JP2017085368A - Communication system and communication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication system and communication method that are capable of implementing safe communication, with a small communication and calculation amounts.SOLUTION: A communication system includes a transmission device and a reception device between which information is transmitted/received. The transmission device previously stores key information KeyX, takes any data α and the key information KeyX as input to uniquely calculate a set of a plurality of pieces of information β, γ on the basis of algorithm P, and transmits the data α and predetermined information β of the plurality of pieces of information to the reception device. The reception device previously stores corresponding key information KeyY uniquely corresponding to the key information KeyX, receives the data α and the predetermined information β transmitted by a transmission unit, and takes the received data α, the predetermined information β, and the corresponding key information KeyY as input to calculate the other information γ on the basis of algorithm Q.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication system that shares information that should be kept secret between communication devices, and relates to a communication system and a communication method that can realize safe communication with a small amount of communication and a large amount of calculation.

  Various encryption schemes have been proposed and used for transmitting and receiving information so that the contents are not known to a third party (Patent Document 1, etc.).

  A typical encryption method is a public key encryption method. In the public key cryptosystem, information on asymmetric keys such as a secret key and a public key is used, and a public key corresponding to the secret key is transmitted from the receiver side having the secret key to the sender. The sender side encrypts and transmits the information shared using the public key, and the receiver decrypts the information encrypted with the corresponding private key. Since decryption is impossible with a public key and it is difficult to derive a secret key from a public key, information can be transmitted and received in a secret state even if the public key is known to a third party.

  In the common key cryptosystem different from the public key cryptosystem, Diffie-Hellman key sharing is used to share the key information itself as secret information. In Diffie-Hellman key sharing, the sender and receiver calculate values that can be disclosed separately using secret information separately from each other, exchange the calculated values with each other, and exchange the calculated values with their own values. When a predetermined calculation is performed using individual secret information, an equal value (secret key) is derived. Thereby, even if what is exchanged is known to the third party, the sender and the receiver can share the same information (secret key) without being known to the third party. In this case, if the information exchanged by a third party is changed in the middle (man-in-the-middle attack), it is difficult to share information secretly, but an elliptic curve that shares information beforehand beforehand The Diffie-Hellman key agreement method solves this problem. With the method of elliptic curve Diffie-Hellman key sharing, information to be shared in a secret state between the sender and the receiver can be updated safely and at any timing.

JP 2000-354031 A

  In the method of elliptic curve Diffie-Hellman key sharing, the same information can be shared secretly only after information that can be disclosed is mutually transmitted and received, that is, bidirectional communication is performed. Also in the public key cryptosystem, two-way communication is required, that is, transmission of a public key from the receiver side and transmission of encrypted information from the sender side. In addition, both methods require abundant computing resources, and processing takes a relatively long time.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a communication system and a communication method capable of realizing safe communication with a small communication amount.

  The communication system according to the present invention is a communication system in which information is transmitted and received between a transmission device and a reception device. The transmission device includes a transmission side storage unit that stores predetermined key information in advance, arbitrary data, and The transmission side calculation unit that calculates based on a first algorithm that uniquely outputs a plurality of sets of information with the predetermined key information as input, and the plurality of sets included in the set output by the data and the transmission side calculation unit A transmitting unit that transmits predetermined information of the received information to the receiving device, wherein the receiving device stores in advance corresponding key information uniquely corresponding to the predetermined key information; A first unit that receives the data and the predetermined information transmitted by the transmission unit, the data received by the reception unit, the predetermined information, and the corresponding key information; Characterized in that it comprises a receiver-side operation unit calculating for on the basis of the second algorithm for outputting other information of a plurality of information contained in the basis outputted said set.

  The communication system according to the present invention includes a plurality of the reception devices, the transmission device stores different key information corresponding to each of the plurality of reception devices in the transmission-side storage unit, and the plurality of reception devices Corresponding key information corresponding to different key information is stored in advance in the receiving-side storage unit.

