JP2004254178A - Key distribution system for cryptographic communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To obtain a key distribution system for cryptographic communication of which the communication load at the time of key distribution is dispersed and the influence of a network failure is reduced. <P>SOLUTION: The network 1 is provided with a key control master device 10, a plurality of key control slave devices 20a, 20b placed under its control and a VPN device 30. Furthermore, VPN devices 40a, 40b are placed under control of the key control slave device 20a, and VPN devices 40c, 40d are placed under control of the key control slave device 20b. A user's terminal 51 or a group of terminals 50 are connected with the respective VPN devices 40. The key control master device 10 generates a key for the cryptographic communication, distributes it to the key control slave devices 20a, 20b and the VPN device 30 and distributes the key to the VPN devices 40a, 40b, 40c, 40d from the key control slave devices 20a, 20b by which the VPN devices are controlled, respectively. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a cryptographic communication key distribution system that distributes a key for performing cryptographic communication on a network to a VPN device used for a virtual private network.
[0002]
[Prior art]
Conventionally, a virtual private network that can be used as if it were a dedicated line even in a network such as a public line is known. In such a network, a large number of user terminals are connected via a VPN device. Data is communicated between user terminals by encrypting or decrypting communication data by a VPN device connected to a network.
In such a network, a key is distributed from a key management device to each VPN device, and each VPN device encrypts communication data using the key in order to increase the confidentiality of encrypted data flowing through a communication path. Or decrypting. Also, a new key is delivered from the key management device to each VPN device at regular intervals, and the key is updated.
According to Patent Document 1, for example, in a system for broadcasting encrypted data from a single center to user terminals, a tree structure is formed between the center and a large number of user terminals to shorten the key delivery time. It is trying to make it.
[0003]
[Patent Document 1]
JP-A-5-327748 [0004]
[Problems to be solved by the invention]
However, since the key management device alone distributes the key directly to all the VPN devices, when there are many VPN devices, traffic concentrates on the network around the key management device. For this reason, there is a problem that a communication packet is lost, key redistribution or the like occurs, and the key distribution time becomes longer. Also, if a failure occurs in the network during key distribution, the key cannot be distributed to all VPN devices, and the effect of the failure will affect all terminals.
Furthermore, unlike the case of broadcasting from the center to a large number of user terminals, the data communication performed between the user terminals via the VPN device does not hinder traffic regardless of whether key distribution is performed or not. Must be done continuously.
[0005]
The present invention has been made to solve such a problem, and provides a key distribution system for cryptographic communication in which the communication load at the time of key distribution is distributed and the influence of a failure occurring on the network at the time of key distribution is reduced. The purpose is to do.
[0006]
[Means for Solving the Problems]
A cryptographic communication key distribution system according to the present invention is a cryptographic communication key distribution system for a network that performs cryptographic communication using a plurality of VPN devices, and includes a key management master device that generates and distributes a cryptographic communication key. A plurality of key management slave devices connected to the key management master device for receiving keys distributed from the key management master device, and a plurality of subordinate VPN devices connected to any of the plurality of key management slave devices. The key management slave device distributes a key to a subordinate VPN device, and the subordinate VPN device receives the distributed key and performs cryptographic communication using the key.
[0007]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.
FIG. 1 shows a configuration of a virtual private network using a cryptographic communication key distribution system according to an embodiment of the present invention.
A key management master device 10 is connected to a network 1 composed of a WAN (Wide Area Network) using a public line or the like capable of two-way communication. A plurality of key management slave devices 20 (20a, 20b) and a VPN device 30 are connected to the key management master device 10 via the network 1, and as devices under the key management master device 10, the key management master device 10 Is under control. A plurality of VPN devices 40 are connected to the key management slave device 20 via the network 1. Of the VPN devices 40, the VPN devices 40a and 40b are under the control of the key management slave device 20a as devices under the control of the key management slave device 20a. On the other hand, the VPN devices 40c and 40d are managed by the key management slave device 20b as devices under the key management slave device 20b.
[0008]
Further, a user terminal 51 or a terminal group 50 is connected to each VPN device 40.
