WO2021029173A1

WO2021029173A1 - Communication system

Info

Publication number: WO2021029173A1
Application number: PCT/JP2020/027295
Authority: WO
Inventors: 宏一良石井
Original assignee: 株式会社村田製作所
Priority date: 2019-08-09
Filing date: 2020-07-13
Publication date: 2021-02-18
Also published as: JPWO2021029173A1

Abstract

Provided is a communication system with which communication can be performed with confidentiality maintained, even if the memory capacity of a host device is low, with which the design of internal memory in a security device does not need to be redesigned depending on the equipment being utilized, and which is highly versatile and has reduced manufacturing costs. In a communication system 1A, when confidential data D are to be stored to an HSM 4 side, a host 2 encrypts the confidential data using a public key and sends the encrypted confidential data D to the HSM 4, and the HSM 4 stores the received encrypted confidential data D in an external memory 5. Further, when the confidential data D stored in the external memory 5 are to be read to the host 2 side, the host 2 encrypts an OTP key using the public key, and sends the encrypted OTP key to the HSM 4. The HSM 4 decrypts the received OTP key using a private key, reads the confidential data D from the external memory 5 and decrypts the same using the private key, encrypts the decrypted confidential data D using the decrypted OTP key, and sends the encrypted confidential data D to the host 2.

Description

Communications system

The present invention relates to a communication system provided with a host device and a security device and performing encrypted communication of confidential data between these devices via a network.

Conventionally, as this communication system, for example, there is one disclosed in Patent Document 1.

In the communication system described in FIG. 8 of the same document, a common key is exchanged after both the host device and the security device are authenticated by communication using a public key cryptosystem. That is, the host device generates a public key and a private key by cryptographic IP (Crypt IP), and transmits the generated public key to the HSM (hardware security module) which is a security device. The HSM generates a random number by a random number generation circuit, encrypts the generated random number by a cryptographic IP using the received public key, and transmits the generated random number as challenge data to the host device. The host device decrypts the received challenge data by the encrypted IP using the private key, generates the response data, and transmits it to the HSM. The HSM verifies the received response data and confirms that the host device is a genuine communication device. After that, the HSM generates a random number by the random number generation circuit, encrypts the random number by the cryptographic IP using the common key, and transmits the random number to the host device. The host device decrypts the received encrypted random number using the common key shared with the HSM in advance.

Japanese Unexamined Patent Publication No. 2016-15824

However, in the conventional communication system disclosed in Patent Document 1, cryptographic keys such as a public key, a private key, and a common key must be stored on both the host device side and the security device side. Therefore, it is necessary to mount a CPU, ROM / RAM, and an encrypted IP (Crypt IP) on both the host device side and the security device side. Therefore, in a communication system using quantum computer encryption (PQC) or the like in which the amount of information of the encryption key is large, if the capacity of the internal memory of the host device is small, the area for storing the encryption key becomes insufficient.

In addition, in the security device, in order to conceal the encrypted key to be stored, it was necessary to configure one chip so as not to expose the encrypted key to the outside of the device. Therefore, the security device configured on one chip must redesign the internal memory that stores the confidential data peculiar to the device for each device to which the communication system is applied, and apply it. It becomes a custom product for each product to be manufactured, and the product cost of the communication system becomes high. Therefore, it is conceivable that the security device is provided with an external memory and the stored contents that change depending on the device to which the communication system is applied are stored in the external memory, but there is a risk of eavesdropping in the communication path between the security device and the external memory. There is. On the other hand, in order to prevent this eavesdropping, if the external memory has an encrypted IP to encrypt the communication between the security device and the external memory, the burden of the encrypted IP on the security device side becomes large, and the security device side The memory capacity will increase.

The present invention has been made to solve such a problem, and it is possible to perform communication while maintaining confidentiality even if the memory capacity on the host device side is small, and a security device depending on the device to which the communication system is applied. The purpose is to provide a communication system that does not require redesigning the internal memory on the side.

To this end, the present invention
It is equipped with a host device that has confidential data and a security device that is connected to the host device via a network and generates and stores a public key and a private key used for encrypted communication with the host device by a random number generator.
When storing the confidential data on the security device side, the host device encrypts the confidential data using the public key received from the security device and sends it to the security device, and the security device receives the encrypted data from the host device. Confidential data is stored in an external memory and stored,
When reading the confidential data stored in the external memory to the host device side, the host device encrypts the generated or acquired one-time pad key with the public key and sends it to the security device, and the security device sends it to the security device from the host device. Communication that decrypts the received one-time pad key with the private key, reads the secret data from the external memory, decrypts it with the private key, encrypts the decrypted secret data with the decrypted one-time pad key, and sends it to the host device. I configured the system.

According to this configuration, the public key and private key used for encrypted communication between the host device and the security device are stored in the security device instead of being stored in the host device. Therefore, the memory capacity required for the host device is suppressed by the amount of the encryption key. Further, the secret data possessed by the host device is transmitted to the security device by encrypting the secret data with the public key. In addition, the confidential data stored in the external memory of the security device is encrypted by the one-time pad key supplied from the host device, transmitted from the security device side to the host device, and decrypted by the host device using the one-time pad key. Will be done.

