JP2016134722A - Key sharing device, key sharing system, key sharing method, program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a key sharing device capable of sharing a key without specifying a partner.SOLUTION: A key sharing device includes a random number generation unit for generating random numbers, a DH operation unit for generating DH operation values based on the random numbers, a ciphertext generation unit for generating a ciphertext by encrypting the DH operation values based on the conditions for specifying the attributes of the user of other key sharing device, a decryption unit for decrypting a ciphertext generated by other key sharing device and published by a predetermined public bulletin device, by using an attribute key generated based on the attribute information indicating the attributes of the user of a key sharing device, and acquiring the decryption results, and a common key generation unit for generating a common key by using the decryption results and random numbers.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a key sharing apparatus, a key sharing system, a key sharing method, and a program that share a shared key with other key sharing apparatuses.

  SSL / TLS (Secure Sockets Layer / Transport Layer Security) is known as a protocol for performing communication by executing authentication and key exchange (key sharing) (Non-Patent Document 1). In the protocol of Non-Patent Document 1, authentication and key exchange (key sharing) are performed separately. On the other hand, an authentication key exchange method that simultaneously performs authentication and key exchange (key sharing) is known (Non-Patent Document 2).

The outline of Non-Patent Documents 1 and 2 and the problems of these techniques will be described with reference to FIGS. FIG. 1 is a block diagram showing the configuration of the key sharing system of Non-Patent Document 1. FIG. 2 is a block diagram showing the configuration of the key sharing system of Non-Patent Document 2. As shown in FIG. 1, the key sharing system 900 of Non-Patent Document 1 is a system including an authentication device 91 and a key sharing device 92. FIG. 1 shows an example in which authentication is performed between two authentication devices 91A-91B and key exchange (key sharing) is performed between two key sharing devices 92A-92B. Authentication device 91A is, in advance to get a pre-public key PK _B from the authentication partner authentication device 91B, it is confidential managing the SK _A is a secret key of its own. Similarly, the authentication device 91B is, in advance to get a pre-public key PK _A from the authentication partner authentication device 91A, it is confidential managing the SK _B is a secret key of its own. The authentication device 91A generates a signature σ _A using its own secret key SK _A , and transmits the signature σ _A to the authentication device 91B. Authentication device 91B receives the signature sigma _A, by verifying the signature sigma _A with the public key PK _A of the authentication device 91A, which authenticates the authentication device 91A. Similarly, the authentication device 91B generates and transmits a signature σ _B using its own secret key SK _B , and the authentication device 91A verifies the signature σ _B with the public key PK _B of the authentication device 91B, thereby authenticating. The device 91B is authenticated.

If the above authentication is successful, the key sharing apparatus 92A generates a random number R _A, based on the generated random number R _A, generates a value X _A is a value necessary for generating the shared key K, the key sharing Transmit to device 92B. Similarly, key sharing apparatus 92B generates a random number R _B, based on a random number R _B to generate a value X _B is a value necessary for generating the shared key K, and transmits the key sharing device 92A. The key sharing apparatuses 92A and 92B generate the shared key K based on the values X _A and X _B. In the key sharing system 900 of Non-Patent Document 1, key sharing is executed in this way.

Hereinafter, the case where the attacker terminal 8 intervenes in the key sharing system 900 will be described. Assume that the attacker terminal 8 is interposed between the authentication devices 91A and 91B and between the key sharing devices 92A and 92B. During signature exchange attacker terminal 8 receives the signature sigma _A, sigma _B, the received signature sigma _A, and transfers the sigma _B as a regular destination. That is, at the time of exchanging signatures, even if the attacker terminal 8 is present, the signature is exchanged in the same manner as when the attacker terminal 8 is not present. When the attacker terminal 8 behaves in this way, the authentication devices 91A and 92A cannot recognize that the attacker terminal 8 is interposed. The authentication device 91A erroneously determines that its communication partner is a genuine authentication device 91B, and the authentication device 91B erroneously determines that its communication partner is a genuine authentication device 91A. Thereafter, the key sharing apparatuses 92A and 92B transmit the values X _A and X _B to the attacker terminal 8, and thus the attacker terminal 8 can obtain the shared key K. As described above, the technique of Non-Patent Document 1 is vulnerable to man-in-the-middle attacks.

