JP7693137B2 - Device key operation system, device key operation method, and device key operation program - Google Patents

Description

The present disclosure relates to an equipment key operation system, a factory device, an equipment device, a key activation device, a user terminal device, an equipment key operation method, and an equipment key operation program.

To provide cloud services to IoT devices, it is necessary to securely connect the IoT devices to the cloud server. To do this, it is necessary to embed a device key into the IoT device, which identifies the IoT device as a legitimate device. IoT is an abbreviation for Internet of Things. There is a need to address the security risks that arise when embedding a device key into a device.

For example, there is a technology in which a cloud server uses a symmetric key or an asymmetric key to authenticate an IoT device between an IoT device and a cloud server, thereby achieving secure communication. To achieve such secure communication, the IoT device needs to have a device key A, and the cloud server needs to have the same device key A or a key B that pairs with device key A.
The operation of assigning a device key to an IoT device is generally performed in a manufacturing factory when the IoT device is manufactured. In addition, the process of transporting the IoT device from the manufacturing factory to the customer may involve multiple external companies. Under such circumstances, there is a high risk of the device key being stolen or leaked after the IoT device is shipped, and the cost of measures to prevent this is high.

Patent document 1 discloses a method of using a split encryption key to decrypt an authentication key required for communication between a user's IC card and a communication terminal. IC is an abbreviation for Integrated Circuit.

JP 2012-065123 A

With conventional methods, there is a risk that IoT devices will be stolen before being delivered from the factory to a legitimate user, and fall into the hands of an attacker.
Therefore, it is necessary to realize a mechanism that prevents unnecessary communication with the cloud server even if an IoT device is stolen, in other words, a mechanism that allows an attacker to enjoy no benefits with no risk.
Furthermore, even if key information is extracted from an IoT device, it is necessary to prevent communication with the cloud server from being established.

With the technology of Patent Document 1, as long as a user possesses the IC card information, the user can decrypt the authentication key even if he or she does not possess the IC card itself. Therefore, it is not possible to authenticate whether or not the user who sent the IC card information from the mobile terminal is the legitimate user who possesses the IC card. Therefore, if the IC card is stolen or the IC card information is leaked, there is a risk that an attacker may be able to decrypt the authentication key.

The present disclosure aims to reduce the risk of device key theft and leakage by dividing the device key into an initial key and an activation key element, and requiring requests from both the user terminal device and the IoT device to calculate the device key.

The present disclosure provides an apparatus key operation system that operates an apparatus key used to authenticate an information transmission apparatus manufactured in a factory, comprising:
a factory device used in the factory to generate the device key, and an initial key and an activation key for calculating the device key;
A device device mounted on the information transmission device;
a key activation device that manages the activation key;
a user terminal device used by a user of the information transmission device,
The factory equipment includes:
Transmitting a device identifier for identifying the information transmission device and the initial key to the device, and transmitting the device identifier and the activation key to the key activation device;
The key activation device
an activation permission flag indicating whether or not the activation of the activation key is permitted, and when an activation permission request for requesting activation of the activation key is received from the user terminal device, the activation permission flag is set to "permission" if the authentication of the user is successful, and when an activation key acquisition request for requesting acquisition of the activation key is received from the equipment device, the activation permission flag is referenced, and if the activation permission flag is "permission", the activation key is transmitted to the equipment device;
The device comprises:
The device key is calculated based on the initial key and the activation key received from the key activation device.

In the device key operation system according to the present disclosure, the device key is divided into an initial key and an activation key, and calculation of the device key requires requests from both the user terminal device and the device. Therefore, according to the device key operation system according to the present disclosure, the risk of device key theft and leakage can be reduced.

1 is a diagram showing a configuration example of an apparatus key operation system according to a first embodiment; 2 is a diagram showing an example of the functional configuration of each device in the device key operation system according to the first embodiment; 2 is a diagram showing an example of the hardware configuration of each device in the device key operation system according to the first embodiment; 4 is a sequence diagram showing an example of the operation of each device in the device key operation system according to the first embodiment. FIG. 5 is a schematic diagram showing steps S101 to S103 in FIG. 4; 5 is a schematic diagram showing steps S104 to S108 in FIG. 4; 4 is a sequence diagram showing an example of the operation of each device in the device key operation system according to the first embodiment. FIG. 8 is a schematic diagram showing steps S109 to S111 in FIG. 7; 8 is a schematic diagram showing steps S112 to S116 in FIG. 7; 8 is a schematic diagram showing steps S117 to S118 in FIG. 7; 8 is a schematic diagram showing steps S119 to S121 in FIG. 7; 4 is a sequence diagram showing an example of the operation of each device in the device key operation system according to the first embodiment. FIG. FIG. 13 is a schematic diagram showing step S122 in FIG. 12 . 13 is a schematic diagram showing steps S123 to S128 in FIG. 12 . FIG. 13 is a diagram showing an example of the hardware configuration of each device in the device key operation system according to a modification of the first embodiment.

