JP2014050069A - Encryption communication system and encryption communication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain an encryption communication system and an encryption communication method which can prevent congestion in a communication path even when a communication speed is slow.SOLUTION: A plurality of connection devices 2 are connected with a center device 1 via a radio communication path 3. The center device 1 encrypts a plain text by a first current key and transmits it to the connection devices 2, and decrypts an encrypted text received from the connection device 2 by the first current key or old key. When an encryption key is generated, the center device 1 deletes the stored old key, updates a first future key with the generated encryption key, updates the first current key with the stored first future key, and updates the old key with the stored first current key. The connection device 2 encrypts a plain text by a second current key and transmits it to the center device 1, and decrypts an encrypted text received from the center device 1 by the second current key or a second future key. The connection device 2 substitutes the first current key and the first future key received from the center device 1 for the second current key and the second future key, respectively.

Description

  The present invention relates to a cryptographic communication system and a cipher capable of preventing congestion of a communication path even when the communication speed is low when performing cryptographic communication between a center apparatus connected via a communication path and a plurality of connection apparatuses. It relates to a communication method.

  Conventionally, when performing encryption communication between a center device connected via a communication path and a plurality of connection devices, the connection device requests key distribution from the center device at the start of connection of the connection device and obtains an encryption key. I was getting.

  FIG. 6 is a diagram showing key distribution processing. In order for the connection device to acquire the encryption key, three-way communication of key distribution request, key distribution, and key distribution response is required at a minimum. For example, in SSL (Secure Socket Layer) widely used for cryptographic communication between a server (corresponding to a center device) and a client (corresponding to a connection device), client hello is a key distribution request and premaster secret message is key distribution In addition, finished corresponds to the key distribution response (see, for example, Non-Patent Document 1). This SSL further requires communication for processing such as certificate exchange and authentication.

  Since it is dangerous to deliver the encryption key itself from the center device to the connection device, a method of sending data for generating the encryption key and sharing the same key by an algorithm determined by both is often used (for example, Non-Patent Document 2). Also, in SSL, a random number (premaster secret) is sent, and the same encryption key is generated by both by calculating with an algorithm determined from the value.

The SSL Protocol Version 3.0, Internet <URL: http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt> W. Diffie and M. E. Hellman, “New Directions in Cryptography”, IEEE transactions on Information Theory, vol.IT-22, No.6, pp.644-654, Nov, 1976

  Conventionally, even when the key has not been updated in the center device, key distribution has been performed at the start of communication at the connection device or at the time of startup of the device. In order to reduce key distribution to the connection device, it is desirable to perform key distribution only when the key is updated in the center device. In order to realize this, it is necessary to perform key distribution to all the connected devices in synchronization with the key update in the center device. However, communication path congestion occurs due to a collision of key distribution to a plurality of connection devices. In order to avoid this, it is necessary to perform key distribution sequentially, but there are cases in which communication cannot be performed because the distribution of a new encryption key is not in time for some connection devices. This problem becomes significant when the communication speed is slow, for example, 10 Mbps or less.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to obtain an encryption communication system and an encryption communication method capable of preventing communication path congestion even when the communication speed is low.

  An encryption communication system according to the present invention includes a center device and a plurality of connection devices connected to the center device via a communication path, and the center device periodically generates an encryption key. And a first current key that is currently used, a first future key that is used after updating the first current key, and an old key that was used before the first current key When the encryption key generation unit generates the encryption key, the old key held is deleted, the encryption key is updated to the first future key, and the first future key held Is updated to the first current key, the first current key that has been held is updated to the old key, and the plaintext is encrypted with the first current key and encrypted. A first encryption unit that obtains a sentence; and the ciphertext output from the first encryption unit A first ciphertext transmission unit that transmits the data, a first ciphertext reception unit that receives a ciphertext transmitted from one of the plurality of connection devices, and the first ciphertext reception unit that the first ciphertext reception unit has received. A first decryption unit for decrypting a ciphertext with the first current key and decrypting with the old key if the ciphertext cannot be decrypted with the first current key; and the first current key and the first An encryption key transmission unit that encrypts one future key with a key distribution key and transmits it to one of the plurality of connection devices, wherein the connection device transmits the first key transmitted from the encryption key transmission unit. Key receiving unit that receives the current key and the first future key and decrypts the key with the key for key distribution, the second current key that is currently used, and the second current key that is used after the update And the first current key and the first future key output from the encryption key receiving unit, respectively. A second encryption key management unit that replaces the second current key with the second future key, a second encryption unit that encrypts plaintext with the second current key, and the second encryption. A second ciphertext transmission unit that transmits the ciphertext output from the unit to the center device; and a second ciphertext reception unit that receives the ciphertext transmitted from the first ciphertext transmission unit; The ciphertext received by the second ciphertext receiving unit is decrypted with the second current key, and if it cannot be decrypted with the second current key, the plaintext is decrypted with the second future key. And a second decoding unit to be obtained.