Therefore, the communication between the host device and the security device in the network is performed in a confidential state, and the communication between the security device and the external memory is not performed in the network, so that it is exposed to the threat of eavesdropping from the outside. Will not be. In addition, by storing the stored contents of confidential data that change depending on the device to which the communication system is applied in the external memory, the internal memory of the security device is redesigned to an appropriate one for each device to which the communication system is applied. The need is eliminated, the versatility of the security device is increased, and the product cost of the communication system is reduced. Therefore, even if the memory capacity of the host device is small, communication can be performed with confidentiality, and the internal memory of the security device does not need to be redesigned depending on the device to which the communication system is applied, which is highly versatile. It is possible to provide a communication system in which the product cost is reduced.

In addition, the present invention
It is equipped with a host device that has confidential data and a security device that is connected to the host device via a network and generates and stores a public key and a private key used for encrypted communication with the host device by a random number generator.
The security device stores the public key in external memory
When storing the secret data on the security device side, the host device directly accesses the public key stored in the external memory, reads it from the external memory, and directly accesses the confidential data encrypted by the read public key. And store it in external memory
When reading the confidential data stored in the external memory to the host device side, the host device directly accesses the external memory and encrypts the generated or acquired one-time pad key with the public key read from the external memory for security. One-time transmission to the device, the security device decrypts the one-time pad key received from the host device with the private key, reads the secret data from the external memory, decrypts it with the private key, and decrypts the decrypted secret data. A communication system that is encrypted with a pad key and transmitted to the host device is configured.

Even with this configuration, the public key and private key used for encrypted communication between the host device and the security device are stored in the security device instead of being stored in the host device. Therefore, the memory capacity required for the host device is suppressed by the amount of the encryption key. Further, when the secret data of the host device is transmitted to the security device side, the public key stored in the external memory of the security device is directly read by the host device, and the secret data is encrypted by the public key in the host device. , It is done by writing directly to the external memory. In addition, the encrypted secret data stored in the external memory is decrypted by the security device and then encrypted with the one-time pad key sent from the host device after being encrypted with the public key for security. It is transmitted from the device side to the host device, and is decrypted by the host device using the one-time pad key.

Therefore, communication between the host device and the external memory in the network is performed in a confidential state, and communication between the security device and the external memory is not performed in the network, so that the user is exposed to an eavesdropping threat from the outside. There is no. In addition, by storing the storage contents that change depending on the device to which the communication system is applied in the external memory, it is not necessary to redesign the internal memory of the security device to an appropriate one for each device to which the communication system is applied. , The versatility of the security device is increased, and the product cost of the communication system is reduced. Therefore, even with this configuration, it is possible to perform communication while maintaining confidentiality even if the memory capacity of the host device is small, and it is not necessary to redesign the internal memory of the security device depending on the device to which the communication system is applied. It is possible to provide a communication system with high versatility and reduced product cost.

According to the present invention, as described above, it is necessary to perform communication while maintaining confidentiality even if the memory capacity of the host device is small, and to redesign the internal memory of the security device depending on the device to which the communication system is applied. It is possible to provide a communication system that is highly versatile and has a reduced product cost.

It is a block diagram which shows the schematic structure of the communication system by 1st Embodiment of this invention. It is an operation sequence diagram when the secret data possessed by a host device is written to a security device in the communication system according to the first embodiment. It is an operation sequence diagram when the secret data stored in the security device is read out to the host device in the communication system by 1st Embodiment. It is a block diagram which shows the schematic structure of the communication system by 2nd Embodiment of this invention. It is an operation sequence diagram when the secret data possessed by a host device is transmitted to the second host device in the communication system according to the second embodiment. It is an operation sequence diagram when the secret data possessed by the 2nd host apparatus is transmitted to the host apparatus in the communication system by 2nd Embodiment. It is a block diagram which shows the schematic structure of the communication system by 3rd Embodiment of this invention. FIG. 5 is an operation sequence diagram when the secret data of the host device is directly written to the external memory of the security device in the communication system according to the third embodiment.

Next, a mode for implementing the communication system according to the present invention will be described.

FIG. 1 is a block diagram showing a schematic configuration of a communication system 1A according to the first embodiment of the present invention.

The communication system 1A includes a host device (hereinafter referred to as HOST) 2 having confidential data D, and a hardware security module (hereinafter referred to as HSM) 4 which is interconnected with HOST 2 via a network 3. HOST 2 is a personal computer (PC), a microcomputer (commonly known as a microcomputer), or the like, and is a main control device in a system such as communication processing or sensor processing via a network 3 or the like. The HSM4 is a security device configured by aggregating security-related components among the components of HOST2, and generally, in a communication system interconnected by a network, concealment of data and packets transferred on the network. It establishes sex and safety. The HSM4 is also called a security unit, a security module, or a hardware security unit. Further, HOST2 includes a device that controls HSM4, such as HSM that becomes HOST.

