JP2009194601A - Encryption protocol executing device, encryption protocol executing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To optionally update or change an encryption protocol in accordance with a communication partner. <P>SOLUTION: An encryption protocol executing device includes: an interpreter which receives an encryption protocol function described in an encryption protocol description language to be executed by an application from the application; a compiler language conversion module which reads a definition file corresponding to the encryption protocol function to be executed by the application that the interpreter has received among definition files, and interprets the definition file to generate an execution file; and a table generation module which reads the execution file to generate a protocol execution table, and the encryption protocol function is executed according to the protocol execution table generated by the table generation module. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a cryptographic protocol execution device, a cryptographic protocol execution method, and a program for executing a cryptographic protocol between entities.

  In recent years, various services using computers have been provided. In many services, an authentication protocol for authenticating a user and a key exchange protocol for exchanging a key for encryption are used.

Conventionally, in a system using such an authentication protocol or a key exchange protocol, it is almost always implemented one protocol. Moreover, when changing a protocol for every apparatus, the protocol had to be individually mounted by that amount (for example, refer to Patent Document 1). Moreover, when updating, all the programs had to be replaced. IPSEC and the like can use a plurality of protocols, but it cannot be said that an optimum protocol is derived, and the number of protocols that can be executed is very limited to about two.
JP 2004-112037 A

  In other words, the conventional technology as described above has a problem in that when a problem occurs in the protocol, all the execution programs must be replaced, which is very expensive. Also, when a defect is found in the cryptographic algorithm used by the cryptographic protocol, the protocol must be exchanged in the same manner. Furthermore, it has been impossible to dynamically change the protocol without replacing such a program. In addition, the protocol compiler has a problem that it takes time to change the protocol because the protocol is operated after the execution code is generated once.

  Therefore, the present invention has been made in view of the above-described problems, and provides a cryptographic protocol execution device, a cryptographic protocol execution method, and a program capable of arbitrarily updating or changing a cryptographic protocol by a communication partner. With the goal.

  The present invention proposes the following matters in order to solve the above problems.

  (1) The present invention provides an interpreter (for example, interpreter 5 in FIG. 1) that receives an encryption protocol function described in an encryption protocol description language that the application wants to execute from an application (for example, equivalent to application 6 in FIG. 1). And a compiler language conversion module (for example, the compiler shown in FIG. 1) that reads a definition file corresponding to a cryptographic protocol function that the application received by the interpreter and wants to execute from the definition file and interprets the generated definition file. Language conversion module 3) and a table generation module (for example, equivalent to the table generation module 4 in FIG. 1) that reads the execution file and generates a protocol execution table. Protocol The rows in the table have proposed a cryptographic protocol execution device and executes the cryptographic protocol function.

  According to the present invention, the interpreter receives the cryptographic protocol function described in the cryptographic protocol description language that the application wants to execute from the application, and the compiler language conversion module executes the application received by the interpreter from the definition file. Read the definition file corresponding to the cryptographic protocol function you want to interpret and generate an executable file. The table generation module reads an execution file and generates a protocol execution table. Then, the cryptographic protocol function is executed by the protocol execution table generated by the table generation module. Therefore, the cryptographic protocol can be arbitrarily updated or changed according to a request from the application.

  (2) The present invention proposes a cryptographic protocol execution device according to (1), wherein the cryptographic protocol description language is composed of at least a function, data, an entity, and a flow. Yes.

  According to the present invention, the cryptographic protocol description language is composed of at least functions, data, entities, and flows. Therefore, any protocol can be described easily.

  (3) The present invention relates to the cryptographic protocol execution apparatus according to (1), wherein the definition file includes a protocol purpose description, an entity definition description, a data definition description, and a protocol definition description. A device is proposed.

  According to the present invention, the definition file includes a protocol purpose description, an entity definition description, a data definition description, and a protocol definition description. That is, the definition file is configured with the minimum necessary elements so that there is no duplication.

  (4) The present invention proposes a cryptographic protocol execution device according to (1), wherein the definition file includes descriptions of both entities that execute the cryptographic protocol.

