JP2001078259A - Encryption key confirmation system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To quickly confirm an encryption key distributed from a base station to a terminal in an encryption key confirmation system where the base station can make a simultaneous notice to terminals. SOLUTION: A base station 2 in this encryption key confirmation system designates a number (1) of an auxiliary group of terminals 1a-1c to send a confirmation request signal. The terminals 1a-1c belonging to the auxiliary group (1) encrypts a communication encryption key delivered in a preset timing so as to differentiate a delay time from each terminal and transmits the encrypted key to the base station 2. The base station 2 identifies the terminals 1a-1c according to the time sequence of received information. The base station 2 makes similar arithmetic operation and compares the result with the information sent from the terminals 1a-1c. When not matched, the base station transmits the communication encryption key again because the base station 2 regards that the communication encryption key of the terminal is incorrect. The processing above is repeated and the base station collates and confirms all the auxiliary groups.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption key confirmation device, and more particularly, to an encryption communication device capable of simultaneously transmitting a message to a plurality of terminals, when a group encryption key is changed to improve security, the changed encryption key is used. The present invention relates to an apparatus for speeding up the confirmation of distribution of a document.

[0002]

2. Description of the Related Art In wireless communication, simultaneous notification to a plurality of terminals has been performed for a long time. Attempts have also been made to encrypt broadcast or group communications. Recently, to improve the security of group communication, it has been considered to transmit a new encryption key from a base station to a terminal wirelessly and change the encryption key. However, in wireless communication, if the communication quality is not so good,
If the terminal is outside the communication zone, the transmitted encryption key may not reach the terminal. Finding out of reach and retransmitting, that is, error retransmission, is a common technique in data communication. In the following, a conventional method for checking and checking is described.

FIG. 4 shows an example of a conventional wireless communication system. 1 is a terminal and 2 is a base station. The base station 2 can communicate with the terminals 1a, 1b, 1c, and 1x. The terminals 1a, 1b, and 1c form one group and can receive the encrypted broadcast message of the base station 2 at the same time. That is, the terminals 1a, 1b and 1c have the same encryption key Kb. There is also a terminal 1x that does not belong to the group. When the current encryption key Kb1 that has been used conventionally is about to be decrypted, the base station 2 secretly distributes the new encryption key Kb2 to each of the terminals 1a, 1b and 1c, and replaces the encryption key Kb1 with the encryption key. K
Change to b2.

[0004] Next, the base station 2 confirms whether the encryption key has been securely distributed. A simple confirmation method will be described with reference to FIG.
The base station 2 transmits the terminal 1a at the timing shown in FIG.
A confirmation request signal including the terminal number to the terminal. Upon receiving the signal, the terminal 1a encrypts the encryption key Kb stored in the terminal at the timing shown in FIG.
Send to The base station 2 receiving this decrypts the information (encrypted) of the terminal 1a and checks whether it is a predetermined encryption key Kb (Kb2 in this case). This process is sequentially repeated for the terminals 1b and 1c to check whether the new encryption key Kb has reached all the terminals 1.

[0005]

However, in the conventional method, when the number of terminals is large, the number of bits of the terminal number increases, the overhead of communication control returned from the terminal increases, and the number of bits increases. × The number of terminals 通信 the communication time determined by the information transfer rate becomes longer, and there is a problem that it takes a longer time to check and verify.

[0006] The present invention solves the above-mentioned conventional problem and, when the number of terminals is large, a delivery confirmation time for confirming whether or not the encryption key distributed from the base station to the terminals has reached the terminals reliably. The purpose is to shorten the.

[0007]

According to the present invention, there is provided an encryption key for collating and confirming an encryption key delivered by a broadcast communication system comprising a base station and a plurality of terminals. A storage device for storing the identification number of the auxiliary group to which the terminal belongs in the confirmation device and the response delay timing; and a means for comparing the identification number stored in the storage device with the identification number of the received auxiliary group. Means for returning its own encryption key to the base station at a response delay timing according to the result. With this configuration, the overhead of communication control can be reduced, and the time required for confirmation can be reduced.