HOST 2 has a CPU 2a which is an arithmetic unit, a read-only memory (ROM) 2b, a temporary storage memory (RAM) 2c, a communication processing circuit 2d, and an OTP encryption function block 2e. In the present embodiment, the secret data D is stored in the temporary storage memory 2c. The OTP encryption function block 2e includes a public key encryption IP and a simple OTP encryption IP, and in the OTP encryption IP, a random number used in an encryption method called One Time Pad is generated by software as an OTP key. The OTP encryption function block 2e does not necessarily have to include the OTP encryption IP, and may be configured to acquire an OTP key from another device. After using the public key and OTP key in HOST2, they can be deleted without saving. The communication processing circuit 2d includes a transmission circuit and a reception circuit for communicating with other devices via the network 3. The communication standard of the network 3 is SPI, CAN, I2C, UART, USB, Ethernet, Bluetooth (registered trademark), etc., and the type thereof does not matter.

The HSM 4 includes an internal memory 4a, a cryptographic processing IP (Crypto IP: encryption / decryption function) 4b, and a random number generator 4c inside, and has an external memory 5 outside. The internal memory 4a includes a RAM and a ROM. The external memory 5 is composed of an EEPROM called a programmable ROM, a flash ROM, a DDR used as a temporary storage memory and called a RAM, an RDRAM, a DRAM, an asynchronous DRAM, a SRAM, and the like. The network 3 interposed between the HOST 2 and the HSM 4 has a risk of eavesdropping, but the HSM 4 and the external memory 5 are connected by a communication path other than the network 3 that is not available to the public.

Cryptographic processing IP4b is a functional block having a data encryption function and a decryption function necessary for encrypting communication in network 3, and uses random numbers generated by the random number generator 4c for encrypted communication with HOST2. Generate a public and private key to be used. The generated public key is stored and stored in the internal memory 4a or the external memory 5, and the private key is stored and stored in the internal memory 4a. The cryptographic processing IP4b is composed of software or hardware, but in the present embodiment, the cryptographic processing IP4b is composed of hardware together with the random number generator 4c. Therefore, the HSM 4 is not provided with an arithmetic unit such as the CPU 2a in the HOST 2. Therefore, the HSM 4 is configured to be compact. The random number generator 4c is composed of a physical random number source, and generates physical random numbers by heat-induced white noise, photon / electron shot noise, quantum noise, fan noise, and the like.

In such a configuration, in order to store the secret data D possessed by HOST 2 in HSM 4, the writing process in which the secret data D is transmitted from HOST 2 to HSM 4 is performed as shown in the operation sequence diagram shown in FIG. In the operation sequence diagram, it is assumed that time elapses from the upper part to the lower part of the diagram. Further, each operation sequence described below is executed by software processing of a simple communication algorithm according to a computer program stored in the memory 2b of the CPU 2a in the HOST 2.

When storing the secret data D on the HSM4 side, HOST2 requests the generation of the encryption key required for encrypted communication in step s1. This key generation request step s1 is not always necessary, and is not necessary when the key is automatically generated when the HSM 4 is started. The HSM4 generates the public key and the private key in step s2 before receiving the secret data D from HOST2. HOST2 requests HSM4 to transmit the public key generated by HSM4 in step s3. In response to this request, the HSM 4 transmits the public key stored in the internal memory 4a or the external memory 5 to the HOST 2 via the network 3 in step s4. At this time, the public key may be eavesdropped on the network 3.

The HOST 2 that has received the public key encrypts the secret data D with the received public key in step s5, and transmits the encrypted secret data D as encrypted data to the HSM 4 via the network 3 in step s6. The HSM 4 that has received the encrypted secret data D stores the received secret data D in the internal memory 4a or the external memory 5 in step s7 in a state of being encrypted with the public key.

When HOST2 sends a memory selection command to HSM4 at the same time as transmission of secret data D in step s6 or in advance, HSM4 sends the received secret data D to either the internal memory 4a or the external memory 5. You can choose to save. The secret data D is usually stored in the external memory 5.

Further, when the received secret data D is stored in the internal memory 4a or the external memory 5 in step s7, the HSM 4 decrypts the received secret data D with the private key and then separately generates the decrypted secret data D. It may be re-encrypted with the public key, or the received secret data D may be further encrypted by using an encryption mode and stored in the internal memory 4a or the external memory 5.

FIG. 3 is an operation sequence diagram of a read process performed by transmitting the secret data D stored in the HSM 4 from the HSM 4 to the HOST 2.

When reading the secret data D stored in the internal memory 4a or the external memory 5 to the HOST2 side, the HOST2 generates an OTP key in step S11 by the OTP encryption function block 2e, or acquires an OTP key from another device. To do. The HOST2 then encrypts the generated or acquired OTP key in step s12 with the public key received from the HSM4. Then, the encrypted OTP key is transmitted to the HSM 4 in step s13 via the network 3. The HSM 4 reads the secret data D from the internal memory 4a or the external memory 5 in step s14, and decodes the secret data D in step s15 with the stored private key. Further, the OTP key received from HOST2 encrypted by the public key is decrypted in step s15 by the stored private key. Then, in step s16, the HSM4 encrypts the decrypted secret data D with the decrypted OTP key to obtain OTP encrypted data, and transmits the OTP encrypted data to HOST2 in step s17. The HOST 2 decrypts the OTP encrypted data received from the HSM 4 with the temporarily stored OTP key and reads out the secret data D.

As described above, in the communication system 1A of the first embodiment, as shown in the operation sequence diagram of FIG. 2, when the secret data D is stored on the HSM4 side, the HOST 2 uses the public key received from the HSM 4 to store the secret data. D is encrypted and transmitted to HSM4, and HSM4 stores and stores the encrypted secret data D received from HOST2 in the external memory 5.

