JP2000261426A - Encryption communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an encryption communication system that can deliver an encryption key at a high speed while securing high security. SOLUTION: Encryption data resulting from encrypting plaintext data at an encryption section 1 are transmitted to a decoding section 13, the decoding section 13 decodes the encrypted data to obtain plaintext data in this encryption communication system. In the case of delivering an encrypted key from the encryption section 1 to the decoding section 13 that is required to realize the encryption communication, the encryption section 1 and the decoding section 13 store in advance part of the same encryption key and a parameter to designate the stored encryption key and the remaining part of the encryption key are transmitted via a communication network.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an encryption system for transmitting an encryption key from a transmission side (encryption side) to a reception side (decryption side) when encrypting data transmitted on a communication network. In particular, the present invention relates to an encryption communication system capable of delivering encryption keys at high speed while ensuring high security.

[0002]

2. Description of the Related Art Generally, data is encrypted for protecting the data (information) transmitted on a communication network. In the case of the common key cryptosystem, it is necessary to share the encryption key used in the encryption between the transmission side (encryption side) and the reception side (decryption side), but the same encryption key is always used. In such a case, there is a possibility that the cipher text may be decrypted by another person. Therefore, a method of changing an encryption key at a predetermined timing, for example, for each data unit has become common. Therefore, the transmitting side must deliver the encryption key corresponding to the encrypted data to the receiving side via the network. When distributing the encryption key, it is originally undesirable to send the encryption key as it is via a communication network that may leak security. For this reason, there is a method in which the encryption key itself is encrypted using another encryption method and sent.However, the receiving side first decrypts the encrypted encryption key data with a decryptor to obtain the encryption key, and then obtains the encryption key. The encrypted data is decrypted using the encryption key, and it takes a predetermined processing time from reception to completion of data decryption. However, in recent years, with the speeding up of the network, such a double decoding process has a problem that it cannot catch up with the transmission speed. Similarly, on the transmitting side, a processing time for encrypting data can be secured due to an increase in transmission speed, but a processing time for encrypting an encryption key cannot often be secured. That is, when the communication speed is increased and a large amount of data is transferred in a short time, the data encryption including the key encryption may not be performed in time. As a countermeasure, the same encryption key is stored in advance on the transmission side and the reception side, and when using the encryption key, a parameter specifying the encryption key is transmitted from the transmission side to the reception side via a communication network. There has been proposed a method in which an encryption key is selected, that is, a method in which an encryption key used for data encryption is shared between a transmission side and a reception side.

[0003]

However, in the method of holding the encryption keys on both the transmitting and receiving sides as described above, a large number of encryption keys cannot be stored because the capacity of the memory for that purpose is limited. There was a problem. Originally, the more secret keys you have, the more confidentiality will improve,
If the memory capacity is limited, the number of available encryption keys is reduced, and it becomes easy for a third party to specify the encryption key, which leads to weakening of the encryption strength. The present invention has been made to solve the above problems, and has as its object to provide an encryption communication system capable of performing high-speed encryption key distribution while ensuring high security.

[0004]

In order to achieve the above object, according to the first aspect of the present invention, plaintext data is transmitted after being encrypted using an encryption key, and decrypted on the receiving side using the same encryption key. In a cryptographic communication system, a transmitting side and a receiving side hold a large number of encryption keys (hereinafter referred to as “held keys”), and at the time of encryption on the transmitting side, select one of the held keys (hereinafter referred to as “selected key”). Key)), generates a second encryption key (hereinafter referred to as a “transmission key”), combines or combines the second encryption key (transmission key) and the selected key, and encrypts plaintext to be transmitted. Transmitting the second encryption key (sending key) and a parameter indicating the selection key attached to the encrypted text;
On the receiving side, a corresponding encryption key is selected from the stored encryption keys based on the parameters, and the transmitted encryption key is combined or synthesized with the transmitted transmission key (second key). The method is characterized in that the sentence is decoded. According to a second aspect of the present invention, in a cryptographic communication system in which plaintext data is encrypted by an encrypting unit and plaintext data is transmitted, and the plaintext data is obtained on the receiving side by decrypting the ciphertext data, the transmitting side and the receiving side are On the transmitting side, the encryption unit holds a plurality of the same encryption keys (“holding keys”), and the encryption unit generates a partial encryption key B, and any one of the holding keys (selection key) Key number generating means for generating a key number for designating the partial key B, and a selection key A selected based on the key number and a partial encryption key B generated by the partial encryption key generation means. A key generation unit, an encryption unit that performs encryption using the encryption key generated by the first encryption key generation unit, and a unit that transmits the key number and the generated partial encryption key B. On the receiving side, the transmitted partial encryption key B and Means for extracting each of the numbers from the numbers, means for reading the corresponding partial encryption key A from the encryption key held based on the key number, and a second encryption key for synthesizing the keys with the partial encryption keys A and B It is characterized by comprising a generating means and a decrypting means for decrypting the encrypted data using the encryption key.

