Method and apparatus for cryptographic processing

• US 9,712,499 B2
• Filed: 03/25/2015
• Issued: 07/18/2017
• Est. Priority Date: 03/31/2014
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Sakemi, Yumi, Izu, Tetsuya, Takenaka, Masahiko
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US14/667,832
• Publication Number:
  US 20150281188A1
• Time in Patent Office: 846 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A cryptographic processing apparatus that holds a first key, and receives authentication object data upon authentication includes a communication unit and a computing unit. The communication unit communicates with a calculation apparatus and a determination apparatus. In the calculation apparatus, encrypted registration data obtained by encrypting registration data twice, once with the first key and once with a second key, is registered. The registration data is data against which the authentication object data is verified. The determination apparatus uses the second key upon the authentication. When registering the encrypted registration data in the calculation apparatus, the computing unit generates a key different from the first key, generates encrypted data by encrypting the registration data twice, once with the first key and once with the different key, transmits the different key to the determination apparatus, and the encrypted data to the calculation apparatus, through the communication unit.

Claims

1. A non-transitory computer-readable storage medium storing a computer program that causes a computer having a memory and a processor, to perform a process comprising:

acquiring, by the processor, a first key and a second key different from the first key, from the memory;

generating, by the processor, first encrypted data by making a logical calculation between data for authentication and the first key, and generating second encrypted data by making the logical calculation between the first encrypted data and the second key;

transmitting, by the processor, the second encrypted data to a calculation apparatus which manages third encrypted data as registered data, the third encrypted data being generated by making the logical calculation between the first encrypted data and a third key; and

transmitting, by the processor, the second key to a determination apparatus which maintains the third key, generates encrypted key data by making the logical calculation between a key received from the computer and the third key, and transmits the encrypted key data to the calculation apparatus;

receiving, by the processor, an authentication result from the determination apparatus, wherein the authentication result is based on the data for authentication;

wherein the third encrypted data are equal to data generated by making the logical calculation between the second encrypted data and the encrypted key data.

2. The non-transitory computer-readable storage medium according to claim 1, wherein:

the calculation apparatus generates the third encrypted data by using the second encrypted data received from the computer and the encrypted key data received from the determination apparatus.

3. The non-transitory computer-readable storage medium according to claim 1, wherein at least one of the first key and the second key is generated using a specified key generation function.

4. A cryptographic processing method executed by a computer having a memory and a processor, the cryptographic processing method comprising:

acquiring, by the processor, a first key and a second key different from the first key, from the memory;

generating, by the processor, first encrypted data by making a logical calculation between data for authentication and the first key, and generating second encrypted data by making the logical calculation between the first encrypted data and the second key;

transmitting, by the processor, the second encrypted data to a calculation apparatus which manages third encrypted data as registered data, the third encrypted data being generated by making the logical calculation between the first encrypted data and a third key; and

transmitting, by the processor, the second key to a determination apparatus which maintains the third key, generates encrypted key data by making the logical calculation between a key received from the computer and the third key, and transmits the encrypted key data to the calculation apparatus;

receiving an authentication result from the determination apparatus, wherein the authentication result is based on the data for authentication;

wherein the third encrypted data are equal to data generated by making the logical calculation between the second encrypted data and the encrypted key data.

5. A cryptographic processing apparatus comprising:

a memory configured to store a first key and a second key different from the first key; and

a processor configured to perform a process including;

generating first encrypted data by making a logical calculation between data for authentication and the first key, and generating second encrypted data by making the logical calculation between the first encrypted data and the second key;

transmitting the second encrypted data to a calculation apparatus which manages third encrypted data as registered data, the third encrypted data being generated by making the logical calculation between the first encrypted data and a third key; and

transmitting the second key to a determination apparatus which maintains the third key, generates encrypted key data by making the logical calculation between a key received from the cryptographic processing apparatus and the third key, and transmits the encrypted key data to the calculation apparatus;

receiving an authentication result from the determination apparatus, wherein the authentication result is based on the data for authentication;

wherein the third encrypted data are equal to data generated by making the logical calculation between the second encrypted data and the encrypted key data.

6. The cryptographic processing apparatus according to claim 5, wherein:

the calculation apparatus generates the third encrypted data by using the second encrypted data received from the cryptographic processing apparatus and the encrypted key data received from the determination apparatus.

7. The cryptographic processing apparatus according to claim 5, wherein at least one of the first key and the second key is generated using a specified key generation function.