JP2005057479A - Vpn communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To communicate with another client on the same VPN regardless of whether a VPN server is in operation. <P>SOLUTION: In equipment registration processing, e-Key chips 6a to 6f mounted on user terminals 5a to 5f are registered in a chip management center 2. In VPN service downloading processing, application software for VPN service is downloaded from a VPN service providing center 3 and installed in the e-Key chips 6a to 6f. Further, VPN keys are stored in the e-Key chips 6a to 6f in VPN key generation processing or VPN key sharing processing. The user terminals 5a to 5f belonging to the same VPN establish VPN connections by using the VPN keys stored in the e-Key chips 6a to 6f. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a VPN communication system in which a plurality of VPNs (Virtual Private Networks) are constructed on a network in which terminals can communicate with each other, and only communication between users belonging to the same VPN is performed.

  Conventionally, a VPN communication system includes a plurality of clients and a management server that distributes a communication encryption key for performing communication within the VPN between the clients via a communication network. The management server manages which VPN the client belongs to using an IP (Internet Protocol) address used by the client. Alternatively, as an improvement, the management server manages which VPN the user belongs to using the user ID of the user (see, for example, Patent Document 1).

In these, dedicated software (VPN server software) is installed, pre-set management server (VPN server, etc.), dedicated software (VPN software) is installed, and dedicated software This is realized by executing a cryptographic communication protocol that ensures security between clients that have been set in advance.
JP 2000-059357 A

  However, (1) If the management server is not operating during VPN connection, VPN connection cannot be performed. (2) The management server must also install and set up software for communicating with the dedicated software. (3) When a legitimate user uses a VPN with another client, the other client must install and set dedicated software. (4) Since dedicated software must be set for the specified VPN server, the communication partner cannot be immediately changed to a client belonging to another VPN. (5) Since client authentication is provided by another method, it is only possible to determine whether another client is a legitimate terminal by the presence of dedicated software.

  Therefore, the present invention can communicate with other clients belonging to the same VPN regardless of whether or not the VPN server operates, and reduces the work load related to software installation and setting in the VPN server and the client. The present invention relates to a VPN communication system capable of

  The VPN communication system according to claim 1 is a VPN communication system comprising a communication terminal equipped with a secure chip and a chip management center for managing the secure chip, wherein the communication terminal is a secret of the secure chip. Registration information signing means for signing registration information including the chip information of the secure chip and the public key of the secure chip using a key, and the registration using the public key of the chip administrator of the chip management center Registration information encryption means for encrypting the registration information signed by the information signature means into encrypted registration information, and the encrypted registration information obtained by encryption by the registration information encryption means Encryption registration information transmitting means for transmitting to the chip public key certificate receiver for receiving the chip public key certificate from the chip management center A chip public key certificate confirming unit that confirms the validity of the chip public key certificate received by the chip public key certificate receiving unit, and a chip public that stores the chip public key certificate in the secure chip A key certificate storage means, wherein the chip management center receives encrypted registration information receiving means for receiving the encrypted registration information from the communication terminal, and a secret key of the chip administrator of the chip management center. A registration information decrypting means for decrypting the encrypted registration information received by the encrypted registration information receiving means into the registration information with the signature; and decryption by the registration information decrypting means. A registration information signature verification means for verifying a signature of the obtained registration information using a public key of the secure chip included in the registration information; Chip public key certificate creating means for creating a chip public key certificate including the public key of the secure chip, and registration information for registering the registration information obtained by decryption by the registration information decryption means in a chip database And a chip public key certificate transmitting unit configured to transmit the chip public key certificate created by the chip public key certificate creating unit to the communication terminal.

  The VPN communication system according to claim 2 is a VPN communication system comprising a communication terminal equipped with a secure chip and a VPN service providing center for providing VPN service application software to the communication terminal, wherein the communication terminal The service provision request signing means for signing a service provision request for requesting the VPN service provision center to provide application software for VPN service using the secret key of the secure chip, and the service provision request signing means And a service provision request means for transmitting a service provision request signed by, and a chip public key certificate including the public key of the secure chip stored in the secure chip to the VPN service provision center, and the service provision request The chip official received by the receiving means Chip public key certificate verification means for verifying a key certificate, service reception means for receiving the VPN service application software from the VPN service providing center, and the VPN service application software received by the service reception means. Service installation means for installing in the secure chip, wherein the VPN service providing center receives the service providing request with the signature and the chip public key certificate received from the communication terminal. And a signature of the service provision request received by the service provision request receiving means using the public key of the secure chip included in the chip public key certificate received by the means and the service provision request receiving means Service provision request signature And testimony means, characterized in that the VPN service application software with a, a service transfer means for transferring to the communication terminal.

  The VPN communication system according to claim 3 provides a service for generating a communication encryption key for communication between a communication terminal equipped with a secure chip and the communication terminal belonging to the same VPN and delivering the communication encryption key to the communication terminal. A VPN communication system comprising a center, wherein the communication terminal requests the service providing center to generate a communication encryption key using a private key of a VPN service application stored in the secure chip An encryption key generation request signing means for signing an encryption key generation request to be performed, and the encryption key generation request signed by the encryption key generation request signing means using a public key of a service provider managing the service providing center Obtained by encryption by the encryption key generation request encryption unit and the encryption key generation request encryption unit. An encryption key generation request transmitting means for transmitting the public key certificate of the VPN service application stored in the secure chip to the service providing center, and a signature from the service providing center. Generated encryption key information receiving means for receiving the attached encrypted generation encryption key information, and the encrypted generated encryption key information received by the generated encryption key information receiving means using the public key of the service provider. Generated encryption key information for verifying signature, and generated encryption key information including a communication encryption key and an identifier of the communication encryption key using the private key of the VPN service application The generated encryption key information decrypting means for decrypting the generated encryption key information and the generated encryption key information obtained by the decryption by the generated encryption key information decrypting means. Generated encryption key information installation means to be installed in a secure chip, and the service providing center receives the encryption encryption key generation request and the public key certificate of the VPN service application from the communication terminal. Using an encryption key generation request receiving means, a service public key certificate verifying means for verifying a public key certificate of the VPN service application received by the encryption key generation request receiving means, and a secret key of the service provider An encryption key generation request decryption unit for decrypting the encryption key generation request received by the encryption key generation request reception unit into the encryption key generation request with the signature, and the VPN service application The encryption key obtained by decryption by the encryption key generation request decryption means using the public key of A generation request signature verification unit that verifies a signature of a key generation request; a communication encryption key generation unit that generates a communication encryption key to be distributed to the communication terminal; and the communication generated by the communication encryption key generation unit The communication generated by the communication encryption key generation means using a group information storage means for registering an encryption key and an identifier of the communication encryption key in a group information database, and a public key of the VPN service application Using the generated encryption key information encryption means for encrypting the generated encryption key information including the encryption key for encryption and the identifier of the communication encryption key into the encrypted generation encryption key information, and the secret key of the service provider, The generated encryption key information signing means for signing the encrypted generated encryption key information obtained by encryption by the generated encryption key encryption means, and the generated encryption key information signing means And wherein the cryptographically generated encryption key information with be equipped with a generating encryption key information transmitting means for transmitting to the communication terminal.