The present embodiment will be described below with reference to the drawings. In each drawing, the same or corresponding parts are given the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawings mainly indicate the flow of data or the flow of processing.

Embodiment 1.
***Configuration Description***
FIG. 1 is a diagram showing an example of the configuration of an equipment key operation system 800 according to the present embodiment.
The device key operation system 800 is a system that operates a device key used for authenticating an information transmission device manufactured in a factory. In this embodiment, an IoT device will be used as an example of an information transmission device manufactured in a factory. The IoT device is a device that is connected to a network such as the Internet and transmits and receives information.
The equipment key operation system 800 includes a factory device 100 , an equipment device 200 , a key activation device 300 , an application device 400 , and a user terminal device 500 .
The factory device 100, the machine device 200, the key activation device 300, the application device 400, and the user terminal device 500 communicate with each other via a network such as the Internet.

FIG. 2 is a diagram showing an example of the functional configuration of each device in the device key operation system 800 according to the present embodiment.
In the following, the factory device 100, the device 200, the key activation device 300, the application device 400, and the user terminal device 500 may be referred to as each device of the device key operation system 800.

The factory device 100 is a computer used in a factory that manufactures IoT devices. The factory device 100 is installed in, for example, a factory that manufactures IoT devices.
The factory device 100 is used in a factory to generate an apparatus key 30, and an initial key 31 and an activation key 32 for calculating the apparatus key 30. The initial key 31 and the activation key 32 are generated so that the apparatus key 30 cannot be inferred from either one of them. Methods for generating the apparatus key 30, the initial key 31, and the activation key 32 will be described later.
The factory device 100 transmits a device identifier 20 for identifying an IoT device and an initial key 31 to the device 200 , and transmits the device identifier 20 and an activation key 32 to the key activation device 300 .
The factory device 100 includes, as functional elements, an equipment key generation unit 110, an activation key generation unit 120, and an initial key generation unit 130.

The device 200 is a computer installed in an IoT device. The device 200 manages an initial key associated with a device identifier that identifies the IoT device. In the following description, the device identifier is abbreviated to device ID. ID is an abbreviation for IDentifier.
The device 200 includes, as functional elements, an initial key management unit 210, an activation key request unit 220, an activation processing unit 230, and a device key storage unit 240.

The key activation device 300 is a computer used for providing an apparatus key management service in the apparatus key management system 800. For example, the key activation device 300 manages an activation key associated with an apparatus ID.
The key activation device 300 also includes an activation permission flag 321 associated with the device ID, and a status flag 322 associated with the device ID.
The key activation device 300 includes, as functional elements, an activation key management unit 310 and a flag management unit 320. The flag management unit 320 manages an activation permission flag 321 and a status flag 322.
The activation permission flag 321 is a flag indicating whether activation of an activation key is permitted. The activation permission flag 321 indicates whether activation of an activation key corresponding to a device ID is permitted. For example, the key activation device 300 has a correspondence table between activation keys corresponding to device IDs and the activation permission flags 321.
The status flag 322 is a flag indicating whether the activation key has been activated for the IoT device or not. For example, the key activation device 300 includes a correspondence table between the activation key corresponding to the device ID and the status flag 322.

The application device 400 is a computer that provides an application service to an IoT device. The application device 400 is also called an application server. The application device 400 is, for example, a cloud server.
The application device 400 includes, as functional elements, a device key management section 410 and a user management section 420 .
The key activation device 300 and the application device 400 may be mounted on the same device.

The user terminal device 500 is a terminal used by a user of an IoT device. The user terminal device 500 is a computer such as a smartphone, a tablet terminal, or a portable information processing device.
The user terminal device 500 includes an activation permission request unit 510 as a functional element.

FIG. 3 is a diagram showing an example of the hardware configuration of each device in the device key operation system 800 according to this embodiment.
For ease of explanation, the hardware of each device in the device key operation system 800 is denoted by a common reference symbol. However, it is self-evident that each device in the device key operation system 800 has its own hardware.

Each device in the device key operation system 800 is a computer. Each device in the device key operation system 800 includes a processor 910, as well as other hardware such as a storage device such as a memory 921 or an auxiliary storage device 922, an input/output interface 930, and a communication interface 950. The processor 910 is connected to the other hardware via a signal line 80 and controls the other hardware.

Each device of the device key operation system 800 has functional elements as described above. The functional elements of each device of the device key operation system 800 are realized, for example, by software.

