JPH0774934B2 - Encryption device - Google Patents

Description

Description: TECHNICAL FIELD The present invention relates to encryption of data sent from a terminal to a center, or vice versa, in a network including a center and a terminal.

(Prior Art and Its Problems) Although key distribution is required in cryptographic communication, a public key distribution system is well known as a conventionally known distribution system.
This method is, for example, IEE Transactions on Information Theory (IEEE Tra
nsactions on Information Theory) Vol. 22, No. 6, 644-65
It is described on page 4. FIG. 6 shows an example in which this system is realized as a device. The terminal 601 is a terminal capable of cryptographic communication according to this public key distribution method, and performs cryptographic communication with other terminals via the connected network 602. The user tries to encrypt and send the communication text created via the user interface 603 or the communication text already created and stored in the storage device 606 to another terminal.
At this time, the user specifies the delivery destination of the communication message via the user interface 603. Public information management means 604
Searches the public information list 605 for the public information of the designated delivery destination, and if so, sends the public information corresponding to the delivery destination to the encryption device 607.
The encryption device 607 performs an encryption process on the communication text using the public information as a key, and transfers it to the network interface 608.
The encrypted communication text is delivered to the specified delivery destination via 02. On the other hand, the public information management means 604 uses the public information list 6
If it is determined that the delivery destination public information specified in 05 does not exist, the network interface 608 obtains the delivery destination public information via the network 602, or the user interface 603 acquires the delivery destination public information. To the user, and the user separately obtains public information. In any case, the newly obtained public information is added to the public information list 605.

This method has a problem that the size of the public information list 605 becomes large in proportion to the number of network subscribers.

As a method for solving this problem, there is a method disclosed in Japanese Patent Application No. 61-197611 (Japanese Patent Publication No. 04-056502).

FIG. 7 shows an example in which this system is realized as a device.

The terminals 701 and 712 are terminals having a function of performing encrypted communication according to this method, and are trying to perform encrypted communication via the network 702. Now, the user of the terminal 701 will send the communication text created to the user of the terminal 712 via the user interface 703 or the communication text already created and stored in the storage device 704 to the terminal 712 in an encrypted form. And that. At this time, the user specifies the delivery destination of the communication message via the interface 703.
Then, the random number generation device 706 randomly generates a code r having a predetermined bit length and sends it to the key information generation means 708 and the key generation means 707. The key information generating means 708 obtains the key information X _A from r, the predetermined code α, n stored in the constant storage means 705, and the secret information S _{A of the} terminal 701 stored in the storage device 704. Generate and send to network interface 710. Network interface 710
Delivers X _A and the identifier ID _A of its own terminal 701 stored in the storage device 704 to the designated delivery destination (terminal 712 in this case) via the network 702. When the network interface 720 of the terminal 712 receives X _A and ID _A , it sends them to the key generation means 717. The random number generator 716 randomly generates a code t having a predetermined bit length and sends it to the key information generating means 718 and the key generating means 717. The key generation means 717 is X _A ,
The key WK is generated from ID _A , t and the predetermined code e stored in the constant storage means 715, and is sent to the encryption device 714. The key information generation means 718 has t, a predetermined code α, n stored in the constant storage means 715, and the storage device 71.
Key information X _B from secret information S _{B of} terminal 712 stored in 4
Is generated and sent to the network interface 720.
The network interface 720 is the network 720
Destination of delivery specified by ID _A via (in this case terminal 7
In 01), X _B and the identifier ID _{B of the} own terminal 712 stored in the storage device 714 are delivered. When the network interface 710X _B of the terminal 701 and the ID _B are received, they are sent to the key generation means 707. The key generation means 707 includes X _B , ID _B , r and constant storage means 705.
The key WK is generated from the predetermined code e stored in the key and is sent to the encryption device 709.

