JP2008259148A - High-strength cipher communication system which minimizes load of repeater - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve an issue of load for a repeater when unique encryption key is used to each channel and an issue of vulnerability when a common encryption key is used to all channels in encryption communication network to which many nodes are connected. <P>SOLUTION: Two kinds of encryption keys, a data key for data encryption and a session key for data key encryption, are used so that cipher communication with sufficient strength is realized while minimizing the load of a repeater. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

The present invention relates to a relay system for cryptographic communication. Some of the technologies introduced in connection with this case also have an authentication function in addition to the encryption communication function, but in this case, we focus only on the encryption function.

In recent Internet communications, the importance of encrypted communications has increased because of the transmission of important company information and personal information. Meanwhile, an encryption standard called SSL (Secure Socket Layer) formulated by Netscape Communications, Inc., and TLS (Transport Layer Security) standardized by IETF based on this, was born. Widely adopted as an encryption method.
RFC2246

On the other hand, encryption methods such as WEP (Wired Equivalent Privacy) and WPA (Wi-Fi Protected Access) are widely used as wireless LAN communication methods. In many cases, in wireless LANs, the access point responsible for the relay function is manufactured as relatively low-performance hardware, so the encryption key used for communication is the same for all nodes and is transferred as it is when relaying. ing. For this reason, if the encryption key used is leaked, there is a vulnerability that the communication of all nodes participating in the wireless LAN is eavesdropped. For this reason, there is a method of updating the encryption key at regular intervals, such as TKIP (Temporal Key Integrity Protocol) which is a subset of WPA.
IEEE 802.11b IEEE802.11i

As shown in FIG. 1, when one or several repeaters relay encrypted communication of a large number of nodes, when a method using an encryption key unique to a communication path such as SSL or TLS is adopted, the repeater Is a very heavy load because all data must be decrypted, re-encrypted and relayed.

As shown in FIG. 2, in the case of the above method, as another means, the encryption key is not shared between the node and the repeater, but unique to each pair of the data transmission source node and the data transmission destination node. It is also conceivable to have an encryption key. In this case, the repeater does not have to perform decryption and re-encryption, so the load is small. However, when the number of connection nodes is N, N square-N keys are required, so this is not a practical measure when the number of connection nodes becomes as large as several thousand.

On the other hand, in the case where all nodes communicate using the same encryption key as shown in FIG. 3, the repeater may perform decryption and re-encryption in order to refer to the user data. Since it may be relayed as it is, the processing load on the repeater is small. However, in this method, if the encryption key leaks somewhere, all communications can be intercepted, so the encryption key must be updated.

One specific crisis of the encryption key is to obtain a crash dump on the node. This is a method in which a malicious user intentionally crashes a node connected to an encryption communication network, acquires a memory dump at that time, and finds an encryption key used for communication. As a method for dealing with this crisis, the encryption key is updated when the number of participating nodes is reduced. Acquiring a crash dump is a node crash, so it takes tens of seconds to several minutes to restart and generate a crash dump file. At this time, since the encryption communication network to which the node is connected can detect disconnection, if the encryption key is updated at this time, the leaked encryption key is not used at the time of acquisition. However, this method also has a weak point that when the number of connected nodes becomes large, such as several thousand, the load and time required for simultaneous exchange of encryption keys become unrealistic.

When updating an encryption key shared by multiple nodes, the node holds the old and new 2nd generation encryption keys so that communication does not stop until all nodes are updated, and the update process is in progress In addition, there is a technique for handling data encrypted with either encryption key in data transmission / reception processing that is in parallel with each other. However, even in this case, the problem of the large number of nodes in the previous section cannot be solved.
Patent Publication 2004-186814

In the present invention, an encryption key (hereinafter referred to as a data key) used for encrypting user data and an encryption key (hereinafter referred to as a session key) unique to each communication path are used in combination, Solve the problem. In the present invention, among the above two types of encryption keys, the session key distribution method is not specifically defined, and it is assumed that the session key is securely distributed by the Diffie Hellman method, the public key encryption method, or the like. .
PKCS # 3 RFC2313

First, at the stage of establishing a communication path, a session key unique to the communication path is shared between the node and the repeater.

The node generates a data key used when transmitting data by using a method that cannot be predicted by others.

At this point, each node holds one session key and one data key on the communication network as shown in FIG. 6, and the repeater holds as many session keys as the number of communication paths.

When transmitting a packet on the communication path, the data format shown in FIG. 4 is used. First, a header portion storing information such as the length of the packet is provided at the head of the data. Next, the data key encrypted with the session key, and finally the user data and digest for tampering are attached.

When the node A transmits the packet in FIG. 6 and the repeater receives the packet, the process shown in FIG. 5 is performed. First, in the first stage, the data key A encrypted with the session key A is decrypted. Then, the data key A is encrypted with the session key B so that the transfer destination node B can decrypt it, and the packet is transferred. The node B can correctly decrypt the user data portion by decrypting the data key A using the session key B.

As described above, compared to the relay method in which the entire user data is decrypted and encrypted, in the relay method in which only the data key portion is decrypted and encrypted, for example, the user data portion is 1600 octets and the data key is 16 octets. If the data relay processing amount is compared, the latter processing amount is about 1 / 100th that of the former. However, even if an attempt is made to create an arbitrary session key and attempt to determine the data key brute force, in order to verify whether the data key was correctly extracted, try decrypting the user data part. On the contrary, the processing amount required for the brute force attack increases.

Furthermore, by updating the session key and data key at regular intervals, it is possible to maintain robustness against key acquisition by brute force check.

Further, the attack by collecting the crash dump described above becomes invalid due to the property that the session key is not used in other sessions.

According to the present invention, since it is possible to perform encryption communication relay processing with lower load processing without lowering encryption strength, it is possible to realize cost reduction and power saving of the repeater.

Furthermore, by connecting the repeaters, a new session key is prepared for the communication path between the repeaters as shown in FIG. 7 when constructing a large-scale cryptographic communication network. It is possible to develop the mechanism of this case.

In a specific implementation of the present invention, it is important to first use a secure authentication method when distributing session keys. For example, in the existing technology, a method using an electronic certificate defined by PKI (Public Key Cryptographic Infrastructure), a 4-way handshake method, and the like are candidates.
RFC 2459

In addition, in order to eliminate the risk of extracting plaintext data and encrypted data samples due to redundancy of user data to be encrypted, AES-CBC mode or AES-CTR mode is used when encrypting actual data blocks. Things are important.
RFC3602 RFC3686

According to the present invention, it is possible to realize power saving while maintaining a grade in a wireless LAN access point. Alternatively, it becomes possible to connect a larger number of nodes with an access point having the same capability.

In addition, in a VPN (Virtual Private Network) system, a repeater to which a large number of nodes are connected can be provided at low cost by using general-purpose computer components.

Cryptographic communication network configuration using a unique encryption key for each channel Cryptographic communication network configuration using a unique encryption key for each destination node Configuration of cryptographic communication network using encryption key shared by all nodes Transmission packet format Flow of processing during packet relay Configuration of cryptographic communication network relayed by one repeater Configuration of cryptographic communication network relayed by two repeaters

Claims (1)

In encryption communication in which one or several repeaters relay communication between multiple terminals, while maintaining encryption strength by using different encryption keys for each communication path, the entire user data The key used for encrypting user data and the key for re-encrypting this key are not separated, and the load of decryption and encryption during relay is minimized.

Images