JP2009077213A - Secret communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a secret communication system which achieves safer secret communication. <P>SOLUTION: The secret communication system includes: a basic authentication means for performing authentication processing on a communication terminal 10 which sets a plurality of secret communication paths for each authentication device and performs secret communication and generating one basic key according to the authentication processing result; and a key conversion information assignment means for repeating predetermined conversion processing on the generated basic key for each authentication device thereby obtaining key conversion information, and for assigning the obtained key conversion information to the authentication device. Each of the authentication devices, when the key conversion information is assigned to itself, sets the assigned key conversion information to a key of a secret communication path corresponding to authentication device itself without performing the authentication processing on the communication terminal. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a confidential communication system including a communication terminal device that performs confidential communication with a connection target that provides a network connection service or a broadcast-type service, and an authentication device group that sets a secret communication channel key.

  In recent years, as a network connection service provided to a communication terminal device such as a mobile terminal or a mobile phone, a network connection service via a wireless local area network (LAN) or a packet switching network for a mobile phone has become widespread. In the future, PAN (Personal Area Network) typified by IEEE 802.15 and Wireless MAN (Metropolitan Area Network) typified by IEEE 802.16 will become widespread, and network connection via various connection operators and heterogeneous networks Providing services is expected.

  FIG. 1 shows an example in which a communication terminal apparatus is connected to a network via various connection providers. The communication terminal device is a terminal that supports a plurality of wireless communication standards such as 3GPP / 3GPP2, WiFi, WiMAX, and ZigBee. The network connection service can be selected by selecting a network or connection provider with better conditions.

  In addition, when the user of the communication terminal device has a use contract for a collective service of authentication, authorization, and billing with the billing business operator X and receives the network connection service, the billing server (hereinafter referred to as the billing server of the communication terminal device and the billing business operator X) Mutual authentication processing is performed between the AAA server (referred to as an authentication, authorization, and accounting (AAA) server), and the AAA server of each connected carrier and the AAA server of the billing carrier X perform processing relating to authentication, authorization, and billing. By linking, all authentication, authorization, and billing related to the communication terminal device are performed at once. With such a configuration, the user of the communication terminal apparatus can receive the service without newly signing a service use contract with each connection carrier existing in the communication path until the connection to the network.

  In order to realize such a form, a mechanism for coordinating each AAA server and a mechanism corresponding to various authentication methods that differ depending on the communication terminal device are required. As the former mechanism, it is conceivable that each AAA server implements an AAA protocol such as RADIUS or DIAMETER that operates on IP to exchange messages related to authentication and billing. As the latter mechanism, it is conceivable that EAP (Extensible Authentication Protocol) is implemented to absorb the difference between different authentication methods depending on communication standards and communication terminal devices.

Patent Document 1 discloses that a communication terminal device is connected to a wireless LAN connection service on the assumption that a user of the communication terminal device has already signed a contract with a 3G mobile phone carrier and shares a subscriber identification ID and its authentication key. A mode of using AKA (Authentication and Key Agreement), which is an authentication scheme for 3G mobile phone terminals, is described as a method for receiving access authentication and authorization. In this case, AKA is set as one authentication method that can be selected in the mounted EAP. Originally, an AKA authentication message exchanged between a mobile phone terminal and an AAA server of a 3G mobile phone carrier via a mobile phone line network is handled as an EAP message in which AKA is set as an authentication method on the wireless LAN. These EAP messages are encapsulated by the AAA protocol and exchanged between the AAA server on the wireless LAN and the AAA server included in the 3G mobile phone carrier. By performing mutual authentication between the communication terminal device and the AAA server of the 3G mobile phone carrier, the authentication result and the session key used between the communication terminal device and the access point of the wireless LAN are transferred to the 3G mobile phone carrier. The AAA server notifies the AAA server of the wireless LAN. By using the above mechanism, the communication terminal apparatus can use the wireless LAN connection service without newly making a service use contract with the wireless LAN connection service provider.
JP 2005-524341 A

  However, the technique disclosed in Patent Document 1 does not consider a form in which a plurality of connection providers exist on a communication path from a communication terminal device to a connection target network. Such a configuration has the following two problems.

  First, as a problem seen from the user of the communication terminal device, the user obtains authentication and authorization from the connection provider that he / she directly accesses and shares the session key, but the connection existing before this connection provider I can't see the business. If there is an unscrupulous business operator on the previous communication path, even if the user intends to access the legitimate site, the communication terminal device will be connected to the phishing site impersonating the legitimate site without permission. there is a possibility.

  Further, even if data is encrypted in the wireless section between the communication terminal device and the access point, the encrypted data is decrypted at the access point. Furthermore, since encryption and authentication of communication prior to the access point depends on the security policy unique to each connection provider, it is not clear to the user whether the data transmitted and received by the communication terminal device is really confidential.

