JP5488653B2 - Key sharing computed entrusting device, key sharing system, and communication system - Google Patents

Description

The present invention relates to a key sharing computed entrusting device , a key sharing system, and a communication system, and can be applied to, for example, a system in which a computing computed entrusting device processes a part of calculation of key exchange processing and authentication processing instead of a communication device. Is.

  For example, in order to use sensors in the social infrastructure field where high reliability and quality are required, such as disaster prevention monitoring, traffic control, and finance, between a communication device such as a service providing server and a communication device such as a sensor. It is necessary to maintain the safety of communication.

  In order for a communication device such as a sensor to secure a secure end-to-end communication path with a communication device such as a service providing server, authentication, key exchange, etc. End-to-end information exchange is required.

  Here, consider a case where communication devices such as sensors form a power-saving multi-hop network. The power-saving multi-hop network is a network that suppresses power consumption by sleeping when each communication device such as a sensor delivers data by a bucket relay method and does not participate in data delivery.

  For example, when a large number of communication devices such as sensors are deployed over a wide area and it is desired to secure an end-to-end safe communication path between each communication device and a communication device such as a server on the Internet, End-to-end information exchange may cause problems such as congestion in a power-saving multi-hop network, increased power consumption, and increased processing time.

  As a prior art that can cope with the above-mentioned problems, Patent Document 1 discloses that end-to-end key exchange processing required for IPsec (Security Architecture for Internet Protocol) is applied to a mobile phone or PDA that is required to be reduced in size and weight. Since it is difficult to introduce, there has been proposed a method for reducing the load on the terminal by delegating key exchange processing to a device on the upper network side.

JP 2004-128782 A

  However, in the technology described in Patent Document 1 described above, it is necessary to deposit secret information such as its own authentication key in the proxy device in order to have the device on the higher network side perform the key exchange processing.

  For example, in order to deposit secret information to a proxy device on a network using a cloud environment, the communication device must distribute the secret information to the proxy device, and it is desirable to maintain the confidential information. When a part of one key exchange process is processed between a plurality of proxy devices, the communication device generates secret information related to key sharing each time, and generates the temporary secret information generated each time each proxy device. The problem of increased traffic can arise due to the need for distribution to the network.

Therefore, the proxy while maintaining the reliability of the classified information maintenance to the device, proxy device to deposit distributed to key sharing the computing consignment device that can be reduced the amount of traffic with the secret information relating to key sharing to, key sharing There is a need for systems and communication systems.

In order to solve this problem, a first aspect of the present invention includes a transmission / reception unit, a first storage unit that stores secret key information, a second storage unit that stores elements of a predetermined cyclic group, and a communication device. Public key information acquisition means for acquiring the key sharing public key parameter information of the following , and an operator defined in the cyclic group by the number given to the unit of the cyclic group by a predetermined integer as a unit of the cyclic group in is intended to determine the binding result, secret and Mitsukagi information, the public key information line physician predetermined arithmetic processing as the predetermined cyclic group of the original based on the acquired key agreement public key parameter information by acquiring means a first calculating means for calculating a partial common key information, the bit string information of the arbitrary been made to encrypted with predetermined key information bit sequence, the partial common key information of the first arithmetic means for encrypting key sharing the calculation entrusted to Ru and an encryption means In location, as (1) the secret key information, and a random number generator for generating random number information of a predetermined bit length, (2) the cyclic group of unity, a predetermined cyclic group of the original given by a predetermined integer The result is obtained by combining the numbers defined by the operators defined in the cyclic group, and the random number information generated by the random number generator is used as the secret key information. Based on the secret key information and the generation source of the cyclic group A second computing unit that performs a predetermined computation process as a source of the predetermined cyclic group and calculates partial key shared public key parameter information; and the transmission / reception unit includes the partial common key information from the encryption unit; A key-sharing computation entrusting device characterized by transmitting partial key-sharing public key parameter information from a second computing means.

