identification information received by the center means as collation processing of the encryption method. Then, the encryption method information management table is used to search for the encryption method identification information, and the encryption information received together with the information storage means identification information is used for the searched encryption method. The decryption is performed by the encryption method corresponding to the expression identification information, and the decryption result is compared with the corresponding collation information in the encryption method information management table to determine whether the result of the comparison is consistent or inconsistent. If they do not match, the received encryption information is decrypted by the old encryption method corresponding to the corresponding old encryption method identification information in the encryption method information management table as the verification processing of the old encryption method, When the result of the decryption is compared with the collation information, it is determined whether the result of the comparison is conformity or inconsistency, and the result of the contrast in the collation process of the encryption method or the collation process of the old encryption method is the conformity. In the update process to the latest encryption method, the encryption method information management table is updated with the encryption method identification information corresponding to the latest encryption method, and the matching encryption information concerned is updated. After the decryption result is encrypted by the latest encryption method, the encrypted information is notified to the information storage means and the writing is updated, whereby the communication from the center means to the communication terminal is interrupted. A characteristic configuration method is implemented that avoids the inconsistency in the matching process of the encryption method due to the above and implements the update process to the latest encryption method.

In solving the above problems, the device of the present invention connects a communication terminal that provides a service on the assumption that an information storage medium has been inserted, with an exchange, and from the communication terminal to the exchange, a public telephone line. A cryptographic processing system device comprising a communication network connected to each of the exchanges through the control line from the exchange to the data processing center device and connected to the communication terminal and the data processing center device connected via the communication network. The data processing center device uses the encryption method information management table to store a database storing encryption method identification information, old encryption method identification information, and collation information for each identification information of the information storage medium, and information storage received from the communication network. Based on the medium identification information, the encryption method information management table is used to search for the encryption method identification information, and the information storage medium identification information is shared. The received encryption information is decrypted by the encryption method corresponding to the retrieved encryption method identification information, and the comparison result of the encryption method that compares the decryption result with the corresponding matching information in the encryption method information management table, When the comparison in the matching process of the encryption method is inconsistent, the received encryption information is decrypted by the old encryption method corresponding to the corresponding old encryption method identification information in the encryption method information management table, The result of the decryption is compared with the collation information, and the comparison process of the old encryption method for determining whether the result of the comparison is matching or inconsistent, and the matching process of the encryption method or the matching process of the old encryption method. If the result of the comparison is a match, the encryption method information management table is updated with the encryption method identification information corresponding to the latest encryption method, and the matching Cryptographic information for performing the update process to the latest cryptographic method of writing and updating after encrypting the decryption result of the encrypted information by the latest cryptographic method and then notifying the encrypted storage information to the information storage medium. A characteristic configuration means of having a management unit is taken.

[0012] More specifically, in order to solve the problem, the present invention achieves the above-mentioned object by adopting the respective novel characteristic construction methods or means listed below.

The first feature of the method of the present invention is that when the notification / writing due to the encryption method change from the center means to the information storage means inserted in the communication terminal providing the service is not possible due to the communication interruption, Cryptographic method identification information of the inserted information storage apparatus identification information in the encryption method information management table that stores the encryption method identification information, the old encryption method identification information, and the collation information for each storage method identification information, and the inserted information A method for avoiding inconsistency with the encrypted information stored in the storage means, wherein the encryption method information management table is created based on the information storage means identification information received by the center means, as the encryption method collation processing. The encryption method identification information is retrieved by using the encryption information received together with the information storage means identification information and the encryption information corresponding to the retrieved encryption method identification information. Decryption is performed using an expression, the result of the decryption is compared with the corresponding collation information in the encryption method information management table, and it is determined whether the result of the comparison is consistent or inconsistent. As the verification processing of the old encryption method, the received encryption information is decrypted by the old encryption method corresponding to the corresponding old encryption method identification information in the encryption method information management table, and the result of the decryption is compared with the verification information. A control is performed and the result of that control is a match,
If the result of the comparison in the collation processing of the encryption method or the collation processing of the old encryption method is a match, it is determined whether there is inconsistency, as the update processing to the latest encryption method, the encryption method corresponding to the latest encryption method. The encryption method information management table is updated with the identification information, and the decryption result of the matched encrypted information is encrypted by the latest encryption method, and then the encrypted storage information is notified to the information storage means. By performing the writing and updating, it is possible to avoid the inconsistency in the collation processing of the encryption method due to the interruption of the communication from the center means to the communication terminal and to realize the update processing to the latest encryption method. It is in adopting the configuration of the cryptographic processing method.

