System and method for authentication, and device and method for authentication

Abstract

In authentication using a plurality of cipher keys, the authentication time is shortened. In the case that an encipher key to encipher key are required to take an access to each area out of the area to area in a memory of an IC card, a plurality of areas to have an access is informed to the IC card from a reader writer, a plurality of cipher keys corresponding to these areas (for example, cipher key 1, cipher key 2, and cipher key 4 ) is read out, and reduction processing section generates one reduction key from these cipher keys. A random number which is generated from a random number generation section of the reader writer is transferred to the IC card, and an encipherment section enciphers the random number using the reduction key. The reader writer receives the enciphered random number from the IC card, and deciphers it using the reduction key, and judges the IC card to be proper if the deciphered random number is equal to the generated random number.

1. An authentication system for performing authentication processing between a first device and a second device, said first device comprising:
 first memory means for storing a plurality of data areas and a first plurality of keys, wherein each of said first plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 first generation means for generating a first single authentication key from two or more of the first plurality of keys stored in said first memory means, wherein said first single authentication key indicates access to two or more corresponding of said plurality of data areas; and  
 first communication means for communicating said first single authentication key with said second device, and  
 said second device comprising: 
 second memory means for storing a second plurality of keys equivalent to said first plurality of keys;  
 second generation means for generating a second single authentication key from two or more of the second plurality of keys stored in said second memory means; and  
 second communication means for communicating said second single authentication key with said first device,  
 wherein one of said first device and said second device further comprises encipherment means for enciphering information using a corresponding one of said first single authentication key and said second single authentication key, and  
 wherein another of said first device and said second device further comprises decipherment means for deciphering said information enciphered by said encipherment means using another corresponding one of said first single authentication key and said second single authentication key.  
 
 
     
     
       2. An authentication system according to  claim 1 , wherein:
 said one of said first device and said second device further comprises notification means for notifying, to said another of said first device and said second device, information required to generate said corresponding one of said first single authentication key and said second single authentication key, and  
 said another of said first device and said second device generates said another corresponding one of said first single authentication key and said second single authentication key corresponding to the information notified by said notification means.  
 
     
     
       3. An authentication system according to  claim 1 , wherein:
 at least one of said first device and said second device further comprises a random number generation means for generating a random number,  
 said encipherment means enciphers said random number generated by said random number generation means, and  
 said decipherment means deciphers said random number enciphered by said encipherment means.  
 
     
     
       4. An authentication method for performing authentication processing between a first device and a second device, the method in said first device comprising:
 a first memory step of storing a plurality of data areas and a first plurality of keys, wherein each of said first plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 a first generation step of generating a first single authentication key from two or more of the first plurality of keys stored in said first memory means, wherein said first single authentication key indicates access to two or more corresponding of said plurality of data areas; and  
 a first communication step of communicating said first single authentication key with said second device, and  
 the method in said second device comprising: 
 a second memory step of storing a second plurality of keys equivalent to said first plurality of keys;  
 second generation step of generating a second single authentication key from two or more of the second plurality of keys stored in said second memory step; and  
 a second communication step of communicating said second single authentication key with said first device,  
 wherein one of said first device and said second device further performs processing in an encipherment step of enciphering information using a corresponding one of said first single authentication key and said second single authentication key, and  
 wherein another of said first device and said second device further performs processing in a decipherment step of deciphering said information enciphered in said encipherment step using another corresponding one of said first single authentication key and said second single authentication key.  
 
 
     
     
       5. An authentication device for performing authentication processing with another device, said authentication device comprising:
 communication means for communicating a first single authentication key with said another device;  
 memory means for storing a first plurality of keys;  
 generation means for generating said first single authentication key from two or more of said first plurality of keys stored in said memory means;  
 notification means for notifying, to said another device, information required to generate a second single authentication key from two or more of a second plurality of keys stored in said another device and data to be enciphered using said second single authentication key, wherein said second plurality of keys is equivalent to said first plurality of keys; and  
 decipherment means for decoding the enciphered data using said first single authentication key.  
 
     
     
       6. An authentication device according to  claim 5 , wherein said notification means notifies a random number as said data to be enciphered. 
     
