JP2021034858A - Key exchange system, key exchange device, key exchange method and program - Google Patents

Abstract

To provide a key exchange system which reduces communication cost, calculation cost, etc., of some users to be participated in a key exchange, a key exchange device, a key exchange method and a program.SOLUTION: In a key exchange system which performs key exchange among a plurality of communication terminals, a representative communication terminal 201 uses information ({Xi}iof[2,n]) which is previously calculated in partial communication terminals 20i (i=2, ..., n) to generate a session key S205. The representative communication terminals uses the generated session key and the information ({Xi}iof[2,n]) to calculate information ({Zi}iof[2,n]) for generating the session key in each of the partial communication terminals S205. Each of the partial communication terminals uses information X1 which is previously calculated in the representative communication terminal, and each of information Zi (i=2, ..., n) to generate the session key S207.SELECTED DRAWING: Figure 5

Description

The present invention relates to a key exchange system, a key exchange device, a key exchange method and a program.

Multi-party key exchange protocols have long been known. For example, ID-MKD (Identity-based multi-cast key distribution) and ID-DMKD (Identity-based dynamic multi-cast key distribution) are known as multi-party key exchange protocols (see, for example, Non-Patent Document 1). ). These multi-party key exchange protocols are expected to be applied in business chat, VPN (Virtual Private Network), and the like.

Here, in the multi-party key exchange protocol, it is premised that all users secure a stable communication band. For this reason, in the multi-party key exchange protocol, all users equally bear the communication cost (number of communications, amount of transmitted / received data, etc.) and calculation cost (number of cryptographic operations, etc.) during key calculation. ..

Kazuki Yoneyama, Reo Yoshida, Yuto Kawahara, Tetsutaro Kobayashi, Hitoshi Fuji, and Tomohide Yamamoto. Multi-Cast Key Distribution: Scalable, Dynamic and Provably Secure Construction. In ProvSec 2016, pages 207-226, 2016.

However, not all users who participate in the key exchange protocol have a good communication environment and high computing power of the terminal used. Since the terminals used and the usage environment are different, users in a communication environment with a narrow band (for example, communication environment in a shared office, cafe, Shinkansen, airplane, etc.) or terminals with lower computing power than other users' terminals. When a user with (for example, a terminal released several years ago) exists in a key exchange session, the conventional multi-party key exchange protocol uses a key update at the time of leaving the user or a key update over a certain period of time. At times, the key update process may be delayed or a key generation error may occur.

Therefore, among the users participating in the key exchange, a multi-person key exchange protocol that can reduce at least the communication cost of the user who is in a communication environment with a narrow bandwidth and the calculation cost of the user who has a low calculation processing capacity is desired. There is.

An embodiment of the present invention has been made in view of the above points, and an object of the present invention is to reduce communication costs and calculation costs of some users who participate in key exchange.

In order to achieve the above object, the key exchange system according to the embodiment of the present invention _{is a key exchange system that exchanges keys between a plurality of communication terminals Ui} (i = 1, ..., N). _{Using the information X i} (i = 2, ..., N) pre-calculated by some of the communication terminals U _i (i = 2, ..., N) among the plurality of communication terminals U _i, in the communication terminal _{U 1,} using the first key generating means for generating a key K, and the key K, the information _{X i (i = 2, ···} , n) and the communication terminal _{U 1 Then, the calculation for calculating the information Z i} (i = 2, ..., N) for generating the key K in each of the some communication terminals U _i (i = 2, ..., N). Using the means, _{the information X 1} pre-calculated by the _{communication terminal U 1} , and each of the information Z _i (i = 2, ..., N), some of the communication terminals U _i (i). = 2, ..., N) is characterized by having a second key generation means for generating the key K.

It is possible to reduce the communication cost and calculation cost of some users who participate in the key exchange.

It is a figure which shows an example of the whole structure of the key exchange system in embodiment of this invention. It is a figure which shows an example of the hardware composition of the key exchange server and the communication terminal in embodiment of this invention. It is a figure which shows an example of the functional structure of the key exchange system in embodiment of this invention. It is a flowchart which shows an example of a setup process. It is a sequence diagram which shows an example of a key exchange process (Dist phase). It is a sequence diagram which shows an example of a key exchange process (Join phase). It is a sequence diagram which shows an example of a key exchange process (Update phase).