[0008]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS.

(Embodiment) In the embodiment of the present invention, when the identification number of the auxiliary group to which the terminal belongs and the received identification number match, the encryption key is returned to the base station at the terminal-specific delay timing. And an encryption key checking device for checking the delivered encryption key.

FIG. 1 is a diagram of a communication system using an encryption key confirmation device according to an embodiment of the present invention. In this embodiment, the terminals belonging to the communication group belong to a group called an auxiliary group. The auxiliary group is a group for collation confirmation, and is a group that is invisible to the user (not conscious of the user). In FIG. 1, the terminal 1
a, 1b, 1c belong to the auxiliary group (1), and the terminals 1d,
1e belongs to the auxiliary group (2). The size of the auxiliary group may be determined by judging the practicality of the system such as the required control accuracy. For example, when the communication group is composed of 10,000 terminals, one auxiliary group It is conceivable to assign 100 terminals to provide a total of 100 auxiliary groups. If the problem of efficiency is ignored, there is no operational problem even if terminals belonging to two communication groups belong to one auxiliary group. The auxiliary group is assigned an auxiliary group number or an identification code, and the terminal stores the terminal number or delay timing in the auxiliary group.

FIG. 2 is a functional block diagram of the encryption key confirmation device according to the embodiment of the present invention. In FIG. 2, a terminal 1 includes an antenna 11, a radio circuit 12, an encryption / decryption unit.
13, memory 14, sequence control unit 15, sequence memory 16, input / output 1
8. It is composed of functional units (electronic circuits) such as the control unit 19. The base station 2 includes an antenna 21, a radio circuit 22, an encryption / decryption unit 23, a memory 24, an order detection unit 25, an order memory
26, a functional unit (electronic circuit) such as a collation / retransmission unit 27, an input / output 28, a control unit 29, and a key generator 31.

The antennas 11 and 21 transmit radio waves into the air or receive radio waves in space. The space between the antenna 21 of the base station 2 and the antenna 11 of the terminal 1 is a radio wave propagation path and an information transmission path. The radio circuit 12 and the radio circuit 22 convert (modulate) a digital signal into an analog signal, convert the signal into a high-frequency signal, send the signal to an antenna, or convert (demodulate) a high-frequency signal received by the antenna into a digital signal. This is a transmission / reception circuit of a so-called ordinary digital radio.

The encryption / decryption unit 13 and the encryption / decryption unit 23
It encrypts plaintext application information and encryption keys transmitted using an encryption key, and decrypts encrypted application information and encryption keys received using an encryption key into plaintext. Constitute. In the present embodiment, the encryption method used in the encryption / decryption units 13 and 23 is described assuming a common key encryption method (also called a secret key encryption method). Can be applied.

The memories 14 and 24 are storage elements for storing encryption keys, and can store a plurality of encryption keys. In the memory 14 of the terminal, a first encryption key Ka (i) (i is a terminal number) that is different for each terminal and a second encryption key Kb (where the terminal is different) for each communication group are stored. When belonging to a plurality of communication groups, a plurality of second encryption keys are provided as many as the number of groups). In the memory 24 of the base station 2, a first encryption key Ka (i) different for each terminal is stored for the number of terminals, and a second encryption key Kb different for each communication group is stored for the number of communication groups. . First encryption key Ka (i)
Can be called a basic encryption key, which is an encryption key unique to a terminal, is an encryption key different for all terminals, and is an encryption key mainly used for key distribution. Second encryption key Kb
Can be called a communication encryption key, which is an encryption key used for transmitting application information. A terminal belonging to a communication group has a second encryption key Kb unique to the communication group and a terminal not belonging to the communication group. Does not have the second encryption key Kb unique to that communication group.