  Secondly, as a problem seen from the connection service provider, each connection service provider cannot see the existence of another connection service provider that is two or more hops away from the connection service provider. For such other connection operators, there is no choice but to rely on information provided by the connection operator itself or information provided by other connection operators. All types of network operators that provide network connection services are certified by a special certification body as reliable vendors, and even if they work illegally, fraud is identified with the cooperation of each network operator If is established, there is no problem. In reality, however, not all operators are fully reliable. For example, a case where a certain connection provider permits a network device provided by the other connection provider to connect to another connection provider's gateway device and a plurality of communication terminal devices are connected under the gateway device. Suppose. In this case, data transmitted / received via the gateway device may be once decrypted by the gateway device, and it is not clear whether a service as contracted can be provided to the communication terminal devices under the gateway device. Also, if you do not want to provide broadcast service to all communication terminal devices under the gateway device at once, but want to provide broadcast service only to specific communication terminal devices with service contracts among all communication terminal devices In addition, there is a possibility that the broadcast content is illegally used by the broadcast device being decrypted by the gateway device.

  An object of the present invention is to provide a confidential communication system that enables more secure confidential communication.

  The confidential communication system according to the present invention includes a communication terminal device that performs a confidential communication by setting a plurality of confidential communication paths between the connection targets for each connection request to the connection target, and is provided for each of the confidential communication paths. And a plurality of authentication devices that perform authentication processing on the communication terminal device and set a key of the confidential communication channel according to the authentication result. Basic authentication means for performing authentication processing on the terminal device and generating one basic key according to the authentication result, and a key obtained by repeating predetermined conversion processing for the generated basic key for each authentication device Key conversion information allocating means for allocating conversion information to the authentication device, and each of the authentication devices allocates without performing authentication processing for the communication terminal device when the key conversion information is allocated to itself. Key conversion And sets the key to secure communications channel to a corresponding distribution to itself.

  According to the confidential communication system of the present invention, more secure confidential communication is possible.

  Embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, the “common key” or simply “key” is generated as a communication terminal device and each authentication device, or between each authentication device, or to be newly shared Means the key to be played. “Key conversion information” means conversion information obtained by applying, for example, a predetermined conversion function to such a common key. The restoration information means information necessary for the communication terminal apparatus to restore the common key.

<First embodiment>
FIG. 2 shows a connection relationship between the communication terminal device and a plurality of connection providers in the embodiment of the present invention. Here, it is assumed that the user A is about to receive a connection service to the network 30 such as the Internet. In order to receive provision of such a service, the communication terminal device 10 performs connection authentication with the lower connection carrier B to share the session key, and at the same time, the upper connection carrier serving as an entrance to the network 30 It is only necessary that the key can be shared between D and the connection provider C on the communication path. The communication terminal device 10 first performs mutual authentication with the server 40 of the billing carrier AAA, and based on the key notified from the billing carrier AAA based on the authentication result, Share keys between. The connection operator B includes an authentication device 20B, the connection operator C includes an authentication device 20C, and the connection operator D includes an authentication device 20D.

  The correspondence relationship with the components of the present invention will be described. The server 40 of the charging business operator AAA provides basic authentication means for generating a basic key, and the authentication devices 20B to 20D provide key information assignment means. The communication terminal device 10 sets a tunnel route as a confidential communication channel for each of the authentication devices 20B to 20D and performs confidential communication with the network 30 to be connected.

  The connection operator D is a connection operator who already shares a key with the communication terminal device 10. For example, as a result of mutual authentication between the communication terminal device 10 and the charging operator, the communication terminal device 10 and the charging operator share it. This is a connection provider who shares the key by notifying the key (basic key) by the charging provider AAA. The connection operator C is a connection operator that exists on the communication path between the connection operator B and the connection operator D. The connection operator B is a connection operator that the communication terminal device 10 newly performs connection authentication.

  In the first embodiment, when a communication terminal device 10 shares a key with an authentication device 20B of a connection operator B who wishes to connect as an entrance of a network connection service, a connection operator having a key with the communication terminal device 10 is used. The authentication device 20D of D sequentially notifies the applied value of the one-way function of the key to the lower-layer connection service provider on the communication path, so that the communication terminal device 10 reaches the connection target network 30 all or any connection service. This is a mode in which each key is shared with the authentication device of the person who is the user.

  In this specification, a connection operator closer to the network 30 on the communication path from the communication terminal device 10 to the network 30 is referred to as an upper connection operator, and conversely, a connection business far from the network 30 and close to the communication terminal device. The above will be referred to as a subordinate carrier and will be described below.

  FIG. 3 is a block diagram showing an internal configuration of the authentication device 20D in the first embodiment. The authentication device 20D includes a key management unit 27, a key conversion information generation unit 24, an encryption unit 25, and a transmission unit 26.