FIG. 8 is a diagram showing the configuration of the key information generating means 708 and 718. The register (801), the register 2 (802), and the register 3 (803) each have a function of storing 256-bit data. When a pulse is detected at the terminal C, the power-residue calculation circuit 804 multiplies the 256-bit signal from the terminal I1 by considering the signal as an integer and the 256-bit signal from the terminal I2 as an integer. 256 from terminal I3 for the result
The remainder obtained by dividing the bit signal by a value regarded as an integer
The signal expressed as a 256-bit integer is output to the terminal O, and when the processing is completed, the terminal F is set and the terminal Reset
It has a function of resetting the terminal F when a pulse is detected. When a pulse is detected at the terminal C, the multiplication residue calculation circuit 805 multiplies the value obtained by considering the 256-bit signal from the terminal I1 as an integer by the value obtained by considering the 256-bit signal from the terminal I2 as an integer. On the other hand, a signal obtained by dividing the 256-bit signal from the terminal I3 by a value regarded as an integer is output as a 256-bit integer signal to the terminal O, and when the processing is completed, the terminal F is set, It has a function of resetting the terminal F when a pulse is detected at the terminal Reset. In the configuration of FIG. 7, terminals S1 to α, terminals S2 to r, terminals S3 to S _A
And S _B , terminals S4 to n are input respectively, and terminal Out
X _A and X _B are output to. The operation of the key information generating means 708 (and 718) will be described with reference to FIG. First, G0, G1, G
Each terminal of 2, G3 and G4 is reset, and a pulse is input from R to reset the respective F terminals of the power-residue calculation circuit 804 and the multiplication-residue calculation circuit 805. Next, the terminal G1 is set, and the signals of S1, S2 and S4 are stored in the register 1 (801), the register 2 (802) and the register 3 (803), respectively.
Terminal G1 is reset and terminal G0 is set. Terminal T1
A pulse is input from, and the modular exponentiation calculation circuit 804 registers 1 (801), 2 (802), and 3 (803).
The above processing is performed by using the contents of each of the above as signals from the terminals I1, I2, and I3. When the terminal A1 is set, the terminal G0 is reset, the terminal G2 is set, the output from the terminal O of the exponentiation remainder arithmetic circuit 804 is stored in the register 1 (801), and the output from S3 is stored in the register 2 (802). The signals are stored respectively. G
2 is reset and a pulse is input from R to reset the F terminals of the power-residue calculation circuit 804 and the multiplication-residue calculation circuit 805, respectively. Next, the terminal G0 is set, a pulse is input from the terminal T2, and the modular multiplication operation circuit 805 causes the register 1 (8
01), the register 2 (802) and the register 3 (803) are used as signals from the terminals I1, I2 and I3 to perform the above processing. When terminal A2 is set, terminal G0 is reset,
The terminal G3 is set, and the output from the terminal O of the modular multiplication calculation circuit 805 is stored in the register 1 (801). Terminal G
4 is set and the result is output from terminal Out.

FIG. 9 is a diagram showing the configuration of the key generation means 707 and 717. The register 1 (901), the register 2 (902), and the register 3 (903) each have a function of storing 256-bit data. The power-residue calculation circuit 904 has the same function as the power-residue calculation circuit 804. Division remainder calculation circuit 905
When a pulse is detected at the terminal C, the 256-bit signal from the terminal I2 is regarded as the 256-bit signal from the terminal I1 regarded as an integer.
The result of performing division with the value that considers the bit signal as an integer and the value that considers the 256-bit signal from terminal I3 as a modulus is
The signal expressed as a 256-bit integer is output to the terminal O, and when the processing is completed, the terminal F is set and the terminal Reset
It has a function of resetting the terminal F when a pulse is detected. In the configuration of FIG. 7, terminals S1 to X _B and X _A ,
Terminals S2 to e, terminals S3 to ID _B and ID _A , terminals S4 to n
Are input respectively and WK is output to the terminal Out. 9th
The operation of the key generation means 707 (and 717) will be described with reference to the drawing. First, the respective terminals of G0, G1, G2, G3, G4 are reset, and a pulse is applied from R to reset the F terminals of the power-residue arithmetic circuit 904 and the division-residue arithmetic circuit 905, respectively. Next, the terminal G1 is set, and the signals of S1, S2, S5 are respectively registered 1 (901), register 2 (902), register 3 (903).
Will be stored in. Terminal G1 is reset and terminal G0 is set. A pulse is input from the terminal T1, and the exponentiation remainder arithmetic circuit 904 processes the contents of the register 1 (901), the register 2 (902), and the register 3 (903) as signals from the terminals I1, I2, and I3. I do. When the terminal A1 is set, the terminal G0 is reset, the terminal G2 is set, the output from the terminal O of the modular exponentiation arithmetic circuit 904 is stored in the register 1 (901), and the output from S3 is stored in the register 2 (902). The signals are stored respectively. G2 is reset, a pulse is input from R, and the F terminals of the power-residue arithmetic circuit 904 and the division-residue arithmetic circuit 905 are reset. Next, the terminal G0 is set, a pulse is input from the terminal T2, and the division remainder arithmetic circuit 90
Reference numeral 5 performs the above-described processing by using the contents of the register 1 (901), the register 2 (902), and the register 3 (903) as signals from the terminals I1, I2, and I3. When terminal A2 is set, the terminal
G0 is reset, terminal G3 is set, register 1
The output from the terminal O of the division and remainder calculation circuit 905 is stored in (801), and the signal from S4 is stored in the register 2 (802). G3 is reset, and a pulse is input from R to reset the F terminals of the power-residue calculation circuit 904 and the division-residue calculation circuit 905, respectively. Next, terminal G0 is set,
A pulse is input from the terminal T1, and the modular exponentiation calculation circuit 904 registers 1 (901), 2 (902) and 3 registers.
The above processing is performed by using the contents of (903) as signals from the terminals I1, I2 and I3. When terminal A1 is set, terminal G0
Is reset, terminal G2 is set, and register 1 (90
The output from the terminal O of the modular exponentiation calculation circuit 904 is stored in 1). Terminal G4 is set and the result is output from terminal Out.

