JP2004320308A - Encrypted communication system and encrypted communication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encrypted communication system which quickly executes from the authentication to the start of an encrypted communication when a mobile terminal connects to a plurality of installed servers one after another when moving. <P>SOLUTION: The encrypted communication system comprises an authentication server 12 for generating an authenticating limited key with limited use conditions every portable terminal 10 being a mobile terminal; a key managing server 13 for distributing the limited keys generated by the authentication server 12 among specified servers, servers 11, 21, 31 for making an encrypted communication with the portable terminal 10, using the limited keys received from the key managing server 13; and a portable terminal 10 for making the encrypted communication with the servers 11, 21, 31, using the limited key. After the portable terminal 10 authenticates with the server 11, the key managing server 13 distributes the limited keys to the servers 21, 31, thus quickly executing the authentication with the servers 21 and 31. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an encrypted communication system and an encrypted communication method for distributing and deleting a key required when a mobile terminal device capable of wireless communication and a server for distributing information perform authentication and encrypted communication. .
[0002]
[Prior art]
2. Description of the Related Art In recent years, wireless communication devices such as wireless LANs and Bluetooth have become widespread, and opportunities to use wireless Internet connections such as hot spots and information providing services such as mobile EC in cities and buildings have been widespread. .
[0003]
In the future, with the advancement of wireless communication technology and the spread of devices, places and opportunities where such services can be used will increase more and more.
[0004]
Spoofing is a problem that should be sufficiently considered when implementing such a service. When a user accesses a malicious server impersonating a legitimate server installed by a malicious person and transmits personal information, the personal information is leaked to the malicious person. Also, if a malicious person impersonates another authorized user and gains access to the server, the personal information of the other user is leaked or the service is used without permission.
[0005]
In general, when a user receives a service from a server, mutual authentication is performed between the server and the portable terminal of the user in order to prevent such spoofing. Further, since the communication is performed wirelessly, it is necessary to encrypt the communication content in order to protect the communication content at the time of providing the service from eavesdropping. Therefore, after the mutual authentication is completed, the server and the mobile terminal generate and share a session key used for encrypted communication in the session. The mutual authentication and the sharing of the session key need to be performed each time the server and the mobile terminal start communication.
[0006]
As a method of mutual authentication, there are a method using common key encryption and a method using public key encryption. In the common key cryptosystem, authentication is performed by confirming that a secret key is possessed by anyone other than the two parties exchanged in advance between the two parties. In public key cryptography, a public key that is trusted by a partner is obtained, a signature is signed by a private key held only by the partner, and authentication is performed by confirming that the private key is indeed possessed. . The authenticity of the other party's public key needs to be confirmed each time authentication is performed.
[0007]
In this way, the server holds a secret key that must not be leaked for authentication, but the server installed on the street or the like, in addition to attacks via the network, It is dangerous to carry a key that can be used for a long time due to possible theft.
[0008]
In the case of the common key cryptosystem, since a key is required for each server and user pair, it takes a great deal of time to manage addition, deletion, and updating of a large number of keys. In particular, it is difficult to manage keys for mobile terminals. In the case of the public key cryptosystem, a list of public keys that can be trusted or invalidated and cannot be trusted is required for each server and mobile terminal, and it takes time to check the reliability of the public key.
[0009]
Conventionally, as a countermeasure against such a problem, there is a method in which a key that can be used for a long time is stored in another secure server called an authentication server, and authentication is performed by the authentication server. A dial-up server such as RADIUS (Remote Authentication Dial-In User Service) has this configuration. In this system, by placing an authentication server, only the session key used for encrypted communication is placed on the server. Therefore, even if the session key is leaked, it becomes invalid when the session ends, so that it does not become a serious problem.
[0010]
In addition, there is an encryption communication system in which wireless base stations are ubiquitous and have an authentication server as described in Non-Patent Document 1.
[0011]
In this system, when a user having a mobile terminal device equipped with a wireless LAN walks in the city and starts wireless communication with a base station, mutual authentication for using a wireless Internet service is performed, and the mobile terminal device The session key used for encrypted communication with the base station is shared.
[0012]
FIG. 20 is a block diagram showing a configuration of a conventional encrypted communication system described in Non-Patent Document 1.
[0013]
In FIG. 20, the encrypted communication system includes a mobile terminal 10 that is a mobile terminal device carried by a user, a server 11 that receives an authentication request or a service request from the mobile terminal 10, transfers an authentication request, and provides a service. And an authentication server 12 that authenticates the transferred authentication request.
[0014]
The communication unit 201 of the mobile terminal 10 performs communication with the communication unit 301 of the server 11. The authentication request unit 202 generates an authentication request from the information in the authentication information storage unit 203 and transmits the request to the server 11 via the communication unit 301. The authentication information storage unit 203 holds information necessary for authentication.
[0015]
The communication unit 301 of the server 11 performs communication with the communication unit 201 of the mobile terminal 10. The key storage unit 2002 holds the session key in association with the identifier of the mobile terminal 10. The key operation unit 304 receives the session key from the key distribution unit 2003, stores the session key in the key storage unit 2002, or deletes the key after the session ends. The authentication transfer unit 2001 transfers an authentication request from the mobile terminal 10 to the authentication unit 401.
[0016]
The authentication unit 401 of the authentication server 12 performs authentication for the authentication request of the mobile terminal 10 transferred from the authentication transfer unit 2001 using the information in the authentication information storage unit 402, generates a session key, and passes it to the key distribution unit 2003. . The authentication information storage unit 402 holds information necessary for authentication. The key distribution unit 2003 transmits the session key passed from the authentication unit 401 to the key operation unit 304.
[0017]
The flow of authentication in this configuration will be described with reference to FIG.
[0018]
First, the server 11 receives an authentication request from the mobile terminal 10 (Step S2101).
[0019]
Next, the server 11 requests the authentication server 12 to perform an authentication process (step S2102).
[0020]
Next, the authentication server 12 performs an authentication process. If successful, a session key is generated from the authentication request of the mobile terminal 10 and transmitted to the server 11 (step S2103).
[0021]
Next, the server 11 notifies the portable terminal 10 of successful authentication (step S2104). The portable terminal 10 notified of the success authenticates the server, and if successful, generates a session key from its own authentication request sent to the server 11. In this way, the server and the mobile terminal can perform mutual authentication and share a session key, and perform subsequent encrypted communication using the session key.
[0022]
Further, conventionally, there has been an encryption communication system as described in Patent Document 1.
[0023]
FIG. 22 shows a conventional encrypted communication system described in Patent Document 1.
[0024]
In FIG. 22, an application system 2200 provides a service, a base station management device 2202 manages a plurality of base station devices 2210, and communication networks 2201 and 2208 connect them. Also, the mobile station device 2217 accesses the base station 2210 and is authenticated by the base station management device 2202 in the communication zone created by the base station device 2210. Thereafter, even when the mobile station apparatus 2217 moves, the authentication is simplified while communicating with another base station apparatus 2211 under the control of the same base station management apparatus 2202.
[0025]
[Patent Document 1]
JP-A-2002-112337 (pages 4 to 5, FIG. 1)
[Non-patent document 1]
"High-speed Authentication System Providing Security Required for Wireless Internet" IPSJ Research Report 2002-DPS-107
[0026]
[Problems to be solved by the invention]
However, in the conventional encryption communication system shown in Non-Patent Document 1, when the mobile terminal 10 moves and starts communication with a new server, the mobile terminal 10 communicates with the authentication server every time it authenticates with the new server. I have to communicate. This communication may be performed via the Internet, and the time required for the authentication depends on the state of the network.
[0027]
Further, since the authentication server accepts the authentication in one hand, the load required for the authentication increases, and the authentication may take a long time. This is also seen in RADIUS.
[0028]
To deal with this, measures such as preparing multiple authentication servers can be taken.However, preparing multiple servers is costly, and as long as the authentication server is requested to authenticate, the problem that the time required for the authentication is not lost remains. Was.
[0029]
In another conventional encrypted communication system disclosed in Patent Document 1, when a mobile station device accesses a base station device managed by a different base station management device, an ID for authentication is not transmitted. It was necessary to perform a formal authentication process.
[0030]
The present invention solves the above-mentioned conventional problems. In a case where a user moves while holding a portable terminal and sequentially connects to a plurality of servers installed in a city, the user starts authentication and starts encrypted communication. It is an object of the present invention to provide an encrypted communication system that performs the processes at high speed.
[0031]
[Means for Solving the Problems]
An encrypted communication system according to the present invention that solves the above-described conventional problems includes a limited key generation device that generates a limited key for authentication with limited use conditions for each mobile terminal device, and a limited key generation device that is generated by the limited key generation device. A key management device that distributes the limited key to a specific server, a server that performs encrypted communication with the mobile terminal device using the limited key received from the key management device, and a server that encrypts the server using the limited key. And a mobile terminal device for performing the communication.