  The key management unit 27 holds a shared key with the communication terminal apparatus 10 and gives this to the key conversion information generation unit 24. As a method for obtaining the key, as a result of mutual authentication between the communication terminal device 10 and the charging company's AAA server, the key shared by the communication terminal apparatus 10 and the charging company's AAA server is notified from the AAA server. Good. Further, the key management unit 27 may share a shared key with the communication terminal device 10 in advance.

  The key conversion information generation unit 24 generates a shared key between the lower-level authentication device 20C and the communication terminal device 10 based on the shared key with the communication terminal device 10 given by the key management unit 27, and generates the generated common key. The key is given to the encryption unit 25 as key conversion information. The key generation uses a unidirectional transformation, which is a transformation in which it is difficult to derive an input value from an output value, and a predetermined one with a common key given from the key management unit 27 as at least one input value. This is done by applying the directional function H.

  The encryption unit 25 performs an encryption process in order to safely deliver the key conversion information given from the key conversion information generation unit 24 to another authentication apparatus, and gives the encrypted key conversion information to the transmission unit 26. The encryption method used in the encryption unit 25 is not particularly limited, and any encryption method defined between itself and the delivery destination authentication device can be used. The transmission unit 26 delivers the encrypted key conversion information given from the encryption unit 25 to another authentication device 20.

  FIG. 4 is a block diagram showing the internal configuration of the authentication device 20C in the first embodiment. The authentication device 20C includes a reception unit 21, a decryption unit 22, a key generation unit 23, a key management unit 27, a key conversion information generation unit 24, an encryption unit 25, and a transmission unit 26.

  The receiving unit 21 receives the encrypted key conversion information from another authentication device, and gives this to the decrypting unit 22. The decryption unit 22 performs decryption processing on the encrypted key conversion information given from the reception unit 21, and gives the obtained key conversion information to the key generation unit 23. The decryption method is not particularly limited, but a decryption method defined in advance with the authentication apparatus 20 of the transmission source is used.

  The key generation unit 23 generates a shared key with the communication terminal device 10 from the key conversion information, and gives this to the key management unit 27 and the key conversion information generation unit 24. The key generation unit 23 communicates a value given from the higher-level authentication device 20D, that is, a value subjected to predetermined one-way conversion using at least one input value as a shared key between the communication terminal device 10 and the higher-level authentication device 20D. Set to a shared key with the terminal device 10.

  The key management unit 27 holds the key given from the key generation unit 23 as a shared key with the communication terminal device 10. The key conversion information generation unit 24 is substantially the same in operation as the key conversion information generation unit 24 of the connection provider D. The difference is that the common key is given from the key generation unit 23. The operation of the encryption unit 25 is the same as that of the encryption unit 25 of the authentication device 20 of the connection operator D. The operation of the transmission unit 26 is the same as that of the transmission unit 26 of the authentication device 20 of the connection provider D.

  FIG. 5 is a block diagram showing the internal configuration of the authentication device 20B in the first embodiment. The authentication device 20B includes a reception unit 21, a decryption unit 22, a key generation unit 23, and a key management unit 27. The operation of the receiving unit 21 is the same as that of the receiving unit 21 of the authentication device 20C. Similarly, the decryption unit 22 and the key generation unit 23 and the key management unit 27 operate in the same manner as the components of the authentication device 20C.

  FIG. 6 is a block diagram showing an internal configuration of the communication terminal apparatus 10 in the first embodiment. The communication terminal device 10 includes a key management unit 13 and a key restoration unit 12.

  The key management unit 13 holds a shared key with the connection operator D and gives the held key to the key restoration unit 12. As a method for obtaining the key, a key shared by the AAA server notifying the key to the connection company D as a result of mutual authentication with the AAA server of the charging company may be used. The key management unit 13 may share a shared key with the connection operator D in advance.

  The key restoration unit 12 restores the shared key with the authentication device 20C and the shared key with the authentication device 20B from the key given from the key management unit 13. Here, the one-way function H is applied with the shared key with the authentication device 20D given by the key management unit 13 as at least one input value, and the result value is restored as the shared key with the lower-level authentication device 20C. The Furthermore, the one-way function H is further applied using the restored common key as at least one input value, and the result value is restored as a shared key with the lower-level authentication device 20B. By repeating the common key restoration process in this way, a shared key to be shared with all the authentication devices is finally obtained.

  FIG. 7 shows an operation procedure in the first embodiment. In the figure, H (a, b) indicates that the information a is applied to the information b to perform one-way conversion, and E (a, b) encrypts the information b using the key a. Represents that. Further, in the figure, only minimum information is described for ease of explanation, but the present invention is not limited to this. For example, the input information of the one-way function H or the input information of the encryption function E is described. Optional information may be included in addition to the above information.