[0005]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described based on illustrated embodiments. FIG. 1 is a configuration diagram showing an embodiment of a cryptographic communication system according to the present invention. This cryptographic communication system relates to a system in which plaintext data is transmitted after being encrypted using an encryption key, and is decrypted on the receiving side using the same encryption key. In this cryptographic communication system,
Each of the transmitting side and the receiving side holds a large number of encryption keys (hereinafter, referred to as holding keys). As shown in FIG. 1, in this encryption communication system, as an encryption unit on the transmission side, an encryption unit 1 for inputting and encrypting plaintext data and a key number of an encryption key used for the encryption are designated. A key number generating unit 3; a partial encryption key generating unit 5 for generating a partial encryption key; a first storage unit 7 connected to the key number generating unit 3; A first encryption key generation unit 9 connected to the first storage unit 7 and generating an encryption key for the encryption unit 1;
It has a first distribution unit 11 connected to the key number generation unit 3 and the partial encryption key generation unit 5, and decrypts the ciphertext data from the encryption unit 1 as a decryption unit on the receiving side. Decoding unit 13, a second delivery unit 15 connected to the first delivery unit 11, a second storage unit 17 connected to the second delivery unit 15, and a second delivery unit A second encryption key generation unit 19 connected to the unit 15 and the second storage unit 17 to generate an encryption key for the decryption unit 13; Here, the encryption key (length N bits) has two parts as shown in FIG. 2, and one of them is a partial encryption key A (length N1 bits).
And the other is a partial encryption key B (length is N2 bits) (where N1 + N2 = N). In the example shown in FIG. 2, N = 120, N1 = 60 and N2 = 60 have the same bits, and each encryption key is represented by a binary number. Note that, at the time of encryption, the transmitting side selects any one of the held keys and uses it as a partial encryption key A. The key selected at this time is referred to as a selection key. The second encryption key B generated at the time of encryption is referred to as a transmission key.

Next, the operation of the above cryptographic system will be described. First, the partial encryption key A, which is one of the divided encryption keys, is generated in advance, and the first storage unit 7 on the transmission side (encryption unit) and the second storage unit 1 on the reception side (decryption unit).
7 respectively. That is, the first storage unit 7 and the second storage unit 17 are in a state where a plurality of partial encryption keys A are stored in advance. The partial encryption key B which is the other of the divided encryption keys is generated by the partial encryption key generation unit 5. Here, the partial encryption key generation unit 5 is, for example, a random number generator, and can generate a large number of encryption keys without being limited by the storage unit capacity like the partial encryption key A. Next, the generated partial encryption key B is transmitted to the first distribution unit 1 together with the key number (specifying the partial encryption key A) generated by the key number generation unit 3.
In 1, it is converted into transmission data and transmitted to the receiving side (decoding unit). That is, the partial encryption key B and the key number are transmitted as plaintext data without being encrypted. At the same time, the key number generated by the key number generation unit 3 is input to the first storage unit 7 and the designated partial encryption key A
Is read. The partial encryption key B generated by the partial encryption key generation unit 5 and the partial encryption key A (corresponding to the partial encryption key B) read from the first storage unit 7 are stored in the first encryption key generation unit. 9 and used as the encryption key in the encryption unit 1. That is, in the encryption unit 1, the input plaintext data is encrypted by the encryption key and sent to the decryption unit 13 via the transmission path as encrypted data.
FIG. 3 shows the transmission data (ciphertext data, key number, partial encryption key B) from the first delivery unit 11 and the encryption unit 1.
Here is an example.

