JP2002353954A

JP2002353954A - System and method of communication

Info

Publication number: JP2002353954A
Application number: JP2001157729A
Authority: JP
Inventors: Hidehiro Masuda; 秀博増田; Tetsuyoshi Nire; 哲身仁禮; Shinichiro Nishikawa; 新一朗西川; Hidetoshi Yamada; 英俊山田
Original assignee: Nippon Shinpan Co Ltd
Current assignee: Nippon Shinpan Co Ltd
Priority date: 2001-05-25
Filing date: 2001-05-25
Publication date: 2002-12-06
Anticipated expiration: 2021-05-25
Also published as: JP4034946B2

Abstract

PROBLEM TO BE SOLVED: To provide a communication system, with which the risks of the masquerading by a third person by illegal wire-tapping of communication can be avoided, while using the cipher communication of short key length for reducing initial introduction or operating load. SOLUTION: This communication system has a means for preparing cryptographic key identification information related to a cryptographic key, a means of enciphering the public key of the present system with the public key of the system of a communicating party and a means for transmitting the cryptographic key identification information related to the enciphered public key of the present system and the public key of the present system enciphered by the enciphering means to the system of the communicating party.

Description

DETAILED DESCRIPTION OF THE INVENTION

【０００１】[0001]

【発明の属する技術分野】本発明は、通信システムおよ
び通信方法の技術分野に属する。The present invention belongs to the technical field of communication systems and communication methods.

【０００２】[0002]

【従来の技術】インターネットやモバイルの普及によ
り、そこで行われる様々な通信において、その不正傍受
や、不正傍受された情報から起こる成りすましに対す
る、不正通信防止システムが要望されている。従来、イ
ンターネットやモバイルでの不正通信防止には、あらか
じめ通信相手と暗号化および復号化で共通に用いる鍵を
交換しておき、送信者はその共通鍵で暗号化してデータ
を送信し、受信者側は同じ共通鍵で送信されたデータを
復号化する共通鍵暗号化方式、または秘密鍵公開鍵を用
いて受信者側があらかじめ自己の秘密鍵と対になる公開
鍵を認証局などに登録するか通信相手に渡しておき、送
信者側はそれにより取得した公開鍵で送信データを暗号
化し送信し、受信者は自己の秘密鍵で受信したデータを
復号するといったＲＳＡに代表される公開鍵暗号化方式
がとられている。これらの暗号方式では、通信相手との
二者間だけでしか知り得ない暗号鍵を使用することで、
通信相手を認証する事もできる。2. Description of the Related Art With the spread of the Internet and mobile devices, there is a demand for an unauthorized communication prevention system for illegal interception of various communications performed therein and impersonation caused by information intercepted by the illegal interception. Conventionally, in order to prevent unauthorized communication on the Internet or mobile, a key commonly used for encryption and decryption is exchanged with the communication partner in advance, and the sender encrypts with the common key and transmits data, and the receiver The receiver uses a common key encryption method to decrypt the data transmitted with the same common key, or uses the private key public key to register the public key paired with its own private key in advance with a certificate authority, etc. Public key encryption, such as RSA, in which the sender encrypts the transmitted data using the public key obtained by the communication partner and transmits it, and the receiver decrypts the received data using its own private key. The system has been adopted. In these encryption systems, by using an encryption key that can only be known between the two parties with the communication partner,
It can also authenticate the communication partner.

【０００３】しかしながら、これらの暗号化方式におい
て、共通鍵暗号化方式では、共通鍵が何らかの理由で他
人に知られてしまった場合、暗号化と復号に同じ鍵が用
いられるため、同じ鍵を長期間にわたり利用することは
不正に傍受され解読される危険が高く、これを回避する
ため頻繁に鍵の更新を行い、その度に通常の通信とは別
の手段で通信相手と鍵の授受を行うことが不可欠とな
る。一方ＲＳＡ方式に代表される秘密鍵と公開鍵を使用
したものは、公開鍵で暗号化したデータは秘密鍵でしか
復号できず、その分共通鍵方式より安全ではあるもの
の、近年のコンピュータの進化に伴い公開鍵の鍵長が短
いと公開鍵から秘密鍵を短時間で見破られる危険が高く
なってきており、長期間にわたり公開鍵を使用する場
合、その鍵長を長くせざるを得ず、伴って送信や受信時
に行われる暗号化および復号化の処理の負荷が大きくな
ってしまうという問題が発生している。また認証局を使
った公開鍵方式であると、公開鍵を認証局に予め登録し
ておかなければならないこともあり、登録や更新などの
費用、およびそれに伴う運用負荷も多大なものがある。[0003] However, in these encryption methods, in the common key encryption method, if the common key is known to another person for some reason, the same key is used for encryption and decryption. Use for a long period of time has a high risk of being intercepted and deciphered illegally, and in order to avoid this, the key is updated frequently, and each time the key is exchanged with the communication partner by another means different from normal communication It becomes essential. On the other hand, in the case of using a secret key and a public key represented by the RSA method, data encrypted with the public key can be decrypted only with the secret key. If the key length of the public key is short, the danger of being able to detect the private key from the public key in a short time is increasing, and if the public key is used for a long time, the key length must be increased, Accordingly, there is a problem that the load of the encryption and decryption processing performed at the time of transmission and reception increases. In the case of a public key system using a certificate authority, the public key may need to be registered in the certificate authority in advance, so that the cost of registration and renewal and the associated operational load are large.

【０００４】[0004]

【解決しようとする課題】本発明の課題は、このような
ネットワーク上での通信において、初期導入や運用負荷
を低減させる鍵長の短い暗号通信を使用しながら、通信
の不正傍受による第三者の成りすましの危険を回避でき
る通信システムを提供することを課題とする。SUMMARY OF THE INVENTION An object of the present invention is to provide a communication system on such a network, which uses an encrypted communication with a short key length to reduce the initial load and operation load, and a third party due to unauthorized interception of the communication. An object of the present invention is to provide a communication system capable of avoiding the risk of impersonation.

【０００５】[0005]

【課題を解決するための手段】前記課題を解決する本発
明の請求項１および２の態様は、情報を記憶するための
記憶手段と、自システムの公開鍵と秘密鍵の対の暗号鍵
を作成する手段と、作成した暗号鍵に関連付けした暗号
鍵識別情報を作成する手段と、前記暗号鍵を作成する手
段が作成した自システムの秘密鍵と暗号鍵識別情報を作
成する手段が作成した暗号鍵識別情報を関連付けて前記
記憶手段に記録する手段とを具備すると共に、前記暗号
鍵を作成する手段が作成した自システムの公開鍵を通信
相手のシステムの公開鍵で暗号化する手段と、前記暗号
化した自システムの公開鍵に関連付けた暗号鍵識別情報
と前記暗号化する手段によって暗号化した自システムの
公開鍵を通信相手のシステムに送信する手段とを有する
通信システム、若しくは、通信相手のシステムから自シ
ステムの暗号鍵識別情報と自システムの公開鍵で暗号化
されたデータを受信する手段と、前記受信する手段によ
って受信した暗号鍵識別情報にもとづき前記記憶手段か
ら関連付けられた自システムの秘密鍵を読み取る手段
と、前記自システムの秘密鍵を読み取る手段によって読
み取った秘密鍵で前記受信したデータを復号する手段と
を有する通信システムである。According to the first and second aspects of the present invention for solving the above-mentioned problems, a storage means for storing information and an encryption key of a pair of a public key and a secret key of the own system are stored. Creating means, means for creating encryption key identification information associated with the created encryption key, and encryption created by means for creating the secret key of the own system created by the means for creating the encryption key and encryption key identification information. Means for associating key identification information and recording the information in the storage means, and means for encrypting the public key of the own system created by the means for creating the encryption key with the public key of the communication partner system, A communication system comprising: encryption key identification information associated with the encrypted public key of the own system; and means for transmitting the public key of the own system encrypted by the encrypting means to the communication partner system. A means for receiving, from a communication partner system, encryption key identification information of the own system and data encrypted with the public key of the own system; and a storage means based on the encryption key identification information received by the receiving means. A communication system comprising: means for reading the associated private key of the own system; and means for decrypting the received data with the secret key read by the means for reading the private key of the own system.

