JP2000151573A - Group key decoding system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide the group key decoding system that is used for a group consisting of three users or over where an listener-in cannot decode a group key. SOLUTION: The group key decoding system includes n-sets of key processing units that can be specified without duplication as the key processing unit kn (n is an integer being 3 or over), the key processing unit k1 and the key processing unit ka (a=2,3,..., n-1). The key processing unit kn requests issue of the group key to the key processing unit k1 and generates an original gn= F(gn-1, xn) that is a group key to be decoded, based on an element gn-1 supplied from the key processing unit kn-1, an element xn received from the user, and a unidirectional function s=F(t, u) and F(F(α, β),)=F(F(α, β), γ) hold. The key processing unit k1, key processing unit ka generate an element g1=F(g,x) and an element ga=F(ga-1, xa) on a residue field G and the elements are fed sequentially to other device.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a group key restoration system for restoring a common group key in n (n is an integer of 3 or more) key processing units.

[0002]

2. Description of the Related Art Conventionally, encryption and decryption techniques have been used when transmitting and storing secret information, thereby ensuring the confidentiality of the secret information. A key is used when secret information is encrypted and decrypted, and this key (a common key or a group key) is shared between a plurality of specific users.

As a method for sharing a key between two specific parties, a DH (Diffie-Hellman) key exchange method is known. FIG. 7 is a diagram for explaining the DH key exchange method. User 1 uses p as a prime number and secret key X ₁
(X ₁ is an integer of 2 or more and (p−2) or less) and a public key Y ₁ obtained from p, another integer value a, and X ₁ by (Equation 1) (see [Equation 1]). , User 2 holds a secret key X ₂ (X ₂ is an integer of 2 or more and (p−2) or less) and a public key Y ₂ obtained from (Equation 2) from p, a, and X ₂ . Here, in (Equation 1), known a, p,
Although it is easy to from X ₁ Request Y _1, when p is sufficiently large, known a, p, to determine the X ₁ from Y ₁ is difficult called discrete logarithm problem. The secret key is a key that is kept secret by the user without being disclosed, and the public key is a key that is disclosed to the partner user.

When the user 1 and the user 2 hold such a private key and a public key, the user 1 uses the secret key X ₁ and the public key Y _{2 of the} user 2 as shown in (Equation 3). To obtain the common key U ₁ , and the user 2
The common key U ₂ (= U ₁ ) can be obtained from the secret key X ₂ and the public key Y _{1 of the} user 1 as shown in (Equation 4). That is, the common key is shared between the user 1 and the user 2.

[0005]

(Equation 1) However, such a DH key exchange method cannot be safely applied to a group of three or more parties. The (k, n) threshold method is known as a method for sharing a key among three or more groups. In this (k, n) threshold method, when the number of all users constituting a group is n,
N pieces of shared information are generated in advance and given to each user. From these n pieces of shared information, arbitrary k pieces of shared information are collected, and the key is restored. (If the number of pieces of shared information is less than k, the key cannot be restored.) Here, k = 3 and n = 4, and based on polynomial interpolation (k,
n) The threshold method will be described.

FIG. 8 is a diagram for explaining the (3, 4) threshold value method. Integers s, s and n to be group keys
(= 4) or more prime numbers are p, and k-1 (= 2) numbers randomly selected from non-negative integers less than p are s ₁ and s _2, and f
(X) is defined as (Expression 5) (see [Equation 2]).
The user 1 user 4, respectively attached identification information ID ₁ ~ID ₄ are different integers each other, the shared information and the secret _{f (ID 1) ~f (ID} 4) is given.

[0007] For example, when the user 2 is to restore a group key s, in addition to f (ID ₂₎ for the user 2 itself _{holds, f (ID 1), f} (ID 3), and, f (I
Any two shared information D ₄₎ is required, wherein it is assumed that f (ID ₁₎ and f (ID ₃₎ is acquired. According to the acquisition of these pieces of shared information by the user 2, a simultaneous linear equation shown in (Equation 6) is obtained, and by solving this simultaneous linear equation, the group key s, s ₁ ,
s ₂ . Similarly, user 1, user 3, and user 4 are also two out of three users other than themselves.
The group key s can be restored by obtaining the shared information from the other users, and the group key s is shared among the users 1 to 4.

[0008]

(Equation 2)

[0009]

However, (k,
n) In the threshold method, if k pieces of shared information for restoring a key are eavesdropped on a communication path, there is a risk that the eavesdropper may restore the group key. (K, n) in the group key recovery system using a threshold method, when a user U ₁ to restore the group key, other than the shared information holding itself (k-1) pieces of distributed information to other users U
It needs to receive from _two to user U _k occur. It is assumed that the eavesdropper X has eavesdropped on all of these communications and obtained (k-1) pieces of shared information.

[0010] Thereafter, out of the n users constituting the group key recovery system, when the user U _m to restore the group key is different from the user U _1, eavesdropper X is more user U
_Assuming that shared information other than ₂ to user U _k has been obtained,
Eavesdropper X is combined with the user U ₁ is eavesdropping when restoring the group key (k-1) pieces of shared information, and thus to obtain a total of k or more of the distributed information. That is, eavesdropper X
Can restore a group key with at least k pieces of shared information.

The present invention has been made in consideration of the above-described problems, and it is impossible for an eavesdropper to recover the group key by eavesdropping on communication that occurs during the process of recovering the group key. It is another object of the present invention to provide a group key restoration system used in a group including three or more users.

[0012]

In order to achieve the above object, a group key recovery system according to the present invention provides a secret key for each of different elements x on a given finite field G.
A group key restoration system including n key processing devices corresponding to three users (where n is an integer of 3 or more) and restoring a common group key with the n key processing devices, Each of the _n key processing devices, when the group key is restored, has a key processing device k _n , a key processing device k _1, and a key processing device k _a (a = 2, 3,..., N−1) As
Identified without duplication.