The second of the present invention, in a key sharing system for outsource part of the key sharing calculation processing between the first and second communication apparatuses to N (N ≧ 2) pieces of the proxy device, N number of proxy device, and one of the first of the calculation consignment unit, sequence by the (N-1) second of the calculation consignment unit, (1) the first communication device, first the calculation consignment 1st partial common key information of a means and 2nd partial common key information of each 2nd calculation entrusting means are acquired, Based on 1st partial common key information and each 2nd partial common key information And (2) the second communication device calculates the common key information based on the random number information acquired from the first calculated consignment means, and (3) the first calculated consignment means. And each second computing entrustment means generates secret key information necessary for generating partial common key parameter information, and Key parameter information is generated, (4) each second calculated delegation means sends the generated partial key shared public key parameter information to the first calculated delegation means, and (5) first calculated Key sharing public key parameter information obtained by combining the partial key shared public key parameter information generated by the entrusting means with all the partial key shared public key parameter information acquired from each second calculated entrusting means Is transmitted to the second communication device .

A third aspect of the present invention is a communication system comprising the key sharing system of the second aspect of the present invention.

  According to the present invention, it is possible to reduce the amount of traffic associated with the distribution of secret information related to key sharing deposited with a proxy device while maintaining the reliability of confidential information maintenance to the proxy device.

1 is a configuration diagram illustrating an overall configuration of a system according to an embodiment. It is an internal block diagram which shows the internal structure of the 1st communication apparatus in embodiment. It is an internal block diagram which shows the internal structure of the primary calculation consignment apparatus of embodiment. It is an internal block diagram which shows the internal structure of the secondary calculation consignment apparatus of embodiment. It is an internal block diagram which shows the internal structure of the 2nd communication apparatus in embodiment. It is a sequence diagram which shows operation | movement of the key sharing process in the system of embodiment.

(A) Main Embodiments Hereinafter, embodiments of a key sharing calculation entrusting apparatus , a key sharing system, and a communication system according to the present invention will be described in detail with reference to the drawings.

  In the embodiment, an embodiment will be described in which the Diffie-Hellman key sharing protocol or the Eliptic Curve Diffie-Hellman key sharing protocol is adopted as the key sharing protocol between the first communication device and the second communication device. .

(A-1) Configuration of Embodiment (A-1-1) Overall Configuration of System FIG. 1 is a configuration diagram showing the overall configuration of the system of the embodiment. In FIG. 1, the system 1 according to the embodiment includes a first communication device 100, a second communication device 400, a primary calculated consignment device 200, and a secondary calculated consignment device 300.

In addition, the key sharing calculation entrustment apparatus of this invention has the primary calculation entrustment apparatus 200 and the secondary calculation entrustment apparatus 300. FIG.

  The first communication device 100 is a communication device mounted on a terminal such as a sensor or a smart terminal, for example, and is a communication device with limited network bandwidth, power consumption, and the like.

  The first communication device 100 performs data communication by multi-hop communication. In FIG. 1, when the first communication device 100 performs data communication toward the second communication device 400, the first communication device 100 is connected to the network 2 by multi-hop communication (first communication device). 100). Also, when performing the security process between the first communication device 100 and the second communication device 400, the first communication device 100 is connected to the primary calculation entrusted device 200 and the secondary device via the termination device. Communication with the calculation entrusting apparatus 300 is performed.

  The second communication device 400 is a communication device mounted on a service providing server or the like that exists on the network 2.

  The primary calculated entrusting device 200 and the secondary calculated entrusting device 300 constitute the calculated entrusted device of the present invention, and act as a proxy for a part of the calculation to be executed by the first communication device 100 in the authentication key sharing protocol. To do.

  In FIG. 1, the primary calculation entrusting apparatus 200 and the secondary calculation entrusting apparatus 300 are shown as physically different apparatuses, but various functions of the primary calculation entrusting apparatus 200 and the secondary calculation entrusting apparatus 300 described later. Can be executed, the primary calculated consignment device 200 and the secondary calculated consignment device 300 may be provided in the same device.

  In the description of the embodiment, g is a generator of the cyclic group <G,..., And is a parameter common to the system. N is the order of the cyclic group G.

  The integer x is a secret key of the first communication apparatus 100, and P_X = g ^ x is a public key of the first communication apparatus 100.

  The integer v is the secret key of the second communication apparatus 400, and P_V = g ^ v is the public key of the second communication apparatus 400.