The processor 910 is a device that executes an equipment key operation program. The equipment key operation program is a program that realizes the functions of each device in the equipment key operation system 800.
The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.
The auxiliary storage device 922 is a storage device that stores data. A specific example of the auxiliary storage device 922 is a HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, a CF, a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

The input/output interface 930 is an interface for connecting input/output devices. Specific examples of the input/output interface 930 are USB and HDMI (registered trademark) ports. USB is an abbreviation for Universal Serial Bus. HDMI (registered trademark) is an abbreviation for High-Definition Multimedia Interface.

The communication interface 950 is an interface for communicating with an external device. Specific examples of the communication interface 950 include an Ethernet (registered trademark) port, or a device that performs wireless communication.

The device key operation program is executed in each device of the device key operation system 800. The device key operation program is loaded into the processor 910 and executed by the processor 910. The memory 921 stores not only the device key operation program but also the OS. OS is an abbreviation for Operating System. The processor 910 executes the device key operation program while executing the OS. The device key operation program and the OS may be stored in the auxiliary storage device 922. The device key operation program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that a part or all of the device key operation program may be incorporated into the OS.

Each device of the device key operation system 800 may have multiple processors that replace the processor 910. These multiple processors share the execution of the device key operation program. Each processor is a device that executes the device key operation program in the same way as the processor 910.

Data, information, signal values and variable values used, processed or output by the device key operation program are stored in memory 921, auxiliary storage device 922, or a register or cache memory within processor 910.

The "part" of each part of each device of the device key operation system 800 may be read as a "circuit,""step,""procedure,""process," or "circuitry." The device key operation program causes a computer to execute each process in which the "part" of each part of each device of the device key operation system 800 is read as a "process." The "process" of each process in each device of the device key operation system 800 may be read as a "program,""programproduct,""computer-readable storage medium storing a program," or "computer-readable recording medium recording a program." The device key operation method is a method performed by each device of the device key operation system 800 executing an device key operation program.
The device key management program may be provided by being stored in a computer-readable recording medium. Also, the device key management program may be provided as a program product.

****Description of operation****

Next, the operation of each device in the device key operation system 800 will be described.
The operation procedure of each device in the device key operation system 800 corresponds to an device key operation method, and the program that realizes the operation of each device in the device key operation system 800 corresponds to an device key operation program.

FIG. 4 is a sequence diagram showing an example of the operation of each device in the device key operation system 800 according to the present embodiment.
FIG. 5 is a schematic diagram showing steps S101 to S103 in FIG.
FIG. 6 is a schematic diagram showing steps S104 to S108 in FIG.

<Processing in FIG. 5: Steps S101 to S103>
The factory device 100 generates a device key 30 indicating that the IoT device is a legitimate device, and an initial key 31 and an activation key 32 for calculating the device key 30. Then, the factory device 100 transmits a device ID for identifying the IoT device and the initial key 31 to the device 200. In addition, the factory device 100 transmits the device ID and the activation key 32 to the key activation device 300. Each of the initial key 31 and the activation key 32 is an element that does not cause any problem even if it is leaked alone.
Specifically, the following applies:

In step S101, the device key generation unit 110 of the factory device 100 generates a different device key 30 for each IoT device using a technique such as random number generation.
In step S102, the device key generation unit 110 sends the generated device key 30 and the device ID of the target IoT device to the application device 400 in association with each other.
In step S103, the device key management section 410 of the application device 400 stores in the storage device the device ID and the device key 30. For example, the device key management section 410 of the application device 400 stores in the storage device a correspondence table that associates the device ID with the device key 30.

<Processing in FIG. 6: Steps S104 to S108>
In step S104, the activation key generation unit 120 of the factory device 100 generates the activation key 32 by using the initial key 31, which is a fixed value, for the device key 30. As an example, a hash value is created from the result of computing the device key 30 and the initial key 31, and this is used as the activation key 32.
The initial key 31 and the activation key 32 may be generated from the device key 30 by other methods.

For example, the device key generation unit 110 may generate the device key 30 as a random number, and the activation key generation unit 120 may generate the activation key 32 as a random number. Then, the initial key generation unit 130 may generate the initial key 31 by encrypting the device key 30 with the activation key 32.
Also, for example, the device key generation unit 110 may generate the device key 30 as a random number, and the initial key generation unit 130 may generate the initial key 31 as a random number. Then, the activation key generation unit 120 may generate the activation key 32 by encrypting the device key 30 with the initial key 31.
Also, for example, the initial key generation unit 130 may generate the initial key 31 as a random number, and the activation key generation unit 120 may generate the activation key 32 as a random number. Then, the device key generation unit 110 may generate the device key 30 by encrypting the initial key 31 with the activation key 32. Here, the encryption process is encryption or hashing.

