JPH11215116A - Key management method and its system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a key recovering method by which abuse of the rights by a law enforcing organ, a key management organ, and an international third organ can be prevented and a user is not allowed to invalidate the enforcement of a law. SOLUTION: When a user A transmits information to another user B, the user A generates an international master key IKAB from the international open key of the user B and from the international secret key of the user A, enforcement agreement information ED by enciphering the master key IKAB and date hour information D, a session key KS from the information ED and from a national common key, and additional information INF by enciphering the master key IKAB with the open key PI of an organ 14, and adding the information INF to annexing information LEAF, and sends the information LEAF and a plaintext enciphered with the session key KS to the user B. The user B prepares the master key IKAB with the international open key of the user A and with the international secret key of the user B, additional information INF' by enciphering the master key IKAB with the open key PI of the organ 14, and, only when the information INF' coincides with the received information INF, prepares the session key KS. At the time of enforcing a law, an organ 15 sends the information LEAF to the organ 14 and the organ 14 obtains the master key IKAB by decoding the information INF with the international secret key of the organ 14, prepares the execution agreement information ED by using the key IKAB, and returns the information ED to the organ 15. The organ 15 sends the information LEAF and ED to an organ 12A and both organs 15 and 12 copy the session key KS by exchanging information between them.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION The present invention relates to a cryptographic communication system in which, based on a law or a contract, an enforcement agency having the authority to decrypt ciphertext stored during communication or stored in a database or the like falls within a prescribed range. As long as the ciphertext can be decrypted as long as it is, key management to ensure that the privacy of the user (user) will not be infringed by the enforcement agency illegally decrypting the ciphertext beyond the provisions The present invention relates to a method and a user device.

[0002]

2. Description of the Related Art In recent years, encryption technology has been widely studied as a fundamental technology for the information society, and extremely strong encryption technology has been developed. On the other hand, as strong encryption technology is developed, there is growing concern that the encryption technology itself will be used for antisocial acts. However, the current encryption technology aims to prevent anyone from eavesdropping on communications, so even if it is used for antisocial acts, it can not be recognized or caught .

[0003] Also, from the viewpoint of corporate defense, some companies have taken measures such as encrypting and storing important files in the company, but on the other hand, accidents, disasters, and other reasons have occurred. Even if a situation occurs in which an encrypted file cannot be decrypted, there is no longer any means for decrypting the file with the current encryption technology, and the file is permanently unavailable.

[0004] For this reason, technologies for enabling enforcement agencies to decrypt ciphertexts under certain conditions under laws or contracts have been studied mainly in Europe and the United States. These technologies are called key recovery or key escrow. being called. These technologies use DRF (Data Recover) to store information about a session key used for performing cryptographic communication.
y Field) or LEAF (Law Enhancement Access Fie)
ld) etc. or stored in additional data, or managed by a key management organization. This is to restore the session key from the information on the key so that the ciphertext can be decrypted. Recently, various types of key recovery (key escrow) methods have been proposed. Among them, Diffie-Hellman type key distribution methods (W. Diffie, MEHell
man, “New Directions in Cryptography,” IEEE Trans
actions in Information Theory IT-22, pp.644-655,19
76) A method that applies to it has come to be seen. The feature of this method is that the communicating parties can generate a common key from the secret information of the user and the public information of the other user, so that the ciphertext can be decrypted regardless of whether the target user is the sender or the receiver. The point that becomes. Here, I
SEC97-33 (Miyazaki, Sakurai "Examination of international issues in key escrow system" will be described as an example.

FIG. 8 shows the configuration and operation of the ISEC97-33 system. According to this method, a plurality of key storage agencies TA and TB exist in each country, and a domestic private key of a user is divided and stored. In the upper layer of the key storage agencies TA and TB in each country, there is an international third organization (upper key storage organization), which holds a public key pair corresponding to each country. The user holds a domestic public key pair and an international public key pair.