On the other hand, the key sharing system 700 of Non-Patent Document 2 shown in FIG. 2 overcomes the above problems by performing authentication and key exchange (key sharing) simultaneously. In the key sharing system 700 shown in FIG. 2, the values X _A and X _B exchanged between apparatuses are configured so that the signature data and the data necessary for generating the shared key are inseparably integrated, and authentication and key exchange are performed. Since (key sharing) is performed at the same time, a secure protocol against the above-mentioned man-in-the-middle attack is realized.

Information Processing Promotion Organization, “Explanation of SSL (Problem Investigation of X.509 Electronic Certificate)”, [online], March 1999, Information Processing Promotion Organization, [Search January 8, 2015], Internet < URL: https://www.ipa.go.jp/security/fy10/contents/over-all/02/22.html> Atsushi Fujioka, Fumitaka Hoshino, Tetsutaro Kobayashi, Koutarou Suzuki, Berkant Ustaoglu, and KzukiYoneyama, “id-eCK Secure ID-Based Authenticated Key Exchange on Symmetric and Asymmetric Pairing,” IEICE Trans, Fundamentals, Vol. E96-A, No.6 JUNE 2013.

  Both Non-Patent Documents 1 and 2 require the communication partner's ID or public key for authentication. That is, the problem is that communication can only be performed with a known partner. Therefore, an object of the present invention is to provide a key sharing apparatus that can share a key without specifying a partner.

  The key sharing apparatus of the present invention includes a random number generation unit, a DH calculation unit, a ciphertext generation unit, a decryption unit, and a shared key generation unit.

  The random number generator generates a random number. The DH calculation unit generates a DH calculation value based on the random number. The ciphertext generation unit generates a ciphertext by encrypting the DH operation value based on a condition for designating a user attribute of another key sharing apparatus. The decryption unit decrypts the ciphertext generated by another key sharing device and published by a predetermined public posting device, using the attribute key generated based on the attribute information indicating the attribute of the user of the key sharing device. Get the decryption result. The shared key generation unit generates a shared key using the decryption result and a random number.

  According to the key sharing apparatus of the present invention, it is possible to share a key without specifying a partner.

The block diagram which shows the structure of the key sharing system of a nonpatent literature 1. FIG. The block diagram which shows the structure of the key sharing system of a nonpatent literature 2. FIG. 1 is a block diagram illustrating a configuration of a key sharing system according to a first embodiment. 6 is a flowchart illustrating an operation of an encryption unit of the key sharing apparatus according to the first embodiment. 6 is a flowchart illustrating an operation of a key generation unit of the key sharing apparatus according to the first embodiment.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

The configuration of the key sharing system according to the first embodiment will be described below with reference to FIG. FIG. 3 is a block diagram illustrating a configuration of the key sharing system 100 according to the present embodiment. The key sharing system 100 according to the present embodiment includes a plurality of key sharing apparatuses 1 and a public notice posting apparatus 2. FIG. 3 is an example in which two key sharing apparatuses 1 (hereinafter referred to as key sharing apparatuses 1A and 1B) exchange data via the public bulletin board 2. Although details will be described later, arrows indicated by alternate long and short dash lines in FIG. 1 indicate data input / output paths when the user manually uploads and downloads data. In this embodiment, the key generation function KeyGen, the encryption function Enc (), and the decryption function Dec () of the conventional attribute-based encryption (reference non-patent document 1) are used.
(Reference Non-Patent Document 1: Tatsuaki Okamoto, Katsuyuki Takashima, “Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption,” EUROCRYPT 2012: 591-608)

  As shown in FIG. 1, the key sharing apparatuses 1 </ b> A and 1 </ b> B are configured to include an encryption unit 11 and a key generation unit 12. The encryption unit 11 includes a random number generation unit 111, a DH calculation unit 112, a ciphertext generation unit 113, and a condition storage unit 114. The key generation unit 12 includes an attribute information storage unit 121, an attribute key generation unit 122, an attribute key storage unit 123, a decryption unit 124, a shared key generation unit 125, and a shared key storage unit 126. Of the constituent requirements of the key generation unit 12, the attribute information storage unit 121 and the attribute key generation unit 122 can be omitted as appropriate for reasons described later. The public posting device 2 is a device that publishes the ciphertext generated by all the key sharing devices (the key sharing devices 1A and 1B in the example of FIG. 3).