  In the communication system according to the present invention, the predetermined key information is a signature key, the corresponding key information is a verification key, a first algorithm is a signature generation algorithm that outputs a signature and a comparison signature, and a second algorithm Is a signature verification algorithm that outputs the comparison signature based on the verification key and the signature, and the transmission unit transmits the signature output by the data and the signature generation algorithm. To do.

  The communication method according to the present invention is a communication method for transmitting and receiving information between a transmission device and a reception device, wherein the transmission device stores predetermined key information in advance, and stores arbitrary data and the predetermined key information. Is input based on a first algorithm that uniquely outputs a plurality of sets of information, and transmits the data and predetermined information included in the sets output by the calculation to the receiving device The receiving device stores in advance corresponding key information uniquely corresponding to the predetermined key information, receives the data transmitted by the transmission unit and the predetermined information, and receives the received data. And a second algorithm that receives the predetermined information and the corresponding key information as input and outputs other information of the plurality of pieces of information included in the set output based on the first algorithm. Characterized in that it.

  In the present invention, the first and second algorithms (the calculation method on the transmission side and the calculation method on the reception side of one algorithm) are used to calculate a predetermined plurality of sets of information based on the data and the corresponding key information. By transmitting data and predetermined information included in the set from the transmitting device to the receiving device between the transmitting device and the receiving device each having a section, the receiving device side derives other information included in the set can do. If the corresponding key information can be held in a secret state in advance, even if the data and the predetermined information are disclosed to a third party, that is, sent to a communication medium, the same information is known to the third party. It can be derived without being done.

  In the present invention, even in a configuration including a plurality of receiving apparatuses, a combination of key information and corresponding key information is received on the transmitting apparatus side and reception for each set of the transmitting apparatus and any one of the plurality of receiving apparatuses. By storing in a secret state in advance on the device side, the same information can be derived in such a way that each set is not known to other receiving devices.

  In the present invention, in the case of a configuration including a plurality of receiving devices, in addition to the combination of the key information for each set and the corresponding key information, the common key information and the common corresponding key information are stored in advance, As a result, information shared by a plurality of receiving devices can be derived so as not to be disclosed to a third party.

  The present invention employs a signature verification algorithm that verifies the signature by decrypting the encrypted information on the receiving side and verifying whether or not it matches the original information, and has less traffic than the key encryption method In addition, it is possible to safely perform data communication with the amount of calculation.

  According to the present invention, the same information is disclosed so that it is not known to a third party by a single transmission process of transmitting data and predetermined information without performing bidirectional communication between the transmission device and the reception device. Can be derived and shared. Thereby, a safe communication can be realized with a small communication amount and a calculation amount.

It is explanatory drawing which shows the concept of the sharing of secret information in this invention. 1 is a block diagram showing a configuration of a communication system in a first embodiment. 3 is a flowchart illustrating an example of a processing procedure performed between communication devices in the communication system according to the first embodiment. 6 is a sequence diagram illustrating an example of a procedure of communication processing executed by the communication device according to Embodiment 1. FIG. It is a sequence diagram which shows the procedure in the conventional secret sharing method (Diffie-Hellman key sharing). 6 is a flowchart illustrating an example of an authentication processing procedure using the communication method according to the first embodiment. 6 is a block diagram showing a configuration of a communication system in a second embodiment. FIG. 6 is an explanatory diagram illustrating an outline of a communication method performed in the communication system according to Embodiment 2. FIG. It is explanatory drawing which shows the outline | summary of the communication method implemented in a modification. FIG. 10 is a block diagram illustrating a configuration of a communication system in a third embodiment.

  Hereinafter, the present invention will be specifically described with reference to the drawings illustrating embodiments thereof. In addition, the embodiment shown below is an illustration, and of course, the present invention is not limited to the following configuration.