Hereinafter, embodiments of the present invention will be described. In the embodiment of the present invention, it is possible to reduce the communication cost and the calculation cost of some users participating in the key exchange (for example, a user in a communication environment having a narrow band or a user having a terminal having a low calculation processing capacity). A possible key exchange system 1 will be described. The communication cost is the number of communications, the amount of transmitted / received data, and the like, and the calculation cost is the number of operations related to encryption processing.

<Theoretical composition>
First, before explaining the specific configuration and processing of the key exchange system 1 in the embodiment of the present invention, a theoretical configuration for realizing the embodiment of the present invention will be described. In the following, κ is a security parameter, p is a prime number of κ bits, G is a finite cyclic group of order p, and g is a generator of G. Further, the N as an integer equal to or larger than 2, represents the communication terminal N users to utilize each _U 1, · · ·, and _{U N, U 1, ···,} U n ( however, n ≦ N ) Is exchanged for keys.

Further, hereinafter, U ₁ is assumed to be a communication terminal (this communication terminal is also referred to as a "representative communication terminal") that is in a communication environment in which a stable communication band is secured and can provide sufficient computing resources. _i (i = 2, ..., N) is a communication terminal in a communication environment where a stable communication band cannot always be secured (for example, a communication terminal in a communication environment with a narrow band) or a communication terminal that cannot provide sufficient computing resources. (For example, a communication terminal having relatively low specifications).

≪UGKE Protocol≫
First, the UGKE (Unbalanced Group Key Exchange) protocol will be described. The UGKE protocol is based on the classical DH (Diffie-Hellman) protocol and is safe against passive attacks under the DDH assumption.

The UGKE protocol consists of offline and online calculations. The offline calculation can be performed by each user's communication terminal without depending on information about other users. Therefore, each U _i (i = 1, 2, ..., N) can perform the offline calculation in advance prior to the online calculation.

(Offline calculation)
Each U _i (i = 1, 2, ..., N) produces x _i ∈ _R Z _p ,

を計算する。ここで、Ｚ_ｐはｐを法とする剰余類である。また、ａ∈_ＲＡは、集合Ａから一様に（ランダムに）要素ａを選択（サンプリング）することを意味する。

To calculate. Here, Z _p is a coset modulo p. Further, a∈ _{R A} is meant to uniformly from the set A (randomly) select the element a (sampling).

Each _{U i stores (x i, X} i) to its storage device or the like.

(Online calculation)
Step S1: Each U _i (where i = 2, ..., N) transmits _{X i} to U _1.

Step S2: _{U 1,} to the _{(X 2, ···, X n} ) receives the generates _{SK∈ R G, i∈ [2,} n],

を計算する。なお、［ｍ，ｎ］はｍ以上ｎ以下の整数の集合を表す。

To calculate. Note that [m, n] represents a set of integers of m or more and n or less.

Then, U ₁ transmits _{(X 1} , Z _i ) to U _i for i ∈ [2, n]. Further, U ₁ outputs SK as a session key.

Step S3: When each U _i (where i = 2, ..., N) receives (X ₁ , Z _i ),

をセッション鍵として出力する。これにより、各Ｕ_ｉ（ｉ＝１，２，・・・，ｎ）の間でセッション鍵ＳＫが共有（言い換えれば、各Ｕ_ｉにセッション鍵ＳＫが配布）される。

Is output as the session key. As a result, the _{session key SK is shared between each U i} (i = 1, 2, ..., N) (in other words, the session key SK is distributed _{to each U i).}

≪ID-DMKD protocol based on UGKE≫
Next, the ID-DMKD protocol based on the above UGKE will be described. The ID-DMKD protocol based on UGKE has four phases (Dist phase, Join phase, Leave phase and Update phase) like the ID-DMKD protocol. The Dist phase is a phase _{for starting a new session and sharing a session key in a group (that is, U 1} , ..., _Un ), and the Join phase is a phase in which a new user's communication terminal joins the group. Along with this, it is a phase for regenerating the session key, and the Leave phase is a phase for regenerating the session key when the communication terminal of a user who has already joined the group leaves the group. is there.