A second feature of the method of the present invention is the adoption of a cryptographic processing method in which the information storage means in the first feature of the method of the present invention is a computer-readable / writable information storage medium.

A third feature of the method of the present invention resides in adoption of a configuration of a cryptographic processing method in which the information storage medium in the second feature of the method of the present invention is an IC card.

A first feature of the device of the present invention is that a communication terminal which provides a service on the assumption that an information storage medium is inserted is connected to an exchange and a public telephone line is passed from the communication terminal to the exchange. A cryptographic processing system device comprising a communication network connected to the data processing center device from the exchange through a control line, and a data processing center device connected to the communication terminal via the communication network. The processing center device uses the encryption method information management table to store a database storing encryption method identification information, old encryption method identification information, and collation information for each identification information of the information storage medium, and an information storage medium identification received from the communication network. Based on the information, the encryption method information management table is used to search for the encryption method identification information, and the encryption information received together with the information storage medium identification information is retrieved. A verification process of the encryption method that decrypts the encrypted information by the encryption method corresponding to the searched encryption method identification information, and compares the decryption result with the corresponding verification information of the encryption method information management table, and the encryption method. If the comparison in the collation processing of No. is inconsistent, the received encryption information is decrypted by the old encryption method corresponding to the corresponding old encryption method identification information in the encryption method information management table, and The result of the comparison is compared with the matching information, and the matching process of the old encryption method that determines whether the result is the match or mismatch and the matching process of the encryption method or the matching process of the old encryption method. If the result is a match, the encryption method information management table is updated with the encryption method identification information corresponding to the latest encryption method, and the matching encryption information is updated. And a cipher information management unit that performs an update process to the latest cipher system that writes and updates the information, after notifying the encrypted storage information to the information storage medium after enciphering the decryption result of The configuration of a cryptographic processing system device comprising:

A second feature of the device of the present invention is that the information storage medium in the first feature of the device of the present invention is an IC card.

A third feature of the device of the present invention is that the communication terminal in the first or second feature of the device of the present invention has a computer including a public telephone terminal, a mobile telephone terminal, a PHS, a personal computer, and an office computer. The configuration of the cryptographic processing system device, which is a terminal capable of communicating with other devices, is adopted.

As an example of the occurrence of a mismatch between the encryption method identification information managed by the data processing center device (means) and the encryption information stored on the IC card side, the information encrypted by the new encryption method is used. There is a writing failure in the IC card.

In this case, the IC card stores the encrypted information used at the previous use, and the encrypted information is notified when the IC card is used. On the data processing center device (means) side, the encrypted information notified from the IC card is decrypted based on the encryption method identification information.
Since the encryption methods are different, even if the decrypted result is compared with the verification information, they do not match.

Since the present invention adopts each of the above characteristic configurations, the data processing center device (means) re-encrypts the encryption information notified from the IC card based on the encryption method identification information before the encryption method change. Decrypt.

In this case, since the same encryption method is used,
The decryption result and the verification information match. The IC card is notified of the encrypted information encrypted by the latest encryption method, and I
The encrypted information is rewritten on the C card side. Thus, even if a mismatch occurs between the encryption method identification information managed by the data processing center device (means) and the encryption information stored on the IC card side, the unusable state can be avoided.

[0023]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings with reference to an apparatus example and a method example. In addition,
In this embodiment, a telephone IC card, a public telephone terminal, and a public telephone line will be described as examples of the information storage medium, the communication terminal, and the communication network, but the present invention is not limited to this.

(Device Example) FIG. 1 is a conceptual schematic block diagram showing the configuration of a cryptographic processing system device 1 for a prepaid telephone IC card α according to the present device example. The cryptographic processing system device 1 of the present device example shown in the figure is a device for managing the cryptographic method of the prepaid telephone IC card α. Data processing center device 2
Is connected to the exchange 4 by a control line 3 for transmitting and receiving control signals, and comprises an encryption information management section 2a and an encryption identification information correspondence table 2b which is a database.

The cryptographic information management unit 2a stores card identification information assigned to each prepaid telephone IC card α,
A correspondence table 2b of old and new encryption method identification information is stored. Prepaid telephone IC card α Available public telephone terminal 5
Is connected to the exchange 4 by a public telephone line 6.