[0032]
Further, the server according to the present invention has a communication unit that receives an authentication request from the mobile terminal device and the first identification information, and that transmits and receives encrypted data to and from the mobile terminal device, and the use conditions are limited. A limited key storage unit that stores the limited key for authentication and the first identification information in association with each other, and a limitation that determines whether the limited key corresponding to the first identification information exists in the limited key storage unit. An authentication unit and an encryption / decryption unit that encrypts / decrypts data with the limited key, and the limited authentication unit has determined that the limited key corresponding to the first identification information exists in the limited key storage unit. In this case, the encryption / decryption unit performs the encrypted communication via the communication unit using the limited key.
[0033]
As a result, when the limited key is not shared between the mobile terminal device and the server, such as at the first access, communication with the authentication server occurs, but thereafter, the limited communication between the mobile terminal device and the server is performed. When the key is shared, communication with the authentication server becomes unnecessary, so that the frequency of authentication requests to the authentication server can be reduced. In addition, encrypted communication can be performed using a limited key, and secure communication can be started at high speed.
[0034]
The mobile terminal device according to the present invention includes a terminal encryption / decryption unit 206 for encrypting / decrypting data with a limited key for authentication whose use conditions are limited, a limited key identification information for identifying a limited key, and limited An authentication information storage unit for storing keys in association with each other, a communication unit for transmitting an authentication request and first identification information, receiving limited key identification information, and transmitting and receiving encrypted data; A determining unit 207 for determining whether or not the limited key specified by the key identification information exists in the authentication information storage unit; and the determining unit 207 determines whether the specified limited key exists in the authentication information storage unit. If it is determined, the terminal encryption / decryption unit 206 performs encrypted communication via the communication unit using the specified limited key.
[0035]
Accordingly, when the limited key is already held, there is no need to wait for the reception of the limited key, so that the encrypted communication can be started quickly using this.
[0036]
The key management device according to the present invention has an authentication unit for authenticating a mobile terminal device based on authentication information received from the mobile terminal device and authentication information for authenticating the mobile terminal device held in advance, and a use condition is limited. It has a limited key generation unit that generates a limited key for authentication, and a limited key management unit that distributes the limited key to only a specific server.
[0037]
As a result, the distribution destination of the limited key can be restricted, so that the load on the key management device can be reduced.
[0038]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0039]
(First embodiment)
The configuration of the encryption communication system according to the first embodiment of the present invention will be described.
[0040]
As shown in FIG. 1, the encryption communication system according to the present embodiment includes a mobile terminal 10 owned by a user, a server 11 that is required to be authenticated by the mobile terminal 10, and an authentication that performs authentication and creates a limited key. The server includes a server 12 and a key management server 13 for selecting a management destination of the limited key and notifying the distribution and deletion of the limited key to the server. The server 11, the authentication server 12, and the key management server 13 are connected by an electric communication line 15 such as the Internet, and communication between them is encrypted. Note that the electric communication line may be wired or wireless.
[0041]
Further, the above-mentioned limited key is a key used by the mobile terminal 10 for authentication and data encryption under predetermined conditions in the encryption communication system of the present embodiment. And additional information such as deletion conditions. Limited keys that do not satisfy the validity conditions cannot be used for authentication. If the validity condition is not temporary and cannot be satisfied permanently, such as after the validity period has expired, or if the deletion condition is satisfied, the limited key is deleted. Further, depending on the instruction of the supplementary information, a notification is made via the key management server to delete the same limited key of another server.
[0042]
In FIG. 1, the user is sequentially moving from point A to point B, point C, point D, and point E in the shopping street. The mobile terminal 10 owned by the user accesses the server 11, the server 21, and the server 31 sequentially each time the mobile terminal 10 enters the communication zones 16, 17, and 18 with the server. receive. The contents of this service are such that a store provides product introduction information based on personal information such as personal preferences registered in advance. Note that the mobile terminal 10 switches the communication zone between the point B and the point D. In the present embodiment, an example is described in which a large number of information servers are arranged in a shopping street, and a user approaches and obtains information. However, the present invention is not limited to an area such as a shopping street, but is limited to entering and exiting museums and department stores. It may be a closed space.
[0043]
Next, a data flow between components of the encrypted communication system according to the first embodiment of the present invention will be described with reference to FIGS.
In FIG. 10, as an initial state, the user has entered the point A, and the portable terminal 10 shares the common key K which is a secret key with the authentication server 12, but the limited key used for authentication with the server 11. Do not own
[0044]
First, when the mobile terminal 10 approaches the server 11 at the entrance where the limited key is not shared, the mobile terminal 10 transmits terminal identification information for identifying itself and authentication information for receiving authentication to the server 11. Then, authentication is requested (step S1001).
[0045]
The server 11 searches for a limited key based on the received terminal identification information. At this time, the server 11 does not yet have a limited key shared with the mobile terminal 10. For this reason, the server 11 transmits an authentication request for the mobile terminal 10 and authentication information for authenticating the server 11 itself to the authentication server 12 (step S1002).
[0046]
Next, the authentication server 12 performs an authentication process on the authentication request received from the server 11 by using the received authentication information and the common key K stored in advance. If the authentication has failed, the server 11 is notified of that fact. If the authentication is successful, the authentication request of the server 11 is signed to assure the portable terminal 10 and transmitted to the server 11 (step S1003).
[0047]
The server 11 notifies the portable terminal 10 that the authentication has been successful, and transmits an authentication request for the server 11 (step S1004). The mobile terminal 10 authenticates the server 11 based on the signature of the authentication server 12. At this point, the server 11 and the portable terminal 10 have been mutually authenticated.
[0048]
In this step S1003, the authentication server 12 calculates a limited key from the authentication information included in the authentication request of the mobile terminal 10 and the common key K.
[0049]
Next, the authentication server 12 transmits the limited key to the key management server 13 together with the terminal identification information of the mobile terminal 10 (step S1005).
[0050]
The key management server 13 selects the distribution destination of the limited key from the limited key and the terminal identification information received from the authentication server 12, and distributes the limited key and the information on the portable terminal 10 to the selected distribution destination (step S1006). . In this example, a server in a shopping district is selected as a distribution destination. The selected servers 21 and 31 store information in which the portable terminal 10 is associated with the received limited key. When there is supplementary information addressed to the mobile terminal 10, the server 11 transmits it to the mobile terminal 10. At this point, mutual authentication between the mobile terminal 10 and the server 11 and sharing of the limited key are completed, and encrypted communication of the service can be started.
[0051]
FIG. 11 shows an operation in the case where the mobile terminal 10 has already authenticated to the authentication server 12 and accesses a server in a shopping mall that shares a limited key used for authentication.
[0052]
The portable terminal 10 of the user is selected at the time of distributing the limited key and approaches the server 21 already sharing the limited key. At this time, the mobile terminal 10 requests authentication from the server 21 using the authentication information (step S1101).
[0053]
The server 21 searches for the limited key based on the received authentication request, and extracts the already distributed and registered limited key. When there are a plurality of valid limited keys, one is selected by using an appropriate means. For example, a key dedicated to a shopping mall, a key distributed later, a key with a long validity period, and a key with a large number of remaining uses are selected.
[0054]
Next, the server 21 does not send the limited key itself used for authentication, but notifies the portable terminal 10 of, for example, a value calculated by inputting the limited key into a one-way function or a value used for generating the limited key. (Step S1102).
[0055]
Next, the portable terminal 10 specifies the limited key from the information that can identify the notified limited key, and uses the limited key and the authentication information used for server authentication transmitted from the server 21 to generate new authentication information. Generate. The mobile terminal 10 transmits this to the server 21 (Step S1103). The server 21 decrypts this using the limited key and authenticates the mobile terminal 10.
[0056]
FIG. 12 shows an operation of deleting a limited key that was valid in a shopping district when the user goes out of the shopping district.
[0057]
The mobile terminal 10 approaches the server 31 and performs authentication in the same manner as when the user has the limited key (step S1201).
[0058]
When the server 31 detects the additional information indicating that the limited key is to be deleted after the communication is completed from the limited key after the authentication, the server 31 deletes the current limited key to the mobile terminal 10 when terminating the communication with the mobile terminal 10. Notify (step S1202). Then, the portable terminal 10 that has received the notification deletes the current limited key.
[0059]
The server 31 requests the key management server 13 to delete the key of the server having the limited key to be deleted (step S1203).
[0060]
The key management server 13 reads out the network address of the server to which the limited key has been distributed, and selects a server for which a deletion request is made. Then, the key management server 13 notifies the selected server to delete the corresponding limited key (Step S1204). Then, the server receiving the notification deletes the corresponding limited key.
[0061]
Next, the configuration and operation of each component of the encryption communication system according to the present invention will be described below.
[0062]
FIG. 2 is a block diagram illustrating a configuration of the mobile terminal 10 according to the first embodiment of the present invention.
[0063]
2, the mobile terminal 10 includes a communication unit 201 that performs local communication with the server 11, an authentication request unit 202 that requests authentication, an authentication information storage unit 203 that holds information necessary for authentication, a limited key A generation unit 205, a terminal authentication unit 204 for performing server authentication, a terminal encryption / decryption unit 206 for encrypting / decrypting data, and the presence / absence of a limited key specified in the authentication information storage unit 203 And a judgment unit 207 for judging.