  FIG. 1 is an explanatory diagram showing the concept of sharing secret information in the present invention. The information used on the sender side is shown on the left side in FIG. 1, and the information used on the receiver side is shown on the right side in FIG. In the embodiment described below, an algorithm P is used in which a predetermined plurality of information sets (β, γ,...) Are uniquely derived from key information (Key X) and plaintext (α). Then, on the receiver side that has been previously provided with the key information (Key Y) paired with the key information (Key X) described above, a predetermined one of a plurality of information sets (β, γ,...) Information (β) and plaintext (α) are received from the sender side. On the receiver side, other information (γ) in the set is derived by the algorithm Q (= P ′) corresponding to the algorithm P, and the other information (γ) indicated by a double circle in FIG. Target for sharing. In the following description, a signature-dedicated algorithm is used as an algorithm for uniquely deriving a plurality of pieces of information (β, γ) for verification from the key information (Key X, Y) and plaintext (α) as a pair. However, it goes without saying that the algorithm is not limited to a signature-only algorithm.

  In the signature-only algorithm, information to be kept secret (α = data (plaintext)) in the public key cryptosystem is transmitted and received as it is, and verification information (β, γ = meaning) encrypted using the key (Key X) The sender is used to authenticate the sender, and there is no concept of shared information that should be kept secret. In the present invention, a verification value (a set of a plurality of information sets (β, γ)) derived from a plaintext (α) and a key (Key X, Y) prepared in advance by a signature-dedicated algorithm ( Focusing on the fact that γ) can be re-derived (can be verified) based on the plaintext (α) and the key corresponding to the key (Key Y) and the predetermined information (β) in the signature, This (γ) is to be shared. This will be specifically described below with reference to the first to third embodiments.

(Embodiment 1)
FIG. 2 is a block diagram showing a configuration of the communication system in the first embodiment. The communication system is an in-vehicle network and includes a communication device 1 and a communication device 2. Each of the communication devices 1 and 2 is an ECU (Electronic Controller Unit), and the communication devices 1 and 2 are connected by a communication bus 3. The communication devices 1 and 2 communicate with each other based on, for example, CAN (Controller Area Network).

  The communication device 1 includes a control unit 10, a storage unit 11, a communication unit 12, a random number generation unit 13, a hash calculation unit 14, and an algorithm calculation 15.

  The control unit 10 is a microcontroller using, for example, one or a plurality of CPUs (Central Processing Units) or a multi-core CPU, and having a ROM (Read Only Memory), a RAM (Random Access Memory), an input / output interface, a timer, and the like. The CPU of the control unit 10 is connected to the storage unit 11, the communication unit 12, the random number calculation unit 13, the hash calculation unit 14, and the algorithm calculation unit 15 via an input / output interface. The control unit 10 controls the operation of each component unit by executing a built-in control program stored in a built-in ROM.

  The storage unit 11 uses a flash memory. The storage unit 11 stores information that the control unit 10 refers to during processing. In the storage unit 11, signature key information 1K is stored in advance in a secret state. The timing at which the signature key information 1K is stored is a specific timing such as when the communication apparatus 1 itself is assembled, when a test is performed after the communication system including the communication apparatus 1 is constructed, and when a vehicle is inspected. The signature key information 1K may be stored separately using a technique such as encryption so that it can be securely stored in a secret state at a specific timing. The storage unit 11 stores a password for authentication of the communication device 2 in advance.

  The communication part 12 implement | achieves communication with the communication apparatus 2 via the communication bus 3 using a transceiver. The communication unit 12 transmits information instructed from the control unit 10 to the communication device 2 by the function of the communication controller included in the control unit 10, detects and receives information sent to the communication bus 3, and receives the control unit 10 is output.

  The random number calculation unit 13 is an integrated circuit that inputs seeds to generate and output random numbers. For example, the control unit 10 can use the time information obtained from a timer as a seed and give it to the random number calculation unit 13 to obtain a random number.

  The hash calculation unit 14 is an integrated circuit that inputs numerical information, performs a hash function calculation, and outputs a hash value. The control unit 10 can obtain a hash value by giving the random number obtained from the random number calculation unit 13 to the hash calculation unit 14.

