JP6540381B2 - Information processing system and encryption communication method - Google Patents

Description

  The present invention relates to an information processing system and an encryption communication method for performing encryption communication based on a predetermined encryption protocol between two sets of information processing devices, and in particular, performs encryption communication between an IC card and another device Encryption communication technology suitable for

  In order to ensure the security of the communication between the two information processing apparatuses, it is essential to establish a secure encryption communication path between the two and to perform encryption communication via this encryption communication path. In particular, in portable information processing apparatuses such as smartphones and IC cards, since there is a possibility that they may be lost in the hands of malicious parties, it is necessary to take sufficient security measures.

  Recently, portable terminal devices such as smartphones have become widespread, and these terminal devices are usually equipped with an IC card called a SIM card or a UIM card. Then, information is exchanged between the IC card and the terminal device or between the IC card and an external server device through a predetermined communication path. At this time, if the information has confidentiality, it is necessary to establish a secure communication path to exchange encrypted information.

  Under such circumstances, various methods have been proposed for establishing a secure communication path between an IC card and an external device to perform encrypted communication. For example, Patent Document 1 below discloses a technique for preventing leakage of confidential information by performing communication via a proxy device having a data conversion processing function based on a predetermined conversion algorithm. Further, Patent Document 2 discloses a technology for performing encrypted communication using a public key encryption method when exchanging information between an IC card and a server device via the Internet. In No. 3, there is disclosed a technology for performing system restoration processing promptly when an abnormality related to security is detected during such encrypted communication. On the other hand, in Patent Document 4, an IC card and an IC card corresponding area corresponding to one to one are provided on the server apparatus side, and a secure communication path is set between the IC card corresponding area and the user terminal apparatus. Discloses a technology for integrating a server device and an IC card.

Japanese Patent Application Laid-Open No. 2002-055961 JP, 2002-217895, A JP, 2006-190222, A Unexamined-Japanese-Patent No. 2010-073188

  In order to establish a secure encryption communication path between the two sets of information processing apparatuses, both apparatuses need to have an encryption communication processing function based on a common encryption protocol. That is, the transmission side encrypts and sends out information to be transmitted using a predetermined encryption key and a predetermined encryption protocol, and the reception side encrypts the received encryption information with the same encryption key as the transmission side. It will decode using a protocol. Therefore, an encryption communication processing function using a specific encryption key and an encryption protocol is incorporated in advance in the two sets of information processing apparatuses.

  However, in recent years, the communication partners of the information processing apparatus have diversified, and there are not a few cases in which one IC card communicates with a plurality of partners according to various situations. For example, in the case of an IC card (SIM card or UIM card) attached to a smartphone, there are many cases where information is exchanged with a plurality of application programs in the smartphone. In this case, hardware means two-way communication between the IC card and the smartphone, but software means a program on the IC card side (usually a program called SD (Security Domain)) and the smartphone side There will be separate communication between each application program.

  On the other hand, recently, a more secure encryption protocol has been recommended, and there are a wide variety of encryption protocols that are actually used. Therefore, practically, one IC card is provided in advance with an encryption communication function based on a plurality of encryption protocols, and according to the convenience of an external device that communicates with the IC card (for example, in a smart phone In accordance with the convenience of the application program), it is preferable to select an arbitrary encryption protocol each time to perform encryption communication.

  However, in a conventional general system, particularly a system for communicating with an IC card, one IC card is provided with an encryption communication function based on a plurality of encryption protocols, and in each case, any encryption protocol It is difficult to select and perform encrypted communication. This is because currently popular IC cards are designed in compliance with international specifications, and any one of multiple encryption protocols can be selected to correspond to such specifications. Because it was difficult to use it.

  Therefore, the present invention establishes an encrypted communication path based on an arbitrary encryption protocol selected from among a plurality of encryption protocols between two sets of information processing apparatuses, enabling secure communication between the two. It is an object of the present invention to provide an information processing system and an encrypted communication method. The present invention is also directed to a specific encryption protocol in a manner in accordance with the international specification for an IC card, in particular when one of the two sets of information processing devices communicating with each other is an IC card. It is an object of the present invention to provide a specific method of transmitting the selection of

(1) A first aspect of the present invention is an information processing system including a first information processing apparatus and a second information processing apparatus, and capable of performing cryptographic communication based on a predetermined encryption protocol between the two.
The first information processing apparatus
It has a function of performing encryption communication based on a plurality N (N ≧ 2) encryption protocols, and among the N encryption protocols, encryption communication based on an encryption protocol designated by the second information processing apparatus A first encryption communication processing unit for establishing an encryption communication path for performing the communication, and performing encryption communication with the second information processing apparatus via the opened encryption communication path;
A first encryption key storage unit having a plurality of storage locations for storing encryption keys, and storing the encryption keys used for each of a plurality of N encryption protocols in the plurality of storage locations;
Provide
The second information processing apparatus
It has a function of performing encryption communication based on at least one specific encryption protocol among the N kinds of encryption protocols, and an encrypted communication path established for performing encryption communication based on the specific encryption protocol A second encryption communication processing unit that performs encryption communication with the first information processing apparatus via
A second encryption key storage unit storing an encryption key used for the specific encryption protocol;
An encrypted communication path establishment instructing unit for giving an encrypted communication path establishment command for instructing the first information processing apparatus to establish an encrypted communication path for performing encrypted communication;
Provide
The encryption communication path establishment command includes protocol specification information for specifying the specific encryption protocol and encryption key specification information for specifying the specific encryption key.
The first encryption communication processing unit transmits the encryption protocol specified by the protocol specification information included in the encryption communication path open command and the encryption key specified by encryption key specification information included in the encryption communication path open command. To establish an encrypted communication path for performing encrypted communication.

(2) According to a second aspect of the present invention, in the information processing system according to the first aspect described above,
In the first encryption key storage unit, N storage zones corresponding to N encryption protocols are set, and storage locations belonging to the i-th (1 ≦ i ≦ N) storage zone Stores the encryption key used for the i-th encryption protocol,
The encryption channel establishment command includes storage location designation information indicating a storage location of a specific encryption key,
The first encryption communication processing unit recognizes the storage location designation information as information having both roles of protocol designation information and encryption key designation information, and stores the storage location designation information in the storage location indicated by the storage location designation information. The encryption communication path for performing the encryption communication based on the encryption protocol corresponding to the storage zone to which the storage location indicated by the storage location designation information belongs is established using the encryption key. .

(3) According to a third aspect of the present invention, in the information processing system according to the second aspect described above,
The first encryption key storage unit is provided with a plurality of storage locations specified by key version numbers, and each storage zone is configured by one or more storage locations,
The encryption channel establishment command includes a specific key version number as storage location designation information,
The first encryption communication processing unit uses the encryption key stored in the storage location specified by the key version number, and uses the encryption protocol corresponding to the storage zone to which the storage location indicated by the key version number belongs. It is intended to establish an encrypted communication path for performing encrypted communication based on the above.

(4) According to a fourth aspect of the present invention, in the information processing system according to the third aspect described above,
Each storage zone consists of one storage location or multiple storage locations with consecutive key version numbers, such that each storage zone is associated with a unique numeric range of key version numbers is there.

(5) According to a fifth aspect of the present invention, in the information processing system according to the third or fourth aspect described above,
In each storage location of the first encryption key storage unit, a plurality of storages respectively specified by key IDs are prepared, and in the whole or a part of the plurality of storages, different encryption keys are stored. Yes,
The first encryption communication processing unit is predetermined by the encryption protocol corresponding to the storage zone to which the storage location belongs, among the storages in the storage location specified by the key version number included in the encryption communication path establishment command. The encryption communication path is established using the encryption key stored in the storage identified by the predetermined key ID.

(6) According to a sixth aspect of the present invention, in the information processing system according to the first aspect described above,
Each storage location of the first encryption key storage unit stores an encryption key including key value data used for the encryption operation and type information indicating the type of encryption algorithm,
The encryption channel establishment command includes storage location designation information indicating a storage location of a specific encryption key,
The first encryption communication processing unit recognizes the storage location designation information as information having both roles of protocol designation information and encryption key designation information, and stores the storage location designation information in the storage location indicated by the storage location designation information. Using the key value data contained in the existing encryption key, an encryption communication path for performing encryption communication based on the encryption protocol indicated by the type information contained in the encryption key is established. It is a thing.

(7) According to a seventh aspect of the present invention, in the information processing system according to the sixth aspect described above,
Each storage location of the first encryption key storage unit includes key value data used for the encryption operation, type information indicating the type of encryption algorithm, and a key length indicating the length of the key value data. An encryption key is stored,
The first encryption communication processing unit extracts key value data from the encryption key based on the key length.

(8) An eighth aspect of the present invention relates to the information processing system according to the sixth or seventh aspect described above,
In each storage location of the first encryption key storage unit, a plurality of storages respectively specified by key IDs are prepared, and in the whole or a part of the plurality of storages, different encryption keys are stored. The same type information is included in the encryption keys stored in multiple storages belonging to the same storage location.
The first encryption communication processing unit is configured to use the encryption indicated by the type information included in the encryption key stored in any storage in the storage location specified by the encryption key specification information included in the encryption communication path establishment command. An encryption communication path for performing encryption communication based on the communication protocol is established.

(9) According to a ninth aspect of the present invention, in the information processing system according to the first aspect described above,
The encrypted communication path establishment command includes command character string information indicating a character string instructing the establishment of an encrypted communication path based on a specific encryption protocol, and storage location designation information indicating a storage location of a specific encryption key. Are
The first encryption communication processing unit recognizes the command string information as the protocol specification information, and recognizes the storage area specification information as the encryption key specification information, whereby the storage area indicated by the storage area specification information is stored. By using the stored encryption key, an encryption communication path for performing encryption communication based on the encryption protocol corresponding to the command string information is established.

(10) A tenth aspect of the present invention relates to the information processing system according to the ninth aspect described above,
In each storage location of the first encryption key storage unit, a plurality of storages respectively specified by key IDs are prepared, and in the whole or a part of the plurality of storages, different encryption keys are stored. Yes,
The first encryption communication processing unit encrypts, in the storage in the storage location specified by the encryption key specification information included in the encryption channel establishment command, the encryption corresponding to the command character string information included in the encryption channel establishment command. The encryption communication path is established using the encryption key stored in the storage identified by the predetermined key ID predetermined by the protocol.

(11) According to an eleventh aspect of the present invention, in the information processing system according to the first to tenth aspects described above,
The second cryptographic communication processing unit is based on at least a plurality M of (M ≦ N) of the plurality of N cryptographic protocols in which the first cryptographic communication processing unit is equipped with the cryptographic communication function. It has a function of performing encrypted communication, and is connected to the first information processing apparatus via an encrypted communication path established to perform encrypted communication based on a specific encryption protocol selected from the M encryption protocols above. Perform cryptographic communication between
The second encryption key storage unit has a plurality of storage locations for storing encryption keys, and the plurality of storage locations are stored in the first encryption key storage unit of the first information processing apparatus. The same encryption key as “the encryption key used for each of the M encryption protocols described above” is stored,
An encryption communication path establishment instructing unit selects a specific encryption protocol from the M encryption protocols and performs encryption communication based on the selected encryption protocol to the first information processing apparatus. An encrypted communication path establishment command for instructing establishment of a communication path is given.

  (12) According to a twelfth aspect of the present invention, the first information processing apparatus in the information processing system according to the first to eleventh aspects described above is configured of an IC card or another information processing apparatus.

  (13) According to a thirteenth aspect of the present invention, the second information processing apparatus in the information processing system according to the first to eleventh aspects described above is configured by a smartphone or another information processing apparatus.

  (14) According to a fourteenth aspect of the present invention, the first information processing apparatus or the second information processing apparatus in the information processing system according to any of the first to eleventh aspects described above is configured by incorporating a program into a computer It is

(15) A fifteenth aspect of the present invention is an encryption communication method for performing encryption communication based on a predetermined encryption protocol between a first information processing device and a second information processing device,
A program preparation stage in which the first information processing apparatus prepares a program for performing encryption communication based on a plurality N (NN2) encryption protocols in an executable state;
An encryption key storage step in which the first information processing apparatus stores encryption keys used for each of the N encryption protocols in a plurality of storage locations for storing encryption keys;
The second information processing apparatus identifies the first information processing apparatus in the encryption key storage stage based on the specific encryption protocol selected from the N encryption protocols prepared in the program preparation stage. An encrypted communication path establishment instruction step of transmitting an encrypted communication path establishment command for instructing establishment of an encrypted communication path for performing encrypted communication using a specific encryption key stored in the storage location of
An encryption communication path establishment phase in which the first information processing apparatus establishes an encryption communication path for performing encryption communication based on the specific encryption protocol based on the received encryption communication path establishment command;
An encryption communication step in which the first information processing apparatus and the second information processing apparatus perform encryption communication via the established encryption communication path;
To do
At the encryption communication path establishment instruction stage, an encryption communication path establishment command including protocol specification information for specifying the specific encryption protocol and encryption key specification information for specifying the specific encryption key is transmitted. And
In the encryption channel establishment stage, the encryption protocol designated by the protocol designation information included in the encryption channel establishment command and the encryption key designated by the encryption key designation information included in the encryption channel establishment command are used. Then, an encryption communication path for performing encryption communication is established.