In addition, ID-DMKD has a concept called a time frame, and is updated to a new time frame after a certain period of time, for example. Then, when a new time frame starts, the session key is updated. The Update phase is a phase for updating the session key when a new time frame starts. Here, each U _{i holds the state information state i} used for updating the session key, etc., and when the U _i starts a session, the session is the first session of the _{U i in the time frame.} If so, the session _i is updated.

From now on, for the sake of simplicity, it is assumed that only one communication terminal is used by the user who newly joins the group in the Join phase. Similarly, in the Leave phase, it is assumed that only one communication terminal is used by the user who leaves the group. For details of the ID-DMKD protocol, refer to Non-Patent Document 1 described above.

[Preparation]
Before explaining the ID-DMKD protocol based on UGKE, the algorithms constituting each of the ciphertext-Policy Attribute-Based Encryption (CP-ABE) and the message authentication code (MAC) will be described. To do.

-Ciphertext policy The attribute-based cipher is composed of four algorithms (Setup, Der, AEnc, and ADec). Each of these algorithms is defined as follows.

(Params, msk) ← Setup (1 ^κ , att): 1 This ^{is a setup algorithm that takes κ} and att as inputs and outputs Params and msk. Here, att is an attribute set descriptor, Params is a public parameter, and msk is a master secret key.

usk _A ← Der (Params, msk, A): A key distribution algorithm that outputs _{usk A by inputting Params, msk, and A.} Here, A is an attribute and usk _A is a user private key.

CT ← AEnc (Params, P, m): An encryption algorithm that outputs CT as inputs of Params, P, and m. Here, P is an access structure, m is a plaintext, and CT is a ciphertext.

m ← ADec (Params, usk _A , CT): _{A decoding algorithm that takes Params, usk A,} and CT as inputs and outputs m when the attribute A satisfies the access structure P.

-The message authentication code is composed of three algorithms (MGen, Tag, Ver). Each of these algorithms is defined as follows.

mk ← MGen (1 ^κ ): This is a key generation algorithm that outputs mk with ^{1 κ as an input.} Here, mk is a MAC key.

σ ← Tag (mk, m): A tag generation algorithm that outputs σ by inputting mk and m. Here, m is plaintext and σ is a tag.

1 or 0 ← Ver (mk, m, σ): This is a verification algorithm that inputs mk, m, and σ and outputs 1 if MAC verification is successful, and 0 if not.

If a key is included in the input of the algorithm that constitutes the above ciphertext policy attribute-based encryption and message authentication code, the symbol representing the key is written in the lower right corner of the symbol representing the algorithm, and the symbol representing the key is indicated in the input of the algorithm. It may indicate that the key is included. For example, Der (Params, msk, A) _{may be expressed as "Dermsk} (Params, A)". The same applies to other algorithms.

[setup]
In the ID-DMKD protocol based on UGKE, the entire system is set up before executing the above four phases. Hereinafter, the key exchange server is represented by S.

S executes the Setup algorithm of the ciphertext policy attribute-based cipher to generate the public parameter Params and the master private key msk.

Here, the TCR (Target-Collision Resistant) hash function is used as the TCR.
TCR: {0,1} ^* → {0,1} ^κ
And.

Also, let the twist pseudo-random function be tPRF.

とする。ここで、Ｋｓｐａｃｅ_κは鍵空間である。

And. Here, Kspace _κ is a key space.

Furthermore, let the pseudo-random functions be F and F',
F, F': {0,1} ^κ x Kspace _κ → {0,1} ^κ
And.

At this time, S issues (Params, p, G, g, TCR, tPRF, F, F') as the static public key SPK _S.