[0064]
The mobile terminal 10 corresponds to a mobile terminal device, and examples thereof include a mobile phone, a PDA, and a notebook computer.
[0065]
The authentication information storage unit 203 stores, in addition to the authentication information, limited key identification information for identifying the limited key in association with the limited key and the limited key. Examples of the authentication information include terminal identification information (ID) for identifying the mobile terminal 10, a common key and a password, which are authentication information used in advance for authentication shared with the authentication server 12, and a secret in public key encryption. Key.
[0066]
The limited key generation unit 205 generates a limited key from the authentication information transmitted to the server 11 and the common key.
[0067]
The operation of the portable terminal 10 configured as described above will be described below with reference to FIG.
[0068]
First, the authentication request unit 202 outputs an authentication request to the server 11 via the communication unit 201 (Step S601).
[0069]
Next, the authentication requesting unit 202 checks whether or not the communication unit 201 has received a response from the server, and if not received within a predetermined time, returns to step S601 (step S602).
[0070]
When receiving the response from the server 11, the authentication requesting unit 202 extracts the terminal identification information (ID) and the common key (K), which are the authentication information, from the authentication information storage unit 203. A signed function value HMAC (t, rn) is calculated from the time argument (t), the random number (rn), and the common key (K), which are increasing values (step S603). This function value HMAC (t, rn) can be said to be a signature using the time argument t and the common key K of the random number rn. In general, a hash value of information obtained by combining information to be transmitted and a secret key K, which is secret information, is referred to as an HMAC value ((Keyed) Hash for Message Authentication Code). The function HMAC in the text calculates this HMAC value. Since the correct value cannot be calculated for the HMAC value without knowing the common key K, it can be confirmed that the sending party has the common key K. For example, MD5 or SHA-1 is used as the hash function. The use of this hash function is determined in advance in the encrypted communication system of the present invention.
[0071]
Next, the authentication request unit 202 transmits the function value HMAC (t, rn), the identifier ID, the time argument t, and the random number rn to the server via the communication unit 201 (Step S604).
[0072]
Next, the communication unit 201 checks whether a response has been received from the server 11 and waits until the response is received (step S605).
[0073]
Next, if the communication unit 201 does not receive the limited key identification information (KID) specifying the limited key together with the response, the communication unit 201 generates the second identification information specified by the server 11 and the authentication server 12 that have received the second identification information. The authentication request unit 202 is notified of the obtained third identification information. The second identification information is an arbitrary random number rn2 selected by the server 11, and the third identification information is a function value HMAC (t, rn) signed with a time argument t and a common key K of the random numbers rn and rn2. , Rn2). The authentication request unit 202 notifies the terminal authentication unit 204 of the received random number rn2, the function value HMAC (t, rn, rn2), the common key K, the time argument t transmitted to the server 11, and the random number rn. Is requested (step S606).
[0074]
The terminal authentication unit 204 checks whether the function value obtained by signing the time argument t and the random numbers rn and rn2 with the common key K is the same as the received function value, and determines whether the server can be authenticated. Then, the result is returned to the authentication request unit 202 (step S607).
[0075]
If the server 11 has not been authenticated, the authentication requesting unit 202 ends this processing, and if the server 11 is authenticated, notifies the limited key generation unit 205 of the random number (rn) and the common key (K), which are the authentication information. Then, an instruction to generate a limited key is issued by using the key (step S608).
[0076]
Next, the limited key generation unit 205 signs the notified random number (rn) with the common key (K) to create a limited key HMAC (rn) (step S609). This is the same as the limited key generated by the key management server 13 described later. The limited key generation unit 205 transfers the limited key to the authentication requesting unit 202. The authentication requesting unit 202 calculates the limited key identification information (KID) from the limited key and the key by a one-way function, and associates the limited key with the limited key identification information (KID). The information is stored in the authentication information storage unit 203. Then, the authentication request unit 202 instructs the terminal encryption / decryption unit 206 to start encrypted communication.
[0077]
Next, the terminal encryption / decryption unit 206 transmits the data encrypted using the limited key to the server via the communication unit 201, or decrypts the encrypted data obtained via the communication unit 201. (Step S610). This encrypted communication is continued until the mobile terminal 10 moves out of the communicable area with the server 11.
[0078]
On the other hand, when the limited key identification information (KID) for specifying the limited key is received in step S606, the limited key identification information (KID) is notified to the determination unit 207 and whether or not the specified limited key is present in the authentication information storage unit 203. Instruct the judgment.
[0079]
The determination unit 207 receives this and checks the possession status of the limited key. If there is no limited key, the process ends. If there is a limited key, the limited key is extracted and the limited key is returned to the authentication requesting unit 202 (step S611).
[0080]
Next, the authentication request unit 202 notifies the terminal authentication unit 204 of the limited key, the time argument t, the random numbers rn, rn2, and the function value HMAC ′ (t, rn, rn2) received together with the limited key. , Requesting the server 11 to determine whether authentication is possible. In response to this, the terminal authentication unit 204 signs the time argument t and the random numbers rn and rn2 with the limited key K ′. The terminal authentication unit 204 checks whether or not the signature result is the same as the function value HMAC ′ (t, rn, rn2) received from the server, and determines whether the server can be authenticated (step S612). Then, the result is returned to the authentication request unit 202.
[0081]
Next, if the authentication is not performed, the authentication requesting unit 202 ends the process. If the authentication is performed, the authentication requesting unit 202 transfers the limited key to the terminal encryption / decryption unit 206 (step S613).
[0082]
Next, the terminal authentication unit 204 obtains a function value HMAC ′ (t, rn2) by signing the time argument t and the random number rn2 with the limited key K ′, and notifies the authentication request unit 202 of this. The authentication request unit 202 transmits the function value HMAC ′ (t, rn2) to the server 11 via the communication unit 201 as server authentication information (step S614). After that, it moves to step S610.
[0083]
As described above, when the mobile terminal 10 according to the present embodiment already has the limited key, it is not necessary to wait for the reception of the limited key. Can be started.
[0084]
In the present embodiment, the mobile terminal 10 has only one limited key and performs authentication with the server. However, the present invention is not limited to this, and the mobile terminal 10 may have a plurality of limited keys depending on the purpose of use and use conditions. be able to. In this case, it is possible not only to specify the limited key from the server but also to transmit the limited key identification information when the portable terminal requests the server for authentication, and to request the authentication in which the limited key is specified.
[0085]
FIG. 3 is a block diagram illustrating a configuration of the server 11 according to the first embodiment of this invention.
[0086]
The server 11 performs a local communication with the mobile terminal 10 and a limited authentication unit that determines whether or not authentication using the limited key of the mobile terminal 10 is possible. 302, a limited key storage unit 303 which is a key database that holds a limited key in a format that allows addition, deletion, update, or search, and a key management notification from the key management server 13 is received. And a key operation unit 304 for changing the data of the data, and an encryption / decryption unit 305 for encrypting and decrypting the data. The limited key storage unit 303 stores the limited key received by the server 11 in association with the identification information of the mobile terminal so that the limited key can be identified as to which mobile terminal. The identification information includes terminal identification information, limited key identification information, or a combination thereof. Since the mobile terminal 10 has a plurality of limited keys depending on the purpose of use and usage conditions, the server 11 does not always have to hold one limited key for one terminal identification information. In addition, as shown in FIG. 1, there are generally a plurality of such servers (server 21, server 31). The operation of the server 11 configured as described above will be described below with reference to FIG.
[0087]
First, the communication unit 301 checks whether an authentication request from the mobile terminal 10 has been received, and waits until the authentication request is received (step S701).
[0088]
Next, when the communication unit 301 receives the authentication request, it transmits a response to the mobile terminal 10 (step S702).
[0089]
Next, the limited authentication unit 302 receives the terminal identification information ID, the time argument t, the random number rn, and the function value HMAC (t, rn) as authentication information via the communication unit 301 (step S703).
[0090]
Next, upon receiving this notification, the limited authentication unit 302 searches for a limited key corresponding to the terminal identification information ID received from the limited key storage unit 303 (step S704).
[0091]
If the limited key is not found, the limited authentication unit 302 transmits the random number rn2 designated by itself, which is the second authentication information, to the authentication server 12, in addition to the authentication information received from the mobile terminal 10, Request authentication (step S705).
[0092]
Next, the limited authentication unit 302 receives the authentication result and the function value HMAC (t, rn, rn2) from the authentication server 12. When the mobile terminal 10 is authenticated (step S706), the key operation unit 304 receives the limited key K ′ and the terminal identification information ID from the key management server 13. The limited key identification information KID is calculated from the limited key K ′ by a one-way function, and the limited key K ′ and the limited key identification information KID are associated with the terminal identification information ID, and are shown in FIGS. 19 (a), (b), or The data is stored in the limited key storage unit 303 with the data structure shown in (c) (step S707).
[0093]
Next, limited authentication section 302 transmits random number rn2 and function value HMAC (t, rn, rn2) to portable terminal 10, and requests authentication (step S708). At this time, the server 11 may also transmit information such as its own ID.