  According to the present invention, the definition file includes a description of both entities executing the cryptographic protocol. Therefore, a plurality of different execution modules are generated from one definition file.

  (5) The present invention proposes a cryptographic protocol execution device characterized in that, in the cryptographic protocol execution device of (1), the definition file is described in XML.

  According to the present invention, the definition file is described in XML. Therefore, it is readable for the user, is easy to edit, and has excellent versatility.

  (6) The present invention proposes a cryptographic protocol execution device characterized in that, in the cryptographic protocol execution device of (1), the definition file collectively describes the same type of function definition.

  According to the present invention, the definition file collectively describes the same type of function definition. Therefore, this reduces the code size, so that redundancy can be suppressed.

  (7) The present invention proposes a cryptographic protocol execution device capable of calling a cryptographic algorithm from an application by using a common interface for each function with respect to the cryptographic protocol execution device of (1).

  According to the present invention, it is possible to call an encryption algorithm from an application by using a common interface for each function. Thereby, the replacement of the algorithm is facilitated, and a plurality of algorithms can be executed regardless of the use environment or the like.

  (8) The present invention proposes a cryptographic protocol execution device characterized in that the cryptographic protocol execution device of (1) is provided with storage means for storing the table generated by the table generation module.

  According to this invention, the storage means for storing the table generated by the table generation module is provided. Therefore, when executing the same protocol, the table creation processing can be omitted by reading the table stored in the storage means, so that the processing speed can be further increased.

  (9) The present invention proposes a cryptographic protocol execution device characterized in that a description language conversion module is provided as preprocessing of the interpreter for the cryptographic protocol execution device of (1).

  According to the present invention, the description language conversion module is provided as preprocessing of the interpreter. Thereby, the size of XML can be reduced, and addition of parameters and the like can be facilitated.

  (10) In the present invention, a first step (for example, corresponding to step S101 in FIG. 6) for transmitting a cryptographic protocol function desired to be executed by an application to the compiler, and a definition in which the compiler has a similar function from the definition file. The second step of reading and executing the file (for example, corresponding to step S102 in FIG. 6) and the electronic signature of the cryptographic protocol description file are verified, and when the validity is confirmed, the cryptographic protocol description file is stored. A third step (for example, equivalent to step S103 in FIG. 6), a fourth step for interpreting the cryptographic protocol description file and generating each table (for example, equivalent to step S104 in FIG. 6), A fifth step (for example, step S1 in FIG. 6) for implementing the cryptographic protocol according to the generated table And equivalent) in 5 proposes a cryptographic protocol execution method characterized by comprising a.

  According to the present invention, the cryptographic protocol function that the application wants to execute is transmitted to the compiler, and the compiler reads and executes a definition file having the same function from the definition file. Next, the electronic signature of the cryptographic protocol description file is verified, and when the validity is confirmed, the cryptographic protocol description file is stored, the cryptographic protocol description file is interpreted, and each table is generated. Then, the cryptographic protocol is implemented according to the generated table. Therefore, the cryptographic protocol can be arbitrarily updated or changed according to a request from the application.

  (11) In the present invention, the first step (for example, corresponding to step S101 in FIG. 6) for transmitting to the compiler the cryptographic protocol function that the application wants to execute to the computer is the same as the function from the definition file. A second step (for example, corresponding to step S102 in FIG. 6) for reading and executing a definition file having the above-mentioned and verifying the digital signature of the cryptographic protocol description file, and verifying the validity of the cryptographic protocol description file A third step for storing a file (for example, corresponding to step S103 in FIG. 6) and a fourth step for interpreting the cryptographic protocol description file and generating each table (for example, corresponding to step S104 in FIG. 6) ) And a fifth step (e.g., diagram) for implementing a cryptographic protocol according to the generated table And equivalent) in step S105 of proposes a program for execution.