(16) According to a sixteenth aspect of the present invention, in the encrypted communication method according to the fifteenth aspect described above,
In the encryption key storage stage, N storage zones corresponding to N encryption protocols are set, and the storage location belonging to the i-th (1 ≦ i ≦ N) storage zone is the i-th Store the encryption key used for the encryption protocol of
At the encryption communication path establishment instruction stage, an encryption communication path establishment command including storage location designation information indicating a storage location of a specific encryption key is transmitted;
In the encryption communication path establishment stage, the storage location designation information is recognized as information having both roles of protocol designation information and encryption key designation information, and is stored in the storage location indicated by the storage location designation information. By using the encryption key, an encrypted communication path for performing encrypted communication based on the encryption protocol corresponding to the storage zone to which the storage location indicated by the storage location designation information belongs is established.

(17) A seventeenth aspect of the present invention is the encryption communication method according to the fifteenth aspect described above,
Storing an encryption key including key value data used for an encryption operation and type information indicating a type of encryption algorithm in the encryption key storage stage;
At the encryption communication path establishment instruction stage, an encryption communication path establishment command including storage location designation information indicating a storage location of a specific encryption key is transmitted;
In the encryption communication path establishment stage, the storage location designation information is recognized as information having both roles of protocol designation information and encryption key designation information, and is stored in the storage location indicated by the storage location designation information. An encryption communication path for performing encryption communication based on the encryption protocol indicated by the type information included in the encryption key is established using key value data included in the encryption key. is there.

(18) According to an eighteenth aspect of the present invention, in the encrypted communication method according to the fifteenth aspect described above,
At the encryption communication path establishment instruction stage, it includes command character string information indicating a character string instructing the establishment of an encryption communication path based on a specific encryption protocol, and storage location designation information indicating a storage location of a specific encryption key. Send the encryption channel open command,
In the encryption communication path establishment stage, the command character string information is recognized as protocol designation information, and the storage location designation information is recognized as encryption key designation information, so that it is stored in the storage location indicated by the storage location designation information. An encryption communication path for performing encryption communication based on the encryption protocol corresponding to the command string information is established using the encryption key.

  In the information processing system according to the present invention, at least a first information processing apparatus of two sets of information processing apparatuses is provided with a function of performing cryptographic communication based on a plurality N of encryption protocols, and a second information processing apparatus Since a specific encryption protocol is specified by the protocol specification information included in the encryption communication path establishment command given to the first information processing apparatus from any of the above, any one of a plurality of encryption protocols is selected. By establishing an encrypted communication path based on the encryption protocol, secure communication can be performed between the two.

  In particular, the invention according to the first embodiment is suitable when one of the two sets of information processing apparatuses is an IC card, and is storage location designation information indicating a storage location of the encryption key in the encryption communication path establishment command. In this case, a method of specifying the encryption protocol according to the storage zone to which the storage location belongs is adopted, so that a specific encryption is performed using an encryption channel establishment command conforming to the international specification for the IC card. It is possible to transmit the selection of the communication protocol to the IC card side.

  Similarly, the invention according to the second embodiment is also suitable when one of the two sets of information processing apparatuses is an IC card, and is a storage location specification that indicates the storage location of the encryption key in the encryption communication path establishment command. Since the method of including the information and designating the encryption protocol by the type information included in the specific encryption key is adopted, using the encryption communication path open command conforming to the international specification for the IC card It becomes possible to transmit the selection of a specific encryption protocol to the IC card side.

  The invention according to the third embodiment is also suitable when one of the two sets of information processing apparatuses is an IC card, and the encryption protocol is set according to the command character string information included in the encryption communication path establishment command. Since the designation method is adopted, it becomes possible to transmit the selection of a specific encryption protocol to the IC card side using the encryption communication path establishment command conforming to the international specification of the IC card.

FIG. 2 is a block diagram showing an aspect of information communication between a general smartphone 10, a SIM card 11, and an external server 20. It is a block diagram which shows an example of the program structure for performing encryption communication between the SIM card 11 shown in FIG. 1, and the smart phone 10 or the external server 20. As shown in FIG. It is a figure which shows the specific example of the key table shown in FIG. FIG. 5 is a diagram showing a general data structure of an encryption key Key stored in a key table shown in FIG. 3 and an outline of a data structure of an encryption communication path establishment command using the encryption key. It is a diagram which shows the specific example of the various commands exchanged between the SIM card 11 (1st information processing apparatus) shown in FIG. 2, and the smart phone 10 (2nd information processing apparatus), and the response with respect to this. . It is a block diagram showing basic composition of an information processing system concerning the present invention. It is a block diagram showing another basic composition of the information processing system concerning the present invention. It is a block diagram showing another basic composition of the information processing system concerning the present invention. It is a figure which shows an example of a zone configuration of key table T1 used for the 1st Embodiment of this invention. It is a figure which shows an example of the data structure of the encryption communication path establishment command CMD used for the 1st Embodiment of this invention. It is a figure which shows an example of the data structure of encryption key Key used for the 2nd Embodiment of this invention. It is a figure which shows an example of the data structure of the encryption communication path establishment command CMD used for the 3rd Embodiment of this invention. It is a table | surface which shows the correspondence of the command character string information in 3rd Embodiment of this invention, and the classification | category information of an encryption algorithm. It is a flowchart which shows the basic procedure of the encryption communication method which concerns on this invention.

  Hereinafter, the present invention will be described based on illustrated embodiments.

<<< 1. 1. Conventional general communication mode for IC card >>>
The present invention relates to a technology for performing encryption communication based on a predetermined encryption protocol between two sets of information processing apparatuses, and in particular, encryption communication suitable for performing encryption communication between an IC card and another apparatus It relates to technology. Here, first, a conventional general communication mode for an IC card will be briefly described.

  FIG. 1 is a block diagram showing an aspect of information communication between a general smartphone 10, a SIM card 11, and an external server 20. As shown in FIG. Usually, the smartphone 10 is used in a state in which the SIM card 11 is mounted inside, and communicates with the external server 20 via a predetermined communication path (the Internet or a telephone line) as necessary. Here, the SIM card 11 (also referred to as UIM card) is an IC card conforming to an international standard that has become a de facto standard such as Java Card (trademark) or GlobalPlatform (registered trademark), and an external device Communication is performed in the form of a command given from the external device and a response thereto.

  Focusing on the SIM card 11, both the smartphone 10 and the external server 20 are referred to as external devices, and communication with these external devices is performed via a predetermined communication path. Although only the communication path between the smart phone 10 and the external server 20 is shown in FIG. 1, actually, between the SIM card 11 and the smart phone 10 or between the SIM card 11 and the external server 20 as well. A communication path is formed. The present invention relates to a technology for establishing an encrypted communication path as these communication paths.

  FIG. 2 is a block diagram showing an example of a program configuration for performing encrypted communication between the SIM card 11 shown in FIG. 1 and the smartphone 10 or the external server 20. The present invention is a technology that can be widely applied when performing encryption communication between two general information processing devices, not limited to an IC card, and as a general theory, it is used for communication between any information processing devices It is possible. Therefore, FIG. 2 shows an example in which a communication path is established between the first information processing apparatus 100 and the second information processing apparatus 200 to communicate with each other.

  However, as described above, the present invention is a technology particularly suitable for performing encrypted communication with an IC card, and here, the first information processing apparatus 100 is the SIM card 11 mounted on the smartphone 10, The following description is given for the case where the second information processing apparatus 200 is the smart phone 10 (or the external server 20 may be used).

  Generally, a plurality of application programs are incorporated in an IC card such as the SIM card 11. The first information processing apparatus 100 (SIM card 11) in FIG. 2 shows a state in which two sets of application programs AP1 and AP2 are incorporated. Also, at least one SD program (Security Domain program) is usually incorporated in the IC card. The SD program is a kind of application program in classification, but plays a role of managing the operation of the entire IC card and other application programs in cooperation with the OS program.

Specifically, the following functions are incorporated in a general SD program.
<Function 1> IC card life cycle management <Function 2> Application program life cycle management <Function 3> Application instance life cycle management <Function 4> Application program loading <Function 5> Application instance generation (installation)
<Function 6> Delete application program and instance <Function 7> Write application issued data for application <Function 8> Read data <Function 9> Secure secure communication path Of the above functions, functions directly related to the present invention Is the function 9: securing a secure communication channel, and based on a predetermined encryption protocol generally called "SCP: Secure Channel Protocol", the external device (in the example shown in FIG. 2, the second information It is a function to establish a secure encryption communication path with the processing device 200) and perform encryption communication. In order to realize such a function, an encrypted communication path establishment routine R1 and a key table T1 are incorporated in the SD program.

  On the other hand, also in the second information processing apparatus 200, an application program AP3 having a function of performing encryption communication according to the second information processing apparatus 200 is prepared, and an encryption communication path establishment routine R2 and a key table T2 are incorporated. For example, when the second information processing apparatus 200 is the smartphone 10, the application program AP3 is one of the application programs installed in the smartphone 10.

  The encrypted communication path establishment routine R1 on the first information processing apparatus 100 side and the encrypted communication path establishment routine R2 on the second information processing apparatus 200 side establish a secure encryption communication path between the two apparatuses and the same. It is a routine for performing encryption communication based on the encryption protocol, and the same encryption key is accommodated in the key table T1 and the key table T2. Therefore, in the case of the illustrated example, the SD program and the application program AP3 make it possible to use the same encryption protocol between the first information processing apparatus 100 and the second information processing apparatus 200 using the same encryption key. An encrypted communication path for performing encrypted communication based on the above is established.

  Protocols such as SCP01 and SCP02 have long been used as encryption protocols used for encryption communication with IC cards. However, the problem of compromise is pointed out in the encryption algorithm "Triple-DES" used in these protocols, and in recent years, SCP03 using an encryption algorithm based on the AES (Advanced Encryption Standard) standard The protocol is also beginning to spread as a specification compliant with GlobalPlatform (registered trademark). In addition, the use of protocols such as SCP80 and SCP81 developed mainly by standardization organizations such as 3GPP / ETSI has also become widespread.

  Further, as the key table T for the SD program incorporated in the IC card, a specification using a key space as illustrated in FIG. 3 is generalized. The illustrated key table T is composed of a matrix in which key version numbers (key version numbers) are defined vertically and key IDs (key ID) are defined horizontally, and the key version numbers are in the range of 0x01 to 0x7F. An address space in the range of 0x00 to 0x7F is assigned to the key ID (0x at the beginning of the address indicates that the following numerical value is a hexadecimal number).

  Each encryption key is stored in any cell of this key table T, and is specified by the combination of the key version number and the key ID. For example, the combination of the key version number “0x01” and the key ID “0x01” specifies the encryption key KeyA. The figure shows a state in which KeyA to KeyR are stored in a specific cell as an example of storage of individual encryption keys. Of course, the encryption key does not need to be stored in all the cells, and it is sufficient if the necessary encryption key is stored in a predetermined cell.

  In one encryption protocol, one key version number is specified, and encryption processing or decryption processing is performed using one or more encryption keys stored in the cell having the key version number. Ru. In the case of the illustrated example, a state is shown in which an encryption key is stored in each row of key version numbers “0x01”, “0x20”, “0x21”, “0x22”, “0x7E”, and “0x7F”. In the case of the example of illustration, an encryption key is stored in the cell of three places of key ID "0x01", "0x02", "0x03" also about any key version number.

  This is because all key version numbers correspond to encryption protocols using three different encryption keys (for example, SCP01, SCP02, SCP03 described above, etc.). For example, when the key version number "0x20" is specified, the three encryption keys KeyD, KeyE, KeyF stored in the cells of the key IDs "0x01", "0x02", "0x03" are encrypted or decrypted. It will be used for processing. In other words, one or more encryption keys with the same key version number will be used for encryption processing or decryption processing based on a specific encryption protocol. Of course, for an encryption protocol that requires a total of five encryption keys, each of the five cells having the same key version number will be provided with an encryption key.

  4A shows a general data structure of the encryption keys KeyA to KeyR stored in the individual cells of the key table T shown in FIG. The data structure of the illustrated encryption key Key indicates the standard format of the encryption key Key defined as the international standard specification for the IC card described above, and the type information (key type) A, A key length (key length) L and key value data (key value) V are arranged. Here, the type information (key type) A is information including the type of encryption algorithm adopted by the encryption protocol that is assumed to use the encryption key Key, such as “AES”, “DES”, “RSA”, etc. The key length (key length) L is information indicating the data length (byte) of the subsequent key value data (key value) V, and the last key value data (key value) V is an encryption operation. It is the key value data itself to be used.