  The integer d_1 is the secret key of the primary calculated consignment device 200, and P_D1 = g ^ d_1 is the public key of the primary calculated consignment device 200.

  The integer d_2 is a secret key of the secondary calculation entrusting apparatus 300, and P_D2 = g ^ d2 is a public key of the secondary calculation entrusting apparatus 300.

  Α · β∈G in the cyclic group G means that an operation defined in the cyclic group G is performed with α and β as operands. Α ^ βεG means that an operation defined in the cyclic group G is performed β times with α as an operand. Α / βεG means that an operation defined by the cyclic group G is performed using α and an inverse element of β defined by the cyclic group as operands.

  For example, when the cyclic group G is a group formed by rational points on the elliptic curve E, α · β∈G means the elliptic addition of α and β on the elliptic curve E, and α ^ β∈G is An elliptic scalar β multiplication of α means α / βεG means an elliptic subtraction of β from α.

  For example, when the cyclic group G is a finite field multiplicative group, α · β∈G means multiplication of α and β, α / β∈G means α to the power of β, and α / β ∈G means the division of α by β. X_Y is the same as when Y is subscripted for X.

  In addition, the common key information K_XD1 of the common key encryption algorithm is shared in advance between the first communication apparatus 100 and the primary calculation entrustment apparatus 200, and the first communication apparatus 100 and the secondary calculation entrustment apparatus 300 are shared. The common key information K_XD2 is shared beforehand.

(A-1-2) Internal Configuration of First Communication Device 100 FIG. 2 is an internal configuration diagram showing the internal configuration of the first communication device 100. In FIG. 2, the first communication apparatus 100 includes a transmission / reception unit 101, a secret key information storage unit 102, a decryption unit 103, and a common key synthesis unit 104.

  In FIG. 2, what includes at least the secret key information storage unit 102, the decryption unit 103, and the common key composition unit 104 is also referred to as a common key composition device 12.

  The transmission / reception unit 101 communicates with at least the primary calculation entrusted device 200 using a predetermined communication protocol.

  The secret key information storage unit 102 stores at least the encryption key information K_XD1 shared between the primary calculation entrusted devices 200 and the encryption key information K_XD2 shared between the secondary calculated entrusted devices 300. The secret key information storage unit 102 may store the calculation result of the common key composition unit 104, that is, the common key information K.

  The decryption unit 103 receives the partial common key information enc (K_XD1, K_1) and the partial common key information enc (K_XD2, K_2) from the transmission / reception unit 101, and receives the encryption key information K_XD1 stored in the secret key information storage unit 102. The partial common key information enc (K_XD1, K_1) is decrypted into the partial common key information K_1, and the partial common key information enc (K_XD2, K_1) is used by using the encryption key information K_XD2 stored in the secret key information storage unit 102. K_2) is decrypted into partial common key information K_2. The partial common key decryption unit 103 provides the decrypted K_1 and K_2 to the common key composition unit 104.

  Note that the partial common key information enc (K_XD1, K_1) is transmitted by being encrypted with the common key information K_XD1 shared in advance with the first communication device 100 by the primary computable device 200. Also, the partial common key information enc (K_XD2, K_2) is transmitted by being encrypted with the common key information K_XD2 shared in advance by the secondary calculation entrusted device 300 with the first communication device 100. .

  However, enc (K, M) means that a predetermined common key encryption algorithm is calculated from the bit string M using the common key bit string K. Here, in this embodiment, enc (K_XD2, K_2) is sent from the secondary calculated consignment device 300 to the primary calculated consignment device 200, and is sent from the primary calculated consignment device 200 to the first communication device 100. .

  The common key composition unit 104 receives the partial common key information K_1 and K_2 from the decryption unit 103, and uses the partial common key information K_1 and K_2 to perform a session with the second communication device 400 according to Expression (1-1). The key information K is obtained.

K = F (K_1 · K_2) (1-1)
Here, F (X) is a function that converts an element X of G into a key information bit string. Specifically, a method of obtaining a bit string having a predetermined key length by inputting a bit string representation of X into a SHA-256 (Secure Hash Algorithm: Federal Information Processing Standards Publication 180-2) hash function can be used.

(A-1-3) Internal Configuration of Primary Computed Consignment Device 200 FIG. 3 is an internal configuration diagram showing an internal configuration of the primary computed commissioned device 200 of the embodiment.