【０００６】前記課題を解決する本発明の請求項３の態
様は、自システムの公開鍵と秘密鍵の対の暗号鍵を作成
する手段が送信単位または通信ごとに対の暗号鍵を作成
する請求項１の態様における通信システムである。According to a third aspect of the present invention which solves the above-mentioned problem, the means for generating an encryption key of a pair of a public key and a secret key of the own system generates an encryption key of a pair for each transmission unit or communication. It is a communication system in the aspect of item 1.

【０００７】前記課題を解決する本発明の請求項４の態
様は、自システムの公開鍵と秘密鍵の対の暗号鍵を作成
する手段が通信を開始しようとするときに対の暗号鍵を
作成する請求項１の態様における通信システムである。According to a fourth aspect of the present invention, which solves the above-mentioned problem, the means for generating an encryption key of a pair of a public key and a secret key of the own system generates the encryption key of the pair when communication is to be started. A communication system according to the aspect of claim 1.

【０００８】本発明の請求項５の態様は、自システムの
公開鍵と秘密鍵の対の暗号鍵を作成する手段が通信を終
了しようとするときにときに次回の通信で使うための対
の暗号鍵を作成する請求項１の態様における通信システ
ムである。According to a fifth aspect of the present invention, when the means for generating the encryption key of the pair of the public key and the secret key of the own system attempts to terminate the communication, the pair for use in the next communication is used. The communication system according to claim 1, wherein the communication system generates an encryption key.

【０００９】本発明の請求項６の態様は、通信相手のシ
ステムから通信相手のシステムに送信した自システムの
公開鍵で暗号化されたデータを受信する手段が受信する
データが、通信相手の公開鍵である請求項２の態様にお
ける通信システムである。According to a sixth aspect of the present invention, the data received by the means for receiving data encrypted with the public key of the own system transmitted from the system of the communication partner to the system of the communication partner receives the public data of the communication partner. 3. The communication system according to claim 2, wherein the communication system is a key.

【００１０】本発明の請求項７の態様は、通信相手のシ
ステムの公開鍵を取得する手段と、情報を記憶するため
の記憶手段と、自システムの公開鍵と秘密鍵の対の暗号
鍵を作成する手段と、前記暗号鍵を作成する手段が作成
した自システムの対の暗号鍵に関連付けした暗号鍵識別
情報を作成する手段と、前記暗号鍵を作成する手段が作
成した自システムの秘密鍵と暗号鍵識別情報を作成する
手段が作成した暗号鍵識別情報を関連付け前記記憶手段
に記録する手段と、前記暗号鍵を作成する手段が作成し
た自システムの公開鍵を前記通信相手システムの公開鍵
を取得する手段が取得した通信相手のシステムの公開鍵
で暗号化する手段と、前記暗号化した自システムの公開
鍵に関連付けした暗号鍵識別情報と前記暗号化する手段
によって暗号化した自システムの公開鍵を通信相手のシ
ステムに送信する手段と、通信相手のシステムから前記
送信した暗号鍵識別情報と通信相手のシステムに送信し
た自システムの公開鍵で暗号化されたデータを受信する
手段と、前記受信する手段によって受信した暗号鍵識別
情報にもとづき前記記憶手段から関連付けられた自シス
テムの秘密鍵を読み取る手段と、前記自システムの秘密
鍵を読み取る手段によって読み取った秘密鍵で前記受信
したデータを復号する手段を有する通信システムによる
通信方法であって、通信の前に通信相手の公開鍵（ＰＫ
ａ１）を公開鍵を取得する手段によって取得し、送信す
る際に自システムの公開鍵と秘密鍵の対の暗号鍵を作成
する手段により自己の公開鍵（ＰＫｂ１）と秘密鍵（Ｓ
Ｋｂ１）を作成し、前記暗号鍵を作成する手段が作成し
た自システムの対の暗号鍵に関連付けした暗号鍵識別情
報を作成する手段により暗号鍵の識別情報（ＮＫｂ１）
を作成し、前記暗号鍵を作成する手段が作成した自シス
テムの秘密鍵（ＳＫｂ１）と暗号鍵識別情報を作成する
手段が作成した暗号鍵識別情報（ＮＫｂ１）を関連付け
させて前記記憶手段に記録する手段により記憶し、前記
暗号鍵を作成する手段が作成した自システムの公開鍵
（ＰＫｂ１）を前記通信相手システムの公開鍵を取得す
る手段が取得した通信相手のシステムの公開鍵（ＰＫａ
１）で暗号化する手段により暗号化し、前記暗号化した
自システムの公開鍵（ＰＫａ１）に関連付けした暗号鍵
識別情報（ＮＫｂ１）と前記暗号化する手段によって暗
号化した自システムの公開鍵（ＰＫａ１）を通信相手の
システムに送信する手段によって送信し、前記送信した
暗号鍵識別情報（ＮＫｂ１）と通信相手のシステムから
通信相手のシステムに送信した自システムの公開鍵（Ｐ
Ｋａ１）で暗号化されたデータを受信する手段によって
受信し、前記受信する手段によって受信した暗号鍵識別
情報（ＮＫｂ１）にもとづき前記記憶手段から関連付け
した自システムの秘密鍵を読み取る手段によって秘密鍵
（ＳＫｂ１）を求め、前記自システムの秘密鍵を読み取
る手段によって読み取った秘密鍵（ＳＫｂ１）で前記受
信したデータを復号する手段により復号化する通信方法
である。According to a seventh aspect of the present invention, a means for acquiring a public key of a communication partner system, a storage means for storing information, and an encryption key of a pair of a public key and a secret key of the own system are used. Creating means, means for creating encryption key identification information associated with a pair of encryption keys of the own system created by the means for creating the encryption key, and secret key of the own system created by the means for creating the encryption key Means for associating the encryption key identification information created by the means for creating encryption key identification information with the storage means, and the public key of the own system created by the means for creating the encryption key to the public key of the communication partner system. Means for encrypting with the public key of the communication partner system obtained by the means for obtaining, and encryption key identification information associated with the encrypted public key of the own system and encryption by the encrypting means. Means for transmitting the public key of the own system to the communication partner system; and receiving the encrypted key identification information transmitted from the communication partner system and data encrypted with the own system public key transmitted to the communication partner system. Means for reading the associated private key of the own system from the storage means based on the encryption key identification information received by the receiving means; and receiving the secret key read by the means for reading the secret key of the own system. A communication method using a communication system having means for decrypting encrypted data, wherein a public key (PK
a1) is acquired by a means for acquiring a public key, and when transmitting the private key (PKb1) and secret key (S
Kb1), and encryption key identification information (NKb1) by means for creating encryption key identification information associated with a pair of encryption keys of the own system created by the encryption key creation means.
And the secret key (SKb1) of the own system created by the means for creating the encryption key and the encryption key identification information (NKb1) created by the means for creating the encryption key identification information are recorded in the storage means in association with each other. The public key (PKb1) of the own system created by the means for creating the encryption key and the public key (PKa) of the system of the communication partner acquired by the means for acquiring the public key of the communication partner system are stored.
(1) The encryption key identification information (NKb1) associated with the encrypted public key (PKa1) of the own system and the public key (PKa1) of the own system encrypted by the encrypting unit. ) To the communication partner system, and transmits the cipher key identification information (NKb1) and the public key (P) of the own system transmitted from the communication partner system to the communication partner system.
Means for receiving data encrypted by Ka1) and means for reading the associated private key of the system from the storage means based on the encryption key identification information (NKb1) received by the receiving means. SKb1), and decrypts the received data with the secret key (SKb1) read by the means for reading the secret key of the own system.