  FIG. 4B is a diagram showing an outline of the data structure of the encrypted communication path establishment command CMD. The actual command will have a more complicated data structure conforming to the standard such as ISO (for example, ISO 7816-4), but for the convenience of explanation, Fig. 4 (b) is necessary to explain the present invention. I will show the conceptual data structure which extracted only the important information. The illustrated example shows an opening command of the encryption communication path used when adopting the above-described encryption protocols SCP01, SCP02, and SCP03, and the character string "INITIALIZE UPDATE" instructing the establishment of the encryption communication path is obtained. Storage of command string information (actually, instruction byte information meaning command “INITIALIZE UPDATE”, but hereinafter described as a character string “INITIALIZE UPDATE” for convenience,) and storage location of a specific encryption key The location specification information (actually, a specific key version number) and a predetermined random number are included.

  For example, when establishing an encrypted communication path using three encryption keys KeyD, KeyE, and KeyF stored in the key table T shown in FIG. 3, a key version number "0x20" in the character string "INITIALIZE UPDATE" Is followed by an encrypted communication path establishment command CMD followed by a predetermined random number. The random number added at the end of the encrypted communication path establishment command CMD is used to authenticate that the external device is the IC card as a legitimate communication partner. In other words, the encrypted communication path establishment command CMD is an authentication command for requesting the IC card to return an authentication code corresponding to a predetermined random number together with a role as an instruction command for executing the establishment processing of the encrypted communication path. Also play a role as

  FIG. 5 is between the SD program incorporated in the SIM card 11 (first information processing apparatus 100) shown in FIG. 2 and the application program AP3 incorporated in the smartphone 10 (second information processing apparatus 200). Are diagrams showing examples of various commands exchanged in and responses to the commands. As shown in steps S1 to S6, the smartphone 10 transmits a predetermined command to the SIM card 11, and a response to the command is sent from the SIM card 11 to the smartphone 10. The exchange of information between the two will take place. In the case of this example, the exchange of information in the steps S1 to S4 is performed through a non-encrypted normal communication path, but the exchange of information in the steps S5 and S6 is an encrypted communication established by the SD program. It takes place through the road.

  First, step S1 is a process of transmitting a "SELECT command" from the smartphone 10 side to the SIM card 11 side. The “SELECT command” is a command for selecting a SD program on the SIM card 11 side by designating a specific channel number. On the SIM card 11 side, the channel number is associated with the SD program, and thereafter, when a command having the same channel number is given, the SD program is processed. When the “SELECT command” is correctly received, a response is returned from the SIM card 11 to the smartphone 10.

  The following step S2 is a process of transmitting a "GET DATA command". The command after step S2 is assigned the same channel number as in step S1, and on the SIM card 11 side, it is processed by the SD program. The "GET DATA command" is a command for reading predetermined data from the SIM card 11 side to the smartphone 10 based on the "function 8: data read" of the SD program described above, and data to be read out Information to identify is added. In response to the command, the SD program reads the designated data from the memory in the SIM card 11, and sends it back to the smartphone 10 as a response to the command.

  According to the GlobalPlatform (registered trademark) specification, when the SD program performs the above-mentioned "function 1 to function 7", exchange of information is executed via an encrypted communication path (a secure communication path established by function 9). Although it is considered essential, the establishment of an encrypted communication path is not mandatory for "function 8: reading data". The process of step S2 of FIG. 5 shows an example in which the data read process is performed before the establishment of the encrypted communication path.

  The following steps S3 and S4 are processes for preparing for establishment of the encrypted communication path. First, in step S3, transmission of an "INITIALIZE UPDATE command" is performed. This command is an encrypted communication path establishment command CMD having the data structure shown in FIG. 4B, and as described above, has a form in which a key version number and a random number are added to command character string information "INITIALIZE UPDATE". . This command also serves as an authentication command for authenticating that the smart phone 10 is the SIM card 11 as a legitimate contact.

  That is, the SIM card 11 (SD program) having received the "INITIALIZE UPDATE command" takes out the encryption key corresponding to the designated key version number from the key table T1, performs preparation for the encryption processing, and is given. An operation based on a predetermined algorithm is performed on the random number, and the operation result is returned as a response to the command. The smartphone 10 (application program AP3) verifies whether the operation result sent back is the correct operation result for the given random number, and if it is the correct operation result, the SIM card 11 currently in communication is Authenticate as a legitimate contact.

  In the subsequent step S4, transmission of "EXTERNAL AUTHENTICATE command" is performed. This command is an authentication command for authenticating that the SIM card 11 is the legitimate communication partner of the smartphone 10. The smartphone 10 performs an operation based on a predetermined algorithm on the data returned in response to the response in step S 3, adds the operation result to the command character string information “EXTERNAL AUTHENTICATE”, and transmits it to the SIM card 11. The SIM card 11 (SD program) verifies whether the calculation result transmitted by the “EXTERNAL AUTHENTICATE command” is a correct calculation result, and if it is a correct calculation result, the smartphone 10 currently in communication Certify as a legitimate contact.

  The specific process of the mutual authentication in the steps S3 and S4 is a publicly known technique that is generally used, and thus the detailed description is omitted here. Thus, when mutual authentication between the SIM card 11 and the smartphone 10 is completed, an encrypted communication path is established between the two, and the command after step S5 shown below the broken line in the figure is the encrypted communication path. It will be given through. That is, the command after step S5 is encrypted based on a predetermined encryption protocol, and is transmitted as a command protected by "SCP: Secure Channel Protocol".

  According to the current standard, it is possible to set a level for SCP at the time of establishment of the encryption communication path (at the time of processing of the "EXTERNAL AUTHENTICATE command"). Specifically, “level 1: check code addition for command tampering detection” and “level 2: check code addition for command tampering detection + encryption of command data field” are defined, and step S5 and subsequent steps are performed. The level set at the time of opening will be applied to the command exchanged. When such setting of the SCP level is performed, encryption is performed on the data field of the command after step S5 only when setting of the level 2 is performed.

  As described above, according to the specifications of GlobalPlatform (registered trademark), it is essential to transmit as a command protected by SCP, a command giving an instruction to cause the SD program to execute "Function 1 to Function 7". . Therefore, for example, a command for causing an SD program to execute processing for loading or installing an application program is encrypted as a command protected by SCP as shown in steps S5 and S6. Will be sent by In the examples of steps S5 and S6, the response to the command is not protected by the SCP, but is sent as plain text via the normal communication path, but if necessary, these responses are sent. Alternatively, the reply may be made via the encrypted communication path.

<<< 2. 2. Basic configuration of information processing system according to the present invention >>>
In the above-mentioned § 1, the procedure for establishing an encryption communication path between the SIM card 11 and the smartphone 10 has been described with reference to FIG. The encryption communication path established here is the same as a normal communication path as hardware. However, the data transmitted and received through this encryption communication path is encrypted by software based on a predetermined encryption protocol, so that the necessary security will be ensured even if it leaks .

  After all, “open encrypted communication path” means that the transmitter side completes preparation for the encryption process based on a predetermined encryption protocol, and the receiver side completes preparation for the decryption process based on the predetermined encryption protocol. It can be said that For that purpose, it is premised that the transmitting side and the receiving side use a common encryption protocol and use a common encryption key. Under these circumstances, conventionally, when incorporating an SD program into an IC card, a specific encryption protocol is selected, and for the SD program, “encryption using the selected specific encryption protocol is exclusively performed. It was set up to "open a communication path".

  For this reason, even if it is an SD program that originally supports three types of encryption protocols such as SCP01, SCP02, and SCP03, one of the encryption protocols is selected and installed at the time of installation on an IC card. After that, operation is performed such that only the encrypted communication path based on the selected encryption protocol is opened. Of course, with regard to the encryption key, a key table T as illustrated in FIG. 3 is prepared, and specification is made by the key version number when the encryption communication path is established, whereby any encryption key can be selected from a plurality of encryption keys. Although it is possible to select and use a key, as for the encryption protocol, it is not possible to select and use an arbitrary protocol from a plurality of protocols, and the diversity of selection is lost.

  Recently, there are a wide variety of encryption protocols. Specifically, encryption protocols such as SCP01, SCP02, SCP03, SCP10, SCP80 and SCP81 are actually used, and proposals for various encryption protocols are expected in the future. Further, the communication partners of the IC card are also diversified, and there are not a few cases where one IC card communicates with a plurality of partners according to various situations.

  For example, in a smart phone, a plurality of application programs are generally installed, and in many cases, an IC card mounted on the smart phone exchanges information with a plurality of application programs. In this case, if the SD program on the IC card side supports only a specific encryption protocol, the degree of freedom of the application program on the smartphone side is inevitably reduced.

  The present invention has been proposed to address such problems, and a cipher based on any encryption protocol selected from among a plurality of encryption protocols between two sets of information processing devices. The present invention provides a technology that establishes a communication path and enables secure communication between the two. Hereinafter, the basic configuration of the information processing system according to the present invention will be described with reference to FIG.

  The information processing system shown in FIG. 6 includes the first information processing apparatus 100 and the second information processing apparatus 200A, and is capable of performing cryptographic communication based on a predetermined encryption protocol between the two. Here, similarly to the example described in Section 1, the SIM card 11 is used as the first information processing apparatus 100, and the smartphone 10A to which the SIM card 11 is attached is used as the second information processing apparatus 200A. The following description will be given for the example used.

  As illustrated, the first information processing apparatus 100 is provided with a first encryption communication processing unit 110 that performs processing for opening an encryption communication path, and a first encryption key storage unit 120 that stores an encryption key. The first encryption communication processing unit 110 uses the encryption key stored in the first encryption key storage unit 120 to perform processing for establishing an encryption communication path. In the case of the embodiment shown here, the first encryption communication processing unit 110 is actually realized as a function of the SD program installed in the SIM card 11, and the first encryption key storage unit 120 is This is realized as an area of a part of the memory built in the SIM card 11 managed by this SD program.

  On the other hand, in the second information processing apparatus 200A, a second encrypted communication processing unit 210A that performs encrypted communication using the encrypted communication path established by the first encrypted communication processing unit 110, and an encryption key are stored. A cryptographic communication processing unit 220A of No. 2 and a cryptographic communication channel establishment instructing unit 230A for instructing the first cryptographic communication processing unit 110 to establish a cryptographic communication channel are provided. As described later, when the encrypted communication path establishment command CMD is transmitted from the encrypted communication path establishment instruction unit 230A to the first encrypted communication processing unit 110, the first encrypted communication processing unit 110 generates the command Based on the processing, the processing for establishing an encryption communication path is performed. After that, the second encrypted communication processing unit 210A performs encrypted communication via the encrypted communication path using the encryption key stored in the second encrypted communication processing unit 220A.

  In the case of the embodiment shown here, the second encrypted communication processing unit 210A and the encrypted communication path establishment instructing unit 230A are actually realized as a function of an application program installed in the smartphone 10A. The encrypted communication processing unit 220A is realized as an area of a part of the memory built in the smartphone 10A.

  After all, the first information processing apparatus 100 according to the present invention is realized by incorporating a dedicated program such as an SD program in a computer constituting an IC card or another information processing apparatus, and the second information according to the present invention The processing device 200A is realized by incorporating a predetermined program into a computer constituting a smartphone or other information processing device.

  Subsequently, the functions of the above-described components will be described in more detail. First, the first encryption communication processing unit 110 has a function of performing encryption communication based on a plurality N of (N22) encryption protocols, and from the second information processing apparatus 200A, the N types When an encrypted communication path open command CMD specifying a specific one of the encryption protocols is given, an encrypted communication path for performing encrypted communication based on the specified specific encryption protocol is opened and opened. The encrypted communication can be performed with the second information processing apparatus 200A through the encrypted communication path.

  In FIG. 6, a first encryption protocol P1, a second encryption protocol P2,..., An Nth encryption protocol PN are prepared in the block of the first encryption communication processing unit 110. The state is shown. Each of these encryption protocols P1 to PN is actually prepared as a function of an SD program installed in the first information processing apparatus 100 (SIM card 11).

  As described above, conventionally, when installing an SD program, only one specific encryption protocol is selected, and after installation, only an encrypted communication path based on the selected encryption protocol is established. Operation was taken. On the other hand, in the case of the present invention, when installing the SD program, an operation is performed in which encryption processing and decryption processing corresponding to each of a plurality of N encryption protocols can be executed. For example, when installing an SD program that supports three encryption protocols, such as SCP01, SCP02, and SCP03, installation is performed in such a manner that all three protocols can be used (in the case of N = 3). Then, when the first encryption communication processing unit 110 actually establishes an encryption communication path, one of the three encryption protocols is selected and the encryption communication based on the selected encryption protocol is selected. The road will be opened.

  On the other hand, the first encryption key storage unit 120 has a plurality of storage locations for storing encryption keys, and stores the encryption keys used for each of the N encryption protocols in the plurality of storage locations. It is a component that In FIG. 6, four sets of storage locations L11 to L14 are provided in the first encryption key storage unit 120, and a state in which encryption keys Keys 11 to Keys 14 are stored in these respective storage locations L11 to L14 is shown. ing. Each of these storage locations L11 to L14 actually corresponds to a cell of one row of the key table T shown in FIG. 3, and the plurality of encryption keys is “Keys”, This is to indicate that it is configured by a plurality of encryption keys.