  The VPN communication system according to claim 4 provides a service for managing a communication encryption key for communication between a communication terminal having a secure chip and the communication terminal belonging to the same VPN, and delivering the same to the communication terminal. A VPN communication system including a center, wherein the communication terminal requests the service providing center to share a communication encryption key using a secret key of a VPN service application stored in the secure chip An encryption key sharing request signing means for signing an encryption key sharing request to be performed, and the encryption key sharing request signed by the encryption key sharing request signing means using a public key of a service provider managing the service providing center Obtained by encryption by the encryption key sharing request encryption unit and the encryption key sharing request encryption unit. An encryption key sharing request transmitting means for transmitting to the service providing center an encryption key sharing request and a public key certificate of the VPN service application stored in the secure chip, and a signature from the service providing center. Shared encryption key information receiving means for receiving the attached encrypted shared encryption key information, and the encrypted shared encryption key information received by the shared encryption key information receiving means using the public key of the service provider. Shared encryption key information for verifying a signature, and shared encryption key information including a communication encryption key and an identifier of the communication encryption key using the private key of the VPN service application The shared encryption key information decrypting means for decrypting the encrypted information, and the shared encryption key information obtained by the decryption by the shared encryption key information decrypting means. Shared encryption key information installation means installed in the secure chip, and the service providing center receives the encrypted encryption key sharing request and the public key certificate of the VPN service application from the communication terminal. Using an encryption key sharing request receiving means, a service public key certificate verifying means for verifying a public key certificate of the VPN service application received by the encryption key sharing request receiving means, and using the public key of the service provider An encryption key sharing request decrypting means for decrypting the encrypted encryption key sharing request received by the encryption key sharing request receiving means into the encryption key sharing request with the signature; and Using the secret key, the signature of the encryption key sharing request obtained by decryption by the encryption key sharing request decrypting means is A shared request signature verification means for verifying, a communication encryption key search means for searching for a communication encryption key distributed to the communication terminal, and a group information additional registration means for additionally registering user information of the user terminal in a group information database; The shared encryption key information including the communication encryption key searched by the communication encryption key search means and the identifier of the communication encryption key is encrypted using the public key of the VPN service application. Signing the encrypted shared encryption key information obtained by encryption by the shared encryption key encryption means using the shared encryption key information encryption means for encrypting the key information and the secret key of the service provider Shared encryption key information signing means, and a shared encryption key for transmitting the encrypted shared encryption key information signed by the shared encryption key information signing means to the communication terminal Characterized by comprising a multi-address transmission means.

  The VPN communication system according to claim 5 is a VPN communication system comprising a communication terminal equipped with a secure chip, wherein the communication terminal uses the communication encryption key stored in the secure chip to make the same VPN. It is characterized by performing encrypted communication with other communication terminals to which it belongs.

  According to the present invention, it is possible to communicate with other clients belonging to the same VPN regardless of the operation of the VPN server, and to reduce the work load related to software installation and setting in the VPN server and the client. Can do.

DESCRIPTION OF EMBODIMENTS Preferred embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing an outline of a VPN communication system according to an embodiment of the present invention. The VPN communication system 1 includes a chip management center 2 having a chip information database, a VPN service providing center 3 having a user information database (for example, a user registers his / her user information in advance) and a group information database. User identification service center 4 and user terminals (corresponding to communication terminals) 5a to 5f equipped with e-Key chips (corresponding to secure chips) 6a to 6f are provided, each connected to the Internet. Yes. In the VPN communication system 1, device registration processing (processing for registering an e-Key chip in the chip management center), VPN service download processing (processing for downloading VPN service application software to a communication terminal), VPN key generation processing (newly) VPN key generation processing), VPN key sharing processing (processing for sharing a VPN key among a plurality of communication terminals), VPN construction processing (processing for establishing a VPN connection between communication terminals belonging to the same VPN group), VPN key invalidation Processing (processing for invalidating the VPN key in the user terminal) is executed. Hereinafter, various processes will be described in order. In addition, a personal computer, a mobile phone, a portable information terminal, etc. are mentioned as a communication terminal.

<Device registration processing>
FIG. 2 is a diagram showing a configuration related to the device registration process of the VPN communication system. Note that the e-Key chips 6a to 6f before the device registration process are started include the public key (hereinafter referred to as chip public key) and the private key (hereinafter referred to as chip private key) of the e-Key chips 6a to 6f. ) And a chip manager public key of the chip management center 2 (hereinafter referred to as a chip manager public key).
As shown in FIG. 2, the user terminals 5a to 5f include a card transmission / reception unit 51a, transmission / reception unit (encrypted registration information transmission unit, chip public key certificate reception unit) 51b, registration information signature unit 51c, registration information encryption unit. 51d, chip public key certificate confirmation means 51e, and chip public key certificate storage means 51f. The card transmitting / receiving means 51 a transmits the encrypted registration information to the personal authentication IC card 7 and receives the encrypted registration information with the personal signature from the personal authentication IC card 7. The transmission / reception means 51b transmits the encrypted registration information with the personal signature to the chip management center 2 and receives a chip public key certificate (a certificate proving that the chip public key is correct) from the chip management center 2. .

  The registration information signing means 51c uses the chip secret key stored in the e-Key chips 6a to 6f to register the registration information (chip information of the e-Key chips 6a to 6f and the e-key). The chip public key stored in the key chips 6a to 6f is signed. The registration information encryption unit 51d encrypts the registration information signed by the registration information signature unit 51c into encrypted registration information using the chip administrator public key stored in the e-Key chips 6a to 6f. To do.

  The chip public key certificate confirmation unit 51e confirms the validity of the chip public key certificate received by the transmission / reception unit 51b. This confirmation is made by using the chip manager public key stored in the e-Key chips 6a to 6f and using the signature (chip manager private key (hereinafter referred to as chip manager private key) included in the chip public key certificate. This is done by verifying the signature) that is created using. The chip public key certificate storage unit 51f stores the chip public key certificate, which has been validated by the chip public key certificate confirmation unit 51e, in the e-Key chips 6a to 6f.