  According to the present invention, the cryptographic protocol function that the application wants to execute is transmitted to the compiler, and the compiler reads and executes a definition file having the same function from the definition file. Next, the electronic signature of the cryptographic protocol description file is verified, and when the validity is confirmed, the cryptographic protocol description file is stored, the cryptographic protocol description file is interpreted, and each table is generated. Then, the cryptographic protocol is implemented according to the generated table. Therefore, the cryptographic protocol can be arbitrarily updated or changed according to a request from the application.

  According to the present invention, an authentication / key sharing protocol can be dynamically updated. Therefore, the protocol can be changed for each partner, or the protocol specification can be updated immediately when a security flow is found.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<Configuration of cryptographic protocol execution device>
As shown in FIG. 1, the cryptographic protocol execution apparatus according to the present embodiment includes a protocol definition file 1, an environment parameter acquisition module 2, a compiler language conversion module 3, a table generation module 4, an interpreter 5, and an application 6. It consists of and.

  The protocol definition file 1 is a file in which the specifications of the cryptographic protocol are described, and is described in a special description language for describing various definitions and execution steps related to the execution of processing according to the specifications of the cryptographic protocol. . In other words, the cryptographic protocol description language is composed of functions, data, entities, and flows so that any protocol can be described easily.

  In more detail, it consists of a protocol purpose description, an entity definition description, a data definition description, and a protocol definition description. The data definition description includes a function definition description. The protocol definition description is classified based on the XML description. As a result, it is easy for the user to edit, easy to edit, and versatile. In addition, an electronic signature is added to the protocol definition file 1. Therefore, the validity of the definition file can be confirmed by verifying the electronic signature.

  The environment parameter acquisition module 2 acquires various parameters required by the compiler language conversion module 3 and inputs them to the compiler language conversion module 3. It also mediates transmission and reception of protocol definition files. The compiler language conversion module 3 reads the protocol definition file 1 described in the protocol description language format and outputs an execution file. The table generation module 4 generates each table based on the execution file input from the compiler language conversion module 3.

  The interpreter 5 executes the protocol according to each table generated by the table generation module 4. The application 6 gives a protocol function (authentication and key sharing) to be executed to the compiler. Further, the application 6 can call the encryption algorithm with an interface common to each function (authentication protocol, key sharing protocol). Alternatively, the application 6 can be executed by giving a name to the protocol definition file 1.

The cryptographic algorithm and the like execute a protocol by calling an external library. Therefore, the compiler module 4 reads and compiles the header file of the external library during the compilation process. Also, in order to compile the same protocol definition file in any environment, the header file format is shared. Specifically, the header files for the following functions are shared.
1) Common key encryption algorithm 2) Public key encryption algorithm 3) Digital signature algorithm 4) Hash function algorithm 5) Message authenticator generation algorithm 6) Key sharing algorithm 7) Random number generation algorithm

In addition, a common ID is assigned to the encryption algorithm so that the compiler module can identify which algorithm the header file is. The environment parameter acquisition module is called by the interpreter 5. The environment parameter acquisition function acquires the following parameters and returns the acquired parameters to the interpreter 5.
1) API (header file) of each cryptographic algorithm and function
2) File that stores data such as keys in advance 3) Protocol definition file 4) Classification of Initiator and Responder

  When one of the two entities transmits a protocol definition file and the other receives it, the transmitting side is an initiator and the receiving side is a responder. Usually, one entity makes a request for the protocol definition file 1 first, and the other module sends the protocol definition file 1. In the case of the client-server model, the client is a responder that receives the protocol definition file 1, and the server is an initiator that transmits the protocol definition file 1. Note that which is the initiator may be determined dynamically between entities separately.

<Functions of compiler language conversion module>
The processing configuration of the compiler language conversion module is as shown in FIG. 2, and the compiler language conversion module has a structure analysis function, a semantic analysis function, and various table generation functions.

  The structure analysis function analyzes the XML of the protocol definition file and generates a data table and an analysis table. Specifically, 1) node extraction, 2) data table record addition, 3) analysis table record addition, 4) data storage, and 5) data-list generation are executed.

  The structure analysis function analyzes the structure of the data table. Specifically, 1) syntax check and 2) data for storing the function execution result are added to the data table. In this process, data is performed first. The image after the structural analysis is shown in the upper right of FIG.