Hereinafter, the operation of the encryption unit 11 will be described with reference to FIG. FIG. 4 is a flowchart illustrating the operation of the encryption unit 11 of the key sharing apparatus 1 according to the present embodiment. The random number generator 111 of the key sharing device 1A generates a random number _RA (S111). The DH operation unit 112 of the key sharing device 1A generates a DH (Diffie-Hellman) operation value based on the random number _RA (S112). Specifically, the DH operation unit 112 of the key sharing device 1A generates a DH operation value: X _A = g ^ R _A using the finite multiplicative group g (S112). The ciphertext generation unit 113 of the key sharing device 1A is a condition D _B (stored in advance in the condition storage unit 114) that specifies the user attribute of another key sharing device (in this example, the key sharing device 1B). to) to generate a ciphertext by encrypting the DH calculated value _{X a} based on (S113). Specifically, the ciphertext generation unit 113 of the key sharing device 1A generates a ciphertext: C _A = Enc (X _A , D _B ) (S113). The condition storage unit 114 stores in advance conditions for designating attributes of users of other key sharing apparatuses. Here, the user attributes are, for example, the company name of the company to which the user belongs, the department to which the user belongs, the job title, the user's residential area and address, the user's generation and age, the user's qualification, Alternatively, it represents all the information related to the user, such as the membership of clubs and organizations held by the user. The user of the key sharing device 1 can manually set and change the above condition D. It is assumed that the condition storage unit 114 stores a condition D set and changed by the user of the key sharing apparatus 1. By setting the condition D, the user of the key sharing device 1 can arbitrarily set the attribute of the other party who is permitted to share the key. For example, when the user of the key sharing apparatus 1 wants to share a key only with a person who has a position higher than the manager level of the company Z, the person who has a position higher than the manager level of the company Z satisfies the above condition D. Add restrictions. Further, for example, when the user of the key sharing device 1 wants to share a key only with a person living in the Kanto region, the above condition D is restricted to a person living in the Kanto region.

The same operation as described above is also executed in the encryption unit 11 of the key sharing device 1B. In particular, the random number generating unit 111 of the key sharing apparatus 1B generates a random number _{R B} (S111), DH calculation unit 112 of the key sharing apparatus 1B, using finite multiplicative group g, DH calculated value: _{X B} = g ^ _{R B} generates (S112), the key sharing apparatus 1B ciphertext generator 113, based on the condition _{D a, ciphertext: C B = Enc (X B} , D a) to produce a (S113 ).

Next, the public bulletin board 2 will be described. When the user of the key sharing device 1 wants to share the key only with the person having the desired attribute, he / she accesses the public bulletin board 2 and the public bulletin board 2 generates the ciphertext C generated by the above procedure. Upload (post) manually on the bulletin board provided. In the above example, the user of the key sharing device 1A uses the ciphertext C _A = Enc (X _A , D _B ), and the user of the key sharing device 1B uses the ciphertext C _B = Enc (X _B , D _A ). Upload on the bulletin board provided by the public notice device 2.

The user of the key sharing device 1 browses the bulletin board provided by the public bulletin board device 2 and downloads a desired ciphertext or uses the comment or explanation described in association with the ciphertext as a clue or temporarily stores it in the browser cache. The stored ciphertext is copied to a predetermined storage area of the own device. Alternatively, the user of the key sharing device 1 may download and copy all the ciphertext uploaded to the bulletin board provided by the public bulletin board device 2. The ciphertext acquisition method differs depending on the service specifications provided by the public bulletin board 2. In this example, the user of the key sharing device 1A download ciphertext C _B, the user of the key sharing device 1B is assumed to have downloaded the ciphertext C _A.