  As shown in FIG. 2, the chip management center 2 includes transmission / reception means (encrypted registration information reception means, chip public key certificate transmission means) 21a, registration information decryption means 21b, registration information signature verification means 21c, chip public key. Certificate creation means 21d and registration information registration means 21e are provided. The transmission / reception means 21a receives the encrypted registration information with the principal signature from the user terminals 5a to 5f and transmits the chip public key certificate to the user terminals 5a to 5f. In addition, a personal identification request is transmitted to the personal identification service center 4 and a personal identification result is received from the personal identification service center 4.

  The registration information decryption means 21b decrypts the encrypted registration information received by the transmission / reception means 21a into the signed registration information using the chip manager private key. The registration information signature verification unit 21c verifies the signature of the registration information using the chip public key included in the registration information with the signature obtained by decryption by the registration information decryption unit 21b. When the registration information signature verification unit 21c determines that the signature is correct, the chip public key certificate creation unit 21d includes a chip public key included in the registration information obtained by decryption by the registration information decryption unit 21b. Create a public key certificate. However, the chip public key certificate includes a signature created using the chip manager private key. When the registration information signature verification unit 21c determines that the signature is correct, the registration information registration unit 21e stores the registration information (chip information and chip public key) obtained by decryption by the registration information decryption unit 21b in the chip information database. Store.

FIG. 3 is a diagram showing a procedure of device registration processing in the VPN communication system.
In the user terminals 5a to 5f, the registration information signing means 51c uses the chip secret key to register the registration information of the e-Key chips 6a to 6f (the chip information of the e-Key chips 6a to 6f and the e-Key chip 6a to 6f). The chip public key stored in 6f is signed (S101). Subsequently, the registration information encryption unit 51d encrypts the registration information with the signature obtained in S101 into the encrypted registration information using the chip administrator public key (S102). Then, the encrypted registration information obtained in S102 from the card transmitting / receiving means 51a is transmitted to the personal authentication IC card 7 (S103).

  When the encrypted registration information is received from the user terminals 5a to 5f in the personal authentication IC card 7, the encrypted registration information is signed using the IC card private key (S104). Then, the encrypted registration information with the personal signature obtained in S104 is transmitted to the user terminals 5a to 5f (S105). In the user terminals 5a to 5f, when the encrypted registration information with the principal signature is received by the card transmission / reception means 51a, the encrypted registration information with the principal signature is chip-managed by the transmission / reception means 51b from the user terminals 5a to 5f. It is transmitted to the center 2 (S106).

  In the chip management center 2, when the encrypted registration information with the personal signature is received by the transmission / reception means 21a, the encrypted registration information with the personal signature is transmitted to the IC card personal identification service center 4 by the transmission / reception means 21a. An identity confirmation request is made to the IC card identity confirmation service center 4 (S107). The IC card identity verification service center 4 requested to confirm the identity verifies the identity signature (signature of S104) by using the IC card public key to confirm the identity, and the identity confirmation result is transmitted to the chip management center 2. (S108).

  When the chip management center 2 is notified of the identity, the registration information decryption unit 21b uses the chip manager private key to register the encrypted registration information received by the transmission / reception unit 21a with a signature. The information is decrypted (S109). Subsequently, the registration information signature verification unit 21c verifies the registration information signature (S101 signature) using the chip public key included in the registration information with the signature obtained in S109 (S110). When it is determined that the signature is correct, the chip public key certificate creating unit 21d creates a chip public key certificate including the chip public key included in the registration information obtained in S109 (S111). Subsequently, the registration information registration unit 21e stores the chip information and the chip public key included in the registration information obtained in S109 in the chip information database (S112). Then, the chip public key certificate created in S111 is transmitted from the transmission / reception means 21a to the user terminals 5a to 5f (S113).

  In the user terminals 5a to 5f, when the chip public key certificate is received by the transmission / reception means 51b, the chip public key certificate confirmation means 51e confirms the validity of the chip public key certificate (S114). When it is confirmed that the chip public key certificate is valid, the chip public key certificate storage unit 51f stores the chip public key certificate received by the transmission / reception unit 51b in the e-Key chips 6a to 6f. (S115).

  In the device registration process, the identity verification IC card is used to confirm the identity. However, the present invention is not limited to this, and the user directly inputs authentication information in the user terminals 5a to 5f. You may make it transmit to the chip | tip management center 2 with registration information. If security is not a problem, the encrypted registration information may be transmitted from the transmission / reception means 51b except for the process of performing personal authentication (S104, S107, S108). In addition, the information of the user who performed the registration process may be registered together in the chip information database.

<< VPN service download process >>
FIG. 4 is a diagram showing a configuration related to VPN service download processing of the VPN communication system. The e-Key chips 6a to 6f before starting the VPN service download process include a chip public key and a chip private key, a chip manager public key, and a chip public key certificate (stored by the device registration process). ) Is stored at least.

  As shown in FIG. 4, the user terminals 5a to 5f include transmission / reception means (service provision means, service reception means) 52a, service provision request signing means 52b, service installation means 52c, and personalization means 52d. The transmission / reception unit 52a sends a signed service download request (corresponding to a service provision request) and a chip public key certificate including a chip public key stored in the e-Key chips 6a to 6f to the VPN service provision center. 3, and VPN service application software 3 (software for securing memory in the e-Key chips 6 a to 6 f) is received from the VPN service providing center 3. The service provision request signing means 52b uses the chip secret key stored in the e-Key chips 6a to 6f to sign a service download request for requesting downloading of VPN service application software. The service installation unit 52c installs VPN service application software received by the transmission / reception unit 52a in the e-Key chips 6a to 6f. The personalization means 52d personalizes with personalized data encrypted using the chip public key and the service provider private key (generates a key on the service application).

As shown in FIG. 4, the VPN service providing center 3 includes transmission / reception means 32a, service provision request signature verification means 32b, and transfer availability determination means 32c.
The transmission / reception means 32a receives the signed service download request and the chip public key certificate from the user terminals 5a to 5f, and transfers the VPN service application software to the user terminals 5a to 5f. In addition, a download permission request is transmitted to the chip management center 2, and a determination result of whether download is permitted or not is received from the chip management center 2. The service provision request signature verification unit 32b verifies the signature of the service download request received by the transmission / reception unit 32a using the chip public key included in the chip public key certificate received by the transmission / reception unit 32a. The transfer enable / disable determining unit 32c determines whether or not the VPN service application software can be transferred to the user terminals 5a to 5f in consideration of the user's previous situation.

FIG. 5 is a diagram showing a procedure of VPN service download processing in the VPN communication system.
In the user terminals 5a to 5f, the service provision request signing unit 52b signs the service download request using the chip secret key (S201). Then, the service download request and the chip public key certificate signed in S201 are transmitted from the transmission / reception means 52a to the VPN service providing center 3 (S202).