When the received information of the base station 2 is the collation return command information designating the number of the auxiliary group to which the terminal 1 belongs, the order control unit 15 of the terminal 1 determines a predetermined transmission timing different for each terminal. By measuring, that is, by measuring the delay time from reception of the collation return command information to return, the collation return information is transmitted to the base station 2. The verification return information is obtained by converting the second encryption key Kb stored in the memory 14 into the first encryption key Ka (i).
Is encrypted. In general, a method of measuring the delay time is to generate a pulse with a transmitter having good frequency stability and count the pulse with a counter.

The sequence memory 16 of the terminal 1 stores the terminal 1
And the value of the transmission timing to which the subgroup belongs. The stored contents are used by the order control unit 15. The value of the transmission timing may be the delay time from reception to transmission or the order of the transmitting terminal. In the case of a turn, the value of the turn can be converted into a time value by calculating the delay time by multiplying the required time per terminal by the number of turns. The contents stored in the order memory 16 can be stored by default, or can be changed wirelessly from the base station during use at the site. Considering that the communication group is changed wirelessly, a more flexible system is one in which the contents stored in the order memory 16 can also be changed wirelessly.

The order detection unit 25 of the base station 2 transmits collation return command information to the terminal 1 when collation confirmation is required, and measures a time delay of collation return information arriving from the terminal after transmission. By detecting which terminal information it is,
The number of the terminal 1 (or the code of the terminal 1) is passed to the collation / retransmission unit 27. Note that information may not be returned from some terminals 1 due to reasons such as being outside the communication zone. In such a case, the collation / retransmission unit 27 receives only the terminal number without receiving the reception information of the terminal.

The order memory 26 of the base station 2 stores information on the relationship between the time delay and the terminal number for each auxiliary group for the number of terminals 1. The stored content is used by the order detection unit 25. The value of the time delay may be the delay time or the order of the transmitting terminal, similarly to the contents stored in the order memory of the terminal 1.

The verification retransmission unit 27 is configured to encrypt the second encryption key Kb of the communication group with the first encryption key Ka (i) of the terminal to be verified and to receive the verification return information of the terminal 1 (The second encryption key Kb sent from the terminal 1 is encrypted with the first encryption key) and is checked for match / mismatch. If the match is found, an OK signal is output. Sends an NG signal and requests redistribution of the encryption key.

Input / output 18 and input / output 28 are input / output of application information to be transmitted / received, and include character information, voice information,
Application information to be transmitted, such as image information, is input, and the received application information is output. All application information such as character information, voice information, and image information is digitized information.

The control unit 19 and the control unit 29 are respectively the terminal 1
And the entire control of the base station 2. Key generator 31
Generates an encryption key used for encrypted communication.
Normally, a random number is generated, and a numerical value that can be used as an encryption key is generated from the generated random number by selection / conversion or the like, and is used as an encryption key.

The operation of the encryption key checking device according to the embodiment of the present invention configured as described above will be described. The first memory 14 of the terminal 1 and the first memory 24 of the base station 2 are stored in advance.
The encryption key Ka (i) is stored in secret. The method of storing is outside the scope of the present invention. When changing the encryption key for group communication, that is, the second encryption key from Kb1 to Kb2, the base station 2 generates a new encryption key by the key generator 31 and stores it in the memory 24 of the base station 2. Then, for each terminal, Kb2 is encrypted with the first encryption key Ka (i) of the terminal and transmitted to the terminal 1 by radio. The received terminal 1 is the first terminal that the terminal has.
And decrypted with the encryption key Ka (i). At this time, encryption and decryption are performed by the encryption / decryption unit 13,
23.

When transmitting the application information after the change of the second encryption key, the base station 2 converts the application information input from the input / output 28 into a new second encryption key Kb2.
And transmit it wirelessly. The received terminal 1
The second encryption key Kb2 is extracted from the memory 14 and decrypted. Since the wireless transmission is used, the radio waves can be received by all the terminals 1 existing in the communication zone. However, even if the terminal 1 receives the radio waves, only the terminal 1 having the second encryption key Kb2 normally transmits the application information. Can be decrypted. Neither the method for distributing the second encryption key nor the method for encrypting and transmitting the application information are outside the scope of the present invention.