  For example, in the key table T shown in FIG. 3, the encryption key Keys 11 stored in the storage location L11 is a pair of encryption keys KeyA, KeyB, KeyC stored in the storage location corresponding to the key version number “0x01”. It corresponds to As described above, the “encryption key” in the present invention is not necessarily a single encryption key, but is a concept including a collection of a plurality of encryption keys used for a specific encryption protocol.

  Subsequently, components of the second information processing apparatus 200A (smartphone 10A) will be described. First, the second cryptographic communication processing unit 210A has a function of performing cryptographic communication based on at least one specific encryption protocol among the plurality of N encryption protocols prepared in the first cryptographic communication processing unit 110. , And is a component that performs cryptographic communication with the first cryptographic communication processing unit 110 via a cryptographic communication path established to perform cryptographic communication based on the particular cryptographic protocol. In the example shown in the figure, the second encryption communication processing unit 210A corresponds to only the first encryption protocol P1, and the encryption communication is performed using this first encryption protocol P1 as the above-mentioned specific encryption protocol. Have the ability to

  The second encryption key storage unit 220A is a component that stores a specific encryption key used for the above-mentioned specific encryption protocol, and in the case of the illustrated example, the encryption key used for the first encryption protocol P1. As, the encryption key Keys 13 is stored. The encryption key Keys 13 is the same as the encryption key Keys 13 stored in the storage location L 13 of the first encryption key storage unit 120.

  Thus, the second cryptographic communication processing unit 210A has a cryptographic communication function based on the same encryption protocol as at least one of the N encryption protocols prepared in the first cryptographic communication processing unit 110. In the second encryption key storage unit 220A, the same encryption key as the encryption key stored in any storage location of the first encryption key storage unit 120 is stored. Therefore, the first information processing apparatus 100 and the second information processing apparatus 200A secure an encrypted communication path based on the same encryption protocol using the same encryption key, and perform encrypted communication via the encrypted communication path. Can exchange information.

  The encrypted communication path establishment instructing unit 230A is a component that gives the first information processing apparatus 100 an encrypted communication path establishment command CMD for instructing the establishment of such an encrypted communication path. A feature of the present invention is that the encryption communication path establishment command CMD includes protocol specification information for specifying a specific encryption protocol. That is, in the encrypted communication path establishment command CMD used in the present invention, protocol specification information for specifying a specific encryption protocol supported by the second encryption communication processing unit 210A, and the specific encryption protocol And encryption key specification information for specifying a specific encryption key to be used in

  The first encryption communication processing unit 110 which has received such an encrypted communication path establishment command CMD, sets up the encryption protocol designated by the protocol specification information included in the encrypted communication path establishment command CMD and the encryption communication path opened. By using the encryption key specified by the encryption key specification information contained in the command CMD, processing for establishing an encryption communication path for performing encryption communication is performed.

  For example, in the illustrated example, the second encryption communication processing unit 210A has an encryption communication function based on the first encryption protocol P1, and the second encryption key storage unit 220A includes the protocol P1. There are stored encryption keys Keys 13 for use in Therefore, the cryptographic communication channel establishment instructing unit 230A performs the first communication channel establishment command CMD including the protocol designation information for designating the first encryption protocol P1 and the cryptographic key designation information for designating the cryptographic key Keys 13. Is sent to the encryption communication processing unit 110 of Then, the first cryptographic communication processing unit 110 that has received such a cryptographic communication channel establishment command CMD uses the designated first cryptographic protocol P1 and the designated cryptographic key Keys 13 to execute the cryptographic communication channel connection. Perform opening process. Thus, encryption communication using the first encryption protocol P1 and the encryption key Keys 13 is executed between the first information processing apparatus 100 and the second information processing apparatus 200A.

  An advantage of the information processing system according to the present invention is that, since the first information processing apparatus 100 has an encryption communication function based on a plurality N of encryption protocols, the encryption protocol to be used can be appropriately used as needed. It is a point that can be changed. FIG. 7 is a block diagram showing another basic configuration of the information processing system according to the present invention. The difference between the information processing system shown in FIG. 6 and the information processing system shown in FIG. 7 is only that the former second information processing apparatus 200A is replaced with the second information processing apparatus 200B in the latter.

  Here, in the example shown in FIG. 7, consider the case where the second information processing apparatus 200 </ b> B is the smartphone 10 </ b> B. In other words, the SIM card 11 in the information processing system shown in FIG. 6 is removed from the smartphone 10A and replaced with another smart phone 10B, which is called an information processing system shown in FIG.

  The second information processing apparatus 200B includes a second encrypted communication processing unit 210B that performs encrypted communication using the encrypted communication path established by the first encrypted communication processing unit 110, and a second storing the encryption key. An encryption key storage unit 220B and an encryption communication path establishment instructing unit 230B for instructing the first encryption communication processing unit 110 to establish an encryption communication path are provided. The basic functions of these components 210B, 220B and 230B are the same as the basic functions of the components 210A, 220A and 230A shown in FIG.

  However, the second encryption communication processing unit 210B supports only the second encryption protocol P2 instead of the first encryption protocol P1, and the second encryption protocol P2 is a specific encryption protocol. As a cryptographic communication. On the other hand, in the second encryption key storage unit 220B, two encryption keys Keys 11 and Keys 12 are stored in the form of a key table T2 as specific encryption keys used for the second encryption protocol P2. These encryption keys Keys11 and Keys12 are the same as the encryption keys Keys11 and Keys12 stored in the storage locations L11 and L12 of the first encryption key storage unit 120, and in fact, as described above, a plurality of encryption keys It is composed of a collection of encryption keys.

  The encryption communication path establishment instructing unit 230B, like the above-described encryption communication path establishment instructing unit 230A, provides the first information processing apparatus 100 with an encryption communication path establishment command CMD for instructing establishment of the encryption communication path. It is. The encryption communication path establishment command CMD includes protocol specification information for specifying a specific encryption protocol supported by the second encryption communication processing unit 210B, and a specific encryption key used for the specific encryption protocol. And encryption key specification information for specification.

  Specifically, in the illustrated example, the second encryption communication processing unit 210B has an encryption communication function based on the second encryption protocol P2, and the second encryption key storage unit 220B Since the encryption keys Keys11 and Keys12 to be used for the protocol P2 are stored, the encryption communication path establishment instructing unit 230B is configured to use either the protocol specification information for specifying the second encryption protocol P2 or the encryption keys Keys11 or Keys12. The encryption communication path establishment command CMD including the encryption key designation information for designating the information is transmitted to the first encryption communication processing unit 110.

  The first cryptographic communication processing unit 110 that has received such a cryptographic communication channel establishment command CMD uses the designated second cryptographic protocol P2 and the designated cryptographic keys Keys 11 or Keys 12 to execute Perform opening process. Thus, encrypted communication using the second encryption protocol P2 and the encryption key Keys 11 or Keys 12 is executed between the first information processing apparatus 100 and the second information processing apparatus 200B. Of course, if more encryption keys are prepared in the second encryption key storage unit 220B, variations of encryption keys that can be specified by the encryption key specification information become more abundant.

  After all, referring to the embodiment shown in FIG. 6 and the embodiment shown in FIG. 7, the identical SIM card 11 (the first information processing apparatus 100) has an encrypted communication function using different encryption protocols. It will have a function of performing encryption communication to any of the two sets of smart phones 10A and 10B (the second information processing apparatuses 200A and 200B), and the SIM card 11 is used by being attached to the smart phone 10A. It can also be used by attaching to the smartphone 10B. That is, the SIM card 11 can establish an encrypted communication path based on any encryption protocol selected from among a plurality of N encryption protocols, and can perform secure communication.

  FIG. 8 is a block diagram showing still another basic configuration of the information processing system according to the present invention. The difference between the information processing system shown in FIG. 6 and the information processing system shown in FIG. 8 is only that the former second information processing apparatus 200A is replaced with the second information processing apparatus 200C in the latter.

  Here, in the example shown in FIG. 8, it is assumed that the second information processing apparatus 200 </ b> C is the smartphone 10 </ b> C. In other words, the SIM card 11 in the information processing system shown in FIG. 6 is removed from the smartphone 10A and replaced with another smart phone 10C, which is called an information processing system shown in FIG.

  The second information processing apparatus 200C stores a second encrypted communication processing unit 210C that performs encrypted communication using the encrypted communication path established by the first encrypted communication processing unit 110, and a second storing the encryption key. An encryption key storage unit 220C and an encryption communication path establishment instructing unit 230C instructing the first encryption communication processing unit 110 to establish an encryption communication path are provided. The basic functions of these components 210C, 220C and 230C are exactly the same as the basic functions of the components 210A, 220A and 230A shown in FIG.

  However, the second cryptographic communication processing unit 210C is configured to generate at least a plurality M of (M ≦ N) of the plurality of N cryptographic protocols in which the first cryptographic communication processing unit 110 is provided with the cryptographic communication function. And has a function of performing encryption communication based on the encryption protocol, and the first communication channel is established to perform encryption communication based on a specific encryption protocol selected from the M encryption protocols. Cryptographic communication can be performed with the information processing apparatus 100 of

  When M is set to N, the second cryptographic communication processing unit 210C is configured such that a cryptographic communication path based on the first cryptographic protocol P1, a cryptographic communication path based on the second cryptographic protocol P2, ..., N It is possible to perform encrypted communication using all of the encrypted communication paths based on the encryption protocol PN. On the other hand, when M <N is set, the second encrypted communication processing unit 210C can not cope with some encryption protocols that can be supported by the first encrypted communication processing unit 110.

  In FIG. 8, for convenience, the second encryption communication process is performed for the first encryption protocol P1 to the Mth encryption protocol PM among the N protocols that the first encryption communication processing unit 110 can cope with. An example is shown in which the second encryption communication processing unit 210C can not cope with the (M + 1) th encryption protocol P (M + 1) to the Nth encryption protocol PN, although the unit 210C can also correspond. . As described above, even if there are some encryption protocols that the first encryption communication processing unit 110 can cope with but the second encryption communication processing unit 210C can not cope with, by the encryption communication path establishment instructing unit 230C, Protocol specification information for specifying one of the encryption protocols (the first encryption protocol P1 to the Mth encryption protocol PM in the example of FIG. 8) that can be supported by the second encryption communication processing unit 210C If an encrypted communication path establishment command CMD is transmitted, there is no problem.

  Note that even if an encryption protocol that can not be handled by the first encryption communication processing unit 110 is stored in the second encryption communication processing unit 210C, the encryption protocol is not used for the first information processing apparatus 100. If the designated encrypted communication path establishment command CMD is not transmitted, no problem occurs. In short, the encrypted communication path establishment instruction unit 230C includes an encrypted communication path establishment command including protocol specification information for specifying an encryption protocol that can be supported by both the first encrypted communication processing unit 110 and the second encrypted communication processing unit 210C. The CMD may be transmitted.

  On the other hand, the second encryption key storage unit 220C has a plurality of storage locations for storing encryption keys, and the plurality of storage locations includes the first encryption key storage unit of the first information processing apparatus 100. The same encryption key as “the encryption key used for each of the M encryption protocols that can be supported by the second encryption communication processing unit 210C” stored in 120 is stored. For example, in the illustrated example, among the four sets of encryption keys stored in the first encryption key storage unit 120, three sets of Keys 11, Keys 12 and Keys 13 can be handled by the second encryption communication processing unit 210C. It is an encryption key used for any of M encryption protocols. Therefore, in the second encryption key storage unit 220C, these three sets of encryption keys Keys11, Keys12, and Keys13 are stored as a key table T2. These encryption keys Keys11, Keys12, and Keys13 are identical to the encryption keys stored in the storage locations L11, L12, and L13 of the first encryption key storage unit 120, and in fact, as described above, It is composed of a collection of multiple encryption keys.

  The cryptographic communication channel establishment instructing unit 230C, like the cryptographic communication channel establishment instructing unit 230A described above, provides the first information processing apparatus 100 with a cryptographic communication channel establishment command CMD for instructing establishment of the cryptographic communication channel. It is. That is, the encryption communication path establishment instructing unit 230C selects a specific encryption protocol from the M encryption protocols supported by the second encryption communication processing unit 210C, and sends the first information processing apparatus 100 A process of providing an encrypted communication path establishment command CMD for instructing establishment of an encrypted communication path for performing encrypted communication based on the selected encryption protocol is performed. As described above, the encryption communication path establishment command CMD includes protocol specification information for specifying a specific encryption protocol selected from the M encryption protocols, and a specific one used for the specific encryption protocol. And encryption key specification information for specifying an encryption key.

