METHOD AND APPARATUS FOR CRYPTOGRAPHIC PROCESSING

• US 20150281188A1
• Filed: 03/25/2015
• Published: 10/01/2015
• Est. Priority Date: 03/31/2014
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: SAKEMI, Yumi, IZU, Tetsuya, TAKENAKA, Masahiko
• Granted Patent: US 9,712,499 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A cryptographic processing apparatus that holds a first key, and receives authentication object data upon authentication includes a communication unit and a computing unit. The communication unit communicates with a calculation apparatus and a determination apparatus. In the calculation apparatus, encrypted registration data obtained by encrypting registration data twice, once with the first key and once with a second key, is registered. The registration data is data against which the authentication object data is verified. The determination apparatus uses the second key upon the authentication. When registering the encrypted registration data in the calculation apparatus, the computing unit generates a key different from the first key, generates encrypted data by encrypting the registration data twice, once with the first key and once with the different key, transmits the different key to the determination apparatus, and the encrypted data to the calculation apparatus, through the communication unit.

Claims

1. A non-transitory computer-readable storage medium storing a computer program that causes a computer, which holds a first key, and receives authentication object data upon authentication, to perform a process comprising:

generating a key different from the first key and transmitting the different key to a determination apparatus, when registering encrypted registration data in a calculation apparatus by communicating with the calculation apparatus and the determination apparatus that uses a second key upon the authentication, the encrypted registration data being obtained by encrypting registration data twice, once with the first key and once with the second key, the registration data being data against which the authentication object data is verified; and

generating encrypted data by encrypting the registration data twice, once with the first key and once with the different key, and transmitting the encrypted data to the calculation apparatus.

2. The non-transitory computer-readable storage medium according to claim 1, wherein:

the different key is the second key; and

the calculation apparatus performs registration of the encrypted registration data, using the encrypted data.

3. The non-transitory computer-readable storage medium according to claim 1, wherein:

the different key is a temporary key that is newly generated each time the encrypted registration data is registered in the calculation apparatus;

the determination apparatus holds the second key, generates encrypted key data by encrypting the second key with the temporary key, and transmits the encrypted key data to the calculation apparatus; and

the calculation apparatus generates the encrypted registration data, using the encrypted data and the encrypted key data, and performs registration of the encrypted registration data.

4. The non-transitory computer-readable storage medium according to claim 1, wherein one or both of the first key and the different key are generated using a specified key generation function.

5. A cryptographic processing method executed by a computer that holds a first key in a memory, and receives authentication object data upon authentication, the cryptographic processing method comprising:

generating, by a processor, a key different from the first key and transmitting the different key to a determination apparatus, when registering encrypted registration data in a calculation apparatus by communicating with the calculation apparatus and the determination apparatus that uses a second key upon the authentication, the encrypted registration data being obtained by encrypting registration data twice, once with the first key and once with the second key, the registration data being data against which the authentication object data is verified; and

generating, by the processor, encrypted data by encrypting the registration data twice, once with the first key and once with the different key, and transmitting the encrypted data to the calculation apparatus.

6. A cryptographic processing apparatus comprising:

a memory configured to store a first key; and

a processor configured to perform a process including;

receiving authentication object data upon authentication,

communicating with a calculation apparatus in which encrypted registration data obtained by encrypting registration data twice, once with the first key and once with the second key, is to be registered, the registration data being data against which the authentication object data is verified, and with a determination apparatus that uses the second key upon the authentication,

generating a key different from the first key, when registering the encrypted registration data in the calculation apparatus,

generating encrypted data by encrypting the registration data twice, once with the first key and once with the different key,

transmitting the different key to the determination apparatus, and

transmitting the encrypted data to the calculation apparatus.

7. The cryptographic processing apparatus according to claim 6, wherein:

the different key is the second key; and

the calculation apparatus performs registration of the encrypted registration data, using the encrypted data.

8. The cryptographic processing apparatus according to claim 6, wherein:

the different key is a temporary key that is newly generated each time the encrypted registration data is registered in the calculation apparatus;

the determination apparatus holds the second key, generates encrypted key data by encrypting the second key with the temporary key, and transmits the encrypted key data to the calculation apparatus; and

the calculation apparatus generates the encrypted registration data, using the encrypted data and the encrypted key data, and performs registration of the encrypted registration data.

9. The cryptographic processing apparatus according to claim 6, wherein one or both of the first key and the different key are generated using a specified key generation function.