  When the VPN service providing center 3 receives the signed service download request and the chip public key certificate by the transmitting / receiving unit 32a, the service providing request signature verifying unit 32b reads the chip public key included in the chip public key certificate. The signature of the service download request (S201 signature) is verified using the key (S203). When it is determined that the signature is correct, a download permission request is transmitted from the transmission / reception means 32a to the chip management center 2 (S204). In the chip management center 2, when there is a download permission request from the VPN service providing center 3, based on whether or not the e-Key chips 6a to 6f of the user terminals 5a to 5f that have made the service download request are registered in the chip information database. Then, it is determined whether or not the VPN service application software can be downloaded, and the VPN service providing center 3 is notified of whether or not download is possible (S205).

  In the VPN service providing center 3, when there is a download permission notification from the chip management center 2, the transfer permission determination unit 32c determines whether the VPN service application software can be downloaded (S206). When the download is permitted, the VPN service application software is transferred from the transmission / reception means 32a to the user terminals 5a to 5f by encrypted communication (S207).

  In the user terminals 5a to 5f, when the VPN service application software is received by the transmission / reception means 52a, the service installation means 52c installs the VPN service application software in the e-Key chips 6a to 6f (S208). Subsequently, the personalizing means 52d personalizes the personalized data encrypted using the chip public key and the service provider private key (S209). The VPN service download process may be created so as not to include the process of S209. Further, it may be verified before installation whether or not the application software itself is correct. Further, the result of installation and personalization may be notified to the VPN service providing center.

<< VPN key generation process >>
FIG. 6 is a diagram showing a configuration related to VPN key generation processing of the VPN communication system. The e-Key chips 6a to 6f before starting the VPN key generation process include a chip public key and a chip private key, a chip manager public key, a service AP public key and a service AP private key, and a VPN service center management. The public key (service provider public key) of the VPN service provider that manages the service provider and the service AP public key certificate are stored. However, the service AP public key, service AP private key, service provider public key, and service AP public key certificate are appropriately stored in the e-Key chips 6a to 6f after the VPN service download process. The service AP public key certificate includes a service AP public key and is a VPN service provider private key or a third party private key recognized by the VPN service provider (hereinafter referred to as a service provider private key). There is a signature made.

  As shown in FIG. 6, the user terminals 5 a to 5 f include transmission / reception means (encryption key generation request transmission means, generated encryption key information reception means) 53 a, encryption key generation request signature means 53 b, encryption key generation request encryption means 53 c, A generation encryption key information signature verification unit 53d, a generation encryption key information decryption unit 53e, and a generation encryption key information installation unit 53f are provided. The transmission / reception means 53a sends the encryption service key generation request to the VPN service providing center 3, the service AP public key certificate stored in the e-Key chips 6a to 6f, and use permission conditions (expiration date, number of times used, etc.). At the same time as transmission, it receives encrypted generated encryption key information with a signature including a VPN key, an identifier (key ID) of the VPN key, expiration date information, and the like. The encryption key generation request signing means 53b uses the service AP private key stored in the e-Key chips 6a to 6f to the VPN service providing center 3 to provide a VPN key (corresponding to a communication encryption key). Sign a cryptographic key generation request that requests generation of. The encryption key generation request encryption unit 53c encrypts the encryption key generation request signed by the encryption key generation request signing unit 53b using the service provider public key stored in the e-Key chips 6a to 6f. Encrypt in the encryption key generation request.

  The generated encryption key information signature verification unit 53d verifies the signature of the encrypted generated encryption key information received by the transmission / reception unit 53a using the service provider public key stored in the e-Key chips 6a to 6f. . When the generated cryptographic key information signature verifying unit 53d determines that the signature is correct, the generated cryptographic key information decrypting unit 53e uses the service AP private key stored in the e-Key chips 6a to 6f to transmit / receive The encrypted generated encryption key information received by the means 53a is decrypted into generated encryption key information including a VPN key, a key ID, expiration date information, and the like. The generated encryption key information installation unit 53f installs the generated encryption key information (VPN key, key ID, expiration date information, etc.) obtained by the decryption by the generated encryption key information decryption unit 53e in the e-Key chips 6a to 6f. .

  As shown in FIG. 6, the VPN service providing center 3 includes transmission / reception means (encryption key generation request reception means, generated encryption key information transmission means) 33a, service AP public key certificate verification means (service public key certificate verification means). 33b, key generation possibility verification means 33c, encryption key generation request decryption means 33d, generation request signature verification means 33e, communication encryption key creation means 33f, addition means 33g, group information storage means 33h, generated encryption key information encryption means 33i and generated encryption key information signing means 33j.

  The transmission / reception means 33a transmits encrypted generation encryption key information with a signature including a VPN key, an identifier (key ID) of the VPN key, expiration date information, and the like to the user terminals 5a to 5f, and the user terminals 5a to 5f. Receives an encryption encryption key generation request, a service AP public key certificate stored in the e-Key chips 6a to 6f, and use permission conditions (expiration date, number of times used, etc.). The service AP public key certificate verifying unit 33b verifies the validity of the service AP public key certificate (performs user authentication). Specifically, it is performed by verifying the signature of the service AP public key certificate using the service provider public key. The key generation possibility verification unit 33c determines whether or not the user can generate a key based on the use permission condition. The encryption key generation request decryption means 33d uses the service provider private key to decrypt the encrypted encryption key generation request received by the transmission / reception means 33a into a signed encryption key generation request. The generation request signature verification unit 33e verifies the signature of the encryption key generation request obtained by the decryption by the encryption key generation request decryption unit 33d using the service AP public key.

  The communication encryption key generation unit 33f determines that the service AP public key certificate is correct by the service AP public key certificate verification unit 33b, and determines that the key can be generated by the key generation capability verification unit 33c. If the generation request signature verification unit 33e determines that the signature is correct, a VPN key is generated. The adding unit 33g adds the additional information such as the VPN key identifier (key ID) and the expiration date information included in the use permission conditions from the user terminals 5a to 5f to the VPN key generated by the communication encryption key generating unit 33f. Append. The group information storage unit 33h includes group information (a VPN key generated by the communication encryption key generation unit 33f, additional information added to the VPN key by the addition unit 33g, and an encryption key generation registered in the user information database). Register the requested user information) in the group information database. The generated encryption key information encryption unit 33i uses the service AP public key included in the service AP public key certificate to encrypt and generate the VPN key (generated encryption key information) added with the additional information by the addition unit 33g. Encrypt to encryption key information. The generated encryption key information signing means 33j signs the encrypted generated encryption key information obtained by the generated encryption key information encryption means 33i using the service provider private key.

