JP2015233173A - Communication system, communication device, and communication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication system, a communication device, and a communication method that are able to improve confidentiality of information between communication devices.SOLUTION: A first communication device 10 encrypts first information using a first encryption key, encrypts the generated primary encryption data and second information using a second encryption key, and transmits the generated secondary encryption data to a relay device 20. The relay device 20 receives the transmitted secondary encryption data, decrypts the received secondary encryption data using the second encryption key, and transmits transfer data on the basis of the obtained primary encryption data to a second communication device 30. The second communication device 30 receives the transfer data transmitted by the relay device 20, and decrypts the received transfer data using the first encryption key.

Description

  The present invention relates to a communication system, a communication apparatus, and a communication method, and more particularly, to a communication system, a communication apparatus, and a communication method that perform communication via a relay apparatus.

  In a network such as the Internet, data to be transmitted / received may be acquired or altered by a third party. Therefore, a method of transmitting / receiving encrypted data between a transmission device and a reception device is used to improve the security of confidential information and the like. For example, a communication protocol for performing encrypted communication between a transmission device and a reception device has been standardized.

  Patent Documents 1 and 2 are known as related techniques.

JP 2001-217843 A JP 2006-295519 A

  On the other hand, when performing encrypted communication between a transmission device and a reception device, if the transmission device and the reception device cannot communicate directly via a network or the like, a method of performing communication via a relay device such as a relay personal computer (personal computer) Can be considered. For example, when encrypted communication using a general communication protocol is used, encrypted communication is performed in communication between the transmission device and the relay device, and further encrypted communication is performed between the relay device and the reception device. In that case, there is a problem that the communication data is decoded by the relay device, and the confidentiality of information between the transmission device and the reception device may not be ensured.

  In view of such a problem, an object of the present invention is to provide a communication system, a communication apparatus, and a communication method capable of improving the confidentiality of information between communication apparatuses.

  A communication system according to the present invention is a communication system including a first communication device, a second communication device, and a relay device that relays communication between the first and second communication devices, The first communication device performs encryption using a first encryption key on the first information, generates primary encrypted data, the generated primary encrypted data, and The second information is encrypted using the second encryption key, the second encryption unit that generates secondary encrypted data, and the generated secondary encrypted data is transmitted to the relay device. A first transmission unit, wherein the relay device receives a second encrypted data transmitted from the first communication device, and a second receiving unit that receives the second encrypted data. Decryption using the second encryption key, and the primary encrypted data and the second information. And a second transmission unit for transmitting transfer data based on the acquired primary encrypted data to the second communication device, and the second communication device includes: A second receiving unit that receives the transfer data transmitted from the relay device; and a first receiver that performs the decryption using the first encryption key based on the received transfer data and acquires the first information 2 decoding units.

  A communication apparatus according to the present invention is a communication apparatus that transmits first information to another communication apparatus via a relay apparatus, and performs encryption using the first encryption key for the first information. First encryption unit for generating primary encrypted data, and encryption using a second encryption key for the generated primary encrypted data and second information to generate secondary encrypted data A second encryption unit that transmits the generated secondary encrypted data to the relay device.

  A communication apparatus according to the present invention is a communication apparatus that receives first information from another communication apparatus via a relay apparatus, wherein the other communication apparatus assigns a first encryption key to the first information. The first encrypted data encrypted using the second encrypted data and the second encrypted data obtained by encrypting the first encrypted data and the second information using the second encryption key are transmitted to the relay device. After that, the receiving unit that receives, from the relay device, transfer data based on the primary encrypted data obtained by decrypting the secondary encrypted data using the second encryption key by the relay device; A decryption unit that performs decryption using the first encryption key based on the received transfer data and obtains the first information.