[0094]
Next, limited authentication section 302 delivers limited key K ′ to encryption / decryption section 305, and instructs the start of encrypted communication. The encryption / decryption unit 305 transmits data encrypted using the limited key K ′ to the mobile terminal 10 via the communication unit 301, or decrypts encrypted data obtained via the communication unit 301. (Step S709). This encrypted communication is performed during the period of providing the service to the mobile terminal 10, and then ends.
[0095]
If the portable terminal 10 has not been authenticated in step S706, the limited authentication unit 302 notifies the portable terminal of the fact (step S710).
[0096]
On the other hand, if the limited key is found in step S704, the limited authentication unit 302 arbitrarily selects the random number rn2, the limited key identification information KID, the time argument t received from the mobile terminal, the random number rn, and the random number selected by itself. The function value HMAC ′ (t, rn, rn2) obtained by signing rn2 with the limited key K ′ is transmitted to the mobile terminal 10 to request authentication (step S711).
[0097]
Next, the limited authentication unit 302 receives, via the communication unit 301, the function value HMAC ′ (t, rn2) in which the time argument t and the random number rn2 are signed with the limited key K ′ as a response to the authentication from the portable terminal 10 (step). S712).
[0098]
Next, the limited authentication unit 302 calculates a function value in which the time argument t and the random number rn2 are signed with the limited key K ′, and checks whether or not the function value is the same as the received function value HMAC ′ (t, rn2) (step S713). If they are not the same, the process ends without performing authentication of the mobile terminal. If they are the same, the limited authentication unit 302 authenticates the portable terminal and checks whether the validity period has expired, which is described in the supplementary information attached to the limited key (step S714). If it is determined that the validity period has not expired, the process proceeds to step S709. If it is determined that the validity period has expired, the limited authentication unit 302 requests the key management server 13 to delete this limited key (step S715). After that, the procedure moves to step S709. In addition to this expiration date, in addition to the expiration date, among the selected servers, the one located at the boundary of the area, the end of the street, or the server at the farthest distance after the service to the mobile terminal is provided It is used to instruct the deletion of the limited key, to notify all distribution destination servers of the time at which the limited key is to be deleted, the number of times the service can be provided, or the allowable data amount of the service. There.
[0099]
As described above, the server 11 in the present embodiment performs communication with the authentication server when the limited key is not shared between the mobile terminal and the server. When the limited key is shared between the authentication servers, the communication with the authentication server becomes unnecessary, so that the frequency of authentication requests to the authentication server can be reduced. In addition, encrypted communication can be performed using a limited key, and secure communication can be started at high speed. In addition, by utilizing the supplementary information attached to the limited key, the limited key can be deleted in a timely manner, thereby preventing the limited key from overflowing.
[0100]
FIG. 4 is a block diagram showing the configuration of the authentication server 12 according to the first embodiment of the present invention.
[0101]
The authentication server 12 includes an authentication unit 401 that performs an authentication process of the mobile terminal 10, an authentication information storage unit 402 that holds information necessary for authentication, and a limited key generation unit 403 that generates a limited key. The authentication server 12 corresponds to a limited key generation device.
[0102]
The operation of the authentication server 12 configured as described above will be described below with reference to FIG.
[0103]
First, the authentication unit 401 signs the terminal identification information ID, the time argument t, the random numbers rn and rn2, the time argument t, and the random number rn with the common key K together with the authentication request of the mobile terminal 10 from the server 11. The function value HMAC (t, rn) is received (step S801).
[0104]
Next, the authentication unit 401 extracts a common key K corresponding to the received terminal identification information ID from the authentication information storage unit 402, and signs a time argument t and a random number rn with a function key HMAC (t, rn) is calculated (step S802).
[0105]
Next, the authentication unit 401 checks whether or not the calculation result matches the function value HMAC (t, rn) received from the server (step S803). If not, the authentication unit 401 authenticates with the server 11. Notification is notified (step S804).
[0106]
If they match, the authentication unit 401 transfers the common key K and the random number rn to the limited key generation unit 403. In response to this, the limited key generation unit 403 calculates a function value HMAC (rn) obtained by signing the random number rn with the common key K, and generates a limited key K ′. The authentication unit 401 also calculates a function value HMAC (t, rn, rn2) in which the time argument t and the random numbers rn, rn2 are signed with the common key K. The limited key K ′, the function value HMAC (t, rn, rn2), and the terminal identification information ID are transmitted to the server 11 (step S805).
[0107]
Next, the limited key K ′ and the terminal identification information ID are transmitted to the key management server 13. (Step S806).
[0108]
As described above, the authentication server 12 in the present embodiment authenticates an authentication request transferred from a server that does not have a limited key, generates a limited key, and distributes the limited key to the key management server. Request, the limited key can be shared in advance between the other server and the terminal, so the frequency of authentication requests to the authentication server is reduced, and even if the user is moving, authentication is performed at high speed, It is possible to start encrypted communication.
[0109]
FIG. 5 is a block diagram showing the configuration of the key management server 13 according to the first embodiment of the present invention. The key management server 13 includes a limited key management unit 501 that manages a server to which a limited key is to be distributed, a distribution destination selection unit 502 that determines a distribution destination of the limited key, and a distribution destination selection information storage that is used to determine the distribution destination. 503.
[0110]
The distribution destination selection information storage unit 503 is recorded as a database in which the location of the server 11 and the distance between the servers or the road and the installed server are associated with each other.
[0111]
The operation of the key management server 13 configured as described above will be described below with reference to FIGS. 9A and 9B.
[0112]
In FIG. 9A, first, the limited key management unit 501 sends, from the authentication server 12, the limited key K ′ and the terminal identification information for identifying the portable terminal that has requested the limited key K ′, and the distribution of the limited key. The request is received (step S901).
[0113]
Next, the limited key management unit 501 notifies the distribution destination selection unit 502 of the limited key K ′ received from the authentication server 12 and the terminal identification information ID. In response to this, the distribution destination selection unit 502 selects a server that is the same as the terminal identification information ID received from the distribution destination selection information storage unit 503, or selects a server located at a predetermined distance from the terminal identification information ID. Or the network address of the server is extracted and stored in the distribution destination storage unit 504 (step S902). In addition to this, the distribution destination can be statically determined by registering a list of suitable servers in advance, such as selecting a server that can be reached within a certain time, and using the usage history, It is also possible to make a dynamic decision, such as using an arcade bookstore on a rainy day using weather information and so on, so that it is distributed to the bookstore. Further, it is also possible for the user to input and select the user's preference and purpose of action, and to use the information for estimation. If you know that you like music, it is presumed that you often drop in at a CD shop, and if you know the purpose of eating, you go to a restaurant. The mobile terminal 10 transmits the schedule information stored in the mobile terminal 10 by the user to the server 10 after authentication, and notifies the key management server 13 of the schedule information. Can also be used to select the distribution destination.
[0114]
Next, the distribution destination selection unit 502 notifies the key management unit 501 of the selected network addresses of these servers. At this time, the distribution destination selection unit 502 notifies the limited key with additional information.
[0115]
Next, the key management unit 501 distributes the limited key and the terminal identification information to the selected distribution destination server (step S903).
[0116]
As described above, the key management server 13 in the present embodiment can efficiently select the distribution destination of the limited key, and can share the limited key between the server and the portable terminal in advance. The frequency of requesting authentication to the server can be reduced, and even if the user is moving, authentication can be performed at high speed and encrypted communication can be started.
[0117]
FIG. 9B is a flowchart showing a limited key deletion process, which is another operation performed by the key management server 13.
[0118]
First, the process waits until the limited key management unit 501 receives a request to delete a limited key from the server 11 (step S910).
[0119]
Next, in response to the request, the limited key management unit 501 notifies the distribution destination selection unit 502 of the received limited key identification information KID, and requests a list of network addresses of servers to which the limited key has been distributed. The distribution destination selection unit 502 reads the network address of the distribution destination server stored in the distribution destination storage unit 504, and notifies the result to the limited key management unit 501 (step S911).
[0120]
Next, the limited key management unit 501 instructs the notified server to delete the limited key together with the limited key identification information (step S912).
[0121]
Thus, the expired limited key can be deleted without leaking. The request for deleting the limited key is generated by the server checking the supplementary information, and the supplementary information includes the following.
[0122]
Various conditions are set in the supplementary information, such as available time, number of times, target server, contents of information that can be communicated with the limited key, number of bytes of information that can be encrypted with the limited key, and are effective. Key that does not satisfy the conditions for the operation is treated as an invalid key. An invalid limited key cannot be used for mutual authentication or encrypted communication with the server. For this reason, the limited key includes a valid key and an invalid key.
[0123]
Then, the limited key which satisfies the condition to be deleted or cannot satisfy the condition for validity is deleted. Conditions for deletion include, for example, deleting the limited key at the end of communication with this server. When the condition for validity cannot be satisfied, the validity period has passed, or the number of times of use has been exceeded.
[0124]
In the present embodiment, the deletion of the limited key is performed by the key management server notifying each server of the limited key deletion, and each server deleting the limited key held by itself according to the notification content from the key management server. However, the present invention is not limited to this, and the server can delete only the limited key held by the server.