     
       7. An authentication method for performing authentication processing between an authentication device and another device, comprising:
 a communication step of communicating a first single authentication key with said another device;  
 a memory step of storing a first plurality of keys;  
 a generation step of generating said first single authentication key from two or more of said first plurality of keys stored in said memory step;  
 a notification step of notifying, to said another device, information required to generate a second single authentication key from two or more of a second plurality of keys stored in said another device and data to be enciphered using second single authentication key, wherein said second plurality of keys is equivalent to said first plurality of keys; and  
 a decipherment step of deciphering the enciphered data using said first single authentication key.  
 
     
     
       8. An authentication device for performing authentication processing with another device, said authentication device comprising:
 communication means for communicating a single authentication key with said another device;  
 memory means for storing a plurality of data areas and a plurality of keys, wherein each of said plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 generation means for generating said single authentication key from two or more of the plurality of keys stored in said memory means based on information notified by said another device, wherein said single authentication key indicates access to two or more corresponding of said plurality of data areas; and  
 an encipherment means for enciphering the information notified by said another device using said single authentication key.  
 
     
     
       9. An authentication method for performing authentication processing between an authentication device and another device, comprising:
 a communication step of communicating a single authentication key with said another device;  
 a memory step of storing a first plurality of data areas and a plurality of keys, wherein each of said plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 a generation step of generating said single authentication key from two or more of the plurality of keys stored in said memory step based on information notified by said another device, wherein said single authentication key indicates access to two or more corresponding of said plurality of data areas; and  
 an encipherment step of enciphering the information notified by said another device using said single authentication key.  
 
     
     
       10. An authentication system for performing authentication processing between a first device and a second device, said first device comprising:
 first memory means for storing a first authentication key, a first common data and a first plurality of keys, wherein each of said first plurality of keys corresponds to said first common data combined with a respective one of a second plurality of keys;  
 first generation means for generating a first single authentication key from said first authentication key and a corresponding one of said first plurality of keys;  
 first notification means for notifying information required for said second device to generate a second single authentication key corresponding to said first single authentication key; and  
 first communication means for communicating said first single authentication key with said second device, and  
 said second device comprising: 
 second memory means for storing a plurality of data areas, said second plurality of keys and a second common data equivalent to said first common data, wherein each of said second plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 second generation means for generating said second single authentication key from the notified information, two or more of said second plurality of keys, and said common data; and  
 second communication means for communicating said second single authentication key with said first device; and  
 wherein one of said first device and said second device further comprises encipherment means for enciphering data using a corresponding one of said first single authentication key and said second single authentication key, and  
 wherein another of said first device and said second device further comprises decipherment means for deciphering the data enciphered by said encipherment means using another corresponding one of said first single authentication key and said second single authentication key.  
 
 
     
     
       11. An authentication system according to  claim 10 , wherein:
 said another of said first device and said second device further comprises second encipherment means for enciphering second data using said another corresponding one of said first single authentication key and said second single authentication key;  
 said one of said first device and said second device further comprises second decipherment means for deciphering the enciphered second data using said corresponding one of said first single authentication key and said second single authentication key;  
 said first device further comprises random number generation means for generating a random number;  
 said encipherment means enciphers said random number using said corresponding one of said first single authentication key and said second single authentication key;  
 said decipherment means deciphers the enciphered random number using said another corresponding one of said first single authentication key and said second single authentication key;  
 said second encipherment means enciphers the deciphered random number using said another corresponding one of said first single authentication key and said second single authentication key; and  
 said second decipherment means deciphers the enciphered deciphered random number using said corresponding one of said first single authentication key and said second single authentication key.  
 
     
     
       12. An authentication system according to  claim 10 , wherein:
 the one of said first device and said second device receives from the another device of said first device and said second device a device identification number specific to the another device of said first device and said second device,  
 the another of said first device and said second device stores said device identification number in a corresponding one of said first memory means and said second memory means, and  
 said first generation means and said second generation means use said device identification number for generating a respective one of said first single authentication key and said second single authentication key.  
 