As described above, the respective devices are connected by the network 1, but the key management slave device 20 and the VPN devices 30 and 40 have a structure as shown in FIG. It is under the control of the management slave device 20. Since the connected VPN devices 40a and 40b have the same key and encrypt the communication path between the terminal groups 50 connected to the network 1, the encrypted information is exchanged.
[0009]
As shown in FIG. 3, the key management master device 10 connected to the network 1 has a network interface 11 for exchanging communications via the network 1 and a key for receiving a key distribution instruction to the key management master device 10. A key data generation / update unit 13 that generates a key for encrypted communication used by the delivery reception unit 12 and the VPN devices 30 and 40 and updates a conventional key with a newly generated key is provided. Further, the key management master device 10 includes a key distribution unit 14 that distributes keys to the subordinate VPN device 30 and the key management slave device 20, a general control unit 15 that controls the entire key management master device 10, and a data storage unit 16. Is provided. The data storage unit 16 stores a registered device list indicating which VPN device 30 and the key management slave device 20 are under the management of the key management master device 10, and updated key data.
[0010]
Next, the key management slave device 20 is provided with a network interface 21, a key message reception unit 22 for receiving a key distribution message or a key request message, and a key reception unit 23 for receiving a key distributed from the key management master device 10. I have. Further, the key management slave device 20 includes a key distribution unit 24 that distributes a key to the subordinate VPN device 40, an overall control unit 25 that controls the entire key management slave device 20, and a data storage unit 26. The data storage unit 26 stores a registered device list indicating which VPN device 30 is under the key management slave device 20 and key data to be delivered to the subordinate VPN device 40.
[0011]
The VPN device 40 under the key management slave device 20 includes a network interface 41, a key distribution request unit 42 for making a key distribution request to the key management slave device 20 to which the VPN device 40 belongs, and a key distributed from the key management slave device 20. A key storage unit 43 for storing is provided. When the key used so far is lost, the key distribution request unit 42 sends a key request message to the key management slave device 20 to which the key belongs, and makes a key distribution request.
[0012]
Further, the VPN device 40 includes a terminal interface 46 for exchanging communication with the terminal 51, an encryption / decryption processing unit 44 for encrypting and decrypting communication path data, and an overall control unit 45 for controlling the entire VPN device. Is provided. The encryption / decryption processing unit 44 encrypts the communication data transmitted from the terminal 51 under management via the terminal interface 46 using the key received from the key management slave device 20, and encrypts the communication data via the network interface 41. Is transmitted to another VPN device 40 having the terminal 51 of the communication partner. On the other hand, communication data transmitted from another VPN device 40 via the network interface 41 is decrypted by the encryption / decryption processing unit 44 and transmitted to the managed terminal 51 via the terminal interface 46.
[0013]
Next, the operation of the key distribution system for encrypted communication according to this embodiment will be described with reference to the flowcharts of FIGS.
First, the operation of the key management master device 10 will be described.
As shown in FIG. 4, the key management master device 10 updates the key data generation / update unit every predetermined time, for example, every 24 hours, or every time the key delivery reception unit 12 receives an instruction from the user of this system. 13 generates a key used for encrypting the communication path of the VPN devices 30 and 40, updates the generated key with respect to a conventional key in the data storage unit 16, and stores the updated key (step S1).
Next, a registered device list indicating devices under the management of the key management master device 10 stored in the data storage unit 16 is acquired from the data storage unit 16 (step S2). Specifically, the key management slave devices 20a and 20b and the VPN device 30 are registered in the registered device list.
[0014]
Next, it is determined whether or not the key management slave device 20 under the key management master device 10 is included in the registered device list (step S3). If there is a key management slave device 20, a key delivery message is sent to the key management slave device 20, and the key generated in step S1 is delivered (step S4). If there is no key management slave device, the process skips step S4 and proceeds to step S5.
In this example, in step S4, the key is delivered to the key management slave devices 20a and 20b.
The same key is delivered to the key management slave devices 20a and 20b and the VPN device 30 in order to perform confidential encrypted communication as a virtual private network.
[0015]
Next, it is determined whether or not the registered device list includes a VPN device 30 managed by the key management master device 10 (step S5). If there is a VPN device 30, the key generated in step S1 is delivered to the VPN device 30 (step S6), and a series of processing ends. If there is no VPN device 30, step S6 is skipped and a series of processing ends.