  The algorithm calculation unit 15 is an integrated circuit that executes a signature verification algorithm using an ECDSA (Elliptic Curve Digital Signature Algorithm) signature method. The algorithm calculation unit 15 inputs arbitrary data (hash value) and signature key information 1K, and outputs a signature (r, s).

  Since the communication device 2 includes the same components as the communication device 1, corresponding reference numerals are assigned and detailed description thereof is omitted. However, the communication device 2 stores verification key information 2K corresponding to the signature key information 1K of the communication device 1 in the storage unit 21 in advance. Verification key information 2K is also stored in a secret state in advance. The timing at which the verification key information 2K is stored is the same as the timing at which the signature key information 1K is stored in the storage unit 11 of the communication device 1. The verification key information 2K may also be stored separately using a technique such as encryption so that it can be securely stored in a secret state. The storage unit 21 stores an authentication password.

  The algorithm calculation unit 25 of the communication device 2 is an integrated circuit that executes a calculation corresponding to the calculation of the algorithm calculation unit 15 of the communication device 1. The algorithm calculation unit 25 receives the signature r when the data input to the algorithm calculation unit 15, the signature s of the signature (r, s) output by the data, and the verification key information 2K of the storage unit 21 are input. Output.

  A communication process performed between the communication device 1 and the communication device 2 configured as described above will be described with reference to a flowchart. FIG. 3 is a flowchart illustrating an example of a procedure of communication processing executed by the communication devices 1 and 2 according to the first embodiment.

  The control unit 10 of the communication device 1 generates a random number by the random number calculation unit 13 using the time information as a seed to start sharing of secret information (step S11), and the hash value calculation unit 14 based on the obtained random number Is acquired (step S12). The control unit 10 gives the acquired hash value and signature key information 1K to the algorithm calculation unit 15 to acquire the signature (r, s) (step S13).

  The control unit 10 stores the signature r in the acquired signature (r, s) in the storage unit 11 (step S14), and transmits the other signature s and the hash value acquired in step S12 to the communication device 2 ( Step S15).

  The control unit 20 of the communication apparatus 2 receives the signature s and the hash value by the communication unit 22 (step S21), and gives the received signature s, hash value, and verification key information 2K to the algorithm calculation unit 25 to obtain the signature r. Derived and acquired (step S22). The control unit 20 stores the acquired signature r in the storage unit 21 (step S23) and ends the process.

  At this time, the signature r having the same contents is stored in the storage unit 11 of the communication device 1 and the storage unit 21 of the communication device 2 without transmitting / receiving the encrypted signature r. In this way, secret information can be shared from the communication device 1 to the communication device 2 by a single transmission process.

  FIG. 4 is a sequence diagram showing a procedure of the communication method in the first embodiment described above. FIG. 5 is a sequence diagram showing a procedure in a conventional secret sharing method (Diffie-Hellman key sharing). In the case of the communication method according to the first embodiment, as shown in FIG. 4, the exchange between the communication device 1 and the communication device 2 for sharing information (signature r) is performed from the communication device 1 side by the signature s and the hash. It is completed in one transmission of value (S15). On the other hand, the conventional secret sharing method requires exchange of values that can be disclosed to each other between the transmission device and the reception device. In this way, it is possible to share information in a secret state with a small amount of communication (number of times).

  Note that the signature (r, s) output by the algorithm calculation unit 15 is numerical information output based on ECDSA, and there is a condition on the information obtained. Therefore, the secret information can be shared with the signature r by the above-described method. However, for the purpose of the signature r, numerical information that is meaningless but serves as a key to be concealed, for example, a hash calculation seed is preferable. As shown below, when the communication device 1 is a server, the communication device 2 is a client, and the communication device 2 is authenticated as a valid device in the communication system, the signature r can be used as a seed for the hash calculation. It is.

  FIG. 6 is a flowchart illustrating an example of an authentication processing procedure using the communication method according to the first embodiment. Among the processing procedures of FIG. 6, the same procedures as those shown in the flowchart of FIG. 3 are denoted by the same reference numerals, and detailed description thereof is omitted.

