Information processing device, authentication system, authentication device, information processing method, information processing program, recording medium, and integrated circuit

An authentication method used in an authentication system including an authentication device and an information processing device for executing an application program, the application program being subject to authentication processing performed with the authentication device,

• wherein the authentication method comprises steps, performed by the information processing device, of:
• holding therein a first decryption key corresponding to a first encryption key;
• holding therein an encrypted second decryption key and a first condition, the encrypted second decryption key having been encrypted using the first encryption key, and the first condition indicating a condition for outputting the second decryption key after decryption of the encrypted second decryption key;
• decrypting the encrypted second decryption key using the first decryption key to obtain the second decryption key, and outputting the second decryption key only when the first condition is satisfied;
• and
• when the second decryption key is output, performing first authentication processing with the authentication device using the second decryption key,
• wherein the first condition is a condition that integrity of a plurality of system programs executed in secure boot is maintained after the secure boot, the secure boot is a processing of sequentially executing the system programs from a start of boot to completion of the boot while verifying the integrity thereof,
• wherein the authentication method further comprises steps, performed by the authentication device, of:
• performing the first authentication processing with the information processing device using the second decryption key;
• and
• when the first authentication processing is completed successfully, transmitting, to the information processing device, an encrypted authentication key having been encrypted using a second encryption key corresponding to the second decryption key,
• wherein the authentication method further comprises a step, performed by the information processing device, of acquiring the encrypted authentication key and holding therein the encrypted authentication key,
• wherein the encrypted second decryption key is decrypted using the first decryption key to obtain the second decryption key after the encrypted authentication key is acquired and held by the information processing device,
• wherein the authentication method further comprises a step, performed by the information processing device, of decrypting the encrypted authentication key using the second decryption key to obtain the authentication key only when the first condition is satisfied, and outputting the authentication key only when a second condition is satisfied, the second condition indicating a condition for outputting the authentication key after decryption of the encrypted authentication key,
• wherein the second condition is a condition that integrity of the application program is maintained,
• wherein the authentication method further comprises a step, performed by the information processing device, of performing second authentication processing with the authentication device using the authentication key, when the authentication key is output by the information processing device, and
• wherein the authentication method further comprises a step, performed by the authentication device, of performing the second authentication processing with the information processing device using the authentication key, after the authentication key is transmitted to the information processing device.

A non-transitory computer readable recording medium having stored thereon an authentication program used in an authentication system, the authentication system including an authentication device and an information processing device for executing an application program, the application program being subject to authentication processing performed with the authentication device, the authentication program causing the authentication system to perform an authentication method,

• wherein the authentication method comprises steps, performed by the information processing device, of:
• holding therein a first decryption key corresponding to a first encryption key;
• holding therein an encrypted second decryption key and a first condition, the encrypted second decryption key having been encrypted using the first encryption key, and the first condition indicating a condition for outputting the second decryption key after decryption of the encrypted second decryption key;
• decrypting the encrypted second decryption key using the first decryption key to obtain the second decryption key, and outputting the second decryption key only when the first condition is satisfied;
• and
• when the second decryption key is output, performing first authentication processing with the authentication device using the second decryption key,
• wherein the first condition is a condition that integrity of a plurality of system programs executed in secure boot is maintained after the secure boot, the secure boot is a processing of sequentially executing the system programs from a start of boot to completion of the boot while verifying the integrity thereof,
• wherein the authentication method further comprises steps, performed by the authentication device, of:
• performing the first authentication processing with the information processing device using the second decryption key;
• and
• when the first authentication processing is completed successfully, transmitting, to the information processing device, an encrypted authentication key having been encrypted using a second encryption key corresponding to the second decryption key,
• wherein the authentication method further comprises a step, performed by the information processing device, of acquiring the encrypted authentication key and holding therein the encrypted authentication key,
• wherein the encrypted second decryption key is decrypted using the first decryption key to obtain the second decryption key after the encrypted authentication key is acquired and held by the information processing device,
• wherein the authentication method further comprises a step, performed by the information processing device, of decrypting the encrypted authentication key using the second decryption key to obtain the authentication key only when the first condition is satisfied, and outputting the authentication key only when a second condition is satisfied, the second condition indicating a condition for outputting the authentication key after decryption of the encrypted authentication key,
• wherein the second condition is a condition that integrity of the application program is maintained,
• wherein the authentication method further comprises a step, performed by the information processing device, of performing second authentication processing with the authentication device using the authentication key, when the authentication key is output by the information processing device, and
• wherein the authentication method further comprises a step, performed by the authentication device, of performing the second authentication processing with the information processing device using the authentication key, after the authentication key is transmitted to the information processing device.

An authentication system comprising:

• a first integrated circuit used in an authentication device;
• and a second integrated circuit used in an information processing device for executing an application program, the application program being subject to authentication processing performed with the authentication device,
• wherein the second integrated circuit includes:
• a key holding unit holding therein a first decryption key corresponding to a first encryption key;
• a key information holding unit holding therein an encrypted second decryption key and a first condition, the encrypted second decryption key having been encrypted using the first encryption key, and the first condition indicating a condition for outputting the second decryption key after decryption of the encrypted second decryption key;
• a decryption processing unit operable to decrypt the encrypted second decryption key using the first decryption key to obtain the second decryption key, and to output the second decryption key only when the first condition is satisfied;
• and
• a first authentication processing unit operable, when the second decryption key is output, to perform first authentication processing with the first integrated circuit using the second decryption key,
• wherein the first condition is a condition that integrity of a plurality of system programs executed in secure boot is maintained after the secure boot, the secure boot is a processing of sequentially executing the system programs from a start of boot to completion of the boot while verifying the integrity thereof,
• wherein the first integrated circuit includes:
• a second authentication processing unit operable to perform the first authentication processing with the second integrated circuit using the second decryption key;
• and
• a transmission unit operable, when the first authentication processing is completed successfully, to transmit, to the second integrated circuit, an encrypted authentication key having been encrypted using a second encryption key corresponding to the second decryption key,
• wherein the first authentication processing unit acquires the encrypted authentication key and writes the encrypted authentication key into the key information holding unit,
• wherein the decryption processing unit decrypts the encrypted second decryption key using the first decryption key to obtain the second decryption key after the encrypted authentication key is written into the key information holding unit, decrypts the encrypted authentication key using the second decryption key to obtain the authentication key only when the first condition is satisfied, and outputs the authentication key only when a second condition is satisfied, the second condition indicating a condition for outputting the authentication key after decryption of the encrypted authentication key,
• wherein the second condition is a condition that integrity of the application program is maintained,
• wherein the first authentication processing unit performs second authentication processing with the first integrated circuit using the authentication key, when the authentication key is output by the decryption processing unit, and
• wherein the second authentication processing unit performs the second authentication processing with the second integrated circuit using the authentication key, after the authentication key is transmitted by the transmission unit.