  A communication method according to the present invention is a communication method in a communication system including a first communication device, a second communication device, and a relay device that relays communication between the first and second communication devices. The first communication device performs encryption using the first encryption key on the first information, generates primary encrypted data, and generates the generated primary encrypted data and second information. Is encrypted using a second encryption key, generates secondary encrypted data, transmits the generated secondary encrypted data to the relay device, and the relay device transmits the first communication Receiving the secondary encrypted data transmitted from the apparatus, decrypting the received secondary encrypted data using the second encryption key, and storing the primary encrypted data and the second information. Obtaining the transfer data based on the obtained primary encrypted data The second communication device receives the transfer data transmitted from the relay device, and performs decryption using the first encryption key based on the received transfer data. The first information is acquired.

  A communication method according to the present invention is a communication method in a communication device that transmits first information to another communication device via a relay device, and an encryption method using a first encryption key for the first information. To generate primary encrypted data, encrypt the generated primary encrypted data and second information using a second encryption key, generate secondary encrypted data, and generate the generated data. The secondary encrypted data thus transmitted is transmitted to the relay device.

  A communication method according to the present invention is a communication method in a communication device that receives first information from another communication device via a relay device, wherein the other communication device performs a first operation on the first information. The primary encrypted data encrypted using the encryption key, and the secondary encrypted data obtained by encrypting the primary encrypted data and the second information using the second encryption key are relayed. After transmitting to the device, the relay device receives the transfer data based on the primary encrypted data obtained by decrypting the secondary encrypted data using the second encryption key from the relay device, and The first information is obtained by performing decryption using the first encryption key based on the received transfer data.

  ADVANTAGE OF THE INVENTION According to this invention, the communication system, the communication apparatus, and communication method which can improve the confidentiality of the information between communication apparatuses can be provided.

It is a block diagram which shows the outline | summary of the communication system which concerns on embodiment. 1 is a configuration diagram showing a configuration of a communication system according to Embodiment 1. FIG. 2 is a block diagram showing functional blocks and data flow of the communication system according to Embodiment 1. FIG. 3 is a flowchart showing an operation of the communication system according to the first embodiment. FIG. 3 is a block diagram illustrating a functional block and a data flow of an encryption processing unit according to the first embodiment. 3 is a diagram showing a configuration of double encrypted data used in the communication system according to Embodiment 1. FIG. 3 is a block diagram illustrating a functional block and a data flow of a decoding processing unit according to Embodiment 1. FIG. 3 is a configuration diagram illustrating a configuration of a communication system according to Embodiment 2. FIG. FIG. 10 is a block diagram illustrating functional blocks and data flow of a communication system according to a third embodiment. FIG. 10 is a configuration diagram showing a configuration of a communication system according to a fourth embodiment. FIG. 10 is a configuration diagram showing a configuration of a communication system according to a fifth embodiment. It is a block diagram which shows the structure of the communication system of a reference example.

(Outline of the embodiment)
First, a reference example before application of the embodiment is examined. FIG. 12 shows a configuration of a communication system 900 of a reference example. As shown in FIG. 12, the communication system 900 of the reference example includes a system management personal computer 910, the Internet 920, a plurality of relay personal computers 930 (930-1 to 930-2), and a plurality of portable terminal devices 940 (940-1 to 940). -4).

  The portable terminal device 940 is a device that handles confidential information, has no function of connecting to the Internet 920, and can communicate with the relay personal computer 930 by serial communication. The system management personal computer 910 manages confidential information and can be connected to the Internet 920. The mobile terminal device 940 needs to transmit and receive confidential information to be handled with the system management personal computer 910 while ensuring confidentiality.

  Since the mobile terminal device 940 cannot be connected to the Internet 920, it communicates with the system management personal computer 910 via the relay personal computer 930. At this time, since the confidential information needs to secure confidentiality between the system management personal computer 910 and each portable terminal device 940, the confidential information must not be disclosed to the relay personal computer 930 or other portable terminal devices 940.

  However, when communication between the system management personal computer 910 and the relay personal computer 930 is performed with related encrypted communication using the Internet communication protocol (see, for example, Patent Document 1), the encryption is performed when the communication is received by the relay personal computer 930. Since the encrypted communication is decrypted, the confidential information is disclosed to the relay personal computer 930. Further, since communication between the relay personal computer 930 and the portable terminal device 940 uses serial communication, encrypted communication using the Internet communication protocol cannot be used. That is, the reference example has the following problems.