In step S105, the activation key generation unit 120 sends the generated activation key 32 and the device ID of the target IoT device to the key activation device 300 in association with each other.
In step S106, the activation key management unit 310 of the key activation device 300 stores in the storage device the device ID and the activation key 32. In addition, the flag management unit 320 sets the activation permission flag 321 corresponding to the device ID to "not possible" and sets the status flag 322 corresponding to the device ID to "not yet performed."

In step S107, the initial key generation unit 130 sends the generated initial key 31 to the device device 200 in association with the device ID of the target IoT device.
In step S108, the initial key management unit 210 of the device 200 stores the device ID and the initial key 31 in the storage device.

FIG. 7 is a sequence diagram showing an example of the operation of each device in the device key operation system 800 according to the present embodiment.
FIG. 8 is a schematic diagram showing steps S109 to S111 in FIG.
FIG. 9 is a schematic diagram showing steps S112 to S116 in FIG.
FIG. 10 is a schematic diagram showing steps S117 to S118 in FIG.
FIG. 11 is a schematic diagram showing steps S119 to S121 in FIG.

The key activation device 300 performs user authentication when it receives an activation permission request 33 requesting activation of the activation key 32 from the user terminal device 500. If the user authentication is successful, the key activation device 300 sets the activation permission flag 321 to "permitted."
Furthermore, when the key activation device 300 receives an activation key acquisition request 34 requesting acquisition of an activation key from the equipment device 200, the key activation device 300 refers to the activation permission flag 321. If the activation permission flag 321 is "permitted", the key activation device 300 transmits the activation key 32 to the equipment device 200.
Specifically, the following applies:

<Processing in FIG. 8: Steps S109 to S111>
The user terminal device 500 includes user information used for user authentication and a device ID in the activation permission request 33 and transmits it to the key activation device 300. This is a process in which a user of an IoT device performs user registration in the application device 400 using the user terminal device 500 such as a smartphone.

In step S109, the validation permission request unit 510 of the user terminal device 500 accepts the device ID input by the user, and user information such as the user's name and email address.
In step S110, the activation permission request unit 510 transmits an activation permission request 33 including the device ID and user information received from the user to the key activation device 300. The activation permission request 33 requests activation of the activation key 32 corresponding to the device ID.
In step S 111 , the key activation device 300 receives the activation permission request 33 .

<Processing in FIG. 9: Steps S112 to S116>
The key activation device 300 performs user authentication using the user information, and if the user authentication is successful, sets the activation permission flag 321 to "permitted."
The key activation device 300 checks the user information included in the activation permission request 33 against user information previously stored in the application device 400. If the user authentication is successful as a result of the check, the key activation device 300 rewrites the activation permission flag 321 corresponding to the device ID included in the activation permission request 33 to "Allowed".
Specifically, the following applies:

In step S 112 , the activation key management unit 310 transmits an authentication request for the user information included in the activation permission request 33 to the application device 400 .
In step S113, the user management unit 420 of the application device 400 compares the user information included in the validation permission request 33 with user information previously held therein.
In step S114, the user management unit 420 transmits the result of the inquiry to the key activation device 300 as an authentication response to the authentication request.
In step S115, the enabling key management unit 310 receives the authentication response.
If the user authentication is successful, in step S116, the activation key management unit 310 rewrites the activation permission flag 321 corresponding to the device ID included in the activation permission request 33 to "permitted." Although not shown, if the user authentication is unsuccessful, the activation key management unit 310 transmits an error notification to the user terminal device 500 indicating that the user authentication has failed.

<Processing in FIG. 10: Steps S117 to S118>
The equipment device 200 transmits the activation key acquisition request 34 including the equipment ID to the key activation device 300 .
Specifically, the following applies:

In step S117, the activation key request unit 220 of the device 200 transmits an activation key acquisition request 34 including the device ID to the key activation device 300. Note that the activation key request unit 220 may include device authentication information generated based on the initial key 31 in the activation key acquisition request 34.
In step S118, the key activation device 300 receives the activation key acquisition request 34.

<Processing in FIG. 11: Steps S119 to S121>
When the key activation device 300 receives the activation key acquisition request 34, it refers to the activation permission flag 321. The key activation device 300 transmits the activation key 32 to the equipment device 200 if the activation permission flag 321 is "permitted".
Specifically, the following applies:

In step S<b>119 , the activation key management unit 310 refers to the activation permission flag 321 corresponding to the device ID included in the activation key acquisition request 34 .
In step S120, if the activation permission flag 321 is "permitted", the activation key management unit 310 transmits the activation key 32 corresponding to the device ID to the equipment device 200. Although not shown, if the activation permission flag 321 is "not permitted", the activation key management unit 310 transmits an error notification to the equipment device 200 or the user terminal device 500 indicating that the activation key 32 cannot be transmitted to the equipment device 200.
In step S 121 , the equipment device 200 receives the activation key 32 .