  As a premise, the communication terminal device 10 used by the user A and the authentication device 20D share the key K_AD in some form. For example, as a result of mutual authentication between the accounting service provider's AAA server and the communication terminal device 10 using the EAP protocol, the generated session key is notified from the accounting service provider's AAA server to the authentication device 20D. Further, the key K_CD is already shared between the authentication device 20D and the authentication device 20C. Further, the key K_BC is already shared between the authentication device 20C and the authentication device 20B.

  First, in response to a connection request from the communication terminal device 10 of the user A, the authentication device 20D generates key conversion information (step S101). Here, the shared key K_AD with the communication terminal apparatus 10 is unidirectionally converted. The obtained unidirectional conversion value H (K_AD) is used as key conversion information.

  Next, the authentication device 20D performs key conversion information delivery (step S102). Here, the key conversion information H (K_AD) is encrypted using the shared key K_CD between the authentication device 20D and the authentication device 20C, and delivered to the authentication device 20C.

  Next, the authentication device 20C performs key setting (step S103). Here, the delivered key conversion information H (K_AD) is received and decrypted. The key conversion information H (K_AD) is held as a shared key K_AC between the connection operator C and the communication terminal device 10.

  Next, the authentication device 20C generates key conversion information (step S104). Here, the held common key K_AC is unidirectionally converted, and a unidirectional conversion value H (K_AC) is obtained as key conversion information.

  Next, the authentication device 20C delivers key conversion information (step S105). Here, the key conversion information H (K_AC) is encrypted using the shared key K_BC between the authentication device 20C and the authentication device 20B, and delivered to the authentication device 20B.

  Next, the authentication device 20B performs key setting (step S106). Here, the delivered key conversion information H (K_AC) is received and decrypted, and held as a shared key K_AB between the connection operator B and the communication terminal device 10.

  On the other hand, the communication terminal apparatus 10 performs key recovery (step S107). Here, the shared key K_AD with the authentication device 20D is unidirectionally converted, and the obtained unidirectional conversion value H (K_AD) is restored as the shared key K_AC with the authentication device 20C. Subsequently, the restored key K_AC is unidirectionally converted, and the obtained unidirectional conversion value H (K_AC) is restored as a shared key K_AB with the authentication device 20B.

  In the first embodiment described above, when the communication terminal device 10 shares the key with the authentication device 20B of the connection operator B that desires to connect, the authentication device 20D that already shares the key with the communication terminal device 10 is the key. Is notified to the lower-level authentication device 20C on the communication path, the authentication device 20C obtains the shared key with the communication terminal device 10. By notifying the one-way conversion value of the key obtained by the authentication device 20C to the lower-level authentication device 20B on the communication path, the authentication device 20B obtains the shared key with the communication terminal device 10. Finally, the communication terminal device 10 can share a key with each authentication device on the communication path, and at the same time share the key with the authentication device 20B that desires connection.

  Therefore, when a communication terminal device and an arbitrary authentication device existing on a communication path until the communication terminal device connects to the network wants to share a key for tunneling individually, each authentication device shares a key individually. There is no need to execute a sequence for.

  In addition, since the common key between the higher-level authentication device and the communication terminal device and the shared key between the lower-level authentication device and the communication terminal device are unidirectionally converted, the lower-level authentication device existing on the communication path Does not know the shared key between the higher-level authentication device and the communication terminal device. As a result, the communication terminal device can construct a tunnel to an authentication device that it trusts, and the connection operator can construct a tunnel to a legitimate communication terminal device with which it has contracted. it can.

<Second Embodiment>
In the second embodiment, when each authentication device generates a common key for a lower-level authentication device and obtains key conversion information, it includes unique information (for example, a random number) that only the authentication device itself can know. It is a form to convert. In the first embodiment, the shared key between the communication terminal device and each authentication device is a unidirectional conversion value of the shared key between the higher-level authentication device and the communication terminal device. Thus, it is possible to derive a shared key between all the lower-level authentication devices and the communication terminal device. On the other hand, in the second embodiment, it is intended to limit the range of lower-level authentication devices that can be derived by higher-level connection operators.

  The internal configuration of the authentication device 20D is the same as the internal configuration of the authentication device 20D in the first embodiment (see FIG. 3), but the operation of each component is different, so only the different points will be described below.

  The key conversion information generation unit 24 generates a shared key between the authentication device 20C and the communication terminal device 10 connected at a lower level, generates key conversion information to be delivered to the authentication device 20C, and encrypts them. To 25. As a shared key between the authentication device 20C and the communication terminal device 10, a random number generated by a random number generator is used. The key conversion information includes a shared key between the communication terminal device 10 and the lower-level authentication device 20C and restoration information.

  The internal configuration of the authentication device 20C of the connection provider C is the same as the internal configuration of the authentication device 20C in the first embodiment (see FIG. 4), but the operation of each component is different, so only the different points will be described below. .