     
     
       13. An authentication system according to  claim 10 , wherein:
 said first memory means further stores a first verification value;  
 said second memory means further stores a second verification value having a value equivalent to said first verification value;  
 said first generation means further generates a replacement key and a verification key, wherein said replacement key corresponds to one of said first plurality of keys that is to be replaced, and wherein said replacement key, said verification key and said first verification value are related;  
 said first device further comprises said encipherment means, wherein said encipherment means further enciphers first data and second data using said one of said first plurality of keys that is to be replaced, wherein said first data corresponds to said replacement key and said second data corresponds to said verification key;  
 said first communication means further communicates the enciphered first data and the enciphered second data with said second device;  
 said second device further comprises said decipherment means, wherein said decipherment means further deciphers the enciphered first data and the enciphered second data using a corresponding one of said second plurality of keys and in accordance therewith generates a deciphered replacement key and a deciphered verification key; and  
 said second device further comprises control means for verifying that said deciphered replacement key, said deciphered verification key, and said second verification value are related, and in accordance therewith replacing said corresponding one of said second plurality of keys with said deciphered replacement key.  
 
     
     
       14. An authentication method for performing authentication processing between a first device and a second device, the method in said first device comprising:
 a first memory step of storing a first authentication key, a first common data and a first plurality of keys, wherein each of said first plurality of keys corresponds to said first common data combined with a respective one of a second plurality of keys;  
 a first generation step generating a first single authentication key from said first authentication key and a corresponding one of said first plurality of keys;  
 a first information step of notifying information required for said second device to generate a second single authentication key corresponding to said first single authentication key; and  
 a first communication step of communicating said first single authentication key with said second device; and  
 the method in said second device comprising: 
 a second memory step of storing a plurality of data areas, said second plurality of keys and a second common data equivalent to said first common data, wherein each of said second plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 a second generation step of generating said second single authentication key from the notified information, two or more of said second plurality of keys, and said common data; and  
 a second communication step of communicating said second single authentication key with said first device, and  
 wherein one of said first device and said second device further performs an encipherment step of enciphering data using a corresponding one of said first single authentication key and said second single authentication key, and  
 wherein another of said first device and said second device further performs a decipherment step of deciphering the data enciphered in said encipherment step using another corresponding one of said first single authentication key and said second single authentication key.  
 
 
     
     
       15. An authentication device for performing authentication processing with a second device comprising:
 memory means for storing a first authentication key, a first common data and a first plurality of keys, wherein each of said first plurality of keys corresponds to said first common data combined with a respective one of a second plurality of keys;  
 generation means for generating a first single authentication key from said first authentication key and a corresponding one of said first plurality of keys;  
 notification means for notifying information required for said second device to generate a second single authentication key corresponding to said first single authentication key;  
 communication means for communicating said first single authentication key with said second device; and  
 encipherment means for enciphering data using said first single authentication key.  
 
     
     
       16. An authentication device according to  claim 15 , wherein said generation means uses a device identification number specific to said second device for generating said first single authentication key. 
     
     
       17. An authentication device according to  claim 15 , wherein:
 said memory means further stores a first verification value;  
 said generation means further generates a replacement key and a verification key, wherein said replacement key corresponds to one of said first plurality of keys that is to be replaced, and wherein said replacement key, said verification key and said first verification value are related;  
 said encipherment means further enciphers first data and second data using said one of said first plurality of keys that is to be replaced, wherein said first data corresponds to said replacement key and said second data corresponds to said verification key; and  
 said communication means further communicates the enciphered first data and the enciphered second data with said second device.  
 
     
     
       18. An authentication method for performing authentication processing with a second device, the method comprising:
 a memory step of storing a first authentication key, a first common data and a first plurality of keys, wherein each of said first plurality of keys corresponds to said first common data combined with a respective one of a second plurality of keys;  
 a generation step of generating a first single authentication key from said first authentication key and a corresponding one of said first plurality of keys;  
 a notification step of notifying information required for said second device to generate a second single authentication key corresponding to said first single authentication key;  
 a communication step of communicating said first single authentication key with said second device; and  
 an encipherment step of enciphering data using said first single authentication key.  
 