Now, consider a case where communication is performed between a sender (user) A in country X and a receiver (user) B in country Y.
First, the upper layer key storage organization sends the sender A the XA public key and the YB public key composed of the public keys of the users A and B and the secret keys of the respective countries. Sender A
An international master key is generated from the own A international secret key, the recipient B's B international public key and B domestic public key, and date and time information. Further, a session key is generated using the international master key, domestic common key, and date and time information, and the message is encrypted. Attached information called LEAF is sent to the recipient B together with the cipher text. LEAF includes B international public key, B domestic public key, A international private key, and additional information INF created from date and time information, and LEAF is information used by recipient B for decryption and law enforcement. It is hoped that the law enforcement is legitimate and cannot be nullified.

[0007] Recipient B has his own B international secret key and B domestic public key, and A's A international public key and INA in the LEAF information.
Generate an international master key from F. A session key is generated using this international master key, domestic common key, and date and time information extracted from the LEAF, and the ciphertext is decrypted. In the case of law enforcement, the law enforcement agency will obtain the LEA
Based on the F information, with the consent of the third international organization and the key storage organization of the search target user, the session key is restored and the ciphertext is decrypted through exchange with the key storage organization.

[0008]

The problem with this conventional method is that the sender can generate a LEAF that can invalidate law enforcement. An object of the present invention is to provide a key management method and a user apparatus for implementing a key recovery method in which a user cannot invalidate law enforcement while preventing abuse of authority by a law enforcement organization, a key storage organization, and an international third organization. Is to provide.

[0009]

In order to achieve the above object, according to the present invention, a sender device A attaches information required for a law enforcement stage as an LEAF. Sender device A
Check if the additional data attached is correct or not,
If incorrect, the decoding is stopped there, and if correct, a check routine is provided to continue the decoding operation. Information called INF obtained by encrypting the AB international master key with the public key of the third international organization is added as LEAF information for realizing this. The composition of the AB international master key is A
AB private key created by the international private key of B and the international public key of B, or encrypted with date and time information.

[0010]

Since the INF is encrypted with the public key of the third international organization, it cannot be decrypted by anyone other than the third international organization. Therefore, in order for the sender device A to obtain INF, it must calculate independently. Because the sender device A and the receiver device B compare and collate separately calculated ones, the sender cannot forge the INF (if the sender device wants to be able to decrypt the ciphertext). This makes it possible to prevent the LEAF from invalidating law enforcement.

[0011] From INF, a third party other than the international third party cannot obtain the AB international master key. As a result, information that can be decrypted by an arbitrary third party does not leak from the LEAF, and does not hinder the original purpose of encryption. Even if the third international organization obtains the AB international master key by decrypting the INF at the time of law enforcement, the third international organization has no means of obtaining the domestic secret information of the user, and thus decrypts the ciphertext. I can't.

As described above, a key management method and a user device which realize a key recovery method in which a user cannot invalidate law enforcement while preventing abuse of authority by a law enforcement organization, a key storage organization, and an international third organization are described. Can be provided.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. FIG. 1 shows a system configuration and data transmission / reception according to an embodiment of the present invention. The user device 11A and the user device 11B store their respective domestic secret keys in their respective key storage institution devices 12A and 12B comprising a plurality of institutions.
Divide and register. In addition, system public information, public key,
A user international public key and a user domestic public key are provided with a public key registration authority device 13 and an upper layer key storage authority device (international third authority device) 14 above the key storage authority devices 12A and 12B. There are fifteen.

First, an operation method at the time of system construction is shown in FIG. Step A1: Upper-level key management organization device 14
Prepares the following information by the information generating means. (1) a large prime p, (2) a primitive element g of p, (3) secret information I,
i, where I = Π _{j = 1} ^k Ij = (Σ _{j = 1} ^k ij) ^-1 m
od (p-1) (k is the number of key storage authority devices 12A (12B)) All the following operations are performed under the modulus p.

Step A2: Upper-level key management organization device 14
Alternatively, the key registrar 13 publishes p and g as system public information to all subscribing users and subscribing institutions. Step A3: I, i are divided as system secret information (random numbers) into the number of key storage institution devices 12 ₁ and 12 ₂ , here, two, and (I1, i1) is divided into key storage institution devices 12 ₁ ,
(I2, i2) safety to the key custodian device 12 ₂ and be sent to the secret back. Here, I = I1 · I2mod p−1, i = i1 + i2mod
Satisfies p-1.