  Specifically, in the illustrated example, the second encryption communication processing unit 210C has an encryption communication function based on M encryption protocols, and the second encryption key storage unit 220C Since the encryption keys Keys 11, Keys 12, and Keys 13 to be used for each protocol are stored, the encryption communication path establishment instructing unit 230C is configured to specify the protocol specification information for specifying one of the M encryption protocols, and the encryption. The encryption communication path establishment command CMD including the encryption key designation information for designating any one of the keys Keys 11, 12, and 13 that can be used for the designated encryption protocol is subjected to a first encryption communication processing. It will be sent to the part 110.

  The first cryptographic communication processing unit 110 that has received such a cryptographic communication channel establishment command CMD uses the specified specific encryption protocol and the specified specific encryption key to execute the encryption communication channel establishment process. Do. Thus, cryptographic communication using the specific encryption protocol and the specific encryption key is performed between the first information processing apparatus 100 and the second information processing apparatus 200C.

  In general, a plurality of application programs are installed in a smartphone, and an IC card (SIM card) mounted on the smartphone exchanges information with the plurality of application programs. In addition, there are many cases where individual application programs installed in a smartphone have encryption communication functions based on different encryption protocols.

  The information processing system shown in FIG. 8 is an optimum embodiment for applying to such a case. For example, a plurality of M application programs are installed in the smart phone 10C, and the first to Mth application programs each have an encryption communication function based on the first to Mth encryption protocols P1 to PM. In this case, the second encryption communication processing unit 210C shown in FIG. 8 is realized by the encryption communication functions of these M application programs, and the second encryption key storage unit 220C An encryption key to be used for each encryption communication function of the application program is stored.

  In this case, when the first application program installed in the smartphone 10C communicates with the SIM card 11, protocol specification information for specifying the first encryption protocol P1 by the encryption channel establishment instruction unit 230C; An encrypted communication path establishment command CMD including encryption key designation information for specifying a specific encryption key used for this may be transmitted to the first encryption communication processing unit 110. Similarly, when the second application program installed in the smartphone 10C communicates with the SIM card 11, protocol specification information for specifying the second encryption protocol P2 by the encryption channel establishment instruction unit 230C; An encrypted communication path establishment command CMD including encryption key designation information for specifying a specific encryption key used for this may be transmitted to the first encryption communication processing unit 110.

  As described above, in the information processing system shown in FIG. 8, each application program installed in the smartphone 10C establishes an encryption communication path with the SIM card 11 based on its own encryption protocol, and performs encryption. It will be possible to communicate. The SIM card 11 opens an encryption communication path based on an arbitrary encryption protocol selected for each application program out of a plurality of M encryption protocols supported by each application program in the smartphone 10C. And secure communication can be performed.

<<< 3. 3. Specific embodiment considering IC card specification >>>
As described in Section 2, the feature of the information processing system according to the present invention is that the first information processing apparatus 100 has a function of performing cryptographic communication based on a plurality N of encryption protocols, and the second information processing apparatus The point is that a specific encryption protocol is specified by the protocol specification information included in the encrypted communication path establishment command CMD given to the first information processing apparatus 100 from 200.

  However, in the case where one of the two sets of information processing apparatuses performing encrypted communication is an IC card, it is necessary to apply a unique idea when applying the present invention. This is because, as described in §1, it is practically essential that common IC cards in widespread use are compliant with international specifications such as Java Card (trademark) and GlobalPlatform (trademark). Therefore, it is necessary to transmit, to the IC card, protocol specification information specifying "in which encryption protocol based on which encryption protocol is to be established among a plurality of N kinds of encryption protocols" in a format compliant with the specification. There is

  For example, when the encryption protocols SCP01, SCP02 and SCP03 are adopted, the format of the encrypted communication path establishment command CMD given to the IC card is as shown in FIG. 4 (b) according to the specification of GlobalPlatform (registered trademark). You need to Therefore, as long as the specification is complied with, protocol specification information specifying a specific encryption protocol can not be added as it is to the encrypted communication path establishment command CMD.

  For example, if it is possible to use an encrypted communication path open command CMD having a format such as "INITIALIZE UPDATE, (key version number), (random number), (protocol specification information)", in the (protocol specification information) part, For example, by placing a character string such as "SCP 02", it is possible to transmit to the IC card that the encryption protocol SCP 02 has been designated. However, since the encrypted communication path establishment command CMD having the above format is not compliant with the specifications of GlobalPlatform (registered trademark), it can not be practically used.

  Therefore, in this Section 3, in consideration of the above circumstances, protocol specification information may be transmitted to the IC card when establishing an encryption communication path while complying with international specifications such as GlobalPlatform (registered trademark). We will describe a specific embodiment that can be done.

<3-1. First embodiment>
When the encryption protocols SCP01, SCP02 and SCP03 are adopted, if the format of the encrypted communication path establishment command CMD given to the IC card is as shown in FIG. 4 (b), it conforms to the specification. Therefore, in the first embodiment, a method is adopted in which the protocol specification information is included in the "key version number" portion in such a format.

  For this purpose, first, storage zones are set in the key table. As shown in FIG. 6, the SIM card 11 includes a key table T1. This key table T1 is actually an address space formed by a matrix in which key version numbers (key version numbers) are defined in the vertical direction and key IDs (key ID) in the horizontal direction as illustrated in FIG. Configure.

  Therefore, for example, N storage zones Z1 to ZN as shown in FIG. 9A are set in the key table T1. Each storage zone is comprised of one or more rows of areas in the diagram matrix. For example, the first storage zone Z1 is a zone for one row identified by the key version number "0x01", and the i-th storage zone Zi is identified by the key version number "0x20-0x22" This is a zone for three lines, and the N-th storage zone ZN is a zone for two lines specified by the key version number “0x7E to 0x7F”.

  Thus, when N storage zones are set, these N storage zones Z1 to ZN correspond to N encryption protocols P1 to PN shown in the first encryption communication processing unit 110 of FIG. 6, respectively. Follow. Then, in the storage location belonging to the i-th (1 ≦ i ≦ N) storage zone Zi, the encryption key used for the i-th encryption protocol Pi is stored.

  FIG. 9 (b) is a table summarizing the results of such zone setting. Such a table is stored in the first encrypted communication processing unit 110 on the SIM card 11 side. In addition, as required, it is also stored in the encrypted communication path establishment instructing unit 230A on the smartphone 10A side.

  As illustrated, the first storage zone Z1 is a zone for one line specified by the numerical range "0x01" of the key version number, and is associated with the first encryption protocol P1. In the example shown in FIG. 9A, the encryption keys KeyA to KeyC are stored in the storage zone Z1, but these encryption keys are all encryption keys used for the first encryption protocol P1. .

  Similarly, the i-th storage zone Zi is a zone for three lines specified by the numerical range “0x20 to 0x22” of the key version number, and the i-th encryption protocol Pi is associated. In the example shown in FIG. 9A, the encryption keys KeyD to KeyL are stored in the storage zone Zi, but these encryption keys are all encryption keys used for the i-th encryption protocol Pi. . The N-th storage zone ZN is a two-line zone specified by the numerical range “0x7E to 0x7F” of the key version number, and is associated with the N-th encryption protocol PN. In the example shown in FIG. 9A, the encryption keys KeyM to KeyR are stored in the storage zone ZN, but these encryption keys are all encryption keys used for the Nth encryption protocol PN. .

  If the zone setting as described above is performed on the key table T1, the storage zone is determined if the key version number is specified, and if the storage zone is determined, the associated encryption protocol is determined. That is, the key version number not only serves as encryption key specification information for specifying the encryption key to be used, but also serves as protocol specification information for specifying the encryption protocol to be used. This means that if a key version number is specified by the encrypted communication path establishment command CMD, specification of an encryption protocol can be performed together.

  FIG. 10 is a diagram showing an example of the data structure of the encrypted communication path establishment command CMD used in the first embodiment. FIG. 10A shows the basic data structure of the encrypted communication path establishment command CMD conforming to the specifications of GlobalPlatform (registered trademark). As illustrated, the encrypted communication path establishment command CMD is an arrangement of “command character string information”, “storage location designation information”, and “random number” in order from the top.

  Here, “command string information” is a character string for identifying the command CMD, and, for example, in the case of a command for establishing an encrypted communication path based on the encryption protocols SCP01, SCP02, and SCP03, as described above, And the string "INITIALIZE UPDATE" is used. The following "storage location specification information" is encryption key specification information for specifying a specific encryption key used for opening the encryption communication path, and is a specific encryption key in the first encryption key storage unit 120 shown in FIG. This is information specifying the storage location of. When the encryption key is stored using the key table T1 as shown in FIG. 9, the "storage location designation information" is configured by the "key version number". The last “random number” is data used by the smartphone 10A to authenticate the SIM card 11 as a legitimate contact, as described above.

  Therefore, when establishing an encrypted communication channel based on the encryption protocols SCP01, SCP02 and SCP03, the format of the encrypted communication channel open command CMD is as shown in FIG. 10 (b) (shown in FIG. 4 (b)). The same as things). FIG. 10 (c) shows an example in which specific digital data is inserted in the "key version number" and the "random number". The key version number “0x21” in this example is storage location designation information for designating a storage location in the key table T1 shown in FIG. 9A (one row of cells identified by the key version number). The random number “0x1234ABCD” is data used for the authentication operation.

  The row of “0x21” (storage location of the encryption key) in the key table T1 shown in FIG. 9A is specified by the key version number “0x21” shown in FIG. 10C. Furthermore, referring to the table shown in FIG. 9 (b), the numerical range "0x20 to 0x22" to which "0x21" belongs corresponds to the i-th storage zone Zi, and the i-th encryption protocol Pi is It can be recognized that they are associated. As a result, the key version number "0x21" in the encrypted communication path establishment command CMD shown in FIG. 10C directly corresponds to the storage location of the encryption key in the IC card (table T1 in FIG. 9A). Storage location designation information for designating a particular line), but in practice, for the IC card, a role as protocol designation information for designating a particular encryption protocol, and an encryption key for designating a particular encryption key It will double as the role as designated information.

  More specifically, for the three encryption protocols SCP01, SCP02 and SCP03, the first storage zone Z1 is associated with the protocol SCP01, the i-th storage zone Zi is associated with the protocol SCP02, and so on. Let N storage zone ZN be associated with protocol SCP03. In this case, the encryption keys KeyA to KeyC stored in the first storage zone Z1 are encryption keys used for the encryption protocol SCP01, and the encryption keys KeyD to KeyL stored in the i-th storage zone Zi are The encryption keys KeyM to KeyR that are encryption keys used for the encryption protocol SCP02 and stored in the N-th storage zone ZN are the encryption keys used for the encryption protocol SCP03.

  Under such a premise, if an encrypted communication path establishment command CMD as shown in FIG. 10C is transmitted from the smartphone 10A to the SIM card 11, the first encrypted communication processing unit 110 that has received this command is: A specific cryptographic key can be used to establish a cryptographic communication path based on a particular cryptographic protocol in the following manner. First, the first cryptographic communication processing unit 110 recognizes that the command is the cryptographic communication channel establishment command CMD based on the first character string “INITIALIZE UPDATE”. Then, based on the subsequent key version number "0x21", the storage zone Zi corresponding to the key version number "0x21" is recognized by referring to the table shown in FIG. 9 (b), and the associated encryption is performed. Recognize the protocol Pi (in the example above, the encryption protocol SCP02).

  Therefore, the first encryption communication processing unit 110 executes a process (a routine incorporated in advance as an SD program) for establishing an encryption communication path based on the encryption protocol SCP02. In this protocol, it is determined in advance that three encryption keys specified by key ID "0x01 to 0x03" are used, so from key table T1, key version number "0x21" and key ID "0x01 to 0x03" The three sets of encryption keys KeyG, KeyH, and KeyI stored in the identified cell are read, and an encryption channel is established using the three sets of encryption keys.

  Of course, on the smart phone 10A side, an encrypted communication path establishment command CMD for instructing establishment of an encrypted communication path based on the encryption protocol SCP02 is transmitted using three sets of encryption keys KeyG, KeyH, and KeyI. The smartphone 10A can perform encrypted communication based on the encryption protocol SCP02 using the three sets of encryption keys by referring to the information. Thus, cryptographic communication between the two is started.

  After all, in the information processing system shown in FIG. 6, to implement the first embodiment, the first encryption key storage unit 120 first stores N pieces of storage associated with N encryption protocols. Zones Z1 to ZN are set, and an encryption key used for the i-th encryption protocol Pi is stored in the storage location belonging to the i-th (1 ≦ i ≦ N) storage zone Zi Make it Further, the encrypted communication path establishment command CMD transmitted by the encrypted communication path establishment instructing unit 230A includes storage location designation information indicating a storage location of a specific encryption key.

  Then, the first encryption communication processing unit 110 that has received the encrypted communication path establishment command CMD determines the storage location designation information included in the encrypted communication path establishment command CMD as both of the protocol designation information and the encryption key designation information. Use the encryption key stored in the storage location indicated by the storage location specification information, and recognize the information as the information that also plays the role of the storage zone to which the storage location indicated by the storage location specification information belongs. It is preferable to perform processing for establishing an encrypted communication path for performing encrypted communication based on the encryption protocol.