     
     
       19. An authentication device for performing authentication processing with a second device, said authentication device comprising:
 memory means for storing a plurality of data areas, a plurality of keys and common data, wherein each of said plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 generation means for generating a first single authentication key from two or more of the plurality of keys and said common data, in accordance with information received from said second device, wherein said first single authentication key indicates access to two or more corresponding of said plurality of data areas;  
 communication means for communicating said first single authentication key with said second device; and  
 decipherment means for deciphering data using said first single authentication key, wherein said data was enciphered by said second device.  
 
     
     
       20. An authentication device according to  claim 19 , wherein said generation means uses a device identification number specific to said authentication device in addition to the information received from said second device. 
     
     
       21. An authentication device according to  claim 19 , wherein:
 said memory means further stores a verification value;  
 said decipherment means further deciphers an enciphered first data and an enciphered second data received from said second device using a corresponding one of said plurality of keys and said common data, and in accordance therewith generates a deciphered replacement key and a deciphered verification key; and  
 said authentication device further comprises control means for verifying that said deciphered replacement key, said deciphered verification key, and said verification value are related, and in accordance therewith replacing said corresponding one of said plurality of keys with said deciphered replacement key.  
 
     
     
       22. An authentication method for performing authentication processing with a second device, the method comprising:
 a memory step of storing a plurality of data areas, a plurality of keys and common data, wherein each of said plurality of keys indicates access to a corresponding one of said plurality of data areas;  
 a generation step of generating a first single authentication key from two or more of the plurality of keys and said common data, in accordance with information received from said second device, wherein said first single authentication key indicates access to two or more corresponding of said plurality of data areas;  
 a communication step of communicating said first single authentication key with said second device; and  
 a decipherment step of deciphering data using said first single authentication key, wherein said data was enciphered by said second device.  
 
     
     
       23. An authentication system for performing authentication processing between a first device and a second device,
   said first device comprising:      a first memory means for storing a plurality of data areas and a first plurality of keys, each of said data areas being accessible by a corresponding one of said first plurality of keys;        a first generation means for generating a first single authentication key from at least two of the first plurality of keys stored in said first memory means; and        a first communication means for communicating with said second device by notifying a first message generated via said first single authentication key; and          said second device comprising:      a second memory means for storing a second plurality of keys equivalent to said first plurality of keys;        a second generation means for generating a second single authentication key from at least two of the second plurality of keys stored in said second memory means; and        a second communication means for communicating with said first device by notifying a second message generated via said second single authentication key;          wherein one of said first and second devices further comprises an encipherment means for enciphering data using a corresponding one of said first single authentication key and said second single authentication key, and the other of said first and second devices further comprises a decipherment means for deciphering said data enciphered by said encipherment means using the other corresponding one of said first single authentication key and said second single authentication key.     
     
     
       24. An authentication system according to  claim 23 , wherein said one of said first and second communication means notifies information required to generate said corresponding one of said first single authentication key and said second single authentication key to the other of said first and second communication means, and the other of said first and second devices generates said corresponding one of said first single authentication key and said second single authentication key corresponding to the information notified. 
     
     
       25. An authentication system according to  claim 23 , wherein at least one of said first device and said second device further comprises a random number generation means for generating a random number, said encipherment means enciphering said random number generated by said random number generation means, and said decipherment means deciphering said random number enciphered by said encipherment means. 
     
     
       26. An authentication system according to  claim 23 , wherein said first message is an enciphered random number generated via said first single authentication key, and said second message is an enciphered random number generated via said second single authentication key. 
     
     
       27. An authentication system according to  claim 24 , wherein said information includes an order using at least two of said plurality of keys corresponding to one of said first single authentication key and said second single authentication key. 
     
     
       28. An authentication method for performing authentication processing between a first device storing a first plurality of keys and a second device storing a second plurality of keys equivalent to the first plurality of keys and a plurality of data areas, wherein each of said data areas is accessible by a corresponding one of the first plurality of keys, the method comprising the steps of:
   generating a first single authentication key from at least two of the first plurality of keys stored in a first memory of said first device;        sending a command to said second device, said command including a first random number and information;        receiving said command from said first device;        generating a second single authentication key from at least two of the second plurality of keys stored in a second memory of said second device based on said information;        enciphering said first random number using said second single authentication key in said second device to generate a second random number;        generating a third random number in said second device;        sending said enciphered second random number and said third random number to said first device;        deciphering said enciphered second random number using said first single authentication key; and        comparing said deciphered second random number and said first random number.     
     