When the key is delivered to the key management slave devices 20a and 20b and the VPN device 30, the key is encrypted using the respective public keys of the destination key management slave device 20a and the like by the public key encryption method, for example, the RSA method. And then delivered.
[0016]
Next, the operation of the key management slave device 20 will be described.
As shown in FIG. 5, the key management slave device 20 checks whether the key message reception unit 22 receives a key delivery message from the key management master device 10 or a key request message from the VPN device 40 under management. A message reception process for constantly monitoring whether or not the message is received is performed (step S11).
If a message is received from any one of them, the process proceeds to step S12 to determine the source of the message (step S12).
[0017]
If a key distribution message has been received from the key management master device 10, the process proceeds to step S13, where a new key distributed from the key management master device 10 is received (step S13). Next, a registered VPN device list of the VPN devices 40 under the management of the key management slave device 20 stored in the data storage unit 26 is obtained (step S14).
For example, in the case of processing in the key management slave device 20a, specifically, the VPN devices 40a and 40b are registered in the registered device list.
[0018]
Next, for the key received in step S13, the key is encrypted for each of the VPN devices 40a and 40b in the registered VPN device list, and stored in the data storage unit 26 (step S15). Further, the encrypted key is delivered to the corresponding VPN devices 40a and 40b all at once (step S16), and a series of processes is completed.
Note that the key management slave device 20 thereafter receives a key reception message from the VPN device 40 that has delivered the key. After confirming that the new key has been delivered to each of the VPN devices 40a and 40b, the key management slave device 20a sends a key update command to each of the VPN devices 40a and 40b all at once, and the VPN devices 40a and 40b Update the key.
[0019]
On the other hand, if a key request message is received from one of the VPN devices 40 under management, for example, from the VPN device 40a, the process proceeds to step S21, where the key stored in the data storage unit 26 is encrypted and stored for each VPN device. Among them, the key corresponding to the VPN device 40a for which the key request has been made is obtained from the data storage unit 26 (step S21). Next, the key is delivered to the VPN device 40a having the key request message.
[0020]
The VPN device 40a that has received the key decrypts the received key with its own secret key, and encrypts the data sent from the terminal 51 under management to the VPN device 40a using the key. The encrypted data is transmitted to the destination VPN device 40d, and, for example, decrypts the data transmitted from the VPN device 40d and transmits the decrypted data to the terminal 51 under management.
[0021]
As described above, a plurality of key management slave devices 20 are provided under the management of the key management master device 10, and keys are distributed only to the key management slave devices 20 and the VPN device 30 under management. Therefore, it is not necessary to distribute the key to all the VPN devices 30 and 40 in the network 1, so that the traffic of the network 1 does not concentrate around the key management master device 10 and the load of the network 1 is distributed. . Therefore, the key distribution time is shortened without any loss of communication packets.
By placing several such key management slave devices 20, it becomes possible to deliver keys in a short time in a virtual private network having thousands to tens of thousands of VPN devices.
[0022]
Further, even if a failure occurs at the point A of the network 1 shown in FIG. 1 at the time of key distribution, only the VPN device 40c under the management of the corresponding key management slave device 20b interferes with the key distribution. A situation in which the key cannot be delivered to all the VPN devices 30 and 40 in the network 1 does not occur, the network-related failure can be localized, and the risk of the failure can be dispersed.
Even if a failure occurs at the point B of the network 1 shown in FIG. 1 during key distribution and the key distribution cannot be performed from the key management master device 10 to the key management slave device 20, each VPN device 40 uses the currently used key. The encrypted communication can be continued.
[0023]
While the key management master device 10 is in such a state, for example, the VPN device 40a may have lost the key being used for some reason. In such a case, the key management slave device 20 individually distributes the key in response to a request from the VPN device 40a, so that no load is applied to the key management master device 10, the other VPN devices 40b, and the like, and communication of the entire system is performed. Does not affect traffic.
Further, for example, after receiving the key, the key management slave device 20a receives a notification from the subordinate VPN devices 40a, 40b that the key has been received, and then instructs the VPN devices 40a, 40b to update the key, and issues a key update request to the VPN devices 40a, 40b. Since the key 40b updates the key only after receiving the key update instruction, even if there are a large number of VPN devices 40 under the key management slave device 20, it is caused by the key mismatch between these VPN devices 40. No trouble occurs.