[0125]
As described above, by adding the supplementary information, it is possible to flexibly control the limited key.
[0126]
In the embodiment of the present invention, the number of the authentication server 12 and the number of the key management server 13 are one, but a plurality of the authentication servers 12 and the key management server 13 may be installed to distribute the load. In addition, the authentication server 12 and the key management server 13 may exist individually, or the functions may be combined into one. This one is equivalent to a key management device.
[0127]
Next, with reference to FIGS. 13A and 13B, a detailed specific example of sharing of a limited key between components and authentication processing in the encrypted communication system of the present embodiment will be described. FIG. 13A is a sequence diagram illustrating a procedure when there is no limited key according to the first embodiment of this invention.
[0128]
First, when the mobile terminal 10 detects the server 11, the mobile terminal 10 stores the terminal identification information (ID), a time argument (t) which is a monotonically increasing value held by itself, a random number (rn), and t. The function value HMAC (t, rn) obtained by signing rn with the common key K is transmitted to the server 11 (step S1301).
[0129]
Next, the server 11 searches the limited key storage unit 303 and confirms that the server 11 does not have the limited key corresponding to the received ID. Then, in addition to the information received from the mobile terminal 10, the server 11 transmits a random number rn2 specified by itself to the authentication server 12 (step S1302).
[0130]
Next, the authentication server 12 searches the received terminal identification information ID for a common key K corresponding to the mobile terminal 10, and replaces the time argument t and the random number rn with a function value HMAC (t, rn) signed with the common key K. , And confirm the match with the one received. If they do not match, the authentication server 12 notifies the server 11 that the authentication has failed. If they match, the function value HMAC (rn) is calculated and used as the limited key K ', and the function value HMAC (t, rn, rn2) signed with the terminal identification information ID, the limited key K', and the common key K is used. Is transmitted to the server 11 (step S1303).
[0131]
Next, the server 11 calculates limited key identification information KID from the limited key K ′ by a one-way function, and stores the limited key K ′ and the limited key identification information KID in the limited key storage unit 303 in association with the terminal identification information ID. I do. The server 11 transmits the random number rn2 and the function value HMAC (t, rn, rn2) signed with the common key K to the mobile terminal 10 (Step S1304). At this time, the server 11 can provide additional information such as transmitting its own ID.
[0132]
The mobile terminal 10 calculates a function value HMAC (t, rn, rn2) signed with the common key K from the time argument t and the random numbers rn and rn2, and confirms that the function value HMAC matches the one sent from the server 11. . If they do not match, the server 11 determines that the communication is not reliable and interrupts the communication.
[0133]
If they match, the mobile terminal 10 authenticates the server 11.
[0134]
Next, the portable terminal 10 calculates a limited key K ′ (= HMAC (rn)), calculates limited key identification information KID from the limited key K ′, and associates the limited key K ′ with the limited key identification information KID. The information is stored in the authentication information storage unit 203. At this point, the portable terminal 10 and the server 11 share the limited key K ′ and have completed mutual authentication. Thereafter, the mobile terminal 10 and the server 11 start encrypted communication using the limited key K ′ (step S1305).
[0135]
Next, FIG. 13B is a sequence diagram illustrating a procedure when the portable terminal 10 and the server 11 share the limited key K ′ according to the first embodiment of this invention.
[0136]
First, when the mobile terminal 10 encounters the server 11 and starts communication, the mobile terminal 10 transmits the terminal identification information (ID), the time argument (t), the random number (rn), and the time argument t and the random number rn to the common key K. The function value HMAC (t, rn) signed in is calculated and transmitted (step S1301). This part is the same as the case where the limited key shown in FIG. 13A is not shared, and the operation of the first portable terminal 10 is always the same.
[0137]
Next, the server 11 confirms that the limited key storage unit 303 has the limited key K ′ of the received terminal identification information ID. It is confirmed from the accompanying information whether the limited key is valid or should be deleted. If there is a limited key to be deleted, the limited key to be deleted is deleted from the limited key storage unit 303. When there is no valid limited key, the same operation as in the case where the limited key shown in FIG. 13A is not shared is performed. If there are a plurality of valid limited keys, a limited key K ′ to be used is determined using information such as the newness of the limited key in the accompanying information.
[0138]
Next, the server 11 selects the limited key K ′, and then generates the random number rn2, the limited key identification information KID of the limited key K ′, the time argument t, and the random numbers rn and rn2 by using the function value HMAC ′ signed with the limited key K ′. (T, rn, rn2) is transmitted to the portable terminal 10 (step S1310). At this time, the server 11 can provide additional information such as transmitting its own ID.
[0139]
Next, the portable terminal 10 acquires the corresponding limited key K ′ from the received limited key identification information KID, and signifies the time argument t and the random numbers rn and rn2 with the limited key K ′ to obtain a function value HMAC ′ (t, rn, rn2) is calculated. If the value does not match the transmitted value, the portable terminal 10 suspends the communication by regarding the server 11 as unreliable. If they match, a function value HMAC ′ (t, rn2) obtained by signing the time argument t and the random number rn2 with the limited key K ′ is calculated and transmitted to the server 11 (step S1311).
[0140]
Next, the server 11 calculates a function value HMAC ′ (t, rn2) obtained by signing the time argument t and the random number rn2 with the limited key K ′. If the value does not match the transmitted value, the server 11 determines that the portable terminal 10 is not reliable and interrupts the communication. If they match, the mobile terminal 10 and the server 11 share the limited key K ′ and have already been mutually authenticated, so start encrypted communication using the limited key K ′ (step S1312).
[0141]
In the present embodiment, the limited key is calculated after the mobile terminal 10 receives the function value HMAC (t, rn, rn2) signed with the common key K from the time argument t and the random numbers rn and rn2 in step S1304. However, the present invention is not limited to this. After transmitting the first random number rn to the server 11, the portable terminal 10 immediately calculates the limited key K ′ and stores the limited key K ′ in the authentication information storage unit 203 waiting for activation. You can also save as. The limited key waiting for activation is not valid unless the portable terminal 10 receives a notification from the server 11 trusted by the portable terminal 10 that the limited key is to be validated, or is designated as a limited key used for authentication. As a result, even if the authentication information is first transmitted in step S1301 and the communication becomes impossible and communication with another server 21 is performed, if the authentication is successfully performed by the authentication server 12, the distribution of the limited key is performed. Since the processing is performed by the server 21, a state in which the limited key K ′ cannot be shared forever can be avoided.
[0142]
Further, the mobile terminal 10 deletes the limited key that is in the waiting state for activation at a predetermined timing according to the accompanying information of the limited key. Additional information for specifying the limited key to be deleted includes the following.
1) A key that has been created for a certain period of time without being valid
2) If the number of keys waiting for activation exceeds a certain threshold, the oldest key
This can prevent a large number of unused limited keys waiting for activation from being stored.
[0143]
By deleting these limited keys waiting for validation, if the limited key corresponding to the limited key identification information KID specified as the limited key used for authentication from the server 11 does not exist on the mobile terminal 10 side, For example, an inquiry is made as to whether there is another valid limited key. However, the method of using the limited key waiting for activation is limited to the case where the function value HMAC (rn) is used as the limited key.
[0144]
As described above, in the present embodiment, the limited key can be shared between the server 11 and the portable terminal 10 in advance, so that the frequency of requesting the authentication to the authentication server 12 can be reduced. Even if the user is moving, authentication can be performed at high speed and encrypted communication can be started.
[0145]
Further, when the limited key is not shared, even when the communication with the server 11 is cut off before the authentication of the mobile terminal 10 is completed, the authentication request of the mobile terminal 10 is passed to the authentication server 12, If the authentication is successful, the limited key is also distributed to the server to which the mobile terminal 10 connects. Therefore, even when the portable terminal 10 accesses another server next time, the limited key can be kept in a shared state, so that it is possible to avoid being unable to receive the service because the authentication is not performed many times in time.
[0146]
In the present embodiment, there is only one authentication server, but a plurality of authentication servers may be prepared. In that case, the server must first transmit the ID of the authentication server to which the server belongs to the portable terminal.
[0147]
At the time of step S1301, an authentication request may be generated for each or all of the limited keys held by the mobile terminal 10 and transmitted to the server 11 in combination with the used limited key identification information. . In this case, the server 11 performs mutual authentication using the limited key that is held and confirmed to be valid among the limited keys sent from the mobile terminal 10. Furthermore, the number of exchanges can be reduced by transmitting an authentication request using a limited key first. However, in this case, the limited key must be stored in the limited key storage unit 303 in the format shown in FIG. 19B or 19C so that the limited key can be extracted from the limited key identification information. In the case of associating with only the limited key identification information as in FIG. 19B, the terminal identification information is not important because the terminal identification information cannot be obtained from the limited key storage unit 303, for example, in the case of a server that distributes advertisements. It is effective in the case.