Step A4: Each key storage organization device 12 ₁ ,
12 ₂ strictly stores (Ij, ij) (j = 1, 2) in the system secret random number management database. This is confidential information that is extremely important in the system and must be kept strictly so as not to leak out in any case. Next, FIG. 3A shows a process when a user subscribes to the system.

In the following steps B1 to B8,
The private key and the public key are valid both for the domestic private key and the domestic public key, and for the international private key and the international public key. Step B1: The user device 11i sets the user secret random number r
ij, and calculates g ^rij as user delivery information,
It is sent to the key storage organization device 12j. Step B2: Similarly, the key storage institution device 12j generates a key storage institution secret random number rji and generates key storage institution delivery information g.
^rji is calculated and sent to the user device 11i.

[0018] step B3: user device 11i is, to generate a key custodian delivery information ^g rji and its own user secret random number rij than partial key sij received in the following manner. si
j = g ^{rji · rij} Step B4: The key storage institution device 12j receives the received user delivery information g ^rij and its own key storage institution secret random number rji.
The partial key sij is generated as follows. sij = g
^rij · ^rji Step B5: The key storage institution device 12j calculates the partial key distribution information g ^sij from the partial keys as shown in FIG. 3B, and sends it to the key registration institution device 13.

Step B6: The key registration authority device 12j
Sent partial key delivery information g^sijFrom the user device 11
The public key of i is obtained as follows. Pi = Π_{j = 1} ^kg^sij
= G ^Si Where Si is the secret key of user i and Si
= Σ_{j = 1} ^kSig mod (p-1) is satisfied. Step B7: The key registration authority device 13 generates the public key
Publish Pi.

Step B8: The key storage organization device 12j
The partial key sij shared with the user device 11i is strictly stored in the user secret key management database. Here, the user device 11i and the key storage institution device 12
j jointly generates a secret key for the user, and
3 has been described as generating and publishing a public key, the present invention is not limited to this, and the key storage organization device 13 or the upper-level key management organization (or international third organization) device 14 generates and publishes the public key. , User device 11i, each key storage organization device 12j, upper layer key management organization (international third organization)
Necessary information may be sent to the device 14.

Next, FIG. 4 shows a functional configuration when user A and user B perform encrypted communication, and FIG. 5 shows an operation procedure. Note that the transmitting side is A and the receiving side is B. User device 11
In each of the memories 21 and 22 of the A and 11B, their own private key, public key of the other party, system public information,
Public key and so on are stored.

Operation of the user device 11A on the sender side Step C1: The international common key generation means 23 specifies the communication party from the international secret key xA of the user device 11A and the international public key YB = g ^{xB of the} user device 11B. An AB international common key ZAB = g ^{xA · xB} is obtained (5-1).

Step C2: International master key generation means 2
4 to obtain the AB international common key ZAB _Three(Arbitrary common key encryption
AB system) and the date and time information D
Tar key IKAB = f_Three{D} [ZAB] is obtained (5-
2). f {K} [M] implies M with key K by encryption method f.
Means to encode. International Master Key
When the key is used as it is, ZAB is set to IKAB.

Step C3: The consent information additional data generation means 25 generates consent information additional data INF from IKAB (5-3). (C3-1) Using E (arbitrary public key cryptosystem),
Public key P of upper level key management organization (international third organization) device 14
In I, IKAB is encrypted and consent information additional data INF
= E {PI} [IKAB].

(C3-2) INF is entered into LEAF as one of the attached information. Step C4: The consent information generation means 26 uses the international master key IKAB by using f ₂ (arbitrary common key cryptosystem).
Then, the date / time information D is encrypted, and the execution agreement information ED = E @ I
KAB｝ [D] (5-4). Step C5: The domestic secret key sA of the user device 11A,
Based on the domestic public key PB = ^{gsB of the} user device 11B, the domestic common key generation means 27 calculates the AB domestic common key KAB = ^{gsA · sB} for specifying the communication party (5-5).

Step C6: From the execution agreement information ED and AB domestic common key KAB calculated in advance and the date and time information D, the session key generating means 28 session key KS = DKAB.E
D is obtained (5-6). Step C7: The message 19 is encrypted by the encryption means 29 using f ₁ (arbitrary common key cryptosystem) in KS (5-7).