FIG. 7 is a diagram showing a procedure of VPN key generation processing in the VPN communication system.
In the user terminals 5a to 5f, the encryption key generation request signing means 53b signs the encryption key generation request using the service AP private key (S301). Subsequently, the encryption key generation request encryption unit 53c encrypts the encryption key generation request with the signature obtained in S301 into the encryption encryption key generation request using the service provider public key (S302). Then, the encrypted encryption key generation request, the service AP public key certificate, and the use permission condition obtained in S302 are transmitted from the transmission / reception means 53a to the VPN service providing center 3 (S303).

  In the VPN service providing center 3, when the transmission / reception means 33a receives an encryption / decryption key generation request or the like, the service AP public key certificate verification means 33b verifies the service AP public key certificate and also verifies the key generation possibility verification means. It is determined whether or not the user 33c is a user who can generate a key (S304). Subsequently, the encryption key generation request decryption means 33d uses the service provider private key to decrypt the encryption encryption key generation request into a signed encryption key generation request (S305). Subsequently, the generation request signature verification unit 33e verifies the signature (S301 signature) of the encryption key generation request using the service AP public key (S306). If the service AP public key certificate is valid, the user can generate a key, and the signature of the encryption key generation request is correct, the communication encryption key generation unit 33f generates a VPN key (S307). ). Subsequently, the adding unit 33g adds additional information (key ID, expiration date information, etc.) to the VPN key generated in S307 (S308). Subsequently, the group information storage unit 33h registers the group information (VPN key, additional information, and user information) in the group information database (S309). In addition, the generated encryption key information encryption unit 33i encrypts the generated encryption key information including the VPN key and the additional information into the encrypted generated encryption key information using the service AP public key (S310). Subsequently, the generated encryption key information signing means 33j uses the service provider private key to sign the encrypted generated encryption key information obtained in S310 (S311). Then, the encryption / decryption encryption key information signed by S311 is transmitted from the transmitting / receiving means 33a to the user terminals 5a to 5f (S312).

  In the user terminals 5a to 5f, when the encrypted generated encryption key information with the signature is received by the transmission / reception unit 53a, the generated encryption key information signature verification unit 53d uses the service provider public key to generate the encrypted generated encryption key. The signature of the key information (signature of S311) is verified (S313). If the signature is correct, the generated encryption key information decrypting means 53e decrypts the encrypted generated encryption key information into the generated encryption key information using the service AP private key (S314). Subsequently, the generated encryption key information installation unit 53f installs the generated encryption key information (VPN key, key ID, expiration date information, etc.) obtained by the decryption in S314 in the e-Key chips 6a to 6f (S315). .

<< VPN key sharing process >>
FIG. 8 is a diagram showing a configuration related to the VPN key sharing process of the VPN communication system. The e-Key chips 6a to 6f before starting the VPN key sharing process are substantially the same as the state before starting the VPN key generation process, except for the VPN key and information related thereto.
As shown in FIG. 8, the user terminals 5a to 5f are configured to send and receive means (encryption key sharing request sending means, shared encryption key information receiving means) 54a, search request means 54b, encryption key sharing request signature means 54c, encryption key sharing request An encryption unit 54d, a shared encryption key information signature verification unit 54e, a shared encryption key information decryption unit 54f, and a shared encryption key information installation unit 54g are provided.

  The transmission / reception means 54a transmits the encrypted encryption key sharing request, the service AP public key certificate stored in the e-Key chips 6a to 6f, and the key ID to the VPN service providing center 3, and the VPN service providing center 3 From the search result including the key ID of the VPN desired to participate, and the encrypted shared encryption key information with the signature including the VPN key, the identifier (key ID) of the VPN key, the expiration date information, and the like. The search request means 54b requests the VPN service providing center 3 to search for a VPN that is desired to participate. The encryption key sharing request signing unit 54c uses the service AP private key stored in the e-Key chips 6a to 6f to make an encryption key sharing request for requesting the VPN service providing center 3 to share the VPN key. Sign. The encryption key sharing request encryption unit 54d encrypts the encryption key sharing request signed by the encryption key sharing request signing unit 54c using the service provider public key stored in the e-Key chips 6a to 6f. Encrypt to encrypted encryption key sharing request.

  The shared encryption key information signature verification unit 54e verifies the signature of the encrypted shared encryption key information using the service provider public key stored in the e-Key chips 6a to 6f. The shared encryption key information decryption unit 54f encrypts using the service AP private key stored in the e-Key chips 6a to 6f when the shared encryption information signature verification unit 54e determines that the signature is correct. The shared encryption key information is decrypted into shared encryption key information including a VPN key, a key ID, expiration date information, and the like. The shared encryption key information installation unit 54g installs shared encryption key information (VPN key, key ID, expiration date information, etc.) obtained by decryption by the shared encryption key information decryption unit 54f in the e-Key chips 6a to 6f. .

  As shown in FIG. 8, the VPN service providing center 3 includes transmission / reception means (encryption key sharing request receiving means, shared encryption key information transmitting means) 34a, participation desired VPN search means 34b, service AP public key certificate verification means (service Public key certificate verification means) 34c, encryption key sharing request decryption means 34d, sharing request signature verification means 34e, participation target VPN search means 34f, sharable verification means 34g, user information additional registration means 34h, shared encryption key information encryption Providing means 34i and shared encryption key information signing means 34j.

  The transmission / reception means 34a includes a search result including a VPN key ID that the user terminal wishes to join the user terminals 5a to 5f, a signature including a VPN key, an identifier (key ID) of the VPN key, expiration date information, and the like. The attached encrypted shared encryption key information is transmitted and stored in the VPN search request, the encrypted encryption key sharing request, the VPN key ID of the participation target, and the e-Key chips 6a to 6f from the user terminals 5a to 5f. The service AP public key certificate being received is received. The participation desired VPN search means 34b searches the VPN that the user terminal desires to participate with reference to the group information database, and passes the search result such as the key ID to the user terminals 5a to 5f via the transmission / reception means 34a. The service AP public key certificate verification unit 34c verifies the validity of the service AP public key certificate (authenticates the user) by the same method as the service AP public key certificate verification unit 33b. The encryption key sharing request decryption means 34d uses the service provider private key to decrypt the encrypted encryption key sharing request received by the transmission / reception means 34a into a signed encryption key sharing request. The sharing request signature verification unit 34e verifies the signature of the encryption key sharing request obtained by the decryption by the encryption key sharing request decryption unit 34d, using the service AP public key included in the service AP public key certificate. When the service AP public key certificate verifying unit 34c determines that the service AP public key certificate is correct and the sharing request signature verifying unit 34e determines that the signature is correct, the participation target VPN search unit 34f The group information is searched based on the key ID received by the transmission / reception means 34a. The sharable verification unit 34g verifies whether the VPN key can be shared, for example, by checking whether the expiration date has passed. If the user information additional registration unit 34h determines that sharing is possible by the sharable verification unit 34g, the user information additional registration unit 34h is associated with the key ID received by the transmission / reception unit 34a. User information) stored in the group information database.

