# US 2026/0303376 A1 · Authentication apparatus, authentication target apparatus, image forming apparatus, replacement unit, and authentication method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0303376 A1
- Document ID: US20260303376A1
- Status: Published application
- Kind: A1
- Application number: 19/697,832
- Filed: 2026-06-04
- Published: 2026-10-01
- Earliest claimed: 2022-12-14
- Assignees: Canon Kabushiki Kaisha
- Applicants: Canon Kabushiki Kaisha
- Inventors: HIROTAKA ITTOGI
- Web page: https://patentgrep.com/patent/US20260303376A1

## CPC

- H04L 9/3271: {using challenge-response}
- H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)}
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- G06F 21/44: Program or device authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An authentication method for authenticating an authentication target apparatus by an authentication apparatus is provided. The method includes: the authentication apparatus performing first encryption processing in accordance with first encryption processing information; the authentication target apparatus performing second decryption processing in accordance with second encryption processing information; the authentication target apparatus performing second encryption processing in accordance with the second encryption processing information; the authentication apparatus performing first decryption processing in accordance with the first encryption processing information. The authentication apparatus changes the first encryption processing information in accordance with a predetermined rule when either of the first encryption processing and the first decryption processing is performed, and the authentication target apparatus changes the second encryption processing information in accordance with the predetermined rule when either of the second encryption processing and the second decryption processing is performed.

## Claims

### Claim at position 1

-30. (canceled)

### Claim 31

An authentication method for authenticating an authentication target apparatus that is mounted in a cartridge detachably attachable to an image forming apparatus including an authentication apparatus, and that is authenticated by the authentication apparatus, the authentication method comprising:
the authentication apparatus generating verification data by using a verification key and challenge data;
the authentication apparatus generating first encrypted data by encrypting first data including at least the challenge data in accordance with first encryption processing information, and transmitting the first encrypted data to the authentication target apparatus;
the authentication target apparatus acquiring the challenge data by decrypting the first encrypted data received from the authentication apparatus in accordance with second encryption processing information;
the authentication target apparatus generating authentication data by using the challenge data acquired by the decryption and an authentication key stored in advance in the authentication target apparatus;
the authentication target apparatus generating second encrypted data by encrypting second data including at least the authentication data in accordance with the second encryption processing information, and transmitting the second encrypted data to the authentication apparatus;
the authentication apparatus acquiring the authentication data by decrypting the second encrypted data received from the authentication target apparatus in accordance with the first encryption processing information; and
the authentication apparatus authenticating the authentication target apparatus by comparing the authentication data acquired by the decryption with the verification data,
wherein the authentication apparatus changes the first encryption processing information in accordance with a predetermined rule when the encryption of the first data is performed, and
wherein the authentication target apparatus changes the second encryption processing information in accordance with the predetermined rule when the encryption of the second data is performed.

### Claim 32 (depends on 31)

The authentication method according to claim 31,
wherein the authentication apparatus performs the decryption of the second encrypted data after a change to the first encryption processing information has been performed due to the encryption of the first data having been performed, and
wherein the authentication target apparatus performs the encryption of the second data after a change to the second encryption processing information has been performed due to the decryption of the first encrypted data having been performed.

### Claim 33 (depends on 31)

The authentication method according to claim 31,
wherein the authentication apparatus stores a plurality of verification keys,
wherein the authentication target apparatus stores a plurality of authentication keys respectively corresponding to the plurality of verification keys,
wherein the authentication method further comprises:
the authentication apparatus selecting a selected verification key from the plurality of verification keys;
the authentication apparatus including, in the first data, identification information for identifying a selected authentication key corresponding to the selected verification key; and
the authentication target apparatus identifying the selected authentication key from among the plurality of authentication keys based on the identification information acquired by decrypting the first encrypted data,
wherein the verification data is generated by using the selected verification key and the challenge data, and
wherein the authentication data is generated by using the selected authentication key and the challenge data.

### Claim 34 (depends on 31)

The authentication method according to claim 31, further comprising:
the authentication target apparatus generating random data; and
the authentication target apparatus including the generated random data in the second data,
wherein the authentication data is generated by using the authentication key, the challenge data, and the random data, and
wherein the verification data is generated by using the verification key, the challenge data, and the random data acquired by decrypting the second encrypted data.

### Claim 35 (depends on 31)

The authentication method according to claim 31,
wherein the first encryption processing information includes information indicating a communication key and information indicating seventh data,
wherein the second encryption processing information includes information indicating the communication key and information indicating the seventh data,
wherein the encryption of the first data, the decryption of the first encrypted data, the encryption of the second data, and the decryption of the second encrypted data are performed based on the communication key and the seventh data,
wherein the authentication apparatus changes the first encryption processing information by changing the seventh data in accordance with the predetermined rule when either the encryption of the first data or the decryption of the second encrypted data is performed, and
wherein the authentication target apparatus changes the second encryption processing information by changing the seventh data in accordance with the predetermined rule when either the decryption of the first encrypted data or the encryption of the second data is performed.