Step C8: The LEAF generating means 31 uses the date and time information D, the consent information additional data INF, etc. to generate the LEA.
Generate F (5-8). LEAF includes, for example, consent information additional data INF, date and time information D, ID information IDA of user device 11A, and I of user device 11B as shown in FIG.
D information IDB, checksum CS, and the like are included.

Step C9: The ciphertext C and the LEAF are transmitted to the user terminal 11B by the transmitting means 32 (5-
9). FIG. 4 shows the functional configuration of the user device 11B on the receiver side.
The operation is shown in FIG. Step D1: The user sets the ciphertext C and the LE
When the AF is received, (6-1) the international secret key generation means 36 uses the international secret key xB of the user device 11B and the international public key YA = ^{gxA of the} user device 11A to operate as follows.
Seek international common key ^{ZAB = g xA · xB (6-2} ).

Step D2: The date and time information D obtained by extracting the ZAB from the received LEAF by the international common key generation means 37
And encrypts using f ₃ (arbitrary common key cryptosystem).
The B international master key IKAB = f ₃ {ZAB} [D] is obtained (6-3). When the international common key ZAB is used as it is as IKAB, ZAB is set to IKAB. Step D3: A collation confirmation for confirming the validity of the consent information additional data INF is performed from the AB international master key IKAB.

(D3-1) Upper level key management organization (International 3rd
With the public key PI of the institution) apparatus 14, the consent information additional data generating means 38 uses E (arbitrary public key encryption) to generate I
Encrypt KAB and INF '= E {PI} [IKAB]
(6-4). (D3-2) The consent information additional data INF is extracted from the received LEAF, and INF ′ = E ｛P obtained by the means 38
I｝ [IKAB] is compared with the comparing means 39.
5) If they match, proceed to the next step; otherwise, stop the operation.

Step D4: In the consent information generating means 41, I
Using KAB, date and time information D is encrypted by f ₂ (arbitrary common key encryption method), and execution agreement information ED = f
₂ {IKAB} [D] is obtained (6-6). Step D5: Domestic secret key sB of user device 11B,
The domestic public key PA = ^{gsA of the} user device 11A and the domestic common key generation means 42 further generate AB domestic common keys KAB = ^{gsA · sB.}
Is calculated (6-7).

Step D6: KS = D ^{KAB ED} is obtained by the session key generation means 43 from the execution agreement information ED and KAB obtained by the means 41 and the date and time information D (6-8). Step D7: Using the KS in the decoding means 44, f
₁ (arbitrary common key cryptosystem) to decrypt received signal text C to obtain message M = f ₁ {KS} [C] (6)
-9).

Finally, FIG. 7 shows a processing procedure in the case where the enforcement agency device 15 executes ciphertext decryption or session key duplication based on a law or a contract. Here, it is assumed that the enforcement agency device 15 has obtained a permit (for example, a communication interception verification warrant, an inquiry letter, etc.) necessary to execute ciphertext decryption or session key duplication, and further through a communication line. User devices 11A and 11 performed
It is assumed that the communication data of B is stored in the storage unit. It is also assumed that the user who is the target of the permit is A, and the communication partner at this time is user B.

Step E1: The enforcement authority device 15 submits the authenticator together with the permit to the international third organization (upper key management organization) device 14. Step E2: The international third organization device 14 checks whether the license is valid, and
Confirms that the subject that is attempting to decrypt or encrypt the session key is within the scope specified in the permit or law, contract, or the like. If it is determined that it is out of the range, the request is rejected.

Step E3: Check the security policy of each key storage institution device 12B to which the user device 11B belongs, and confirm whether each key storage institution device 12B1, 12B2 agrees to decrypt the ciphertext. As a result of this check, if the agreement is deemed to be non-consent, the request from the enforcement agency device 15 is rejected. Step E4: If it is determined that consent has been obtained,
The execution consent information forming means performs the following calculation to generate the execution consent information ED.

Step E5: The international third organization device 14 uses its own international third organization secret key SI and obtains consent information additional data INF = E @ PI extracted from LEAF by E (arbitrary public key cryptosystem).復 号 Decrypt [IKAB] to obtain AB international master key IKAB. Step E6: The third international organization device 14 uses the IKAB to execute LEAF by f ₂ (arbitrary common key cryptosystem).
Encrypts the date and time information D extracted from the
D = f ₂ {IKAB} [D] is obtained.