[0148]
Further, in the present embodiment, the limited key is the function value HMAC (rn), but is not limited to this, and may be the function value HMAC (rn2) using the random number of the server. Alternatively, the authentication server may generate a unique random number rn3 and use it as the function value HMAC (rn3), or combine it with the function value HMAC (rn, rn2), the function value HMAC (rn, rn2, rn3), or the like.
[0149]
The advantage of using the function value HMAC (rn) is that the portable terminal can generate the limited key without obtaining any other information by itself. When the random number rn3 specified by the authentication server is used, it is necessary to transmit those values to the portable terminal. The transmission of the random number rn3 may not be encrypted. The advantage of combining the random numbers rn, rn2, rn3 is that the use of a plurality of random numbers makes the key more difficult to predict.
[0150]
Furthermore, the limited key only needs to be finally shared, and the key itself generated by the mobile terminal or the authentication server may be encrypted and passed to the other party.
[0151]
In addition, the authentication method without sharing the limited key does not require an authentication server. For example, if it is allowed to put a private key on the server, perform authentication directly with the server using the public key. You may. This is because by distributing a limited key shared after authentication and using this limited key for authentication, subsequent authentication can be performed at high speed.
[0152]
When the distribution destination server forms a plurality of groups, the key management server 13 may distribute a different limited key to each server group. Thus, for example, it is possible to avoid having the same limited key for each server group of different organizations, and thus it is possible to improve security. At this time, the mobile terminal has a limited key for each server group. By having a communication key separately for each server group, it is possible to prevent an administrator of a server in another server group from eavesdropping using the limited key. Alternatively, after the authentication with the limited key is completed, a new key may be exchanged without performing the encrypted communication with the limited key, and the encryption may be performed with the key.
[0153]
(Second embodiment)
FIG. 15 is a block diagram illustrating a configuration of a mobile terminal 10 which is a mobile terminal device according to the second embodiment of the present invention. 15, the portable terminal 10 includes a communication history storage unit 1501 in addition to the configuration of the first embodiment. The communication history storage unit 1501 stores the identifier of the server that has been accessed several times in the past and the access time. The authentication request unit 202 transmits this communication history to the key management server 13 each time the server is newly accessed via the connected server.
[0154]
Further, the key management server 13 according to the second embodiment of the present invention, upon receiving the communication history, stores it in the distribution destination selection information storage unit 503. The distribution destination selection unit 502 uses the information of the communication history transmitted from the mobile terminal 10 as the key distribution destination selection information to estimate the probability of a user accessing each server.
[0155]
In the following, the distribution destination selection unit 502 estimates the probability of the next access by the mobile terminal 10 for each server from the communication history information collected from the unspecified number of mobile terminals stored in the distribution destination selection information storage unit 503. The method for performing this will be described with reference to FIG.
[0156]
It is assumed that, when the user is at the server m (1401), the server q (1402) and the server r (1403) have been accessed next by the user. At this time, the probability that the server that the user will reach next is server q (1402) and server r (1403) is estimated.
[0157]
The principle of estimating the probability will be described below. The distribution destination selection information storage unit 503 stores the number of times that the next server reached the server q (1402) is eight times and the number of times that the server r1 was the server r out of ten times that the server m (1401) was previously reached. Is stored twice. From the frequency information, the distribution destination selection unit 502 determines that the probability that the user who is now at the server m (1401) will reach the server q (1402) next is 8/10 = 0.8, and the server r (1403) Is estimated to be 2/10 = 0.2. Assuming that 0.3 has been selected as the threshold value T for determining whether to select as the distribution destination, the distribution destination selection unit 502 selects the server q (1402) as the distribution destination of the key.
[0158]
In this state, only the adjacent server is selected, so that the probability of reaching the next server is also estimated. The same calculation is repeated for each of the selected servers, and the probability of reaching each server is further multiplied. For example, it is assumed that a server s (1404) and a server t (1405) arrive next to the server q (1402), and the server arrives six times and eight times, respectively, out of eight times. At this time, the probability of reaching the server s (1404) is 0.8 × 6 / (6 + 2) = 0.6, and the probability of reaching the server t (1405) is 0.8 × 2 / (6 + 2) = 0.2. Is calculated. Further, the server s (1404) is selected in comparison with the threshold value T, and the process is repeated until there is no server whose probability of reaching the threshold value T or more. There may be multiple paths to reach a server, but they may be treated independently or may be summed, for example. In the case of taking the sum, it is necessary to pay attention to the fact that a certain server may be selected, but a server in the middle path may not be selected.
[0159]
Then, the frequency is counted in consideration of which server was the previous server, and the probability is estimated.
[0160]
As a result, the case of coming to the server m (1401) from a certain direction and the case of coming from the opposite direction are treated equally, and it is estimated that the probability of going to the server in the direction opposite to the walking direction is also high, Selection can be prevented.
[0161]
The distribution destination selection information storage unit 503 is updated when the mobile terminal 10 starts communicating with the server 11. Specifically, the communication history is a list of the identifier ID of the server connected just before the communication with the new server 11 and the one immediately before the communication, and the access time. The server 11 that has received the list from the mobile terminal 10 transmits the list to the distribution destination selection unit 502. Upon receiving the list, the distribution destination selection unit 502 updates the information in the distribution destination selection information storage unit 503.
[0162]
This information is updated not only every time the mobile terminal 10 communicates with the server, but also when the mobile terminal 10 accesses the server a certain number of times or once a day, such as once a day. There are times when the server is accessed for the first time later. Alternatively, even when the server has the limited key when accessed from the mobile terminal 10, the limited authentication unit 302 causes the distribution destination selection unit 502 of the key management server 13 to provide the distribution destination such as the communication history of the mobile terminal 10. By transmitting the selection information, the distribution destination selection information storage unit 503 can be updated. Since this communication is performed irrespective of the communication with the mobile terminal 10, there is no possibility of causing a delay. Further, taking into account the load of the key management server 13 and the like, for example, the server may accumulate communication histories from the portable terminal to some extent, collect them, and then transmit them to the key management server 13. Note that the accuracy of this frequency is not required. If the server m (1401) has not moved to the server r (1403), it is not distributed to the server r (1403), so it is necessary to appropriately set the initial frequency.
[0163]
It should be noted that the lower the threshold T is, the more the distribution is made. However, if the threshold T is too low, the number of distribution destinations increases and the load on the key management server increases. Therefore, when the number of distribution destinations exceeds a predetermined number in consideration of the load of the key management server 13 and the like, the threshold T can be changed dynamically, for example, by slightly increasing the threshold T.
[0164]
Furthermore, as another selection method, a server that has a high probability from a location close to the server currently being accessed can be selected up to a predetermined upper limit of the number of distribution destinations.
[0165]
In addition, when delivering to the determined distribution destination, it is preferable to deliver from a nearby location, since the possibility that the distribution of the limited key will not be in time before the next communication starts is reduced.
[0166]
Furthermore, the frequency may be counted separately for each user, time zone, and group.
[0167]
FIG. 16A is a block diagram illustrating a configuration of the key management server 13 in a case where the communication history is divided and stored in the key management server 13 for each group.
[0168]
FIG. 16A is different from the previous one in that a mobile terminal has a group ID storage unit 1601 for holding group identification information ID indicating which group the mobile terminal belongs to. The identification information and the group identification information ID are stored in association with each other.
[0169]
The distribution destination selection unit 502 obtains the communication history of the mobile terminal obtained via the limited key management unit 501 from the information in the group ID storage unit 1601 to find out what the identifier of the group to which the mobile terminal belongs is. The information is stored in the storage unit 503 for each group ID.
Then, when the distribution destination selection unit 502 is instructed to select a distribution destination from the limited key management unit 501, the distribution destination selection unit 502 selects a distribution destination using the communication history of the group to which the portable terminal requesting the limited key belongs.
[0170]
Note that only a valid group identification information ID is stored in the group ID storage unit, and the portable terminal transmits the group identification information ID. The key management server checks whether the group ID is valid. May be treated as belonging to. If the group is invalid, a default group that is not any group may be used, or the entire history information may be used instead of the group.
[0171]
In addition, the communication history is not transmitted by the mobile terminal, but the server collects the time of access from the mobile terminal and the terminal identification information of the terminal, transmits the collected information to the key management server, and the key management server counts the communication history. Although it is possible to obtain access frequency information, the order of access is important for making inferences, so the clocks must be set between servers.
[0172]
As described above, in the present embodiment, the estimated probability of the next server to be accessed can be calculated from the communication history storage unit provided in the portable terminal, and the efficient distribution destination based on the estimation of the user's behavior tendency can be calculated. Can be selected.
[0173]
That is, it is assumed that many users are moving in a situation where many servers are located in the city. The user moves with his or her own intention, but there is a certain path depending on the shape of the road, the arrangement of shops, and the like. For this reason, when the limited key is distributed by the method of the present invention, the limited key can be distributed along a route that the user may pass, and the distribution is not wasted.
[0174]
(Third embodiment)
FIG. 16B is a block diagram illustrating a configuration of the key management server 13 according to the third embodiment of this invention. FIG. 16B is different from the first embodiment in that the key management server 13 has a limited key storage unit 1602.