  According to the present invention, communication path congestion can be prevented even when the communication speed is low.

1 is an overall view showing a cryptographic communication system according to an embodiment of the present invention. It is a block diagram which shows the center apparatus which concerns on embodiment of this invention. It is a block diagram which shows the connection apparatus which concerns on embodiment of this invention. It is a figure which shows the key distribution processing flow which concerns on embodiment of this invention. It is a figure which shows the condition of the encryption key management in embodiment of this invention, and encryption communication. It is a figure which shows a key delivery process.

  An encryption communication system and an encryption communication method according to an embodiment of the present invention will be described with reference to the drawings. The same or corresponding components are denoted by the same reference numerals, and repeated description may be omitted.

  FIG. 1 is an overall view showing a cryptographic communication system according to an embodiment of the present invention. A plurality of connection devices 2 (up to several thousand units) are connected to one center device 1 via a low-speed wireless communication path 3 of 10 Mbps or less. Bidirectional encryption communication is performed between the center device 1 and the connection device 2, and there is no communication between the connection devices 2.

  FIG. 2 is a block diagram showing the center device according to the embodiment of the present invention. The encryption key management unit 4 includes a first current key that is currently used, a first future key that is used after updating the first current key, and an old key that was used before the first current key. And holding.

  The plaintext input unit 5 inputs plaintext from an external device. The encryption unit 6 encrypts the plaintext output from the plaintext input unit 5 with the first current key to obtain a ciphertext. The ciphertext transmission unit 7 transmits the ciphertext output from the encryption unit 6 to one of the plurality of connection devices 2.

  The ciphertext receiving unit 8 receives a ciphertext transmitted from one of the plurality of connection devices 2. The decrypting unit 9 decrypts the ciphertext received by the ciphertext receiving unit 8 with the first current key, and if it cannot be decrypted with the first current key, decrypts it with the old key to obtain plaintext. The plaintext output unit 10 outputs the plaintext output from the decryption unit 9 to an external device.

  The encryption key generation unit 11 periodically generates an encryption key. When the encryption key generation unit 11 generates the encryption key, the encryption key management unit 4 deletes the retained old key, updates the encryption key to the first future key, and retains the retained first future key. Is updated to the first current key, and the held first current key is updated to the old key.

  The encryption key request reception unit 12 receives the key distribution request packet and the connection device number from one of the plurality of connection devices 2 and supplies the key distribution request packet and the connection device number to the encryption key management unit 4. In response to this, the encryption key management unit 4 supplies the encryption key transmission unit 13 with the first current key, the first future key, the key generation time, and the like. The encryption key transmission unit 13 encrypts the first current key and the first future key with the key distribution key, and transmits the encrypted key to the connection device 2 corresponding to the connection device number. Specifically, the encryption key transmission unit 13 calculates a first current key, a first future key, a next key update time, a time at the time of key distribution in the clock of the center device 1, and a hash value of the key update interval. Then, the data before hashing and the hash value are encrypted and transmitted. The hash value is used to verify that no communication error or tampering has occurred during key distribution. The encryption key distribution response reception unit 14 receives a key distribution response packet from the connection device 2 that has performed the key distribution, and notifies the encryption key management unit 4 of the completion of key distribution.

  FIG. 3 is a block diagram showing the connection device according to the embodiment of the present invention. The encryption key management unit 15 holds a second current key that is currently used and a second future key that is used after the second current key is updated.

  The plaintext input unit 16 inputs plaintext from an external device. The encryption unit 17 encrypts the plaintext output from the plaintext input unit 16 with the second current key. The ciphertext transmission unit 18 transmits the ciphertext output from the encryption unit 17 to the center device 1.

  The ciphertext receiving unit 19 receives the ciphertext transmitted from the ciphertext transmitting unit 7. The decrypting unit 20 decrypts the ciphertext received by the ciphertext receiving unit 19 with the second current key, and if it cannot be decrypted with the second current key, decrypts it with the second future key to obtain plaintext. The plaintext output unit 21 outputs the plaintext output from the decryption unit 20 to the external device.