  The first problem is that the confidentiality of data between the transmitting device and the receiving device when the device for transmitting the confidential data and the receiving device cannot communicate directly and a relay personal computer is required. Is not protected. The reason is that in the case of related encrypted communication using the Internet communication protocol, the communication data encrypted by the relay personal computer is decrypted during communication between the transmitting device and the relay personal computer. This is because the confidentiality of data between the transmission device and the reception device is lost.

  The second problem is that encrypted communication using a communication protocol cannot be used for the Internet in the case of serial communication or the like.

  Therefore, in the embodiment, when data communication is performed using the Internet or the like, if a relay personal computer or the like is required between the transmission device and the reception device, the communication data is double-encrypted to the relay personal computer. Data communication is performed between the transmitting device and the receiving device while ensuring the confidentiality of the communication data without disclosing the communication data.

  FIG. 1 shows an overview of a communication system according to an embodiment. As shown in FIG. 1, the communication system according to the embodiment performs communication between the first communication device 10, the second communication device 30, and the first communication device 10 and the second communication device 30. And a relay device 20 for relaying.

  The first communication device 10 includes a first encryption unit 11, a second encryption unit 12, and a first transmission unit 13. The first encryption unit 11 encrypts the first information using the first encryption key to generate primary encrypted data. The second encryption unit 12 performs encryption using the second encryption key on the generated primary encrypted data and the second information, and generates secondary encrypted data. The first transmission unit 13 transmits the generated secondary encrypted data to the relay device 20.

  The relay device 20 includes a first reception unit 21, a first decoding unit 22, and a second transmission unit 23. The first receiving unit 21 receives the secondary encrypted data transmitted from the first communication device 10. The first decryption unit 22 decrypts the received secondary encrypted data using the second encryption key, and acquires the primary encrypted data and the second information. The second transmission unit 23 transmits transfer data based on the acquired primary encrypted data to the second communication device 30.

  The second communication device 30 includes a second receiving unit 31 and a second decoding unit 32. The second reception unit 31 receives the transfer data transmitted from the relay device 20. The second decryption unit 32 performs decryption using the first encryption key based on the received transfer data, and acquires first information.

  In this way, when the encryption is performed twice, the transmission side communication device that performs data transmission and the reception side communication device that performs data reception cannot directly communicate with each other, and a relay device is necessary. Since the content of the transmission data is not disclosed to the relay device, the confidentiality of information between communication devices can be improved.

(Embodiment 1)
The first embodiment will be described below with reference to the drawings. FIG. 2 shows a configuration of the communication system 100 according to the present embodiment. As shown in FIG. 2, the communication system 100 according to the present embodiment includes a transmission / reception device (first communication device) 110, the Internet 120, a relay personal computer 130, and a transmission / reception device (second communication device) 140. .

  The transmission / reception device 110 and the relay personal computer 130 are communicably connected via the Internet 120, and the relay personal computer 130 and the transmission / reception device 140 are communicably connected via a serial line 121 (serial communication). The Internet 120 and the serial line 121 are examples, and may be connected via other networks and lines.

  The transmission / reception devices 110 and 140 encrypt data to be transmitted, transmit the encrypted data to the other device, receive data from the other device, and decrypt the received data. The relay personal computer 130 communicates with the transmission / reception device 110 via the Internet 120 and relays communication data to the transmission / reception device 140.

  For example, the transmission / reception device 110 is a server (system management personal computer) that performs system management, the relay personal computer 130 is a personal computer, and can be connected to the Internet 120. The transmission / reception device 140 is a device such as a portable terminal device that cannot be connected to the Internet 120, and can perform data communication with a personal computer by serial communication. For example, the relay personal computer 130 and the transmission / reception device 140 exist in the same place, and the transmission / reception device 110 exists in a remote place. When the transmission / reception device 140 receives confidential information stored in the transmission / reception device 110, encrypted communication is performed using this embodiment.