The key processing device k _n requests the key processing device k ₁ to issue a group key, and the element g _n-1 supplied from the key processing device k _n-1 later and the element x _n input by the user. (Element x
_b is made to correspond to an element x input to the key processing device k _b by the user) and a one-way function s = F (t, u) (t = u (t, u)) for performing an operation from t, u to s on the finite field Where F
(F (α, β), γ) = F (F (α, γ), β) holds, so that the element g _n = F (g _n ) on the finite field G, which is the group key to be restored _-1 , x _n ). Also,
The key processing unit k ₁ acquires the element g of the finite field G which is stored in a predetermined storage device, element g, based on x ₁ and s = F
(T, u) by, generates original _{g 1 = F (g, x} 1), and supplies the original g ₁ to the key processing unit k _2, the key processing unit k _a, the original g
_a-1 , element x _a and s = F (t, u), element g _a = F
(G _a−1 , x _a ) is generated, and the element g _a is supplied to the key processing device k _{a + 1} .

[0014]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a group key restoration system according to one embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an overall configuration of a group key restoration system according to one embodiment of the present invention.
FIG. 2 is a diagram for explaining an outline of a configuration of a key processing device constituting the group key restoration system.

The present group key recovery system includes a key processing device
k₁, Key processing device k_Two, Key processing device k _Three, ..., key processing unit
k_a, ..., key processing device k_nAnd the key processing device k₁
~ K_nAre connected via a communication path. this
K attached to these key processors₁~ K_nIs, as shown below:
It specifies the content of the processing when generating the group key.
However, these are a group consisting of n key processors.
In the key recovery system, the processing in each key processing device progresses.
Selected so that they do not overlap as
(Details will be described later). In addition, this group
The key recovery system has a predetermined storage device for storing the public information I.
And the source of the group key.
Information is stored.

As shown in FIG. 2, each of the key processing devices k _{1 to} k _n includes a data transmission / reception unit 101 for transmitting / receiving data to / from another device, an operation unit 102 for performing an operation required for restoring a group key, A storage unit 103 for performing storage required for the calculation by the calculation unit 102, a group key restoration request from a user,
An input unit 104 for receiving an input of a secret key or the like; a display unit 105 for performing a display necessary for restoring a group key
Contains.

The key processing unit k _a data transceiver 101
Receives g _a−1 , and the arithmetic unit 102 calculates F (F (α,
β), γ) = F (F (α, γ), β) One-way function F, received g _a-1 , which is kept secret from the user and input from the input unit 104 when necessary Secret key x _a
Thus, g _a = F (g _a−1 , x _a ) is generated. Arithmetic unit 10
The thus generated g _{a in 2} is further transmitted from the data transmission / reception unit 101 to the key processing device k _{a + 1} ,
The above processing is repeated in the next key processing device until a group key is finally generated.

As described above, F (F (α, β), γ) = F
As the one-way function F having the property of (F (α, γ), β), p is a prime number of 3 or more, which is a modulus for generating a certain remainder field G, g is an element on the remainder field G, x = y = F
(G, x) = g ^x mod p.
(In such y = F (g, x), when p is sufficiently large, it is difficult to obtain x from known g, p, and y, and this is called a discrete logarithm problem.) Actually, this unidirectionality is obtained. The fact that the function F (g, x) has the above properties can be confirmed by the following (Equation 7) (see [Equation 3]).

[0019]

(Equation 3) A group G (E) of points on the elliptic curve E defined on a remainder field G ₀ generated modulo a certain integer p as another one-way function F having the above properties. Is an element x and P is an integer x, x additions of the element P (ie, P is x
Y = F (P, x) = x * P indicating the multiplication by multiplication can be defined. (In such Y = F (P, x), it is very difficult to obtain the integer x from the element P and the element Y on the known group G (E). The fact that the one-way function F (P, x) satisfies the above-mentioned F (F (α, β), γ) = F (F (α, γ), β) is as follows ( This can be confirmed by Expression 8) (see [Equation 4]). Here, P is an element on the group G (E), x is an integer, x is a multiplication (normal to a number), and * is an elliptic curve E
The above is the multiplication of P.

[0020]

(Equation 4) From the above, F (F (α, β), γ) = F (F (α,
γ), β) a one-way function y = F (g,
The presence of x) is confirmed. In the group key recovery system according to the present embodiment, the one-way function F is represented by F (g, x) = g ^x
Mod p will be described, but other than these, (F
The invention can be implemented with a one-way function having the above properties (like (P, x) = x * P).

When F is as described above,
The public information I is an input to a key processing device serving as a starting point of key restoration, such as a prime number p serving as a modulus of a remainder, and a parameter for specifying an elliptic curve when an operation on an elliptic curve is used for F. An element g on the remainder field G (an element P on the group G (E)) is included. N managed by each of the users of the group sharing the key
One of the key processing devices obtains a one-way function F from the public information I.
Can be freely obtained, such as a prime number p (a parameter of an elliptic curve) required when calculating. (It is not necessary to keep the public information I confidential to the outside of the group.) Processing performed when a group key is actually generated will be described with reference to FIG.

[0022] First, in the key processing unit k _n which is one of the n sets of key processing apparatus of the present group key recovery system, the input unit 1
04 receives a key restoration request from the user. Upon receiving this key restoration request, the key processing device k _n requests the key processing device k ₁ , which is another key processing device, to restore the group key g _n at the time of selection. The treatment with these kind of key processing unit k _n and the group key recovery request process.