  Here, when the decryption unit 20 can decrypt with the second current key, the decryption unit 20 and the encryption unit 17 continue to decrypt and encrypt with the second current key. On the other hand, when the decryption unit 20 can decrypt with the second future key, the decryption unit 20 and the encryption unit 17 subsequently decrypt and encrypt with the second future key, respectively. However, it is possible to always use the second current key for encryption in the connection device 2 and decrypt with the second future key only when decryption with the second current key is impossible.

  If neither the second current key nor the second future key can be decrypted, it is determined as a communication error, and the key is not switched. Whether or not decryption is possible is determined by including CRC (Cyclic Redundancy Check) in the data to be encrypted and performing CRC verification. As described above, when the second current key is used and decryption cannot be performed, the encryption communication can be continued without receiving key distribution by switching to the second future key.

  The encryption key reception unit 22 receives the first current key and the first future key transmitted from the encryption key transmission unit 13, decrypts them with the key distribution key, and performs hash verification. If the hash verification is successful, the received encryption key is supplied to the encryption key management unit 15, the encryption key delivery response unit 24 is notified of receipt of the encryption key, and the encryption key delivery request unit 23 is notified of the next key update time and key update. The interval is supplied, and the clock of the connection device 2 is set to the time of the center device 1 that received it. If hash verification fails, the received packet is discarded.

  The encryption key management unit 15 updates the first current key and the first future key output from the encryption key receiving unit 22 to the second current key and the second future key, respectively. The encryption key distribution response unit 24 notified of the reception of the encryption key generates a key distribution response packet, encrypts it with the key distribution key, and transmits it to the encryption key distribution response reception unit 14 of the center apparatus 1.

  The encryption key distribution request unit 23 calculates the key update time one after another from the next key update time received at the time of key distribution and the key update interval. After receiving the key delivery, the key distribution request packet is received at a random time between the next key update time that is the next key update time of the center device 1 and the next key update time that is the next key update time. And the key distribution request packet and the connection device number are transmitted to the center device 1. As described above, after the key delivery is received, the key delivery request is made one after another until the key update time, so that the encrypted communication can be continued without interruption. The random time is determined using a random number or the like.

  If the connection device 2 is powered off, the encryption key distribution request unit 23 may not be able to transmit a key distribution request packet to the center device 1 from the next key update time to the next key update time. In this case, the key distribution request packet is transmitted to the encryption key distribution response receiving unit 14 of the center apparatus 1 when the power of the connection apparatus 2 is turned on after the line update time.

  Next, FIG. 4 is a diagram showing a key distribution processing flow according to the embodiment of the present invention. When the connection device 2 is initialized, the center device 1 generates a key for key distribution (step S1). The connection device 2 receives the key distribution key and writes it in the encryption key management unit 15 (step S2). The key delivery key is necessary for concealing the key to be delivered, and a different key delivery key is generated for each connection device 2 in advance, and the encryption key management unit 4 of the center device 1 and the encryption key of the connection device 2 are generated. It is written in the management unit 15.

  The center device 1 periodically updates the encryption key for communication (at a fixed key update interval) (step S3). The key update interval is determined by the communication system. The center device 1 holds the first current key, the first future key, and the old key. When the key is updated, the center device 1 deletes the held old key, and uses the encryption key as the first future key. The first future key that has been updated and retained is updated to the first current key, and the first current key that has been retained is updated to the old key.

  The connection device 2 checks the key delivery request timing determined at a random time from the next key update time to the next key update time from the next key update time and key update interval received from the center device 1 (step S4). ). If the key delivery request timing has passed, a key delivery request packet is immediately generated, and the key delivery request packet and the connection device number are transmitted to the center device 1 (step S5). If the connection device is turned off when the timing of the key delivery request is exceeded, the key delivery request is immediately made when the connection device 2 is turned on for the first time.

  The center device 1 waits for a key distribution request from the connection device 2 (step S6), and upon receiving the key distribution request, the first current key, first future key, center time, next key update time, hash of key update interval A value is calculated (step S7). The data before hashing and the hash value are encrypted with the key distribution key and transmitted to the connection device 2 (step S8).

