JP2021100227A - IoT KEY MANAGEMENT SYSTEM, SECURE DEVICE, IoT DEVICE, DEVICE MANAGEMENT APPARATUS, AND METHOD FOR CREATING PUBLIC KEY CERTIFICATE OF SECURE ELEMENT - Google Patents

Abstract

To allow, in applying for a public key certificate 27 of a secure element 2, a device management apparatus 4 to verify the correctness of a public key 23 for applying for the issuance of the public key certificate 27 to a CA 5.SOLUTION: In an IoT key management system 1 according to the present embodiment, a secure element 2 generates a secret key 22 and a public key 23 of an asymmetric cryptographic system, generates an authentication code 25 of a public key file 24 including at least the public key 23, and causes a device management apparatus 4 to verify the authentication code 25 of the public key file 24 to allow the device management apparatus 4 to verify the correctness of the public key 23 included in a CSR file 31a with a signature that is transmitted to a CA5.SELECTED DRAWING: Figure 5

Description

The present invention relates to the technical field of generating a public key certificate of a public key generated by a secure element embedded in an IoT device.

The 5th generation mobile communication system (commonly known as 5G), which will start operation in Japan from 2020, can connect more than 1 million mobile devices per square kilometer to one relay station at the same time, so the 5th generation mobile It is said that the IoT (Internet of Things) will spread rapidly with the start of operation of mobile communication systems.

Depending on the use of IoT such as payment, medical treatment or transportation, secure IoT operation is required. For secure IoT operations, it has become common to utilize PKI (public key infrastructure), which is based on a public key certificate with a digital signature of CA (Certification Authority). There is.

A secure element corresponding to PKI is incorporated in the IoT device used in IoT where secure operation is required. The secure element incorporated in the IoT device has functions related to PKI, such as a function of generating an asymmetric encryption key pair (private key and public key), a function of secretly storing the private key, and a function of outputting the public key. It also has a function to perform cryptographic operations using a private key or public key.

In PKI, a public key certificate of a secure element with a digital signature of CA or the like is required so that the communication partner of the IoT device can confirm the validity of the secure element incorporated in the IoT device. The format of the public key certificate is arbitrary, but for example, X.I. 509 defines the standard format of public key certificates.

As described in Patent Document 1, the general procedure for generating a public key certificate of a secure element is as follows.

Step 1) The secure element embedded in the IoT device generates the private key and public key of the asymmetric encryption method.

Step 2) The IoT device acquires the public key from the secure element, and the IoT device transmits the public key acquired from the secure element to the device management device that centrally manages the IoT device.

Step 3) The device management device applies to CA for issuance of a public key certificate.

Japanese Patent No. 6465426 (paragraph 0018)

However, in the conventional procedure of generating the public key certificate of the IoT device, the device management device asks the CA whether or not the public key for which the public key certificate is issued is generated by a legitimate secure element. In addition, there is a problem that it is not possible to determine whether the public key has been tampered with.

Therefore, in the present invention, when generating the public key certificate of the secure element embedded in the IoT device, the device management device side that applies to the CA for the issuance of the public key certificate issues the public key certificate to the CA. The purpose is to be able to verify the validity of the public key you apply for.

The IoT key management system according to the first invention that solves the above-mentioned problems is a system in which an IoT device incorporating a secure element and a device management device are connected via a network.

The secure element according to the first invention generates a pair of a private key and a public key of an asymmetric encryption method, and uses a basic key for generating an authentication code to authenticate a public key file including the public key. After calculating the code, the public key file, the encryption key generation means for outputting this authentication code, and the signature generation means for generating the signature of the instructed message using the private key generated by the encryption key generation means. Be prepared.

The IoT device according to the first invention instructs the secure element to generate a set of a private key and a public key of an asymmetric encryption method, and obtains a CSR file of a public key included in the public key file received from the secure element. After the generation, the secure element is instructed to generate the signature of the CSR file, and the public key file, this authentication code, and the signed CSR file in which the signature generated by the secure element is added to the CSR file are managed by the device. A means for generating a CSR file to be transmitted to the device is provided.

The device management device according to the first invention verifies the validity of the authentication code received from the IoT device by using the basic key shared with the secure element, and when the validity verification is successful, the signature is obtained. It is provided with a certificate application means for transmitting the attached CSR file to a predetermined certificate authority.