Upon receiving this request, the key processing device k ₁ obtains information g corresponding to the group key g _n to be restored from the public information I stored in the predetermined storage device, and inputs this g and the user's input. The above-described one-way function F is used to calculate g ₁ = F (g, x ₁ ) from the secret key x ₁ to be generated, and a key which is any other key processing device is selected at the time of selection. and transmits to the processing unit k _2. (The one-way function F performs an operation on the remainder field G, and g ₁ is an element of the remainder field G.) The processing in the key processing device k ₁ like these is defined as the starting point processing. .

The key processing unit k ₂ are, g from the private key x ₂ Metropolitan input by g ₁ and the user, which is transmitted from the key processing unit k _1
2 = F (g ₁ , x ₂ ) is generated and transmitted to any other key processing device k ₃ (excluding the key processing devices k _n and k ₁ ). The processing in the key processing unit k ₂ and relay processing. Hereinafter, the relay processing, performed from the key processing unit k ₃ by the key processing unit k _n-1, in all key processing devices configuring the group key recovery system (one degree) calculation of F is performed Like g _a
(A = 1, 2,..., N−1) are transmitted and received. (Nature g _a-1, g _a (here the F, g ₀ = a g) from it is difficult to calculate the secret key x _a of each user, required to perform these communications at secret communication no.) the key processing unit k _n that has issued the key recovery request, the key processing unit k ₃ ~
After the relay processing in the k _n-1, it receives a g _n-1 from the key processing unit k _n-1, using a secret key x _n, group key g _n of interest
= F (g _n − ₁ , x _n ). The treatment with these kind of key processing unit k _n and ending process.

Actually, when n = 6, each key processing device k _{1 to} k ₆ corresponds to a key processing device managed by a specific user as follows, and each key processing device k _{1 to} k ₆ g ₁ to g ₅ is transmitted and received tHAT calculated. 3, in the group key recovery system consisting of six is a diagram showing the path g ₁ to g ₅ are transmitted and received. FIGS. 3A and 3B show two routes out of 120 possible routes when the end point is determined.

Each of the specific users 111 to 116 manages a key processing device. When restoring the group key,
In FIG. 3A, the key processing device managed by the user 111 performs the starting process in response to a request from the key processing device managed by the user 116, and the key processing devices managed by the users 112 to 115 sequentially perform the relay process. Perform After these relay processes, the key processing device managed by the user 116 performs an end point process to obtain a group key.

Further, a request for a group key in the same group key restoration system can be made to a key processing device managed by the user 113 different from the above. FIG.
In (b), the key processing device managed by the user 113 performs the starting process in response to a request from the key processing device managed by the user 116, and the user 114, the user 112, and the user 1
15. The key processing devices respectively managed by the user 111 sequentially perform the relay processing. After these relay processes, user 1
The key processing device managed by 16 performs end point processing to obtain a group key.

Selection of a path such as these depends on F, F
(F (α, β), γ) = F (F (α, γ), β). At six group key recovery system consisting of key processing apparatus, when the user 116 is assumed to have requested the issuance of group key, used all without overlapping the other five key processing apparatus, a total of 120 (= ₅ P ₅ ) routes can be selected, and using any route does not affect the value of the restored group key.

More specifically, in the present group key recovery system, table data as shown in [Table 1] can be used next to instruct the user to perform key recovery processing appropriately. . This table data is n
At Group key recovery apparatus comprising a base of the key processor, it is transmitted and received as additional information together with g ₁ ~g _n-1 when restoring the group key.

[0030]

[Table 1] As shown in [Table 1], this table data includes a processing type, a user name, and a processing status. The process type identifies the type of process to be performed by the user, and includes a start process, a relay process, and an end process. The user name is for identifying (a key processing apparatus corresponding to) a user constituting the group, and describes one of the users constituting the group. The processing status is
This is information for identifying whether or not each user has performed a process for restoring a group key. The information is blank in an initial state, and is used for each user to restore a group key in each key processing device. Is performed, the table data is updated by adding a circle having the meaning of a flag.

In the table data shown in [Table 1],
Origin processing is performed for the user 113, the user 111, the user 11
2, indicating that the relay processing is assigned to the user 114 and the user 115 and the end point processing is assigned to the user 116, and that the processing to be performed for the user 113, the user 111, and the user 112 has already been completed. ing.

The procedure of the processing performed by the key processing device constituting such a group key restoration system will be described. FIG. 4 is a flowchart illustrating a procedure of a group key restoration request / end point process, and FIG. 5 is a flowchart illustrating a procedure of a start point process and a relay process. In the group key restoration request / end point process performed by the key processing device k _n (see FIG. 1), as shown in FIG. 4, first, a group key restoration instruction from a user is detected (S101). According to the instruction, the above-described table data (see [Table 1]) is created (S102). Subsequently, a key processing device that performs the starting point process is specified from the table data,
A group key restoration process notification requesting that the key processing device perform the process for restoring the group key is transmitted (S103).

Thereafter, the process is stopped until a group key restoration process notification is received from a key processing device managed by another user (after completing the (n-2) th relay process) (S104).
When the group key restoration process notification is received (Yes in S104), the original g _n-1 is received from the key processing device managed by the user who transmitted the group key restoration process notification (S105). A group key is generated by the one-way function F from the element g _n−1 and the secret key x _n input by the user (S106).

The above-mentioned key processing device k₁Done at
Origin processing and key processing device k_Two~ K _n-1Being done at
In the connection processing, as shown in FIG.
Received from the key processing unit
(S201). In this group key restoration processing notification,
Created in the above group key restoration request / end point process,
Table data is added, and this table data
From whether the process to be performed by the own device is the starting process
Is determined (S202).

When the process to be performed by the own device is the originating process (Yes in S202), the element g corresponding to the group key is obtained from the public information I (S203), and the process to be performed by the own device is performed. Is not the originating process (No in S202), it is determined that the process to be performed by the own device is the relay process, and the key processing device managed by the user who has transmitted the group key restoration process notification sends the original g _{a- 1}
Is received (S204).