Further, each U _i (i = 1, 2, ..., N) and S execute the key distribution algorithm of the ciphertext policy attribute-based cipher with the _{attribute A i} = (U _{i, init), and perform the initial secret.} the key _{isk i ← Der (Params, msk} , a i) to generate. When U _i is specified as an _{attribute, U i} represents an identifier of the communication terminal (for example, arbitrary information that can identify the communication terminal such as an e-mail address, an IP (Internet Protocol) address, and a manufacturing unique number). ..

In addition, each U _i generates a _{secret string (st i} , st _i ´) for the twist pseudo-random function. Similarly, S produces a secret string (st _S , st _S ′). Here, st _i , st _S ∈ _R Kspace _κ , st _i ´, st _{S ′ ∈ R} {0,1} ^κ .

Then, each U _i stores (isk _i , st _i , st _i ´) as a static secret key SSK _i in its own storage device or the like. Similarly, S stores (msk, st _S , st _S ') as a static secret key SSK _S in its own storage device or the like.

[Dist phase]
A case where U ₁ , ..., _Un starts a new session and shares a session key will be described.

(Update of status information in a new time frame)
In the time frame TF, if the new session is _{the first session of U i} (i = 1, 2, ..., N), for the current time t ∈ TF, S is the attribute A _i '=. As (U _i , t), usk _i ← Der (Params, msk, A _i ´) and _{mki i} ← MGen (1 ^κ ) are generated. Next, S is, as the access structure _{P i = ((ID = U} i) ∧ (t = init)), CT i ← AEnc (Params, P i, (usk i, mk i)) is calculated. Here, the ID is a predicate variable representing a communication terminal.

Then, S transmits _{CT i} to U _i. After that, when U _i receives CT _i,

を計算して、自身の記憶装置等に保存されている状態情報ｓｔａｔｅ_ｉに含まれる（ｕｓｋ_ｉ，ｍｋ_ｉ）を、当該計算された（ｕｓｋ_ｉ，ｍｋ_ｉ）に更新する。

The calculated, updates the state information state _i contained in _{(usk i,} mk i) stored in its own storage device such as a, on the calculated _{(usk i,} mk i).

(Offline calculation)
Each U _i (i = 1, 2, ..., N) produces x _i ∈ _R Z _p ,

を計算する。そして、各Ｕ_ｉは、状態情報ｓｔａｔｅ_ｉに含まれる情報として（ｘ_ｉ，Ｘ_ｉ）を自身の記憶装置等に保存する。

To calculate. Each _{U i} is, _{(x i, X} i) as information included in the state information state _i to save in its own storage device.

(First round of communication terminals other than the representative communication terminal)
Each U _i (however, i = 2, ..., N) is

を計算し、（Ｘ_ｉ，σ_ｉ）をＳに送信する。

Is calculated and (X _i , σ _i ) is transmitted to S.

(First round of key exchange server)
For i ∈ [2, n], when S receives (X _i , σ _i ), the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｓは、受信した（Ｘ_ｉ，σ_ｉ）を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｓは、

To execute. Then, when the MAC verification by this verification algorithm fails, S discards the _{received (X i} , σ _i). On the other hand, if the MAC verification by this verification algorithm is successful, S

を計算し、（｛Ｘ_ｉ｝_{ｉ∈［２，ｎ］}，σ_Ｓ）をＵ_１に送信する。

Is calculated, and ({X _i } _{i ∈ [2, n]} , σ _S ) is transmitted _{to U 1.}

(First round of representative communication terminal)
When U ₁ receives ({X _i } _{i ∈ [2, n]} , σ _S ), the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｕ_１は、受信した（｛Ｘ_ｉ｝_{ｉ∈［２，ｎ］}，σ_Ｓ）を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｕ_１は、

To execute. Then, when the MAC verification by this verification algorithm fails, U ₁ discards the received ({X _i } _{i ∈ [2, n]} , σ _S ). On the other hand, if MAC verification by this verification algorithm is successful, U ₁ will

を短期秘密鍵ＥＳＫ_１として生成し、

As a short-term private key ESK ₁

を計算する。その後、Ｕ_１は、

To calculate. After that, U ₁

を計算し、（Ｘ_１，｛Ｚ_ｉ｝_{ｉ∈［２，ｎ］}，σ_１´）をＳに送信する。

Is calculated, and (X ₁ , {Z _i } _{i ∈ [2, n]} , σ ₁ ′) is transmitted to S.