  The control unit 20 of the communication device 2 as a client transmits an authentication request from the communication unit 22 to the communication device 1 as a server (step S201).

  The communication unit 12 of the communication device 1 receives the authentication request (step S101), generates a random number by the random number calculation unit 13 using the time information of the received time as a seed (S11), and acquires a hash value (S12). Subsequently, the control unit 10 acquires the signature (r, s) from the algorithm calculation unit 15 (S13), stores the signature r in the storage unit 11 (S14), and communicates the signature s and the hash value as a response to the request. It transmits to the apparatus 2 (S15).

  The control unit 20 of the communication device 2 receives the signature s and the hash value by the communication unit 22 (S21), and derives and acquires the signature r (S22). The control unit 20 stores the acquired signature r in the storage unit 21 (S23), and the hash calculation unit 24 calculates and acquires the password hash value stored in the storage unit 21 using the signature r as a seed (step S23). S24). The control unit 20 transmits the hash value obtained in step S24 to the communication device 1 that is a server (step S25).

  On the other hand, the control unit 10 of the communication device 1 as a server obtains the hash value of the authentication password of the communication device 2 stored in the storage unit 11 by using the stored signature r as a seed by the hash calculation unit 14. (Step S16). And the control part 10 receives the hash value transmitted from the communication apparatus 2 by the communication part 12 (step S17), and authenticates by comparing the hash value acquired by step S16, and the hash value received by step S17. Is executed (step S18). If the comparison results in step S18 match, authentication is successful, and if they do not match, authentication fails. The control unit 10 returns an authentication result (step S19), receives this on the communication device 2 side (step S26), and ends the authentication process.

  As described above, also in the authentication process, it is possible to securely share a secret seed with a small amount of communication and execute the authentication safely. In addition, the amount of information can be reduced by using an algorithm of the ECDSA signature method. Even when an embedded processor such as the above-described ECU is used, it is possible to reduce the processing load and save the storage capacity. Further, the above-described method has high resistance against man-in-the-middle attacks.

  The algorithm calculation units 15 and 25 are configured to use the ECDSA signature method, but may use DSA or RSA encryption. Further, the algorithm calculation units 15 and 25 may perform the calculation by a new method that substitutes for these signature algorithms. That is, the algorithm calculation unit 15 outputs a plurality of sets of information when key information and arbitrary data are input, and outputs other information of the set when a corresponding calculation is performed using the output numerical information as input. Any other method may be used as long as it is an algorithm. The algorithm calculation unit 25 is paired with the numerical information when the input data, the numerical information output by the algorithm calculation unit 15 and the corresponding key information are input corresponding to the algorithm calculation unit 15. Other numerical information may be output.

(Embodiment 2)
FIG. 7 is a block diagram showing a configuration of a communication system in the second embodiment. The communication system in the second embodiment includes a communication device 1 and communication devices 2a, 2b, and 2c. The communication device 1 and the communication devices 2a, 2b, and 2c are all ECUs and are connected by a communication bus 3. The details of the internal configuration of the communication device 1 are the same as those of the communication device 1 according to the first embodiment except for the information stored in the storage unit 11. The details of the internal configuration of the communication devices 2a, 2b, and 2c are the same as those in the second embodiment except for the information stored in each storage unit 21. Therefore, the same reference numerals are given to configurations common to the first embodiment, and detailed description thereof is omitted.

  The storage unit 11 of the communication device 1 according to the second embodiment stores a plurality of pieces of signature key information 1Ka, 1Kb, 1Kc in advance. The signature key information 1Ka is key information for sharing secret information with the communication device 2a, and the signature key information 1Kb is key information for sharing secret information with the communication device 2b. The signature key information 1Kc is key information for sharing secret information with the communication device 2c.

  The storage unit 21 of the communication device 2a stores in advance verification key information 2Ka corresponding to the signature key information 1Ka. The storage unit 21 of the communication device 2b stores verification key information 2Kb corresponding to the signature key information 1Kb in advance. The storage unit 21 of the communication device 2c stores verification key information 2Kc corresponding to the signature key information 1Kc in advance.