Further, as shown in the operation sequence diagram of FIG. 3, when reading the secret data D stored in the external memory 5 to the HOST2 side, the HOST2 receives the generated or acquired OTP key from the HSM4 side as a public key. Encrypted by and transmitted to HSM4. The HSM4 decrypts the OTP key received from HOST2 with the private key, reads the secret data D from the external memory 5, decrypts it with the secret key, encrypts the decrypted secret data D with the decrypted OTP key, and transfers it to HOST2. Send.

Therefore, according to the communication system 1A of the first embodiment, the public key and the private key used for the encrypted communication between HOST 2 and HSM 4 are stored in HSM 4 instead of being stored in HOST 2. Therefore, the memory capacity of the

memories

2b, 2c, etc. required for HOST 2 is suppressed by the amount of the encryption key. Further, although the encryption key generation process generally takes time, the HOST2 process is reduced by having the HSM4 take charge of this generation process. Further, HOST2 performs encryption processing of the secret data D in step s5 using the public key received from HSM4, but even if the public key is deleted after this encryption processing, it can be obtained from HSM4 again, so that the memory It is not necessary to save it in 2c or the like. If HOST2 saves the public key, it is not necessary to reacquire it from HSM4. Therefore, HOST2 may save the public key in order to increase the communication processing speed.

Further, the transmission of the secret data D possessed by HOST2 to HSM4 is performed by transmitting the public key stored in HSM4 to HOST2 and encrypting the secret data D in HOST2 with the public key. Further, the secret data D stored in the external memory 5 of the HSM4 is encrypted by the OTP key supplied from the HOST2, transmitted from the HSM4 side to the HOST2, and decrypted by the OTP key in the HOST2.

Therefore, even if the public key and the private key are not stored in the HOST 2, the communication between the HOST 2 and the HSM 4 in the network 3 is performed in a secret state, and the communication between the HSM 4 and the external memory 5 is performed in the network 3. Because it is not done in, it is not exposed to the threat of eavesdropping from the outside. Further, by storing the stored contents of the confidential data D, which changes depending on the device to which the communication system 1A is applied, in the external memory 5, the internal memory 4a of the HSM4 is appropriately set for each device to which the communication system 1A is applied. It is no longer necessary to redesign the HSM4, the versatility of the HSM4 is increased, and the product cost of the communication system 1A is reduced.

Therefore, even if the memory capacity of HOST2 is small, communication can be performed while maintaining confidentiality, and the internal memory 4a of HSM4 does not need to be redesigned by the device to which the communication system 1A is applied, which is highly versatile. It is possible to provide the communication system 1A in which the product cost is reduced. Further, the HSM 4 can store the secret data D received from the HOST 2 in the encrypted state in the external memory 5, so that the secret data D can be saved while maintaining the communication processing speed.

In general, when public key cryptography is used, the private key must be stored and managed in order to be decrypted, but when the private key is stored and managed in HOST2, the memory area of HOST2 is occupied. It will be. However, by using the OTP key for the encrypted transmission of the secret data D from the HSM4 to the HOST2 as in the present embodiment, the HOST2 only needs to temporarily store the OTP key. Therefore, it is not necessary to store and manage the OTP key in HOST2 and HSM4, and the encryption key only needs to be stored and managed in HSM4 for the public key and the private key. For this reason, the demand for security measures taken on the HOST2 side is reduced, and the security measures need to be focused on the HSM4 side, so that the development cost of the communication system 1A can be reduced.

Further, in the communication system 1A of the first embodiment, the random number generator 4c in HSM4 is composed of a physical random number source called QRNG or TRNG. When random numbers are generated by computer program software, the internal memory 4a of HSM4 needs a storage capacity to store the software, but when random numbers are generated by a physical random number source, a physical phenomenon occurs. Is used and the software is not used, so that the capacity for storing the software in the internal memory 4a of the HSM4 is not required. Moreover, an arithmetic unit such as a CPU for executing software is not required for the HSM4. Further, since the calculation time is not required to generate the random number by the physical random number source, the random number generator 4c generates the random number at a higher speed than the case where the random number is generated by software.

Furthermore, the random numbers generated by the software are related to each other, and it is easy to infer another random number from one random number, but the random numbers generated by the physical random number source are generated without mutual relation. , It is difficult to guess other random numbers from one random number, and the independence is high. Therefore, according to the random number generator 4c of the present embodiment, a high-quality private key and public key can be generated at high speed and with low power consumption without increasing the memory capacity of the internal memory 4a of the HSM4. Further, since the private key and the public key are generated and stored and managed inside the HSM4, the confidentiality of the data communication can be improved.

Next, the communication system according to the second embodiment of the present invention will be described.

FIG. 4 is a block diagram showing a schematic configuration of the communication system 1B according to the second embodiment of the present invention. In the figure, the same or corresponding parts as those in FIG. 1 are designated by the same reference numerals, and the description thereof will be omitted.

Communication system 1B differs from communication system 1A according to the first embodiment only in that HOST 2 includes a second HOST 6 that is network-connected to each other via HOST 2. The second HOST 6 is connected to the HOST 2 via a network 7 similar to the network 3. Other configurations are the same as those of the communication system 1A according to the first embodiment.