(Example of Method) The procedure for carrying out this example of the method applied to the above example of the apparatus will be described with reference to the drawings. FIG. 2 is a flow chart for explaining the implementation procedure of this method example, and FIG. 3 is a cryptographic method information management table used in this method example, which shows card identification information assigned to each IC card and corresponding cryptographic method identification information. It is a figure explaining the structure of a correspondence table.

As shown in the figure, for example, a card identification ID which is identification information of the prepaid telephone IC card α,
The encryption method identification information may be stored in pairs. The format is not limited to the correspondence table in the above example as long as the encryption method identification information can be retrieved from the card identification information.

First, when the caller makes a call from the public telephone terminal 5 through the public telephone line 6, the exchange 4 notifies the data processing center device 2 of the card identification information and the encrypted information via the control line 3. .

Next, the cryptographic information management unit 2a of the data processing center device 2 receives a control signal from the exchange 4 via the control line 3. The encryption information management unit 2a uses the received control signal to identify the encryption method identification information for the card identification information, based on the received control signal.
The encryption method identification information associated with the IC card α is searched by indexing b (ST1).

Subsequently, when the encryption method identification information corresponding to the card identification information exists, the data processing center device 2
The encrypted information is decrypted by the currently used encryption method corresponding to the encryption method identification information, the decryption result is compared with the verification information (ST2), and it is determined whether they match (ST3).

When the decryption result matches the verification information (O
K), the encryption method identification information indicating the latest encryption method managed by the data processing center device 2 is compared with the encryption method identification information corresponding to the IC card α, and the encryption method identification information corresponding to the IC card α is determined. When it is older than the encryption method identification information indicating the latest encryption method, the decryption information is encrypted by the latest encryption method (ST4), and the encryption method identification information in the encryption method identification information correspondence table 2b is changed to the latest encryption method identification information. (ST5).

The data processing center device 2 notifies the exchange 4 of the latest encrypted information via the control line 3, and the exchange 4
Notifies the public telephone terminal 5 of the encrypted information through the public telephone line 6 (ST6), and the public telephone terminal 5 writes the new encrypted information in the IC card α. The next time the data is used, the updated encrypted information will be transferred to the data processing center device 2 in the same procedure as described above.
Is notified, the decryption and collation processing (ST2) is performed through the same procedure (ST1) as described above.

Next, a procedure for implementing the cryptographic processing system device 1 when a mismatch occurs will be described. In the same procedure as described above, the encryption processing system device 1 retrieves the encryption method identification information notified from the IC card α (ST1) to decrypt and verify the encrypted information (ST2). ), If there is a mismatch (NG),
An abnormality is detected in the decryption process or the collation process.

In this case (NG), the encryption method identification information correspondence table 2b managed by the encryption information management unit 2a is searched,
The previously used encryption method identification information is searched, and the same decryption as the above is performed by the encryption method identification information obtained by the search.
Collation processing is performed (ST7).

When it is determined that the result of the collation (ST8) coincides with the collation information (OK), the latest cryptosystem managed by the data processing center device 2 is the cryptosystem identification information corresponding to the IC card α. The procedure shifts to the procedure (ST4) of encrypting the decryption information by the encryption method identification information shown, and then proceeds to the next procedures ST5 and ST6, but the result of the collation determination (ST8) does not match the collation information. In the case (NG), the authentication procedure is immediately terminated.

Although the representative device examples and method examples of the present invention have been described above, the present invention is not necessarily limited to the means of the device examples and the method of the method examples. The present invention can be appropriately modified and implemented within a range in which the object of the present invention is achieved and the effects described later are obtained.

For example, the information storage medium may be any one that can be read and written by a computer, and the communication terminal may be a portable telephone terminal, PHS, personal computer, office computer, or the like, and a computer may be attached or built in for communication. The network and the communication network may be wired or wireless as long as they are all net-like transmission media including LAN, Internet, intranet, virtual private network, ISDN and the like.

[0038]

As described above, according to the present invention, inconsistency occurs between the encryption method identification information managed by the data processing center device and the encryption information stored on the information storage medium side. In this case, the service using the information storage medium can be provided while ensuring the security after performing the authentication by the encryption method used before, and the encrypted information of the information storage medium is updated to the latest each time. The advantage is obtained.

[Brief description of drawings]

FIG. 1 is a conceptual schematic block diagram of an apparatus example showing an embodiment of the present invention.

FIG. 2 is a flowchart of an example method showing the same as above.

FIG. 3 is a cryptographic identification information correspondence table used in the above method example.