By verifying the authentication code of the public key file generated by the secure element, the device management device can verify whether or not the data contained in the public key file has been tampered with, and further, for generating the authentication code. By using the basic key shared by the secure element and the device management device, the device management device side can determine that the secure element that generated the public key is the secure element managed by the device management device. Can be verified.

Further, according to the second invention, in the IoT key management system described in the first invention, the encryption key generation means of the secure element is used with the basic key according to a derivation algorithm for deriving the derivation key when calculating the authentication code. The derived key is derived using the parameters required by the derivation algorithm, the authentication code is calculated from the public key file containing the parameters and the derived key, and the certificate application means of the device management device is used. Using the basic key and the parameters included in the public key file, a derived key is generated by the same derivation algorithm as the secure element, and the authentication code received from the IoT device is verified using the derived key. It is characterized by doing.

By deriving the derived key by the derivation algorithm using the basic key and the parameter, it becomes more difficult to decipher the basic key, and the effect of detecting falsification of the public key file is enhanced.

Further, in the third invention, in the IoT key management system described in the second invention, the derivation algorithm is an algorithm for deriving a derived key from the basic key by using a pseudo-random function, and the parameter is the pseudo-random function. It is characterized by the number of repetitions of.

In the algorithm for deriving the derived key from the basic key using the pseudo-random number function, the security is enhanced by the number of iterations. Therefore, it is preferable to set the parameter included in the public key file to the number of iterations.

Further, in the fourth invention, in the IoT key management system described in the second invention, the derivation algorithm is an algorithm for generating a derivation key by arithmetically processing the parameter using the basic key, and the parameter is a random number. It is characterized by being informational.

By using the random number information to generate the derived key, the key used to calculate the authentication code can be changed each time the public key is generated even for the same secure element.

Further, the fifth invention is the IoT key management system according to any one of the first to fourth inventions. The secure element stores the basic key individually for each secure element, and the encryption key generation means. Includes an individual element ID of the secure element in the public key file, and the certificate application means of the device management device stores the basic key stored in the secure element in association with the element ID. Then, the authentication code received from the IoT device is validated by using the basic key associated with the element ID included in the public key file received from the IoT device. ..

By individually assigning the basic key stored in the secure element to the secure element, the device management device generates a public key from the element ID included in the public key file received from the IoT device. The secure element can be identified.

Further, the sixth invention is a secure element constituting the IoT key management system described in any one of the first to fifth inventions.

Further, the seventh invention is an IoT device constituting the IoT key management system described in the first invention.

Further, the eighth invention is a device management device constituting the IoT key management system described in any one of the first to fifth inventions.

Further, the ninth invention is a method of generating a public key certificate of a secure element, in which an IoT device incorporating the secure element uses the secure element to generate a set of a private key and a public key of an asymmetric encryption method. The secure element generates a pair of private key and public key of asymmetric encryption method, and uses the basic key to generate the authentication code to generate the authentication code of the public key file including the public key. After the calculation, the public key file and the step a for outputting the authentication code, and when the IoT device receives the public key file and the authentication code from the secure element, the public key included in the public key file In step b of generating a CSR file, the IoT device instructs the secure element to generate a signature of the CSR file, and the secure element uses the private key generated in the step a to sign the CSR file. Step c to generate and output the IoT device, the IoT device transmits the public key file, the authentication code, and a signed CSR file in which the signature generated by the secure element is added to the CSR file to the device management device. Step d and the device management device use the basic key shared with the secure element to verify the validity of the authentication code received from the IoT device, and when the validity verification is successful, the signature is given. It is a method of generating a public key certificate of a secure element, which comprises a step e of transmitting a attached CSR file to a predetermined authentication authority.

The ninth invention is an invention of a method corresponding to the first invention.

Further, the tenth invention is the method for generating a public key certificate of a secure element described in the ninth invention. Further, in the step a, the secure element is based on the derivation algorithm for deriving the derivation key when calculating the authentication code. The derived key is derived using the key and the parameters required by the derivation algorithm, the authentication code is calculated from the public key file including the parameters and the derivation key, and in the step e, the device management device , The basic key and the parameters included in the public key file are used to generate a derived key by the same derivation algorithm as the secure element, and the authentication code received from the IoT device using the derived key is valid. It is characterized by verification.

The tenth invention is an invention of a method corresponding to the second invention.