Hereinafter, the operation of the key generation unit 12 will be described with reference to FIG. FIG. 5 is a flowchart illustrating the operation of the key generation unit 12 of the key sharing apparatus 1 according to the present embodiment. The attribute information generation unit 122 of the key sharing apparatuses 1A and 1B is based on the attribute information Atr _A and Atr _B representing the attributes of the users of the key sharing apparatuses 1A and 1B, for example, the attribute-based encryption key of Reference Non-Patent Document 1 Using the generation function KeyGen, the attribute keys SK _A and SK _B are generated, and the generated attribute keys SK _A and SK _B are stored in the attribute key storage unit 123 (S122). It is assumed that the attribute information of each user is stored in advance in the attribute information storage unit 121 of the key sharing device 1. When the attribute key is generated by a reliable third party organization (TTP) or the like, the attribute information storage unit 121, the attribute information generation unit 122, and step S122 can be omitted. In this case, the key sharing apparatus 1 receives an attribute key from a third party organization (TTP) in advance and stores it in the attribute key storage unit 123 in advance.

The decryption unit 124 of the key sharing device 1A uses the attribute key SK _A stored in the attribute key storage unit 123 to be generated by another key sharing device (in this example, the key sharing device 1B) and the predetermined public posting device 2 The decrypted ciphertext C _B is decrypted to obtain a decryption result X ′ _B (S124). Specifically, the decryption unit 124 of the key sharing device 1A obtains the decryption result X ′ _B = Dec (C _B , SK _A ) of the ciphertext C _B. Correctly if the decoding is performed in step S124, the namely when the condition D _A of the key sharing device 1B is presented an attribute key SK _A to reflect the attributes of the key sharing device 1A is met, the decoded result X _{'B =} X _B. If the correct decoding has not been performed in step S124, the namely the condition D _A of the key sharing device 1B is presented, if the attribute key SK _A to reflect the attributes of the key sharing device 1A do not match, the decoded result X ' _B ≠ X _B , that is, a correct decoding result cannot be obtained. Shared key generation unit 125 of the key sharing device 1A generates a shared key K by using the decoded result X _'B and the random number _{R A} (S125). Specifically, the shared key generation unit 125 of the key sharing device 1A obtains the shared key from the calculation of K = X ′ _B ^ R _A. When decoding is performed correctly, since X ′ _B = X _B , K = X ′ _B ^ R _A = X _B ^ R _A = (g ^ R _B ) ^ R _A.

The key sharing apparatus 1B operates in the same manner. That is, the decryption unit 124 of the key sharing device 1B acquires the decryption result X ′ _A = Dec (C _A , SK _B ) of the ciphertext C _A , and the shared key generation unit 125 of the key sharing device 1B obtains the shared key. , K = X ′ _A ^ R _B is calculated from the calculation. When decryption is correctly performed, since X ′ _A = X _A , K = X ′ _A ^ R _B = X _A ^ R _B = (g ^ R _A ) ^ R _B , so the key sharing apparatus 1A It is possible to generate the same shared key K as the shared key K that is correctly generated in (1). The shared key generation unit 125 stores the generated shared key K in the shared key storage unit 126.

Key sharing apparatus 1A as described above, 1B does not identify the other party, and without direct communication, the specified condition _{D A} and _{D B} is the partner attribute _Atr A, respectively, if the true Atr _B only, The shared key K can be shared.

In the key sharing system 100 (attribute-based authentication key sharing method) of the first embodiment described above, the random numbers R _A and R _B used for key sharing and the secret keys SK _A and SK _B used for attribute-based encryption are not leaked. This is the premise of safety. As a method for protecting safety even when only one of _RA and SK _A leaks, the system may be changed as follows. After key sharing apparatus 1A generates the random number _{R A,} cryptographic hash function in generating the _{X A} using H () is _{X A = g ^ H (R} A, SK A) cipher from seeking Create the sentence C _A = Enc (X _A , D _B ). Similarly, after generating the random number _RA , the key sharing apparatus 1B also obtains X _A = g ^ H (R _A , SK _A ) when generating X _A using the cryptographic hash function H (). After that, the ciphertext C _A = Enc (X _A , D _B ) is created.

<Effect of this embodiment>
According to the key sharing system 100 and the key sharing apparatus 1 of the present embodiment, “key sharing with authentication using attributes” that enables key sharing with an attribute that satisfies a condition without specifying a partner is realized. did it. In the key sharing system 100 and the key sharing apparatus 1 according to the present embodiment, the shared key information does not leak, that is, high security is realized unless either the random number generated temporarily or the secret information based on the attribute is leaked. . If the attribute-based encryption used in this embodiment has anonymity, the third party monitoring the anonymous bulletin board will not leak information on the attributes of the person who is sharing the key, and is anonymous Key sharing can be realized. In addition, while the normal authentication key exchange method exchanges keys only between two parties, in the key sharing system 100 of the present embodiment, keys are shared at the same time if the persons whose attributes meet the conditions. The secondary effect of being able to do so was also achieved.

