JP2001292135A - Key exchange system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a key exchange system which can share password key data by allowing a plurality of communication terminals and a gateway device on a LAN to individually and easily exchange key data, by using an existing communication protocol. SOLUTION: In the key exchange system, having a plurality of communication terminals 101, 102 and 103 connected to the LAN 105 and the gateway device 104 as a DHCP server, which is connected to the LAN and a WAN 106 and which performs concentration/conversion processing, the communication terminals 101, 102 and 103 exchange key data with the gateway device 104, in order to obtain network information at the time of starting DHCP communication.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention comprises a plurality of communication terminals, a LAN connecting the plurality of communication terminals, and a gateway device connecting the LAN to a WAN such as the Internet. Is DHCP
(Dynamic Host Con-figurat
ION Protocol) In a LAN system that requests network information as a client, and a gateway device assigns network information to each communication terminal as a DHCP server and performs centralized management, communication with the WAN is performed while ensuring confidentiality of intra-LAN communication. It relates to a key exchange system.

[0002]

2. Description of the Related Art In recent years, with the explosive spread of the Internet, there have been increasing cases where LANs are constructed not only at companies but also at home. In addition, it is LAN in apartment houses
LANs with different characteristics from those constructed by companies up to now have appeared, for example, by connecting a terminal of each home to the Internet via a LAN. In such a case, only the connectivity to the Internet is emphasized, and it is not necessary to share information that is regarded as important in a normal LAN, and conversely, it is necessary to keep network information confidential in the LAN. Also in existing LANs constructed by companies and the like, there is an increasing demand to secure communication data by encrypting communication data in the LAN separately from shared information.

FIG. 1 is a block diagram showing a general key exchange system for encrypting communication data in a LAN to secure security.

In FIG. 1, reference numerals 101 to 103 denote L to be described later.
A communication terminal (for example, a personal computer) 104 in the AN 105 is interposed between the LAN 105 and a WAN 106 to be described later, and is a gateway device for performing line consolidation / conversion processing. 105 is a LAN in which the communication terminals 101 to 103 and the gateway device 104 are connected. , 106 are WANs such as the Internet. Communication terminals 101 to 103 and gateway device 1
04 output to the LAN 105 is LA
All terminals connected in N105, that is, communication terminal 1
01 to 103 and the gateway device 104 will receive.

FIG. 2 is a block diagram showing the gateway device and the communication terminal shown in FIG. 1 in detail.

In FIG. 2, reference numeral 201 denotes a gateway device for performing line collection and conversion processing interposed between the LAN 210 and the WAN 209. The gateway device 201 serves as an interface for connecting to a network.
10 and a WAN physical connection unit 203 connected to the WAN 209, and the LAN controller 204 and the WAN controller 205 respectively control the connection. The routing function as a gateway is performed by the routing processing unit 206.
To do so, refer to the network information table 208.
You need to register. This network information table 2
08 is constructed inside the storage device 207. 211 is L
A communication terminal 211 connected via the AN 210;
The communication terminal 11 is a LAN physical connection unit 2 connected to the LAN 210 as an interface for connecting to the network.
The connection of the LAN physical connection unit 212 is controlled by a LAN controller 213. The function as the communication terminal is performed by the communication protocol processing unit 214. For that purpose, it is necessary to refer to and register the network information table 216. The network information table 216 is constructed inside the storage device 215.

Next, the DHCP communication model will be described with reference to FIG. Figure 3 shows DHC as a communication terminal
FIG. 4 is a sequence diagram illustrating a communication procedure between a P client 301 and a DHCP server 302. In FIG. 3, 3
01 is a DHCP client, and 302 is a DHCP server. DHCP is a client-server model communication protocol and provides a mechanism for the DHCP server 302 to centrally manage network information such as the IP address of the communication terminal 301 in the network. Generally, the DHCP server 302 on the LAN is used in a form in which network information such as an IP address is provided with an expiration date to communication terminals 301 in the same segment.

In FIG. 3, first, the communication terminal 301
After power-on, a DHCPDISCOVER message is broadcast (broadcast) to all terminals in the LAN to construct an IP address (S1). DHCPDI
D in the network that received the SCOVER message
The DHCP server 302 sends the requested configuration information to the DHCP server.
Notification is made by an OFFER message (S2). If there are multiple DHCP servers on the network, all of them send DHCPOFFER message and DHCP
The P client 301 will receive a plurality of DHCPOFFER messages.