The second HOST6 is a HOST that is different from the HOST2 and the HSM4 and is not directly connected to the HSM4, such as a server, a cloud, a PC different from the one constituting the HOST2, and an HSM different from the HSM4. Also between HOST 2 and HSM 4 in this communication system 1B, the secret data D possessed by HOST 2 is written from HOST 2 to the HSM 4 side as shown in the operation sequence diagram of FIG. 2, and HSM 4 is also written in the same manner as in the first embodiment. The secret data D stored in is read from HSM4 to HOST2 as shown in the operation sequence diagram of FIG. In the second embodiment, as shown in the operation sequence diagram of FIG. 5, the secret data D possessed by HOST 2 is further transmitted to the second HOST 6.

When the secret data D is transmitted to the second HOST6, the HOST2 requests the generation of the encryption key required for the encrypted communication in step s21. This key generation request step s21 is not always necessary, and is not necessary when the key is automatically generated when the HSM4 is started. The HSM 4 generates the public key and the private key in step s22 before receiving the secret data D from the HOST 2.

The second HOST 6 has a second public key S and a second private key used for encrypted communication with the HOST 2, and transmits the second public key S to the HOST 2 in step s23 via the network 7. The HOST 2 that has received the second public key S from the second HOST 6 transmits the received second public key S to the HSM 4 in step s24 via the network 3. At this time, the second public key S may be eavesdropped on the

networks

3 and 7. The HSM 4 stores the received second public key S in the internal memory 4a or the external memory 5 in step s25.

HOST2 requests HSM4 to send the public key M generated and stored by HSM4. In response to this request, the HSM 4 transmits the public key M stored in the internal memory 4a or the external memory 5 to the HOST 2 via the network 3 in step s26. The HOST 2 that has received the public key M from the HSM 4 transmits the received public key M to the second HOST 6 in step s27 via the network 7. At this time, the public key M may be eavesdropped on the

networks

3 and 7. The second HOST 6 stores the received public key M.

By the processing up to this point, the key exchange between the public key M and the second public key S is performed between HOST 2 and the second HOST 6. However, HOST2 does not store and manage the public key M and the second public key S, and HSM4 does this. It is also possible to replace the public key cryptosystem that uses the public key M and the second public key S with the public key cryptosystem that uses the common key between HOST2 and the second HOST6 for encrypted communication. is there. Also in this case, HOST2 does not store and manage the common key, and HSM4 does this.

When transmitting the secret data D to the second HOST6, the HOST2 requests the transmission of the public key M stored in the HSM4 in step s28. The HSM 4 transmits the public key M to be stored in response to this request to the HOST 2 in step s29. Upon receiving the public key M, HOST2 encrypts the held secret data D with the public key M in step s30. The HOST 2 may temporarily store one or both of the public key M and the second public key S in order to speed up the communication process. When the public key M is stored, the processing of steps s28 and s29 is arbitrary, and HOST2 encrypts the held secret data D with the stored public key M in step s30.

Next, HOST2 transmits the secret data D encrypted with the public key M as the encrypted data M to the HSM 4 in step s31. The HSM 4 decrypts the received encrypted data M with a private key stored as a pair with the public key M, and encrypts the decrypted secret data D with the second public key S received from the second HOST 6 and stored in step s32. Then, the secret data D encrypted with the second public key S is transmitted to HOST2 in step s33 as encrypted data S. HOST 2 transmits the received encrypted data S as encrypted data to the second HOST 6 in step s34.

When HOST2 temporarily stores the second public key S, HOST2 encrypts the secret data D held by the second public key S in step s30, and encrypts the data D without performing steps s31 to s33. The data is immediately transmitted to the second HOST 6 in step s34. In this case, steps s31 to s33 are arbitrary. The second HOST 6 that has received the encrypted data is decrypted with the second private key stored in pairs with the second public key S, and the secret data D is acquired.

As described above, in the communication system 1B of the second embodiment, as shown in the operation sequence diagram of FIG. 5, the HOST 2 receives the second public key S used for the encrypted communication with the second HOST 6 from the second HOST 6 and HSM4. Receives the public key M stored by the HSM 4 from the HSM 4 and transmits it to the second HOST 6. Then, when the secret data D is transmitted to the second HOST 6, the HOST 2 encrypts the secret data D with the second public key S and transmits it to the second HOST 6, or encrypts the secret data D with the public key M and sends it to the HSM 4. The data is transmitted, and the secret data D decrypted by the HSM 4 with the private key and encrypted with the second public key S is transmitted to the second HOST 6.

According to the communication system 1B of the second embodiment as described above, the same operation and effect as that of the communication system 1A according to the first embodiment is exhibited. Further, according to the communication system 1B of the second embodiment, the public key M and the private key used for the encrypted communication between HSM4 and HOST2, and the second public key S used for the encrypted communication between HOST2 and the second HOST6. Is stored in HSM4 instead of being stored in HOST2. Therefore, the memory capacity required for HOST 2 is suppressed by the amount of these encryption keys.