In the method disclosed in Japanese Patent Application No. 61-197611 (Japanese Patent Publication No. 04-056502), the identifiers ID _A and ID _B , and the predetermined codes α, n and e have different values of r and t. Even if
WK generated by key generation means 707 and generated by key generation means 717
It is predetermined so that it matches WK. Therefore, the communication text is encrypted by the encryption device 709 using WK as a key, delivered to the encryption device 719 of the terminal 712 via the network interface 710, the network 702, and the network interface 720, and the encryption device 719 transmits the W
By decrypting with K as a key, the user of the terminal 712 can read the message via the user interface 713.

Since this method shares a key between the communication side and the receiving side, there is a problem that it cannot be used in an electronic bulletin board system having a bulletin board at the center.

(Means for Solving Problems) The present invention is a network including a center and a terminal, wherein the terminal stores a device for generating a random number code and a first secret code known only to the terminal. A key information generation device for generating key generation information by inputting the random number code, the first secret code, and a predetermined first digital pattern, and an encryption device for generating an encryption key. A key generation device; and a first cryptographic device that generates a ciphertext by inputting the encryption key and plaintext, the encrypted ciphertext, the key creation information, and identification information of the terminal, or An encryption device including a second encryption device that transmits identification information corresponding to a user who is using a terminal, and the center receives the decryption key and the ciphertext to restore the plaintext. In the terminal, the first cryptographic key generation means outputs the cryptographic key of the terminal by inputting a predetermined second digital pattern and the random number code, and the center only outputs the cryptographic key. An apparatus for storing a known second secret code, a key generation information received from the terminal, identification information of the terminal, or identification information corresponding to a user using the terminal is predetermined. And a decryption key generation device for generating the decryption key by inputting the third digital pattern and the second secret code, regardless of the contents of the random number code generated on the terminal side and the decryption key. Identification information of the first digital pattern, the second digital pattern, the third digital pattern, and the terminal so that the keys match. Other is characterized by defining the secret code of the center secret code of the identification information corresponding to the user using the terminal device.

Further, the present invention is a network comprising a center and a terminal, wherein the terminal generates a random number code, a device stores a first secret code known only to the terminal, and the random number code. A key information generation device for generating key generation information by inputting the first secret code and a predetermined first digital pattern, a decryption key generation device for generating a decryption key, the decryption key and encryption The first to restore plaintext by inputting text
Of the encryption device, and transmits the key creation information and the identification information of the terminal or the identification information corresponding to the user who is using the terminal, receives the ciphertext encrypted by the center, The center generates a ciphertext by inputting the encryption key and the plaintext.
An encryption device for transmitting the ciphertext to the terminal, wherein the terminal inputs the predetermined second digital pattern and the random number code to the first encryption key generating means. A device for outputting the decryption key of the terminal as the, the center stores a second secret code known only to the center, the key creation information received from the terminal, and the identification information of the terminal, or An encryption key generation device for generating the encryption key by inputting identification information corresponding to a user who is using the terminal, a predetermined third digital pattern, and the second secret code, Regardless of the content of the random number code generated on the terminal side, the first digital pattern and the second digital pattern are matched so that the encryption key and the decryption key match. Wherein the determining and the secret code of the identification information corresponding to the user pattern and said third digital pattern using the identification information or the terminal of the terminal and the secret code of the terminal center.