[0009] When the DHCP client 301 receives the DHCPOFFER message and receives messages from a plurality of DHCP servers, it selects the DHCP server 302 in FIG.
An HCP REQUEST message is transmitted to request network information such as an IP address (S3). D for
If the request from the DHCP client 301 is valid and can be fulfilled, the DHCP server 302
A CK message is transmitted to the DHCP client 301, network information including an IP address is added,
The HCP client 301 can perform IP communication (S
4). At this time, the expiration date of the network information is also set. The DHCP client 301 transmits a DHCP REQUEST message as an IP address extension request to the DHCP server 302 within the validity period (at the time when 50% of the validity period has elapsed in the initial setting of DHCP) (S5), and the DHCP server 302 By replying to this (S6), the network information is updated and the expiration date is extended.

Next, an existing security protocol for ensuring security by encrypting communication data will be described. A typical existing security protocol is IPsec (Security for Inte
rnet Protocol) or PGP (Pretty
Good Privacy) and the like, which provide encryption / authentication at the IP layer and later in the packet, are mainly mounted on the gateway device, and are used for establishing a VPN on the WAN. The management of the encryption key includes a manual key management method and an automatic key management method. To realize the automatic key management method, IKE (Internet
A protocol must be implemented separately from the IPsec main body called Key Exchange. Latter PG
P is used only for e-mail encryption. A public key encryption method is used for encrypting / decrypting an electronic mail. In this method, a user registers his / her public key in a key server in advance. The sender of the mail obtains the public key of the other party from the key server, encrypts the contents of the mail using the public key, and transmits the encrypted mail. The recipient of the mail decrypts the encrypted mail using his / her private key.

[0011]

However, in the above-mentioned conventional key exchange system, there is no communication protocol aimed at concealing only communication within the LAN, and encryption / decryption of communication data is performed between two points. It is necessary to share key data to be encrypted, but it is very inefficient to manually set key data between two points, and to automatically share key data, It is necessary to implement a communication protocol to exchange data or purchase a product that supports it.

In this key exchange system, a plurality of communication terminals on the LAN and the gateway device exchange key data separately and easily using the existing communication protocol, thereby sharing encryption key data. Is required.

According to the present invention, in order to satisfy this demand, a plurality of communication terminals on a LAN and a gateway device exchange key data separately and easily using an existing communication protocol, thereby providing an encryption key. An object is to provide a key exchange system that can share data.

[0014]

In order to solve this problem, a key exchange system according to the present invention comprises a plurality of communication terminals connected to a LAN and a DHCP server connected to the LAN and the WAN to perform a line consolidation / conversion process. A key exchange system having a gateway device, wherein the communication terminal is configured to simultaneously exchange key data at the time of DHCP communication performed with the gateway device to acquire network information at the time of startup.

According to this configuration, the plurality of communication terminals on the LAN and the gateway device can easily and separately exchange key data using the existing communication protocol, thereby sharing the encryption key data. A key exchange system that can be obtained is obtained.

[0016]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A key exchange system according to a first aspect of the present invention comprises: a plurality of communication terminals connected to a LAN;
DH connected to AN and WAN to perform line consolidation and conversion processing
A key exchange system having a gateway device as a CP server, wherein a communication terminal performs a communication with the gateway device to acquire network information at startup.
At the time of HCP communication, key data is also exchanged at the same time.

[0017] With this configuration, the key data which can be used when encrypting / decrypting communication data between the two points by the shared key cryptosystem can be easily shared between the gateway device and each communication terminal. It has the effect of being done.

According to a second aspect of the present invention, there is provided the key exchange system according to the first aspect, wherein the communication terminal requests the gateway device to extend the network information by the expiration of the assigned network information. At the time of DHCP communication starting from a request, the shared key data exchanged previously is discarded, and the shared key data is updated by newly exchanging the key data.

According to this configuration, the DHCP session periodically performed inside the LAN and the key data exchange procedure are synchronized, and the periodic update of the encryption key data shared by each communication terminal and the gateway device in the LAN is established. This has the effect of improving the security of the encryption key data.

[0020] The key exchange system according to claim 3 is an LA system.
N, a plurality of communication terminals, a LAN and a WAN
And a gateway device as a DHCP server connected to the gateway and performing a line collection / conversion process, wherein the communication terminal encrypts communication data with encryption key data only for data transmitted to the WAN via the gateway device. The gateway device decrypts the communication data using the encryption key data shared with the communication terminal of the transmission source and transmits the decrypted communication data to the WAN.