Further, the eleventh invention is the method for generating a public key certificate of a secure element described in the tenth invention, wherein the derivation algorithm is an algorithm for deriving a derivation key from the basic key by using a pseudo-random function. The parameter is the number of repetitions of the pseudo-random function.

The eleventh invention is an invention of a method corresponding to the third invention.

Further, the twelfth invention is the method for generating a public key certificate of a secure element described in the tenth invention, in which a derived key is generated by arithmetically processing the parameters using the basic key in the derivation algorithm. It is characterized by using an algorithm and using the above parameters as random number information.

The twelfth invention is an invention of a method corresponding to the fourth invention.

Further, the thirteenth invention is the method for generating a public key certificate of a secure element described in any one of the ninth invention to the twelfth invention, and in the step a, the secure element is used for each secure element. The authentication code of the public key file including the individual element ID is generated by the secure element by using the individual basic key, and in the step e, the device management device is associated with the element ID. From the stored basic keys, the authentication code received from the IoT device using the basic key associated with the element ID included in the public key file received from the IoT device. It is characterized by verifying the validity of.

The thirteenth invention is an invention of a method corresponding to the fifth invention.

As described above, according to the present invention, when the public key certificate of the IoT device is generated, the device management device side that applies to the CA for the issuance of the public key certificate applies to the CA for the issuance of the public key certificate. The validity of the public key can be verified.

The figure which showed the structure of the IoT key management system. Block diagram of secure elements implemented by IoT devices. Block diagram of IoT device. Block diagram of the device management device. The figure explaining the procedure of generating the public key certificate of a secure element.

From here, an embodiment according to the present invention will be described. The present embodiment is for facilitating the understanding of the present invention, and the present invention is not limited to the present embodiment. Unless otherwise specified, the drawings are schematic drawings drawn to facilitate understanding of the present invention.

FIG. 1 shows the configuration of the IoT key management system 1. The IoT key management system 1 illustrated in FIG. 1 includes a plurality of IoT devices 3, a secure element 2 incorporated in each IoT device 3, and a device management device 4. In FIG. 1, in addition to these, gateway 6, network 7, and CA5 (Certification Authority, a certificate authority in Japanese) are included in the IoT key management system 1.

The IoT device 3 is a device that acquires data according to the use of the IoT device 3 and transmits the acquired data to a predetermined device (here, device management device 4). The specific form of the IoT device 3 is changed according to the user and the like. Examples of the IoT device 3 include a tablet computer, a point of sale (POS), an automobile, and the like.

The security of the IoT key management system 1 is enhanced by utilizing PKI that supports signature, authentication, and encryption. Since the private key 22 of the asymmetric encryption method that uses different encryption keys for encryption and decryption is securely stored in the IoT device 3, the IoT device 3 is required to have tamper resistance. In order to realize this, the secure element 2 which is an IC chip having tamper resistance is mounted on the IoT device 3 according to the present embodiment.

The form of the secure element 2 which is an IC chip having tamper resistance includes the form of eSE (embedded Secure Element), but the secure element 2 of FIG. 1 is in the form of a SIM card (Subscriber Identity Module Card). There is.

The device management device 4 is a device that provides various services related to the operation and management of the IoT device 3. In the present embodiment, when the IoT device 3 causes the secure element 2 to generate the private key 22 and the public key 23 of the asymmetric cryptosystem in this service, the public key certificate 27 of the public key 23 generated by the secure element 2 is issued. The service to apply for is included.

The gateway 6 is a device that can be connected to a plurality of IoT devices 3 at the same time. The network 7 may be a local network, but if the area where the IoT device 3 is arranged is a wide area, the network 7 becomes the Internet. CA5 is an organization that issues the public key certificate 27 of the public key 23 generated by the secure element 2.

The devices that play a central role in the service for acquiring the public key certificate 27 of the public key 23 generated by the secure element 2 are the secure element 2, the IoT device 3, and the device management device 4. From here, these devices will be described in detail.

FIG. 2 is a block diagram of the secure element 2 mounted on the IoT device 3. This is a device issued by the operating company of the device management device 4. The secure element 2 is configured to be accessible only to applications and users that have been authenticated by the operating company of the device management device 4.