  The embodiment shown in FIG. 9 is an example in which the encryption key is stored in the form of the key table T1 in the first encryption key storage unit 120. In the case of this example, a plurality of storage locations (individual lines constituting the key table T1) specified by the key version number are prepared, and each storage zone is one or more storage locations (key table T1). It consists of one or more lines). In the case of this embodiment, as shown in FIG. 10, a specific key version number is included as storage location designation information in the encrypted communication path establishment command CMD. Then, using the encryption key stored in the storage location (the specific row of the key table T1) specified by the key version number, the first encryption communication processing unit 110 indicates the key version number by the key version number. It is possible to perform processing for opening an encrypted communication path for performing encrypted communication based on a specific encryption protocol corresponding to the storage zone to which the stored storage location belongs.

  When zone setting is performed, as in the example shown in FIG. 9, each storage zone is divided into one storage location (one line on the key table) or a plurality of storage locations (key table having consecutive key version numbers) It is preferable to configure the above by a plurality of consecutive lines), and to make each storage zone correspond to a unique numerical range of key version numbers. Of course, it is also possible to set one storage zone as a collection of discrete storage locations (discrete rows), but a collection of consecutive storage locations (continuous rows) as shown in FIG. 9A. If individual storage zones are configured by the body, individual storage zones can be specified as numerical ranges as shown in FIG. 9 (b), which facilitates storage zone recognition processing.

  Further, in the case of the embodiment shown in FIG. 9, in each storage location (each row on the key table) of the first encryption key storage unit 120, a plurality of storages (each cell on the key table specified by the key ID) A separate encryption key is stored in all or part of the plurality of storages. This is a consideration for dealing with encryption protocols that require multiple encryption keys, such as the encryption protocols SCP01, SCP02, and SCP03.

  As described above, if a plurality of storages (each cell on the key table) are prepared in one storage location (one row on the key table), and it is possible to store separate encryption keys in each storage. It becomes possible to cope with encryption protocols that require multiple encryption keys. In this case, the first encrypted communication processing unit 110 belongs to the storage (specified row on the key table) specified by the key version number included in the encrypted communication path establishment command CMD (the specified row). Encryption cell using the encryption key stored in the storage identified by the predetermined key ID predetermined by the encryption protocol corresponding to the storage zone to which the storage location belongs among Will be established.

  For example, in the case of the encryption protocols SCP01, SCP02, and SCP03, since three sets of encryption keys are used, it may be defined in advance that the three encryption keys specified by the key ID "0x01 to 0x03" should be used. Then, when the encryption protocols SCP01, SCP02, and SCP03 are specified, three sets of encryption keys stored in the cell identified by the key ID "0x01 to 0x03" can be read and used. .

  As described above, the first embodiment is suitable when one of the two sets of information processing apparatuses is an IC card, and storage location designation information indicating the storage location of the encryption key in the encryption communication path establishment command CMD. In this case, a method of specifying the encryption protocol according to the storage zone to which the storage location belongs is adopted, so that a specific encryption is performed using an encryption channel establishment command conforming to the international specification for the IC card. It is possible to transmit the selection of the communication protocol to the IC card side.

<3-2. Second embodiment>
In the second embodiment described here, protocol specification information is transmitted to an IC card using a standard data structure of an encryption key defined as an international specification of the IC card. is there. Separate storage keys (keys) are stored in the individual storages (cells) of the key table T1 shown in FIG. 9 (a). FIG. 11 shows a data structure defined as an international specification for such an encryption key Key.

  That is, according to this specification, it is defined that data constituting each encryption key Key has a format as shown in FIG. 11 (a). Specifically, the encryption key Key is an arrangement of “type information (key type) A”, “key length L”, and “key value data (key value V)” in order from the top. . Here, the “key value data V” is a portion that forms the main part of the encryption key, and corresponds to the data itself used for the encryption operation. The “key length L” is data having a unit of the number of bytes for indicating the length of the “key value data V”, and based on the “key length L”, the “key value data V Can be extracted. The first “type information A” is type information indicating the type of encryption algorithm that uses the encryption key, and, for example, is configured by information including types such as “AES”, “DES”, “RSA”, etc. Ru.

  FIGS. 11 (b) and 11 (c) show specific data examples of the encryption key Key based on such a specification. FIG. 11B shows an example of data of three sets of encryption keys KeyA, KeyB, and KeyC stored in the storage location specified by the key version number “0x01” in the key table T1 shown in FIG. 9A. It shows. Here, the encryption keys KeyA, KeyB and KeyC are stored in the storage (cell) specified by the key IDs “0x01”, “0x02” and “0x03”, respectively. On the other hand, FIG. 11C shows the data of the three sets of encryption keys KeyG, KeyH, and KeyI stored in the storage location specified by the key version number “0x21” in the key table T1 shown in FIG. An example is shown. Here, the encryption keys KeyG, KeyH and KeyI are stored in the storage (cell) specified by the key IDs “0x01”, “0x02” and “0x03”, respectively.

  In the three sets of encryption keys KeyA, KeyB, and KeyC shown in FIG. 11B, the “type information A” column is “AES”, and the encryption algorithm of AES (Advanced Encryption Standard) is used as the encryption algorithm. It shows that it is an encryption key used for the encryption protocol to be adopted. On the other hand, in the three sets of encryption keys KeyG, KeyH, and KeyI shown in FIG. 11C, the “type information A” column is “DES”, and the encryption algorithm is DES (Data Encryption Standard). It shows that it is an encryption key used for an encryption protocol that adopts the scheme. In each case, “key length L” is 16 bytes, and “key value data V” is configured by 16 bytes of data.

  As described above, when installing the SD program in the IC card, conventionally, any one encryption protocol is selected at the installation time, and after installation, only the encrypted communication path based on the selected encryption protocol is selected. There is an operation to make it open. In performing such an operation, it is not necessary to add “type information A” to the encryption key Key, but in terms of specifications, the encryption key Key including “type information A” is used.

  In the second embodiment described here, in consideration of such circumstances, the method of transmitting the protocol specification information to the IC card side using “type information A” included in the encryption key Key is adopted. .

  That is, in this second embodiment, an encryption including key value data V used for the encryption operation and type information A indicating the type of the encryption algorithm in each storage location of the first encryption key storage unit 120. In the encrypted communication path establishment command CMD transmitted by the encrypted communication path establishment instructing unit 230A, the key Key is stored, as shown in FIG. Specifically, the key version number is included. In the case of the example shown in FIG. 11, in each storage location of the first encryption key storage unit 120, key value data V used for encryption calculation, type information A indicating the type of encryption algorithm, and key value data V An encryption key Key including a key length L indicating a length of L is stored, and based on the key length L, extraction of key value data V having an appropriate length can be performed from the encryption key Key. It is supposed to be.

  On the other hand, the first encryption communication processing unit 110 which has received the encryption communication path establishment command CMD uses the storage location specification information (key version number) as information having the roles of both of the protocol specification information and the encryption key specification information. Using key value data V contained in the encryption key that is recognized and stored in the storage location indicated by the storage location designation information, the encryption indicated by the type information A included in the encryption key Processing for establishing an encrypted communication path for performing encrypted communication based on the communication protocol.

  In the case of the embodiment shown in FIG. 9, each storage location (each row on the key table) of the first encryption key storage unit 120 contains a plurality of storages (each cell on the key table) specified by the key ID. A separate encryption key is stored in all or part of the plurality of storages. This is a consideration for dealing with encryption protocols that require multiple encryption keys, such as the encryption protocols SCP01, SCP02, and SCP03.

  As described above, when corresponding to an encryption protocol that requires a plurality of encryption keys, the encryption stored in a plurality of storages (each cell in the key table) belonging to the same storage location (the same row of the key table) The key is made to include the same type information A. This is because the encryption keys stored in a plurality of storages belonging to the same storage location are encryption keys used for the same encryption protocol, so type information A indicating the type of encryption algorithm should also be the same as a matter of course It is for.

  For example, three sets of encryption keys KeyA to KeyC shown in FIG. 11 (b) are encryption keys stored in the same storage location specified by the key version number "0x01", and the same encryption protocol is used. It is an encryption key to be used. Therefore, the same type information A “AES” is included in these encryption keys. Similarly, the three sets of encryption keys KeyG to KeyI shown in FIG. 11C are encryption keys stored in the same storage location specified by the key version number “0x21”, and the same encryption protocol is used. Encryption key used in Therefore, the same type information A “DES” is included in these encryption keys.

  Therefore, in order to recognize which encryption protocol is designated when the first cryptographic communication processing unit 110 establishes the cryptographic communication path, the cryptographic key specification information included in the cryptographic communication path establishment command CMD (see FIG. The type information A included in the encryption key stored in any storage in the storage location specified by the key version number) may be referred to.

  For example, when an encrypted communication path establishment command CMD as shown in FIG. 10C is given, the first encrypted communication processing unit 110 uses the key version number “0x21” included in the encrypted communication path establishment command CMD. The encryption key Key stored in any storage (cell) in the specified storage location (row corresponding to the key version number "0x21" on the key table T1) is read, and the type information contained therein By referring to A, it can be recognized which encryption protocol is specified. Specifically, in the row corresponding to the key version number “0x21”, three sets of encryption keys KeyG, KeyH, and KeyI shown in FIG. 11C are stored, but in any case, the type information A is “DES”. Since it is "," it is possible to recognize that the type information A is "DES" regardless of which encryption key is referenced, and to recognize the specified encryption protocol.

  The information stored as the type information A is information only indicating the type of “encryption algorithm” and is not information indicating “encryption protocol”. Moreover, the correspondence between the “encryption algorithm” and the “encryption protocol” is not necessarily one-to-one. That is, a specific "encryption protocol" is a procedure for performing encryption using a specific "encryption algorithm", but there is only one protocol for performing encryption using a specific "encryption algorithm" Absent. As a specific example, for example, the encryption protocol SCP01 and the encryption protocol SCP02 are protocols whose specific procedures are different, but both are “DES” as the “encryption algorithm” (in fact, Triple-DES ) Is used.

  Therefore, when there are a plurality of N encryption protocols supported by the first encryption communication processing unit 110 that use “DES” as the encryption algorithm, the first encryption communication processing unit 110 is used. Can not identify one encryption protocol only by recognizing that the type information A is "DES". Specifically, when the first encryption communication processing unit 110 supports both the encryption protocol SCP01 and the encryption protocol SCP02, encryption is performed based on the encryption keys KeyG to KeyI shown in FIG. Even if the algorithm is identified as "DES", it can not be identified whether the designated encryption protocol is "SCP01" or "SCP02".

  In order to avoid such a problem, among the N encryption protocols to which the first encryption communication processing unit 110 corresponds, setting is made such that only one using the same encryption algorithm is included. You should do it. For example, "SCP 01" is set as the encryption protocol using the encryption algorithm "DES", "SCP 03" is set as the encryption protocol using the encryption algorithm "AES", and "Science 2" is set as the encryption protocol using the encryption algorithm "RSA". If "SCP 10" is set and the first cryptographic communication processing unit 110 performs setting such that it corresponds to a total of three encryption protocols, any of the type information A is "DES", "AES", or "RSA". By recognizing whether it is or not, it becomes possible to specify one encryption protocol.

  Thus, the invention according to the second embodiment is suitable when one of the two sets of information processing apparatuses is an IC card, and a storage location indicating the storage location of the encryption key in the encryption communication path establishment command CMD. Since the method of including specification information and specifying the encryption protocol by the type information A included in the specific encryption key is adopted, the encryption communication path establishment command conforming to the international specification for the IC card is used. Using this, it becomes possible to communicate the selection of a specific encryption protocol to the IC card side.

<3-3. Third embodiment>
In the third embodiment described here, protocol specification information is transmitted to an IC card using command character string information defined as an international specification of the IC card.

  FIG. 12 is a diagram showing a data structure of an encrypted communication path establishment command CMD defined as a specification regarding an IC card. According to the specification, the encrypted communication path establishment command CMD is, as shown in the figure, arranged "command string information", "storage location designation information", and "random number" in order from the top.

  As described above, the first “command character string information” is a character string for indicating that the command is a command for establishing an encrypted communication path. The following "storage location specification information" is encryption key specification information for specifying a specific encryption key used for opening an encryption communication path, and when storing an encryption key using a key table T1 as shown in FIG. Is configured by "key version number". The last “random number” is data used by the smartphone 10A to authenticate the SIM card 11 as a legitimate contact, as described above.