This configuration has an effect that only communication within the LAN is encrypted and concealment is realized without impairing the transmission to the WAN.

According to a fourth aspect of the present invention, in the key exchange system according to the third aspect, the gateway device receives a packet from the WAN to the destination communication terminal in the LAN and shares the packet with the destination communication terminal. The communication data is encrypted with the encryption key data and output to the LAN, and the destination communication terminal
The decryption is performed using the encryption key data shared with the gateway device.

This configuration has the effect that only communications within the LAN are encrypted and concealment is realized without impairing the receivability from the WAN.

Hereinafter, an embodiment of the present invention will be described with reference to FIGS.
This will be described with reference to FIG.

(Embodiment 1) The configuration of a key exchange system according to Embodiment 1 of the present invention is the same as that shown in FIGS. 1 and 2, and a description thereof will be omitted. The difference between this embodiment and the conventional technology is that DHCP as a gateway device is used.
This is related to the functions and operations of the server and a communication terminal (DHCP client) such as a personal computer.

The key exchange system having such a configuration will be described with reference to FIGS. 1, 3 to 8. FIG. 4 (a),
FIG. 4B is a data diagram showing details of data provided by the DHCP communication. FIG. 4A shows details of the DHCP data structure, and FIG. 4B shows main network information provided from the DHCP server. Are shown. FIG.
6 is an explanatory diagram of key exchange by the Diffie-Hellman method, FIG. 6 is a flowchart showing an operation of one communication terminal A, FIG. 7 is a flowchart showing an operation of the other communication terminal B, and FIG. 8 is a communication as a DHCP client. FIG. 3 is a sequence diagram showing a communication sequence between a terminal and a gateway device as a DHCP server. In FIG. 8, reference numeral 601 denotes a communication terminal serving as a DHCP client;
Reference numeral 602 denotes a gateway device serving as a DHCP server.

In FIG. 1, the communication terminals 101 to 103 connected to the LAN 105 perform DHCP communication with the gateway device 104 as a DHCP server in order to obtain the network information listed in FIG.
At this time, at the same time, the option field (option part) in the DHCP message of FIG.
The encryption keys are individually shared between the communication terminals 101 to 103 and the gateway device 104 according to the Diffie-Hellman (Diffy-Hellman) key exchange method.

In FIG. 5, A and B are Diffie-H.
In a communication terminal that performs key exchange using the ellman method, first, before starting key exchange, a prime number p and an appropriate integer α satisfying 1 <α <p are determined in advance between communication terminals A and B. There is a need. p and α may be known to a third party other than A and B. Next, the communication terminal A selects an appropriate positive integer Xa and calculates (Equation 1) as shown in FIG. 6 (S11),
The key data Ya is transmitted to B (S12) (mod
Is the expression of the remainder of the division, for example, 17mo
d 7 is the remainder of dividing 17 by 7).

[0029]

(Equation 1)

At this time, Xa must not be known to anyone other than the communication terminal A (Xa is called a secret key). Similarly, the communication terminal B selects an appropriate positive integer Xb, calculates (Equation 2) as shown in FIG. 7 (S21), and transmits the key data Yb to A (S22).

[0031]

(Equation 2)

Like Xa, Xb must not be known to anyone other than the communication terminal B (Xb is called secret key data). Communication terminal A calculates (Equation 3) using Yb received from communication terminal B (S13), and generates shared key data K
ab can be determined.

[0033]

(Equation 3)

The communication terminal B can also obtain the shared key data Kab by calculating (Equation 4) (S23).

[0035]

(Equation 4)

Next, the DHCP communication and the Diffie-He
A key exchange system combining the llman method will be described with reference to FIG.

When the DHCP client 601 starts up,
To obtain network information such as P address,
The HCPDISCOVER message is broadcast in the LAN (S31). DHCPDISCOVER
The DHCP server 602 that has received the message sends a prime p
And an appropriate positive integer α that satisfies 1 <α <p.
Optional part in P data structure (see Fig. 4 (a))
And reply as a DHCPOFFER message (S32). Since p and α are information that may be known to a third party, plain text (normal text data in DHCP communication)
There is no problem if it is put on the communication path as it is.

