JP2001237817A - Key deposition method and system and storage medium storing key deposition program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a key deposition method and system by which whether or not a key is deposited can flexibly be controlled depending on a type of the key and to provide a storage medium that stores a key deposition program. SOLUTION: A key used for encryption processing is generated on the basis of a key generation request issued fro a user terminal, a key deposition condition table is referenced consisting of conditions by which whether or not the key is to be deposited can be discriminated depending on the type of the key, whether or not the generated key is deposited to a key store agency is discriminated, and when the type of the key satisfies the conditions in the key deposition condition table, the key is deposited to the key storage agency and the generated key is returned to the user terminal.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a key escrow method and system and a storage medium storing a key escrow program, and more particularly to a method for generating a key used for encryption and storing the key in a key storage organization. The present invention relates to a deposit method and system for performing recovery and a storage medium storing a key deposit program.

[0002]

2. Description of the Related Art Currently, a common key cryptosystem and a public key cryptosystem are often used in cryptosystems. In the common key cryptosystem, the encrypting person and the decrypting person use the same key to perform encryption and decryption. In the public key cryptosystem, a user previously holds a secret key and a public key (the two keys are called a key pair) as their own keys. The public key is widely disclosed, and the private key is kept secret by the user himself and must not be leaked to others. A public key is used for encryption, and a private key is used for decryption. The secret key is used when creating the electronic signature, and the public key included in the public key certificate is used when verifying the signature.

However, if the decryption key is lost or damaged due to carelessness or accident, there is a problem that the encrypted information cannot be decrypted. In a company, an encryption system is used to securely store confidential information such as transaction information, but the loss of a decryption key makes recovery of confidential information impossible, which seriously impairs corporate activities.

[0004] For this reason, several key recovery methods have been proposed as methods that enable key recovery. For example,
One of these is a deposit-type scheme in which the key itself proposed as “Nortel entrust” is deposited with a key recovery authority.

[0005]

However, in the conventional key escrow system, only the key pair used for encryption is to be deposited, and the signature key is not to be deposited. We believe that by depositing the signature key used for the electronic signature, it is possible for anyone other than the user to hold a copy of the signature key, and that the original purpose of the electronic signature will not be non-repudiation. Because it is.

For this reason, if the signature key is lost or damaged, the signature key must be regenerated and the public key signature reissue procedure must be performed. Operation is large. In particular, a serious signature key used as a representative seal of a company poses a greater problem.

Therefore, many users consider that the signature key should be restored only when there is no risk of leakage when the signature key is lost or damaged due to carelessness, accident, etc. It is necessary, but it is difficult to cope with the conventional method.

In the case of a key escrow system in which a key is deposited in a key storage organization at the same time as the key is generated, the time required to generate the key is increased by the operation of depositing the key. However, in practice, it is often not necessary to keep all keys, such as keys used temporarily, for key recovery. Therefore, depending on the type of key (key length, encryption algorithm, key usage, etc.)
It is necessary to flexibly decide whether to keep the key.

The present invention has been made in view of the above points, and has a key depositing method and system capable of realizing a key depositing method capable of flexibly controlling the presence or absence of a key deposit according to a type of a key, and a key depositing method. It is an object to provide a storage medium storing a program.

[0010]

FIG. 1 is a diagram for explaining the principle of the present invention.

According to the present invention (claim 1), in a key escrow method in which a key generation organization generates a key used for encryption processing and stores the key in a key storage organization, a key generation request issued from a user terminal is transmitted. It obtains (step 1), generates a key to be used for encryption processing (step 2), and refers to a key escrow condition table including conditions for determining whether to escrow the key according to the type of key (step 3). It is determined whether or not the key is deposited in the key depository (step 4). If the type of the key satisfies the condition of the key depositing condition table, the key is deposited in the key depository (step 5) and the key is generated. The returned key is returned to the user terminal (step 6).