  The key generation unit 23 extracts a shared key with the communication terminal apparatus 10 from the key conversion information given from the decryption unit 22 and gives the key to the key management unit 27 and also gives the key conversion information to the key conversion information generation unit 24. The key conversion information includes a shared key with the communication terminal device 10 generated by the higher-level authentication device 20D and restoration information.

  The key conversion information generation unit 24 has substantially the same operation as the key conversion information generation unit 24 of the authentication device 20D in the second embodiment. The difference is that a key shared by the communication terminal device 10 and the restoration information are given by the key generation unit 23, and a key shared by the communication terminal device 10 and the communication terminal device 10 is used. The key conversion information is obtained by generating a shared key with the authentication device 20B and the restoration information for the common key, and adding the restoration information provided by the key generation unit 23 to the generated information. Is given to the encryption unit 25.

  FIG. 8 is a block diagram showing the internal configuration of the authentication device 20B in the second embodiment. The authentication device 20B includes a reception unit 21, a decryption unit 22, a key generation unit 23, a key management unit 27, and a transmission unit 26. Among the above components, the receiving unit 21, the decrypting unit 22, and the key managing unit 27 equalize the operation in the internal configuration (see FIG. 5) of the authentication device 20B in the first embodiment. Hereinafter, only the key generation unit 23 having different operations and the transmission unit 26 which is a new component will be described.

  The key generation unit 23 has substantially the same operation as the key generation unit 23 described in the internal configuration of the authentication device 20C. The difference is that only the restoration information included in the key conversion information given from the decryption unit 22 is given to the transmission unit 26. The transmission unit 26 delivers the restoration information given from the key generation unit 23 toward the communication terminal device 10.

  FIG. 9 is a block diagram showing the internal configuration of the communication terminal apparatus 10 in the second embodiment. The communication terminal device 10 includes a reception unit 11, a key management unit 13, and a key restoration unit 12. The receiving unit 11 gives the restoration information received from the authentication device 20B to the key restoring unit 12. The key management unit 13 has the same operation as the key management unit 13 of the communication terminal device 10 in the first embodiment.

  The key restoration unit 12 uses the key shared with the authentication device 20D of the connection provider D given from the key management unit 13 and the restoration information given from the reception unit 11 to the shared key and the authentication device 20B with the authentication device 20C. And restore the shared key.

  FIG. 10 shows an operation procedure in the second embodiment. In the figure, E (a, b) represents that information b is encrypted using the key a, and F (a, b) represents that information b is encrypted using the key a. . In the figure, only minimum information is described for ease of explanation. However, the present invention is not limited to this. For example, the input information of the encryption functions E and F includes optional information other than the described information. May be included.

  First, the authentication device 20D generates key conversion information (step S201). A random number R_D is generated. The random number R_D is encrypted with the shared key K_AD with the communication terminal device 10, and information F (K_AD, R_D) is obtained. Random numbers R_D and F (K_AD, R_D) are used as key conversion information.

  Next, the authentication device 20D performs key conversion information delivery (step S202). The key conversion information {R_D, F (K_AD, R_D)} is encrypted using the shared key K_CD between the authentication device 20D and the authentication device 20C, and delivered to the authentication device 20C.

  Next, the authentication device 20C performs key setting (step S203). The encrypted key conversion information is received and decrypted, and random numbers R_D and F (K_AD, R_D) are obtained. The random number R_D is held as a shared key K_AC with the communication terminal device 10.

Next, the authentication device 20C generates key conversion information (step S204). A random number R_C is generated. The random number R_C is encrypted with a shared key K_AC with the communication terminal device 10 to obtain information F (K_AC, R_C). The random number R_C, the information F (K_AC, R_C), and the information F (K_AD, K_AC) are used as key conversion information. Next, the authentication device 20C performs key conversion information delivery (step S205). The key conversion information {R_C, F (K_AC, R_C), F (K_AD, K_AC)} is encrypted using a shared key K_BC between the authentication device 20C and the authentication device 20B, and delivered to the authentication device 20B. .

  Next, the authentication device 20B performs key setting (step S206). The encrypted key conversion information is received and decrypted to obtain key conversion information {R_C, F (K_AC, R_C), F (K_AD, K_AC). The random number R_C included in the key conversion information is held as a shared key K_AB with the communication terminal device 10.

  Next, the authentication device 20B delivers key recovery information to the communication terminal device 10 (step S207). The restoration information {F (K_AC, K_AB), F (K_AD, K_AC)} is delivered toward the communication terminal device 10.

  Finally, the communication terminal apparatus 10 performs key recovery (step S208). The restoration information {F (K_AC, K_AB), F (K_AD, K_AC)} is received, F (K_AD, K_AC) is decrypted using the shared key K_AD with the authentication device 20D, and the shared key with the authentication device 20C K_AC is restored. Further, F (K_AC, K_AB) is decrypted using the restored key K_AC, and the shared key K_AB with the authentication device 20B is restored.