【００１１】本発明の請求項８の態様は、請求項７にお
いて、自システムの公開鍵と秘密鍵の対の暗号鍵を作成
する手段が送信単位または通信ごとに対の暗号鍵を作成
する通信方法である。According to an eighth aspect of the present invention, there is provided the communication system according to the seventh aspect, wherein the means for generating the encryption key of the pair of the public key and the secret key of the own system generates the encryption key of the pair for each transmission unit or communication. Is the way.

【００１２】本発明の請求項９の態様は、請求項７にお
いて、自システムの公開鍵と秘密鍵の対の暗号鍵を作成
する手段が通信を開始しようとするときに対の暗号鍵を
作成する通信方法である。According to a ninth aspect of the present invention, in the seventh aspect, when the means for generating an encryption key of a pair of a public key and a private key of the own system attempts to start communication, the encryption key of the pair is generated. Communication method.

【００１３】本発明の請求項１０の態様は、請求項７に
おいて、自システムの公開鍵と秘密鍵の対の暗号鍵を作
成する手段が通信を終了しようとするときにときに次回
の通信で使うための対の暗号鍵を作成する通信方法であ
る。According to a tenth aspect of the present invention, in the seventh aspect, when means for generating an encryption key of a pair of a public key and a secret key of the own system attempts to end the communication, the means for the next communication is used. This is a communication method that creates a pair of encryption keys for use.

【００１４】本発明の請求項１１の態様は、請求項７よ
り請求項１０のいずれかにおいて、通信相手のシステム
から通信相手のシステムに送信した自システムの公開鍵
で暗号化されたデータを受信する手段が受信するデータ
が、通信相手の公開鍵である通信方法である。[0014] According to an eleventh aspect of the present invention, in any one of the seventh to tenth aspects, receiving the data encrypted with the public key of the own system transmitted from the communication partner system to the communication partner system. This is a communication method in which the data received by the communication means is the public key of the communication partner.

【００１５】本発明の請求項１２の態様は、通信相手の
システムの公開鍵を取得する手段と、情報を記憶するた
めの記憶手段と、送信単位または通信ごとに自システム
の公開鍵と秘密鍵の対の暗号鍵を作成する手段と、前記
暗号鍵を作成する手段が作成した自システムの対の暗号
鍵に関連付けした暗号鍵識別情報を作成する手段と、前
記暗号鍵を作成する手段が作成した自システムの秘密鍵
と暗号鍵識別情報を作成する手段が作成した暗号鍵識別
情報を関連付け前記記憶手段に記録する手段と、前記暗
号鍵を作成する手段が作成した自システムの公開鍵を前
記通信相手システムの公開鍵を取得する手段が取得した
通信相手のシステムの公開鍵で暗号化する手段と、前記
暗号化した自システムの公開鍵に関連付けした暗号鍵識
別情報と前記暗号化する手段によって暗号化した自シス
テムの公開鍵を通信相手のシステムに送信する手段と、
通信相手のシステムから前記送信した暗号鍵識別情報と
通信相手のシステムに送信した自システムの公開鍵で暗
号化されたデータを受信する手段と、前記受信する手段
によって受信した暗号鍵識別情報にもとづき前記記憶手
段から関連付けられた自システムの秘密鍵を読み取る手
段と、前記自システムの秘密鍵を読み取る手段によって
読み取った秘密鍵で前記受信したデータを復号する手段
を有する通信システムによる通信方法であって、通信の
前に通信相手の公開鍵（ＰＫａ１）を公開鍵を取得する
手段によって取得しておき、自システムの公開鍵と秘密
鍵の対の暗号鍵を作成する手段により自己の公開鍵（Ｐ
Ｋｂ１）と秘密鍵（ＳＫｂ１）を作成し、暗号鍵識別情
報を作成する手段により前記暗号鍵を作成する手段が作
成した自システムの対の暗号鍵に関連付けした暗号鍵の
識別情報（ＮＫｂ１）を作成し、前記暗号鍵を作成する
手段が作成した自システムの秘密鍵（ＳＫｂ１）と暗号
鍵識別情報を作成する手段が作成した暗号鍵識別情報
（ＮＫｂ１）を関連付け手前記記憶手段に記録する手段
により記憶し、前記暗号鍵を作成する手段が作成した自
システムの公開鍵（ＰＫｂ１）を前記通信相手システム
の公開鍵を取得する手段が取得した通信相手のシステム
の公開鍵（ＰＫａ１）で暗号化する手段により暗号化
し、前記暗号化した自システムの公開鍵（ＰＫａ１）に
関連付けした暗号鍵識別情報（ＮＫｂ１）と前記暗号化
する手段によって暗号化した自システムの公開鍵（ＰＫ
ａ１）を通信相手のシステムに送信する手段によって送
信し、前記送信した暗号鍵識別情報（ＮＫｂ１）と通信
相手のシステムから通信相手のシステムに送信した自シ
ステムの公開鍵（ＰＫａ１）で暗号化された次の送信時
に使う通信相手の公開鍵（ＰＫａ２）を含むデータを受
信する手段によって受信し、前記受信する手段によって
受信した暗号鍵識別情報（ＮＫｂ１）にもとづき前記記
憶手段から関連付けした自システムの秘密鍵を読み取る
手段によって秘密鍵（ＳＫｂ１）を求め、前記自システ
ムの秘密鍵を読み取る手段によって読み取った秘密鍵
（ＳＫｂ１）で前記受信したデータを復号する手段によ
り復号化し、その後送信する際に自システムの公開鍵と
秘密鍵の対の暗号鍵を作成する手段により自己の公開鍵
（ＰＫｂ２）と秘密鍵（ＳＫｂ２）を作成し、前記暗号
鍵を作成する手段が作成した自システムの対の暗号鍵に
関連付けした暗号鍵識別情報を作成する手段により暗号
鍵の識別情報（ＮＫｂ２）を作成し、前記暗号鍵を作成
する手段が作成した自システムの秘密鍵（ＳＫｂ２）と
暗号鍵識別情報を作成する手段が作成した暗号鍵識別情
報（ＮＫｂ２）を関連付けて前記記憶手段に記録する手
段により記憶し、前記で求めた次の送信の時に使う通信
相手のシステムの公開鍵（ＰＫａ２）で暗号化する手段
により暗号化し、前記暗号化した自システムの公開鍵
（ＰＫａ２）に関連付けした暗号鍵識別情報（ＮＫｂ
２）と前記暗号化する手段によって暗号化した自システ
ムの公開鍵（ＰＫａ２）を通信相手のシステムに送信す
る手段によって送信する通信方法である。According to a twelfth aspect of the present invention, there is provided a means for acquiring a public key of a communication partner system, a storage means for storing information, and a public key and a private key of the own system for each transmission or communication. Means for creating a pair of encryption keys, means for creating encryption key identification information associated with the pair of encryption keys of the own system created by the means for creating the encryption key, and means for creating the encryption key Means for associating the secret key of the own system with the encryption key identification information created by the means for creating encryption key identification information, recording the information in the storage means, and the public key of the own system created by the means for creating the encryption key. Means for encrypting with the public key of the communication partner system obtained by the means for obtaining the public key of the communication partner system; encryption key identification information associated with the encrypted public key of the own system; Means for transmitting the public key of its own system encrypted communication partner system by means of,
Means for receiving the encrypted key identification information transmitted from the communication partner system and the data encrypted with the public key of the own system transmitted to the communication partner system, based on the encryption key identification information received by the receiving unit. A communication method by a communication system, comprising: means for reading an associated private key of the own system from the storage means; and means for decoding the received data with the secret key read by the means for reading the secret key of the own system. Before the communication, the communication partner's public key (PKa1) is obtained by means for obtaining a public key, and the own system's own public key (PKa1) is generated by means for generating an encryption key of a pair of a public key and a secret key of the own system.
Kb1) and a secret key (SKb1), and the encryption key identification information (NKb1) associated with the paired encryption key of the own system created by the encryption key creation means by the encryption key identification information creation means. Means for creating and associating the secret key (SKb1) of the own system created by the means for creating the encryption key with the encryption key identification information (NKb1) created by the means for creating encryption key identification information; And encrypts the public key (PKb1) of the own system created by the means for creating the encryption key with the public key (PKa1) of the communication partner system acquired by the means for acquiring the public key of the communication partner system. Encryption key identification information (NKb1) associated with the encrypted public key (PKa1) of the own system and the encryption by the encryption means. Public key (PK of its own system
a1) is transmitted by means for transmitting to the communication partner system, and is encrypted with the transmitted encryption key identification information (NKb1) and the public key (PKa1) of the own system transmitted from the communication partner system to the communication partner system. Receiving the data including the public key (PKa2) of the communication partner to be used at the time of the next transmission by the receiving unit, and correlating the data from the storage unit based on the encryption key identification information (NKb1) received by the receiving unit. The secret key (SKb1) is obtained by the means for reading the secret key, and the received data is decrypted by the means for decrypting the received data using the secret key (SKb1) read by the means for reading the secret key of the own system. A means for generating an encryption key of a pair of a public key and a secret key of the system and a secret key of the self key (PKb2). (SKb2), and encryption key identification information (NKb2) created by the encryption key identification information created by the encryption key creation means and associated with the paired encryption key of the own system. Storing the secret key (SKb2) of the own system created by the means for creating the key and the encryption key identification information (NKb2) created by the means for creating the encryption key identification information in the storage means, And encryption key identification information (NKb) associated with the encrypted public key (PKa2) of the own system by means of encrypting with the public key (PKa2) of the communication partner system to be used at the time of the next transmission obtained in
2) and a communication method in which the public key (PKa2) of the own system encrypted by the encrypting unit is transmitted to the communication partner system by the transmitting unit.