(Second round of key exchange server)
When S receives (X ₁ , {Z _i } _{i ∈ [2, n]} , σ ₁ ′), the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｓは、受信した（Ｘ_１，｛Ｚ_ｉ｝_{ｉ∈［２，ｎ］}，σ_１´）を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｓは、ｓｉｄ＝ＴＣＲ（Ｘ_１，・・・，Ｘ_ｎ）を計算する。なお、ｓｉｄはセッションＩＤを意味する。

To execute. Then, when the MAC verification by this verification algorithm fails, S _{discards the received (X 1} , {Z _i } _{i ∈ [2, n]} , σ ₁ ′). On the other hand, if the MAC verification by this verification algorithm is successful, S calculates side _{= TCR (X 1} , ..., X _n). In addition, side means a session ID.

Also, S is

を短期秘密鍵ＥＳＫ_Ｓとして生成し、

As a short-term private key ESK _S ,

を計算する。次に、Ｓは、ｉ∈［１，ｎ］に対して、アクセス構造Ｐ_ｉ´＝（（ＩＤ＝Ｕ_ｉ）∧（ｔ∈ＴＦ））として、ＣＴ_ｉ´←ＡＥｎｃ（Ｐａｒａｍｓ，Ｐ_ｉ´，Ｋ_１）を計算する。続いて、Ｓは、

To calculate. Next, S is for i∈ [1, n], 'as _{= ((ID = U i)} ∧ (t∈TF)), CT i' access structure _{P i ← AEnc (Params, P} i ' , K ₁ ) is calculated. Then, S is

を計算し、

Calculate and

をＵ_１に送信すると共に、ｉ∈［２，ｎ］に対して、

To U ₁ , and for i ∈ [2, n]

をＵ_ｉに送信する。

And transmits to the _{U i.}

(Generation of session key)
U _i (however, i = 2, ... n) is

を受信すると、検証アルゴリズム

When you receive the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｕ_ｉ（ただし、ｉ＝２，・・・ｎ）は、受信した情報を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｕ_ｉ（ただし、ｉ＝２，・・・ｎ）は、

To execute. Then, when the MAC verification by this verification algorithm fails, U _i (however, i = 2, ... n) discards the received information. On the other hand, if MAC verification by this verification algorithm is successful, U _i (however, i = 2, ... n) will be

により復号を行うと共に、

Decrypt by

を計算し、セッション鍵

Calculate and session key

を生成及び出力する。また、Ｕ_ｉ（ただし、ｉ＝２，・・・ｎ）は、自身の記憶装置等に保存されている状態情報ｓｔａｔｅ_ｉから（ｘ_ｉ，Ｘ_ｉ）を削除する。

Is generated and output. Further, U _i (however, i = 2, ... n) deletes (x _i , X _{i ) from the state information state i stored in its own storage device or the like.}

On the other hand, U ₁

を受信すると、検証アルゴリズム

When you receive the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｕ_１は、受信した情報を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｕ_１は、

To execute. Then, when the MAC verification by this verification algorithm fails, the U ₁ discards the received information. On the other hand, if MAC verification by this verification algorithm is successful, U ₁ will

により復号を行って、セッション鍵

Decrypt with the session key

を生成及び出力する。また、Ｕ_１は、自身の記憶装置等に保存されている状態情報ｓｔａｔｅ_１に対してＫ_２を追加すると共に、状態情報ｓｔａｔｅ_１から（ｘ_１，Ｘ_１）を削除する。

Is generated and output. Further, U ₁ adds K _{2 to the state information state 1} stored in its own storage device or the like, and deletes (x ₁ , X ₁ ) from the state information stage _1.