Further, the transmission of the secret data D possessed by the HOST 2 to the second HOST 6 is performed by the HOST 2 encrypting the secret data D with the second public key S. Alternatively, the secret data D is once encrypted and transmitted from the HOST 2 to the HSM 4 by the public key M, decrypted by the HSM 4, and then the secret data D is encrypted by the second public key S. Therefore, according to the communication system 1B of the second embodiment, the communication in the

networks

3 and 7 between the HOST 2 and the HSM 4 and the second HOST 6 is performed in a secret state. Therefore, according to the communication system 1B of the second embodiment, even if the memory capacity of the HOST 2 is small, the confidential data D of the HOST 2 can be transmitted to the second HOST 6 while maintaining the confidentiality.

In the above communication system 1B, when the secret data D encrypted with the public key M stored in the external memory 5 is transmitted to the second HOST 6, the public key M and the second public key M are released between the HOST 2 and the second HOST 6. After the key exchange with the key S is performed in steps s23 to s27, the HSM 4 can directly read the secret data D from the external memory 5 and transmit it to the second HOST 6. In this case, the HSM 4 is a private key that is stored as a pair with the public key M, and is a second public key that decodes the secret data D read from the external memory 5 and receives and stores the decoded secret data D from the second HOST 6. In S, the encryption is performed in step s32. Then, the secret data D encrypted with the second public key S is transmitted to HOST2 in step s33, and HOST2 transmits it to the second HOST6 in step s34. By performing such processing, it is possible to increase the communication processing speed of the communication system 1B.

FIG. 6 is an operation sequence diagram when transmitting the secret data D possessed by the second HOST 6 to the HOST 2 in the above communication system 1B.

The processes from steps s21 to s27 are the same as those in the operation sequence diagram shown in FIG. 5, and in these processes, the public key M and the second public key S are exchanged between the HOST 2 and the second HOST 6. After the key exchange, the second HOST 6 encrypts the secret data D held by the exchanged public key M in step s41 and transmits the encrypted data to HOST2 in step s42. The HOST 2 that has received the encrypted data transmits the received encrypted data to the HSM 4 in step s43.

Further, HOST2 generates an OTP key in step S44 by the OTP encryption function block 2e, or acquires an OTP key from another device. Then, HOST2 requests the transmission of the public key M stored in HSM4 in step s45. The HSM 4 transmits the public key M to be stored in response to this request to the HOST 2 in step s46. Upon receiving the public key M, HOST2 encrypts the generated or acquired OTP key with the public key M in step s47. The HOST 2 may temporarily store the public key M in order to speed up the communication process. When the public key M is stored, the processing of steps s45 and s46 is arbitrary, and HOST2 encrypts the OTP key with the stored public key M in step s47.

Next, HOST2 transmits the OTP key encrypted with the public key M to HSM4 in step s48. The HSM4 decrypts the encrypted data received in step s43 and the encrypted OTP key received in step 48 with the private key stored in pair with the public key M in step s49, respectively. Then, the decrypted encrypted data is encrypted in step s50 with the decrypted OTP key. Then, the secret data D encrypted with the OTP key is transmitted to HOST2 in step s51 as OTP encrypted data. The HOST 2 decrypts the OTP encrypted data received from the HSM 4 with the temporarily stored OTP key and reads out the secret data D.

As described above, in the communication system 1B of the second embodiment, as shown in the operation sequence diagram of FIG. 6, the HOST 2 receives the second public key S used for the encrypted communication with the second HOST 6 from the second HOST 6 and HSM4. Receives the public key M stored by the HSM 4 from the HSM 4 and transmits it to the second HOST 6. When the secret data D possessed by the second HOST 6 is transmitted to the HOST 2, the HOST 2 receives the secret data D encrypted by the public key M from the second HOST 6 and transmits the secret data D to the HSM4, and the generated or acquired OTP key is transmitted from the HSM4. It is encrypted by the received public key M and transmitted to HSM4. The HSM4 decrypts the secret data D and the OTP key received from HOST2 by the secret key, respectively, and transmits the secret data D encrypted by the decrypted OTP key to HOST2.

Therefore, according to the communication system 1B of the second embodiment, the transmission of the secret data possessed by the second HOST 6 to the HOST 2 is transmitted from the second HOST 6 to the HSM 4 via the HOST 2 after the secret data D is encrypted by the public key M. Then, the secret data D decrypted by HSM4 is encrypted by the OTP key received from HOST2 and transmitted from HSM4 to HOST2. Therefore, according to the communication system 1B of the second embodiment, even when the secret data D possessed by the second HOST 6 is transmitted to the HOST 2, the communication in the

networks

3 and 7 between the HOST 2 and the HSM 4 and the second HOST 6 is in a secret state. It is done in. Therefore, according to the communication system 1B of the second embodiment, even when the confidential data D of the second HOST 6 is transmitted to the HOST 2, even if the memory capacity of the HOST 2 is small, the second HOST 6 maintains the confidentiality. The secret data D to be possessed can be transmitted to HOST2.

Next, the communication system according to the third embodiment of the present invention will be described.

FIG. 7 is a block diagram showing a schematic configuration of the communication system 1C according to the third embodiment of the present invention. In the figure, the same or corresponding parts as those in FIG. 1 are designated by the same reference numerals, and the description thereof will be omitted.

Communication system 1C differs from communication system 1A according to the first embodiment only in that HOST 2 is directly connected to the external memory 5 via a network 8 similar to network 3. Other configurations are the same as those of the communication system 1A according to the first embodiment.