  In FIG. 3, the primary computing entrustment device 200 includes a transmission / reception unit 201, a secret key information storage unit 202, a generation source storage unit 203, a partial key shared secret key parameter generation unit 204, a partial common key calculation unit 205, a key shared public key. A parameter delivery management unit 206, a public key acquisition unit 207, a partial key shared public key parameter calculation unit 208, and a key shared public key parameter synthesis unit 209 are included.

  The transmission / reception unit 201 communicates with the first communication device 100, the second communication device 400, or the secondary calculation entrusted device 300 using a predetermined communication protocol.

  The secret key information storage unit 202 stores common key information K_XD1 shared in advance with the first communication device 100. Here, in this embodiment, the case where the common key information K_XD1 is stored in advance in the secret key information storage unit 202 is exemplified. However, for example, the common key information K_XD1 is derived according to the equation (1-2). It may be. However, when deriving the common key information K_XD1 according to the equation (1-2), it is necessary to securely store the secret key information d_1 of the primary calculation entrusted device 200 in the secret key information storage unit 202. Further, a means for acquiring or storing the public key information P_X of the first communication device 100 is required separately.

K_XD1 = F (P_X ^ d_1) (1-2)
The generator storage unit 203 stores the generator g of the cyclic group G.

  The partial key shared secret key parameter generation unit 204 generates a partial key shared secret key parameter x_t1, and uses the generated partial key shared secret key parameter information x_t1 as the partial common key calculation unit 205 and the partial key shared public key parameter calculation unit 208. It is something to give to. For example, the partial key shared secret key parameter generation unit 204 has a (pseudo) random number generation function, generates random number information in a range of 2 ≦ x_t1 ≦ n−1, and uses the random number information as the partial key shared secret key parameter information. Let x_t1.

  The partial common key calculation unit 205 receives the partial key shared secret key parameter information x_t1 from the partial key shared secret key parameter generation unit 204 and the key shared public key parameter information P_Vt of the second communication device 400 from the public key acquisition unit 207. By reading, the partial common key information K_1 is calculated by the following equation (1-3). Further, the partial common key calculation unit 205 reads the common key K_XD1 shared in advance with the first communication device 100 from the secret key information storage unit 202, and uses the common key K_XD1 as a key for the partial common key information K_1. Is encrypted according to the common key encryption algorithm, and the encrypted partial common key information enc (K_XD1, K_1) is transmitted to the first communication device 100.

enc (K_XD1, K_1), where
K_1 = P_Vt ^ x_t1 (1-3)
The key shared public key parameter delivery management unit 206 reads the key shared public key parameter information P_Vt of the second communication device 400 from the public key acquisition unit 207, and transmits the key shared public key parameter information P_Vt to the secondary calculation entrusted device. Is.

  The public key acquisition unit 207 acquires the key sharing public key parameter information P_Vt of the second communication device 400 from the transmission / reception unit 201.

  The partial key shared public key parameter calculation unit 208 reads the partial key shared secret key parameter information x_t1 from the partial key shared secret key parameter generation unit 204 and the generation source g from the generation source storage unit 203 to obtain the partial key shared public key. The parameter information P_Xt1 is calculated according to the following equation (1-4). Also, the partial key shared exchange key parameter calculation unit 208 gives partial key shared public key parameter information P_Xt1 to the key shared public key parameter synthesis unit 209.

P_Xt1 = g ^ x_t1 (1-4)
The key sharing public key parameter synthesizing unit 209 reads the partial key sharing public key parameter information P_Xt1 from the partial public key parameter calculating unit 208, and receives the partial public key parameter information P_Xt2 of the secondary calculated entrusted device 300 from the transmission / reception unit 201. The key sharing public key parameter information P_Xt is calculated according to the following equation (1-5). Further, the key sharing public key parameter synthesis unit 209 transmits key sharing public key parameter information P_Xt to the second communication device 400.