【００１６】かかる本発明によれば、公開鍵と秘密鍵は
１送受信の間または通信相手と接続している時間だけで
使用し使い捨てとすることになり、次の送信または通信
には同じ鍵を使用しないため、何らかの理由で第三者が
通信を不正に傍受し、成りすましを行おうとしても、次
の通信時には、また新たに作成した別の公開鍵が使用さ
れる事により、解読される前に次の通信が行われていれ
ば該１通信が解読されるだけで済み、鍵長を短かくして
もセキュリティーを保つことができ、暗号化復号の処理
が軽くできる。また、公開鍵は、従来技術の公開鍵暗号
方式のように認証局に登録し公開する必要がなく、初期
導入コストの低い利便性の高い不正通信防止システムを
提供することができる。According to the present invention, the public key and the secret key are used during one transmission / reception or only during the time of connection with the communication partner and are disposable, and the same key is used for the next transmission or communication. Because it is not used, even if a third party illegally intercepts the communication for any reason and tries to impersonate it, it will not be decrypted at the next communication and by using another newly created public key If the next communication is performed, only the one communication need be decrypted, security can be maintained even if the key length is shortened, and the encryption / decryption processing can be lightened. Further, the public key does not need to be registered and disclosed in a certificate authority as in the case of the public key cryptosystem of the related art, so that a highly convenient unauthorized communication prevention system with a low initial introduction cost can be provided.

【００１７】[0017]

【発明の実施の形態】以下、本発明を実施形態に基づい
て説明する。DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described based on embodiments.

【００１８】本発明による、機密通信方法を、第一のシ
ステムをユーザーの使用するシステムで、第二のシステ
ムをインターネット上で商取引を行うモールのシステム
として、以下でこの二つのシステム間での機密情報通信
の実施例を示す。The confidential communication method according to the present invention will be described below assuming that the first system is a system used by a user and the second system is a mall system for conducting business transactions on the Internet. 1 shows an embodiment of information communication.

【００１９】まず互いの送信時に使用する公開鍵の交換
方法であるが、図１は、インターネット３０を介して接
続された通信システムを備えた第一のシステム１０と、
同じく通信システムを備えた第二のシステム２０の図で
あり、第一のシステム１０から第二のシステム２０へ、
取り引き情報などの機密情報の入ったデータを送信しよ
うとするとき、第一のシステム１０は、まず公開鍵「Ｐ
Ｋ１−１」を作成し、送信しようとする取り引き情報と
ともに通信相手の公開鍵「ＰＫ２−１」で暗号化してデー
タを送信する。FIG. 1 shows a first system 10 having a communication system connected via the Internet 30, and FIG.
FIG. 2 is a diagram of a second system 20 also including a communication system, from the first system 10 to the second system 20;
When trying to transmit data containing confidential information such as transaction information, the first system 10 first uses the public key “P
K1-1 "is created, and encrypted with the public key" PK2-1 "of the communication partner together with the transaction information to be transmitted, and the data is transmitted.

【００２０】このときの暗号化に用いる第二のシステム
２０の公開鍵「ＰＫ２−１」は、前回通信時に第二のシス
テム２０から取得したものでも良いし、事前にＥメール
やＦＡＸや電話や手紙などの別の通信手段から取得した
もの、あるいは第三の認証局などの機関から取得したも
のでも良い。The public key "PK2-1" of the second system 20 used for encryption at this time may be obtained from the second system 20 at the time of the previous communication, or may be e-mail, FAX, telephone, It may be obtained from another communication means such as a letter, or may be obtained from an organization such as a third certificate authority.

【００２１】第二のシステム２０は、受け取ったデータ
を復号し、データの中の第一のシステム１０の公開鍵
「ＰＫ１−１」を取得し、その公開鍵「ＰＫ１−１」で第一
のシステム１０へ返信しようとするデータを暗号化する
が、この第二のシステム２０からの返信する公開鍵「Ｐ
Ｋ１−１」で暗号化したデータの中に、第二のシステム
２０で新たに作成した公開鍵ＰＫ２−２を暗号化して格
納しておくことで、第一のシステム１０側での復号時
に、この第二のシステム２０の公開鍵「ＰＫ２−２」を取
得できる。The second system 20 decrypts the received data, acquires the public key “PK1-1” of the first system 10 in the data, and uses the public key “PK1-1” to perform the first The data to be returned to the system 10 is encrypted, and the public key “P” returned from the second system 20 is encrypted.
By encrypting and storing the public key PK2-2 newly created by the second system 20 in the data encrypted by "K1-1", when the first system 10 decrypts it, The public key “PK2-2” of the second system 20 can be obtained.

【００２２】さらに第一のシステム１０が第二のシステ
ム２０へ返信しようとするときは、前記で取得した第二
のシステム２０の公開鍵ＰＫ２−２で返信データを暗号
化する。このときに第一のシステム１０は、また新しい
公開鍵「ＰＫ１−２」を作成し、この第二のシステム２０
へ返信する暗号化したデータに格納しておく。Further, when the first system 10 attempts to send a reply to the second system 20, the reply data is encrypted with the public key PK2-2 of the second system 20 obtained above. At this time, the first system 10 creates a new public key “PK1-2” again, and
Stored in the encrypted data to be returned to

【００２３】このように、お互いに通信相手が次の返信
データを暗号化する時に使用する公開鍵を、送信データ
に入れて通信相手の公開鍵で暗号化して送り合うことの
繰り返しで暗号化用の公開鍵を交換し、送信毎に違う公
開鍵で暗号化したデータでの通信を行える。As described above, the communication key is used for encrypting the next reply data by using the public key used when encrypting the next reply data. Can be exchanged, and communication can be performed using data encrypted with a different public key for each transmission.

【００２４】しかし、送信する度に違う公開鍵で暗号化
するには、受信したデータの復号の際には、受信したデ
ータが通信相手に送ったどの公開鍵で暗号化されている
のか、または、どの秘密鍵で復号できるのかを識別する
ことが重要となる。However, in order to encrypt with a different public key each time data is transmitted, when decrypting the received data, which public key was transmitted to the communication partner with which the received data was encrypted, or It is important to identify which secret key can be used for decryption.