As illustrated in FIG. 2, the secure element 2 includes a processor 200 that performs data arithmetic processing, and a coprocessor 210 that performs processing specialized in asymmetric cryptographic arithmetic (for example, surplus arithmetic). Further, the secure element 2 is a RAM 220 (Random Access Memory) which is a volatile memory, a UART 230 (Universal Asynchronous Receiver / Transmitter) which is a circuit which communicates with an external device (here, an IoT device 3), and a circuit which generates a random number. It is equipped with a certain RNG 240 (Random Number Generator) and an electrically rewritable non-volatile memory NVM250 (Non-volatile memory).

In the NVM of the secure element 2, the element ID 252 and the basic key 251 are stored as individual data for each secure element 2. The basic key 251 may be the same for each secure element 2, but in the present embodiment, the basic key 251 is individual for each secure element 2.

Further, the NVM 250 of the secure element 2 stores a plurality of commands 253 for operating the processor 200 of the secure element 2. The command 253 stored in the NVM 250 includes an encryption key generation command 253a and a signature generation command 253b.

The encryption key generation command 253a is a command for generating the private key 22 and the public key 23 of the asymmetric encryption method. When the encryption key generation command 253a is executed, the processor 200 of the secure element 2 has the secret key of the asymmetric encryption method. The encryption key generation means according to the present invention, which generates the public key 23 and the public key 23, calculates the authentication code 25 of the public key file 24 including the public key 23, and then outputs the public key file 24 and the authentication code 25. Functions as 20.

The private key 22 and the public key 23 of the asymmetric encryption method generated by the encryption key generation means 20 are stored in the NVM 250 of the secure element 2. The private key 22 of the asymmetric encryption method is stored in the NVM 250 of the secure element 2 in a state where it cannot be read from the secure element 2, but the public key 23 of the asymmetric encryption method is stored in the NVM 250 of the secure element 2 in a state where it can be read from the secure element 2. It is stored in 2 NVM250.

The algorithm for calculating the authentication code 25 is arbitrary, but the secure element 2 according to the present embodiment uses at least the basic key 251 stored in the NVM 250 of the secure element 2 to derive the derived key according to a predetermined derivation algorithm. The authentication code is calculated using this derived key. By using the basic key 251 for deriving the derived key, only a legitimate one who knows the basic key 251 (here, the device management device 4) can derive the derived key used for generating the authentication code 25. The public key file 24 can include parameters required by the derivation algorithm used for derivation of the derivation key.

The element ID 252 included in the public key file 24 to be calculated by the authentication code 25 is individual data for each secure element 2. From the element ID 252 included in the public key file 24 output by the secure element 2 when the private key 22 and the public key 23 of the asymmetric encryption method are generated, the secure element 2 that generated the public key 23 of the asymmetric encryption method can be specified.

The signature generation command 253b is a command for generating a digital signature of a message transmitted from the IoT device 3 on which the secure element 2 is mounted, using the private key 22 generated by the encryption key generation means 20 (encryption key generation command 253a). is there. When the signature generation command 253b is executed, the processor 200 of the secure element 2 functions as the signature generation means 21 according to the present invention.

FIG. 3 is a block diagram of the IoT device 3. As illustrated in FIG. 3, the IoT device 3 includes an MCU 300 (Micro Control Unit), a mobile communication unit 310, a sensor hub 320, and an interface 330, and a sensor 321 that senses predetermined data is connected to the sensor hub 320. A secure element 2 is connected to the interface 330.

The MCU 300 is an embedded microprocessor that integrates a computer system including an application processor 301 and a memory unit 302 capable of processing various applications into one integrated circuit. The mobile communication unit 310 is a circuit for performing communication conforming to a predetermined mobile communication standard. The mobile communication unit 310 is preferably compatible with 5G.

The sensor hub 320 is an IC chip that converts the signal of the sensor 321 connected to the sensor hub 320 and transmits it to the MCU 300, or switches the sensor 321 connected to the sensor hub 320. The sensor 321 connected to the sensor hub 320 may be arbitrary. The sensor 321 connected to the sensor hub 320 includes a temperature sensor, a humidity sensor, a current sensor, an optical sensor, a position sensor, and the like.

The interface 330 is an input / output circuit for connecting peripheral devices to the MCU 300. In the present embodiment, the interface 330 includes one for connecting to the secure element 2. In the present embodiment, since the secure element 2 is in the form of a SIM, the interface 330 includes an interface for ISO7816.