[0024]
Further, the key management slave device 20 stores the key of the VPN device 40a from which the key has been lost in the data storage unit 26 in an encrypted state using the public key of the VPN device 40a. Keys can be delivered immediately according to. At this time, since the key is encrypted, there is no problem of confidentiality. Therefore, the VPN device 40a that has lost the key can safely and quickly reacquire the key from the key management slave device 20a, and can resume encrypted communication in a short time.
[0025]
In addition, since the encryption of the key delivered to each VPN device 40 is performed by the key management slave device 20, the load on the key management master device 10 is reduced, and the concentration of traffic around the key management master device 10 is further reduced. it can.
Further, since the key management slave device 20 has the associated VPN data for specifying the subordinate VPN device 40 in the data storage unit 26 as the registered VPN device list, the key management slave device 20 receives the destination instruction from the key management master device 10. The key can be delivered based on the belonging VPN data without receiving it.
[0026]
In the above embodiment, one key management slave device 20 is provided between the key management master device 10 and each VPN device 40. However, the present invention is not limited to this. The slave devices may be hierarchized in a tree shape by combining other key management slave devices according to the number of VPN devices. In this case, the key received by the key management slave device is delivered to the key management slave devices under the hierarchized hierarchy, and is delivered to the VPN device therefrom. Thus, even if the number of VPN devices increases, the key distribution time does not increase.
The network 1 is not limited to a WAN, and a virtual private network can be constructed by providing the above-described devices on a LAN, the Internet, an intranet, or the like.
[0027]
【The invention's effect】
According to the key distribution system for cryptographic communication according to the present invention, a key management master device that generates and distributes a key for cryptographic communication is provided in a key distribution system for cryptographic communication that performs cryptographic communication using a plurality of VPN devices. A plurality of key management slave devices connected to the key management master device for receiving keys distributed from the key management master device, and a plurality of subordinate VPNs connected to any of the plurality of key management slave devices. The key management slave device distributes a key to a subordinate VPN device, and the subordinate VPN device receives the distributed key and performs cryptographic communication using the key. The load is distributed, and the effect of a network failure can be reduced.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of a key distribution system for encrypted communication according to an embodiment of the present invention.
FIG. 2 is a relationship diagram showing a master-slave relationship between devices of the key distribution system for encrypted communication according to the embodiment of the present invention.
FIG. 3 is a block diagram illustrating a configuration of a device included in the key distribution system according to the embodiment;
FIG. 4 is a flowchart showing a processing flow of a key management master device used in the key distribution system according to the embodiment.
FIG. 5 is a flowchart showing a processing flow of a key management slave device used in the key distribution system according to the embodiment.
[Explanation of symbols]
1 network, 10 key management master devices, 20 key management slave devices, 30, 40 VPN devices.

Claims (5)

A cryptographic communication key distribution system for a network that performs cryptographic communication using a plurality of VPN devices,
A key management master device for generating and delivering a key for cryptographic communication,
A plurality of key management slave devices connected to the key management master device and receiving the key delivered from the key management master device;
A plurality of subordinate VPN devices connected to any of the plurality of key management slave devices,
The key management slave device distributes the key to the subordinate VPN device,
A key distribution system for cryptographic communication, wherein the subordinate VPN device receives the distributed key and performs cryptographic communication using the key. The key management slave device includes a data storage unit,
2. The key distribution system for encrypted communication according to claim 1, wherein the belonging VPN data for specifying the subordinate VPN device is stored in the data storage unit. The encryption according to claim 2, wherein the key management slave device encrypts a key delivered from the key management master device for each VPN device described in the belonging VPN data and stores the encrypted key in the data storage unit. Communication key distribution system. The key management slave device receives a key distribution request from the subordinate VPN device,
4. The key distribution system for encrypted communication according to claim 2, wherein the key stored in the data storage unit is distributed only to the VPN device that has requested the key distribution. The key management slave device, after receiving the notification that the key has been received from the subordinate VPN device, instructs the subordinate VPN device to update the key,
The key distribution system for encrypted communication according to any one of claims 1 to 4, wherein the subordinate VPN device updates the key only after receiving the key update instruction.

Images