FIG. 12 is a sequence diagram showing an example of the operation of each device in the device key operation system 800 according to the present embodiment.
FIG. 13 is a schematic diagram showing step S122 in FIG.
FIG. 14 is a schematic diagram showing steps S123 to S128 in FIG.

<Processing in FIG. 13: Step S122>
The equipment device 200 calculates the equipment key 30 based on the initial key 31 and the activation key 32 received from the key activation device 300 .
Specifically, the following applies:

In step S122, the activation processing unit 230 of the equipment 200 generates an equipment key from the received activation key 32 and the initial key 31 held in the storage device.
For example, the activation processing unit 230 calculates the device key by cryptographically processing (encrypting or hashing) the initial key 31 with the activation key 32. Alternatively, the activation processing unit 230 calculates the device key by decrypting the initial key 31 with the activation key 32. The method of calculating the device key depends on the methods of generating the device key, the initial key, and the activation key.
The validation processing unit 230 stores the calculated device key in a storage device.

<Processing in FIG. 14: Steps S123 to S128>
The device 200 transmits a device key authentication request 35 for requesting authentication as to whether the calculated device key is authentic to the application device 400. The device key authentication request 35 includes the calculated device key and the device ID.
The application device 400 authenticates whether the device key included in the device key authentication request 35 is authentic, based on the device ID and device key previously stored in the storage device.
Specifically, the following applies:

In step S123, the validation processing unit 230 of the device 200 transmits a device key authentication request 35 including the calculated device key and a device ID to the application device 400. The device key authentication request 35 is a request to inquire whether the calculated device key is genuine or not.
In step S 124 , the application device 400 receives the device key authentication request 35 .
In step S 125 , the device key management unit 410 of the application device 400 checks the device ID and device key stored in advance in the storage device against the device ID and device key included in the device key authentication request 35 .

If the device key included in the device key authentication request 35 is genuine, in step S126, the device key management unit 410 sends a device key authentication confirmation notification 36 to the key activation device 300 and the device device 200 to notify that the device key is genuine. The device key authentication confirmation notification 36 includes a device ID corresponding to the calculated device key. Although not shown, if the device key is not genuine, the device key management unit 410 sends a notification to the device device 200 or the user terminal device 500 that the device key included in the device key authentication request 35 is not genuine.

In step S127, the key activation device 300 receives the device key authentication confirmation notification 36.
In step S128, upon receiving the device key authentication confirmation notification 36, the flag management unit 320 of the key activation device 300 sets the activation permission flag 321 corresponding to the device ID to “not possible.” In addition, the flag management unit 320 sets the status flag 322 corresponding to the device ID to “implemented.”
Then, the key activation device 300 writes the user information sent in step S111 into the storage device of the application device 400 in association with the device ID.
Furthermore, the key activation device 300 may notify the user terminal device 500 that activation of the device key 30 has been completed, based on the user information corresponding to the device ID.

Once the above process has authenticated that the device key is genuine, communication between the equipment device 200 and the application device 400 becomes possible.

***Other configurations***
<Modification 1>
As a first variation of this embodiment, the key activation device 300 may determine whether the activation key acquisition request 34 is received within a certain time from the time when the activation permission request 33 is received. Then, the key activation device 300 proceeds with the process by treating only the activation key acquisition request 34 received within the certain time as a valid activation key acquisition request 34. If the key activation device 300 receives the activation key acquisition request 34 after the certain time has elapsed, it transmits an error notification to the equipment device 200 or the user terminal device 500. The error notification is displayed on the display device of the equipment device 200 or the display device of the user terminal device 500.
According to the first modification of the present embodiment, security in validating the device key is improved.

<Modification 2>
As a second modification of this embodiment, the application device 400 may store the expiration date of the device key together with the device ID and device key transmitted from the factory device 100 in a storage device.
When transmitting the device ID and device key to the application device 400, the factory device 100 also transmits the expiration date of the device key.
The application device 400 authenticates whether the calculated device key included in the device key authentication request 35 is genuine based on the device ID, device key, and expiration date stored in the storage device. Specifically, the application device 400 holds a correspondence table of device IDs, device keys, and expiration dates, and checks the expiration date when authenticating whether the device key is genuine.
According to the second modification of the present embodiment, the accuracy of verifying the device key is improved, and security is strengthened.