  FIG. 3 shows a functional block and a flow of double encryption data in the communication system 100 according to the present embodiment. In FIG. 3, as an example, the transmission / reception device 110 is illustrated as a transmission device that mainly transmits data, and the transmission / reception device 140 is illustrated as a reception device that mainly receives data.

  The transmission / reception device 110 includes an encryption processing unit 111 and a data communication unit 112, and further includes a storage unit (not shown) that stores an encryption key K1, an encryption key K2, communication data, header information, and double encrypted data. ing. The transmission / reception device 110 holds an encryption key K1 and an encryption key K2 in advance.

  The relay personal computer 130 includes a decryption processing unit 131, an encryption processing unit 132, and data communication units 133 and 134, and further includes an encryption key K2, an encryption key K3, encrypted data, double encrypted data (received double encrypted data). Storage unit (not shown) for storing the encrypted data and the transmission double encrypted data). The relay personal computer 130 holds the encryption key K2 and the encryption key K3 in advance.

  The transmission / reception device 140 includes a decryption processing unit 141 and a data communication unit 142, and further includes a storage unit (not shown) that stores the encryption key K1, the encryption key K3, double encrypted data, and communication data. The transmission / reception device 140 includes an encryption key K1 and an encryption key K3 in advance.

  The operation of the communication system 100 according to the present embodiment will be described using FIGS. 4 to 7 with reference to FIG. FIG. 4 is a flowchart showing an operation when data is transmitted from the transmission / reception device 110 to the transmission / reception device 140 via the relay personal computer 130 in the communication system 100 according to the present embodiment.

  As illustrated in FIG. 4, the encryption processing unit 111 of the transmission / reception device 110 encrypts communication data (first information) such as confidential information using an encryption key K1, and encrypts the encrypted data (primary encrypted data). ) Is generated (S101). Further, the encryption processing unit 111 generates a message authentication code using the generated encrypted data and the encryption key K1 (S102). The encryption processing unit 111 assigns the generated message authentication code to the generated encrypted data and header information (second information) necessary for transfer in the relay personal computer 130, and then encrypts the encrypted data using the encryption key K2. Then, double encrypted data (secondary encrypted data) is generated (S103).

  FIG. 5 shows an example of the encryption processing unit 111 that realizes the operations of S101 to S103 of FIG. For example, the encryption processing unit 111 includes a first encryption unit 201, a hash calculation unit 202, and a second encryption unit 203.

  The first encryption unit 201 of the encryption processing unit 111 performs encryption using the communication data and the encryption key K1, and generates encrypted data. The hash calculation unit 202 of the encryption processing unit 111 performs hash calculation by combining the generated encrypted data and the encryption key K1, and generates a message authentication code. The second encryption unit 203 of the encryption processing unit 111 combines the generated encrypted data, message authentication code, and header information and performs encryption with the encryption key K2, thereby generating double encrypted data.

  FIG. 6 shows an example of the data structure of double encrypted data generated by the encryption processing unit 111. The communication data is data that ensures information concealment between the transmission device (transmission / reception device 110) and the reception device (transmission / reception device 140). The header information is information necessary for the relay personal computer 130 to transfer data to the receiving device, and may be information disclosed to the relay personal computer 130. The message authentication code is a code calculated by hash calculation in FIG. 5 in order to detect tampering of communication data. The present embodiment is characterized in that encrypted data obtained by encrypting communication data is encrypted together with data provided with header information and a message authentication code.

  4, the data communication unit (first transmission unit) 112 of the transmission / reception device 110 transmits the double encrypted data generated by the encryption processing unit 111 to the relay personal computer 130 via the Internet 120. (S104). Then, the data communication unit (first receiving unit) 133 of the relay personal computer 130 receives the double encrypted data transmitted from the transmission / reception device 110 via the Internet 120 (S105).

  The decryption processing unit (first decryption unit) 131 of the relay personal computer 130 decrypts the received double encrypted data with the encryption key K2, and generates encrypted communication data (encrypted data) and header information. (S106). That is, as shown in FIG. 6, the encrypted data and the header information included in the double encrypted data are acquired. With reference to the acquired header information, the transmission / reception apparatus (receiving data) of the transmission destination is specified. The transmission / reception device of the transmission destination may be specified by any processing (timing) of the decryption processing unit 131, the encryption processing unit 132, and the data communication unit 134.