Subsequently, the element g obtained as described above is obtained.
Alternatively, the element g _a is generated by the one-way function F from the element g _a-1 and the secret key x _a input by the user (S20).
5) In order to indicate that necessary processing has been performed in the own device, the table data is updated so that a circle is added to the processing status column of the above-described table data (see [Table 1]) (S
206), a user who has not performed the relay process is searched from the table data (S207), and it is determined whether there is a user who has not performed the relay process (S20).
8).

[0037] If there are users who do not perform relay processing (at S208 Yes), the group key restoration process notifies the user should perform the relay process and the output value g _a of F are sequentially transmitted (S209), the relay If there is no user who has not performed the processing (No in S208), the user who has requested the restoration of the group key (the user who should perform the end point processing)
, The group key restoration process notification and the output value g _a (g _n−1 ) of F are transmitted in order. (If there are a plurality of users who have not performed the relay process, the destination user is randomly selected.) As described above, in the present group key restoration system, when the group key is restored, All the key processing devices that make up the group do not overlap,
It is specified as an apparatus that performs any one of the end point processing (and the group key restoration request processing), and each processing is performed.

The data sequentially transmitted and received to perform each of these processes differs depending on which process is assigned to each key processing device, and a secret key required in each process is transmitted from the transmitted and received data. Since it cannot be specified, even if the communication that occurs during the process of restoring the group key is eavesdropped, the eavesdropper can use it unless the secret key input by each key processing device is leaked to the eavesdropper. It is impossible to recover the group key. For this reason, it is not necessary to perform communication occurring in the process of restoring the group key as secret communication.

Further, in the present group key recovery system,
G obtained from the public information I in the starting point processing (see FIG. 1)
Is changed, it is possible to easily update the group key without performing processing on a plurality of key processing devices. In the above-described embodiment, it is assumed that there is only one g obtained from the public information in the starting point process. However, even if the value of the secret key held by the user is unchanged, the group is determined by the value of g. Since the key can be changed, g can be made up of a plurality of groups, and a plurality of group keys can be assigned to each of them, and these group keys can be shared.

In the above-described embodiment, the processing status column in the table data (see Table 1) is provided with a circle having the meaning of a flag indicating whether or not each processing is completed when each processing is completed. However, signature data using a user's private key can be used instead. By using such signature data, when any unauthorized process (including an erroneous input of a secret key by the user) is performed during the originating process and the relay process, the key in which the unauthorized process is performed is performed. The processing device can be easily specified.

Further, as another embodiment of the present invention different from the above, the following group key restoration system can be mentioned. This group key restoration system is for a group that can be divided into a plurality of subgroups, and a group key is restored for each subgroup. Here, the users who can request the group key (manage the key processing device) are included in a plurality of sub-groups in an overlapping manner. (Here, 1
It is assumed that only one key processing device is included in a plurality of subgroups, but other key processing devices are included in a plurality of subgroups together with a key processing device that requests a group key. It can be. FIG. 6 is a diagram showing an overall configuration of a group key restoration system that can restore a group key for each subgroup in a group that can be divided into two subgroups.

This group key restoration system is intended for seven users (key processing devices managed by seven users) included in one group and holding mutually different secret keys. This group of seven has two subgroups, A and B
Is divided into Subgroup A includes users 201 to 2
04, and the subgroup B includes users 204 to 2
07 is included. That is, the user 204 is included in the subgroups A and B redundantly.

Here, the users 201 to 207 manage the key processing devices k _{A1 to} k _A3 , the key processing device k ₄ , and the key processing devices k _{B3 to} k _B1 , respectively. K _{A1 to} k _A3 and k _{B3 to} k _B1 attached to these key processing devices specify the processing content (origin processing or relay processing) when generating a group key, as in the above-described group key restoration system. However, these are sequentially selected from the three key processing devices for restoring the group key in each subgroup so as not to overlap as the processing in each key processing device proceeds. To go.

Further, the present group key restoration system includes a predetermined storage device, g _A which is information on which the subgroup _A restores the group key, and the subgroup B which contains the group key. g _B is based on information serving in restoring is stored as public information I. Any key processing device included in this group key recovery system,
The information included in the public information I can be obtained.

In order for the user 204 to obtain the group key of the subgroup A, first, the user 204 issues a group key restoration request to the key processing device k _A1 managed by the user 201 by the key processing device k _4. Key processing device k _A1
To perform a starting point process. In the key processing devices k _A2 and k _A3 managed by the users 202 and 203, respectively, relay processing is sequentially performed according to the starting process in the key processing device k _A1 , and finally, the key processing device k ₄ , G _A3 is received from the key processing device k _A3 and the end point processing is performed. (The starting point processing, relay processing, and end point processing here are the same as those performed in the above-described group key restoration system.) By such processing, in the subgroup A, the key processing device k ₄ Restores the group key g _A4 .

In the processing in subgroup A as described above,
Three devices managed by the users 201 to 203 respectively
In which order the originating process and the relaying process
(In which key processing device_A1~ K_A3Is supported
Can be selected freely. Also the user
In order for 204 to obtain the group key of subgroup B,
First, the user 204 sets the key processing device k_FourBy the user
Key processing device k managed by 207_B1Group key recovery for
Key request device k_B1Perform origin processing on
Let User 206 and user 205 respectively manage
Key processing device k_B2, Key processing device k_B3Then, the key processing device k_B1
Relay processing is sequentially performed according to the starting processing at
Later, the key processing device k_FourAt g_B3Is the key processor k_B3From
It is received and the end point processing is performed. For processing like these
Therefore, in the subgroup B, the key processing device k _FourGuru at
Key g_B4Is restored.