<Modification 3>
As a third modification of the present embodiment, a mode in which a device key of an IoT device is reissued will be described. Reissuing the device key of an IoT device is effective when the IoT device is transferred or used for other purposes.
The factory device 100 acquires an equipment key reissue request from the user terminal device 500, which requests the reissue of an equipment key for an IoT device corresponding to the equipment ID. When the factory device 100 acquires the equipment key reissue request, it transmits an expiration notification of the equipment key corresponding to the equipment ID to the equipment device 200 or the user terminal device 500. The factory device 100 manages an expiration flag. Then, the factory device 100 regenerates an equipment key and an activation key corresponding to the equipment ID. Here, the initial key is assumed to be a fixed value. The regeneration method is the same as the above-mentioned method of generating the equipment key and the activation key.
The application device 400 stores the device ID transmitted from the factory device 100 and the regenerated device key in a storage device.
The key activation device 300 stores in a storage device the device ID and the regenerated activation key transmitted from the factory device 100. Then, the key activation device 300 sets the status flag 322 of the regenerated activation key corresponding to the device ID from "performed" to "not performed."
Thereafter, the process of activating the activation key is carried out in the same manner as in the first embodiment described above.
According to the third modification of the present embodiment, the regenerated activation key can be used to perform the device key operation process in the same manner as in the first embodiment.

The device key reissue request may be transmitted from the user terminal device 500 to the key activation device 300 or the application device 400. Then, the key activation device 300 or the application device 400 that receives the device key reissue request makes a device key reissue request to the factory device 100. By making a device key reissue request from the user terminal device 500 to the key activation device 300 or the application device 400, user authentication can be performed by the key activation device 300 or the application device 400. In addition, at that time, the revocation flag is managed in the key activation device 300 or the application device 400.

In addition, the device key reissue request may be transmitted from the device 200 to the key activation device 300 or the application device 400. For example, when the device 200 is operated and initialized, communication with the key activation device 300 or the application device 400 can be performed, and the process of revoking and reissuing the device key can be simultaneously performed.

<Modification 4>
As a fourth modification of the present embodiment, a mode of performing a device key revocation process for an IoT device will be described. The device key revocation process for an IoT device can improve security when the IoT device is disposed of.
The key activation device 300 receives a device key revocation request for revoking the device key of an IoT device corresponding to a device ID from the user terminal device 500. Upon receiving the device key revocation request, the key activation device 300 sets a revocation flag corresponding to the device ID. The key activation device 300 also transmits a notification of revocation of the device key corresponding to the device ID to the device device 200 and the application device 400.
In this way, when the key activation device 300 manages the revocation of the device key, the key activation device 300 is provided with a revocation flag. The revocation flag is set with two pieces of information, for example, "expired" and "issued," and indicates whether the device key is usable.
According to the fourth modification of the present embodiment, security at the time of device disposal can be improved.

<Modification 5>
As a fifth variation of this embodiment, the user terminal device 500 transmits the activation permission request 33 to the key activation device 300 including information indicating that the communication is via the same network as the equipment device 200. For example, the user terminal device 500 includes information indicating that the communication is via the same LAN as the equipment device 200 in the activation permission request 33. When the key activation device 300 receives the activation key acquisition request 34 from the equipment device 200, it checks whether the communication is via the same LAN as the user terminal device 500. If the networks are different, an error notification is sent to the user terminal device 500 or the equipment device 200.
Variation 5 of this embodiment improves security in verifying whether an IoT device is owned by a user.

<Modification 6>
In this embodiment, the functions of each unit of each device in the device key operation system 800 are realized by software. As a modification, the functions of each device in the device key operation system 800 may be realized by hardware.
Specifically, each device of the device key operation system 800 includes an electronic circuit 909 instead of a processor 910 .

FIG. 15 is a diagram showing an example of the hardware configuration of each device in an apparatus key operation system 800 according to a modified example of the present embodiment.
The electronic circuit 909 is a dedicated electronic circuit for implementing the functions of each unit of each device in the device key operation system 800. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

The functions of each part of each device in the device key operation system 800 may be realized by a single electronic circuit, or may be distributed across multiple electronic circuits.

As another variation, some of the functions of each unit of each device of device key operation system 800 may be realized by electronic circuits, and the remaining functions may be realized by software. Also, some or all of the functions of each unit of each device of device key operation system 800 may be realized by firmware.

Each of the processors and electronic circuits is also called a processing circuitry. In other words, the functions of each device in the device key operation system 800 are realized by the processing circuitry.

***Description of Effects of This Embodiment***
In the device key operation system according to the present embodiment, the device key to be held by the IoT device is divided into an initial key and an activation key, which are elements that can be leaked without any problem when they are alone, and each is delivered via a different route. Then, only the initial key is held by the IoT device, and the activation key is held by the key activation device. Furthermore, it is possible to calculate the device key from the two parts, the initial key and the activation key, in response to requests from both the user terminal device used by the user of the IoT device and the device device mounted on the IoT device. Specifically, it is possible to restore the device key by activating the initial key with the activation key.