Next, a method of confirming the second encryption key Kb of the terminal 1 will be described. The terminal 1 belonging to the auxiliary group requested to return for collation retrieves the second encryption key Kb from its memory 14 at the timing described later, and the encryption / decryption unit 13 uses the first encryption key Kb. Encrypt with Ka (i). The encrypted information (the collation return information) is transmitted to the radio circuit 12 of the terminal 1, the antenna 11, and the antenna 2 of the base station 2.
1. The signal is sent to the matching retransmission section 27 of the base station 2 via the radio circuit 22. On the other hand, the base station 2 extracts the second encryption key Kb from the memory 24, and the encryption / decryption unit 23 outputs the second encryption key Kb.
Is encrypted with the first encryption key Ka (i) possessed by the user and passed to the verification / retransmission unit 27. The collation / retransmission unit 27 compares the information transmitted from the terminal 1 with the information received from the encryption / decryption unit 23 of the base station 2, and when the information does not match, the second information held by the base station 2. Assuming that the encryption key and the second encryption key Kb of the terminal 1 do not match, that is, assuming that the second encryption key Kb of the terminal 1 is incorrect, a process such as retransmission is performed.

The mismatch includes a case where there is no response from the terminal (such as when the terminal is out of the communication zone) and a case where the information of the terminal arrives but does not match the information held by the base station. Although there are various treatment methods, for example, after a series of collation is completed, the second encryption key is retransmitted to the terminal 1. If they match, it is normal.
You do not need to take any action.

The base station 2 checks the information sequentially transmitted from the terminal 1 in this manner, and after checking one auxiliary group, sends a return request for collation to another auxiliary group. send. By repeating the above, the collation check is performed for all the auxiliary groups to which all the necessary terminals belong.

The timing will be described with reference to FIG. The base station 2 specifies the number of the auxiliary group (1) and sends a confirmation request signal at the timing as shown in FIG.
The terminals 1a, 1b, 1c belonging to the auxiliary group (1)
The base station 2 receives the confirmation request signal and encrypts the encryption key Kb stored in the terminal at the timing of each terminal.
Send to Specifically, the terminal 1a that has received the confirmation request signal at the timing as shown in FIG. 3 encrypts the encryption key Kb stored in the terminal at the timing as shown in FIG. Send to Similarly, the terminal 1b that has received the confirmation request signal at the timing as shown in FIG. 3 is the terminal 1c that has received the confirmation request signal at the timing as shown in FIG. At such a timing, the encryption key Kb stored in the terminal is encrypted and sent to the base station 2. The delay time is set in advance so as to be different for each terminal.

The base station 2 which has received the information detects the information of the terminals 1a, 1b and 1c according to the time sequence of the received information, and checks whether the terminal has a predetermined encryption key Kb. I do. The base station 2 checks whether the information sequentially transmitted from the terminal 1 matches the information to be encrypted by itself for each auxiliary group, and checks all the necessary terminals.

The number of terminals belonging to the auxiliary group will be described. Even if the number of terminals belonging to one auxiliary group increases, the number of transmissions of the check request information of the base station does not increase.
Therefore, if more terminals are assigned to one auxiliary group, the overall transmission time can be shortened. However, as for the ratio, the improvement rate decreases. For example, if the number of terminals belonging to the auxiliary group is from 100 to 101
Even if the number increases, only 1/100 (1%) will be improved to 1/101 (0.99%). On the other hand, as the number of terminals increases, timing accuracy is required. However, modern radios have a built-in high-precision crystal oscillator because radio frequency accuracy is required, so if there are about 100 terminals belonging to the auxiliary group, there is no control accuracy. No problem. The number of terminals belonging to the auxiliary group may be different for each auxiliary group. When the base station finishes collating all terminals in one supplementary group, it may move to collation of the next supplementary group.

If the encryption key returned by the terminal to the base station is compressed data as proposed in Japanese Patent Application No. 11-247056, the communication time can be further reduced, and the verification can be performed in a shorter time. Become. In particular, since the communication time per terminal is shortened, more terminals can belong to one auxiliary group even if the accuracy of the crystal oscillator is the same. Therefore, by using the compression means together, the verification of the encryption keys of many terminals can be performed in a very short time.