  The encryption processing unit 132 of the relay personal computer 130 encrypts the encrypted communication data (encrypted data) with the encryption key K3 and generates double encrypted data to be transmitted to the transmission / reception device 140 (reception device) ( S107). For example, the encrypted data and the message authentication code in FIG. 6 are encrypted to generate double encrypted data. Similar to FIG. 6, double encrypted data may be generated by encrypting the header information, the encrypted data, and the message authentication code.

  The data communication unit (second transmission unit) 134 of the relay personal computer 130 transmits the generated double encrypted data to the transmission / reception device 140 of the transmission destination via the serial line 121 (S108). Then, the data communication unit (second reception unit) 142 of the transmission / reception device 140 receives the double encrypted data transmitted from the relay personal computer 130 via the serial line 121 (S109).

  The decryption processing unit 141 of the transmission / reception device 140 decrypts the received double encrypted data with the encryption key K3, and extracts the encrypted data and the message authentication code (S110). The decryption processing unit 141 generates a message authentication code using the encrypted data and the encryption key K1, compares it with the sent message authentication code, and confirms (authenticates) whether or not the encrypted data has been tampered with. (S111). If there is no falsification of the encrypted data, the decryption processing unit 141 decrypts the encrypted data with the encryption key K1 to generate communication data (S112).

  FIG. 7 shows an example of the decoding processing unit 141 that realizes the operations of S110 to S112 of FIG. For example, the decryption processing unit 141 includes a first decryption unit 211, a hash calculation unit 212, and a second decryption unit 213.

  The first decryption unit 211 of the decryption processing unit 141 decrypts the double encrypted data with the encryption key K3, and acquires the encrypted data and the message authentication code. The hash calculation unit 212 of the decryption processing unit 141 performs hash calculation by combining the acquired encrypted data and the encryption key K1, generates a message authentication code, and generates the message authentication code and the double encrypted data from Compare the acquired message authentication code. The second decryption unit 213 of the decryption processing unit 141 decrypts the acquired encrypted data with the encryption key K1 when the generated message authentication code matches the message authentication code acquired from the double encrypted data. To generate communication data.

  When the transmission / reception device 110 is a reception device and the transmission / reception device 140 is a transmission device, in FIG. 3, the transmission / reception device 110 is provided with a decryption processing unit 141, and the transmission / reception device 140 is provided with an encryption processing unit 111. By exchanging K2 and encryption key K3 and performing processing, communication can be similarly performed using double encrypted data.

  By adopting the above configuration, the following effects can be obtained in the present embodiment.

  The first effect is that the confidentiality of data between the transmission device and the reception device is protected. The reason is that the transmission device encrypts the communication data with an encryption key that cannot be decrypted by the relay personal computer, and double-encrypts the encrypted communication data and the information necessary for the relay with a key that can be decrypted by the relay personal computer. This is because by transmitting to the personal computer, it is possible to transmit to the receiving device without disclosing the contents of the communication data to the relay personal computer.

  The second effect is that encrypted communication is possible even in an environment where encrypted communication using an Internet communication protocol cannot be performed. The reason is that communication is performed after the communication data is encrypted in this method, and therefore communication data can be encrypted without depending on the communication protocol of the Internet.

(Embodiment 2)
FIG. 8 shows an example in which a plurality of reception devices (transmission / reception devices 140-1 to 140-2) are connected to the relay personal computer 130 as another configuration example of the communication system 100.

  When the transmission / reception device 140-1 and the transmission / reception device 140-2 handle different confidential information, the transmission / reception device 110 as the transmission device has the encryption key K1 and the encryption key K2, and the relay personal computer 130 has the encryption key K2 and the encryption key. K3-1 and encryption key K3-2 are held. The transmission / reception device 140-1 holds the encryption key K1 and encryption key K3-1. The transmission / reception device 140-2 holds the encryption key K1 and encryption key K3-2. It shall be held.