  In the above second embodiment, when the communication terminal device 10 shares a key with the authentication device 20B that the communication terminal device 10 desires to connect to, the authentication device 20D that has already shared the key with the communication terminal device 10 The authentication device 20C obtains the shared key with the communication terminal device 10 by generating the shared key with the authentication device 20C and the restoration information and notifying the lower authentication device 20C on the communication path. Further, the authentication device 20C notifies the lower authentication device 20B of information including the shared key between the communication terminal device 10 and the lower authentication device 20B, and the communication terminal device 10 information for restoration. The authentication device 20B obtains the shared key with the communication terminal device 10, and finally, the connection operator B notifies the communication terminal device 10 of the restoration information by the communication terminal device 10, so that the communication terminal Device 10 At the same time the key for each authentication device 20 on a communication path restoration and sharing, it is possible to recover and share the authentication unit 20B and the key.

  Therefore, in the first embodiment, the higher-level authentication device has been able to derive all the keys shared by the lower-level authentication device and the communication terminal device, whereas in the second embodiment, There is an effect that only the shared key between the authentication device and the communication terminal device which is one order lower on the communication path can be read.

  In the second embodiment described above, a method using a random number generated using a random number generator provided in the authentication device as a key is used. It is also possible to use, as a key, an output value of a one-way function having at least two input values of a shared key and a random number generated using a random number generator. In this case, the random number as the restoration information and the key that is the output value of the generated one-way function are used as the key conversion information.

<Third embodiment>
The third embodiment is a form in which each authentication device generates a common key for itself and performs conversion including unique information (for example, random numbers) that can be known only to the authentication device itself. In the second embodiment described above, the shared key between the communication terminal device and each authentication device is generated and assigned by the higher-level authentication device. Therefore, the shared key between the lower-level authentication device and the communication terminal device is: It was not secret for the higher-level authentication device that generated the key. On the other hand, in the third embodiment, since each authentication device generates a secret key for itself in a concealed manner, the shared key between the lower authentication device and the communication terminal device is not known to the upper authentication device. Can be.

  The internal configuration of the authentication device 20D is equal to the internal configuration of the authentication device 20D of the connection operator D in the first embodiment (see FIG. 3), but the operation of each component is different, so only the different points will be described below. To do.

  The key conversion information generation unit 24 sends the shared key with the communication terminal device 10 given by the key management unit 27 to the authentication device 20C connected to the lower side of the communication path from the communication terminal device 10 to itself. In order to keep it secret, one-way conversion is performed using the common key as at least one input value. The key conversion information generation unit 24 gives the output value of the generated one-way function to the encryption unit 25 as key conversion information. The one-way function used here is determined in advance with the communication terminal device 10.

  The internal configuration of the authentication device 20 of the connection provider C is the same as the internal configuration (see FIG. 4) of the authentication device 20C of the connection operator C in the first embodiment, but the operation of each component is different. Only described below.

  The key generation unit 23 generates a shared key with the communication terminal device 10 from the key conversion information given from the decryption unit 22. The key conversion information includes a one-way function application value of a shared key between the higher-level authentication device 20D and the communication terminal device 10, and restoration information for the common key.

  The key generation unit 23 inputs at least two random number generated by using a random number generator and one-way function application value of the shared key between the higher-level authentication device 20D and the communication terminal device 10 extracted from the key conversion information. By applying a predetermined function as a value, a shared key with the communication terminal device 10 is generated. The predetermined function used here is determined in advance with the communication terminal device 10. The key generation unit 23 updates the generated random number by including it in the restoration information given from the decryption unit 22 as restoration information. The key generation unit 23 gives the generated common key to the key management unit 27. Further, the key generation unit 23 gives the generated common key and the updated restoration information to the key conversion information generation unit 24.

  The key conversion information generation unit 24 is given a shared key and restoration information with the communication terminal device 10 from the key generation unit 23, and secretly transmits the shared key with the communication terminal device 10 to the authentication device 20B connected to the lower side from itself. Therefore, one-way conversion is performed using the common key as at least one input value. The key conversion information generation unit 24 gives the output value of the generated one-way function and the restoration information given from the key generation unit 23 to the encryption unit 25 as key conversion information. The one-way function used here is shared with the communication terminal device 10.

  The internal configuration of the authentication device 20B is equal to the internal configuration of the authentication device 20B in the second embodiment (see FIG. 8), but the key generation unit 23 has been described in the internal configuration of the authentication device 20C in the second embodiment. Although the operation is almost the same as that of the key generation unit 23, only the restoration information is given to the transmission unit 26.