  Here, focusing on "command string information", in international specifications such as GlobalPlatform (registered trademark) and 3GPP / ETSI, a plurality of character strings are defined according to the encryption protocol. Specifically, for the encryption protocols SCP01, SCP02, and SCP03, as shown in FIG. 12 (b), an encrypted communication path open command CMD is defined with the character string "INITIALIZE UPDATE" at the beginning, For the encryption protocol SCP80, as shown in FIG. 12 (c), an encrypted communication path establishment command CMD is defined with the character string "ENVELOPE" at the head, and for the encryption protocol SCP10, it is shown in FIG. 12 (d). As shown in the figure, an encrypted communication channel establishment command CMD is defined with the character string "MANAGE SECURITY ENVIRONMENT" at the beginning (as described above, the data structure of each command CMD is necessary for the description of the present invention for convenience. It is a conceptual data structure that extracts only specific information, not the actual data structure itself).

  FIG. 13 is a table showing the correspondence between the command string information and the type information of the encryption algorithm. The type and command of the encryption algorithm to be used for each of the encryption protocols SCP01, SCP02, SCP03, SCP10 and SCP80. String information is shown. Note that "SCPxx" in this table indicates an encryption protocol that may not be specified by GlobalPlatform (registered trademark) at present, but may be formulated in the future.

  After all, in the encrypted communication path establishment command CMD conforming to the international specification such as GlobalPlatform (registered trademark), command character string information indicating a character string instructing the establishment of the encrypted communication path based on the specific encryption protocol; Since storage location specification information indicating a storage location of a specific encryption key is included, a protocol for specifying a specific encryption protocol for an IC card by using a portion of command string information It is possible to transmit designated information.

  That is, the first encryption communication processing unit 110 recognizes command string information included in the encrypted communication path establishment command CMD as protocol designation information, and specifies storage key designation information included in the encrypted communication path establishment command CMD as an encryption key. Recognizing as information, using the encryption key stored in the storage location indicated by the storage location specification information, encrypted communication for performing encryption communication based on the encryption protocol corresponding to the command character string information You can open the road.

  Of course, the “command character string information” included in the encrypted communication path establishment command CMD is not necessarily in one-to-one correspondence with a specific “encryption protocol”. For example, the command string information indicating the character string "INITIALIZE UPDATE" is information commonly used for the three encryption protocols SCP01, SCP02, and SCP03 at present, as shown in the table of FIG. Yes, it may also be used for new encryption protocols to be formulated in the future.

  Therefore, when there are a plurality of N encryption protocols supported by the first encryption communication processing unit 110 that use command string information "INITIALIZE UPDATE", the first encryption communication is performed. The processing unit 110 can not specify one encryption protocol only by recognizing that the command string information is “INITIALIZE UPDATE”. Specifically, when the first cryptographic communication processing unit 110 corresponds to the cryptographic protocols SCP01, SCP02, and SCP03, the first cryptographic communication processing unit 110 receives the cryptographic communication path establishment command CMD having command string information "INITIALIZE UPDATE". However, it can not be specified whether the designated encryption protocol is "SCP01", "SCP02" or "SCP03".

  In order to avoid such a problem, among the N encryption protocols corresponding to the first encryption communication processing unit 110, only one using the same command string information is included. Settings should be made. For example, "SCP01" is set as an encryption protocol using command string information "INITIALIZE UPDATE", "SCP 80" is set as an encryption protocol using command string information "ENVELOPE", and command string information "MANAGE SECURITY" When "SCP10" is set as an encryption protocol using "ENVIRONMENT" and the first encryption communication processing unit 110 is set to correspond to a total of three encryption protocols, the command string information is "INITIALIZE It becomes possible to identify one encryption protocol by recognizing whether it is "UPDATE", "ENVELOPE" or "MANAGE SECURITY ENVIRONMENT".

  In the case of the embodiment shown in FIG. 9, each storage location (each row on the key table) of the first encryption key storage unit 120 contains a plurality of storages (each cell on the key table) specified by the key ID. A separate encryption key is stored in all or part of the plurality of storages. This is a consideration for coping with encryption protocols that require multiple encryption keys.

  As described above, if a plurality of storages (each cell on the key table) are prepared in one storage location (one row on the key table), and it is possible to store separate encryption keys in each storage. It becomes possible to cope with encryption protocols that require multiple encryption keys. In this case, the first encrypted communication processing unit 110 belongs to the storage (specified row on the key table) specified by the key version number included in the encrypted communication path establishment command CMD (the specified row). Use of the encryption key stored in the storage identified by the predetermined key ID predetermined by the encryption protocol corresponding to the command character string information included in the encrypted communication path establishment command CMD And establish an encrypted communication channel.

  For example, in the case of the encryption protocol SCP01, since three sets of encryption keys are used, it may be determined in advance that the three encryption keys specified by the key ID "0x01 to 0x03" should be used. Then, when the encryption protocol SCP01 is designated, three sets of encryption keys stored in the cell specified by the key ID “0x01 to 0x03” can be read out and used.

  As described above, the invention according to the third embodiment is suitable when one of the two sets of information processing apparatuses is an IC card, and the encryption protocol is made based on the command character string information included in the encryption communication path establishment command. Is adopted, so that it is possible to transmit the selection of a specific encryption protocol to the IC card by using an encryption channel establishment command conforming to the international specification of the IC card. .

<<< 4. 4. Embodiment as Method Invention >>>
Finally, an embodiment in the case where the present invention is grasped as a method invention called an encryption communication method will be described. FIG. 14 is a flowchart showing the basic procedure of the cryptographic communication method according to the present invention. This encryption communication method is an encryption communication method for performing encryption communication based on a predetermined encryption protocol between the first information processing apparatus and the second information processing apparatus, and as shown in FIG. The encryption key storage step S12, the encryption communication path establishment instruction step S13, the encryption communication path establishment step S14, and the encryption communication step S15 are constituted. Note that the description on the right side of the block indicating each step in the flowchart of FIG. 14 is a procedure to be executed by the first information processing device 100 shown in FIG. 6 or the second information processing device 200A. Indicates whether the procedure is to be performed by

  The program preparation step in step S11 is a step in which the first information processing apparatus 100 prepares an executable state of a program performing encryption communication based on a plurality N (N ≧ 2) encryption protocols. Specifically, when the first information processing apparatus 100 is an IC card such as SIM 11, the encryption communication function is realized by the SD program. Therefore, the program preparation step of step S11 is performed by the process of installing the SD program. Conventionally, when installing an SD program, one encryption protocol is selected, and for the SD program, "encryption channel establishment" is performed using this selected specific encryption protocol. However, in the case of the present invention, at the time of installation of the SD program, encryption communication based on a plurality of N encryption protocols is enabled.

  The encryption key storage step of step S12 is a step in which the first information processing apparatus 100 stores encryption keys used for each of a plurality N of encryption protocols in a plurality of storage locations for storing encryption keys. is there. Specifically, in the first encryption key storage unit 120, a key table T as shown in FIG. 3 is stored.

  In the encryption communication path establishment instruction step of step S13, the second information processing apparatus 200A is selected from the N encryption protocols prepared in the program preparation step of step S11 to the first information processing apparatus 100. An encrypted communication path instructing establishment of an encrypted communication path for performing encrypted communication using the specific encryption key stored in the specific storage location at the encryption key storage stage of step S12 based on the specific encryption protocol This is a step of transmitting the opening command CMD. At the encryption communication path establishment instruction stage, an encryption communication path establishment command CMD including protocol specification information for specifying a specific encryption protocol and encryption key specification information for specifying a specific encryption key is transmitted. It will be done.

  In the enciphered communication channel establishment step of step S14, the first information processing apparatus 100 establishes an enciphered communication channel for performing enciphered communication based on a specific encipherment protocol based on the received enciphered communication channel establishment command CMD. It is a stage. That is, the encryption is performed using the encryption protocol specified by the protocol specification information included in the encryption communication path open command CMD and the encryption key specified by the encryption key specification information included in the encryption communication path open command CMD. A process of opening an encrypted communication path for communication is performed. Here, the process of establishing an encryption communication path is actually a process of encrypting transmission data by a specific encryption protocol using a specific encryption key and preparing to decrypt received data. become.

  The encryption communication step of step S15 is a step in which the first information processing apparatus 100 and the second information processing apparatus 200A perform encryption communication through the encryption communication path established in step S14. In practice, at the time of transmission, the transmission data is encrypted and transmitted, and at the time of reception, processing for decrypting and receiving the reception data is performed.

  In §3, when performing the processing of the encryption communication path establishment instruction step of step S13 among the procedures shown in this flowchart, the IC card (first one) is compliant with the international specifications such as GlobalPlatform (registered trademark). Three specific embodiments in which the protocol specification information can be transmitted to the information processing apparatus 100) have been described. Here, these three embodiments are grasped and described as a method invention called a cryptographic communication method.

  First, in the first embodiment, in the encryption key storage step of step S12, N storage zones corresponding to N encryption protocols are set, and the i-th (1 ≦ i ≦ N) storage is performed. The storage location belonging to the zone Zi is subjected to processing for storing the encryption key used for the i-th encryption protocol Pi, and storage indicating the storage location of the specific encryption key in the encryption communication path establishment instruction step of step S13. An encrypted communication path establishment command CMD including location specification information (key version number) is transmitted. Then, in the encryption communication path establishment step of step S14, the storage location designation information (key version number) included in the encryption communication path establishment command CMD is information having the roles of both of the protocol designation information and the encryption key designation information. The storage location indicated by the storage location designation information (key version number) belongs using the encryption key stored in the storage location indicated by the storage location designation information (key version number). An encrypted communication path for performing encrypted communication based on the encryption protocol corresponding to the storage zone may be established.

  On the other hand, in the second embodiment, at the encryption key storage step of step S12, an encryption key including key value data V used for the encryption operation and type information A indicating the type of encryption algorithm is stored. In the encryption communication path establishment instruction step of S13, an encryption communication path establishment command CMD including storage location designation information (key version number) indicating a storage location of a specific encryption key is transmitted. Then, in the encryption communication path establishment step of step S14, the storage location designation information (key version number) included in the encryption communication path establishment command CMD is information having the roles of both of the protocol designation information and the encryption key designation information. Type information included in the encryption key using key value data V included in the encryption key stored in the storage location indicated by the storage location specification information (key version number) An encrypted communication path for performing encrypted communication based on the encryption protocol indicated by A may be established.

  Finally, in the third embodiment, in the step of instructing the establishment of an encrypted communication path in step S13, command character string information indicating a character string instructing the establishment of an encrypted communication path based on a specific encryption protocol, and a specific encryption key And an encrypted communication path establishment command CMD including storage location designation information (key version number) indicating the storage location of. Then, in the encryption communication path establishment step of step S14, the command character string information included in the encryption communication path establishment command CMD is recognized as the protocol designation information, and the storage location designation information contained in the encryption communication path establishment command CMD. By recognizing (key version number) as encryption key specification information, the command character string information is supported using the encryption key stored in the storage location indicated by the storage location specification information (key version number). It is sufficient to establish an encryption communication path for performing encryption communication based on the encryption protocol.

10, 10A to 10C: smartphone 11: SIM card 20: external server 100: first information processing apparatus 110: first encryption communication processing unit 120: first encryption key storage unit 200, 200A to 200C: second Information processing apparatuses 210A to 210C: second encrypted communication processing units 220A to 220C: second encrypted key storage units 230A to 230C: encrypted communication path establishment instructing unit A: type information AP1 to AP3: application program CMD: encrypted communication path Opening command Key, Key A to Key R: Encryption key Keys, Keys 11 to Keys 14: Encryption key group L: Key length L11 to L14: Storage location P1, P2, Pi, PN, PM: Encryption protocol R1, R2: Encryption communication path establishment Routines S1 to S6: Steps S11 to S15 in the diagram: Steps T and T in the flowchart , T2: key table V: key value data Z1, Zi, ZN: storage zone

Claims (14)