[Join Phase]
Next, a case where a new user's communication terminal _{Un + 1 joins a group (U 1} , ..., _Un ) sharing the session key SK will be described. Hereinafter, this new user's communication terminal will also be referred to as a "participating communication terminal". In the Join phase, the session key SK does not change, so the side does not change either. Further, in the Join phase, no processing occurs in communication terminals other than the participating communication terminal and the representative communication terminal.

(Update of status information in a new time frame)
In the time frame TF, if the new session is the first session of U _i (where i = 1, n + 1), for the current time t ∈ TF, S is the attribute A _i ′ = (U _i , As t), usk _i ← Der (Params, msk, A _i ´) and _{mki i} ← MGen (1 ^κ ) are generated. Next, S is, as the access structure _{P i = ((ID = U} i) ∧ (t = init)), CT i ← AEnc (Params, P i, (usk i, mk i)) is calculated.

Then, S transmits _{CT i} to U _i. After that, when U _i receives CT _i,

を計算して、自身の記憶装置等に保存されている状態情報ｓｔａｔｅ_ｉに含まれる（ｕｓｋ_ｉ，ｍｋ_ｉ）を、当該計算された（ｕｓｋ_ｉ，ｍｋ_ｉ）に更新する。

The calculated, updates the state information state _i contained in _{(usk i,} mk i) stored in its own storage device such as a, on the calculated _{(usk i,} mk i).

(Offline calculation)
Each U _i (where i = 1, n + 1) produces x _i ∈ _R Z _p ,

を計算する。そして、各Ｕ_ｉは、状態情報ｓｔａｔｅ_ｉに含まれる情報として（ｘ_ｉ，Ｘ_ｉ）を自身の記憶装置等に保存する。

To calculate. Each _{U i} is, _{(x i, X} i) as information included in the state information state _i to save in its own storage device.

(First round of participating communication terminals)
_{Un + 1} is

を計算し、（Ｘ_ｎ＋１，σ_ｎ＋１）をＳに送信する。

Is calculated, and (X _{n + 1} , σ _{n + 1} ) is transmitted to S.

(First round of key exchange server)
When S receives (X _{n + 1} , σ _{n + 1} ), the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｓは、受信した（Ｘ_ｎ＋１，σ_ｎ＋１）を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｓは、

To execute. Then, when the MAC verification by this verification algorithm fails, S _{discards the received (X n + 1} , σ _{n + 1} ). On the other hand, if the MAC verification by this verification algorithm is successful, S

を計算し、（ｓｉｄ，Ｘ_ｎ＋１，σ_Ｓ）をＵ_１に送信する。

Is calculated, and (sid, X _{n + 1} , σ _S ) is transmitted _{to U 1.}

(First round of representative communication terminal)
When U ₁ receives (sid, X _{n + 1} , σ _S ), the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｕ_１は、受信した（ｓｉｄ，Ｘ_ｎ＋１，σ_Ｓ）を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｕ_１は、

To execute. Then, when the MAC verification by this verification algorithm fails, U ₁ discards the received (sid, X _{n + 1} , σ _S ). On the other hand, if MAC verification by this verification algorithm is successful, U ₁ will

を計算し、（Ｘ_１，Ｚ_ｎ＋１，σ_１）をＳに送信する。

Is calculated, and (X ₁ , Z _{n + 1} , σ ₁ ) is transmitted to S.

(Second round of key exchange server)
When S receives (X ₁ , Z _{n + 1} , σ ₁ ), the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｓは、受信した（Ｘ_１，Ｚ_ｎ＋１，σ_１）を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｓは、アクセス構造Ｐ_ｎ＋１´＝（（ＩＤ＝Ｕ_ｎ＋１）∧（ｔ∈ＴＦ））として、ＣＴ_ｎ＋１´←ＡＥｎｃ（Ｐａｒａｍｓ，Ｐ_ｎ＋１´，Ｋ_１）を計算する。続いて、Ｓは、

To execute. Then, when the MAC verification by this verification algorithm fails, S _{discards the received (X 1} , Zn _{+ 1} , σ ₁ ). On the other hand, when MAC verification by this verification algorithm is successful, S has _{CT n + 1} ′ ← AEnc (Params, P _{n + 1} ′ ′ as _{the access structure P n + 1} ′ = ((ID = _{Un + 1} ) ∧ (t ∈ TF)) , K ₁ ) is calculated. Then, S is