[0175]
The limited key storage unit 1602 stores the limited key received from the authentication server 12 in association with the limited key identification information.
[0176]
The operation of redistributing the limited key in the encryption communication system including the key management server 13 will be described below with reference to FIG.
[0177]
First, the mobile terminal 10 makes an authentication request to the server 11 (step S1701).
[0178]
Next, since the server 11 does not have the limited key applicable to the mobile terminal 10, the server 11 requests the authentication server 13 for authentication (step S1702).
[0179]
Next, the authentication server 12 generates a limited key and requests the key management server 13 to distribute the limited key (step S1703).
[0180]
Next, the key management server 13 distributes the limited key to the servers 11 and 21 based on the distribution destination selection information (step S1704). At this time, it is not distributed to the server 31. Further, the mobile terminal 10 receives a notification from the server 11 that the authentication has been successful (step S1705).
[0181]
Next, the mobile terminal 10 makes a request for authentication to the server 21 (step S1706). Since the server 21 has received the limited key in advance, the server 21 authenticates the mobile terminal 10 using the limited key.
[0182]
The above steps S1701 to S1706 are the same as the authentication processing in the first embodiment.
[0183]
In the operation of the server according to the first embodiment shown in FIG. 7, in step S714, the server determines whether or not the validity period has expired from the supplementary information of the limited key. Deletion was requested (step S715). However, in the present embodiment, when authenticating the mobile terminal 10 with the received limited key, the server 21 determines whether or not to request the key management server to redistribute the limited key using the incidental information. I do. As this determination, for example, it is determined whether or not there is information that the own server is located at the end among the distributed servers, or the expiration date of the limited key is within a predetermined period It is to determine whether or not. The server 21 also determines whether to distribute a current limited key or a new limited key. For example, it is determined that the current limited key is used if there is more than 5 minutes until the expiration date, and that if it is less than 5 minutes, distribution of a new limited key is requested. It is desirable to consider security issues when setting these conditions. When the server 21 determines to distribute the current limited key, the server 21 requests the key management server to additionally distribute the key (step S1707).
[0184]
Next, the key management server 13 selects the distribution destination of the limited key again, starting from the request source server 21. Then, out of the new distribution destinations, the limited key is distributed only to servers to which the limited key has not been distributed (step S1708).
[0185]
The processing of the key management server 13 will be described with reference to the flowchart shown in FIG.
[0186]
First, upon receiving a request for redistribution of a limited key from the server 21, the limited key management unit 501 requests the distribution destination selection unit 502 to select a redistribution destination together with the identifier of the requesting server and the limited key identification information. (Step S1801).
[0187]
Next, the distribution destination selection unit 502 selects a distribution destination based on the distribution destination selection information, starting from the server specified by the identifier of the requesting server (step S1802). This selection method is the same as in the first embodiment.
[0188]
Next, the distribution destination selection unit 502 reads the distribution destination of the limited key corresponding to the limited key identification information from the distribution destination storage unit 504 (step S1803). The server of the distribution destination that is not duplicated between the distribution destination and the newly selected distribution destination is extracted (step S1804).
[0189]
The distribution destination selection unit 502 notifies the limited key management unit 501 of the extracted server. The limited key management unit 501 reads the limited key corresponding to the limited key identification information from the limited key storage unit 505, and distributes the limited key to the server notified from the distribution destination selection unit 502 (step S1805).
[0190]
As described above, the key management server 13 can distribute the limited key to the server that the mobile terminal is expected to access further without duplicating the specified existing limited key.
[0191]
As a result, the mobile terminal can continue to use the existing limited key even when moving, and can be quickly authenticated by the new server and provided with the service quickly. Further, the validity period is checked, and if available, the current limited key is distributed, so that unnecessary increase of the limited key can be prevented. Furthermore, when authentication with an authentication server is performed, even if a limited key is not distributed to a server to which the limited key has not been distributed, it is additionally distributed without waste as necessary, so that the frequency of requesting authentication to the authentication server is further reduced. Can be.
[0192]
When the server 21 determines to distribute a new key, the server 21 transmits the authentication information received from the mobile terminal 10 to the authentication server for generating a new limited key. The authentication server 12 generates a new limited key and requests the key management server 13 to distribute it, as in the first embodiment. The key management server 13 also receives this and distributes the new limited key. That is, when the valid limited key is shared, it can be determined that the authentication has been completed. Therefore, even if a key distribution request is made, there is no need to wait for a response in communication between the server and the portable terminal.
[0193]
Accordingly, even when the mobile terminal 10 needs a new limited key due to an expiration or the like, before the limited key expires, a new limited key is received while the service is being received with the existing limited key. Since the server can be obtained, the server that has been distributed with the new limited key is quickly authenticated.
[0194]
【The invention's effect】
According to the present invention, the limited key can be shared in advance between the server and the mobile terminal device, so that the frequency of authentication requests to the authentication server is reduced, and even if the user moves, the server and the mobile terminal device are reduced. It is possible to perform mutual authentication at high speed and start encrypted communication.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an encryption communication system according to a first embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of a portable terminal according to the first embodiment of the present invention.
FIG. 3 is a block diagram showing a configuration of a server according to the first embodiment of the present invention.
FIG. 4 is a block diagram showing a configuration of an authentication server according to the first embodiment of the present invention.
FIG. 5 is a block diagram showing a configuration of a key management server according to the first embodiment of the present invention.
FIG. 6 is a flowchart illustrating an operation of the mobile terminal according to the first embodiment of the present invention.
FIG. 7 is a flowchart showing the operation of the server according to the first embodiment of the present invention;
FIG. 8 is a flowchart showing the operation of the authentication server according to the first embodiment of the present invention.
FIG. 9A is a flowchart showing the operation of the key management server according to the first embodiment of the present invention.
(B) Flow chart showing the operation of the key management server according to the first embodiment of the present invention
FIG. 10 is a view for explaining an operation when there is no limited key in the first embodiment of the present invention;
FIG. 11 is a view for explaining an operation when there is a limited key according to the first embodiment of the present invention;
FIG. 12 is a diagram illustrating an operation of deleting a limited key according to the first embodiment of the present invention.
FIG. 13A is a sequence diagram showing a procedure when there is no limited key according to the first embodiment of this invention;
(B) Sequence diagram showing a procedure when there is a limited key according to the first embodiment of the present invention
FIG. 14 is a diagram illustrating selection of a distribution destination of a limited key according to the second embodiment of this invention;
FIG. 15 is a block diagram showing a configuration of a mobile terminal according to a second embodiment of the present invention.
FIG. 16A is a block diagram showing a configuration of a key management server according to the second embodiment of the present invention.
(B) Block diagram showing the configuration of the key management server according to the third embodiment of the present invention
FIG. 17 is a diagram illustrating an operation when additional distribution of a limited key according to the third embodiment of the present invention is performed.
FIG. 18 is a flowchart showing the operation of the key management server according to the third embodiment of the present invention.
FIG. 19A illustrates a data structure stored in a limited key storage unit according to the first embodiment of the present invention.
(B) A diagram showing a data structure stored in a limited key storage unit according to the first embodiment of the present invention.
(C) A diagram showing a data structure stored in a limited key storage unit according to the first embodiment of the present invention.
FIG. 20 is a block diagram showing the configuration of a conventional encrypted communication system.
FIG. 21 is a diagram illustrating the operation of a conventional encrypted communication system.
FIG. 22 is a block diagram showing a configuration of a conventional encrypted communication system.