     
       29. An authentication method according to  claim 28 , the method further comprising the steps of:
   enciphering said third random number using said first single authentication key in said first device to generate a fourth random number;        sending a command to said second device, said command including said fourth random number and information;        deciphering said fourth random number using said second single authentication key in said second device; and        comparing said deciphered fourth random number and said third random number.     
     
     
       30. An authentication method according to  claim 28 , wherein said information is an order of reduction of said second plurality of keys to generate said second single authentication key. 
     
     
       31. An authentication method for performing processing between a first device storing a first plurality of keys and a second device storing a second plurality of keys equivalent to the first plurality of keys and a plurality of data areas, wherein each of said data areas is accessible by a corresponding one of the first plurality of keys, the method comprising the steps of:
   generating a first single authentication key from at least two of a first plurality of keys stored in a first memory of said first device;        generating a first random number in said first device;        enciphering said first random number by using said first single authentication key;        sending a first command to said second device, said first command including said enciphered first random number and information;        generating a second single authentication key from at least two of a second plurality of keys stored in a second memory of said second device based on said information;        deciphering said enciphered first random number by using said second single authentication key;        enciphering said deciphered first random number by using said second single authentication key in said second device to generate a first response to said first command;        receiving a first response from said second device;        deciphering said first response by using said first single authentication key in said first device; and        comparing said deciphered first response and said first random number.     
     
     
       32. An authentication method according to  claim 31 , further comprising the steps of:
   generating a second random number in said second device;        enciphering said second random number to generate a second response in said second device;        receiving said second response from said second device;        deciphering said second response by using said first single authentication key;        enciphering said deciphered second response by using said first single authentication key to generate a second command in said first device;        sending said second command to said second device;        deciphering said second command in said second device; and        comparing said deciphered second command and said second random number.     
     
     
       33. An authentication device for performing authentication processing with another device, said authentication device comprising:
   a memory means for storing a first plurality of prescribed data, each of said first plurality of prescribed data being a first cipher key which indicates access to a corresponding data area in said another device;        a generation means for generating a first random number;        a generation means for generating a first single authentication key from at least two of said first plurality of prescribed data;        an encipherment means for enciphering said first random number using said first single authentication key and for deciphering enciphered data sent from said another device using said first single authentication key, said enciphered data being enciphered using a second single authentication key transmitted from said authentication device to generate said second single authentication key from at least two of a second plurality of prescribed data stored in said another device; and        a communication means for communicating with said another device.     
     
     
       34. An authentication device according to  claim 33 , wherein each of said second plurality of prescribed data is a second cipher key equivalent to a first plurality of keys. 
     
     
       35. An authentication device according to  claim 33 , wherein said first plurality of prescribed data includes individual data and a cipher key assigned to said authentication device, said individual data being generated by data combined with at least two cipher keys assigned to other providers. 
     
     
       36. An authentication device according to  claim 34 , wherein said second plurality of prescribed data includes data and a plurality of cipher keys, each of said plurality of cipher keys indicating access to a corresponding one data area. 
     
     
       37. An authentication device according to  claim 35 , wherein said encipherment means deciphers an enciphered second random number using said first single authentication key, and said enciphered second random number is enciphered using said second single authentication key. 
     
     
       38. An authentication device according to  claim 33 , wherein said communication means notifies information required to generate said second singe authentication key. 
     
     
       39. An authentication device according to  claim 38 , wherein said information is an order using said at least two of a second plurality of prescribed data. 
     
     
       40. An authentication device according to  claim 33 , wherein said first single authentication key is generated using an identification number specific to said another device by receiving said identification number from said another device. 
     
     
       41. An authentication device according to  claim 33 , wherein said another device is an IC card. 
     
     
       42. An authentication device for performing authentication processing with another device, comprising:
   a memory means for storing a first plurality of prescribed data including a first plurality of keys, each of which indicates access to a corresponding area;        a generating means for generating a first single authentication key from at least two of said first plurality of keys based on information notified from said another device; and        an encipherment means for enciphering a message to said another device using said first single authentication key.     
     
     
       43. An authentication device according to  claim 42 , wherein said first plurality of prescribed data includes common data. 
     