を計算し、

Calculate and

をＵ_ｎ＋１に送信する。

Is sent to _{Un + 1.}

(Generation of session key)
_{Un + 1} is

を受信すると、検証アルゴリズム

When you receive the verification algorithm

を実行する。そして、この検証アルゴリズムによるＭＡＣ検証に失敗した場合、Ｕ_ｎ＋１は、受信した情報を破棄する。一方で、この検証アルゴリズムによるＭＡＣ検証に成功した場合、Ｕ_ｎ＋１は、

To execute. Then, when the MAC verification by this verification algorithm fails, _{Un + 1} discards the received information. On the other hand, if MAC verification by this verification algorithm is successful, _{Un + 1} will be

により復号を行うと共に、

Decrypt by

を計算し、セッション鍵

Calculate and session key

を生成及び出力する。また、Ｕ_ｎ＋１は、自身の記憶装置等に保存されている状態情報ｓｔａｔｅ_ｎ＋１から（ｘ_ｎ＋１，Ｘ_ｎ＋１）を削除する。同様に、Ｕ_１は、自身の記憶装置等に保存されている状態情報ｓｔａｔｅ_１から（ｘ_１，Ｘ_１）を削除する。

Is generated and output. _{Also, U n + 1} is deleted from the status information state _{n + 1} stored in its own storage device such as a _{(x n + 1, X n} + 1). Similarly, U ₁ deletes (x ₁ , X _{1 ) from the state information state 1} stored in its own storage device or the like.

[Leave phase]
Next, when a user's communication terminal U _j leaves the group sharing the session key SK (U ₁ , ..., _Un ), the group _{excluding U j} from this group (for example, j). ≠ 1, if it is _{n, U 1, ···, U} j-1, U j + 1, ···, may be executed Dist phase with _{U n).} Therefore, a detailed description of the Leave phase will be omitted.

[Update phase]
Then, when a new time frame has begun, U _1, · · ·, for a case of updating the session key SK shared by U _n to a new session key SK' be described.

(Update of status information in a new time frame)
In the new time frame _TF, U 1, · · ·, session started with _{U n} is _{U i (i = 1,2, ···} , n) if it is the first session, the current time t∈TF in contrast, S is the attribute _{a i '= (U i,} t) _{as, usk i ← Der (Params,} msk, a i') and to produce a ^{_{mk i ← MGen (1 κ)}} . Next, S is, as the access structure _{P i = ((ID = U} i) ∧ (t = init)), CT i ← AEnc (Params, P i, (usk i, mk i)) is calculated.

Then, S transmits _{CT i} to U _i. After that, when U _i receives CT _i,

を計算して、自身の記憶装置等に保存されている状態情報ｓｔａｔｅ_ｉに含まれる（ｕｓｋ_ｉ，ｍｋ_ｉ）を、当該計算された（ｕｓｋ_ｉ，ｍｋ_ｉ）に更新する。

The calculated, updates the state information state _i contained in _{(usk i,} mk i) stored in its own storage device such as a, on the calculated _{(usk i,} mk i).

(Information generation for updating session key)
S is

を生成した後、

After generating

を計算した上で、アクセス構造Ｐ_ｉ´＝（（ＩＤ＝Ｕ_ｉ）∧（ｔ∈ＴＦ））として、ＣＴ_ｉ´←ＡＥｎｃ（Ｐａｒａｍｓ，Ｐ_ｉ´，Ｋ_１）を計算する。そして、Ｓは、ＣＴ_ｉ´をＵ_ｉに送信する。

After having calculated the 'as _{= ((ID = U i)} ∧ (t∈TF)), CT i' access structure _P i ← AEnc calculating the _{(Params, P i ', K} 1). Then, S transmits _{CT i'to} U _i.