As described above, according to the device key management system of the present embodiment, the device key is divided into two elements and delivered via separate routes, thereby reducing the risk of theft and leakage during key delivery.
Furthermore, according to the device key operation system of the present embodiment, a mechanism is introduced in which a user requests activation of an activation key from a user terminal device, thereby reducing the risk of device keys being stolen. Furthermore, when an activation key is activated, a user authentication function (confirmation that the user owns an IoT device) is performed, thereby reducing the risk of IoT device theft and ensuring the safety of device keys for installed IoT devices.
Furthermore, according to the device key operation system of the present embodiment, it is possible to reduce the costs of measures against the risk of device key theft and leakage.

In the above-mentioned first embodiment, each unit of each device of the device key operation system 800 has been described as an independent functional block. However, the configuration of each device of the device key operation system 800 does not have to be the configuration as in the above-mentioned embodiment. The functional block of each device of the device key operation system 800 may have any configuration as long as it can realize the functions described in the above-mentioned embodiment. Furthermore, each device of the device key operation system 800 may not be a single device, but may be a system composed of multiple devices.
In addition, a plurality of parts of the first embodiment may be combined to be implemented. Alternatively, one part of this embodiment may be implemented. In addition, this embodiment may be combined in any manner as a whole or in part to be implemented.
That is, in the first embodiment, it is possible to freely combine parts of the embodiments, or to modify any of the components of the embodiments, or to omit any of the components of the embodiments.

Note that the above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, or the scope of use of the present disclosure. The above-described embodiments can be modified in various ways as necessary. For example, the procedures described using flow charts or sequence diagrams may be modified as appropriate.

20 device identifier, 30 device key, 31 initial key, 32 activation key, 33 activation permission request, 34 activation key acquisition request, 35 device key authentication request, 36 device key authentication confirmation notification, 100 factory device, 110 device key generation unit, 120 activation key generation unit, 130 initial key generation unit, 200 device device, 210 initial key management unit, 220 activation key request unit, 230 activation processing unit, 240 device key storage unit, 300 key activation device, 310 activation key management unit, 320 flag management unit, 321 activation permission flag, 322 status flag, 400 application device, 410 device key management unit, 420 user management unit, 500 user terminal device, 510 activation permission request unit, 800 device key operation system, 80 signal line, 909 electronic circuit, 910 processor, 921 Memory, 922 auxiliary storage device, 930 input/output interface, 950 communication interface.

Claims (16)

