AUTHENTICATION SYSTEM AND AUTHENTICATION DEVICE

• US 20090292918A1
• Filed: 12/15/2006
• Published: 11/26/2009
• Est. Priority Date: 12/20/2005
• Status: Abandoned Application

• Current Assignee: Panasonic Corporation (Panasonic Holdings Corporation)
• Original Assignee: Panasonic Corporation (Panasonic Holdings Corporation)
• Inventors: Mori, Iichiro, Nakashima, Shota
• Application Number:
  US12/097,998
• Publication Number:
  US 20090292918A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An authentication system is provided with a server device for generating a random number used for authentication and check data obtained by encrypting the random number using an encryption key, an authentication device for authenticating a device to be authenticated by transmitting the random number transmitted from the server device to the device to be authenticated and comparing reply data transmitted from the device to be authenticated with check data transmitted from the server device, and the device to be authenticated for encrypting the random number transmitted from the authentication device using the encryption key and transmitting the encrypted random number as reply data.

Claims

1-19. -19. (canceled)

20. An authentication system, comprising a device to be authenticated, an authentication device for authenticating the device to be authenticated, and a server device connected with the authentication device via a network,

wherein:

the server device includes;

a server-side encryption key storage for storing an encryption key for the authentication beforehand,

a check data generating section for generating check data by encrypting specified authentication data used for the authentication by a preset encryption method using the encryption key stored in the server-side encryption key storage,

a server-side communicating section for communicating with the authentication device via the network, and

a server-side transmitting section for causing the server-side communicating section to transmit the authentication data to the authentication device;

the authentication device includes;

a first authenticating-side communicating section for communicating with the server device via the network,

a second authenticating-side communicating section for communicating with the device to be authenticated, and

an authenticating-side transmitting section for causing the second authenticating-side communicating section to transmit the authentication data received by the first authenticating-side communicating section to the device to be authenticated;

the device to be authenticated includes;

an authenticated-side encryption key storage for storing the encryption key beforehand,

an authenticated-side communicating section for communicating with the authentication device, and

an encrypting section for, if the authentication data is received from the second authenticating-side communicating section by the authenticated-side communicating section, encrypting the received authentication data by the encryption method using the encryption key stored in the authenticated-side encryption key storage;

the authenticated-side communicating section transmits the data encrypted by the encrypting section as reply data to the second authenticating-side communicating section; and

the authentication device further includes an authenticating section for authenticating the device to be authenticated based on the reply data received by the second authenticating-side communicating section and the check data generated by the check data generating section.

21. An authentication system according to claim 20, wherein:

the server-side transmitting section causes the server-side communicating section to transmit the check data generated by the check data generating section to the first authenticating-side communicating section;

the authentication device further includes an authenticating-side data storage for storing the authentication data received from the server-side communicating section by the first authenticating-side communicating section and the check data in correspondence; and

the authenticating section compares the reply data received by the second authenticating-side communicating section and the check data stored in correspondence with the authentication data in the authenticating-side data storage and judges a success of authentication if the two data coincide while judging a failure of authentication unless the two data coincide.

22. An authentication system according to claim 21, wherein:

the check data generating section encrypts a plurality of authentication data by the encryption method using encryption keys respectively stored in the server-side encryption key storage to generate a plurality of check data;

the server-side transmitting section causes the server-side communicating section to transmit the plurality of authentication data and the plurality of check data generated by the check data generating section to the first authenticating-side communicating section via the network;

the authenticating-side data storage stores the plurality of authentication data and the plurality of check data received by the first authenticating-side communicating section; and

the authenticating-side transmitting section causes the second authenticating-side communicating section to transmit any one of the plurality of authentication data stored in the authenticating-side data storage to the authenticated-side communicating section.

23. An authentication system according to claim 21, further comprising an authentication data generating section for regularly generating the authentication data,

wherein:

the check data generating section generates the check data based on the authentication data regularly generated by the authentication data generating section; and

the server-side transmitting section causes the server-side communicating section to transmit the regularly generated authentication data and the check data generated based on the authentication data to the first authenticating-side communicating section via the network.

24. An authentication system according to claim 20, wherein:

the authenticating-side transmitting section causes the first authenticating-side communicating section to transmit the reply data received by the second authenticating-side communicating section to the server-side communicating section;

the server device further includes a server-side authenticating section for comparing the check data generated by the check data generating section and the reply data received by the server-side communicating section and judging a success of authentication if the two data coincide while judging a failure of authentication unless the two data coincide;

the server-side transmitting section causes the server-side communicating section to transmit a judgment result by the server-side authenticating section to the first authenticating-side communicating section; and

the authenticating section authenticates the device to be authenticated based on the judgment result received by the first authenticating-side communicating section.

25. An authentication system according to claim 20, wherein:

the server device further includes;

an encryption key generating section for generating a new encryption key,

an update key information generating section for generating update key information by encrypting the generated new encryption key by the encryption method using the encryption key stored in the server-side encryption key storage if the new encryption key is generated by the encryption key generating section, and

an encryption key updating section for storing the generated new encryption key in the server-side encryption key storage if the new encryption key is generated by the encryption key generating section;

the server-side transmitting section causes the server-side communicating section to transmit the update key information generated by the update key information generating section to the first authenticating-side communicating section;

the authenticating-side transmitting section causes the second authenticating-side communicating section to transmit the received update key information to the authenticated-side communicating section if the update key information is received by the first authenticating-side communicating section; and

the device to be authenticated further includes;

a decrypting section for decrypting the received update key information using the encryption key stored in the authenticated-side encryption key storage if the update key information is received by the authenticated-side communicating section, and

an encryption key updating section for storing the encryption key decrypted by the decrypting section as a new encryption key in the authenticated-side encryption key storage.