【００２５】このため、公開鍵および対となる秘密鍵と
関連付けた暗号鍵識別情報を用いて、データの複合化に
使用する秘密鍵を求めることになるが、以下でその説明
をする。For this reason, a secret key to be used for data decryption is obtained by using the public key and the encryption key identification information associated with the secret key to be paired. This will be described below.

【００２６】図２には、この実施形態に係る第一のシス
テム１０での暗号鍵識別情報と秘密鍵の記憶部１５への
格納方法を示し、図３には、この実施形態に係る第二の
システム２０での暗号鍵識別情報と秘密鍵の記憶部２５
への格納方法を示す。FIG. 2 shows a method for storing the encryption key identification information and the secret key in the storage unit 15 in the first system 10 according to this embodiment, and FIG. 3 shows the second method according to this embodiment. Storage unit 25 for encryption key identification information and secret key in system 20
This shows how to store it in

【００２７】図４は、本発明による第一のシステム１０
と第二のシステム２０間での送受信データの構成図であ
り、暗号鍵識別情報を格納する暗号鍵識別情報部７０と
通信相手の公開鍵で暗号化される送信情報部８０があ
り、暗号鍵識別情報部７０には、その中に送信側暗号鍵
識別情報部７１と受信側暗号鍵識別情報部７２があり、
送信情報部８０には送信者側の公開鍵を格納する送信者
側公開鍵部８１と、取り引き情報などの機密情報を格納
する通信内容部８２がある。FIG. 4 shows a first system 10 according to the present invention.
FIG. 3 is a configuration diagram of data transmitted and received between the second system 20 and an encryption key identification information unit 70 that stores encryption key identification information and a transmission information unit 80 that is encrypted with the public key of the communication partner; The identification information section 70 includes a transmission-side encryption key identification information section 71 and a reception-side encryption key identification information section 72 therein.
The transmission information section 80 includes a sender side public key section 81 for storing a sender side public key and a communication content section 82 for storing confidential information such as transaction information.

【００２８】まず、最初に送信を行う側たとえば第一の
システム１０に対し受信者側たとえば第二のシステム２
０からあらかじめ公開鍵「１１２２３３０２０１９」をＥ
メールやＦＡＸや書面、または電話などの別の通信方法
で第一のシステム１０側に渡しておく。First, the first transmitting side, for example, the first system 10 is connected to the receiving side, for example, the second system 2.
From 0, the public key "11223302019" is stored in E
It is passed to the first system 10 by another communication method such as e-mail, facsimile, writing, or telephone.

【００２９】また公開鍵「１１２２３３０２０１９」に対
応する秘密鍵に関連付けた暗号鍵識別情報「０２０１Ｓ」
も、前記公開鍵「１１２２３３０２０１９」と同様に、事
前にＥメールやＦＡＸや書面、または電話などの別の通
信方法により第一のシステム１０に渡しておく。Also, the encryption key identification information “0201S” associated with the secret key corresponding to the public key “1122232019”
In the same manner as the public key “11223302019”, the information is passed to the first system 10 in advance by another communication method such as e-mail, facsimile, writing, or telephone.

【００３０】この秘密鍵と公開鍵については公開鍵暗号
方式に分類されるものであればＲＳＡ方式のものでもよ
いし他のものでも構わない。The secret key and the public key may be of the RSA type or other types as long as they are classified into the public key cryptosystem.

【００３１】また前記秘密鍵と公開鍵を認識するための
暗号鍵識別情報も公開鍵と秘密鍵を識別できれば、簡単
な数字の並びでもよく、文字列や数式でもよく、通信を
識別するための情報を使用してもよい。The encryption key identification information for recognizing the secret key and the public key may be a simple sequence of numbers, a character string or a mathematical expression, as long as the identification key can identify the public key and the secret key. Information may be used.

【００３２】この公開鍵「１１２２３３０２０１９」に対
応する秘密鍵「３３２２１１０２０１８」は、それに関連
付けられた暗号鍵識別情報「０２０１Ｓ」と関連付けて図
３のように第二のシステム２０内の記憶部２５へ、暗号
鍵識別情報を暗号鍵識別情報欄４０に、秘密鍵を秘密鍵
欄５０に記録しておく。The private key “3322102018” corresponding to the public key “11223302019” is associated with the encryption key identification information “0201S” associated therewith and stored in the storage unit 25 in the second system 20 as shown in FIG. The encryption key identification information is recorded in the encryption key identification information column 40, and the secret key is recorded in the secret key column 50.

【００３３】通信を行う際に、第一のシステム１０では
対となる公開鍵「４４５５６６０１０１７」と秘密鍵「６
６５５４４０１０１６」を作成し、この秘密鍵に関連付
けした暗号鍵識別情報「０１０１Ｒ」を作成し、その秘密
鍵「６６５５４４０１０１６」と暗号鍵識別情報「０１０
１Ｒ」を関連付けて図２のように第一のシステム１０内
の記憶部１５へ、暗号鍵識別情報を暗号鍵識別情報欄４
１に、秘密鍵を秘密鍵欄５１に記録する。At the time of communication, the first system 10 makes a pair of the public key “4455561017” and the secret key “6”.
6554401016 "and the encryption key identification information" 0101R "associated with this secret key, and the secret key" 66554401016 "and the encryption key identification information" 010 "
1R, and stores the encryption key identification information in the storage unit 15 in the first system 10 as shown in FIG.
1, the secret key is recorded in the secret key column 51.

【００３４】作成した第一のシステム１０の公開鍵「４
４５５６６０１０１７」を通信相手である第二のシステ
ム２０に取り引き情報とともに送信するが、この時のデ
ータは、図４にあるような構成とし、送信情報部８０の
中の送信者側公開鍵部８１には第一のシステム１０の公
開鍵「４４５５６６０１０１７」を格納し、取り引き情報
は通信内容部８２に格納しておき、送信情報部８０を通
信相手の公開鍵「１１２２３３０２０１９」で暗号化す
る。The created public key “4” of the first system 10
4556601017 ”is transmitted together with the transaction information to the second system 20 as the communication partner. The data at this time is configured as shown in FIG. 4 and is transmitted to the sender side public key unit 81 in the transmission information unit 80. Stores the public key "4455561017" of the first system 10, stores the transaction information in the communication content section 82, and encrypts the transmission information section 80 with the public key "1122232019" of the communication partner.

【００３５】また第一のシステム１０の作成した暗号鍵
識別情報「０１０１Ｒ」は送信側暗号鍵識別情報部７１
に、暗号化に用いた第二のシステム２０の公開鍵「１１
２２３３０２０１９」に対する暗号鍵識別情報「０２０１
Ｓ」は、受信者側暗号鍵識別情報部７２に格納する。The encryption key identification information “0101R” created by the first system 10 is transmitted to the transmission-side encryption key identification information section 71.
The public key “11” of the second system 20 used for encryption
Key identification information “0201” for “223302019”
"S" is stored in the receiver-side encryption key identification information section 72.

【００３６】第二のシステム２０では、第一のシステム
１０から受信したにデータの受信者側暗号鍵識別情報部
７２から、暗号鍵識別情報「０２０１Ｓ」を読み取り、こ
の暗号鍵識別情報「０２０１Ｓ」を基に第二のシステム２
０内の記憶部２５に記録してある暗号鍵識別情報と一致
した場合、暗号鍵識別情報「０２０１Ｓ」に関連付けられ
た秘密鍵「３３２２１１０２０１８」を読み取る。In the second system 20, the encryption key identification information "0201S" is read from the receiver encryption key identification information section 72 of the data received from the first system 10, and the encryption key identification information "0201S" is read. Based on the second system 2
When the key matches the encryption key identification information recorded in the storage unit 25 in 0, the secret key “3322102018” associated with the encryption key identification information “0201S” is read.