According to a second aspect of the present invention, there is provided a key escrow method for generating a key used for encryption processing on a user terminal and storing the key in a key storage organization, based on a key generation request issued by the user. It generates a key to be used for cryptographic processing and refers to a key escrow condition table, which is a condition for determining whether to escrow the key according to the type of key, and determines whether the generated key is to be escrowed at a key storage organization. If the key type satisfies the conditions in the key escrow condition table, the key is escrowed to a key storage institution,
Return the generated key to the user.

FIG. 2 is a diagram showing the principle of the present invention.

According to a third aspect of the present invention, there is provided a key escrow system having a key generation unit of a key generation organization that generates a key used for encryption processing and stores the key in a key storage organization. Key generation means for generating a key to be used for cryptographic processing based on a key generation condition table 240 including conditions for determining whether to deposit a key according to the type of key and a key generation request issued from the user terminal 100 210 and the key deposit condition table 240, it is determined whether the generated key is to be deposited at the key storage institution 300. If the type of the key satisfies the condition of the key deposit condition table 240, the key is Key depositing means 220 for depositing with the key storage organization, key generating means 21
And a key return means 230 for returning the key generated at 0 to the user terminal 100.

[0015] The present invention (claim 4) is a key escrow system having a user terminal for generating a key to be used for encryption processing and storing the key in a key storage institution. The key escrow condition table including conditions for determination, a key generation unit that generates a key used for encryption processing based on a key generation request issued by a user, and a key escrow condition table. It is determined whether or not the key is to be deposited at a key storage institution. If the type of the key satisfies the conditions in the key storage condition table, the key is deposited at the key storage facility and the key is generated by a key generation means. Key return means for returning the key to the user.

According to a fifth aspect of the present invention, there is provided a storage medium storing a key escrow program installed in a key generation device of a key generation organization that generates a key used for encryption processing and stores the key in a key storage organization. A key generation process for generating a key used for encryption processing based on a key generation request issued from a user terminal, and a key escrow condition table including conditions for determining whether to escrow a key according to the type of key. And determining whether the generated key is to be deposited in a key depository. If the type of the key satisfies the conditions in the key depositing condition table, a key depositing process for depositing the key in the key depository is performed. And a key return process for returning the key generated in the key generation process to the user terminal.

According to a sixth aspect of the present invention, there is provided a storage medium storing a key escrow program installed in a user terminal for generating a key used for encryption processing and storing the key in a key storage organization.
Referring to a key generation process for generating a key used for encryption processing based on a key generation request issued from a user, and a key escrow condition table including conditions for determining whether to escrow a key according to a key type. Determining whether the generated key is to be deposited at a key depository, and if the type of the key satisfies the conditions of the key depositary condition table, a key depositing process for depositing the key with the key depository; And a key return process for returning the key generated in the generation process to the user.

As described above, according to the present invention, a key depositing condition table indicating whether a key is to be deposited at a key storage institution according to the type of a key is stored in a key generating institution or a user terminal. The type of key means the purpose of use of the key, encryption algorithm,
The key length, the label assigned to the key, the validity period, and the like are all attribute information related to the key, and any of them can be used for the key deposit condition.

When a key is generated, a process of generating the key, a process of depositing the key with a key storage institution, and a process of delivering the generated key to a user are performed. Judge whether the type of the key satisfies the key escrow condition in the key escrow condition table.
Deposit the key with the key depository. As described above, the key deposit condition table indicating whether the key is to be deposited according to the type of the key is provided, and it is determined whether the deposit condition is satisfied based on the target key type and the key deposit condition table when the key is deposited. ,
It becomes possible to flexibly control whether to deposit a key depending on the type of the key.

[0020]

Embodiments of the present invention will be described below with reference to the drawings.

[First Embodiment] In this embodiment, an example will be described in which key generation processing and key escrow processing are performed by a key generation organization.

FIG. 3 shows the configuration of the key escrow system of the first embodiment of the present invention.