The memory unit 302 of the MCU 300 stores the application 303 that operates the application processor 301 of the MCU 300 and the public key certificate 424 of the device management device 4 distributed from the device management device 4. The memory unit 302 of the MCU 300 can also store the data acquired by the sensor 321.

The application 303 stored in the memory unit 302 of the MCU 300 causes the secure element 2 to generate the private key 22 and the public key 23 of the asymmetric cryptosystem, and the CSR file 31 (CSR: Certificate Signing) of the public key 23 generated by the secure element 2 is generated. Request, in Japanese, includes a CSR file generation application 303a that executes a process of generating a certificate signing request) and transmitting it to the device management device 4. The CSR file generation application 303a is distributed from the device management device 4 to the IoT device 3. When the CSR file generation application 303a is executed, the application processor 301 of the MCU 300 functions as the CSR file generation means 30 according to the present invention. The operation of the CSR file generation means 30 included in the IoT device 3 will be described later.

FIG. 4 is a block diagram of the device management device 4. The device management device 4 is a device composed of one or a plurality of servers. In FIG. 4, one server constitutes the device management device 4. As illustrated in FIG. 4, the device management device 4 has one or more processors 400 and various components connected to the processor 400 via the bus 430. In FIG. 4, only the network communication unit 410 and the storage 420 are shown as the components connected to the processor 400 via the bus 430, but in reality, various components other than these are shown in the processor 400 via the bus 430. Is connected to.

The storage 420 of the device management device 4 contains a management application 421 that performs processing related to the management and operation of the IoT device 3 and a secure element DB 422 (DataBase) that stores various data for each secure element 2 managed by the device management device 4. ), The private key 423 of the device management device 4, and the public key certificate 424 of the device management device 4 are stored.

When the management application 421 stored in the storage 420 of the device management device 4 receives the public key file 24, the authentication code 25, and the CSR file 31, the public key file 24 is included in the CSR file 31 by verifying the validity of the authentication code 25. Includes a certificate application application 421a that verifies the validity of the key 23 and, in the case of the legitimate secure element 2, applies to CA5 for the issuance of the public key certificate 27. When the certificate application application 421a is executed, the processor 400 of the device management device 4 functions as the certificate application means 40 according to the present invention. The operation of the certificate application means 40 according to the present invention will be described later.

The secure element DB 422 stored in the storage 420 of the device management device 4 is associated with the element ID 252 stored in the secure element 2 for each secure element 2 mounted on the IoT device 3 to be managed by the device management device 4. In this state, the basic key 251 stored in the secure element 2 is stored.

FIG. 5 is a diagram illustrating a procedure for generating the public key certificate 27 of the secure element 2. The description with reference to FIG. 5 includes a description of the public key certificate generation method of the secure element 2 of the present invention according to the method category, a description of the CSR file generation means 30 included in the IoT device 3, and a device management device 4. It also serves as an explanation of the certificate application means 40 to be provided.

In S1, which is the first step in FIG. 5, the CSR file generation means 30 of the IoT device 3 instructs the secure element 2 mounted on the IoT device 3 to generate the private key 22 and the public key 23 of the asymmetric encryption method. To do. The encryption key generation means 20 provided in the secure element 2 generates the private key 22 and the public key 23 of the asymmetric encryption method. The IoT device 3 secures the command APDU (Application Protocol Data Unit) of the encryption key generation command 253a when instructing the generation of the private key 22 and the public key 23 of the asymmetric encryption method in order to activate the encryption key generation means 20. Send to element 2.

In S2 in FIG. 5, the encryption key generation means 20 of the secure element 2 generates the private key 22 of the asymmetric encryption method and the public key 23 of the asymmetric encryption method.

In S3 of FIG. 5, the encryption key generation means 20 of the secure element 2 reads the basic key 251 and the element ID 252 from the NVM 250, and according to the derivation algorithm for deriving the derivation key, obtains the basic key 251 and the parameters required for the derivation algorithm. Use to derive the derived key.

The derivation algorithm for deriving the derived key is arbitrary, but it is preferable to use an algorithm for deriving the derived key from the basic key 251 using a pseudo-random function. As such a derivation algorithm, the algorithm disclosed in NIST Special Publication 800-108 can be used.