In the processing in the subgroup B as described above, similarly to the processing in the subgroup A, the user 205
207 can freely select in what order the originating process and the relaying process are performed (which key processing device corresponds to k _B1 to k _B3 ) in the three key processing devices respectively managed by can do. In the group key recovery system as described above, for a single secret key held by each user, a user included in a plurality of subgroups in an overlapping manner is
A plurality of (sub) group keys corresponding to each of the plurality of subgroups can be restored.

[0048]

The group key recovery system according to the present invention
Secrets different elements x on a given finite field G
To n users (n is an integer of 3 or more)
In each case, n key processing devices are included, and the n
Group key for restoring a common group key in the key processing unit
A recovery system, wherein each of said n key processing devices comprises:
When the group key is restored, the key processing device k_n, Key processing
Device k₁And key processing unit k _a(A = 2,3, ..., n-
As 1), it is specified without duplication.

The key processing device k _n requests the key processing device k ₁ to issue a group key, and the element g _n-1 supplied from the key processing device k _n-1 later and the element x _n input by the user. (Element x
_b is made to correspond to an element x input to the key processing device k _b by the user) and a one-way function s = F (t, u) (t = u (t, u)) for performing an operation from t, u to s on the finite field G Where F
(F (α, β), γ) = F (F (α, γ), β) holds, so that the element g _n = F (g _n ) on the finite field G, which is the group key to be restored _-1 , x _n ). Also,
The key processing unit k ₁ acquires the element g of the finite field G which is stored in a predetermined storage device, element g, based on x ₁ and s = F
(T, u) by, generates original _{g 1 = F (g, x} 1), and supplies the original g ₁ to the key processing unit k _2, the key processing unit k _a, the original g
_a-1 , element x _a and s = F (t, u), element g _a = F
(G _a−1 , x _a ) is generated, and the element g _a is supplied to the key processing device k _{a + 1} .

According to the present group key recovery system, the key processing
Science equipment_nIn the key processing device k₁Group key must be issued
Key processing device k_n-1Yuan g supplied from_n-1,
Element x _nAnd s = F (t, u), on a finite field G,
Element g that is the group key to be restored_n= F (g_n-1, X
_n) Is generated. Also, the key processing device k₁In the prescribed notes
The element g on the finite field G stored in the storage device is obtained,
Element g, element x₁And s = F (t, u) gives the element g₁= F
(G, x₁) Is generated and the key processing device k_TwoSupplied to the key
Processing unit k_aAt yuan g_a-1, Element x_aAnd s = F (t,
u) by the element g_a= F (g_a-1, X_a) Is generated and the key
Science equipment_{a + 1}Supplied to

[0051] Any Thus, data sequentially communication in order to perform the processing (processing corresponding to one of the key processing unit k _n, the key processing unit k ₁ or the key processing unit k _a) Each key processing unit It depends on whether the process is assigned, and since the secret key required in each process cannot be specified from the data to be communicated, even if the communication generated in the process of restoring the group key is eavesdropped, It is impossible for an eavesdropper to recover the group key.

In the above group key recovery system,
A finite field G is expressed as a remainder field G modulo 3 or more prime numbers p₁When
And F (t, u) is replaced by t^u(Mod p)
And can be. This group key recovery system
Then, the key processing device k_nIn the key processing device k₁Group key
Of the key processing device k_n-1Supplied by
G_n-1, Element x _nAnd s = F (t, u) = t^u(Mo
d p) gives the remainder field G modulo the prime number p₁Above, return
Element g that is the group key to be derived_n= F (g_n-1,
x_n) Is generated. Also, the key processing device k₁At the given
Remainder G stored in storage device₁The original g on is obtained
, Element g, element x₁And s = F (t, u) gives the element g₁=
F (g, x ₁) Is generated and the key processing device k_TwoSupplied to
Key processing device k_aAt yuan g_a-1, Element x _aAnd s = F
The element g by (t, u)_a= F (g_a-1, X_a) Generated
And the key processing device k_{a + 1}Supplied to

This makes it impossible for an eavesdropper to restore the group key even if the communication generated during the process of restoring the group key is eavesdropped. In the above group key recovery system, the storage device stores a plurality of different original on residue field G _1, the key processing unit k ₁ selectively one of the plurality of original Can be obtained.

According to the present group key restoration system, the key processing
Science equipment_nIn the key processing device k₁Group key must be issued
Key processing device k_n-1Yuan g supplied from_n-1,
Element x _nAnd s = F (t, u) = t^uBy (mod p)
The remainder field G modulo the prime number p₁On, should be restored
Element g that is the group key_n= F (g_n-1, X_n) Is generated
You. Also, the key processing device k₁Store in the specified storage device
Remainder G₁Of the different elements above
Is selectively obtained, and the element g and the element x ₁You
And s = F (t, u) gives the element g₁= F (g, x₁) Is raw
Key processing device k_TwoAnd the key processing device k_aTo
G_a-1, Element x_aAnd s = F (t, u) gives the element g
_a= F (g_a-1, X_a) Is generated and the key processing device k_{a + 1}To serve
Be paid.

This makes it impossible for an eavesdropper to restore the group key even if the communication generated during the process of restoring the group key is eavesdropped. Furthermore, a plurality of group keys are assigned to each of a plurality of different elements on the remainder, and a plurality of different elements on the remainder are selectively obtained to select a group key to be restored. can do.