  The communication process between the communication apparatus 1 and the communication apparatus 2a, the communication process between the communication apparatus 1 and the communication apparatus 2b, and the communication process between the communication apparatus 1 and the communication apparatus 2c are each in the first embodiment. The same procedure (FIG. 3) as the communication process between the communication device 1 and the communication device 2 is performed.

  However, since the corresponding key information is stored for each pair of the communication device 1 and the communication devices 2a, 2b, and 2c, the same information (signature r) other than the corresponding key information is stored. Since output is not possible, secret information cannot be shared. FIG. 8 is an explanatory diagram showing an outline of a communication method performed in the communication system according to the second embodiment. FIG. 8 shows the correspondence between the key information held in each communication device 1, 2a, 2b, 2c and the flow of information transmitted and received. When the secret information is shared between the communication device 1 and the communication device 2a in the second embodiment, the control unit 10 of the communication device 1 is for the communication device 2a among the plurality of signature key information 1Ka, 1Kb, 1Kc. The signature (r, s) is acquired by the algorithm calculation unit 15 using the signature key information 1Ka. The control unit 10 of the communication device 1 sends the data (hash value) and the signature s input when acquiring the signature (r, s) from the communication unit 12 to the communication bus 3.

  The transmitted data (hash value) and signature s can be received by the communication units 22 of all the communication devices 2a, 2b, 2c connected to the communication bus 3. However, only the communication device 2a that operates using the verification key information 2Ka corresponding to the signature key information 1Ka used to output the data and the signature s acquires the signature r by the algorithm operation unit 25, and the communication device 1 and the secret key information 1Ka are secret. Information (information r) can be shared. The communication devices 2b and 2c can also receive the data based on the signature key information 1Ka and the signature s. However, since the corresponding verification key information 2Ka is not owned, obtaining the common signature r with the communication device 1 is not possible. Can not.

  The same applies to the communication processing between the communication device 1 and the communication device 2b and the communication processing between the communication device 1 and the communication device 2c.

  As described in the second embodiment, arbitrary data (hash value) and signature (r, s) are transmitted from the communication device 1 on the transmission side to the other communication devices 2a, 2b, and 2c on the reception side. Send the signature s. With this one-time transmission, secret information can be shared for each set of the communication device 1 and each of the plurality of communication devices 2a, 2b, and 2c.

  Note that the signature key information 1Ka, 1Kb, 1Kc stored in the storage unit 11 of the communication device 1 and the verification key information 2Ka, 2Kb, 2Kc stored in each storage unit 21 of the communication devices 2a, 2b, 2c are stored. Various timings can be considered for the storage. For example, the timing at which the communication devices 1, 2 a, 2 b, and 2 c are individually assembled may be the timing at which which communication device is to be communicated when the communication system is constructed.

  In Embodiments 1 and 2, the communication system according to the present invention is applied to communication between ECUs in an in-vehicle network, for example. However, the present invention is not limited to this, and may be applied to communication between various electronic devices or apparatuses including an HMI (Human Machine Interface), a PLC (Programmable Logic Controller), a controller, and a maintenance jig in an industrial equipment network. It is.

(Modification)
In the first and second embodiments, secret information (signature r) is shared at the same timing between one transmission-side communication device and one or more reception-side communication devices. In the modified example, by obtaining secret information through a certain procedure or process, information different from the value (signature r) shared in the communication of the present invention is shared between specific devices.

  FIG. 9 is an explanatory diagram showing an outline of a communication method implemented in the modification. In the modified example, as shown in FIG. 9, even if the communication device 2 stores the same verification key information 2Ka, in addition to the communication device 2a that stores only the verification key information 2Ka, “processing 2” There are communication devices 2d and 2f that know the “processing 1” and a communication device 2e that knows “processing 1”. Further, there is a communication device 2g that knows both “processing 2” and “processing 1”. The communication apparatus 1 on the transmission side knows “processing 1”. “Processing 1” and “Processing 2” are specific calculation procedures or algorithms, and are stored in each storage unit 21 in advance without being otherwise known between devices that share information.