(Operation) FIG. 1 is a view showing the operation and principle of the present invention.

1A shows the case where the user A sends data to the center, and FIG. 1B shows the case where the center B sends data to the user B at the request of the user B. A and B may be the same. Each user i has a secret integer Si, and further has integers α, n, and y common to all users. The center has a secret integer r and other integers e and n. These integers should be distributed in advance by a reliable person or institution. The method of setting will be described later. Further, it is assumed that each user i corresponds to an IDi in which a name, an address, etc. are coded, and anyone knows this IDi. E _K (DaTa) and E _K (ED) in the figure respectively indicate that DaTa is encrypted with the key K and ED is encoded with the key K. Further, a (mod b) means a remainder obtained by dividing a by b. FIG. 1 (a) is the first invention, the first
Figure (b) shows the operation and principle of the second invention.

In FIG. 1 (a), user A generates a random number rA, and IK
Calculate A ^rA (mod n) and XA = SA · α ^rA (mod n). IKA
Data is encrypted with ED = E _IKA (DaTa) using
Send (IDA, XA, ED) to the center. Center is IK = (X
A ^e .IDA) ^r (mod n) is calculated, and ED is decrypted using IK as a key to obtain data. That is, DaTa = _IK (ED).

Here, Si, n, α, e, r, and y are defined as follows. n is the product of two prime numbers p and q, and determines the size of p and q to the extent that factoring n is difficult. For example, it is sufficient that both p and q are about 2 ²⁵⁶ . Let e be a prime number less than n and α be an integer less than n. Furthermore, d is changed to e ・ b (mod (p-1) (q-
1)) = 1 so that Si = IDi- ^d (mod n). Further, r is a randomly defined integer less than n, and y
= Α ^{e · r} (mod n). At this time, IDi ＝ Si ^-e (mod
n). This is Volume 21 of the Communication of the ACM magazine.
This is true because the so-called RSA public key cryptosystem described on pages 120 to 126 is used. Now, IKA ＝ y ^rA (mo
dn) = α ^{e · r · rA} (mod n), while IK = (XA ^e
・ IDA) ^r (mod n) = (SA ^e · α ^{e · r · rA} · IDA)
_r (mod n) = α ^{e · r · rA} (mod n) and is equal to IKA. Therefore, if ED is decrypted with IK as the key, the original data is restored.

Since only user i knows Si (provided that the trusted person or institution that created Si does not commit fraud), XA can only be created by user A. Since r is known only by the center, only the center can process IK = (XA ^e · ID) ^r (mod n). Therefore IKA = IK is user A
And only the center can be made. From the above, the operation and principle of the first invention have been shown.

There are other IK generation methods than those shown in FIG. For example, as shown in the following example. User A uses ZA = α ^{e · rA} (mod
n) and WA = SAα ^{c · rA} (mod n) are sent, and at the center (ZA ^c · WA ^e ) ^-1 (mod n) = IDA, IK = ZA ^r (mod n)
Make IK from. (ZA ^c・ WA ^e ) ^-1 (mod
If n) = IDA, the key delivery process is interrupted because there is an error or tampering. Here, c is a fixed prime number.

FIG. 1 (b) shows a case where the user requests data from the center. In the figure, data transmission is shown in Fig. 1 (a).
It is the opposite. However, the data encryption keys IKB and I
The method of creating K is exactly the same as in FIG. 1 (a). Therefore, if Si, n, α, e, r, and y are set in the same manner as in FIG. 1A, data can be secretly transferred to a third party.

(Embodiment) FIG. 2 is a configuration diagram showing a first embodiment of the present invention. In this embodiment, the present invention is applied to an electronic bulletin board system (hereinafter referred to as BBS) in a personal computer network. Although it can be applied to an e-mail system or a database system, only the BBS will be described for the sake of simplicity.