P_Xt = P_Xt1 · P_Xt2 (1-5)
(A-1-4) Internal Configuration of Secondary Calculated Consignment Device 300 FIG. 4 is an internal configuration diagram showing the internal configuration of the secondary calculated consignment device 300 of the embodiment. In FIG. 4, the secondary computation entrusted device 300 includes a transmission / reception unit 301, a secret key information storage unit 302, a generation source storage unit 303, a partial common key calculation unit 304, a public key acquisition unit 305, and a partial key shared secret key parameter generation unit. 306, a partial key shared public key parameter calculation unit 307.

  4, at least a secret key information storage unit 302, a generation source storage unit 303, a partial common key calculation unit 304, a public key acquisition unit 305, a partial key shared secret key parameter generation unit 306, a partial key shared public key parameter calculation unit. A device including 307 is also referred to as a key sharing computation entrusting device 31.

  The transmission / reception unit 301 communicates with the primary calculation entrusted device 200 using at least a predetermined communication protocol.

  The secret key information storage unit 302 stores common key information K_XD2 shared in advance with the first communication device 100. Here, in this embodiment, the case where the common key information K_XD2 is stored in advance in the secret key information storage unit 302 is exemplified, but the common key information K_XD2 is derived according to, for example, the equation (1-6). It may be. However, when the common key information K_XD2 is derived according to the equation (1-6), it is necessary to securely store the secret key information d_2 of the secondary calculation entrusted device 300 in the secret key information storage unit 302. Further, a means for obtaining or storing the public key information P_X of the first communication device 100 is separately required.

K_XD2 = F (P_X ^ d_2) (1-6)
The generator storage unit 303 stores the generator g of the cyclic group G.

The partial common key calculation unit 304 obtains the partial key shared secret key parameter information x_t2 from the partial key shared secret key parameter generation unit 306 and the key shared public key parameter information P_Vt of the second communication device 400 from the public key acquisition unit 305. By reading, the partial common key information K_2 is calculated according to the following equation (1-7). Further, the partial common key calculation unit 304 reads the common key information K_XD2 shared in advance with the first communication device 100 from the secret key information storage unit 302, and uses the common key information K_XD2 as a key for the partial common key. The information K_2 is encrypted according to the common key encryption algorithm, and the encrypted partial common key information enc (K_XD2, K_2) is transmitted to the primary computed entrusting apparatus 200.

enc ( K_XD2 , K_2), where
K_2 = P_Vt ^ x_t2 (1-7)

  The partial key shared secret key parameter generation unit 306 generates a partial key shared secret key parameter x_t2, and provides the generated partial key shared secret key parameter information x_t2 to the partial common key calculation unit 304 and the shared public key parameter calculation unit 307. Is. For example, the partial key shared secret key parameter generation unit 306 has a (pseudo) random number generation function, generates random number information in the range of 2 ≦ x_t2 ≦ n−1, and uses the random number information as the partial key shared secret key parameter information. Let x_t2.

  The partial key shared public key parameter calculation unit 307 reads the partial key shared secret key parameter information x_t2 from the partial key shared secret key parameter generation unit 306 and the generation source g from the generation source storage unit 303, and reads the partial key shared public key. The parameter information P_Xt2 is calculated according to the following equation (1-8). Further, the partial key shared public key parameter calculation unit 307 transmits the partial key shared public key parameter information P_Xt2 to the primary calculation target entrusting apparatus 200.

P_Xt2 = g ^ x_t2 (1-8)
(A-1-5) Internal Configuration of Second Communication Device 400 FIG. 5 is an internal configuration diagram illustrating an internal configuration of the second communication device 400 according to the embodiment. 5, the second communication device 400 includes a transmission / reception unit 401, a public key acquisition unit 402, a key shared secret key parameter generation unit 403, a key shared public key parameter calculation unit 404, a common key calculation unit 405, and a generation source storage unit. 406.

  The transmission / reception unit 401 communicates with at least the primary calculation entrusted device 200 using a predetermined communication protocol.

  The public key acquisition unit 402 acquires key sharing public key parameter information P_Xt of the first communication device 100.

  The key sharing secret key parameter generation unit 403 generates key sharing secret key parameter information v_t, and supplies the generated key sharing secret key parameter information v_t to the common key calculation unit 405 and the key sharing public key parameter calculation unit 404 It is. For example, the key sharing secret key parameter generation unit 403 has a (pseudo) random number generation function, generates random number information in a range of 2 ≦ v_t ≦ n−1, and uses the random number information as key sharing secret key parameter information v_t. To do.