  In the example of FIG. 9, the communication device 1 can acquire not only the signature r as secret information by the signature key information 1Ka but also “information r1” by the process “processing 1” for “information r”. . The communication device 2a can acquire “information r” from the verification key information 2Ka corresponding to the signature key information 1Ka, the data transmitted from the communication device 1, and the information s. On the other hand, since the communication devices 2b and 2c do not store the verification key information 2Ka corresponding to the signature key information 1Ka, the same “information r” as that of the communication device 2a is transmitted by the data and information s transmitted from the communication device 1. Can not get. Then, the communication device 2e and the communication device 2g not only can acquire “information r” based on the verification key information 2Ka, but also acquire “information r1” by processing “processing 1” for “information r”. be able to. Accordingly, the communication device 2e and the communication device 2g can share “information r1” that cannot be known to the communication devices 2a, 2b, 2c, 2d, and 2f with the communication device 1. The communication device 2d, the communication device 2f, and the communication device 2g can not only acquire “information r” common to the communication device 1 and the communication device 2a based on the verification key information 2Ka, but also “ “Information r2” can be acquired by the processing of “Process 2”. The communication device 2d, the communication device 2f, and the communication device 2g can share “information r2” that cannot be known to the communication devices 2a, 2b, 2c, and 2e, and the communication device 1 that is a transmission device.

  As described above, in the system including the communication device 1 and the communication devices 2a to 2g, it becomes possible to share secret information not known elsewhere in an arbitrary set by prior agreement.

(Embodiment 3)
The present invention can also be applied between communication devices such as a PC (Personal Computer) and a server computer that communicate with each other via a public communication network such as the Internet, and is one-to-one or one-to-multiple secret information. It is possible to apply to communication sharing.

  Embodiment 3 shows an example in which the present invention is applied to a server client system. FIG. 10 is a block diagram showing a configuration of a communication system in the third embodiment. The communication system in the third embodiment includes a central device 4 and a terminal device 5. The central device 4 is a server computer, and the terminal device 5 is a PC. Communication between the central device 4 and the terminal device 5 is possible via a network N which is a public communication network such as the Internet.

  The central device 4 includes a control unit 40, a storage unit 41, a temporary storage unit 42, and a communication unit 43.

  The control unit 40 uses a CPU. The control unit 40 reads and executes the algorithm P program 411 stored in the storage unit 41, thereby causing the general-purpose server computer to function as the transmission device in the present invention. The temporary storage unit 42 uses a RAM such as a DRAM and temporarily stores information generated by the processing of the control unit 40.

  The storage unit 41 uses a nonvolatile memory such as a hard disk or a flash memory, and stores the algorithm P program 411 and the signature key information 4K in advance. The algorithm P program 411 is a program that realizes an operation based on the algorithm P shown in FIG. 1, that is, the signature verification algorithm based on the ECDSA signature scheme.

  The communication unit 43 implements communication with the terminal device 5 via the network N using a network card. The communication realized by the communication unit 45 may be either wired communication or wireless communication.

  The terminal device 5 includes a control unit 50, a storage unit 51, a temporary storage unit 52, and a communication unit 53.

  The control unit 50 uses a CPU. The control unit 50 reads and executes the algorithm Q program 511 stored in the storage unit 51, thereby causing the general-purpose PC to function as the receiving device in the present invention. The temporary storage unit 52 uses a RAM such as a DRAM and temporarily stores information generated by the processing of the control unit 50.

  The storage unit 51 uses a nonvolatile storage medium such as a hard disk or a flash memory, and stores the algorithm Q program 511 described above and verification key information 5K corresponding to the signature key information 4K. The algorithm Q program 511 is a program that realizes an operation corresponding to an operation based on the algorithm P program 411 in the central apparatus 4.

  The communication unit 53 implements communication with the central device 4 via the network N using a network card. The communication realized by the communication unit 53 may be either wired communication or wireless communication.