[Explanation of symbols]
10 Mobile terminal
11, 21, 31 servers
12 Authentication server
13 Key Management Server
15 Telecommunication lines
16, 17, 18 Communication zone
201 Communication unit
202 Authentication request section
203 Authentication information storage unit
204 Terminal authentication unit
205 Limited key generator
206 Terminal encryption / decryption unit
207 Judgment unit
301 Communication unit
302 Limited Authentication Department
303 Limited key storage
304 key operation unit
305 Encryption / Decryption Unit
401 Authentication unit
402 Authentication information storage unit
403 Limited key generator
501 Limited key management unit
502 Distribution destination selection section
503 Distribution destination selection information storage unit
504 Distribution destination storage unit
1501 communication history storage unit
1601 Group ID storage unit
1602 Limited key storage
2001 Authentication transfer unit
2002 Key storage unit
2003 Key distribution unit
2200 Application System
2201 and 2208 communication networks
2202 Base station management device
2210, 2211 base station apparatus
2217 Mobile station equipment

Claims (32)

A communication unit that receives an authentication request from the mobile terminal device and the first identification information, and transmits and receives encrypted data to and from the mobile terminal device,
A limited key storage unit that stores the limited key for authentication with limited use conditions and the first identification information in association with each other,
A limited authentication unit that determines whether a limited key corresponding to the first identification information exists in the limited key storage unit,
An encryption / decryption unit for encrypting / decrypting data with a limited key,
When the limited authentication unit determines that the limited key corresponding to the first identification information exists in the limited key storage unit, the encryption / decryption unit uses the limited key to perform encrypted communication via the communication unit. Server to do. A communication unit that receives an authentication request from the mobile terminal device, authentication information for authentication, and first identification information, and transmits and receives data to and from the mobile terminal device,
A limited key storage unit that stores the limited key for authentication with limited use conditions and the first identification information in association with each other,
A limited authentication unit that determines whether a limited key corresponding to the first identification information exists in the limited key storage unit,
A server that performs an authentication process using the authentication information and the limited key when the limited authentication unit determines that the limited key corresponding to the first identification information exists in the limited key storage unit. 3. The server according to claim 1, wherein the first identification information is at least one of terminal identification information and limited key identification information. The authentication process includes:
The communication unit receives first identification information and authentication information from the mobile terminal device performing the authentication request, and the limited authentication unit stores a limited key corresponding to the first identification information in the limited key storage unit. If it is determined that it exists,
The second authentication information determined by the limited authentication unit, the third authentication information generated from the limited key and the received authentication information and the second authentication information, the mobile terminal 3. The server according to claim 2, wherein the server transmits the information to a device. If the limited authentication unit determines that the limited key corresponding to the mobile terminal device that has requested authentication does not exist in the limited key storage unit, the limited information is transferred between the authentication information and the first identification information received from the mobile terminal device. The server according to claim 1, wherein the server transmits the terminal device to an authentication device that performs authentication of the terminal device. The limited authentication unit determines whether the limited key stored in the limited key storage unit satisfies the use condition. If the limited key does not satisfy the use condition, the limited key is deleted or updated by validating the limited key. The server according to claim 5, wherein a request is made to a key management device that manages revocation. The limited authentication unit determines whether the limited key stored in the limited key storage unit satisfies a use condition. If the limited key does not satisfy the use condition, the limited key is deleted and a new limited key is distributed. The server according to claim 5, wherein the server requests the key management device that manages validity / invalidity of the limited key. 8. The server according to claim 6, wherein the limited authentication unit receives an instruction to delete a limited key from the key management device, and deletes the limited key stored in the limited key storage unit. The limited authentication unit determines whether the limited key stored in the limited key storage unit satisfies a use condition, and deletes the limited key from the limited key storage unit if the use condition is not satisfied. The server according to any one of claims 1 to 5. A terminal encryption / decryption unit that encrypts / decrypts data using a limited key for authentication with limited use conditions;
An authentication information storage unit that stores the limited key in association with the limited key identification information for identifying the limited key,
A communication unit that transmits an authentication request and first identification information, receives limited key identification information, and transmits and receives encrypted data,
A determination unit that determines whether the limited key specified by the limited key identification information exists in the authentication information storage unit,
If the determination unit determines that the specified limited key is present in the authentication information storage unit, the terminal encryption / decryption unit encrypts the data via the communication unit using the specified limited key. A mobile terminal device that performs communication. A limited key for authentication whose use conditions are limited, and an authentication information storage unit that accumulates and stores limited key identification information for identifying the limited key,
A communication unit that transmits an authentication request and first identification information, receives limited key identification information, and transmits and receives data,
A determining unit that determines whether the limited key specified by the limited key identification information exists in the authentication information storage unit;
A mobile terminal comprising: an authentication unit that performs an authentication process via the communication unit using the specified limited key when the determination unit determines that the specified limited key exists in the authentication information storage unit. apparatus. The mobile terminal device according to claim 10, wherein the first identification information is at least one of terminal identification information and limited key identification information. The authentication process includes:
The communication unit receives the limited key identification information, the second authentication information, and the third authentication information from the server, and determines that the limited key corresponding to the limited key identification information exists in the authentication information storage unit. If judged,
The method according to claim 11 or 12, wherein the mobile terminal device transmits to the server information generated from the authentication information transmitted to the server, the limited key, and the received second authentication information. Mobile terminal. An authentication unit that authenticates the mobile terminal device from authentication information received from the mobile terminal device and authentication information for authenticating the mobile terminal device held in advance,
A limited key generation unit that generates a limited key for authentication with limited use conditions,
A key management device comprising: a limited key management unit that distributes the limited key only to a specific server. The key management device according to claim 14, wherein the limited key management unit distributes the limited key by adding usage conditions to the limited key. The key management device according to claim 15, wherein the use condition includes at least one of a usable period, a usable number, a usable region, and a receivable data amount. 16. The key management device according to claim 15, wherein when the use condition is not satisfied, the limited key management unit adds an instruction to the server to delete the limited key or to distribute a new limited key to the limited key. Further comprising a communication history storage unit for storing information regarding a communication history from any mobile terminal device to any server,
The limited key management unit, based on information for specifying a server currently connected to the mobile terminal device authenticated by the authentication unit, and a communication history including the currently connected server stored in the communication history storage unit. 18. The key management device according to claim 14, wherein the key management device determines the specific server. 19. The key management device according to claim 18, wherein the determination of the specific server is determined based only on information regarding a communication history from the authenticated mobile terminal device among communication histories including the connected server. A terminal ID for identifying a mobile terminal device, and a group ID storage unit for storing the group identification information for identifying a group to which the mobile terminal device belongs in association with each other;
A communication history storage unit that stores information about a communication history from an arbitrary mobile terminal device to an arbitrary server for each group;
The limited key management unit obtains a group to which the mobile terminal device authenticated by the authentication unit belongs from the terminal identification information and the group identification information of the group ID storage unit, and determines a server to which the mobile terminal device is currently connected. The server according to any one of claims 14 to 17, wherein the specific server is determined based on information to be specified and a communication history of a group to which the mobile terminal device belongs, including the connected server in the communication history storage unit. A key management device according to claim 1. A communication history storage unit that stores information on a communication history from any mobile terminal device to any server for each group,
A group to which the mobile terminal belongs, including the group identification information received from the mobile terminal, information identifying the currently connected server of the mobile terminal, and the connected server in the communication history storage unit. The key management device according to any one of claims 14 to 17, wherein the specific server is determined based on the communication history. A server group ID storage unit for storing server identification information for identifying a server and server group identification information for identifying a group to which the server belongs in association with each other;
The limited key generation unit generates a different limited key for each server group of the server specified by the limited key management unit based on the information in the server group ID storage unit,
The key management device according to any one of claims 14 to 17, wherein the limited key management unit distributes the different limited keys to the specified server. 22. The specific server is determined by selecting a predetermined number of servers or a server having a predetermined connection frequency or more in descending order of connection frequency from the currently connected server. A key management device according to claim 1. 24. The key management device according to claim 14, wherein the determination of the specific server is updated by a request from an arbitrary server. 25. The key management device according to claim 14, wherein the limited key management unit instructs the specific server to delete the limited key. The limited key management unit further includes a specific server to which the limited key is distributed, and a distribution destination storage unit that stores the limited key identification information that specifies the limited key in association with each other,
26. The key management device according to claim 25, wherein the limited key management unit extracts a specific server to which the limited key has been distributed from the distribution destination storage unit, according to the received limited key deletion request and the limited key identification information. . The key management device according to claim 14, wherein the specific server is a server located within a predetermined distance from a server currently connected to the mobile terminal device authenticated by the authentication unit. The key management device according to claim 14, wherein the specific server is a server located in a region where a server currently connected to the mobile terminal device authenticated by the authentication unit exists, or a server related to the server. A limited key generation device that generates a limited key for authentication with limited use conditions for each mobile terminal device,
A key management device that distributes the limited key generated by the limited key generation device to a specific server;
Using the limited key received from the key management device, a server that performs encrypted communication with the mobile terminal device,
An encrypted communication system comprising: a mobile terminal device that performs encrypted communication with the server using the limited key. A limited key generation device that generates a limited key for authentication with limited use conditions for each mobile terminal device,
A key management device that distributes the limited key generated by the limited key generation device to a specific server;
After authenticating the mobile terminal device using the limited key received from the key management device and the authentication information received from the mobile terminal device, perform encrypted communication with the mobile terminal device using the limited key. Server and
An encrypted communication system having a mobile terminal device that performs encrypted communication with the server using the limited key after authenticating the server using the limited key and the second authentication information received from the server. . A server according to claim 1,
A mobile terminal device according to claim 10,
An encryption communication system comprising the key management device according to claim 14. From the mobile terminal device owning a limited key for authentication with limited use conditions, transmitting authentication information and identification information for identifying the mobile terminal device to a server and requesting authentication,
When the server receives the authentication request and owns the same limited key as the limited key owned by the mobile terminal device, performs encrypted communication with the mobile terminal device using the limited key, When not owning the same limited key as the limited key, requesting the limited key generation device to generate the limited key for the mobile terminal device by transmitting the authentication information and the identification information,
The mobile terminal device is authenticated from the authentication information received by the limited key generation device and the authentication information held in advance, and the mobile terminal device is owned by the mobile terminal device based on at least a part of the authentication information and the authentication information. Generating a limited key identical to the limited key;
A step in which a key management device that manages the validity / invalidity of the limited key distributes the limited key generated by the limited key generation device to a specific server;
Receiving the limited key distributed by the server that has requested the generation of the limited key, and performing encrypted communication with the mobile terminal device that has requested authentication, using the limited key.

Images