     
       44. An authentication device according to  claim 43 , wherein said encipherment means deciphers a message sent from said another device. 
     
     
       45. An authentication device according to  claim 43 , wherein said message is a random number. 
     
     
       46. A method for performing authentication processing via an authentication device, said processing occurring with another device, the method comprising the steps of:
   storing a first plurality of prescribed data in a memory means of the authentication device each of said first plurality of prescribed data being a first cipher key which indicates access to a corresponding data area in said another device;        generating a first random number via a generation means of said authentication device;        generating a first single authentication key from at least two of said first plurality of prescribed data via a further generation means of the authentication device;        enciphering said first random number, via an encipherment means of said authentication device, using said first single authentication key, and deciphering an enciphered data sent from said another device using said first single authentication key, said enciphered data being enciphered using a second single authentication key transmitted from said authentication device to generate said second single authentication key from at least two of a second plurality of prescribed data stored in said another device; and        communicating with said another device via a communication means.     
     
     
       47. A method for performing authentication processing according to  claim 46 , wherein each of said second plurality of prescribed data is a second cipher key equivalent to a first plurality of keys. 
     
     
       48. A method for performing authentication processing according to  claim 46 , wherein said first plurality of prescribed data includes individual data and a cipher key assigned to said authentication device, said individual data being generated by data combined with at least two of said cipher keys assigned to other providers. 
     
     
       49. A method for performing authentication processing according to  claim 47 , wherein said second plurality of prescribed data includes data and a plurality of cipher keys, each of said plurality of cipher keys indicating access to a corresponding single area. 
     
     
       50. A method for performing authentication processing according to  claim 48 , wherein said encipherment means deciphers an enciphered second random number using said first single authentication key, and said enciphered second random number is enciphered using said second single authentication key. 
     
     
       51. A method for performing authentication processing according to  claim 46 , wherein said communication means notifies information required to generate said second single authentication key. 
     
     
       52. A method for performing authentication processing according to  claim 51 , wherein said information is an order using said at least two of said second plurality of prescribed data. 
     
     
       53. A method for performing authentication processing according to  claim 46 , wherein said first single authentication key is generated using an identification number specific to said another device by receiving said identification number from said another device. 
     
     
       54. A method for performing authentication processing according to  claim 46 , wherein said another device is an IC card. 
     
     
       55. A method for performing authentication processing via an authentication device, said processing being performed with another device, the method comprising the steps of:
   storing a first plurality of prescribed data in a memory means of said authentication device, said first plurality of prescribed data including a first plurality of keys, each of which indicates access to a corresponding area;        generating a first single authentication key, via a generation means of said authentication device, from at least two of said first plurality of keys based on information notified from another device; and        enciphering a message to said another device, via a encipherment means of said authentication device, using said first single authentication key.     
     
     
       56. A method for performing authentication processing according to  claim 55 , wherein said first plurality of prescribed data includes common data. 
     
     
       57. A method for performing authentication processing according to  claim 56 , wherein said encipherment means deciphers a message sent from said another device. 
     
     
       58. A method for performing authentication processing according to  claim 56 , wherein said message is a random number. 
     
     
       59. A method for generating an authentication key for authenticating a plurality of data areas stored in a device, wherein each of the data areas is accessible by a cipher key, the method comprising the steps of:
   providing common data;        generating a first reduction key by combining said common data with a first cipher key for access to a first data area;        generating a second reduction key by combining said first reduction key with a second cipher key for access to a second data area; and        generating an authentication key by combining said second reduction key with a key assigned to an authentication device that authenticates said first and second data areas in said device.     
     
     
       60. A method for replacing a first key of a plurality of keys stored in a memory of a multi- application device for providing a plurality of services with a second key, wherein each of the services is provided by using at least one data area of the multi - application device, and said data area is accessible by a corresponding one of the plurality of keys, the method comprising the steps of:      receiving first and second data with an identification number which indicates a first key to be replaced, said first data being generated by enciphering a second key using said first key, and said second data being generated by enciphering a third key which has a relationship to the second key using said first key;        deciphering said first and second data using said first key;        determining whether said deciphered second data has the relationship to said third key; and        replacing said first key with said second key in accordance with the result of the determining step.