<Supplementary note>
The apparatus of the present invention includes, for example, a single hardware entity as an input unit to which a keyboard or the like can be connected, an output unit to which a liquid crystal display or the like can be connected, and a communication device (for example, a communication cable) capable of communicating outside the hardware entity. Can be connected to a communication unit, a CPU (Central Processing Unit, may include a cache memory or a register), a RAM or ROM that is a memory, an external storage device that is a hard disk, and an input unit, an output unit, or a communication unit thereof , A CPU, a RAM, a ROM, and a bus connected so that data can be exchanged between the external storage devices. If necessary, the hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device of the hardware entity stores a program necessary for realizing the above functions and data necessary for processing the program (not limited to the external storage device, for example, reading a program) It may be stored in a ROM that is a dedicated storage device). Data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device.

  In the hardware entity, each program stored in an external storage device (or ROM or the like) and data necessary for processing each program are read into a memory as necessary, and are interpreted and executed by a CPU as appropriate. . As a result, the CPU realizes a predetermined function (respective component requirements expressed as the above-described unit, unit, etc.).

  The present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above embodiment may be executed not only in time series according to the order of description but also in parallel or individually as required by the processing capability of the apparatus that executes the processing. .

  As described above, when the processing functions in the hardware entity (the apparatus of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. Then, by executing this program on a computer, the processing functions in the hardware entity are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, a hardware entity is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (5)

A key sharing device that shares a shared key with other key sharing devices,
A random number generator for generating random numbers;
A DH operation unit that generates a DH operation value based on the random number;
A ciphertext generation unit that generates a ciphertext by encrypting the DH operation value based on a condition for designating an attribute of a user of the other key sharing device;
Using the attribute key generated based on the attribute information representing the attribute of the user of the key sharing device, the ciphertext generated by the other key sharing device and released by the predetermined public posting device is decrypted A decryption unit for obtaining
A key sharing device including a shared key generation unit that generates the shared key using the decryption result and the random number. A key sharing system including a key sharing device that shares a shared key with another key sharing device, and a public bulletin board device,
The key sharing device includes:
A random number generator for generating random numbers;
A DH operation unit that generates a DH operation value based on the random number;
A ciphertext generation unit that generates a ciphertext by encrypting the DH operation value based on a condition for designating an attribute of a user of the other key sharing device;
Using the attribute key generated based on the attribute information representing the user attribute of the key sharing device, the ciphertext generated by the other key sharing device and released by the public posting device is decrypted, and the decryption result is obtained. A decoding unit to obtain;
A shared key generation unit that generates the shared key using the decryption result and the random number;
The public bulletin board
A key sharing system that discloses ciphertext generated by the key sharing device and the other key sharing device. A key sharing method executed by a key sharing apparatus that shares a shared key with another key sharing apparatus,
Generating a random number;
Generating a DH operation value based on the random number;
Encrypting the DH operation value based on a condition for designating a user attribute of the other key sharing device to generate a ciphertext;
Using the attribute key generated based on the attribute information representing the attribute of the user of the key sharing device, the ciphertext generated by the other key sharing device and released by the predetermined public posting device is decrypted Step to get the
A key sharing method including a step of generating the shared key using the decryption result and the random number. A key sharing device that shares a shared key with another key sharing device, and a key sharing method that is executed by a public bulletin board device,
The key sharing device includes:
Generating a random number;
Generating a DH operation value based on the random number;
Executing a step of generating a ciphertext by encrypting the DH operation value based on a condition for designating a user attribute of the other key sharing device;
The public bulletin board
Performing the step of publishing ciphertext generated by the key sharing device and the other key sharing device;
The key sharing device includes:
Using the attribute key generated based on the attribute information representing the user attribute of the key sharing device, the ciphertext generated by the other key sharing device and released by the public posting device is decrypted, and the decryption result is obtained. A step to obtain,
A key sharing method for executing the step of generating the shared key using the decryption result and the random number.   A program for causing a computer to function as the key sharing apparatus according to claim 1.

Images