Step E7: The international third organization device 14
The obtained execution consent information ED is returned to the enforcement agency device 15. Step E8: The enforcement agency device 15 sends the user device 11A
12Aj (j = 1, 2, 2)
…), Submit the execution agreement information ED and the date and time information D together with the permit.

Step E9: Each key storage organization device 12Aj
Confirms that the license is legitimate, and determines that the object that the enforcement agency device 15 is attempting to perform ciphertext decryption or session key duplication is within the range described in the license or law, contract, etc. Check if there is. If it is determined that it is out of the range, the request is rejected. Step E10: If it is determined that each key storage institution device 12Aj is within an appropriate range, each key storage institution device 12Aj
Calculates the pseudo domestic common partial key Kj = IjPB ^sAj from the division information sAj of the secret key of the user A, the public key PB of the partner user B, and the divided system secret information Ij.

Step E11: Each key storage organization device 12A
j sends Kj = IjPB ^sAj to the enforcement agency device 15. Step E12: The enforcement authority device 15 calculates the pseudo domestic common key K ′ = K1 · K2... = I · KAB from all Kj received from each key storage authority device 12Aj.
When j = 1, 2, 3, K '= K1, K2, K3 = I1.
I2 · I3 · PB (SA1 + SA2 + SA3) = I · g
^{SB · SA} = I · KAB.

Step E13: The enforcement authority device 15 sends the pseudo session key K 'to each key storage authority device 12Aj. Step E14: Each key storage institution device 12Aj obtains the session key division information Kj '= D ^{ij ·} from the pseudo session key K', the execution agreement information ED, the date and time information D extracted from the LEAF, and the divided system secret information ij. Calculate ^{K '· ED} .

Step E15: Each key storage organization device 12A
j sends Kj ′ to the enforcement agency device 15. Step E16: The enforcement authority device 15 obtains the session key KS = K1 ′ · K2 ′... = From all the session key division information Kj ′ received from each key storage authority device 12Aj.
Calculate D ^{KAB ED} . That is, if j = 1, 2, 3, K
1'.K2'.K3 '= D ^{(i1 + i2 + i3) .K'.ED} = D
^{i · I · KAB · ED} = D ^{KAB · ED} = KS.

Step E17: Using KS, the ciphertext C is decrypted from f ₁ (arbitrary common key cryptosystem) and the plaintext M is decrypted.
= F ₁ {KS} [C]. In the above description, this method is applied to two (or three) user devices.
The key storage institution devices 12 ₁ and 12 ₂ (12 ₃ ) have been described. However, by changing the number of divisions of the user secret key and system secret information, the key storage institution device to which the user device belongs is changed. Can be constructed as a single or two or more key storage institutions. For example, if alone, the key storage authority device owns all the user secret key and system secret information. In this case, steps E10 to E15 can be omitted, and the session key is directly transmitted to the enforcement authority device 15. Can be provided.

In the above description, what is referred to as the international third organization apparatus may simply be an upper layer key management organization apparatus. The international third organization device means an upper-level key management organization device, and the international secret key and the international public key also mean those corresponding thereto. It is assumed that the user who is the target of the permit is B, and if the communication partner at this time is user A, A and B may be exchanged and the opposite is performed. Therefore, the user who is the target of the permit is the sender,
Processing can be performed in the same manner regardless of whether the receiving side is used. In other words, the user device can generally be a transmitting side or a receiving side. Therefore, the user device is shown in FIG.
The two functional configurations of the transmitting device 11A and the receiving device 11B shown in FIG. In general, the control means 5 mainly composed of a microprocessor is used for both the user devices 11A and 11B.
Each means is sequentially controlled by 1, 52, and performs reading, writing, and the like with respect to a memory.

Further, the user secret key used by the key storage institution device belongs to the user (user device) for which the permit is issued, and only the user public key is used for the communication partner user. Therefore, the user private key of the user who is not the target of the permit is not used.