  The transmission / reception device 110 describes the information of the transmission / reception device 140 as the transfer destination in the header information, and the relay personal computer 130 decrypts the double-encrypted data with the encryption key K2 and identifies the transmission / reception device 140 for the purpose of reading identified from the header information. It is possible to transfer communication data to.

  When performing encrypted communication from the transmission / reception device 110 to the transmission / reception device 140-1, the processing is performed by replacing the encryption key K3 with the encryption key K3-1 in FIG. 3, and encryption is performed from the transmission / reception device 110 to the transmission / reception device 140-2. In the case of performing communication, it is possible to similarly perform communication using double encrypted data by replacing the encryption key K3 with the encryption key K3-2 in FIG.

  In this case, the encryption key is the encryption key K1 used by the transmission / reception device 110 and the transmission / reception device 140, the encryption key K2 used by the transmission / reception device 110 and the relay personal computer 130, and the encryption key K3- used by the relay personal computer 130 and the transmission / reception device 140-n. n is required, and n + 2 types of encryption keys are required when n receiving devices are connected to the relay personal computer 130.

  In this way, communication between devices is performed by using double-encrypted data by combining the encryption key K1 for encrypting communication data and the encryption key K2 and encryption key K3, which are different for each communication partner, between the transmitting and receiving devices. Confidentiality can be improved.

(Embodiment 3)
In an example in which a plurality of receiving devices (transmitting / receiving devices 140-1 to 140-2) are connected to the relay personal computer 130 as shown in FIG. 8, when the transmitting / receiving device 140-1 and the transmitting / receiving device 140-2 handle the same confidential information, When the encrypted data is transferred from the relay personal computer 130 to the transmission / reception device 140, it is possible to communicate without performing double encryption.

  FIG. 9 shows a functional block and a data flow in this case. The transmission / reception device 110 on the transmission side has the encryption key K1 and the encryption key K2, the relay personal computer 130 has the encryption key K2, and the transmission / reception devices 140-1 and 140-2 on the reception side have the encryption key K1. It shall be held. In this case, the encryption key requires two types of encryption keys: an encryption key K1 used by the transmission / reception device 110 and the transmission / reception device 140, and an encryption key K2 used by the transmission / reception device 110 and the relay personal computer 130.

  In the example of FIG. 9, the relay personal computer 130 includes a decryption processing unit 131 and data communication units 133 and 134. The data communication unit 134 transmits the encrypted data decrypted by the decryption processing unit 131 to the transmission / reception device 140. The decryption processing unit 141 of the transmission / reception device 140 decrypts the received encrypted data with the encryption key K1, and generates communication data. Thereby, the confidentiality of information can be similarly secured in the transmission / reception device 140-1 and the transmission / reception device 140-2.

(Embodiment 4)
FIG. 10 shows an example in which the communication system 100 is routed through a plurality of relay personal computers 130 (130-1 to 130-2).

  For example, the transmission / reception device 110 on the transmission side has the encryption key K1 and the encryption key K2, the relay personal computer 130-1 has the encryption key K2, and the relay personal computer 130-2 has the encryption key K2 and the encryption key K3. The receiving transmission / reception device 140 holds the encryption key K1 and the encryption key K3.

  When transmitting data from the relay personal computer 130-1 to the relay personal computer 130-2, the relay personal computer 130-1 decrypts and encrypts the double encrypted data received from the transmission / reception device 110 with the encryption key K2. Double-encrypted data is generated and transferred to relay personal computer 130-2. Further, the relay personal computer 130-2 can transfer the communication data from the relay personal computer 130-2 to the receiving-side transmitting / receiving device 140 by performing the same processing as in FIG. Thereby, even when a plurality of relay apparatuses are used, the confidentiality of information can be ensured as in the other embodiments.

(Embodiment 5)
FIG. 11 shows an example in which a receiving device (transmission / reception devices 140-1 to 140-2) is connected to each of a plurality of relay personal computers 130 (130-1 to 130-2) as another configuration example of the communication system 100. ing.