  Here, the key sharing secret key parameter generation unit 403 may use the secret key v of the second communication device 400 as the key sharing secret key parameter v_t instead of generating the key sharing secret key parameter v_t.

  The key sharing public key parameter calculation unit 404 reads the partial key sharing secret key parameter v_t from the key sharing secret key parameter generation unit 403 and the generation source g from the generation source storage unit 406, and outputs the key sharing public key parameter P_Vt. The calculation is performed according to the equation (1-9). The key sharing public key parameter calculation unit 404 transmits the key sharing public key parameter P_Vt to the primary calculated consignment device 200.

P_Vt = g ^ v_t (1-9)
The common key calculation unit 405 obtains a session key K from the key shared public key parameter P_Xt received from the primary calculation entrusted device 200 and the key shared secret key parameter v_t received from the key shared secret key parameter generation unit 403 by the following formula: It is calculated by (1-10).

K = F (P_Xt ^ v_t) (1-10)
The generation source storage unit 406 stores the generation source g of the cyclic group G.

(A-2) Operation of Embodiment FIG. 6 is a sequence diagram showing the operation of key sharing processing in the system 3 of this embodiment.

  (S101) In the second communication apparatus 400, the key sharing secret key parameter generation unit 403 arbitrarily generates first key sharing secret key parameter information v_t (2 ≦ v_t ≦ n−1), and the key sharing secret key The parameter generation unit 403 gives the first key shared secret key parameter information v_t to the key shared public key parameter calculation unit 404.

  (S102) Upon receiving the first key shared secret key parameter information v_t, the key share public key parameter calculation unit 404 reads the generation source g from the generation source storage unit 406, and performs the first operation according to the equation (1-9). Key sharing public key parameter information P_Vt is calculated. Then, the key sharing public key parameter calculation unit 404 transmits the first key sharing public key parameter information P_Vt to the primary calculated consignment device 200.

  When the first key shared public key parameter information P_Vt is given to the primary computable device 200, the first key shared public key parameter information P_Vt is stored in the public key acquisition unit 207 and the key shared public key. This is given to the parameter delivery management unit 206. Further, the first key shared public key parameter information P_Vt is transmitted from the key shared public key parameter delivery management unit 206 to the secondary calculation entrusted device 300.

  When the first key shared public key parameter information P_Vt is given to the secondary computation entrusted device 300, the first key shared public key parameter information P_Vt is stored in the public key acquisition unit 305.

  (S103) Next, in primary entrusted device 200, partial key shared secret key parameter generation section 204 arbitrarily generates first partial key shared secret key parameter information x_t1 (2 ≦ x_t1 ≦ n−1). . Then, the partial key shared secret key parameter generation unit 204 provides the generated first partial key shared secret key parameter information x_t1 to the partial key shared public key parameter calculation unit 208 and the partial common key calculation unit 205.

  (S104) Upon receiving the first partial key shared secret key parameter x_t1, the partial key shared public key parameter calculation unit 208 reads the generation source g from the generation source storage unit 203, and performs the first operation according to the equation (1-4). The partial key shared public key parameter P_Xt1 is calculated and provided to the key shared public key parameter synthesis unit 209.

  (S105) Upon receiving the first partial key shared secret key parameter x_t1, the partial common key calculation unit 205 reads the public key P_Vt of the second communication device from the public key acquisition unit 207, and follows Formula (1-3). The first partial common key information K_1 is calculated and encrypted with the common key K_XD1 shared between the first communication device 100 and the primary calculated entrusted device 200. Then, the partial common key calculation unit 205 stores the encrypted enc (K_XD1, K_1) in a temporary storage unit (not shown).

  (S106) Next, in the secondary computing entrustment device 300, the partial key shared secret key parameter generation unit 306 arbitrarily generates a second partial key shared secret key parameter x_t2 (2 ≦ x_t2 ≦ n−1). Then, the partial key shared secret key parameter generation unit 306 gives the generated second partial key shared secret key parameter x_t2 to the partial key shared public key parameter calculation unit 307 and the partial common key calculation unit 304.