[0045]

As described above, according to the present invention, the ciphertext is not decrypted unless the LEAF to which the information necessary for the law enforcement stage is attached is correct, so that the transmitting side user apparatus can receive the information. In order to have the side user device decrypt the ciphertext, a correct LEAF is inevitably attached.
As a configuration of the INF attached as the LEAF, A
In order to make the B international master key encrypted with the public key of the international third organization device, it is necessary to use a check routine for comparing the values independently calculated by the transmitting user device and the receiving user device. it can. This is LEA
It is possible to prevent F from invalidating law enforcement.

According to the INF, the third party other than the international third party equipment
Cannot obtain the AB International Master Key. As a result, information that can be decrypted by an arbitrary third party cannot be obtained from the LEAF, and the original purpose of the encryption is not hindered. International Third Organizational Machines
Even if F is decrypted to obtain an AB international master key, the international third party apparatus cannot decrypt the ciphertext because there is no means to obtain the user's domestic secret information.

As described above, a key management method and a user device which realize a key recovery method in which a user cannot invalidate law enforcement while preventing abuse of authority by a law enforcement organization, a key storage organization, and an international third organization are described. Can be provided.

[Brief description of the drawings]

FIG. 1 is a functional configuration diagram of a key management system to which an embodiment of the present invention is applied.

FIG. 2 is an operation schematic diagram in a system construction stage.

FIG. 3 shows an outline of an operation in a user joining stage, wherein A is an outline of an operation of a partial key sharing method, and B is an outline of a public key registration operation.

FIG. 4 is a block diagram showing a functional configuration of the user device in the encrypted communication between users.

FIG. 5 is a flowchart showing an operation procedure of the transmitting-side user device in the encrypted communication between users.

FIG. 6 is a flowchart showing an operation procedure of the receiving-side user device in the encrypted communication between users.

FIG. 7 is an operation schematic diagram at the time of a law enforcement stage.

FIG. 8 is a functional configuration diagram of a system to which the related art ISEC97-33 (Miyazaki, Sakurai, “Study on International Issues in Key Escrow System”) is applied.

[Procedure amendment]

[Submission date] February 3, 1998

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] Claim 2

[Correction method] Change

[Correction contents]

[Procedure amendment 2]

[Document name to be amended] Statement

[Correction target item name] Claim 3

[Correction method] Change

[Correction contents]

Claims (11)