### Claim 36 (depends on 35)

The authentication method according to claim 35, further comprising:
in response to a predetermined condition being satisfied, the authentication apparatus changing the seventh data to an initial value and transmitting an initialization command to the authentication target apparatus; and
in response to the initialization command being received from the authentication apparatus, the authentication target apparatus changing the seventh data to the initial value.

### Claim 37 (depends on 35)

The authentication method according to claim 35, further comprising:
the authentication apparatus generating a session value and generating the communication key based on the session value and a first original key stored in the authentication apparatus;
the authentication apparatus notifying the authentication target apparatus of the session value; and
the authentication target apparatus generating the communication key based on the session value notified from the authentication apparatus and a second original key stored in the authentication target apparatus.

### Claim 38 (depends on 37)

The authentication method according to claim 37, further comprising:
the authentication apparatus acquiring an identifier of the authentication target apparatus from the authentication target apparatus,
wherein the authentication apparatus generates the communication key based on the session value, the first original key, and the identifier acquired from the authentication target apparatus, and
wherein the authentication target apparatus generates the communication key based on the session value, the second original key, and the identifier of the authentication target apparatus.

### Claim 39 (depends on 37)

The authentication method according to claim 37, further comprising:
the authentication apparatus generating a detection key based on the first original key;
the authentication target apparatus generating the detection key based on the second original key;
the authentication apparatus generating, based on the detection key, first detection data for detecting falsification of the first encrypted data, and transmitting the first detection data to the authentication target apparatus;
the authentication target apparatus detecting whether the first encrypted data has been falsified by inspecting, based on the detection key, the first detection data received from the authentication apparatus;
the authentication target apparatus generating, based on the detection key, second detection data for detecting falsification of the second encrypted data, and transmitting the second detection data to the authentication apparatus; and
the authentication apparatus detecting whether the second encrypted data has been falsified by inspecting, based on the detection key, the second detection data received from the authentication target apparatus,
wherein, in a case where the authentication target apparatus detects that the first encrypted data has been falsified, the authentication target apparatus does not decrypt the first encrypted data, and
wherein, in a case where the authentication apparatus detects that the second encrypted data has been falsified, the authentication apparatus does not decrypt the second encrypted data.

### Claim 40

An authentication target apparatus that is mounted in a cartridge detachably attachable to an image forming apparatus including an authentication apparatus, and that is authenticated by the authentication apparatus, the authentication target apparatus comprising:
a storage unit configured to store an authentication key;
a first generation unit configured to generate encryption processing information;
a decryption unit configured to decrypt, in accordance with the encryption processing information generated by the first generation unit, first encrypted data that is received from the authentication apparatus and that is generated by encrypting data including at least challenge data;
a generation unit configured to generate authentication data based on the authentication key stored in the storage unit and the challenge data acquired by the decryption; and
an encryption unit configured to generate second encrypted data by encrypting data including the authentication data in accordance with the encryption processing information generated by the first generation unit, and to transmit the second encrypted data to the authentication apparatus,
wherein the first generation unit is configured to change the encryption processing information in accordance with a predetermined rule when either decryption processing by the decryption unit or encryption processing by the encryption unit is performed.

### Claim 41 (depends on 40)

The authentication target apparatus according to claim 40,
wherein the encryption unit is configured to perform the encryption processing after the first generation unit has performed a change to the encryption processing information due to the decryption processing having been performed.

### Claim 42 (depends on 40)

The authentication target apparatus according to claim 40,
wherein the storage unit is configured to store a plurality of authentication keys,
wherein data acquired by decrypting the first encrypted data includes information indicating a selected authentication key from among the plurality of authentication keys, and
wherein the generation unit is configured to generate the authentication data based on the selected authentication key and the challenge data.

### Claim 43 (depends on 40)

The authentication target apparatus according to claim 40, further comprising:
a second generation unit configured to generate random data,
wherein the generation unit is configured to generate the authentication data based on the authentication key, the challenge data, and the random data generated by the second generation unit, and
wherein the encryption unit is configured to encrypt data including the authentication data and the random data.

### Claim 44 (depends on 40)

The authentication target apparatus according to claim 40,
wherein the encryption processing information includes information indicating a communication key and information indicating fifth data,
wherein the decryption processing and the encryption processing are performed based on the communication key and the fifth data, and
wherein the first generation unit is configured to change the encryption processing information by changing the fifth data in accordance with the predetermined rule when either the decryption processing or the encryption processing is performed.

### Claim 45 (depends on 44)

The authentication target apparatus according to claim 44,
wherein the first generation unit is configured to change the fifth data to an initial value in response to an initialization command being received from the authentication apparatus.

### Claim 46

The authentication target apparatus according to claim
wherein the storage unit stores an original key, and
wherein the first generation unit is configured to generate the communication key based on the original key and a session value notified from the authentication apparatus.

### Claim 47 (depends on 46)

The authentication target apparatus according to claim 46,
wherein the first generation unit is configured to generate the communication key based on the original key, the session value, and an identifier of the authentication target apparatus.