  The internal configuration of the communication terminal device 10 is the same as the internal configuration (see FIG. 9) of the communication terminal device 10 in the second embodiment, but the operation of each component is different. That is, the key restoration unit 12 restores the shared key with the authentication device 20C and the shared key with the authentication device 20B from the common key given by the key management unit 13 and the restoration information given by the reception unit 11. First, the key restoration unit 12 derives a result of applying a one-way function with at least one input of the shared key with the authentication device 20D given by the key management unit 13, and the derived result value and the lower order A shared key with the authentication device 20C is generated by applying a prescribed function having at least two inputs of the random number generated by the authentication device 20C. Further, a result obtained by applying a one-way function with the generated common key as at least one input is derived, and the derived result value and a random number generated by the lower-level authentication device 20B are used as at least two inputs. By applying a prescribed function, a shared key with the authentication device 20B is generated.

  FIG. 11 shows an operation procedure in the third embodiment. In the figure, H (a, b) indicates that the information a is applied to the information b to perform one-way conversion, and E (a, b) encrypts the information b using the key a. G (a, b) represents a conversion function with information a and information b as inputs. Further, in the figure, only minimum information is described for ease of explanation, but it is not limited to this. For example, the input information of the one-way function H, the encryption function E, and the conversion function G includes Optional information may be included in addition to the described information.

  First, the authentication device 20D generates key conversion information (step S301). The shared key K_AD with the communication terminal apparatus 10 is unidirectionally converted to obtain a unidirectional conversion value H (K_AD). The obtained unidirectional conversion value H (K_AD) is used as key conversion information.

  Next, the authentication device 20D performs key conversion information delivery (step S302). The key conversion information H (K_AD) is encrypted using the shared key K_CD between the authentication device 20D and the authentication device 20C, and delivered to the authentication device 20C.

  Next, the authentication device 20C performs key setting (step S303). H (K_AD) is obtained by receiving and decrypting the encrypted key conversion information. Subsequently, a random number R_C is generated. The output value G {R_C, H (K_AD)} of the conversion function with the random numbers R_C and H (K_AD) as inputs is held as a shared key K_AC with the communication terminal device 10.

  Next, the authentication device 20C generates key conversion information (step S304). The shared key K_AC with the communication terminal apparatus 10 is unidirectionally converted to obtain a unidirectional conversion value H (K_AC). The obtained unidirectional conversion value H (K_AC) and the random number R_C as restoration information are used as key conversion information.

  Next, the authentication device 20C delivers key conversion information (step S305). The key conversion information {H (K_AC), R_C} is encrypted using the shared key K_BC between the authentication device 20C and the authentication device 20B, and delivered to the authentication device 20B.

  Next, the authentication device 20B performs key setting (step S306). The encrypted key conversion information is received and decrypted, and H (K_AC) and restoration information R_C are obtained. Subsequently, a random number R_B is generated. The output value G {R_B, H (K_AC)} of the conversion function with the random numbers R_B and H (K_AC) as inputs is held as a shared key K_AB with the communication terminal device 10.

  Next, the authentication device 20B delivers key recovery information to the communication terminal device 10 (step S307). The random number R_C and the random number R_B are delivered to the communication terminal device 10 as restoration information {R_C, R_B}.

  Next, the communication terminal apparatus 10 performs key recovery (step S308). Restoration information {R_C, R_B} is received. The shared key K_AD with the authentication device 20D is unidirectionally converted to obtain a unidirectional conversion value H (K_AD). The output value G {R_C, H (K_AD)} of the conversion function with the random number R_C and the obtained unidirectional conversion value H (H (K_AD) as input is restored as the shared key K_AC with the authentication device 20C. Thus, the restored key K_AC is unidirectionally transformed to obtain a unidirectional transformation value H (K_AC), and an output value of a transformation function having the random number R_B and the obtained unidirectional transformation value H (K_AC) as inputs. G {R_B, H (K_AC)} is restored as a shared key K_AB with the authentication device 20B.

  In the third embodiment described above, when the communication terminal device 10 shares a key with the authentication device 20B of the connection operator B that desires to connect, the authentication device 20D that has already shared the key with the communication terminal device 10 Unidirectional conversion value is notified to the lower-level authentication device 20C, and the lower-level authentication device 20C receives the conversion value input from the notified unidirectional conversion value and a random number generated by itself as a communication terminal device 10. Is set to the shared key, and the lower-rank authentication device 20B is notified of the set one-way conversion value of the key and the random value generated to cause the communication terminal device 10 to decrypt the key. When the person B notifies the communication terminal device 10 of the restoration information, the communication terminal device 10 restores and shares the key with each authentication device 20 on the communication path, and at the same time restores and restores the key with the authentication device 20B. Can be shared.

  Therefore, in the first and second embodiments described above, the higher-level authentication device has been able to derive the shared key between the lower-level authentication device and the communication terminal device, whereas in the third embodiment, There is an effect that the upper authentication apparatus cannot read the content of the shared key between the lower authentication apparatus and the communication terminal apparatus.