  The semantic analysis function performs semantic analysis on the data table and reflects it in the data table and the analysis table. Specifically, 1) data-list link generation, 2) relation check, and 3) analysis table entity item data generation are performed. This process is performed for each record of the flow table. The image after semantic analysis is shown in the lower right of FIG.

<Relationship between analysis table, data table, and source generation table>
The relationship between the analysis table, data table, and source generation table is shown in FIG.
The data table stores contents (data) obtained by actually analyzing the XML describing the protocol definition file. The data table has a relation relationship, and each table has data of an id field in order to refer to data of another table.

  The source generation table is a table used when the source is actually generated. The content is an index to the data table, and a pointer that directly refers to the data is prepared to facilitate the data reference. This table and data table are used together when generating the source.

  The content of the analysis table is an index to the data table, and a pointer for directly referring to the data is prepared in order to facilitate data reference. Also, the usage for each entity is checked to facilitate the construction of the source generation table.

  The data table has items of other tables by id, but the analysis table / source generation table directly has a pointer on the data table corresponding to id.

<Configuration of source generation table>
As shown in FIG. 4, the source generation table is made up of an algorithm table, Data, Function, Flow, and Script. The algorithm table provides a header file, Data is a variable declaration and initialization, Function is a function definition, Flow Gives the flow and Script gives the body to generate the source code. Specifically, the data, flow, and function required by the entity are stored in Data, Function, and Flow, respectively, and source code is generated. Although not shown, error processing may be added as necessary.

<Relationship between protocol definition file and each table>
FIG. 5 shows the relationship between the protocol definition file and each table. According to FIG. 5, a data table group is generated from the protocol definition file, and an analysis table is generated from the protocol definition file and the data table group.

  Further, a source code generation table group is generated from the analysis table and the data table group.

<Processing of cryptographic protocol execution device>
Next, processing of the cryptographic protocol execution device will be described with reference to FIG.
First, the cryptographic protocol function that the application 6 wants to execute is transmitted to the compiler (step S101). The compiler reads a definition file having the same function from the definition file and executes it (step S102).

  The electronic signature of the cryptographic protocol description file is verified, and when the validity is confirmed, the cryptographic protocol description file is stored (step S103). Then, the cryptographic protocol description file is interpreted to generate each table (step S104), and the cryptographic protocol is implemented according to the generated table (step S105).

  Therefore, according to the present embodiment, the authentication / key sharing protocol can be dynamically updated. Therefore, when the protocol is changed for each partner or a security flow is found, the protocol specification is immediately updated. You will be able to.

<Example 1>
Hereinafter, as Example 1, the generation of functionInstance is shown by a specific example with reference to FIG.
First, one function is described for each record of the functionInstance-list in FIG. Then, the target record of the functionInstance table is acquired from the functionInstance-list of FIG. 7, and source code for calling the corresponding function is generated.

At this time, the source code is composed of the following elements.
1st line: Function declaration 2nd line: Function call

  The function name is acquired from the functionInstance table. The function name of the function to be called is generated from the data of the function table target record. The arguments are acquired from the data-list in the target record of the functionInstance table, and are first argument, second argument,. For the argument name, the data table target record is acquired from the data-list target record, and the contents of the label item are assigned to this. It should be noted that the description of the algorithm item in the function table does not match the description of the algorithm in the protocol definition file. For this correspondence, it is necessary to refer to the definition file.

As a result of the above processing, the following source code is obtained.
func_a () :: =
aaa_from (d1, func_b_ret, func_a_ret)

<Example 2>
Hereinafter, as a second embodiment, the generation of the flow will be described with a specific example with reference to FIG.
First, one function is described for each record of the flow-list in FIG. Then, the target record of the flow table is acquired from the flow-list of FIG. 8, and source code for calling the corresponding functionInstance and send or recv function is generated.