### Claim 48 (depends on 46)

The authentication target apparatus according to claim 46,
wherein the first generation unit is configured to generate a detection key based on the original key,
wherein the decryption unit is configured to detect whether the first encrypted data has been falsified by inspecting, based on the detection key, first detection data for detecting falsification of the first encrypted data received from the authentication apparatus,
wherein the encryption unit is configured to generate, based on the detection key, second detection data for detecting falsification of the second encrypted data, and to transmit the second detection data to the authentication apparatus, and
wherein, in a case where the decryption unit detects that the first encrypted data has been falsified, the decryption unit is configured not to perform the decryption processing on the first encrypted data.

### Claim 49 (depends on 40)

A cartridge detachably attachable to an image forming apparatus including an authentication apparatus,
wherein the cartridge comprises the authentication target apparatus according to claim 40.

### Claim 50 (depends on 49)

The cartridge according to claim 49,
wherein the cartridge is a process cartridge including at least one of a photoreceptor, a charger, and a developing apparatus.

### Claim 51

An authentication apparatus provided in an image forming apparatus and configured to authenticate an authentication target apparatus mounted in a cartridge detachably attachable to the image forming apparatus, the authentication apparatus comprising:
a storage unit configured to store a verification key;
a first generation unit configured to generate encryption processing information;
a second generation unit configured to generate challenge data;
an encryption unit configured to generate first encrypted data by encrypting first data including at least the challenge data in accordance with the encryption processing information generated by the first generation unit, and to transmit the first encrypted data to the authentication target apparatus;
a decryption unit configured to receive second encrypted data from the authentication target apparatus in response to transmission of the first encrypted data to the authentication target apparatus, and to acquire authentication data by decrypting the second encrypted data in accordance with the encryption processing information generated by the first generation unit;
a third generation unit configured to generate verification data based on the verification key stored in the storage unit and the challenge data; and
an authentication unit configured to authenticate the authentication target apparatus by comparing the authentication data acquired by the decryption unit with the verification data,
wherein the first generation unit is configured to change the encryption processing information in accordance with a predetermined rule when either encryption processing by the encryption unit or decryption processing by the decryption unit is performed.

### Claim 52 (depends on 51)

The authentication apparatus according to claim 51,
wherein the decryption unit is configured to perform the decryption processing after the first generation unit has performed a change to the encryption processing information due to the encryption processing having been performed.

### Claim 53 (depends on 51)

The authentication apparatus according to claim 51,
wherein the storage unit is configured to store a plurality of verification keys,
wherein the first data includes information indicating an authentication key corresponding to a selected verification key from among the plurality of verification keys, and
wherein the third generation unit is configured to generate the verification data based on the selected verification key and the challenge data.

### Claim 54 (depends on 51)

The authentication apparatus according to claim 51,
wherein data acquired by decrypting the second encrypted data includes random data, and
wherein the third generation unit is configured to generate the verification data based on the verification key, the challenge data, and the random data.

### Claim 55 (depends on 51)

The authentication apparatus according to claim 51,
wherein the encryption processing information includes information indicating a communication key and information indicating fifth data,
wherein the encryption processing and the decryption processing are performed based on the communication key and the fifth data, and
wherein the first generation unit is configured to change the encryption processing information by changing the fifth data in accordance with the predetermined rule when either the encryption processing or the decryption processing is performed.

### Claim 56 (depends on 55)

The authentication apparatus according to claim 55,
wherein the first generation unit is configured to, in response to a predetermined condition being satisfied, change the fifth data to an initial value and transmit an initialization command to the authentication target apparatus.

### Claim 57 (depends on 55)

The authentication apparatus according to claim 55,
wherein the storage unit stores an original key, and
wherein the first generation unit is configured to generate a session value and generate the communication key based on the original key and the session value.

### Claim 58 (depends on 57)

The authentication apparatus according to claim 57,
wherein the first generation unit is configured to generate the communication key based on the session value, the original key, and an identifier of the authentication target apparatus acquired from the authentication target apparatus.

### Claim 59 (depends on 57)

The authentication apparatus according to claim 57,
wherein the first generation unit is configured to generate a detection key based on the original key,
wherein the encryption unit is configured to generate, based on the detection key, first detection data for detecting falsification of the first encrypted data, and to transmit the first detection data to the authentication target apparatus,
wherein the decryption unit is configured to detect whether the second encrypted data has been falsified by inspecting, based on the detection key, second detection data for detecting falsification of the second encrypted data received from the authentication target apparatus, and
wherein, in a case where the decryption unit detects that the second encrypted data has been falsified, the decryption unit is configured not to perform the decryption processing on the second encrypted data.

### Claim 60 (depends on 51)

An image forming apparatus configured to perform image formation with a cartridge including an authentication target apparatus detachably attached thereto, the image forming apparatus comprising:
the authentication apparatus according to claim 51,
wherein the cartridge includes the authentication target apparatus.