  (S107) Upon receiving the second partial key shared secret key parameter x_t2, the partial key shared public key parameter calculation unit 307 reads the generation source g from the generation source storage unit 303, and stores the second generation according to equation (1-8). The partial key shared public key parameter P_Xt2 is calculated, and the second partial key shared public key parameter P_Xt2 is temporarily stored in a temporary storage unit (not shown) of the secondary calculated consignment device 300.

  (S108) Upon receiving the second partial key shared secret key parameter x_t2, the partial common key calculation unit 304 reads the public key P_Vt of the second communication device from the public key acquisition unit 305, and follows equation (1-7). The second partial common key information K_2 is calculated and encrypted with the common key K_XD2 shared between the second communication device 100 and the secondary calculation entrusted device 300. Then, the partial common key calculation unit 304 transmits the encrypted enc (K_XD2, K_2) to the primary calculated entrusted device together with the second partial key shared public key parameter P_Xt2.

  (S109) When receiving the second partial key shared public key parameter P_Xt2 from the secondary calculated consignment device 300, the primary calculated consignment device 200 gives it to the key shared public key parameter composition unit 209. The key sharing public key parameter synthesizing unit 209 calculates the second key sharing public key parameter from the first partial key sharing public key parameter P_Xt1 and the second partial key sharing public key parameter P_Xt2 according to Expression (1-5). P_Xt is calculated and transmitted to the second communication device 400. In addition, when receiving the second partial common key information enc (K_XD2, K_2) sent encrypted from the secondary calculation entrusting apparatus 300, the primary calculation entrusting apparatus 200 receives the primary calculation entrusting apparatus 200. The first partial common key information enc (K_XD1, K_1) stored in the temporary storage unit is sent to the first communication device.

  (S110) When the second communication device 400 receives the second key sharing public key parameter P_Xt from the primary calculated delegation device 200, the second communication device 400 calculates the session key K according to the equation (1-10).

  (S111) The first communication device 100 sends the encrypted first partial common key information enc (K_XD1, K_1) and the encrypted second partial common key information enc from the primary computing device 200. When (K_XD2, K_2) is received, they are given to the decoding unit 103.

  The decryption unit 103 uses the first partial common key information enc (K_XD1, K_1) encrypted by using the common key K_XD1 shared between the first communication device 100 and the primary computed entrusted device 200 to the first The partial shared key information K_1 is decrypted. In addition, the decryption unit 103 starts from the second partial common key information enc (K_XD2, K_2) encrypted using the common key K_XD2 shared between the first communication device 100 and the secondary computation entrusted device 300. 2 partial shared key information K2 is decrypted.

  The decryption unit 103 gives the decrypted first partial shared key information K_1 and second partial shared key information K_2 to the common key composition unit 104. Then, the common key composition unit 104 calculates the session key K according to the equation (1-1).

(A-3) Effect of Embodiment As described above, according to the embodiment, when it is necessary to temporarily generate secret key information used for key sharing by at least the first communication device, two computable entrustments Each of the devices generates temporal partial secret key information and corresponding (temporal) partial public key information, and the partial public key information is synthesized by the primary computing device as key sharing public key information. The calculation cost and the communication cost required for the first communication device to prepare the secret key information for key sharing each time, divide it, and deposit it to each calculation target consignment server. Can be omitted.

(B) Other Embodiments In the above-described embodiment, the secondary calculated consignment device 300 transmits the encrypted second partial shared key information enc (K_XD2, K_2) to the primary calculated consignment device. The secondary calculated entrustment device 300 may directly transmit the encrypted second partial shared key information enc (K_XD2, K_2) to the first communication device. However, it is a condition that the transmission / reception unit of the first communication device has a function of communicating with the secondary calculation entrusted device.

  The above-described embodiment can be widely applied to a key sharing system in which a part of security processing between the first communication device and the second communication device is performed by the substitute device instead of the first communication device. . For example, the inventor of the present application has a proxy device that performs a part of the back chestnut processing between the first communication device and the second communication device as a key sharing calculation, a PKI decryption calculation, and a digital signature calculation. A technology to do part of it is proposed (see Japanese Patent Application 2012-15216). The present invention may be applied to the key sharing calculation technique in the proposed technique.