【００３７】この暗号鍵識別情報が不一致になった場
合、第二のシステム２０は第一のシステム１０に当該通
信を拒絶する旨を通知し通信を終了する。不一致の場合
の処理としては、一致するまで再送信を要求する方法
や、1回の暗号鍵識別情報の不一致をもって当該通信を
強制終了する方法であってもよい。When the encryption key identification information does not match, the second system 20 notifies the first system 10 that the communication is rejected, and ends the communication. As a process in the case of a mismatch, a method of requesting retransmission until a match is obtained, or a method of forcibly terminating the communication upon one mismatch of the encryption key identification information may be used.

【００３８】暗号鍵識別情報「０２０１Ｓ」が一致し秘密
鍵「３３２２１１０２０１８」を読み取る事ができた場合
は、暗号化された送信情報部８０をその秘密鍵により復
号し、その復号した送信情報部８０における通信内容部
８２から、取り引き情報を取得し取り引きに関する処理
を行うとともに、送信情報部８０における送信者側公開
鍵部８１から第一のシステム１０の公開鍵「４４５５６
６０１０１７」を読み取る。また、第一のシステム１０
の作成した暗号鍵識別情報「０１０１Ｒ」を送信側暗号鍵
識別情報部７１から取得する。暗号鍵識別情報と秘密鍵
を使い捨てとするため、記憶部２５から該当の暗号鍵識
別情報「０２０１Ｓ」と秘密鍵「３３２２１１０２０１８」
を削除する。If the encryption key identification information “0201S” matches and the secret key “3321102018” can be read, the encrypted transmission information section 80 is decrypted with the secret key, and the decrypted transmission information section 80 is decrypted. The transaction information is obtained from the communication content unit 82 in the communication information processing unit 102, and the transaction related processing is performed. The sender's public key unit 81 in the transmission information unit 80 sends the public key “44556” of the first system 10.
601017 "is read. In addition, the first system 10
The encryption key identification information “0101R” created by the above is acquired from the transmission-side encryption key identification information section 71. In order to dispose of the encryption key identification information and the secret key, the storage unit 25 stores the corresponding encryption key identification information “0201S” and the secret key “3322212018”.
Remove.

【００３９】暗号鍵識別情報「０２０１Ｓ」と秘密鍵「３
３２２１１０２０１８」を削除したことで、第三者が通
信を不正傍受し内容を解読し、成りすましのため同じ公
開鍵「１１２２３３０２０１９」で暗号化し、暗号鍵識別
情報「０２０１Ｓ」を付けた情報を不正に送信してきたと
しても、第二のシステム２０では、一致する暗号鍵識別
情報「０２０１Ｓ」は既に削除されていることから、この
第三者がその後の通信を続ける事は不可能となる。な
お、一度使用した暗号鍵識別情報と秘密鍵は、削除する
のではなく無効とするサインを付与する方法でも良い。
この場合暗号鍵識別情報の一致を判定してから、有効か
無効かを判定する方法となる。The encryption key identification information "0201S" and the secret key "3
By deleting "3221102018", a third party illegally intercepts the communication, decrypts the contents, encrypts it with the same public key "11223302019" for spoofing, and illegally transmits the information with the encryption key identification information "0201S" Even so, in the second system 20, since the corresponding encryption key identification information "0201S" has already been deleted, it is impossible for this third party to continue the subsequent communication. It should be noted that the encryption key identification information and the secret key that have been used once may be given a signature that invalidates them instead of deleting them.
In this case, the method is to determine whether the encryption key identification information matches, and then determine whether it is valid or invalid.

【００４０】第二のシステム２０で取り引きに関するデ
ータの処理後、第一のシステム１０へ返信しようとする
際は、あらたに第二のシステム２０の公開鍵「１１２２
３３０２０２５」と秘密鍵「３３２２１１０２０２４」
と、この二つの鍵に関連付けた暗号鍵識別情報「０２０
２Ｓ」を作成し、秘密鍵「３３２２１１０２０２４」と暗
号鍵識別情報「０２０２Ｓ」は、また第二のシステム２０
内に図３のように関連付けて記録する。After the second system 20 processes the data related to the transaction, when the data is to be returned to the first system 10, the public key “1122” of the second system 20 is newly prepared.
3302025 "and the secret key" 33222102024 "
And the encryption key identification information “020” associated with these two keys.
2S ", and the secret key" 3321102024 "and the encryption key identification information" 0202S "are stored in the second system 20.
In FIG. 3, they are recorded in association with each other.

【００４１】第二のシステム２０から第一のシステム１
０へ返信する取り引きデータも図４のような構成とし、
前記で作成した第二のシステム２０の公開鍵「１１２２
３３０２０２５」を含む送信情報部８０を、第一のシス
テム１０の公開鍵「４４５５６６０１０１７」にて暗号化
する。From the second system 20 to the first system 1
The transaction data returned to 0 is also configured as shown in FIG.
The public key “1122” of the second system 20 created above
The transmission information section 80 including “3302025” is encrypted with the public key “4455561017” of the first system 10.

【００４２】この暗号化する送信情報部８０の中の送信
者側公開鍵部８１に第二のシステム２０の公開鍵「１１
２２３３０２０２５」を格納し、返信したい取り引きの
結果などの情報は、通信内容部８２に格納しておく。ま
た第二のシステム２０の暗号鍵識別情報「０２０２Ｓ」は
送信者側鍵識別情報部７１に、暗号化に用いた第一のシ
ステム１０の公開鍵「４４５５６６０１０１７」に対する
暗号鍵識別情報「０１０１Ｒ」は受信者側暗号鍵識別情報
部７２にそれぞれ格納し送信する。The public key “11” of the second system 20 is stored in the sender's public key section 81 in the transmission information section 80 to be encrypted.
2233202025 ”, and information such as the result of the transaction to be returned is stored in the communication content section 82. Also, the encryption key identification information “0202S” of the second system 20 is stored in the sender side key identification information section 71, and the encryption key identification information “0101R” for the public key “4455561017” of the first system 10 used for encryption is It is stored in the receiver's encryption key identification information section 72 and transmitted.

【００４３】このようにして、第一のシステム１０に
は、第二のシステム２０に送った公開鍵「４４５５６６
０１０１７」で暗号化されたデータが返信されてくるこ
とになり、暗号鍵識別情報「０１０１Ｒ」を受信者側暗号
鍵識別情報部７２から読み取り、これを基に、第一のシ
ステム１０内に記録してある暗号鍵識別情報「０１０１
Ｒ」と、これに関連付けられた秘密鍵を読み取り秘密鍵
「６６５５４４０１０１６」を取得する。Thus, the first system 10 has the public key “445566” sent to the second system 20.
"0171" is returned, and the encryption key identification information "0101R" is read from the receiver-side encryption key identification information section 72, and recorded in the first system 10 based on this. Encryption key identification information “0101
R "and a secret key associated therewith to obtain a secret key" 6655541016 ".

【００４４】このとき暗号鍵識別情報が不一致になった
場合、前記第二のシステム２０の処理と同様に第一のシ
ステム１０は第二のシステム２０に当該通信を拒絶する
旨を通知し通信を終了する。不一致の場合の処理として
は、一致するまで再送信を要求する方法や、1回の暗号
鍵識別情報の不一致をもって当該通信を強制終了する方
法であってもよい。At this time, if the encryption key identification information does not match, the first system 10 notifies the second system 20 of the rejection of the communication and performs the communication in the same manner as the processing of the second system 20. finish. As a process in the case of a mismatch, a method of requesting retransmission until a match is obtained, or a method of forcibly terminating the communication upon one mismatch of the encryption key identification information may be used.