The source code consists of the following elements.
1) From:
1st line: Function declaration 2nd line and after: functionInstance function call Last line: send function call 2) To:
1st line: Function declaration 2nd line: recv function call 3rd line transition: functionInstance function call

  The function to be called is recursively acquired with all the descriptions of functionInstance-id in the data-list of the flow table target record and those with the description of functionInstance-id in the data-list of those functionInstances. .

  The function call order is from the deepest nesting. However, functions that are not related to each other need not be nested.

  The arguments are acquired from the data-list, and are first argument, second argument,... For the argument name, the data table target record is obtained from the data-list target record, and the contents of the label item are assigned to this.

As a result of the above processing, the following source code is obtained.
flow_1 () :: =
func_b ()
func_a ()
send (d1, func_a_ret)

  Note that the cryptographic protocol execution device of the present invention is realized by recording the processing of the cryptographic protocol execution device on a computer-readable recording medium, causing the cryptographic protocol execution device to read and execute the program recorded on the recording medium. be able to. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is a block diagram of the encryption protocol execution apparatus which concerns on this embodiment. It is a figure which shows the function of the compiler language conversion module which concerns on this embodiment. It is a figure which shows the relationship between the analysis table which concerns on this embodiment, a data table, and a source generation table. It is a figure which shows the structure of the source generation table which concerns on this embodiment. It is a figure which shows the relationship between the protocol definition file which concerns on this embodiment, and each table. It is a processing flow of the encryption protocol execution apparatus which concerns on this embodiment. FIG. 3 is a diagram illustrating an outline of processing according to the first embodiment. FIG. 10 is a diagram illustrating an outline of processing according to a second embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Protocol definition file, 2 ... Environment parameter acquisition module, 3 ... Compiler language conversion module, 4 ... Table generation module, 5 ... Interpreter, 6 ... Application

Claims (11)

An interpreter that receives, from an application, a cryptographic protocol function described in a cryptographic protocol description language that the application wants to execute;
A compiler language conversion module that reads a definition file corresponding to a cryptographic protocol function desired to be executed by the application received by the interpreter from the definition file, and generates an execution file by interpreting the definition file.
A table generation module that reads the execution file and generates a protocol execution table;
An encryption protocol execution apparatus, wherein the table generation module executes the encryption protocol function according to the generated protocol execution table.   2. The cryptographic protocol execution apparatus according to claim 1, wherein the cryptographic protocol description language includes at least a function, data, an entity, and a flow.   2. The cryptographic protocol execution apparatus according to claim 1, wherein the definition file includes a protocol purpose description, an entity definition description, a data definition description, and a protocol definition description.   2. The cryptographic protocol execution apparatus according to claim 1, wherein the definition file includes descriptions of both entities that execute the cryptographic protocol.   2. The cryptographic protocol execution apparatus according to claim 1, wherein the definition file is described in XML.   2. The cryptographic protocol execution apparatus according to claim 1, wherein the definition file collectively describes function definitions of the same type.   The cryptographic protocol execution device according to claim 1, wherein the cryptographic algorithm can be called from an application by a common interface for each function.   2. The cryptographic protocol execution apparatus according to claim 1, further comprising storage means for storing a table generated by the table generation module.   2. The cryptographic protocol execution apparatus according to claim 1, further comprising a description language conversion module as preprocessing of the interpreter. A first step of sending a cryptographic protocol function that the application wishes to perform to the compiler;
A second step in which the compiler reads and executes a definition file having the same function from the definition file;
A third step of verifying the electronic signature of the cryptographic protocol description file and storing the cryptographic protocol description file when the validity is confirmed;
A fourth step of interpreting the cryptographic protocol description file and generating each table;
A fifth step of implementing a cryptographic protocol according to the generated table;
A cryptographic protocol execution method characterized by comprising: On the computer,
A first step of sending a cryptographic protocol function that the application wishes to perform to the compiler;
A second step in which the compiler reads and executes a definition file having the same function from the definition file;
A third step of verifying the electronic signature of the cryptographic protocol description file and storing the cryptographic protocol description file when the validity is confirmed;
A fourth step of interpreting the cryptographic protocol description file and generating each table;
A fifth step of implementing a cryptographic protocol according to the generated table;
A program for running

Images