1 ... system, 2 ... network,
100: first communication device, 12: common key synthesis device,
101: Transmission / reception unit, 102: Secret key information storage unit,
103 ... Decryption unit, 104 ... Common key composition unit,
200: Primary calculation commissioned device,
201 ... Transmission / reception unit, 202 ... Secret key information storage unit, 203 ... Generation source storage unit,
204 ... Partial key shared secret key parameter generation unit, 205 ... Partial common key calculation unit,
206 ... Key sharing public key parameter delivery management unit, 207 ... Public key acquisition unit,
208: Partial key shared public key parameter calculation unit,
209 ... Key sharing public key parameter synthesis unit,
300 ... Secondary calculation entrusting device, 31 ... Key sharing calculation entrusting device,
301: Transmission / reception unit, 302 ... Secret key information storage unit, 303 ... Generation source storage unit,
304: partial common key calculation unit, 305 ... public key acquisition unit,
306... Partial key shared secret key parameter generation unit,
307 ... Partial key shared public key parameter calculation unit,
400 ... second communication device,
401: transmission / reception unit, 402: public key acquisition unit,
403 ... Key sharing secret key parameter generation unit,
404 ... Key shared public key parameter calculation unit, 405 ... Shared key calculation unit,
406 ... Generation source storage unit.

Claims (4)

Transmitting and receiving means;
First storage means for storing secret key information;
Second storage means for storing elements of a predetermined cyclic group ;
Public key information acquisition means for acquiring key sharing public key parameter information of the communication device;
The identity element of the cyclic group, the predetermined cyclic group of the original, the number given by the predetermined integer, which seek result of combining with the operator to be defined in該巡times groups, the upper Kihi Mitsukagi information , have rows predetermined arithmetic processing as the predetermined cyclic group of the original on the basis of the above key sharing public key parameter information acquired by the public key information acquiring means, first calculating means for calculating a partial common key information When,
The bit string information of arbitrary been made to encrypted with predetermined key information bit sequence, the first computing means of the partial common key information encryption processing key sharing the computing consignment device Ru and a encryption means for In
A random number generator for generating random information of a predetermined bit length as the secret key information;
The result is obtained by combining a unit of a cyclic group with a predetermined cyclic group element by an operator defined in the cyclic group by a number given by a predetermined integer, and is generated by the random number generator. The random number information is used as the secret key information, and based on the secret key information and the generation source of the cyclic group, predetermined calculation processing is performed as an element of the predetermined cyclic group, and partial key shared public key parameter information is calculated. 2 computing means and
Further comprising
The transmission / reception means transmits the partial common key information from the encryption means and the partial key shared public key parameter information from the second calculation means.
A key sharing computation entrusting device characterized by that. The partial key shared public key parameter information of the second computing means and all the partial key shared public key parameter information acquired from other key shared computation entrusted devices are combined to synthesize key shared public key parameter information. Further comprising third arithmetic processing means;
The transmission / reception means transmits the key sharing public key parameter information of the third calculation means.
The key sharing computed entrusting apparatus according to claim 1. In a key sharing system in which a part of the key sharing calculation process between the first communication device and the second communication device is entrusted to N (N ≧ 2) proxy devices,
The N proxy devices are
And one of the first of the calculation consignment means corresponding to a key sharing the computing consignment device according to claim 2,
And the N-1 second of the calculation consignment means corresponding to a key sharing the computing consignment device according to 請 Motomeko 1
And
The first communication device acquires first partial common key information of the first calculated consignment means and second partial common key information of each second calculated consignment means, and Calculating common key information based on one partial common key information and each of the second partial common key information,
The second communication device calculates common key information based on random number information acquired from the first calculation entrustment means,
The first calculated delegation means and each of the second calculated delegation means generate secret key information necessary for generating partial common key parameter information and generate partial key shared public key parameter information. ,
Each of the second calculated entrusting means transmits the generated partial key shared public key parameter information to the first calculated entrusting means,
The first calculated delegation means synthesizes the partial key shared public key parameter information generated by itself and all the partial key shared public key parameter information acquired from the second calculated delegation means. key sharing system that the key sharing public key parameter information obtained and to transmit to the second communication device. A communication system comprising the key sharing system according to claim 3 .

Images