【００４５】暗号鍵識別情報が第一のシステム１０に記
憶してある情報と一致し、関連付けた秘密鍵を取得した
場合は、第二のシステム２０から返信されてきたデータ
の暗号化された送信情報部８０の復号を行い、通信内容
部８２の取り引きの情報を読み取り処理を行う。この復
号が完了した後、暗号鍵識別情報と秘密鍵を使い捨てと
するため、記憶部から該当の暗号鍵識別情報「０１０１
Ｒ」と秘密鍵「６６５５４４０１０１６」を削除する。If the encryption key identification information matches the information stored in the first system 10 and obtains the associated private key, the encrypted transmission of the data returned from the second system 20 is performed. The information section 80 is decrypted, and the transaction information of the communication content section 82 is read and processed. After the decryption is completed, the corresponding encryption key identification information “0101” is stored in the storage unit in order to dispose of the encryption key identification information and the secret key.
R "and the secret key" 66555401016 "are deleted.

【００４６】暗号鍵識別情報「０１０１Ｒ」と秘密鍵「６
６５５４４０１０１６」を削除したことで、第三者が通
信を不整傍受し内容を解読し、成りすましのため同じ公
開鍵「４４５５６６０１０１７」で暗号化し、暗号鍵識別
情報「０１０１Ｒ」を付けた情報を不正に送信してきたと
しても、第一のシステム１０では、一致する暗号鍵識別
情報「０１０１Ｒ」は既に削除されていることから、この
第三者がその後の通信を続ける事は不可能となる。な
お、一度使用した暗号鍵識別情報と秘密鍵は、削除する
のではなく無効とするサインを付与する方法でも良い。
この場合暗号鍵識別情報の一致を判定して、有効か無効
かを判定する方法となる。The encryption key identification information “0101R” and the secret key “6”
By deleting "6554401016", a third party intercepts the communication and decrypts the contents, encrypts it with the same public key "4455561017" for impersonation, and illegally transmits the information with the encryption key identification information "0101R" Even so, in the first system 10, since the matching encryption key identification information "0101R" has already been deleted, it is impossible for this third party to continue the subsequent communication. It should be noted that the encryption key identification information and the secret key that have been used once may be given a signature that invalidates them instead of deleting them.
In this case, the method is to determine whether the encryption key identification information matches, and determine whether the information is valid or invalid.

【００４７】さらに第一のシステム１０での取り引きに
関するデータの処理後、第二のシステム２０へ返信しよ
うとする際は、またあらたに第一のシステム１０の公開
鍵「４４５５６６０１０２３」と秘密鍵「６６５５４４０
１０２２」と、この二つの鍵に関連付けた暗号鍵識別情
報「０１０２Ｒ」を作成し、秘密鍵「６６５５４４０１０
２２」と暗号鍵識別情報「０１０２Ｒ」は第一のシステム
１０内に図２のように関連付けて記録する。Further, after the data relating to the transaction in the first system 10 is processed, when the data is to be returned to the second system 20, the public key “44555606023” and the private key “66555440” of the first system 10 are newly obtained.
1022 "and encryption key identification information" 0102R "associated with the two keys, and a secret key" 665544010 "is created.
22 and the encryption key identification information “0102R” are recorded in the first system 10 in association with each other as shown in FIG.

【００４８】第一のシステム１０から第二のシステム２
０へ返信する取り引きデータも図４のような構成とし、
前記で作成した第一のシステム１０の公開鍵「４４５５
６６０１０２３」とともに前記第二のシステム２０から
の返信データに格納されていた公開鍵「１１２２３３０
２０２５」にて暗号化する。この暗号化する情報の中に
第一のシステム１０の公開鍵「４４５５６６０１０２３」
を格納する。また第一のシステム１０の暗号鍵識別情報
「０１０２Ｒ」は送信者側鍵識別情報部７１に、暗号化に
用いた第二のシステム２０の公開鍵「１１２２３３０２
０２５」に対する暗号鍵識別情報「０２０２Ｓ」は受信者
側暗号鍵識別情報部７２にそれぞれ格納し送信する。From the first system 10 to the second system 2
The transaction data returned to 0 is also configured as shown in FIG.
The public key “4455” of the first system 10 created above
The public key “1122330” stored in the reply data from the second system 20 together with “6601023”
2025 ". The public key “4455561023” of the first system 10 is included in the information to be encrypted.
Is stored. Also, the encryption key identification information “0102R” of the first system 10 is stored in the sender side key identification information section 71 by the public key “11223302” of the second system 20 used for encryption.
The encryption key identification information “0202S” for “025” is stored in the receiver-side encryption key identification information section 72 and transmitted.

【００４９】このように送信毎にお互いの公開鍵で暗号
化し、次の返信時に使用される自システムの公開鍵を送
信し通信相手にその公開鍵で暗号化してもらうことを次
々と繰り返し、送信毎に異なる公開鍵での暗号化を行う
ことで、第三者の不正傍受からの成りすましを防止する
事ができるのである。In this manner, each time transmission is performed, the transmission key is encrypted with each other's public key, the public key of the own system used at the next reply is transmitted, and the communication partner is encrypted with the public key. By performing encryption with a different public key for each case, it is possible to prevent impersonation from unauthorized interception of a third party.

【００５０】[0050]

【発明の効果】以上説明したように、本発明によれば、
自システムの公開鍵に関連付けた暗号鍵識別情報と、自
システムの公開鍵を通信相手のシステムの公開鍵で暗号
化したものとを通信相手のシステムへ送信することがで
きるので、システムに大きな負荷をかけずに、かつ、非
常に高い信頼性をもって不正通信を防止し、第三者によ
る成りすましを阻止することができる。As described above, according to the present invention,
Since the encryption key identification information associated with the public key of the own system and the one obtained by encrypting the public key of the own system with the public key of the communication partner system can be transmitted to the communication partner system, a large load is imposed on the system. It is possible to prevent unauthorized communication and to prevent impersonation by a third party without applying any excessively high reliability.

[Brief description of the drawings]

【図１】本発明を利用したシステムの模式図FIG. 1 is a schematic diagram of a system using the present invention.

【図２】第一のシステムにおける暗号鍵識別情報と秘密
鍵の格納方法を示す図FIG. 2 is a diagram showing a method of storing encryption key identification information and a secret key in a first system.

【図３】第二のシステムにおける暗号鍵識別情報と秘密
鍵の格納方法を示す図FIG. 3 is a diagram showing a method of storing encryption key identification information and a secret key in a second system.

【図４】送受信データの構成説明図FIG. 4 is an explanatory diagram of a configuration of transmission / reception data.

[Explanation of symbols]

１０第一のシステム１５，２５記憶部２０第二のシステム３０インターネット４０，４１暗号鍵識別情報欄５０，５１秘密鍵欄６０送信データ７０暗号鍵識別情報部７１送信側暗号鍵識別情報部７２受信側暗号鍵識別情報部８０送信情報部８１送信者側公開鍵部８２通信内容部 Reference Signs List 10 First system 15, 25 Storage unit 20 Second system 30 Internet 40, 41 Encryption key identification information column 50, 51 Private key column 60 Transmission data 70 Encryption key identification information unit 71 Transmission-side encryption key identification information unit 72 Reception Side encryption key identification information section 80 transmission information section 81 sender side public key section 82 communication contents section

───────────────────────────────────────────────────── フロントページの続き (72)発明者西川新一朗東京都文京区本郷３丁目33番地５号日本信販株式会社内 (72)発明者山田英俊東京都文京区本郷３丁目33番地５号日本信販株式会社内Ｆターム(参考） 5J104 AA04 AA16 EA06 EA19 NA02 ──────────────────────────────────────────────────続き Continued on the front page (72) Inventor Shinichiro Nishikawa 3-33-5 Hongo, Bunkyo-ku, Tokyo Nippon Shinpan Co., Ltd. (72) Inventor Hidetoshi Yamada 3-33-5 Hongo, Bungo-ku, Tokyo F-term in Nippon Shinpan Co., Ltd. (reference) 5J104 AA04 AA16 EA06 EA19 NA02

Claims

[Claims]

A storage unit for storing information; a unit for generating an encryption key corresponding to a pair of a public key and a private key of the own system;
Means for creating encryption key identification information associated with the created encryption key, and associating the secret key of the own system created by the means for creating the encryption key with the encryption key identification information created by the means for creating encryption key identification information Means for recording in the storage means, means for encrypting the public key of the own system created by the means for creating the encryption key with the public key of the communication partner system, and means for encrypting the public key of the own system. A communication unit that transmits the associated encryption key identification information and the public key of the own system encrypted by the encryption unit to the communication partner system.