The system shown in FIG.
0, a key generation apparatus 200 at the key generation organization, and a key storage organization 300.

The user terminal 100 issues a key generation request to the key generation device 200 and obtains the key generated by the key generation device 200. The key generation request may include a key use purpose and the like in addition to the minimum information required for key generation such as an encryption algorithm and a key length. The key generation device 200 includes a key generation unit 210, a key deposit unit 220, a key return unit 230, and a value deposit condition table 240.

The key generation unit 210 receives a key generation request from the user terminal 100 and uses the key included in the request, an encryption algorithm, a key length, a label assigned to the key,
Generate a key based on the validity period.

The key escrow unit 220 uses the key information generated by the key generation unit 210 to refer to the key escrow condition table 240 to determine whether it is necessary to deposit the generated key to the key storage institution 300. Is determined.

The key return unit 230 returns the generated key to the user terminal 100.

The key deposit condition table 240 includes a conditional expression number and a deposit condition, and is referred to by the key deposit unit 220.

Next, a description will be given of a process in the key depositing section 220 for determining whether or not to deposit a key with the key storage institution 300.

FIG. 4 is a flowchart of the key escrow determination process according to the first embodiment of the present invention.

Step 101) The key escrow unit 220 determines whether there is an unevaluated escrow condition for the key generated by the key generation unit 210, and terminates the process if it is not. Step 102) The key escrow unit 220 refers to the key escrow condition table 240 to determine whether the generated key satisfies the escrow condition. If so, the process proceeds to step 103. If not, the process proceeds to step 101.

Step 103) Store the key in the key storage institution 300
Send to As a result, the key storage organization 300 stores the key in the key storage unit 310.

FIG. 5 shows an example of a key escrow condition table according to the first embodiment of this invention. The key escrow condition table 240 shown in the figure is composed of a conditional expression number and a deposit inequality. The key escrow unit 220 refers to the key escrow condition table 240 and determines whether the generated key satisfies the escrow condition in order from the escrow condition number 1. If any one of the conditions is satisfied, it is deposited with the key storage organization 300. Also,
If none of the conditional expressions is satisfied, the key depositing unit 220 ends the processing without depositing the key. Finally,
The generated key is returned from the key return unit 230 to the user terminal 100.

[Second Embodiment] In the above-described first embodiment, an example has been described in which a key is generated and deposited at a key generation organization. However, in this embodiment, a key is generated at a user terminal.
An example of deposit will be described. FIG. 6 shows the configuration of a key escrow system according to the second embodiment of the present invention.

The configuration shown in the figure is the same as that of the key generation device 200 of the key generation organization in the first embodiment, and the key return unit 130 uses the key generated by the key generation unit 110. Except for returning to the user, the same operation as in the first embodiment is performed, and the description is omitted.

In the above embodiment, the operations of the key generation unit, the key escrow unit, and the key return unit are constructed as a program, and the operations of the key escrow unit and the user terminal are implemented. Disk device connected to the computer used, floppy (registered trademark) disk, CD-R
The present invention can be easily realized by storing it in a portable storage medium such as OM and installing it when implementing the present invention.

It should be noted that the present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

[0038]

As described above, according to the present invention, there is provided a key escrow condition table indicating whether a key is to be escrowed according to the type of key. By judging whether or not the deposit conditions are satisfied by the table, it is possible to flexibly control whether or not to deposit the key according to the type of the key. It is possible to flexibly control the presence / absence of a deposit depending on the type (encryption algorithm, key length, key usage, etc.).

[Brief description of the drawings]

FIG. 1 is a diagram for explaining the principle of the present invention.

FIG. 2 is a principle configuration diagram of the present invention.

FIG. 3 is a configuration diagram of a key escrow system of the first embodiment of the present invention.

FIG. 4 is a flowchart of a key escrow judgment process according to the first embodiment of the present invention.

FIG. 5 is an example of a key escrow condition table according to the first embodiment of this invention.