In a device key operation system that operates a device key used to authenticate an information transmission device manufactured in a factory,
a factory device used in the factory to generate the device key, and an initial key and an activation key for calculating the device key;
A device device mounted on the information transmission device;
a key activation device that manages the activation key;
a user terminal device used by a user of the information transmission device,
The factory equipment includes:
Transmitting a device identifier for identifying the information transmission device and the initial key to the device, and transmitting the device identifier and the activation key to the key activation device;
The key activation device
an activation permission flag indicating whether or not the activation of the activation key is permitted, and when an activation permission request for requesting activation of the activation key is received from the user terminal device, the activation permission flag is set to "permission" if the authentication of the user is successful, and when an activation key acquisition request for requesting acquisition of the activation key is received from the equipment device, the activation permission flag is referenced, and if the activation permission flag is "permission", the activation key is transmitted to the equipment device;
The device comprises:
an apparatus key operation system that calculates the apparatus key based on the initial key and the activation key received from the key activation device; The user terminal device
sending the activation permission request including user information used for authenticating the user and the device identifier to the key activation device;
The key activation device
performing authentication of the user using the user information, and setting the activation permission flag to "enabled" if the authentication of the user is successful;
The device comprises:
sending the activation key acquisition request including the device identifier to the key activation device;
The key activation device
2. The device key operation system according to claim 1, wherein when the activation key acquisition request is received, the activation permission flag is referenced, and if the activation permission flag indicates permission, the activation key is transmitted to the device. The factory equipment includes:
transmitting the device identifier and the device key to an application device that communicates with the information transmission device;
The application device includes:
storing the device identifier and the device key transmitted from the factory device in a storage device;
The device comprises:
sending to the application device an apparatus key authentication request for requesting authentication as to whether the calculated apparatus key is authentic, the apparatus key authentication request including the calculated apparatus key and the apparatus identifier;
The application device includes:
3. The device key operation system according to claim 1, further comprising: authenticating whether the calculated device key included in the device key authentication request is authentic, based on the device identifier and the device key stored in the storage device. The application device includes:
4. The device key operation system according to claim 3, further comprising: a device identifier and a device key transmitted from the factory device, together with an expiration date of the device key, stored in a storage device; and an authentication process for authenticating the calculated device key included in the device key authentication request based on the device identifier, the device key, and the expiration date stored in the storage device. The factory equipment includes:
3. The device key operation system according to claim 1, wherein the initial key is generated as a random number, the activation key is generated as a random number, and the device key is generated by encrypting the initial key with the activation key. The factory equipment includes:
3. The device key operation system according to claim 1, wherein the device key is generated as a random number, the activation key is generated as a random number, and the initial key is generated by encrypting the device key with the activation key. The device comprises:
The device key operation system according to claim 5 , further comprising: a device key management unit that calculates the device key by encrypting the initial key with the activation key. The device comprises:
The device key operation system according to claim 6 , further comprising: a device key management unit that calculates the device key by decrypting the initial key with the activation key. The key activation device
3. The device key operation system of claim 1, further comprising: determining whether the activation key acquisition request is received within a certain time from the time the activation permission request is received; and determining that the activation key acquisition request received within the certain time is a valid activation key acquisition request. The key activation device
4. The device key operation system of claim 3, further comprising a status flag indicating whether activation of the activation key has been performed or not for the information transmission device, and when the device identifier and the activation key are received from the factory device, the device identifier and the activation key are stored in a storage device, the activation permission flag corresponding to the device identifier is set to disabled, and the status flag corresponding to the device identifier is set to not performed. The application device includes:
transmitting an apparatus key authentication confirmation notification, which certifies that the calculated apparatus key is authentic, to the apparatus and the key validation device, the apparatus key authentication confirmation notification including the apparatus identifier;
The key activation device
The device key operation system according to claim 10 , wherein, when the device key authentication confirmation notification is received, the activation permission flag corresponding to the device identifier is set to "not valid," and the status flag corresponding to the device identifier is set to "already performed." The factory equipment includes:
when receiving a device key reissue request for requesting reissue of a device key for the information transmission device corresponding to the device identifier, transmitting an expiration notification of the device key corresponding to the device identifier to the device device, and regenerating a device key and an activation key corresponding to the device identifier;
The application device includes:
storing the device identifier and the regenerated device key transmitted from the factory device in a storage device;
The key activation device
The device key operation system of claim 11, wherein the device identifier and the regenerated activation key transmitted from the factory device are stored in a storage device, and the status flag of the regenerated activation key corresponding to the device identifier is set from "implemented" to "not implemented." The key activation device
The device key operation system of claim 11, wherein when a device key revocation request is received requesting the revocation of the device key of the information transmission device corresponding to the device identifier, the status flag corresponding to the device identifier is set to revoked, and a revocation notification of the device key corresponding to the device identifier is sent to the device device and the application device. The device key operation system according to claim 1 or 2, wherein the information transmission device is an IoT (Internet of Things) device. 1. A device key operation method for use in a device key operation system that operates a device key used to authenticate an information transmission device manufactured in a factory, comprising:
a factory device used in the factory generates the device key, an initial key for calculating the device key, and an activation key, transmits a device identifier for identifying the information transmission device and the initial key to a device device mounted on the information transmission device, and transmits the device identifier and the activation key to a key activation device that manages the activation key;
the key activation device has an activation permission flag indicating whether activation of the activation key is permitted, and when an activation permission request for requesting activation of the activation key is received from a user terminal device used by a user of the information transmission device, the key activation device authenticates the user, and sets the activation permission flag to "permission" if the authentication of the user is successful, and when an activation key acquisition request for requesting acquisition of the activation key is received from the device, the key activation device refers to the activation permission flag, and if the activation permission flag is "permission", transmits the activation key to the device;
The device calculates the device key based on the initial key and the activation key received from the key activation device. 2. A device key operation program used in a device key operation system that operates a device key used to authenticate an information transmission device manufactured in a factory, comprising:
generating the device key, an initial key for calculating the device key, and an activation key, transmitting a device identifier for identifying the information transmission device and the initial key to a device device mounted on the information transmission device, and transmitting the device identifier and the activation key to a key activation device that manages the activation key, on a computer that is a factory device used in the factory;
the key activation device includes an activation permission flag indicating whether activation of the activation key is permitted,
when receiving an activation permission request for requesting activation of the activation key from a user terminal device used by a user of the information transmission device, authenticating the user, and setting the activation permission flag to "permission" if the authentication of the user is successful, and when receiving an activation key acquisition request for requesting acquisition of the activation key from the device, referring to the activation permission flag, and causing a computer that is the key activation device to execute a process of transmitting the activation key to the device if the activation permission flag is "permission";
an apparatus key operation program that causes a computer that is the apparatus to execute a process of calculating the apparatus key based on the initial key and the activation key received from the key activation device;

Images