2. A storage unit for storing information, a unit for generating an encryption key of a pair of a public key and a secret key of the own system,
Means for creating encryption key identification information associated with the created encryption key, and associating the secret key of the own system created by the means for creating the encryption key with the encryption key identification information created by the means for creating encryption key identification information Means for recording in the storage means, means for receiving encryption key identification information of the own system and data encrypted with the public key of the own system from the communication partner system, and identification of the encryption key received by the receiving means. Means for reading a secret key of the associated system from the storage means based on information, and means for decrypting the received data with the secret key read by the means for reading the secret key of the own system. Communication system.

3. The communication system according to claim 1, wherein said means for creating an encryption key of a pair of a public key and a secret key of the own system creates an encryption key of a pair for each transmission unit or each communication.

4. The communication according to claim 1, wherein said means for creating a pair of encryption key of a public key and a secret key of said own system creates a pair of encryption keys when starting communication. system.

5. The communication system according to claim 1, wherein said means for generating an encryption key of a pair of a public key and a secret key of said own system generates a pair of encryption keys to be used in the next communication when said communication is to be terminated. The communication system according to claim 1, wherein:

6. The data received by the means for receiving data encrypted with the public key of the own system transmitted from the system of the communication partner to the system of the communication partner is the public key of the communication partner. The communication system according to claim 2.

7. A storage unit for storing information, a unit for generating an encryption key of a pair of a public key and a secret key of the own system,
Means for creating encryption key identification information associated with a pair of encryption keys of the own system created by the means for creating the encryption key, and secret key and encryption key identification information of the own system created by the means for creating the encryption key Means for associating the encryption key identification information created by the means for creating and recording in the storage means,
Means for encrypting the public key of the own system created by the means for creating the encryption key with the public key of the communication partner system,
Means for transmitting the encrypted key identification information associated with the encrypted public key of the own system and the public key of the own system encrypted by the encrypting means to the communication partner system; and Means for receiving data encrypted with the encryption key identification information and the public key of the own system transmitted to the communication partner system; and a self-association unit associated with the storage means based on the encryption key identification information received by the receiving means. A method of communication by a communication system, comprising: means for reading a secret key of a system; and means for decoding the received data with a secret key read by the means for reading a secret key of the own system. Before the public key of the communication partner (PKa
1) is obtained, and when transmitting data to the communication partner system, the public key (PKb1) and the secret key (SKb1) of the own system are generated by means for creating an encryption key of a pair of the public key and the secret key of the own system. ), And encryption key identification information (N) associated with a pair of encryption keys of its own system created by the encryption key creation means by the encryption key identification information creation means.
Kb1), and a secret key (SKb1) of the own system created by the means for creating the encryption key by means for creating the encryption key, and encryption key identification information (NKb1) created by the means for creating encryption key identification information. ) And record it,
The public key (PKb1) of the own system created by the means for creating the encryption key is encrypted by the public key (PKa1) of the communication partner system by the encrypting means, and the encrypted public system is disclosed by the transmitting means. Key (PKb1)
Transmits the encryption key identification information (NKb1) associated with the public key and the public key (PKb1) of the own system encrypted by the encrypting unit to the communication partner system, and then receives the transmission from the communication partner system by the receiving unit. Receiving the encrypted data with the encrypted key identification information (NKb1) and the public key (PKb1) of the own system transmitted to the communication partner system and reading the secret key of the own system by the receiving unit The associated secret key (SKb1) is obtained from the storage means based on the encryption key identification information (NKb1), and the received data is obtained by the secret key (SKb1) read by the means for reading the secret key of the own system by the decrypting means. A communication method, comprising:

8. The communication method according to claim 7, wherein said means for creating an encryption key of a pair of a public key and a secret key of the own system creates an encryption key of a pair for each transmission unit or each communication.

9. A communication method according to claim 7, wherein said means for creating an encryption key of a pair of a public key and a secret key of the own system creates an encryption key of said pair when starting communication. .

10. A system according to claim 7, wherein said means for generating an encryption key of a pair of a public key and a secret key of said own system uses a pair of encryption keys to be used in the next communication when said communication is to be terminated. A communication method characterized by creating.

11. The data received by the means for receiving data encrypted with its own public key transmitted from the communication partner system to the communication partner system according to any one of claims 7 to 10, A communication method, which is a public key of a communication partner.

12. A storage unit for storing information, a unit for creating an encryption key of a pair of a public key and a secret key of the own system for each transmission unit or communication, and a unit for creating the encryption key. Means for creating encryption key identification information associated with a pair of encryption keys of the own system, and encryption key identification created by means for creating secret key and encryption key identification information of the own system created by the means for creating the encryption key Means for associating information and recording the information in the storage means, means for encrypting the public key of the own system created by the means for creating the encryption key with the public key of the communication partner system, and disclosure of the encrypted own system. Means for transmitting the encryption key identification information associated with the key and the public key of the own system encrypted by the encrypting means to the communication partner system; Means for receiving the identification information and the data encrypted with the public key of the own system transmitted to the communication partner system, and the own system associated from the storage means based on the encryption key identification information received by the receiving means. A communication method by a communication system, comprising: means for reading a secret key; and means for decrypting the received data with the secret key read by the means for reading the secret key of the own system. The public key (PKa1) of the communication partner is obtained in advance, and the public key (PKb1) and the secret key (SKb1) of the own system are created by means for creating an encryption key of a pair of the public key and the secret key of the own system. The encryption key associated with the paired encryption key of the own system created by the encryption key creation means by the encryption key identification information creation means. Another information (NKb
1) The secret key (SKb1) of the own system created by the means for creating the encryption key by means for creating and recording the encryption key and the encryption key identification information (NKb1) created by the means for creating encryption key identification information. Means for encrypting the public key (PKb1) of the own system created by the means for creating the encryption key by means for creating the encryption key with the public key (PKa1) of the communication partner system, The encryption key identification information (NKb1) associated with the public key (PKb1) and the encrypted public key (PKb1) of the own system are transmitted to the communication partner system, and then the transmitted encryption key identification information (NKb1) is received by the receiving unit. NK
b1) and data including the communication partner's public key (PKa2) to be used at the time of the next transmission, which is encrypted with the own system's public key (PKb1) transmitted from the communication partner's system to the communication partner's system. Means for reading the secret key (SKb1) of the own system associated with the encryption key identification information (NKb1) received by the receiving means from the storage means, and means for reading the secret key of the own system by means for decoding. The read secret key (S
Kb1) decrypts the received data, and then transmits the public key (PKb2) and the private key (SKb2) of the own system by means for newly generating an encryption key of a pair of a public key and a private key of the own system when transmitting the data. The encryption key identification information (N) associated with the paired encryption key of the own system created by the encryption key creation means by the encryption key creation means.
Kb2) The secret key (SKb2) of the own system created by the means for creating the encryption key by the means for creating and recording
And the encryption key identification information (NKb2) created by the means for creating encryption key identification information are recorded in the storage means in association with each other;
Encrypting with the public key (PKa2) of the communication partner system used at the time of the next transmission obtained by the encrypting means,
The encryption key identification information (NKb2) associated with the encrypted public key (PKb2) of the own system by the transmitting unit.
2) and transmitting the public key (PKb2) of the own system encrypted by the encrypting means to the communication partner system.