  The connection device 2 receives the key or the like (step S9). These are decrypted with the key delivery key, and hash verification and time adjustment are performed. The first current key and the first future key received from the center device 1 are replaced with the original second current key and the second future key held in the encryption key management unit 15, respectively. The connection device 2 generates a key distribution response packet (step S10). The key delivery response packet is encrypted with the key delivery key, and a key delivery response is sent to the center apparatus 1 (step S11). Thereafter, the process returns to the key delivery request timing check S4. After receiving the key distribution response, the center device 1 confirms the completion of key distribution (step S12). Thereafter, the process returns to waiting for key distribution request reception S6.

  Note that using a key distribution key or hash value is a general method for key distribution, and various practical variations are possible. In this embodiment, a common key is used as a key distribution key, but a public key may be used. When a time lag occurs between the center device 1 and the connection device 2, a key delivery request timing in the connection device 2 is distorted. Therefore, the time is adjusted every time the key is delivered.

  After a series of key distribution processes, communication is possible. In the communicable state, the key delivery request timing check S4 is always performed. When the key delivery request timing is exceeded, a key delivery request is issued.

  Next, FIG. 5 is a diagram showing the state of encryption key management and encryption communication in the embodiment of the present invention. In the figure, Kn is an encryption key, n indicates the distinction of keys, and the same n indicates the same key. The key held by each device is shown in parentheses. In the center device 1 (old key, first current key, first future key), in the connection device 2 (second current key, second future key). Indicates. tKn indicates the key update time when the encryption key Kn becomes the old key from the first current key, and tI indicates the key update interval. tn indicates a time when the encryption key Kn is delivered as the first current key and Kn + 1 is delivered as the first future key.

  (1) The connection device 2 makes a key distribution request to the center device 1 (step S5 in FIG. 4). (2) Upon receiving the key distribution request, the center device 1 transmits the current key K1 and future key K2 of the center device 1 to the connection device 2 (step S8 in FIG. 4). At this time, the next key update time tK1 (time when K1 becomes the old key from the current key) and the key update interval tI are also transmitted. (3) The connection device 2 receives and confirms the first current key K1 and the first future key K2, and then replaces the second current key and the second future key of the connection device 2 with K1 and K2, respectively. Then, a key distribution response is transmitted to the center device 1 (step S11 in FIG. 4). (4) (5) Both the center device 1 and the connection device 2 encrypt with the current key K1.

  (6) Key update is performed in the center device 1 at time tK1. The newly generated encryption key K3 becomes the future key, the future key K2 becomes the current key, the current key K1 becomes the old key, and the original old key K0 is deleted.

  Even after the key update is performed in the center device 1, the connection device 2 cannot recognize the key update in the center device 1 until the communication from the center device 1 is received. Therefore, (7) when communicating from the connection device 2 to the center device 1, the second current key of the connection device 2 in which the connection device 2 is an old key (first current key before key update of the center device 1). Encrypt with K1. In this case, the center apparatus 1 attempts to decrypt with the first current key K2 after the key update, but cannot be decrypted due to the key mismatch, so the center apparatus 1 decrypts with the old key K1. Thereby, encryption communication can be continued without interruption.

  (8) When communicating from the center apparatus 1, the connection apparatus 2 tries to decrypt with the current key K2 of the center apparatus 1 and the connection apparatus 2 tries to decrypt with the current key K1. Decrypt with. (9) After successful decryption with the future key K2, the connection device 2 performs encryption with the future key K2. In some cases, after the key update, there is no communication (7) from the connection device, and communication (8) from the center device 1 is performed first.

  (10) At a random time t2 between the next key update time tK1 and the next key update time (tK1 + tI), the connection device 2 makes a key distribution request to the center device 1 (step S5 in FIG. 4). (11) Upon receiving the key distribution request, the center device 1 transmits the current key K2 and future key K3 of the center device 1 to the connection device 2 (step S8 in FIG. 4). (12) After receiving and confirming the current key K2 and the future key K3, the connecting device 2 replaces the second current key and the second future key of the connecting device 2 with K2 and K3, respectively, and the key to the center device 1 A delivery response is transmitted (step S11 in FIG. 4). (13) (14) Both the center apparatus 1 and the connection apparatus 2 encrypt with the current key K2. Thereafter, similar steps are repeated.