The DHCP client 601 having received the DHCPOFFER message receives p and α. Even if there are multiple DHCP servers in the LAN,
The DHCP server can be selected depending on whether p and α are stored in the option part of the DHCP data. The communication terminal 601 determines the secret key data Xa, which is an appropriate positive integer, and calculates the key data Ya.

Similarly, the gateway device 502 also determines the secret key data Xb, which is an appropriate positive integer, and calculates the key data Yb. DHCP which decided DHCP server
The client 601 transmits a DHCPREQUEST message (S33), and transmits network information to the DHCP
A request is made to the server 602. At this time, Ya uniquely calculated is stored in the option part of the DHCP data.

The DHCP server 602, which has received the DHCPREQUEST message, stores the network information to be provided to the communication terminal 601 in the DHCPACK message and returns it (S34). At this time, the independently calculated Yb is also stored in the option section of the DHCP data. Here comes the DHCP client 601, DHCP
Both the P server 602 can calculate the shared key data Kab, and the communication terminal 601 and the gateway device 602 can safely exchange and share the key data for encrypting / decrypting the communication data. Become.

As described above, in the present embodiment, the communication terminal 601 exchanges the key data Ya and Yb at the same time during the DHCP communication with the gateway device 602 to acquire the network information at the time of startup. As a result, the gateway device 602 and each communication terminal 601
Separately, a key which can be used when encrypting / decrypting communication data between two points by a shared key encryption method can be easily shared.

(Embodiment 2) The configuration of a key exchange system according to Embodiment 2 of the present invention is the same as that shown in FIGS. 1 and 2, and a description thereof will be omitted. The difference between this embodiment and the conventional technology is that DHCP as a gateway device is used.
This is related to the functions and operations of the communication terminal such as the server and the personal computer.

The key exchange system having such a configuration will be described with reference to FIGS. 1, 4 and 8.

As shown in FIG. 4B, in addition to the IP address and the netmask, the data provided by the DHCP communication includes an expiration date (lending expiration date) of the assigned network information. The client communicates with the DHCP server within the assigned expiration date (in the initial setting, 50% of the expiration date) and reacquires network information. As shown in FIG. 3, network information reacquisition is performed by DHCPDISCOVER and DHCPPOF.
No need to send and receive FER messages, DHCPREQ
It is performed only by transmitting and receiving the UEST and the DHCPACK message (see steps S5 and S6). Regarding the re-acquisition of network information, the previously acquired information such as the IP address is basically kept as much as possible, but the content of the shared key data is updated when the network information is re-acquired. Increase the security of shared key data.

Regarding such update of the shared key data,
FIG. 8 showing a key information update procedure at the time of reacquisition of network information
This will be described with reference to FIG.

As shown in FIG. 8, when the DHCP client 601 triggers the network reacquisition, the previously used secret key data Xa is discarded, and the secret key data Xa which is a positive integer is newly set. The key data Ya is calculated. Then, the DHCP server 602
A REQUEST message is transmitted (S35). At this time, the recalculated key data Ya is stored in the option part of the DHCP data. DH that has received the DHCPREQUEST message from DHCP client 601
The CP server 602 discards the previously used secret key data Xb, resets the secret key data Xb as a new positive integer, and calculates the key data Yb. Then, D for giving network information to the DHCP client 601
An HCCP ACK message is transmitted (S36), but DH
The key data Yb is stored in the option part of the CP data. Here is the DHCP client (communication terminal) 6
01, both the DHCP server (gateway device) 602 can calculate new shared key data Kab, and can update the key for encrypting / decrypting communication data between the communication terminal 601 and the gateway device 602. Become.

As described above, in the present embodiment, the communication terminal 601 has exchanged the previously exchanged data at the time of the DHCP communication starting from the network information extension application request to the gateway device 602 by the expiration of the assigned network information expiration date. By discarding the shared key data and exchanging new key data to update the shared key data,
Synchronize the key exchange procedure with the DHCP session that is periodically performed inside the LAN, establish the periodic update of the encryption key data shared by each communication terminal 601 and the gateway device 602 in the LAN, and secure the encryption key data. Performance can be improved.

(Embodiment 3) The configuration of a key exchange system according to Embodiment 3 of the present invention is the same as that shown in FIGS. 1 and 2, and a description thereof will be omitted. The difference between this embodiment and the conventional technology is that DHCP as a gateway device is used.
This is related to the functions and operations of the communication terminal such as the server and the personal computer.