In the derivation algorithm for deriving the derived key from the basic key 251 using the pseudo-random number function, the salt and the number of iterations, which are the input data of the derivation algorithm, are the parameters of the derivation algorithm. Since it is desirable for security that the salt, which is one of the parameters of this derivation algorithm, is known only to the secure element 2 and the device management device 4, in this embodiment, the number of iterations, which is one of the parameters of this derivation algorithm, is disclosed. It is included in the key file.

Further, an algorithm for generating a derived key by arithmetically processing a parameter using the basic key 251 can be used as a derived key derivation algorithm. In this case, the random number information generated by RNG240 is used as a parameter, and exclusive OR or cryptographic operation can be used for this operation processing.

In S4 in FIG. 5, the encryption key generating means 20 of the secure element 2 uses the derived key generated in S3 in FIG. 5 to include the element ID 252, the parameters of the derived algorithm (for example, the number of iterations), and the public key 23. The authentication code 25 of the public key file 24 is calculated. CBC-MAC (Cipher Block Chaining Message Authentication Code) and CMAC (Cipher-based Message Authentication Code) can be used as an algorithm for generating the authentication code 25 using the derived key.

In S5 of FIG. 5, the encryption key generation means 20 of the secure element 2 includes the public key file 24 and the authentication code 25 in the response data as the response of the command APDU of the encryption key generation command 253a received in S1 of FIG. The response APDU is output to the IoT device 3.

In S6 in FIG. 5, the CSR file generation means 30 of the IoT device 3 generates the CSR file 31 including the public key 23 included in the public key file 24 received from the secure element 2. The CSR file 31 includes a distinguished name (common name, department name, organization name, etc.) in addition to the public key 23.

In S7 of FIG. 5, the CSR file generation means 30 of the IoT device 3 instructs the secure element 2 mounted on the IoT device 3 to generate the signature of the CSR file 31 generated in S7 of FIG. The signature generation of the CSR file 31 is performed by the signature generation means 21 provided in the secure element 2. When instructing the signature generation of the CSR file 31 to activate the signature generation means 21, the IoT device 3 transmits the command APDU of the signature generation command 253b including the CSR file 31 in the command data to the secure element 2. ..

In S8 of FIG. 5, the signature generation means 21 of the secure element 2 uses the secret key 22 of the asymmetric encryption method generated in S2 of FIG. 5 to generate the signature 26 of the CSR file 31 received from the IoT device 3. The signature 26 of the CSR file 31 is calculated by encrypting the hash value of the CSR file 31 calculated by using the one-way hash function with the secret key 22 of the asymmetric encryption method.

In S9 of FIG. 5, the signature generation means 21 of the secure element 2 transmits the response APDU of the signature generation command 253b using the signature 26 of the CSR file 31 calculated in S9 of FIG. 5 as the response data to the IoT device 3. , Outputs the signature 26 of the CSR file 31.

In S10 of FIG. 5, the IoT device 3 has the public key file 24 and the authentication code 25 of the public key file 24 acquired from the secure element 2 in S5 of FIG. 5, and the signature output by the secure element 2 in S10 of FIG. The signed CSR file 31a with 26 added to the CSR file 31 is transmitted to the device management device 4.

In order to ensure the security of communication between the IoT device 3 and the device management device 4, the data transmitted from the IoT device 3 to the device management device 4 must be encrypted. In S10 of FIG. 5, the IoT device 3 encrypts data such as the public key file 24 transmitted from the IoT device 3 to the device management device 4 with the public key included in the public key certificate 424 of the device management device 4. ..

In S11 in FIG. 5, the certificate application means 40 of the device management device 4 decrypts the data transmitted from the IoT device 3 with the private key 423 of the device management device 4, and then the authentication code 25 transmitted from the IoT device 3. To verify the validity.

When verifying the authentication code 25 transmitted from the IoT device 3, the certificate application means 40 of the device management device 4 uses the basic key 251 associated with the element ID 252 included in the public key file 24 transmitted from the IoT device 3. Is obtained from the secure element DB422. Next, the certificate application means 40 of the device management device 4 uses the same derivation algorithm as the secure element 2 to obtain the parameters (for example, the number of iterations) of the derivation algorithm transmitted from the IoT device 3 and the basic key acquired from the secure element DB 422. After generating a derived key from 251 and calculating the authentication code 25 of the public key file 24 transmitted from the IoT device 3, the authentication code 25 transmitted from the IoT device 3 and the authentication code calculated by the device management device 4 side. Check if 25 matches. When the authentication codes 25 match, the certificate application means 40 of the device management device 4 determines that the public key 23 included in the signed CSR file 31a is generated by the legitimate secure element 2.