In the third embodiment, as shown in the operation sequence diagram of FIG. 8, the secret data D held by HOST 2 is directly transmitted and written to the external memory 5 of the HSM 4. That is, when the confidential data D held by HOST2 is stored on the HSM4 side, HOST2 requests the generation of the key required for encrypted communication in step s61. This key generation request step s61 is not always necessary, and is not necessary when the key is automatically generated when the HSM 4 is started. The HSM4 performs key generation of the public key and the private key in step s62. Then, the generated public key is saved in the external memory 5 in step s63.

HOST 2 directly accesses the public key stored in the external memory 5 and reads it from the external memory 5, and encrypts the secret data D in step s64 with the read public key. Then, the encrypted secret data D is directly accessed to the external memory 5 and saved in the external memory 5 in step s65.

Note that the HOST 2 can also request in step s66 to transmit the public key generated by HSM4 to HSM4 after the key is generated in step s62 without reading the public key directly from the external memory 5. In this case, in response to this request, the HSM 4 stores the public key in the external memory 5 in step s63, and transmits the public key to HOST 2 in step s67 via the network 3. HOST2 encrypts the secret data D held by the public key received from HSM4 in step s64.

Further, the HOST 2 can also transmit the encrypted secret data D as encrypted data to the HSM 4 in step s68 without directly storing the encrypted secret data D in the external memory 5. In this case, the HSM 4 stores the received encrypted data in the external memory 5 or the internal memory 4a in step s69.

Further, the reading of the encrypted data directly stored in the external memory 5 to HOST 2 is performed in the same manner as in the operation sequence diagram shown in FIG. In this case, the HOST 2 directly accesses the external memory 5 in step s13 and directly transmits the OTP key encrypted in step s12 by the public key to the external memory 5 in step s13 instead of transmitting the OTP key encrypted in step s12 to the HSM 4 in step s13 via the network 3. Then, the OTP key encrypted in step s12 by the public key can be directly stored in the external memory 5. The secret data D encrypted by the public key stored directly in the external memory 5 in step s65 is read from the external memory 5 by HSM4 in step s14 and decrypted in step s15 by the private key stored by HSM4. To. Further, the OTP key encrypted by the public key stored in the external memory 5 is read from the external memory 5 by the HSM 4 in step s15 and decrypted by the private key stored in the HSM 4. Then, in step s16, the decrypted secret data D is encrypted by the decrypted OTP key to be OTP encrypted data, and the OTP encrypted data is transmitted to HOST 2 in step s17. The HOST 2 decrypts the OTP encrypted data received from the HSM 4 with the temporarily stored OTP key and reads out the secret data D.

As described above, in the communication system 1C according to the third embodiment, the HOST 2 is stored in the external memory 5 when the secret data D held by the HOST 2 is stored on the HSM4 side as shown in the operation sequence diagram shown in FIG. The public key is directly accessed to the external memory 5 and read from the external memory 5, and the secret data D encrypted by the read public key is directly accessed to the external memory 5 and stored in the external memory 5. Further, when the secret data D stored in the external memory 5 is read to the HOST2 side, the HOST2 directly accesses the external memory 5 and encrypts the generated or acquired OTP key with the public key read from the external memory 5. The HSM4 decrypts the OTP key received from HOST2 with the private key, reads the secret data D from the external memory 5, decodes it with the private key, and decodes the decrypted secret data D with the OTP key. It is encrypted by and sent to HOST2.

Even with the communication system 1C according to the third embodiment, the public key and the private key used for the encrypted communication between HOST2 and HSM4 are stored in HSM4 without being stored in HOST2. Therefore, the memory capacity required for HOST 2 is suppressed by the amount of the encryption key.

Further, in the transmission of the secret data D possessed by the HOST 2 to the HSM4 side, the public key stored in the external memory 5 of the HSM4 is directly read by the HOST2, and the secret data D is encrypted by the public key in the HOST2 to the outside. This is done by writing directly to memory 5. Further, the encrypted secret data D stored in the external memory 5 is decrypted by the HSM4, then encrypted with the OTP key sent from the HOST2 after being encrypted with the public key, and is encrypted from the HSM4 side. It is transmitted to HOST2 and decrypted by the OTP key in HOST2. Therefore, the communication between the HOST 2 and the external memory 5 in the network 8 is performed in a secret state, and the communication between the HSM 4 and the external memory 5 is not performed in the

networks

3 and 8, so that the communication from the outside is performed. You are not exposed to the threat of eavesdropping. Further, by storing the storage contents that change depending on the device to which the communication system 1C is applied in the external memory 5, the internal memory 4a of the HSM 4 is redesigned to be appropriate for each device to which the communication system 1C is applied. The need is eliminated, the versatility of the HSM4 is increased, and the product cost of the communication system 1C is reduced.

Therefore, even with the communication system 1C according to the third embodiment, communication can be performed while maintaining confidentiality even if the memory capacity of HOST2 is small, and the internal memory 4a of the HSM4 is used by the device to which the communication system 1C is applied. It is possible to provide a communication system 1C that does not need to be redesigned, has high versatility, and reduces product cost. Further, unlike the communication system 1A according to the first embodiment, according to the communication system 1C according to the third embodiment, the encrypted secret data D can be stored in the external memory 5 without going through the HSM 4. Communication processing can be performed at high speed and with low power consumption.