A key exchange system having such a configuration will be described with reference to FIGS. FIG. 9 is an image diagram of the encrypted communication in the LAN. FIG. 10A is a table diagram showing a management table of network information and key information held by the communication terminal 701, and FIG. 10B is held by the gateway device 704. FIG. 4 is a table diagram showing a management table of network information and key information to be executed.

In FIG. 9, reference numerals 701 to 703 denote L, which will be described later.
A communication terminal in the AN 709, a gateway device 704,
705 is a WAN such as the Internet, 706, 70
7 and 708, the gateway device 704 and the communication terminal 70
1. VPN constructed by sharing the encryption key data (K1, K2, K3, respectively) between the communication terminal 702 and the communication terminal 703, and 709 is a LAN.

In FIG. 9, the communication terminal 701 is connected to the WAN 7
When transmitting a packet to the network 05, the gateway device 704 relays (routes) the packet. Looking at the management table of the network information and the key information held by the communication terminal 701, the communication terminal 701 shares the encryption key data K1 with the gateway device 704.
1 to encrypt the packet and transmit it over the LAN 709. A packet from the communication terminal 701 to the gateway device 704 can be received by all terminals connected to the LAN 709, but two packets of the communication terminal 701 and the gateway device 704 can be received.
Since the data is encrypted with the encryption key data K1 shared only between the points, it can be regarded as flowing on the VPN 706 constructed between the communication terminal 701 and the gateway device 704. The gateway device 704, which has received the encrypted packet, searches the management table of the network information and the key information holding the source MAC address of the packet, and finds that the packet is encrypted by the encryption key data K1. The packet is decrypted with the key data K1, and the packet is transmitted to the WAN 705.

Conversely, from the WAN 705 to the LAN 709
When the gateway device 704 receives a packet addressed to the communication terminal 701 in the network, the gateway device 704 searches the IP address of the destination, the held network information, and the key information management table, and determines that the destination is the communication terminal 701 and the communication terminal 701 It can be seen that the encryption key data K1 is shared by. Therefore, the gateway device 704 encrypts the packet using the encryption key data K1 and transmits the packet to the LAN 709.
Since the destination MAC address is its own, the communication terminal 701 searches the network information and the key information management table holding the MAC address of the transmission source, and shares the encryption key data K1. To decrypt the packet. The communication terminals 702 and 703 can also receive the packet addressed to the communication terminal 701, but cannot correctly decode the packets because the encryption / decryption keys are different, and the VPN 706 constructed between the communication terminal 701 and the gateway device 704. Above can be considered as data flowing. As described above, data concealment can be realized for both the upstream and downstream in the LAN 709.

As described above, in the present embodiment, the communication terminal 701 communicates with the WAN 70 via the gateway 704.
5, the communication data is encrypted with the encryption key data and transmitted to the LAN 709, and the gateway device 704 decrypts the communication data using the encryption key data K1 shared with the communication terminal 701 of the transmission source. WA
N705, the WAN 70
5 can be concealed by encrypting only the communication within the LAN 709 without impairing the transmission to the LAN 5.

The gateway device 704 is connected to the WAN
705, a packet to the destination communication terminal 701 in the LAN 709 is received, the communication data is encrypted with the encryption key data K1 shared with the destination communication terminal 701, and the encrypted communication data is output to the LAN 709. The destination communication terminal 701
By using the key data shared between the LAN 705 and the decryption, it is possible to encrypt only the communication within the LAN 709 without impairing the receivability from the WAN 705 and realize confidentiality.

[0055]

As described above, according to the key exchange system according to the first aspect of the present invention, a plurality of communication terminals connected to a LAN, and a line concentrator connected to a LAN and a WAN.
A key exchange system having a gateway device as a DHCP server for performing a conversion process, wherein a communication terminal simultaneously exchanges key data during DHCP communication with a gateway device to acquire network information at startup. Thus, the gateway device and each communication terminal can easily share key data that can be used when encrypting / decrypting communication data between the two points using the shared key encryption method. The advantageous effect described above can be obtained.

According to the key exchange system of the second aspect, in the key exchange system of the first aspect, the communication terminal transmits the network information to the gateway device before the validity of the assigned network information expires. At the time of DHCP communication starting from an extension request, discarding the previously exchanged shared key data, exchanging new key data and updating the shared key data, exchanges key data with a DHCP session periodically performed inside the LAN. This has the advantageous effect of synchronizing the procedures, establishing regular updates of the encryption key data shared by each communication terminal in the LAN and the gateway device, and improving the security of the encryption key data.