  As described above, in the present embodiment, the center device 1 holds the first current key, the first future key, and the old key, and the connection device 2 holds the second current key and the second future key. According to the configuration, the number of times of key distribution can be minimized (number of times of key update × number of connected devices), and encryption communication can be continued without interruption. Since each connection device 2 only needs to receive the updated key by the time when it cannot be decrypted with the held key, the center device 1 simultaneously distributes keys to all the connection devices 2 every time the key is updated. There is no need. For this reason, even when the communication speed is low, congestion of the communication path due to a collision with key distribution to another connection device can be prevented. Specifically, if the plurality of connection devices 2 make key distribution requests at random times from the next key update time to the next key update time, the timing of key distribution to the plurality of connection devices 2 is shifted, so that the communication path Can be prevented.

  In this embodiment, the encryption key transmission unit 13 of the center device 1 transmits the next key update time and the key update interval to the encryption key reception unit 22 of the connection device 2 in order to determine the key distribution request timing. . Not limited to this, the encryption key transmitting unit 13 of the center device 1 may transmit at least two of the next key update time, the next key update time, and the key update interval to the encryption key receiving unit 22 of the connection device 2. Also, the key update interval is written in advance in the second encryption key distribution request unit 23 of the connection device 2, and the encryption key transmission unit 13 of the center device 1 connects at least one of the next key update time and the key update time one after another. It may be transmitted to the encryption key receiving unit 22 of the device 2.

  Further, the encryption key transmission unit 13 of the center device 1 transmits data for generating the first current key and the first future key instead of the first current key and the first future key. May be. In this case, the connection device 2 generates a first current key and a first future key based on the received data.

DESCRIPTION OF SYMBOLS 1 Center apparatus, 2 connection apparatus, 3 wireless communication path (communication path), 4 encryption key management part (1st encryption key management part), 5,16 plaintext input part, 6 encryption part (1st encryption part) ), 7 ciphertext transmission unit (first ciphertext transmission unit), 8 ciphertext reception unit (first ciphertext reception unit), 9 decryption unit (first decryption unit), 10, 21 plaintext output unit, DESCRIPTION OF SYMBOLS 11 Encryption key production | generation part, 12 Encryption key request | requirement reception part, 13 Encryption key transmission part, 14 Encryption key delivery response reception part, 15 Encryption key management part (2nd encryption key management part), 17 Encryption part (2nd Encryption unit), 18 ciphertext transmission unit (second ciphertext transmission unit), 19 ciphertext reception unit (second ciphertext reception unit), 20 decryption unit (second decryption unit), 22 encryption key reception Part, 23 encryption key delivery request part, 24 encryption key delivery response part

Claims (16)