  In the above-described embodiments, the authentication device that the communication terminal device desires connection authentication has been described as a terminal authentication device as a communication terminal device, but the present invention is not limited to such a form. The authentication device may be an authentication device several hops away.

  Further, the authentication device that the communication terminal device already shares the key may exist in the middle of the communication path from the communication terminal device to the connection to the network.

  Furthermore, although the mode in which only one third authentication device exists on the communication path from the lowest authentication device to the highest authentication device has been described, two or more authentication devices may exist. .

  Furthermore, although the mode in which the communication terminal device and all the authentication devices on the communication path share the key has been described, a mode in which the key is shared only with an arbitrary connection provider on the path may be used.

  Further, although messages transmitted and received in order to share a key between the communication terminal device and each authentication device on the communication path, only a minimum amount of information is shown for ease of explanation. Some information related to the connection provider may be added. For example, by adding an identification number indicating a connection carrier or an identification number of an authentication device to the message, it may be possible to grasp the presence of a connection carrier required until the communication terminal device connects to the network. . Further, information such as an encryption method related to the security policy of the service provided by each connection provider is added to the message so that the communication terminal apparatus can grasp the security policy of each connection provider. good.

  Furthermore, it is assumed that the authentication devices of any connection provider on the communication path share a key and communicate securely, but a dedicated line or VPN is set up to ensure communication safety. If it is, it is not limited to this configuration.

  Furthermore, in the present invention, the target sharing the key with the communication terminal device has been described as an example of an arbitrary connection provider on the communication path, but it exists on the communication route until connection to the network, such as a broadband router device or a gateway device. Any device may be used.

It is a conceptual diagram which shows the example which a communication terminal device connects to a network via various connection providers. It is a block diagram which shows the connection relationship of the communication terminal device in the Example of this invention, and several connection operators. It is a block diagram which shows the internal structure of authentication apparatus 20D in a 1st Example. It is a block diagram which shows the internal structure of 20 C of authentication apparatuses in a 1st Example. It is a block diagram which shows the internal structure of the authentication apparatus 20B in a 1st Example. It is a block diagram which shows the internal structure of the communication terminal device 10 in a 1st Example. It is a sequence diagram which shows the operation | movement procedure in a 1st Example. It is a block diagram which shows the internal structure of the authentication apparatus 20B in a 2nd Example. It is a block diagram which shows the internal structure of the communication terminal device 10 in a 2nd Example. It is a sequence diagram which shows the operation | movement procedure in a 2nd Example. It is a sequence diagram which shows the operation | movement procedure in a 3rd Example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Communication terminal device 11 Receiving part 12 Key recovery part 13 Key management part 20B-20D Authentication apparatus 21 Reception part 22 Decoding part 23 Key generation part 24 Key conversion information generation part 25 Encryption part 26 Transmission part 27 Key management part 30 Network 40 AAA server A User BD Connection provider

Claims (8)

A communication terminal device that performs a confidential communication by setting a plurality of confidential communication paths between the connection targets for each connection request to the connection target, and each communication terminal device that is provided for each of the confidential communication paths is connected to the communication terminal device. A plurality of authentication devices that perform authentication processing and set a key of the secret communication path according to the authentication result, and a secret communication system including:
Basic authentication means for performing authentication processing on the communication terminal device in response to the connection request and generating one basic key according to the authentication result;
Key conversion information allocating means for allocating key conversion information obtained by repeating a predetermined conversion process for the generated basic key for each authentication device to the authentication device;
Each of the authentication devices, when the key conversion information is assigned to itself, the key conversion information assigned to the communication terminal device without performing authentication processing on the communication terminal device. A confidential communication system, characterized in that   2. The key conversion information allocating unit performs repetition of predetermined conversion processing for each authentication device in order from the higher-level authentication device on the connection target side to the lower-level authentication device on the communication terminal device side. Secret communication system.   3. The confidential communication system according to claim 2, wherein the key conversion information assigning unit performs one-way conversion processing as the predetermined conversion processing in the order from the higher-level authentication device to the lower-level authentication device.   3. The confidential communication system according to claim 2, wherein the key conversion information allocating unit performs a conversion process to which unique information that only the authentication apparatus can know is added for each authentication apparatus as the predetermined conversion process.   3. Each of the authentication devices sets information obtained by adding unique information known only to the assigned key conversion information to a key of a confidential communication channel corresponding to the authentication device. Secret communication system.   The plurality of authentication devices further include means for generating restoration information for restoring a key set for each of the authentication devices, and means for notifying the communication terminal device of the restoration information, The confidential communication system according to claim 1 or 2.   An authentication apparatus used for the confidential communication system according to any one of the preceding claims.   A communication terminal device used in the confidential communication system according to any one of the preceding claims.

Images