In the above group key restoration system, the n (here, n is an integer of 4 or more) key processing devices are set such that _n key processing devices k _n are included in duplicate.
Included ₁ (n ₁ to the integer of 3 or more) and the first sub-group of _{base, n 2 (n 2 = n} -n 1 + θ ≧ 3, the theta to both the first subgroup and a second subgroup It is fixedly specified as a second subgroup consisting of several to) stand key processing apparatus, in the first sub-group, except the key processing unit k _n of (n ₁ -1) stand key processing unit Each is processed by a key processing device k _n and a key processing device k _1,1 (key processing device k _{c, d}
As the key processing device k _d specified in the c-th subgroup) and the key processing device k _{1, e-1} (e = 2,
3, ..., as n ₁ -1) by the key processing unit k _{1, e,} are sequentially identified without overlapping, the key processing unit k _{1, 1,} key processing unit k _{1, e} and key processing unit k _n is restore the first subgroup key g _{1, n,} the at second subgroup, each except the key processing unit k _{n (n 2} -1) stand key processing apparatus, the key by the key processing unit k _n As processor k _2,1 and
Key processing unit _{k 2, f-1 (f} = 2,3, ..., n 2 -1) as the key processing unit k _{1, f,} is sequentially identified without overlapping, the key processing unit k _2,1, key processor k _{2, f} and key processing unit k _n can be made to restore the second subgroup key g _{2, n.}

According to the present group key recovery system, the first
The subgroup, each except the key processing unit k _{n (n 1} -1) stand key processing apparatus, a key processing unit k _{1, 1} by the key processing unit k _n, and, the key processing unit k _{1, e} as the key processor k _{1, e} by _-1, it is sequentially identified without overlapping, the first subgroup key g _{1, n} is restored, the second sub-group, except the key processing unit k _n (n ₂ - each of 1) base of the key processing unit, the key processing unit k _n by the key processing unit k
_2,1 and the key processing device k _{2, f-1} are sequentially specified without duplication as the key processing device k _{1, f} , and the second subgroup key g _{2, n} is restored.

This makes it impossible for an eavesdropper to restore the group key even if the communication generated in the process of restoring the group key is eavesdropped. Further, for a single secret key held by each user, a user included in a plurality of subgroups in a redundant manner can restore a plurality of group keys corresponding to each of the plurality of subgroups.

Further, the group key restoration system according to the present invention provides n (n
Is an integer equal to or greater than 3). A group key restoration system including n key processing devices corresponding to three users, and restoring a common group key in the n key processing devices. When the group keys are restored, each of the two key processing devices serves as a key processing device k _n , a key processing device k _1, and a key processing device k _a (a = 2, 3,..., N−1). Identified without duplication.

The key processing device k _n requests the key processing device k ₁ to issue a group key, and the element P _n-1 supplied from the key processing device k _n-1 later, and the integer x _n input by the user. (Integer x
_b corresponds to an integer x input to the key processing device k _b by the user) and an element t on a group G (E) consisting of points on an elliptic curve E defined on a predetermined finite field G _0. One-way function s = multiplying by integer u to obtain element s on group G (E)
Based on u * t, an element P _n = x _n * P _n-1 which is a group key to be restored on the group G (E) is generated. Further, the key processing device k ₁ is a group G stored in a predetermined storage device.
(E) Obtain the element P above, and find the element P, integer x ₁ and s = u
* T, an element P ₁ = x ₁ * P is generated, and the key processing device k ₂
A supply source P _1, the key processing unit k _a, the original P _a-1, an integer x _a
And by s = u * t, to generate the original _{P a = x a * P a} -1, and supplies the original P _a to the key processing unit k _{a + 1.}

According to the present group key restoration system, the key processing device k _n requests the key processing device k ₁ to issue a group key, and the element P _n−1 supplied from the key processing device k _n-1 later. ,
With the integer _xn and s = u * t, an element _Pn = _xn * _Pn-1 which is a group key to be restored on the group G (E) is generated. The element P on the group G (E) stored in the predetermined storage device is acquired by the key processing device k ₁ , and the element P ₁ = x is obtained from the element P, the integer x _1, and s = u * t. ₁ * P is generated and supplied to the key processing unit k _2, in the key processing unit k _a, the original P _a-1, the integer x _a and s = u * t based on P _a =
x _a * Pa _-1 is generated and supplied to the key processing device ka _{+ 1} .

As a result, the data sequentially communicated for performing each process differs depending on which process is assigned to each key processing device, and the data communicated with the secret key required for each process. Therefore, even if the communication generated during the process of restoring the group key is eavesdropped, it is impossible for an eavesdropper to restore the group key.

The key processing apparatus according to the present invention corresponds to n users (n is an integer of 3 or more) each of which holds a different element x on a predetermined finite field G secretly.
One of the n key processing devices and the other (n-1)
A key processing apparatus for restoring a common group key when used together with two key processing apparatuses, wherein each of the n key processing apparatuses performs key processing when a group key is restored.
_n , a key processing device k ₁ and a key processing device k _a (a = 2, 3,
.., N-1).

Key processing device k_nWhen identified as
Key processing device k₁Requesting the issuance of a group key to
Science equipment_n-1Yuan g supplied from_n-1, Input by user
Element x_n(Element x_bTo the key processing device k by the user._bTo
Corresponding to the input element x) and on the finite field G
One-way function s = F that performs an operation from t, u to s
(T, u) (where F (F (α, β), γ) = F (F
(Α, γ), β) hold), the finite field G
Element g that is the group key to be restored_n= F (g_n-1, X
_n). Also, the key processing device k₁Identified as
In this case, the finite field G stored in a predetermined storage device
Get element g, element g, element x₁And s = F (t, u)
Than the original g₁= F (g, x₁), And the key processing device k_Two
To g₁And the key processing device k_aWhen identified as
Is the element g_a-1, Element x_aAnd s = F (t, u), the element
g_a= F (g_a-1, X_a), And the key processing device k_{a + 1}To yuan
g_aSupply.