Also, when a terminal cannot respond or when the radio wave environment is poor, a response from the next terminal is received without waiting for a response. , Can be checked quickly. Only terminals that can respond can be checked first, and for terminals that do not respond, after completing the process, a response is requested again, so there is no need to wait for terminals that can respond, and overall efficiency Is improved. That is, a terminal that cannot communicate with a new encryption key is identified in a short time, and group communication is performed only with a terminal that can communicate, or an encryption key is retransmitted to an unconfirmed terminal. By taking measures, efficient communication can be realized.

As described above, in the embodiment of the present invention,
When the identification number of the auxiliary group to which the terminal belongs matches the received identification number, the encryption key confirmation device returns the encryption key to the base station at a terminal-specific delay timing, and checks the delivered encryption key for verification. With this configuration, when the number of terminals is large, the delivery confirmation time for confirming whether the encryption key has reached the terminals reliably can be reduced.

[0033]

As is apparent from the above description, according to the present invention, a terminal in an encryption key confirmation apparatus for collating and confirming an encryption key delivered in a broadcast communication system including a base station and a plurality of terminals. Storage means for holding the identification number of the auxiliary group to which the self belongs and the response delay timing; means for comparing the identification number held in the storage means with the identification number of the received auxiliary group; Since means for returning its own encryption key to the base station at the response delay timing is provided, the base station only needs to issue a confirmation request once for each auxiliary group, and the number of confirmation requests is greatly reduced. can get.

Further, by providing the supplementary group in the group, the number of supplementary groups is significantly smaller than the number of terminals in the group, and the number of bits of the supplementary group number is smaller than the number of bits of the terminal number. Therefore, the effect of reducing the amount of information transmission from the base station can be obtained.

Further, since means for rewriting the storage content of the storage means of the terminal in accordance with the instruction from the base station is provided, the auxiliary group and the delay time can be changed from the base station, and the number of terminals belonging to the auxiliary group can be reduced. Since the setting can be made freely for each auxiliary group, the effect of increasing the degree of freedom in system construction can be obtained.

[Brief description of the drawings]

FIG. 1 is a diagram of a communication system using an encryption key confirmation device according to an embodiment of the present invention;

FIG. 2 is a functional block diagram of an encryption key confirmation device according to the embodiment of the present invention;

FIG. 3 is a timing chart of the encryption key confirmation device according to the embodiment of the present invention;

FIG. 4 is a diagram of a conventional communication system;

FIG. 5 is a timing chart of a conventional encryption key confirmation.

[Explanation of symbols]

 1 terminal 2 base station 11 antenna 12 radio circuit 13 decoding unit 14 memory 15 order control unit 16 order memory 18 input / output 19 control unit 21 antenna 22 radio unit circuit 23 decoding unit 24 memory 25 order detection unit 26 order memory 27 collation Retransmission unit 28 Input / output 29 Control unit 31 Key generator

Continued on the front page (51) Int.Cl. ⁷ Identification code FI Theme coat II (reference) H04L 9/00 601E F term (reference) 5J104 AA07 AA16 AA34 EA06 EA18 JA03 KA02 NA02 PA01 5K067 AA11 AA30 CC13 DD17 DD27 EE02 EE10 HH23 HH28 HH36

Claims (3)

[Claims] A cryptographic key verification device for verifying and verifying a cryptographic key delivered by a broadcast communication system comprising a base station and a plurality of terminals, wherein the terminal is provided with an identification number of an auxiliary group to which the terminal belongs. Storage means for storing the identification number held in the storage means and the identification number of the received auxiliary group, and storing the encryption key at the response delay timing according to the comparison result. Means for returning to the base station. 2. The encryption key verification device according to claim 1, wherein said terminal has means for rewriting the storage contents of said storage means in accordance with an instruction from said base station. 3. The encryption key verification device according to claim 1, wherein said terminal has means for compressing and returning the encryption key.