[Explanation of symbols]

1 ... Cryptographic processing system device 2 ... Data processing center device 2a ... Cryptographic information management section 2b ... Cryptographic identification information correspondence table 3 ... Control line 4 ... Exchange 5 ... Public telephone terminal 6 ... Public telephone line α ... IC card

─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Takaho Shibata 2-3-1, Otemachi, Chiyoda-ku, Tokyo Nippon Telegraph and Telephone Corporation (72) Inventor Yuichi Suwa 2-3-1, Otemachi, Chiyoda-ku, Tokyo No. Nippon Telegraph and Telephone Corporation (72) Inventor Masaaki Naoi 2-3-1 Otemachi, Chiyoda-ku, Tokyo Inside Nippon Telegraph and Telephone Corporation (72) Inventor Akira Asami 2-3-1 Otemachi, Chiyoda-ku, Tokyo No. Nippon Telegraph and Telephone Corporation (56) Reference JP-A-3-62162 (JP, A) JP-A-6-133368 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) H04L 9/32 G09C 1/00 640 G06F 15/00 330

Claims (6)

(57) [Claims] 1. An encryption method for each information storage means identification information when notification / writing from the center means to the information storage means inserted in a communication terminal providing a service is not possible due to communication interruption. The encryption method identification information of the identification information of the inserted information storage means in the encryption method information management table storing the identification information, the old encryption method identification information, and the verification information, and the encryption stored in the inserted information storage means A method of avoiding inconsistency with the encrypted information, wherein the encryption method identification information is obtained by using the encryption method information management table based on the information storage means identification information received by the center means, as encryption method collation processing. The encrypted information that is retrieved and received together with the information storage unit identification information is decrypted by the encryption method corresponding to the retrieved encryption method identification information, The decryption result is compared with the matching information in the encryption method information management table, and the comparison result is
It is determined whether it is consistent or inconsistent, and if it is inconsistent, as the collation processing of the old encryption method, the received encryption information is corresponded to the corresponding old encryption method identification information in the encryption method information management table. The old encryption method is used to perform decryption, and the result of the decryption is compared with the collation information to determine whether the result is the match or the inconsistency. If the result of the comparison in the process is a match, as the update process to the latest encryption method, the encryption method information management table is updated with the encryption method identification information corresponding to the latest encryption method, and the matched encryption is performed. After the result of information decryption is encrypted by the latest encryption method, the encrypted information is notified to the information storage means, and the information is written and updated. Wherein implementing the process of updating to the latest encryption method, an encryption processing method, characterized in that while avoiding the verification process mismatch of the encryption scheme due to disruption of the serial communication to the communication terminal. 2. The cryptographic processing method according to claim 1, wherein the information storage means is a computer-readable / writable information storage medium. 3. The information storage medium, It is an IC card, The cryptographic processing method according to claim 2, wherein: 4. A communication terminal, which provides a service on the assumption that an information storage medium is inserted, and an exchange,
From the communication terminal through the public telephone line to the exchange, through the control line from the exchange to the data processing center device,
A cryptographic processing system device comprising a communication network connected to each and a data processing center device connected to the communication terminal via the communication network, wherein the data processing center device stores information by an encryption method information management table. A database that stores encryption method identification information, old encryption method identification information, and collation information for each medium identification information, and the encryption method information management table based on the information storage medium identification information received from the communication network. The encryption method identification information is searched, the encryption information received together with the information storage medium identification information is decrypted by the encryption method corresponding to the retrieved encryption method identification information, and the decryption result is stored in the encryption method information management table. There is a mismatch between the matching process of the encryption method that compares the matching information and the matching process of the matching encryption method. Case, the received encrypted information decodes the old encryption method corresponding to the old encryption method identification information of the in the encryption method information management table, performs control results per verification information of the decoding,
If the comparison result of the old encryption method that determines whether the result of the comparison is conformity or inconsistency and the comparison processing of the encryption method or the comparison process of the old encryption method is a match, the latest encryption method is used. The encryption method information management table is updated with the encryption method identification information corresponding to, and the decryption result of the matched encrypted information is encrypted by the latest encryption method, and then the encrypted encryption is performed on the information storage medium. A cryptographic processing system device, comprising: a cryptographic information management unit for notifying encrypted information and performing update processing to the latest cryptographic method for writing and updating. 5. The cryptographic processing system apparatus according to claim 4, wherein the information storage medium is an IC card. 6. The communication terminal according to claim 4, wherein the communication terminal is a terminal including a public telephone terminal, a mobile telephone terminal, a PHS, a personal computer, and an office computer, and having communication with the computer. Cryptographic processing system device.