  The shared encryption key information encryption unit 34i encrypts the shared encryption key information including the VPN key, the key ID, the expiration date information, and the like stored in the group information database using the service AP public key. Encrypt to The shared encryption key information signing means 34j signs the encrypted shared encryption key information obtained by the shared encryption key information encryption means 34i using the service provider private key.

FIG. 9 is a diagram showing a procedure of VPN key sharing processing in the VPN communication system. It is assumed that the user terminal 5a requests sharing of the VPN key, and the user terminal 5b participates in the VPN of the VPN key requested to be shared.
In the user terminal 5a, the search request unit 54b requests the VPN service providing center 3 to search for a VPN that the user desires to participate in (S401). On the other hand, in the VPN service providing center 3, the desired VPN search means 34b searches for the VPN that the user wishes to participate in, and sends the search result including the key ID to the user terminal 5a (S402). In the user terminal 5a, when the search result is received by the transmission / reception unit 54a, the encryption key sharing request signing unit 54c signs the encryption key sharing request using the service AP private key (S403). Subsequently, the encryption key sharing request encryption unit 54d encrypts the encryption key sharing request with the signature obtained in S403 into the encryption encryption key sharing request using the service provider public key (S404). Then, the encryption / cipher key sharing request obtained in S404 from the transmission / reception means 54a, the key ID notified as the search result, and the service AP public key certificate are transmitted to the VPN service providing center 3 (S405).

  In the VPN service providing center 3, when an encryption / cipher key sharing request or the like is received by the transmission / reception unit 34a, the service AP public key certificate verification unit 34c verifies the service AP public key certificate (S406). Subsequently, the encryption key sharing request decryption means 34d decrypts the encrypted encryption key sharing request received by the transmission / reception means 34a into a signed encryption key sharing request using the service provider private key ( S407). Subsequently, the sharing request signature verification unit 34e verifies the signature of the encryption key sharing request (signature of S403) using the service AP public key (S408). If the service AP public key certificate is valid and the signature of the encryption key sharing request is correct, the participation target VPN search unit 34f searches for the participation target VPN (S409). Subsequently, the shareability verification unit 34g verifies whether or not the VPN key can be shared (S410). When sharing is permitted, the user information additional registration unit 34h registers the user information in the group information database (S411). The shared encryption key information encryption unit 34i encrypts the shared encryption key information including the VPN key and the additional information into the encrypted shared encryption key information using the service AP public key (S412). Subsequently, the shared encryption key information signing means 34j signs the encrypted shared encryption key information obtained in S412 using the service provider private key (S413). Then, the encrypted shared encryption key information signed by S413 is transmitted from the transmission / reception means 34a to the user terminal 5a (S414). At the same time, a new participant is notified to the user terminal 5b (S418).

  When the user terminal 5a receives the encrypted shared encryption key information signed by the transmission / reception unit 54a, the shared encryption key information signature verification unit 54e uses the service provider public key to encrypt the shared encryption key information. (S413) is verified (S415). If the signature is correct, the shared encryption key information decrypting unit 54f decrypts the encrypted shared encryption key information into the shared encryption key information using the service AP private key (S416). Subsequently, the shared encryption key information installation unit 54g installs the shared encryption key information (VPN key, key ID, expiration date information, etc.) obtained by the decryption in S416 in the e-Key chip 6a (S417).

<< VPN construction process >>
In the VPN construction process of the VPN communication system, communication is performed between the user terminals 5a to 5f in which the same VPN key is stored in the e-Key chips 6a to 6f. At this time, in the user terminals 5a to 5f, the VPN key attributes (expiration date, number of times of use, etc.) are verified.

FIG. 10 is a diagram illustrating a procedure of VPN construction processing in the VPN communication system. Note that communication is performed between the user terminal 5a and the user terminal 5b.
In each of the user terminal 5a and the user terminal 5b, the attributes (such as the number of uses and the expiration date) of the VPN key to be used are verified (S501, S502). If the VPN key can be used by both the user terminal 5a and the user terminal 5b, encrypted communication is performed using the VPN key defined between the user terminal 5a and the user terminal 5b (S503).

<< VPN key invalidation process >>
FIG. 11 is a diagram showing a configuration related to the VPN key invalidation process of the VPN communication system. The e-Key chips 6a to 6f before starting the VPN key invalidation process include a chip public key and a chip private key, a chip manager public key, a service AP public key and a service AP private key, and a service provider public key. , At least information related to the service AP public key certificate and the VPN key.

  As shown in FIG. 11, the user terminals 5a to 5f include a transmission / reception unit 56a, an attribute verification unit 56b, an encryption key deletion unit 56c, an information deletion request signature unit 56d, and a judgment notification information signature verification unit 56e. The transmission / reception unit 56a transmits an information deletion request and the service AP public key certificate stored in the e-Key chips 6a to 6f to the VPN service providing center 3, and receives determination notification information from the VPN service providing center 3. . The attribute verification unit 56b verifies the attribute (such as an expiration date) of the VPN key that is desired to be used. If the attribute verification unit 56b determines that the encryption key deletion unit 56c cannot be used (the expiration date has passed), the encryption key deletion unit 56c deletes the VPN key that is the verification target from the e-Key chips 6a to 6f. If the attribute deletion means 56b determines that the information deletion request signing means 56d is unusable, the information deletion request signing means 56d is stored in the e-Key chips 6a to 6f using the service AP private key stored in the e-Key chips 6a to 6f. The key ID and the information deletion request for requesting the VPN service providing center 3 to delete the user information are signed. The determination notification information signature verification unit 56e verifies the signature of the determination notification information received by the transmission / reception unit 56a using the service provider public key stored in the e-Key chips 6a to 6f.