Next, on the receiving side (decryption unit), the key number and the partial encryption key B sent from the first distribution unit 11 are separated by the second distribution unit 15, and the key number is The partial encryption key A is input to the second storage unit 17 and read. Partial encryption key B and corresponding partial encryption key A
Is input to the second encryption key generation unit 19 and an encryption key is synthesized, and this encryption key is used for decryption by the decryption unit 13.
That is, the input ciphertext data is decrypted by the decryption unit 13 using the encryption key and output as plaintext data. As described above, a plurality of partial keys are combined or combined as an encryption key used for encryption, and some of the plurality of partial encryption keys are newly generated on the transmission side each time, and While transmitting the newly generated partial encryption key to the receiving side, the other remaining partial ciphers are selected in advance from the same encryption key group provided for both the transmitting side and the receiving side, and A parameter such as a number for selection is transmitted to the receiving side, and the transmitting side encrypts data to be transmitted by combining the newly generated partial cipher and the selected partial cipher, and the receiving side transmits the transmitted partial cipher. Since the received data is decrypted with the encryption key obtained by combining the partial encryption key selected based on the parameter and the directly transmitted partial encryption key, at least the directly sent encryption key is used as is. Have to be able to have, because the process of decrypting the encrypted key as in the prior art for its part is not required, the decoding processing time is shortened. In addition, since the encryption key transmitted through the transmission path is a part of the whole, even if it is obtained by a third party during transmission, it is difficult to obtain the remaining partial encryption, so that the confidentiality is hardly degraded. . Although the transmission key is transmitted as it is in the above embodiment, it may be useful to reduce the length of the transmission key and further encrypt the transmission key. That is, the encryption of the key takes time to decrypt on the receiving side, but if the bit length is short, the processing time will not be much redundant. In the embodiment shown in FIG. 2, N1 and N2 have the same bit length, but may have different bit lengths. Needless to say, three or more partial encryption keys may be used. Further, for example, as shown in FIG. 4, if the partial encryption key B is divided into two and connected before and after the partial encryption key A, the encryption key can be obtained even if the partial encryption key B is obtained from the transmission path. Since the correlation with the whole becomes low, improvement in encryption strength can be expected.

[0008]

As described above, according to the present invention, only a part of the encryption key used for encrypting data is delivered, so that the encryption key is not encrypted at the time of delivery. Thus, it is possible to safely distribute the encryption key even on a high-speed transmission path.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an embodiment of a cryptographic communication system according to the present invention.

FIG. 2 is an explanatory diagram of division of a partial encryption key B shown in FIG.

FIG. 3 is an explanatory diagram of transmission data from an encryption unit shown in FIG. 1;

FIG. 4 is an explanatory diagram in a case where a partial encryption key B is divided into two and connected before and after a partial encryption key A is used as an encryption key.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Encryption part, 3 ... Key number generation part, 5 ... Partial encryption key generation part, 7
... first storage unit, 9 ... first encryption key generation unit,
11: first delivery unit, 13: decoding unit,
15: second delivery unit, 17: second storage unit, 19: second encryption key generation unit,

Claims (2)

[Claims] 1. An encryption communication system in which plaintext data is transmitted after being encrypted using an encryption key and then decrypted using the same encryption key on the receiving side, wherein the transmitting side and the receiving side hold many encryption keys. At the time of encryption on the transmitting side, one of the held keys is selected (hereinafter, “selected key”) and the second key is selected.
(Hereinafter referred to as “sending key”), and after combining or synthesizing the second encryption key (sending key) and the selected key, encrypts the plaintext to be transmitted, and attaches it to the encrypted text. The second encryption key (sending key) and a parameter indicating the selected key are transmitted. On the receiving side, the corresponding encryption key is selected from the stored encryption keys based on the parameter, and transmitted. A cipher communication system characterized in that the transmitted cipher text is decrypted by combining or combining the transmitted transmission key (second key). 2. In a cryptographic communication system in which plaintext data is transmitted by encrypting a plaintext data in an encrypting section and plaintext data is obtained on the receiving side by decrypting the ciphertext data, the transmitting side and the receiving side are the same. On the transmitting side, the encryption unit holds a large number of encryption keys (“holding keys”), and a partial encryption key generating unit that generates a partial encryption key B, and one of the holding keys (selection key). Key number generation means for generating a key number to be designated; a selection key A selected based on the key number; and a partial encryption key B generated by the partial encryption key generation means
First encryption key generation means for synthesizing the first encryption key, encryption means for performing encryption using the encryption key generated by the first encryption key generation means, the key number and the generated partial encryption key B, On the receiving side, means for extracting each of the transmitted partial encryption key B and the key number, and a corresponding partial encryption key A from the encryption key held based on the key number. Reading means, a second encryption key generating means for combining the partial encryption key A and the partial encryption key B with the key, and a decryption means for decrypting the encrypted data using the encryption key. Cryptographic communication system.