FIG. 6 is a configuration diagram of a key escrow system according to a second embodiment of the present invention.

[Explanation of symbols]

 REFERENCE SIGNS LIST 100 user terminal 110 key generation unit 120 key escrow unit 130 key return unit 140 key escrow condition table 200 key generation device 210 key generation unit, key generation unit 220 key escrow unit, key escrow unit 230 key return unit, key return unit 240 Key deposit condition table 300 Key storage organization 310 Key storage unit

 ────────────────────────────────────────────────── ─── Continued on the front page (72) Inventor Hiroki Ueda 2-3-1 Otemachi, Chiyoda-ku, Tokyo Nippon Telegraph and Telephone Corporation F-term (reference) 5J104 AA16 EA04 EA12 MA06 NA02 NA32

Claims (6)

[Claims] 1. A key depositing method for a key generation organization to generate a key to be used for encryption processing and to store the key in a key storage organization, wherein the key generation organization uses the key generation request issued from a user terminal for encryption processing. Generate a key, refer to a key escrow condition table comprising conditions for determining whether to escrow the key according to the type of key, determine whether the generated key is to be escrowed at a key storage institution, When the type satisfies the condition of the key escrow condition table, the key is escrowed to the key storage organization and the generated key is returned to the user terminal. 2. A key escrow method for generating a key to be used for encryption processing on a user terminal and storing the key in a key storage institution, the key being used for encryption processing based on a key generation request issued by a user. A key deposit condition table comprising conditions for determining whether to deposit a key according to the type of key, and determining whether to deposit the generated key to a key storage institution; A key depositing method, wherein when the condition of the key depositing condition table is satisfied, the key is deposited with the key storage agency, and the generated key is returned to a user. 3. A key escrow system having a key generation device of a key generation institution that generates a key used for encryption processing and stores the key in a key storage institution, wherein the key generation device deposits the key according to the type of the key. A key escrow condition table including conditions for determining whether or not to perform key generation, a key generation means for generating a key used for encryption processing based on a key generation request issued from a user terminal, and the key escrow condition table. And determining whether the generated key is to be deposited at the key storage facility. If the type of the key satisfies the conditions of the key storage condition table, the key deposit is performed to deposit the key at the key storage facility. And a key return means for returning the key generated by the key generation means to the user terminal. 4. A key escrow system having a user terminal for generating a key to be used for cryptographic processing and storing the key in a key storage organization, comprising a condition for determining whether to deposit a key according to a type of a key. A key escrow condition table; key generation means for generating a key to be used for encryption processing based on a key generation request issued by a user; and a key storage unit for storing the generated key with reference to the key escrow condition table. It is determined whether the key is to be deposited at the institution, and if the type of the key satisfies the condition of the key depositing condition table, the key is deposited at the key storage facility, and the key is generated by the key generating means. A key return means for returning the key to the user. 5. A storage medium storing a key escrow program installed in a key generation device of a key generation institution for generating a key used for encryption processing and storing the key in a key storage institution, and issued from a user terminal. A key generation process for generating a key used for encryption processing based on a key generation request to be performed, and a key escrow condition table including conditions for determining whether to escrow the key according to the type of key. Determining whether the key is to be deposited at the key depository, and if the type of the key satisfies the conditions of the key depositing condition table, depositing the key with the key depository; A key return process for returning the key generated in the process to the user terminal. 6. A storage medium storing a key escrow program mounted on a user terminal for generating a key used for encryption processing and storing the key in a key storage institution, wherein the key generation request issued by the user is stored in a storage medium. A key generation process for generating a key to be used for encryption processing, and a key escrow condition table comprising conditions for determining whether to escrow the key according to the type of the key, and storing the generated key in the key storage A key depositing process for depositing the key with the key storage institution if the type of the key satisfies the conditions of the key depositing condition table; A key return process for returning the key to the user. A storage medium storing a key escrow program.