According to the group key restoration system including _n key processing apparatuses, the key processing apparatus k _n uses the key processing apparatus k _1.
Is requested to issue a group key, and later the key processing device k _n-1
G _n-1 , x _n and s = F (t, u) supplied from
Generates an element g _n = F (g _n−1 , x _n ) on the finite field G, which is a group key to be restored. Further, the key processing device k ₁ obtains an element g on the finite field G stored in a predetermined storage device, and the element g, the element x ₁ and s = F
(T, u) based on _{g 1 = F (g, x} 1) by is generated and supplied to the key processing unit k _2, in the key processing unit k _a, original g _a-1, based on x _a and s = The element g _a = F by F (t, u)
(G _a−1 , x _a ) is generated and supplied to the key processing device k _{a + 1} .

As a result, the data sequentially communicated to perform each process differs depending on which process is assigned to each key processing device, and the data communicated with a secret key required in each process. Therefore, even if the communication generated during the process of restoring the group key is eavesdropped, it is impossible for an eavesdropper to restore the group key.

The computer-readable recording medium on which the program according to the present invention is recorded is installed and executed, so that n (n is 3) in which different elements x on a predetermined finite field G are kept secret. A program for restoring a common group key in the n key processing apparatuses, which operates as one of the n key processing apparatuses corresponding to the respective users) A computer-readable recording medium, wherein
When the group key is restored, each of the key processing devices k _n , k _1, and k _1
a (a = 2, 3,..., n−1) are specified without duplication.

Key processing device k_nWhen identified as
Key processing device k₁Requesting the issuance of a group key to
Science equipment_n-1Yuan g supplied from_n-1, Input by user
Element x_n(Element x_bTo the key processing device k by the user._bTo
Corresponding to the input element x) and on the finite field G
One-way function s = F that performs an operation from t, u to s
(T, u) (where F (F (α, β), γ) = F (F
(Α, γ), β) hold), the finite field G
Element g that is the group key to be restored_n= F (g_n-1, X
_n). Also, the key processing device k₁Identified as
In this case, the finite field G stored in a predetermined storage device
Get element g, element g, element x₁And s = F (t, u)
Than the original g₁= F (g, x₁), And the key processing device k_Two
To g₁And the key processing device k_aWhen identified as
Is the element g_a-1, Element x_aAnd s = F (t, u), the element
g_a= F (g_a-1, X_a), And the key processing device k_{a + 1}To yuan
g_aSupply.

This program is installed and executed.
Glue consisting of n key processing devices
According to the key recovery system, the key processing device k_nAt the key office
Science equipment₁Is required to issue a group key, and later key processing
Device k_n-1Yuan g supplied from _n-1, Element x_nAnd s = F
By (t, u), the glue to be restored on the finite field G
Original g which is a key_n= F (g_n-1, X_n) Is generated.
Also, the key processing device k₁Is stored in a predetermined storage device.
The element g on the finite field G is obtained, and the element g and the element x₁And
And s = F (t, u) gives the element g₁= F (g, x₁) Is generated
And the key processing device k _TwoAnd the key processing device k_aAt
Original g_a-1, Element x_aAnd s = F (t, u) gives the element g_a=
F (g_a-1, X_a) Is generated and the key processing device k_{a + 1}Supply to
Is done.

Thus, even if a communication generated in the process of restoring the group key is eavesdropped, it becomes impossible for an eavesdropper to restore the group key.

[Brief description of the drawings]

FIG. 1 is a diagram showing an entire configuration of a group key restoration system according to one embodiment of the present invention.

FIG. 2 is a diagram for explaining an outline of a configuration of a key processing device constituting the group key restoration system;

FIG. 3 shows g in a group key recovery system composed of six units.
₁ to g ₅ is a diagram showing a route to be transmitted and received.

FIG. 4 is a flowchart illustrating a procedure of a group key restoration request / end point process.

FIG. 5 is a flowchart illustrating a procedure of a starting point process and a relay process.

FIG. 6 is a diagram illustrating an overall configuration of a group key restoration system capable of restoring a group key for each subgroup.

FIG. 7 is a diagram for explaining a DH key exchange method.

FIG. 8 is a diagram for explaining a (3, 4) threshold method.

[Explanation of symbols]

Original g ₁ to g _n-1 group keys on a given residue field included in 101 the data transmission and reception unit 102 calculating unit 103 storage unit 104 input unit 105 display unit 111-116 user k ₁ to k _n key processing unit g Public Information G _n group key x ₁ -x _n secret key on the remainder field communicated when restoring

Claims (7)