  As shown in FIG. 11, the VPN service providing center 3 includes a transmission / reception unit 36a, a service AP public key certificate verification unit 36b, a deletion request signature verification unit 36c, a deletion target VPN search unit 36d, an availability determination unit 36e, and group information. An updating unit 36f and a determination notification information signing unit 36g are provided. The transmission / reception means 36a receives information deletion requests from the user terminals 5a to 5f and transmits determination notification information to the user terminals 5a to 5f. The service AP public key certificate verifying unit 36b performs substantially the same processing as the service AP public key certificate verifying unit 33b to verify the service AP public key certificate (performs device authentication). When the service AP public key certificate verification unit 36b determines that the service AP public key certificate is correct, the deletion request signature verification unit 36c uses the service AP public key to receive the key ID received by the transmission / reception unit 36a. And the signature of the information deletion request are verified. If the deletion request signature verification unit 36c determines that the signature is correct, the deletion target VPN search unit 36d searches the information group database for the deletion target VPN based on the key ID received by the transmission / reception unit 36a. The availability determination unit 36e confirms the expiration date of the VPN searched by the deletion target VPN search unit 36d and determines the availability. The group information update unit 36f deletes the user information included in the VPN group information retrieved from the group information database when it is disabled by the availability determination unit 36e. The determination notification information signing means 36g uses the VPN service provider private key to sign the determination notification information including the fact that the user information has been deleted and the key ID is deleted.

FIG. 12 is a diagram illustrating a procedure of VPN key invalidation processing in the VPN communication system. It is assumed that the user terminal 5a makes a deletion request and the user terminal 5b is participating in the VPN that is the target of the deletion request.
In the user terminal 5a, the attribute verification unit 56b verifies the attribute of the VPN key desired to be used (S601). If the VPN key cannot be used, the encryption key deleting unit 56c deletes the VPN key from the e-Key chip 6a (S602). Subsequently, the information deletion request signing unit 56d signs the key ID and the information deletion request using the service AP private key (S603). Then, the information deletion request with the signature, the key ID, and the service AP public key certificate are transmitted from the transmission / reception means 56a to the VPN service providing center 3 (S604).

  In the VPN service providing center 3, when the information deletion request and the key ID and the service AP public key certificate with the signature are received from the user terminal 5a by the transmission / reception unit 36a, the service AP public key certificate verification unit 36b The AP public key certificate is verified (S605). Subsequently, if it is determined that the service AP public key certificate is correct, the deletion request signature verification unit 36c verifies the signature of the information deletion request (signature of S603) using the service AP public key (S606). Subsequently, when it is determined that the signature is correct, the deletion target VPN search unit 36d searches for a deletion target VPN (S607). Subsequently, the availability determination unit 36e determines whether the VPN key can be used (S608). If it is determined that it cannot be used, the group information updating unit 36f deletes the user information from the group information database (S609). Further, the determination notification information signing means 36g signs the determination notification information using the service provider private key (S610). Then, determination notification information with a signature is transmitted to the user terminal 5a by the transmission / reception means 36a (S611), and the member whose VPN key is invalid is notified to the other user terminal 5b belonging to the VPN to be deleted (S613). ).

  In the user terminal 5a, when the determination notification information is received by the transmission / reception means 56a, the determination notification information signature verification means 56e verifies the signature of the determination notification information (signature of S610) using the service provider public key ( S612). Thereafter, by analyzing the judgment notification information, it is possible to know that its own user information has been deleted from the group information database of the VPN service providing center 3.

  A plurality of different VPN keys can be stored in the e-Key chips 6a to 6f by performing the VPN key generation process or the VPN key sharing process a plurality of times.

  According to the embodiment described above, since the VPN connection is established using the VPN key stored in the e-Key chips 6a to 6f, the same VPN can be used even if the VPN service providing center is not operating. VPN connection can be established between the user terminals belonging to. In addition, since the load on the user terminal during VPN connection is reduced (a process for requesting an encryption key from the center each time a VPN connection is made), it is possible to cope with VPN connections of a large number of user terminals. Furthermore, it is possible to construct a network platform that provides various services (membership service, content distribution, remote maintenance of information devices, etc.) that require a safe information service mechanism. In addition, since the users and the like are managed by the VPN service providing center, for example, it is possible to realize a service for charging users and the like.

  It should be noted that the procedure executed by each means constituting each device described in the device registration process, VPN service download process, VPN key generation process, VPN key sharing process, VPN construction process, and VPN invalidation process is a program format. Thus, each apparatus of the present invention may be realized by recording on a computer-readable recording medium, causing the computer to read the program recorded on the recording medium, and executing the program. And each said process may be performed using each apparatus implement | achieved in this way. Here, the computer-readable recording medium refers to a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, and the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  The preferred embodiments of the present invention have been described above, but the present invention is not limited to the above-described embodiments, and various design changes can be made as long as they are described in the claims. Yes.

The figure which shows the outline | summary of the VPN communication system in embodiment of this invention. The figure which shows the structure relevant to the apparatus registration process of a VPN communication system. The figure which shows the procedure of the apparatus registration process of a VPN communication system. The figure which shows the structure relevant to the VPN service download process of a VPN communication system. The figure which shows the procedure of the VPN service download process of a VPN communication system. The figure which shows the structure relevant to the VPN key production | generation process of a VPN communication system. The figure which shows the procedure of the VPN key production | generation process of a VPN communication system. The figure which shows the structure relevant to the VPN key sharing process of a VPN communication system. The figure which shows the procedure of the VPN key sharing process of a VPN communication system. The figure which shows the procedure of the VPN construction process of a VPN communication system. The figure which shows the structure relevant to the VPN key invalidation process of a VPN communication system. The figure which shows the procedure of the VPN key invalidation process of a VPN communication system.

Explanation of symbols

1 VPN communication system, 2 chip management center, 3 VPN service providing center, 4 identity verification service center, 5a-5f user terminal, 6a-6f e-Key chip

Claims (5)