An information processing system comprising a first information processing apparatus and a second information processing apparatus, and capable of performing cryptographic communication based on a predetermined encryption protocol between the two,
The first information processing apparatus is
It has a function of performing encryption communication based on a plurality N (N ≧ 2) encryption protocols, and among the N encryption protocols, an encryption based on an encryption protocol specified by the second information processing apparatus A first encrypted communication processing unit that establishes an encrypted communication path for performing communication and performs encrypted communication with the second information processing apparatus via the opened encrypted communication path;
A first encryption key storage unit having a plurality of storage locations for storing encryption keys, the plurality of storage locations storing encryption keys used for each of the plurality of N encryption protocols;
Have
The second information processing apparatus is
It has a function to perform encryption communication based on at least one specific encryption protocol among the plurality of N encryption protocols, and an encrypted communication channel established for performing encryption communication based on the specific encryption protocol A second encryption communication processing unit that performs encryption communication with the first information processing apparatus via:
A second encryption key storage unit storing an encryption key used for the specific encryption protocol;
An encrypted communication path establishment instructing unit for giving an encrypted communication path establishment command for instructing the first information processing apparatus to establish an encrypted communication path for performing encrypted communication;
Have
The encrypted communication path establishment command includes protocol specification information for specifying the specific encryption protocol, and encryption key specification information for specifying the specific encryption key.
The first encryption communication processing unit is configured to use the encryption protocol specified by the protocol specification information included in the encryption communication path establishment command and the encryption key specification information included in the encryption communication path establishment command. Establish an encrypted communication path for encrypted communication using the designated encryption key ,
In the first encryption key storage unit, N storage zones corresponding to the N encryption protocols are set, and the first encryption key storage unit belongs to an i-th (1 ≦ i ≦ N) storage zone. The storage location stores the encryption key used for the i-th encryption protocol,
The encrypted communication path establishment command includes storage location designation information indicating a storage location of a specific encryption key,
The first encryption communication processing unit recognizes the storage location designation information as information having both roles of protocol designation information and encryption key designation information, and stores the storage location designation information in the storage location indicated by the storage location designation information. Establishing an encryption communication path for performing encryption communication based on the encryption protocol corresponding to the storage zone to which the storage location indicated by the storage location designation information belongs, using the encryption key being stored;
The first encryption key storage unit is provided with a plurality of storage locations specified by a key version number, and each storage zone is constituted by one or more storage locations,
The encrypted communication path establishment command includes a specific key version number as storage location designation information,
The first encryption communication processing unit uses the encryption key stored in the storage location specified by the key version number, and uses the encryption key corresponding to the storage zone to which the storage location indicated by the key version number belongs. An information processing system characterized by establishing an encryption communication path for performing encryption communication based on an encryption protocol. In the information processing system according to claim 1 ,
Each storage zone is composed of a single storage location or a plurality of storage locations having consecutive key version numbers, and each storage zone is characterized by being associated with a unique numerical range of the key version numbers. Information processing system. In the information processing system according to claim 1 or 2 ,
In each storage location of the first encryption key storage unit, a plurality of storages respectively specified by key IDs are prepared, and in the whole or a part of the plurality of storages, different encryption keys are stored. Yes,
The first encryption communication processing unit is predetermined by the encryption protocol corresponding to the storage zone to which the storage location belongs, among the storages in the storage location specified by the key version number included in the encryption communication path establishment command. An information processing system characterized by establishing an encryption communication path using an encryption key stored in a storage identified by a predetermined key ID. An information processing system comprising a first information processing apparatus and a second information processing apparatus, and capable of performing cryptographic communication based on a predetermined encryption protocol between the two,
The first information processing apparatus is
It has a function of performing encryption communication based on a plurality N (N ≧ 2) encryption protocols, and among the N encryption protocols, an encryption based on an encryption protocol specified by the second information processing apparatus A first encrypted communication processing unit that establishes an encrypted communication path for performing communication and performs encrypted communication with the second information processing apparatus via the opened encrypted communication path;
A first encryption key storage unit having a plurality of storage locations for storing encryption keys, the plurality of storage locations storing encryption keys used for each of the plurality of N encryption protocols;
Have
The second information processing apparatus is
It has a function to perform encryption communication based on at least one specific encryption protocol among the plurality of N encryption protocols, and an encrypted communication channel established for performing encryption communication based on the specific encryption protocol A second encryption communication processing unit that performs encryption communication with the first information processing apparatus via:
A second encryption key storage unit storing an encryption key used for the specific encryption protocol;
An encrypted communication path establishment instructing unit for giving an encrypted communication path establishment command for instructing the first information processing apparatus to establish an encrypted communication path for performing encrypted communication;
Have
The encrypted communication path establishment command includes protocol specification information for specifying the specific encryption protocol, and encryption key specification information for specifying the specific encryption key.
The first encryption communication processing unit is configured to use the encryption protocol specified by the protocol specification information included in the encryption communication path establishment command and the encryption key specification information included in the encryption communication path establishment command. Establish an encrypted communication path for encrypted communication using the designated encryption key ,
Each storage location of the first encryption key storage unit stores an encryption key including key value data used for encryption operation and type information indicating the type of encryption algorithm,
The encrypted communication path establishment command includes storage location designation information indicating a storage location of a specific encryption key,
The first encryption communication processing unit recognizes the storage location designation information as information having both roles of protocol designation information and encryption key designation information, and stores the storage location designation information in the storage location indicated by the storage location designation information. Establishing an encrypted communication path for performing encrypted communication based on the encryption protocol indicated by the type information included in the encryption key using key value data included in the encryption key being stored. Information processing system characterized by In the information processing system according to claim 4 ,
Each storage location of the first encryption key storage unit includes key value data used for an encryption operation, type information indicating the type of encryption algorithm, and a key length indicating the length of the key value data. An encryption key is stored,
An information processing system characterized in that a first encryption communication processing unit extracts key value data from an encryption key based on the key length. In the information processing system according to claim 4 or 5 ,
In each storage location of the first encryption key storage unit, a plurality of storages respectively specified by key IDs are prepared, and in the whole or a part of the plurality of storages, different encryption keys are stored. The same type information is included in the encryption keys stored in multiple storages belonging to the same storage location.
The first encryption communication processing unit is configured to use the encryption indicated by the type information included in the encryption key stored in any storage in the storage location specified by the encryption key specification information included in the encryption communication path establishment command. An information processing system characterized by establishing an encryption communication path for performing encryption communication based on an encryption protocol. An information processing system comprising a first information processing apparatus and a second information processing apparatus, and capable of performing cryptographic communication based on a predetermined encryption protocol between the two,
The first information processing apparatus is
It has a function of performing encryption communication based on a plurality N (N ≧ 2) encryption protocols, and among the N encryption protocols, an encryption based on an encryption protocol specified by the second information processing apparatus A first encrypted communication processing unit that establishes an encrypted communication path for performing communication and performs encrypted communication with the second information processing apparatus via the opened encrypted communication path;
A first encryption key storage unit having a plurality of storage locations for storing encryption keys, the plurality of storage locations storing encryption keys used for each of the plurality of N encryption protocols;
Have
The second information processing apparatus is
It has a function to perform encryption communication based on at least one specific encryption protocol among the plurality of N encryption protocols, and an encrypted communication channel established for performing encryption communication based on the specific encryption protocol A second encryption communication processing unit that performs encryption communication with the first information processing apparatus via:
A second encryption key storage unit storing an encryption key used for the specific encryption protocol;
An encrypted communication path establishment instructing unit for giving an encrypted communication path establishment command for instructing the first information processing apparatus to establish an encrypted communication path for performing encrypted communication;
Have
The encrypted communication path establishment command includes protocol specification information for specifying the specific encryption protocol, and encryption key specification information for specifying the specific encryption key.
The first encryption communication processing unit is configured to use the encryption protocol specified by the protocol specification information included in the encryption communication path establishment command and the encryption key specification information included in the encryption communication path establishment command. Establish an encrypted communication path for encrypted communication using the designated encryption key ,
The encrypted communication path establishment command includes command character string information indicating a character string instructing the establishment of an encrypted communication path based on a specific encryption protocol, and storage location designation information indicating a storage location of a specific encryption key. Included,
The first encrypted communication processing unit recognizes the command character string information as protocol specification information, and recognizes the storage area specification information as encryption key specification information, whereby a storage location indicated by the storage location specification information An information processing system characterized by establishing an encryption communication path for performing encryption communication based on an encryption protocol corresponding to the command character string information using the encryption key stored in. In the information processing system according to claim 7 ,
In each storage location of the first encryption key storage unit, a plurality of storages respectively specified by key IDs are prepared, and in the whole or a part of the plurality of storages, different encryption keys are stored. Yes,
The first encryption communication processing unit encrypts, in the storage in the storage location specified by the encryption key specification information included in the encryption channel establishment command, the encryption corresponding to the command character string information included in the encryption channel establishment command. An information processing system characterized by establishing an encryption communication path using an encryption key stored in a storage identified by a predetermined key ID predetermined by a protocol. In the information processing system according to any one of claims 1 to 8 ,
The second cryptographic communication processing unit is based on at least a plurality M of (M ≦ N) of the plurality of N cryptographic protocols in which the first cryptographic communication processing unit is equipped with the cryptographic communication function. It has a function of performing encrypted communication, and is connected to the first information processing apparatus via an encrypted communication path established to perform encrypted communication based on a specific encryption protocol selected from the M encryption protocols. Perform cryptographic communication between
The second encryption key storage unit has a plurality of storage locations for storing encryption keys, and the plurality of storage locations are stored in the first encryption key storage unit of the first information processing apparatus. The same encryption key as "the encryption key used for each of the M encryption protocols" is stored,
The encryption communication path establishment instructing unit selects a specific encryption protocol from the M encryption protocols, and performs encryption communication based on the selected encryption protocol to the first information processing apparatus. What is claimed is: 1. An information processing system comprising: an encryption communication path establishment command for instructing establishment of an encryption communication path. An IC card or other information processing apparatus functioning as a first information processing apparatus in the information processing system according to any one of claims 1 to 9 . The smart phone or other information processing apparatus which functions as a 2nd information processing apparatus in the information processing system in any one of Claims 1-9 . A program that causes a computer to function as the first information processing apparatus or the second information processing apparatus in the information processing system according to any one of claims 1 to 9 . An encryption communication method for performing encryption communication based on a predetermined encryption protocol between a first information processing apparatus and a second information processing apparatus,
A program preparation stage in which the first information processing apparatus prepares in an executable state a program for performing encryption communication based on a plurality N (N ≧ 2) encryption protocols;
An encryption key storage step in which the first information processing apparatus stores encryption keys used for each of the plurality of N encryption protocols in a plurality of storage locations for storing encryption keys;
The second information processing apparatus transmits to the first information processing apparatus the encryption based on a specific encryption protocol selected from the N encryption protocols prepared in the program preparation stage. An encrypted communication path establishment instruction step of transmitting an encrypted communication path establishment command instructing establishment of an encrypted communication path for performing an encrypted communication using a specific encryption key stored in a specific storage location at the key storage stage;
An encryption communication path establishment step in which the first information processing apparatus establishes an encryption communication path for performing encryption communication based on the specific encryption protocol based on the received encryption communication path establishment command;
An encryption communication step in which the first information processing apparatus and the second information processing apparatus perform encryption communication via the established encryption communication path;
Have
The encrypted communication path establishment instruction step includes an encrypted communication path establishment command including protocol specification information for specifying the specific encryption protocol and encryption key specification information for specifying the specific encryption key. Send
In the encryption channel establishment stage, the encryption protocol designated by the protocol designation information included in the encryption channel establishment command and the encryption key designation information included in the encryption channel establishment command are specified. Establish an encrypted communication path to perform encrypted communication using the encrypted key
Storing an encryption key including key value data used for an encryption operation and type information indicating a type of an encryption algorithm in the encryption key storage step;
In the encryption communication path establishment instruction step, an encryption communication path establishment command including storage location designation information indicating a storage location of a specific encryption key is transmitted;
In the encryption communication path establishment stage, the storage location designation information is recognized as information having both roles of protocol designation information and encryption key designation information, and stored in the storage location indicated by the storage location designation information Using the key value data included in the encryption key, establishing an encryption communication path for performing encryption communication based on the encryption protocol indicated by the type information included in the encryption key. Encryption communication method. An encryption communication method for performing encryption communication based on a predetermined encryption protocol between a first information processing apparatus and a second information processing apparatus,
A program preparation stage in which the first information processing apparatus prepares in an executable state a program for performing encryption communication based on a plurality N (N ≧ 2) encryption protocols;
An encryption key storage step in which the first information processing apparatus stores encryption keys used for each of the plurality of N encryption protocols in a plurality of storage locations for storing encryption keys;
The second information processing apparatus transmits to the first information processing apparatus the encryption based on a specific encryption protocol selected from the N encryption protocols prepared in the program preparation stage. An encrypted communication path establishment instruction step of transmitting an encrypted communication path establishment command instructing establishment of an encrypted communication path for performing an encrypted communication using a specific encryption key stored in a specific storage location at the key storage stage;
An encryption communication path establishment step in which the first information processing apparatus establishes an encryption communication path for performing encryption communication based on the specific encryption protocol based on the received encryption communication path establishment command;
An encryption communication step in which the first information processing apparatus and the second information processing apparatus perform encryption communication via the established encryption communication path;
Have
The encrypted communication path establishment instruction step includes an encrypted communication path establishment command including protocol specification information for specifying the specific encryption protocol and encryption key specification information for specifying the specific encryption key. Send
In the encryption channel establishment stage, the encryption protocol designated by the protocol designation information included in the encryption channel establishment command and the encryption key designation information included in the encryption channel establishment command are specified. Establish an encrypted communication path to perform encrypted communication using the encrypted key
Command character string information indicating a character string instructing the establishment of an encrypted communication path based on a specific encryption protocol in the encryption communication path establishment instructing step; and storage location designation information indicating a storage location of the specific encryption key Send the included encrypted communication channel establishment command,
At the establishment stage of the encryption communication path, the command character string information is recognized as protocol designation information, and the storage location designation information is recognized as encryption key designation information, so that the information is stored in the storage location indicated by the storage location designation information. An encryption communication method characterized by establishing an encryption communication path for performing encryption communication based on an encryption protocol corresponding to the command string information, using the encryption key.

Images