Further, in the communication system 1C according to the third embodiment, the HOST 2 may be configured to encrypt the secret data D into homomorphic encryption by the public key read from the external memory 5. Homomorphic encryption can perform a predetermined analysis such as AI (artificial intelligence) analysis in a state of being encrypted with a public key without performing decryption processing. Therefore, in this case, HOST2 eliminates the OTP encryption / decryption sequence without accessing HSM4, reads the confidential data D directly from the external memory 5 while maintaining confidentiality, and encrypts it with homomorphic encryption. Predetermined analysis of the secret data D can be performed in a short time, that is, at high speed and with low power consumption. However, the true data value of the secret data D requires an OTP encryption / decryption sequence as shown in the operation sequence diagram shown in FIG. 3, and the data read processing from the HSM 4 in the communication system 1A according to the first embodiment. It will follow the same sequence.

Further, even when the second HOST 6 is provided as in the communication system 1B according to the second embodiment, the HOST 2 and the external memory 5 are directly connected by the network 8 as in the communication system 1C according to the third embodiment. As a result, as shown in the operation sequence diagram shown in FIG. 8, encrypted data such as homomorphic encryption can be stored directly from HOST 2 via network 8 in external memory 5, or from external memory 5 directly to HOST 2 via network 8. It is possible to read encrypted data such as homomorphic encryption and perform a predetermined analysis at high speed and with low power consumption without using HSM4. Further, as shown in the operation sequence diagram shown in FIG. 3, the confidential data D stored in the external memory 5 can be read out to HOST 2 while maintaining confidentiality.

1A, 1B, 1C ... Communication system 2 ... Host device (HOST)
2a ... CPU
2b ... Read-only memory (ROM)
2c ... Temporary storage memory (RAM)
2d ... Communication processing circuit 2e ... OTP

encryption function block

3, 7, 8 ... Network 4 ... Hardware security module (HSM: Security device)
4a ... Internal memory 4b ... Cryptographic processing IP
4c ... Random number generator 5 ... External memory 6 ... 2nd host device (2nd HOST)

Claims

A host device having confidential data and a security device connected to the host device via a network to generate and store a public key and a private key used for encrypted communication with the host device by a random number generator. ,
When the secret data is stored on the security device side, the host device encrypts the secret data using the public key received from the security device and transmits the confidential data to the security device, and the security device receives the security device. The encrypted secret data received from the host device is stored in an external memory and stored.
At the time of reading the secret data stored in the external memory to the host device side, the host device encrypts the generated or acquired one-time pad key with the public key and transmits it to the security device. The security device decrypts the one-time pad key received from the host device with the private key, reads the secret data from the external memory, decrypts with the private key, and decodes the decrypted secret data. A communication system that is encrypted by the one-time pad key and transmitted to the host device.
A host device having confidential data and a security device connected to the host device via a network to generate and store a public key and a private key used for encrypted communication with the host device by a random number generator. ,
The security device stores the public key in an external memory and
When the secret data is stored on the security device side, the host device directly accesses the external memory, reads the public key stored in the external memory, reads it from the external memory, and encrypts it with the read public key. The secret data is directly accessed to the external memory and stored in the external memory.
When reading the secret data stored in the external memory to the host device side, the host device directly accesses the external memory and is generated or acquired by the public key read from the external memory. The pad key is encrypted and transmitted to the security device, and the security device decrypts the one-time pad key received from the host device by the private key, reads the secret data from the external memory, and reads the secret key. A communication system that decrypts and encrypts the decrypted secret data with the decrypted one-time pad key and transmits the decrypted data to the host device.
The communication system according to claim 2, wherein the host device encrypts the secret data into homomorphic encryption by the public key read from the external memory.
The communication system according to any one of claims 1 to 3, wherein the random number generator is composed of a physical random number source.
The security device is further provided with a second host device that is network-connected to each other via the host device.
The host device receives the second public key used for encrypted communication with the second host device from the second host device, transmits the second public key to the security device, and stores the public key, which is stored by the security device. Is received from the security device and transmitted to the second host device.
When the secret data is transmitted to the second host device, the host device encrypts the secret data with the second public key and transmits the secret data to the second host device, or the secret data is transmitted with the public key. 1 to 4 that encrypts the data and transmits it to the security device, and the security device transmits the confidential data that is decrypted by the private key and encrypted by the second public key to the second host device. The communication system according to any one of the above.
The security device is further provided with a second host device having confidential data connected to each other via the host device.
The host device receives the second public key used for encrypted communication with the second host device from the second host device, transmits the second public key to the security device, and stores the public key, which is stored by the security device. Is received from the security device and transmitted to the second host device.
When the secret data possessed by the second host device is transmitted to the host device, the host device receives the secret data encrypted by the public key from the second host device and transmits the secret data to the security device. Then, the generated or acquired one-time pad key is encrypted by the public key and transmitted to the security device, and the security device secretly transmits the secret data received from the host device and the one-time pad key, respectively. The communication system according to any one of claims 1 to 5, wherein the secret data decrypted by a key and encrypted by the decrypted one-time pad key is transmitted to the host device.