Each user i holds an IC card in which IDi, Si, α, and n are written. When user A accesses the BBS,
Insert the IC card 213 into the card reader 212 of a certain terminal 211. Each terminal 211 performs processing according to the flowchart shown in FIG. That is, from the IC card to SA, IDA,
Read α and n, generate a random number rA and calculate XA. Since user A is currently accessing terminal 211, i
Is A. same as below. If writing to BBS, I
KA is calculated, and the data to be written in BBS is encrypted with IKA as a key and sent to BBS together with IDA and XA. Conversely, when reading the information posted on the BBS, a transmission request is issued to the BBS, but IDA and XA are also sent at that time, and a random number rA used later is stored in an appropriate place. On the other hand, in the BBS, as shown in FIG. 3 (b), first, when write data is sent, IK is calculated, and the ciphertext is decrypted and written on the bulletin board. If the request is to browse the bulletin board, IK is calculated first, and then the message on the bulletin board is encrypted and sent. Returning to FIG. 3 (a) again, when the ciphertext is sent from the BBS, the IKA is calculated using rA previously stored and the sent ciphertext is decrypted. The IKA may be calculated before the ciphertext from the BBS arrives.

FIG. 4 is a block diagram showing a second embodiment of the present invention. In this embodiment, the present invention is applied to an electronic mail system in a personal computer network. It can also be applied to electronic bulletin board systems and database file systems.

Each user i holds an IC card in which IDi, Si, α, and n are written. It is assumed that the user A sends a mail to the user B. Card reader 412 of user A or terminal 411
Insert the IC card 413 into the. Each terminal performs processing according to the flowchart shown in FIG. That is, SA, IDA, α, n are read from the IC card, random numbers rA and WK are generated and X
Calculate A and IKA. Since user A is accessing terminal 411, i in the figure is A. same as below. IKA
The work key WK is encrypted with the key as EKA, and the email is encrypted with WK. And the encrypted mail
Send to mail center 430 with IDA, IDB, XA, EKA. In the figure, IDj is identification information of the mail receiving user. The mail center 430 performs processing according to the flowchart shown in FIG. That is, from user A to IDA, IDB, XA, EK
When A and the encrypted mail are received, IKA is calculated from XA and IDA, and WK is calculated from WK = D _IKA (EKA). This WK and encrypted mail are stored in the mailbox 432 for the user B. When the user B requests the mail text addressed to himself / herself, the IC card 423 is inserted into the IC card reader 422 of an arbitrary terminal (here, 421). As shown in FIG. 5 (a), the terminal 421
Read SB, IDB, α, n from the IC card, generate random number rB and calculate XB. And IDB, XB in the mail center 430
To send a mail request. As shown in FIG. 5B, the mail center 430 calculates IKB, sends WKB read from the mailbox addressed to B to EKB encrypted with IKB, and encrypted mail to the terminal 421. Terminal 421 calculates IKB when receiving EKB and encrypted mail, as shown in Fig. 5 (b) WK = D
_{Calculate the} work key WK from _IKB (EKB). This WK is used to decrypt the encrypted mail text and obtain the original mail. IK
B may be calculated before encrypted mail arrives from the mail center.

Although the work key WK and the encrypted mail are stored in the mailbox of the mail center in this embodiment, the work key is stored in a different place from the mailbox or a key unique to the mail center for safety. You can specify the MK, encrypt the MK with the MK, and store it in the mailbox.

In the above description of the embodiments, Si, α, n, y, e, r
However, as a countermeasure when the IC card is stolen and the personal identification information of the IC card is stolen, an expiration date can be set for some of the above parameters. For example Si
= (IDi, year) ^d (mod n). Where (I
(Di, era) is a pattern in which IDi and era patterns are arranged.

It is possible to set an expiration date for other n or the like. There is also an embodiment in which users are divided into groups, the key distribution shown in the method of the present invention is performed for each group, and the conventional key distribution method or the method of the present invention is used between the groups.
These are included in the scope of the present invention.

(Effects of the Invention) As described in detail above, the use of the present invention brings about an effect that each user and the center can carry out encrypted communication with little information.