  In the communication system of the third embodiment, the process for sharing secret information (signature r) using the signature key information 4K and the verification key information 5K performed between the central device 4 and the terminal device 5 is performed in the embodiment. 1 is the same as the processing content (FIG. 3) performed between the communication device 1 and the communication device 2 in FIG. Therefore, detailed description is omitted. Of course, the second embodiment and the modification can be applied to the processing between the central device 4 and the terminal device 5 shown in the third embodiment.

  As shown in the third embodiment, the communication system according to the present invention can be applied to a server client system using a PC and a server computer. Further, as shown in the third embodiment, it can also be realized by processing based on software.

  It should be thought that embodiment disclosed this time is an illustration and restrictive at no points. The scope of the present invention is defined by the terms of the claims, rather than the meanings described above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1 Communication device (transmitting device)
11 Storage unit (transmission side storage unit)
12 Communication unit (transmission unit)
15 Algorithm computation unit (transmission side computation unit)
1K, 1Ka, 1Kb, 1Kc Signature key information (predetermined key information)
2, 2a, 2b, 2c Communication device (receiving device)
21 storage unit (reception side storage unit)
22 Communication unit (receiving unit)
25 Algorithm operation part (reception side operation part)
2K, 2Ka, 2Kb, 2Kc Verification key information (corresponding key information)
4 Central unit (transmitting unit)
40 Control unit (transmission side calculation unit)
411 Algorithm P program (transmission side computing unit)
41 Storage unit (transmission side storage unit)
43 Communication part (transmission part)
4K signature key information (predetermined key information)
5 Terminal device (receiving device)
50 Control unit (receiver side calculation unit)
511 Algorithm Q program (receiver side calculation unit)
51 storage unit (reception side storage unit)
53 Communication unit (receiving unit)

Claims (4)

In a communication system that transmits and receives information between a transmission device and a reception device,
The transmitter is
A transmission-side storage unit that stores predetermined key information in advance;
Arbitrary data and the predetermined key information as inputs, a transmission side calculation unit that calculates based on a first algorithm that uniquely outputs a plurality of sets of information;
A transmission unit that transmits predetermined information of the plurality of pieces of information included in the set output by the data and the transmission side calculation unit to the reception device;
The receiving device is:
A receiving-side storage unit that previously stores corresponding key information uniquely corresponding to the predetermined key information;
A receiver that receives the data and the predetermined information transmitted by the transmitter;
Based on the second algorithm that outputs the other information of the plurality of pieces of information included in the set output based on the first algorithm, using the data received by the receiving unit, the predetermined information, and the corresponding key information as inputs. A communication system comprising: a receiving-side computing unit that computes. Including a plurality of the receiving devices;
The transmitter is
Store different key information corresponding to each of a plurality of receiving devices in the transmission side storage unit,
The communication system according to claim 1, wherein the plurality of receiving devices store corresponding key information corresponding to each of the different key information in the receiving-side storage unit in advance. The predetermined key information is a signature key, and the corresponding key information is a verification key;
The first algorithm is a signature generation algorithm that outputs a signature and a comparison signature, and the second algorithm is a signature verification algorithm that outputs the comparison signature based on the verification key and the signature,
The communication system according to claim 1, wherein the transmission unit transmits the data and a signature output by a signature generation algorithm. In a communication method for transmitting and receiving information between a transmission device and a reception device,
The transmitter is
Predetermined key information is stored in advance,
Arbitrary data and the predetermined key information are input, and calculation is performed based on a first algorithm that uniquely outputs a plurality of sets of information,
Transmitting predetermined information of the plurality of pieces of information included in the set output by the data and calculation to the receiving device;
The receiving device is:
Corresponding key information uniquely corresponding to the predetermined key information is stored in advance,
Receiving the data and the predetermined information transmitted by the transmitter;
Based on the second algorithm that receives the received data and the predetermined information, and the corresponding key information as input, and outputs other information of the plurality of information included in the set output based on the first algorithm A communication method characterized by computing.

Images