[Claims] 1. A key management method for managing a session key used for cryptographic communication performed between user devices belonging to different key storage institution devices, wherein at the time of system construction, the key storage institution device or the international third institution device is open to the system. Set and store information and system secret information, register and publish system public information, and send system secret information to all key storage institutions to which user devices belong. The process of storing information, setting and storing the international third organization public key and the international third organization private key, and registering and publishing the international third organization public key to a key registrar; Occasionally, the user's device or key storage authority device or international third party
The authority device generates a user domestic public key and a user domestic private key and a user international public key and a user international secret key, or generates a domestic common key and an international common key for identifying a communication party, and publishes the user public key. The process of registering and managing the user secret key or domestic common key and international master key in at least the key storage institution to which the user device belongs; and, during cryptographic communication, the transmitting user device uses the international common key to Generates a master key, generates execution consent information using the international master key and date and time information, generates a session key using the execution consent information, date and time information, and the domestic common key, and encrypts the message with the session key. Agrees to transmit the encrypted message and encrypt the data including the international master key with the public key of the international third party device Generating the information additional data and transmitting at least the consent information additional data, the date and time information, and the authenticator as LEAF information; and the receiving-side user device uses the international common key to perform the same operation as the transmitting-side user device. A consent information additional data is generated by generating a master key, encrypting the data including the international master key with the public key of the international third organization device, collating this with the received consent information additional data, and finding a match. Only in such a case, an enforcement agreement is generated using the international master key and the date and time information, a session key is generated using the enforcement agreement information, the received date and time information, and the domestic common key, and the received encrypted message is transmitted to the session. Decrypting with a key to obtain a message; and a key management method. 2. When the enforcement authority device performs ciphertext decryption or session key duplication, the international third authority device obtains an international master key using the consent information additional data and the international third authority public key, and acquires the international master key. The execution consent information is constructed using the key and the date and time information, and provided to the enforcement agency device. The enforcement agency device provides the enforcement consent information to the key storage agency device. ) Pseudo domestic common key split information is generated from the data including the partial key, the user public key, and the system secret information, and is provided to the enforcement agency device. The enforcement agency device generates the domestic common key using the pseudo domestic common key split information. The key storage authority device prepares for erasing the system secret information from the domestic common key and prepares to incorporate the execution consent information, and returns it to the enforcement authority device. After configuring ® down key, the key management method according to claim 1, characterized in that it comprises a step of acquiring a message by decrypting the encrypted message using the session key. 3. The communication system according to claim 1, wherein a domestic common key for identifying the communication party is generated from a domestic private key of one user of the communication party and a domestic international public key of the communication partner. Key management method described in 1. 4. The method according to claim 1, wherein the international common key is generated from a user's international secret key of one of the communicating parties and a user's international public key of the communicating party. Key management method. 5. The international master key is generated from an international common key and date and time information.
The key management method described in any of the above. 6. The key management method according to claim 1, wherein an international common key is used as the international master key. 7. The key storage institution device to which the user device belongs is plural, and the system secret information, the user domestic secret key,
In the process of registering and managing a user international secret key, a domestic secret key, or an international secret key, the secret information is divided and each key storage institution manages the divided secret information. The key management method according to any one of claims 1 to 6. 8. A user device belongs to a plurality of key storage institution devices, and when a domestic user secret key or an international user secret key is registered and managed and a user public key is registered and disclosed to a registrar, when a user joins The user device generates a user secret random number by the number of divisions of the user secret key, generates user delivery information for each key storage institution to which the user device belongs using each user secret random number,
While transmitting each user delivery information to each key storage institution, each key storage institution generates a key storage institution secret random number by the number of divisions of the user secret key, and distributes the key storage institution using the key storage institution secret random number. After generating the information and transmitting the key storage organization delivery information to the user, the user device generates a partial key using each key storage organization delivery information and the user secret random number, and generates a user secret using all the partial keys. While generating and storing the key, each key storage institution generates the same partial key as the user device using the user delivery information and the key storage institution secret random number, and generates and stores the partial key distribution information. The distribution information is transmitted to the key registration authority device, and the key registration authority device generates and stores the user public key using all the partial key distribution information sent from each key storage agency device to which the user device belongs, and Register the public key Wherein, according claim 1 to claim 7
One of the key management methods described above. 9. A user device of a key management system for managing a session key used for cryptographic communication performed between user devices belonging to different key storage institutions, comprising: a user's own international secret key and a user's domestic secret key. , The user's international public key and the user's domestic public key,
A memory for storing the institution's public key, an international master key generation means for generating an international master key using the user's own international secret key and the user's international public key, and a user's domestic secret key and the user of the communication partner A domestic common key generating means for generating a domestic common key for identifying a communication party using a domestic public key, date and time information generating means, an agreement information generating means for generating enforcement agreement information from an international master key and date and time information, A consent information additional data generating means for generating consent information additional data from the master key and the date and time information, and an LE from the consent information additional data, the authenticator and the date and time information
LEAF information generating means for generating AF; session key generating means for generating a session key from the domestic common key, date and time information, and execution agreement information; encryption means for encrypting a message with the session key; Communication means for transmitting the ciphertext from the means and the LEAF to the partner user device; receiving means for receiving the ciphertext and the LEAF from the partner user device; and using date and time information and the international master key in the received LEAF. Means for generating consent information additional data by comparing the generated consent information additional data with the received consent information additional data; and decrypting the received ciphertext with the session key when the comparison means detects a match. A user device comprising: a conversion unit; and a control unit for sequentially controlling each of the units and reading and writing data to and from a memory. 10. The international master key generating means includes: means for generating an international common key using its own user international secret key and a communication partner's user international public key; and generating an international master key from the international common key and date and time information. 10. The user device according to claim 9, comprising means for generating. 11. A random number generating means for generating a user secret random number, a delivery information generating means for generating user delivery information in which the user secret random number is disturbed by system public information, and a means for transmitting the user delivery information to a key storage authority device. Partial key generation means for generating a partial key from the received key storage organization delivery information and the user's secret random number, and a partial key generated for the key storage organization delivery information from the key storage organization device to which the user device belongs. 11. The user device according to claim 9, further comprising: a unit that generates the user domestic private key using all of them.