A center device;
A plurality of connection devices connected to the center device via a communication path;
The center device is
An encryption key generator that periodically generates an encryption key;
Holding a first current key that is currently in use, a first future key that is used after updating the first current key, and an old key that was used before the first current key; When the encryption key generation unit generates the encryption key, the stored old key is deleted, the encryption key is updated to the first future key, and the stored first future key is changed to the first future key. A first encryption key management unit that updates to the first current key and updates the held first current key to the old key;
A first encryption unit that encrypts plaintext with the first current key to obtain a ciphertext;
A first ciphertext transmission unit that transmits the ciphertext output from the first encryption unit to one of the plurality of connection devices;
A first ciphertext receiving unit that receives a ciphertext transmitted from one of the plurality of connection devices;
A first decryption that decrypts the ciphertext received by the first ciphertext receiving unit with the first current key, and obtains a plaintext by decrypting with the old key if the ciphertext cannot be decrypted with the first current key; And
An encryption key transmission unit that encrypts the first current key and the first future key with a key distribution key and transmits the encrypted key to one of the plurality of connection devices;
The connecting device is
An encryption key receiving unit that receives the first current key and the first future key transmitted from the encryption key transmitting unit and decrypts them with the key distribution key;
The second current key currently used and the second future key used after the second current key is updated, and the first current key output from the encryption key receiving unit and the second current key A second encryption key manager that replaces the first future key with the second current key and the second future key, respectively.
A second encryption unit for encrypting plaintext with the second current key;
A second ciphertext transmission unit that transmits the ciphertext output from the second encryption unit to the center device;
A second ciphertext receiver that receives the ciphertext transmitted from the first ciphertext transmitter;
The ciphertext received by the second ciphertext receiving unit is decrypted with the second current key, and if it cannot be decrypted with the second current key, the plaintext is obtained by decrypting with the second future key. A cryptographic communication system comprising: a second decryption unit. The connection device generates a key distribution request packet from a next key update time that is a next key update time by the center device to a next key update time that is a next key update time, and the key distribution request packet And an encryption key distribution request part for transmitting the connection device number to the center device,
The center device further includes an encryption key request reception unit that receives the key distribution request packet and the connection device number from one of the plurality of connection devices,
Upon receiving the key distribution request packet and the connection device number, the encryption key transmission unit encrypts the first current key and the first future key with the key distribution key, and converts the key into the connection device number. The encryption communication system according to claim 1, wherein the communication is transmitted to the corresponding connection device.   The encryption key distribution request unit of the plurality of connection devices generates the key distribution request packet at a random time from the next key update time to the next key update time, and transmits the packet to the center device. The cryptographic communication system according to claim 2.   The encryption key transmitting unit of the center device transmits at least two of the next key update time, the next key update time, and a key update interval to the encryption key receiving unit of the connection device. Item 4. The cryptographic communication system according to Item 2 or 3. The second encryption key distribution request unit holds a key update interval,
The said encryption key transmission part of the said center apparatus transmits at least one of the said next key update time and the said next key update time to the said encryption key reception part of the said connection apparatus, The Claim 2 or 3 characterized by the above-mentioned. The cryptographic communication system described   When the connection device is powered off and the encryption key distribution request unit cannot transmit the key distribution request packet to the center device from the next key update time to the next key update time, The cryptographic communication system according to any one of claims 2 to 5, wherein the key distribution request packet is transmitted to the center device when the power of the connection device is turned on after the line update time.   If the second decryption unit can decrypt with the second future key, the second decryption unit and the second encryption unit are decrypted and encrypted with the second future key thereafter. The cryptographic communication system according to any one of claims 1 to 6, characterized in that:   The encryption key transmission unit transmits data for generating the first current key and the first future key instead of the first current key and the first future key. The cryptographic communication system according to any one of claims 1 to 7. A method of performing cryptographic communication between a center device connected via a communication path and a plurality of connection devices,
The center device periodically generating an encryption key;
The first current key currently used by the center device, a first future key used after updating the first current key, and an old key used before the first current key When the encryption key is generated, the old key held is deleted, the encryption key is updated to the first future key, and the held first future key is Updating the first current key and updating the held first current key to the old key;
The center device encrypts a plaintext with a first current key and transmits it to one of the plurality of connection devices;
The center device receives a ciphertext transmitted from one of the plurality of connection devices, decrypts it with the first current key, and decrypts with the old key if it cannot be decrypted with the first current key When,
The center device encrypts the first current key and the first future key with a key distribution key and transmits the same to one of the plurality of connection devices;
The connection device receiving the first current key and the first future key transmitted from the center device and decrypting with the key delivery key;
The connection device holds a second current key currently used and a second future key used after updating the second current key, and receives the received first current key and the first Updating each of the future keys to the second current key and the second future key;
The connection device encrypts plaintext with the second current key and transmits it to the center device;
The connection device receives the ciphertext transmitted from the center device, decrypts it with the second current key, and decrypts it with the second future key if it cannot be decrypted with the second current key. An encryption communication method comprising: The connection device generates a key distribution request packet from a next key update time, which is a time when the center device performs next key update, to a next key update time, which is a time when the key is updated next, and the key distribution request packet Transmitting the connection device number to the center device;
The center device receiving the key distribution request packet and the connection device number from one of the plurality of connection devices;
When the center device receives the key distribution request packet and the connection device number, the center device encrypts the first current key and the first future key with the key distribution key and corresponds to the connection device number. The encryption communication method according to claim 9, further comprising a step of transmitting to the connection device.   The plurality of connection devices generate the key distribution request packet at a random time between the next key update time and the next key update time, and transmit the packet to the center device. The encryption communication method described.   The encryption communication method according to claim 10 or 11, wherein the center device transmits at least two of the next key update time, the next key update time, and a key update interval to the connection device. The plurality of connection devices hold a key update interval;
12. The encryption communication method according to claim 10, wherein the center device transmits at least one of the next key update time and the next key update time to the connection device.   If the connection device is powered off and the key distribution request packet cannot be transmitted to the center device between the next key update time and the next key update time, the connection device updates The encryption communication method according to claim 10, wherein the key distribution request packet is transmitted to the center device when the power of the connection device is turned on after the time.   15. The connection device according to claim 9, wherein when the connection device can perform decryption using the second future key, encryption and decryption are performed using the second future key thereafter. The encryption communication method described in 1.   The center device transmits data for generating the first current key and the first future key instead of the first current key and the first future key. Item 16. The encryption communication method according to any one of Items 9 to 15.

Images