  When different confidential information is handled in the transmission / reception device 140-1 and the transmission / reception device 140-2 on the reception side, the transmission / reception device 110 on the transmission side has the encryption key K1 and the encryption key K2, and the relay personal computer 130-1 has the encryption key. K2 and encryption key K3-1, relay PC 130-2 has encryption key K2 and encryption key K3-2, and transmission / reception device 140-1 has encryption key K1 and encryption key K3-1. The transmission / reception device 140-2 has an encryption key K1 and an encryption key K3-2.

  When performing encrypted communication from the transmission / reception device 110 to the transmission / reception device 140-1, the encryption key K3 is replaced with the encryption key K3-1 in FIG. 3 to perform encrypted communication, and the transmission / reception device 110 to the transmission / reception device 140-2. In the case of performing the encrypted communication, it is possible to similarly communicate using the double encrypted data by performing the encrypted communication by replacing the encryption key K3 with the encryption key K3-2 in FIG.

  When m relay personal computers 130 exist and one transmission / reception device 140 is connected, the encryption key is used by the transmission / reception device 110 and the transmission / reception device 140, and the encryption key K1 is used by the transmission / reception device 110 and the relay personal computer 130-m. The encryption key K2, the relay personal computer 130-m and the encryption key K3-m used in the transmission / reception device 140 are required, and m + 2 types of keys are required.

  When the transmission / reception device 140-1 and the transmission / reception device 140-2 handle the same confidential information, the transmission / reception device 110 has the encryption key K1 and the encryption key K2, and the relay personal computer 130-1 and the relay personal computer 130-2 have the encryption key K2. Assume that the transmission / reception device 140-1 and the transmission / reception device 140-2 have the encryption key K1.

  In this case, when encrypted communication is performed between the transmission / reception device 110, the transmission / reception device 140-1, and the transmission / reception device 140-2, the same processing as in FIG. Two types of encryption keys are required: K1, an encryption key K2 used by the transmission / reception device 110 and the relay personal computer 130.

  Even if a transmitting / receiving device is connected to each of a plurality of relay devices as in this embodiment, the confidentiality of information can be ensured as in the other embodiments. Further, as shown in FIG. 12, a plurality of transmission / reception devices may be connected to each of the plurality of relay devices.

  Note that the present invention is not limited to the above-described embodiment, and can be changed as appropriate without departing from the spirit of the present invention.

  Each configuration in the above-described embodiment is configured by hardware and / or software, and may be configured by one piece of hardware or software, or may be configured by a plurality of pieces of hardware or software. Each function (each process) of each device may be realized by a computer having a CPU, a memory, and the like. For example, a communication program for performing the communication method according to the embodiment may be stored in the storage device, and each function may be realized by executing the communication program stored in the storage device by the CPU.

  These programs can be stored using various types of non-transitory computer readable media and supplied to a computer. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (for example, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (for example, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W and semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (random access memory)) are included. The program may also be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

DESCRIPTION OF SYMBOLS 10 1st communication apparatus 11 1st encryption part 12 2nd encryption part 13 1st transmission part 20 Relay apparatus 21 1st reception part 22 1st decoding part 23 2nd transmission part 30 2nd Second communication device 31 Second reception unit 32 Second decryption unit 100 Communication system 110 Transmission / reception device 111 Encryption processing unit 112 Data communication unit 120 Internet 121 Serial line 130 Relay personal computer 131 Decryption processing unit 132 Encryption processing unit 133, 134 Data communication unit 140 Transmission / reception device 141 Decryption processing unit 142 Data communication unit 201 First encryption unit 202 Hash calculation unit 203 Second encryption unit 211 First decryption unit 212 Hash calculation unit 213 Second Decryption part

Claims (10)