[Claims] 1. Different elements x on a given finite field G
Each of n (n is an integer of 3 or more) secretly held
Including n key processing devices, each corresponding to a user,
A common group key is restored by the n key processing devices.
A group key recovery system, wherein each of the n key processing devices recovers a group key.
The key processing device k _n, Key processing device k₁And key processing equipment
Place_a(A = 2,3, ..., n-1)
Key processing device k_nIs the key processing device k₁Issue a group key to
Request and later key processing device k_n-1Yuan g supplied from_n-1,
Element x entered by the user_n(Element x_bBy the user
Key processing device k_bCorresponding to the element x input to
One-way operation to perform operation from t, u to s on finite field G
Function s = F (t, u) (where F (F (α, β),
γ) = F (F (α, γ), β) holds)
The element g on the field G that is the group key to be restored_n=
F (g_n-1, X_n), And the key processing device k₁Is stored in a predetermined storage device.
Get the element g on the field G, the element g, the element x₁And s = F
By (t, u), the element g₁= F (g, x₁) Generate the key
Processing unit k_TwoTo g₁And the key processing unit k_aIs the element g_a-1, Element x_aAnd s = F (t,
u) gives the element g_a= F (g_a-1, X_a) And generate the key
Science equipment_{a + 1}To g_aGlue characterized by supplying
Key recovery system. 2. The finite field G is a remainder field G ₁ modulo a prime number p of 3 or more, and the F (t, u) is represented by ^tu (mod).
2. The group key restoration system according to claim 1, wherein p). Wherein the storage device stores a plurality of different original on residue field G _1, the key processing unit k ₁ is claim 1 to selectively obtain one of the plurality of original Alternatively, the group key recovery system according to claim 2. 4. The n key processing apparatuses (here, n is an integer of 4 or more) include n ₁ (n ₁ is 3 or more) such that key processing apparatuses k _n are included in an overlapping manner. A first sub-group consisting of (integral) units and n ₂ (n ₂ = n−n ₁ + θ ≧
3, θ is the number of key processing devices included in both the first sub-group and the second sub-group). The second sub-group is fixedly specified. except for the equipment k _{n (n 1}
Each -1) stand key processing unit, the key processing unit k _n by the key processing unit k _{1, 1} (key processing unit k _c, the _d, and a key processing unit k _d identified in the c-th subgroup And the key processing device k _{1, e-1} (e = 2,3, ..., n ₁ -1)
As the key processor k _{1, e} by sequentially identified without overlapping, the key processing unit k _{1, 1,} key processing unit k _{1, e} and key processing unit k
_n is a first subgroup key g _{1, n} restored, by the second sub-group, except the key processing unit k _n (n ₂
Each -1) stand key processing apparatus, a key processing unit k _2,1 by the key processing unit k _n, and, the key processing unit k _{2, f-1}
(F = 2, 3,..., N ₂ -1) and the key processing device k _{1, f}
The key processing device k _2,1 , the key processing device k _{2, f} and the key processing device k
_n restores the second subgroup key g _{2, n} .
The group key restoration system according to claim 3. 5. An integer x different from each other is kept secret.
N (n is an integer of 3 or more) users
Corresponding n key processing devices, said n key processing
Group key recovery system for recovering a common group key on the device
Wherein each of the n key processing devices has a group key restored.
The key processing device k _n, Key processing device k₁And key processing equipment
Place_a(A = 2,3, ..., n-1)
Key processing device k_nIs the key processing device k₁Issue a group key to
Request and later key processing device k_n-1Yuan P supplied by_n-1,
Integer x entered by the user_n(Integer x_bTo the user
Key processing device k_bCorresponding to the integer x input to
And a given finite field G₀On the elliptic curve E defined above
A group obtained by multiplying an element t on a group G (E) of points by an integer u
According to a one-way function s = u * t that obtains an element s on G (E)
And the group key on group G (E) to be restored
Former P_n= X_n* P_n-1And generates a key processing device k₁Is a group stored in a predetermined storage device.
Get element P on G (E), element P, integer x₁And s =
By u * t, the element P₁= X₁* P is generated and the key processing device k is generated.
_TwoEx-P₁And the key processing unit k_aIs the element P_a-1, Integer x_aAnd s = u * t
By the former P_a= X_a* P_a-1And generates a key processing device k_{a + 1}
Ex-P_aGroup key recovery system characterized in that
Stem. 6. Different elements x on a predetermined finite field G
Each of n (n is an integer of 3 or more) secretly held
Of the n key processing devices corresponding to each user,
One for use with other (n-1) key processors
And a key processing unit for restoring a common group key
And wherein each of the n key processing devices has a group key restored.
The key processing device k _n, Key processing device k₁And key processing equipment
Place_a(A = 2,3, ..., n-1)
Key processing device k_nWhen the key processing device k is specified as₁To
Requests issuance of a group key, and later a key processing device k_n-1From
Yuan g supplied_n-1, The element x entered by the user_n(Original
x_bTo the key processing device k by the user._bTo the element x input to
) And the performance from t, u to s on the finite field G
One-way function s = F (t, u) (where F
(F (α, β), γ) = F (F (α, γ), β) holds
The group to be restored on the finite field G
Key g_n= F (g_n-1, X_n), And the key processing device k₁When specified as a predetermined storage device
Obtains the element g on the finite field G stored in
x₁And s = F (t, u), the element g₁= F (g, x
₁), And the key processing device k_TwoTo g₁And the key processing unit k_aWhen specified as_a-1, Element x_a
And s = F (t, u), the element g_a= F (g_a-1, X
_a), And the key processing device k_{a + 1}To g_aSupplying
A key processing device characterized by the above-mentioned. 7. When installed and executed,
And secrete different elements x on a given finite field G
To n users (n is an integer of 3 or more)
As one of the corresponding n key processors,
Operates and a common group key is shared by the n key processing devices.
Read computer with recorded program to restore
A removable recording medium, wherein each of the n key processing devices has a group key restored.
The key processing device k _n, Key processing device k₁And key processing equipment
Place_a(A = 2,3, ..., n-1)
Key processing device k_nWhen the key processing device k is specified as₁To
Requests issuance of a group key, and later a key processing device k_n-1From
Yuan g supplied_n-1, The element x entered by the user_n(Original
x_bTo the key processing device k by the user._bTo the element x input to
) And the performance from t, u to s on the finite field G
One-way function s = F (t, u) (where F
(F (α, β), γ) = F (F (α, γ), β) holds
The group to be restored on the finite field G
Key g_n= F (g_n-1, X_n), And the key processing device k₁When specified as a predetermined storage device
Obtains the element g on the finite field G stored in
x₁And s = F (t, u), the element g₁= F (g, x
₁), And the key processing device k_TwoTo g₁And the key processing unit k_aWhen specified as_a-1, Element x_a
And s = F (t, u), the element g_a= F (g_a-1, X
_a), And the key processing device k_{a + 1}To g_aSupplying
Computer-readable recording of a program characterized by
Recording media.