In S12 in FIG. 5, the certificate application means 40 of the device management device 4 branches the process according to the validity verification result of the authentication code 25. If the certificate application means 40 of the device management device 4 fails to verify the validity of the authentication code 25, the certificate application means 40 does not apply to CA5 for issuance of the public key certificate 27 of the public key 23 generated by the secure element 2, and FIG. The procedure of is completed.

When the validity verification of the authentication code 25 is successful, in S13 in FIG. 5, the certificate application means 40 of the device management device 4 informs the CA5 of the public key certificate 27 of the public key 23 generated by the secure element 2. Apply for issuance. When applying for the issuance of the public key certificate 27, the certificate application means 40 of the device management device 4 transmits the signed CSR file 31a to the CA5.

In S14 in FIG. 5, the CA5 examines the signed CSR file 31a by verifying the signature 26 of the signed CSR file 31a using the public key 23 included in the signed CSR file 31a, and then the CSR file. When the examination is passed, the signature of the public key 23 and the like included in the signed CSR file 31a is calculated using the CA5 private key, and the CA5 signature is used instead of the signature 26 attached to the signed CSR file 31a. The public key certificate 27 of the added public key 23 is issued.

In S15 of FIG. 5, the certificate application means 40 of the device management device 4 provides the public key certificate 27 corresponding to the signed CSR file 31a transmitted to CA5 in S13 of FIG. 5 with the public key provided by CA5. After downloading from the public location of the certificate 27, the public key certificate 27 is registered in the secure element DB 422 of the device management device 4 in association with the element ID 252, and the procedure of FIG. 5 ends.

In the IoT key management system 1 according to the present embodiment, the public key generated by the secure element 2 is located between the device management device 4 that applies to CA5 for issuance of the public key certificate 27 and the secure element 2 that generates the public key 23. There is an IoT device 3 that generates a signed CSR file 31a from 23. Therefore, it is necessary for the device management device 4 side to be able to verify the validity of the public key 23 included in the signed CSR file 31a to be transmitted to the CA5.

In the IoT key management system 1 according to the present embodiment, the secure element 2 generates the authentication code 25 of the public key file 24 including the public key 23, and the device management device 4 side generates the authentication code 25 of the public key file 24. By verifying, the device management device 4 can at least verify the validity of the public key 23 included in the signed CSR file 31a to be transmitted to the CA5.

By verifying the authentication code 25 of the public key file 24 on the device management device 4, it is possible to verify whether or not the data contained in the public key file 24 has been tampered with. Further, by using the basic key 251 shared by the secure element 2 and the device management device 4 to generate the authentication code 25, the basic key 251 used by the secure element 2 to generate the authentication code 25 and the device management device The fact that the basic key 251 stored in 4 is the same is a condition for succeeding in the validity verification of the authentication code 25. Therefore, by verifying the authentication code 25, the device management device 4 can verify that the secure element 2 that generated the public key 23 is the secure element 2 managed by the device management device 4.

Further, by individually assigning the basic key 251 stored in the secure element 2 to the secure element 2, the device management device 4 can obtain the public key from the element ID 252 included in the public key file 24 received from the IoT device 3. The secure element 2 that generated 23 can be specified.

1 IoT key management system 2 Secure element 20 Cryptographic key generation means 21 Sign generation means 22 Private key 23 Public key 24 Public key file 25 Authentication code 3 IoT device 30 CSR file generation means 31 CSR file 31a Signed CSR file 4 Device management device 40 Certificate application method

Claims (13)