A communication system comprising a first communication device, a second communication device, and a relay device that relays communication between the first and second communication devices,
The first communication device is:
A first encryption unit that performs encryption using the first encryption key on the first information and generates primary encrypted data;
A second encryption unit that performs encryption using a second encryption key on the generated primary encrypted data and second information, and generates secondary encrypted data;
A first transmission unit that transmits the generated secondary encrypted data to the relay device;
With
The relay device is
A first receiving unit for receiving secondary encrypted data transmitted from the first communication device;
A first decryption unit that decrypts the received secondary encrypted data using the second encryption key, and obtains the primary encrypted data and the second information;
A second transmission unit for transmitting transfer data based on the acquired primary encrypted data to the second communication device;
With
The second communication device is:
A second receiving unit for receiving transfer data transmitted from the relay device;
A second decryption unit that performs decryption using the first encryption key based on the received transfer data and obtains the first information;
A communication system comprising: The second transmission unit transmits the transfer data including the acquired primary encrypted data to the second communication device;
The second decryption unit decrypts the received transfer data using the first encryption key.
The communication system according to claim 1. The relay device includes a third encryption unit that encrypts the acquired primary encrypted data using a third encryption key and generates second secondary encrypted data,
The second transmission unit transmits the transfer data including the generated second secondary encrypted data to a second communication device,
The second communication device includes a third decryption unit that decrypts the received transfer data using the third encryption key and obtains the primary encrypted data,
The second decryption unit decrypts the acquired primary encrypted data using the first encryption key.
The communication system according to claim 1. A plurality of third encryption keys respectively corresponding to the plurality of second communication devices;
The third encryption unit performs encryption using the third encryption key corresponding to the second communication device of the transmission destination;
The communication system according to claim 3. The second information is header information for the relay device to transfer the first information to the second communication device.
The communication system according to any one of claims 1 to 4. A communication device that transmits first information to another communication device via a relay device,
A first encryption unit that performs encryption using a first encryption key on the first information and generates primary encrypted data;
A second encryption unit that performs encryption using a second encryption key on the generated primary encrypted data and second information, and generates secondary encrypted data;
A transmission unit for transmitting the generated secondary encrypted data to the relay device;
A communication device comprising: A communication device that receives first information from another communication device via a relay device,
The other communication device performs primary encryption data obtained by encrypting the first information using a first encryption key, and further uses a second encryption key for the primary encryption data and the second information. After the secondary encrypted data encrypted by using the second encryption key is transmitted to the relay device, the relay device decrypts the secondary encrypted data using the second encryption key. A receiving unit that receives transfer data based on the digitized data from the relay device;
A decryption unit that performs decryption using the first encryption key based on the received transfer data and obtains the first information;
A communication device comprising: A communication method in a communication system comprising a first communication device, a second communication device, and a relay device that relays communication between the first and second communication devices,
The first communication device is:
Performing encryption using the first encryption key on the first information to generate primary encrypted data;
Performing encryption using a second encryption key on the generated primary encrypted data and the second information to generate secondary encrypted data;
Transmitting the generated secondary encrypted data to the relay device;
The relay device is
Receiving secondary encrypted data transmitted from the first communication device;
Performing decryption using the second encryption key on the received secondary encrypted data, obtaining the primary encrypted data and the second information;
Transmitting transfer data based on the acquired primary encrypted data to the second communication device;
The second communication device is:
Receiving the transfer data transmitted from the relay device;
Performing decryption using the first encryption key based on the received transfer data to obtain the first information;
Communication method. A communication method in a communication device that transmits first information to another communication device via a relay device,
Encrypting the first information using a first encryption key to generate primary encrypted data;
Performing encryption using a second encryption key on the generated primary encrypted data and the second information to generate secondary encrypted data;
Transmitting the generated secondary encrypted data to the relay device;
Communication method. A communication method in a communication device that receives first information from another communication device via a relay device,
The other communication device performs primary encryption data obtained by encrypting the first information using a first encryption key, and further uses a second encryption key for the primary encryption data and the second information. After the secondary encrypted data encrypted by using the second encryption key is transmitted to the relay device, the relay device decrypts the secondary encrypted data using the second encryption key. Transfer data based on the data is received from the relay device;
Performing decryption using the first encryption key based on the received transfer data to obtain the first information;
Communication method.

Images