A VPN communication system comprising a communication terminal equipped with a secure chip and a chip management center for managing the secure chip,
The communication terminal is
Registration information signing means for signing registration information including the chip information of the secure chip and the public key of the secure chip using the secret key of the secure chip;
Registration information encryption means for encrypting the registration information signed by the registration information signature means into encrypted registration information using the public key of the chip manager of the chip management center;
Encrypted registration information transmission means for transmitting the encrypted registration information obtained by encryption by the registration information encryption means to the chip management center;
Chip public key certificate receiving means for receiving a chip public key certificate from the chip management center;
Chip public key certificate confirmation means for confirming the validity of the chip public key certificate received by the chip public key certificate reception means;
Chip public key certificate storage means for storing the chip public key certificate in the secure chip;
With
The chip management center is
Encrypted registration information receiving means for receiving the encrypted registration information from the communication terminal;
Registration information decryption means for decrypting the encrypted registration information received by the encrypted registration information receiving means into the registration information with the signature using the secret key of the chip manager of the chip management center When,
Registration information signature verification means for verifying the signature of the registration information obtained by decryption by the registration information decryption means using the public key of the secure chip included in the registration information;
Chip public key certificate creating means for creating a chip public key certificate including the public key of the secure chip to be transmitted to the communication terminal;
Registration information registration means for registering the registration information obtained by decoding by the registration information decoding means in a chip database;
Chip public key certificate transmission means for transmitting the chip public key certificate created by the chip public key certificate creation means to the communication terminal;
A VPN communication system comprising: A VPN communication system comprising a communication terminal equipped with a secure chip, and a VPN service providing center for providing VPN service application software to the communication terminal,
The communication terminal is
Service provision request signing means for signing a service provision request for requesting provision of VPN service application software to the VPN service provision center using the secret key of the secure chip;
Service provision request means for transmitting a service provision request signed by the service provision request signing means and a chip public key certificate including the public key of the secure chip stored in the secure chip to the VPN service provision center. When,
Service receiving means for receiving the VPN service application software from the VPN service providing center;
Service installation means for installing the VPN service application software received by the service reception means in the secure chip;
With
The VPN service providing center is
Service provision request receiving means for receiving the service provision request with the signature and the chip public key certificate from the communication terminal;
Chip public key certificate verifying means for verifying the chip public key certificate received by the service providing request receiving means;
A service provision for verifying a signature of a service provision request received by the service provision request receiving means using a public key of the secure chip included in the chip public key certificate received by the service provision request receiving means Request signature verification means;
Service transfer means for transferring the VPN service application software to the communication terminal;
A VPN communication system comprising: A VPN communication system comprising: a communication terminal equipped with a secure chip; and a service providing center that generates a communication encryption key for performing communication between the communication terminals belonging to the same VPN and delivers the communication encryption key to the communication terminal. ,
The communication terminal is
An encryption key generation request signing means for signing an encryption key generation request for requesting the service providing center to generate an encryption key for communication using a secret key of the VPN service application stored in the secure chip;
An encryption key generation request encryption for encrypting the encryption key generation request signed by the encryption key generation request signing means into an encryption encryption key generation request using the public key of the service provider managing the service providing center And
An encryption key for transmitting an encryption encryption key generation request obtained by encryption by the encryption key generation request encryption means and a public key certificate of a VPN service application stored in the secure chip to the service providing center Generation request transmission means;
Generated encryption key information receiving means for receiving encrypted generated encryption key information with a signature from the service providing center;
Generated cryptographic key information signature verification means for verifying a signature of the encrypted generated cryptographic key information received by the generated cryptographic key information receiving means using the public key of the service provider;
Generated encryption key information decrypting means for decrypting the encrypted generated encryption key information into generated encryption key information including a communication encryption key and an identifier of the communication encryption key using a secret key of the VPN service application;
Generated encryption key information installing means for installing the generated encryption key information obtained by decryption by the generated encryption key information decrypting means in the secure chip;
With
The service providing center
Encryption key generation request receiving means for receiving the encryption encryption key generation request and the public key certificate of the VPN service application from the communication terminal;
Service public key certificate verifying means for verifying the public key certificate of the VPN service application received by the encryption key generation request receiving means;
Encryption key generation request decryption for decrypting the encryption encryption key generation request received by the encryption key generation request receiving means into the encryption key generation request with the signature, using the secret key of the service provider And
Generation request signature verification means for verifying the signature of the encryption key generation request obtained by decryption by the encryption key generation request decryption means using the public key of the VPN service application;
A communication encryption key generating means for generating a communication encryption key distributed to the communication terminal;
Group information storage means for registering the communication encryption key generated by the communication encryption key generation means and the identifier of the communication encryption key in a group information database;
Using the public key of the VPN service application, the generated encryption key information including the communication encryption key generated by the communication encryption key generation means and the identifier of the communication encryption key is encrypted and generated Generated encryption key information encryption means for encrypting information;
Generated encryption key information signing means for signing the encrypted generated encryption key information obtained by encryption by the generated encryption key encryption means using the secret key of the service provider;
Generated encryption key information transmitting means for transmitting the encrypted generated encryption key information signed by the generated encryption key information signing means to the communication terminal;
A VPN communication system comprising: A VPN communication system comprising: a communication terminal equipped with a secure chip; and a service providing center that manages a communication encryption key for performing communication between the communication terminals belonging to the same VPN and delivers the communication encryption key to the communication terminal. ,
The communication terminal is
An encryption key sharing request signing means for signing an encryption key sharing request for requesting the service providing center to share a communication encryption key, using a secret key of the VPN service application stored in the secure chip;
Encryption key sharing request encryption for encrypting the encryption key sharing request signed by the encryption key sharing request signing means into an encryption encryption key sharing request using the public key of the service provider managing the service providing center And
Encryption key for transmitting an encryption encryption key sharing request obtained by encryption by the encryption key sharing request encryption unit and a public key certificate of a VPN service application stored in the secure chip to the service providing center A sharing request transmission means;
Shared encryption key information receiving means for receiving encrypted shared encryption key information with a signature from the service providing center;
Shared encryption key information signature verification means for verifying the signature of the encrypted shared encryption key information received by the shared encryption key information receiving means using the public key of the service provider;
Shared encryption key information decrypting means for decrypting the encrypted shared encryption key information into shared encryption key information including a communication encryption key and an identifier of the communication encryption key using a secret key of the VPN service application;
Shared encryption key information installation means for installing shared encryption key information obtained by decryption by the shared encryption key information decryption means in the secure chip;
With
The service providing center
Encryption key sharing request receiving means for receiving the encrypted encryption key sharing request and the public key certificate of the VPN service application from the communication terminal;
Service public key certificate verification means for verifying the public key certificate of the VPN service application received by the encryption key sharing request reception means;
Cryptographic key sharing request decryption for decrypting the encrypted cryptographic key sharing request received by the cryptographic key sharing request receiving means into the signed cryptographic key sharing request using the public key of the service provider And
A shared request signature verification means for verifying a signature of the encryption key sharing request obtained by decryption by the encryption key sharing request decryption means, using the secret key of the service provider;
A communication encryption key search means for searching for a communication encryption key distributed to the communication terminal;
Group information additional registration means for additionally registering user information of the user terminal in a group information database;
Using the public key of the VPN service application, the shared encryption key information including the communication encryption key searched by the communication encryption key search means and the identifier of the communication encryption key is encrypted. Shared encryption key information encryption means for encrypting information;
Shared encryption key information signing means for signing the encrypted shared encryption key information obtained by encryption by the shared encryption key encryption means using the service provider's private key;
Shared encryption key information transmitting means for transmitting the encrypted shared encryption key information signed by the shared encryption key information signing means to the communication terminal;
A VPN communication system comprising: In a VPN communication system equipped with a communication terminal equipped with a secure chip,
The VPN communication system, wherein the communication terminal performs encrypted communication with another communication terminal belonging to the same VPN using a communication encryption key stored in the secure chip.

Images