A system in which IoT devices and device management devices incorporating secure elements are connected via a network.
The secure element generates a pair of private key and public key of asymmetric encryption method, and after calculating the authentication code of the public key file including the public key by using the basic key for generating the authentication code. It is provided with an encryption key generation means for outputting the public key file and this authentication code, and a signature generation means for generating a signature of an instructed message using the private key generated by the encryption key generation means.
The IoT device instructs the secure element to generate a pair of a private key and a public key of an asymmetric encryption method, generates a CSR file of a public key included in the public key file received from the secure element, and then CSRs. A CSR that instructs the secure element to generate a signature of a file, and transmits the public key file, this authentication code, and a signed CSR file in which the signature generated by the secure element is added to the CSR file to the device management device. Equipped with file generation means
The device management device verifies the validity of the authentication code received from the IoT device by using the basic key shared with the secure element, and if the validity verification succeeds, the signed CSR file is predetermined. Equipped with a means of applying for a certificate to be sent to the certification authority of
An IoT key management system characterized by this. When calculating the authentication code, the encryption key generation means of the secure element derives the derived key using the basic key and the parameters required by the derivation algorithm according to the derivation algorithm for deriving the derivation key, and derives the derivation key. The authentication code is calculated from the public key file containing the above key and the derived key.
The certificate application means of the device management device uses the basic key and the parameters included in the public key file to generate a derived key by the same derivation algorithm as the secure element, and uses the derived key. Validate the authentication code received from the IoT device,
The IoT key management system according to claim 1, wherein the IoT key management system is characterized in that. The IoT key according to claim 2, wherein the derivation algorithm is an algorithm for deriving a derived key from the basic key using a pseudo-random function, and the parameter is the number of iterations of the pseudo-random function. Management system. The IoT key management system according to claim 2, wherein the derivation algorithm is an algorithm for generating a derivation key by arithmetically processing the parameter using the basic key, and the parameter is used as random number information. .. The secure element stores the basic key that is individual for each secure element, and the encryption key generation means includes the element ID that is individual for the secure element in the public key file.
The certificate application means of the device management device stores the basic key stored in the secure element in association with the element ID, and the element included in the public key file received from the IoT device. Using the basic key associated with the ID, the validity of the authentication code received from the IoT device is verified.
The IoT key management system according to any one of claims 1 to 4, wherein the IoT key management system is characterized in that. A secure element that constitutes the IoT key management system according to any one of claims 1 to 5. The IoT device that constitutes the IoT key management system according to claim 1. The device management device constituting the IoT key management system according to any one of claims 1 to 5. A method of generating a secure element public key certificate
The IoT device incorporating the secure element instructs the secure element to generate a private key and public key pair of the asymmetric encryption method, and the secure element generates a private key and public key pair of the asymmetric encryption method. , Step a to output the public key file and this authentication code after calculating the authentication code of the public key file including the public key using the basic key for generating the authentication code.
When the IoT device receives the public key file and this authentication code from the secure element, step b of generating a CSR file of the public key included in the public key file, and
Step c, in which the IoT device instructs the secure element to generate a signature of the CSR file, and the secure element generates and outputs a signature of the CSR file using the private key generated in step a.
The IoT device transmits the public key file, the authentication code, and a signed CSR file in which the signature generated by the secure element is added to the CSR file to the device management device that manages the secure element. Step d and
When the device management device verifies the validity of the authentication code received from the IoT device by using the basic key shared with the secure element and succeeds in the validity verification, the signed CSR file is specified. Step e to be sent to the certification authority of
A method of generating a public key certificate for a secure element, characterized by including. In step a, when calculating the authentication code, the secure element derives the derived key using the basic key and the parameters required by the derivation algorithm according to the derivation algorithm for deriving the derivation key, and obtains the parameters. The authentication code is calculated from the included public key file and the derived key.
In step e, the device management device uses the basic key and the parameters included in the public key file to generate a derived key by the same derivation algorithm as the secure element, and uses the derived key to generate the derived key. Validate the authentication code received from the IoT device,
The method for generating a public key certificate for a secure element according to claim 9, wherein the public key certificate is generated. The secure element according to claim 10, wherein the derivation algorithm is an algorithm for deriving a derived key from the basic key using a pseudo-random number function, and the parameter is the number of repetitions of the pseudo-random function. How to generate a public key certificate. The derivation algorithm is an algorithm for generating a derivation key by arithmetically processing the parameter using the basic key, and the parameter is used as random number information.
The method for generating a public key certificate for a secure element according to claim 10. In step a, the secure element uses the basic key that is individual for each secure element to generate an authentication code for the public key file that includes an individual element ID for the secure element.
In the step e, the device management device is associated with the element ID included in the public key file received from the IoT device from among the basic keys stored in association with the element ID. The validity of the authentication code received from the IoT device is verified by using the basic key provided.
The method for generating a public key certificate for a secure element according to any one of claims 9 to 12, characterized in that.

Images