26. An authentication system according to claim 20, wherein:

the server-side encryption key storage further stores an update encryption key for encrypting a new encryption key;

the server device further includes;

an encryption key generating section for generating a new encryption key,

an update key information generating section for generating update key information by encrypting the generated new encryption key by the encryption method using the update encryption key stored in the server-side encryption key storage if the new encryption key is generated by the encryption key generating section, and

an encryption key updating section for storing the generated new encryption key in the server-side encryption key storage if the new encryption key is generated by the encryption key generating section;

the server-side transmitting section causes the server-side communicating section to transmit the update key information generated by the update key information generating section to the first authenticating-side communicating section;

the authenticating-side transmitting section causes the second authenticating-side communicating section to transmit the received update key information to the authenticated-side communicating section if the update key information is received by the first authenticating-side communicating section;

the authenticated-side encryption key storage further stores the update encryption key beforehand; and

the device to be authenticated further includes;

a decrypting section for decrypting the received update key information using the update encryption key stored in the authenticated-side encryption key storage if the update key information is received by the authenticated-side communicating section, and

an encryption key updating section for storing the encryption key decrypted by the decrypting section as a new encryption key in the authenticated-side encryption key storage.

27. An authentication system according to claim 25, wherein the server device further includes an encryption key generation administrating section for causing the encryption key generating section to generate the new encryption key regularly or as scheduled.

28. An authentication system according to claim 27, wherein the schedule for generating the encryption key is programmed utilizing a calendar timer, the number of accesses for authentication or a cumulative operating time of the device.

29. An authentication system according to claim 20, wherein:

the authentication device is a charging device including;

a connection terminal connectable with a secondary battery,

a charging section for charging the secondary battery connected with the connection terminal and

a charge controller for controlling the operation of the charging section in accordance with the judgment result of the authenticating section; and

the device to be authenticated is a battery pack further including the secondary battery.

30. An authentication system according to claim 29, wherein the charge controller prohibits the charging of the secondary battery by the charging section if the failure of authentication was judged by the authenticating section.

31. An authentication system according to claim 29, wherein the charge controller sets a voltage to be supplied by the charging section to charge the secondary battery lower than a voltage supplied to charge the secondary battery by the charging section in the case of judging the success of authentication by the authenticating section if the failure of authentication was judged by the authenticating section.

32. An authentication system according to claim 29, wherein:

the authentication device is a mobile phone terminal further including a phone processing section for conducting radio communication by power supplied from the secondary battery; and

the network is a mobile phone line.

36. An authentication system according to claim 20, wherein:

the device to be authenticated includes a first integrated circuit for ID tag having;

a first storage for storing a specified encryption key,

a first receiving section for receiving the authentication data as a password,

a first encryption data generating section for generating an encryption data by encrypting the password received by the receiving section by a preset encryption method using the encryption key stored in the first storage, and

a first transmitting section for transmitting the encryption data generated by the first encryption data generating section;

the first storage is used as the authenticated-side encryption key storage;

the first receiving section and the first transmitting section are used as the authenticated-side communicating section;

the first encryption data generating section is used as the encrypting section; and

the encryption data transmitted from the first transmitting section is used as the reply data.

37. An authentication system according to claim 36, wherein:

the server device includes a second integrated circuit for ID tag having;

a second storage for storing the same encryption key as the one stored in the first storage,

a second receiving section for receiving the authentication data as a password, and

a second encryption data generating section for generating an encryption data by encrypting the password received by the second receiving section by the same encryption method as the one used in the first encryption data generating section using the encryption key stored in the second storage;

the second storage is used as the server-side encryption key storage; and

the check data generating section causes the second integrated circuit to generate the encryption data by transmitting the authentication data to the second receiving section and generates the check data by receiving the generated encryption data transmitted from the second transmitting section as the check data.

38. An authentication system according to claim 37, wherein:

the server device further includes a connecting portion to which the second integrated circuit is detachably attachable; and

the check data generating section transmits the authentication data to the second receiving section in the second integrated circuit attached to the connecting portion and receives the encryption data generated by the second integrated circuit via the connecting portion.

33. An authentication device connected with a server device via a network for authenticating a device to be authenticated, comprising:

a first authenticating-side communicating section for communicating with the server device via the network;

a second authenticating-side communicating section for communicating with the device to be authenticated;

an authenticating-side transmitting section for, if specified authentication data transmitted from the server device is received by the first authenticating-side communicating section, causing the second authenticating-side communicating section to transmit the received authentication data to the device to be authenticated; and

an authenticating section for, if reply data obtained by encrypting the authentication data using preset encryption method and encryption key by the device to be authenticated is received by the second authenticating side communicating section, authenticating the device to be authenticated based on check data obtained by encrypting the authentication data using the encryption method and encryption key and the reply data received by the second authenticating-side communicating section.

34. An authentication device according to claim 33, wherein:

the check data is transmitted from the server device;

the authentication device further comprises an authenticating-side data storage for storing the received check data if the check data transmitted from the server device is received by the first authenticating-side communicating section; and

the authenticating section compares the received reply data and the check data stored in the authenticating-side data storage if the reply data is received by the second authenticating-side communicating section and judges a success of authentication if the two data coincide while judging a failure of authentication unless the two data coincide.

35. An authentication device according to claim 33, wherein:

the authenticating-side transmitting section causes the first authenticating-side communicating section to transmit the received reply data to the server device if the reply data is received by the second authenticating-side communicating section; and

the authenticating section authenticates the device to be authenticated based on a judgment result if the judgment result on the authentication based on the reply data obtained by the server device is received.