[Brief description of drawings]

FIGS. 1 (a) and 1 (b) are diagrams for showing the operation and principle of the present invention, FIGS. 2 and 4 are configuration diagrams showing the first and second embodiments of the present invention, and FIG. 5 (a) and 5 (b) are flow charts showing the processes to be performed by the terminal and the center shown in FIGS. 2 (a) and 4 (b), and FIGS. 6 (a) and 7 (b) are prior arts. Fig. 8 is a block diagram of the device using
Block diagram of key information generation means 708 and 718 in the figure, ninth
The figure is a block diagram of the key generation means 707 and 717 in FIG. In the figure, 201 is an electronic bulletin board, 211, 411 and 421 are terminals,
212, 412, 422 are card readers, 213, 413, 423 are IC cards, 430 is a mail center, 431, 432 are mailboxes, 601 is a terminal, 602 is a network, 603 is a user interface, 604 is public information management means, 605 is a public information list, 606 is a storage device, 607 is an encryption device, 608 is a network interface, 609 is a channel for connecting devices and means from 603 to 608 to each other, 702 is a network, 701 and 712 are terminals, and 703 and 713 are User interfaces, 704 and 714 are storage devices, 705 and 715 are constant storage means, 706 and 716 are random number generation devices, 707 and 717 are key generation means, 70
8,718 is key information generating means, 709,719 are encryption devices, and 711 is 703.
To 710 to 721 are channels for mutually connecting the devices and means from 713 to 720, and 801, 802 and 803 are 256 channels.
A register that can store a code of bits, 80
4 is a modular exponentiation arithmetic circuit, 805 is a modular multiplication remainder arithmetic circuit, 901, 9
Each of 02 and 903 is a register capable of storing a 256-bit code, 904 is a modular exponentiation arithmetic circuit, and 905 is a division modulo arithmetic circuit.

Claims (2)

[Claims] 1. A network composed of a center and a terminal, wherein the terminal generates a random number code, a device stores a first secret code known only to the terminal, the random number code and the random number code. A key information generation device for generating key generation information by inputting a first secret code and a predetermined first digital pattern, an encryption key generation device for generating an encryption key, and the encryption key And a first encryption device that generates a ciphertext by inputting plaintext, and corresponds to the encrypted ciphertext, the key creation information, the identification information of the terminal, or the user who is using the terminal. And a second encryption device that restores the plaintext by inputting a decryption key and the ciphertext, the terminal transmitting the identification information The encryption key generating means of No. 1 outputs the encryption key of the terminal by inputting the predetermined second digital pattern and the random number code, and the center secretes the second secret code which only the center knows. A device for storing a code; a third digital pattern in which the key creation information received from the terminal, identification information of the terminal, or identification information corresponding to a user using the terminal is predetermined; A decryption key generation device for generating the decryption key by inputting the second secret code, and the encryption key and the decryption key are matched so that the encryption key and the decryption key match regardless of the content of the random number code generated on the terminal side. The first digital pattern, the second digital pattern, the third digital pattern, identification information of the terminal, or the terminal is used. Encryption apparatus characterized by defining the identification information corresponding to the over The secret code of the terminal and the secret code of the center. 2. A network composed of a center and a terminal, wherein the terminal generates a random number code, a device stores a first secret code known only to the terminal, the random number code and the random number code. A key information generation device for generating key generation information by inputting a first secret code and a predetermined first digital pattern, a decryption key generation device for generating a decryption key, the decryption key and ciphertext To recover plaintext with input
Of the encryption device, and transmits the key creation information and the identification information of the terminal or the identification information corresponding to the user who is using the terminal, receives the ciphertext encrypted by the center, The center generates a ciphertext by inputting the encryption key and the plaintext.
An encryption device for transmitting the ciphertext to the terminal, wherein the terminal inputs the predetermined second digital pattern and the random number code to the first encryption key generating means. A device for outputting the decryption key of the terminal as the, the center stores a second secret code known only to the center, the key creation information received from the terminal, and the identification information of the terminal, or An encryption key generation device for generating the decryption key by inputting identification information corresponding to a user who is using the terminal, a predetermined third digital pattern, and the second secret code, The first digital pattern and the second digital pattern are matched so that the encryption key and the decryption key match regardless of the content of the random number code generated on the terminal side. An encryption characterized by defining a turn, the third digital pattern, identification information of the terminal or identification information corresponding to a user who is using the terminal, a secret code of the terminal, and a secret code of the center. apparatus.