According to the key exchange system of the third aspect, a key exchange having a plurality of communication terminals connected to the LAN and a gateway device as a DHCP server connected to the LAN and the WAN for performing line concentrating / conversion processing. In a system, a communication terminal is connected to a WA through a gateway device.
Only the data to be transmitted to N is encrypted with the encryption key data and transmitted to the LAN, and the gateway device decrypts the communication data using the encryption key data shared with the communication terminal of the transmission source and transmits the data to the WAN. By transmitting, there is an advantageous effect that only communication within the LAN can be encrypted and concealment can be realized without impairing the transmission to the WAN.

According to the key exchange system of the fourth aspect, in the key exchange system of the third aspect, the gateway device receives a packet from the WAN to the destination communication terminal in the LAN and communicates with the destination communication terminal. The communication data is encrypted with the shared encryption key data and output to the LAN, and the destination communication terminal decrypts using the shared encryption key data with the gateway device, thereby impairing the reception from the WAN. An advantageous effect is obtained in that only communication within the LAN can be encrypted and concealment can be realized without the need.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing a general key exchange system.

FIG. 2 is a block diagram showing a gateway device and a communication terminal shown in FIG. 1 in detail;

FIG. 3 is a sequence diagram showing a communication procedure between a DHCP client as a communication terminal and a DHCP server as a gateway device.

4A is a data diagram showing details of data provided by DHCP communication; FIG. 4B is a data diagram showing details of data provided by DHCP communication;

FIG. 5 is an explanatory diagram of key exchange by the Diffie-Hellman method.

FIG. 6 is a flowchart showing the operation of one communication terminal.

FIG. 7 is a flowchart showing the operation of the other communication terminal B;

FIG. 8 shows a communication terminal and DH as a DHCP client.
Sequence diagram showing a communication sequence between the gateway device as a CP server

FIG. 9 is an image diagram of encrypted communication in a LAN.

10A is a table diagram showing a management table of network information and key information held by a communication terminal. FIG. 10B is a table diagram showing a management table of network information and key information held by a gateway device.

[Explanation of symbols]

101, 102, 103, 211, 301, 601, 7
01, 702, 703 Communication terminal (DHCP client) 104, 291, 302, 602, 704 Gateway device (DHCP server) 105, 210, 709 LAN 106, 209, 705 WAN 202, 212 LAN physical connection unit 203 WAN physical connection unit 204, 213 LAN controller 205 WAN controller 206 Routing processing unit 207, 215 Storage device 208, 216 Network information table 214 Communication protocol processing unit 706, 707, 708 VPN

Continued on the front page F term (reference) 5J104 AA16 BA02 EA24 EA28 EA33 NA03 PA07 5K030 GA15 HD03 HD06 JT02 LD19 5K033 AA08 CB08 CC01 DB10 DB18 9A001 BB04 CC03 CC08 DD10 EE03 JJ13 JJ14 JJ25 JJ27 KK56 LL03

Claims (4)

[Claims] A plurality of communication terminals connected to a LAN;
DH connected to AN and WAN to perform line consolidation and conversion processing
A key exchange system having a gateway device as a CP server, wherein the communication terminal exchanges key data at the same time as DHCP communication performed with the gateway device to acquire network information at startup. Characterized key exchange system. 2. The communication terminal according to claim 1, wherein said communication terminal starts with a request for extension of network information to said gateway device before expiration of the assigned network information.
2. The key exchange system according to claim 1, wherein at the time of CP communication, the shared key data exchanged before is discarded, and the shared key data is updated by newly exchanging the key data. A plurality of communication terminals connected to the LAN;
DH connected to AN and WAN to perform line consolidation and conversion processing
A key exchange system having a gateway device as a CP server, wherein the communication terminal is a WAN device via the gateway device.
Only the data to be transmitted to the communication terminal is encrypted with the encryption key data and transmitted to the LAN, and the gateway device decrypts the communication data using the encryption key data shared with the communication terminal of the transmission source, and A key exchange system for transmitting to a key exchange system. 4. The method according to claim 1, wherein the gateway device is configured to connect the WAN to the LA.
N receives a packet to the destination communication terminal in N, encrypts the communication data with encryption key data shared with the destination communication terminal, and outputs it to the LAN, and the destination communication terminal shares the data with the gateway device. The key exchange system according to claim 3, wherein the decryption is performed using the encryption key data.