(Update session key)
When U _i receives CT _i ',

により復号を行って、

Decrypt with

によりセッション鍵ＳＫを更新して新たなセッション鍵ＳＫ´を生成及び出力する。

Updates the session key SK and generates and outputs a new session key SK'.

<Overall configuration of key exchange system 1>
Next, the overall configuration of the key exchange system 1 that realizes the key exchange by the ID-DMKD protocol based on the above UGKE will be described with reference to FIG. FIG. 1 is a diagram showing an example of the overall configuration of the key exchange system 1 according to the embodiment of the present invention.

As shown in FIG. 1, the key exchange system 1 according to the embodiment of the present invention includes a key exchange server 10 and a plurality of communication terminals 20. The key exchange server 10, each communication terminal 20, and the communication terminal 20 are connected to each other so as to be able to communicate with each other via a communication network N such as the Internet.

The key exchange server 10 is a computer or computer system that functions as a server for exchanging keys between communication terminals 20. The "key exchange server S" in the ID-DMKD protocol based on the above UGKE is realized by the key exchange server 10. Therefore, hereinafter, the key exchange server 10 is also referred to as "key exchange server S" or simply "S".

The communication terminal 20 is a terminal used by the user. For distinguishing each of the plurality of communication terminal 20, the n as an integer of 2 or more, referred to as "communication terminal 20 _1", ..., "communication terminal 20 _N". "Communication terminal _{U i"} in the ID-DMKD protocol based on the above UGKE is realized by the communication terminal 20. Therefore, in the following, as n ≦ N, "the communication terminal 20 _1", ..., respectively "communication terminal 20 _{n", "U 1",} ..., _{"U n"} or "communications terminal _{U 1} , ..., Also referred to as "communication terminal _Un ".

Similar to the assumption in the ID-DMKD protocol based on the above _UGKE, U _{1, ···,} and performs key exchange between the _{U n.} U ₁ is also referred to as a "representative communication terminal" because it is in a communication environment in which a stable communication band is secured and sufficient computing resources can be provided. _{On the other hand, it is assumed that the communication terminals Ui} (i = 2, ..., N) other than the "representative communication terminal" are in a communication environment in which a stable communication band cannot always be secured, or cannot provide sufficient computing resources. ..

As the communication terminal 20, any terminal capable of communication is used. Examples thereof include PCs (personal computers), smartphones, tablet terminals, wearable devices, game devices, digital home appliances, various IoT devices, and the like.

<Hardware configuration of key exchange server 10 and communication terminal 20>
Next, the hardware configuration of the key exchange server 10 and the communication terminal 20 according to the embodiment of the present invention will be described with reference to FIG. FIG. 2 is a diagram showing an example of the hardware configuration of the key exchange server 10 and the communication terminal 20 according to the embodiment of the present invention. When the communication terminal 20 is a PC, a smartphone, a tablet terminal, or the like, the communication terminal 20 can be realized with a hardware configuration substantially similar to that of the key exchange server 10. Therefore, the hardware configuration of the key exchange server 10 will be mainly described below.

As shown in FIG. 2, the key exchange server 10 according to the embodiment of the present invention includes an input device 11, a display device 12, a RAM (Random Access Memory) 13, a ROM (Read Only Memory) 14, and a processor 15. , An external I / F16, a communication I / F17, and an auxiliary storage device 18. Each of these hardware is connected so as to be able to communicate with each other via the bus 19.

The input device 11 is, for example, a keyboard, a mouse, a touch panel, or the like, and is used for a user to input various operations. The display device 12 is, for example, a display or the like, and is used to display various processing results or the like to the user. The key exchange server 10 does not have to have at least one of the input device 11 and the display device 12.

The RAM 13 is a volatile semiconductor memory that temporarily holds programs and data. The ROM 14 is a non-volatile semiconductor memory capable of holding programs and data even when the power is turned off. The processor 15 is, for example, a CPU (Central Processing Unit) or the like, and is an arithmetic unit that reads a program or data from a ROM 14 or an auxiliary storage device 18 or the like onto a RAM 13 and executes processing.

The external I / F 16 is an interface with an external device. The external device includes a recording medium 16a and the like. Examples of the recording medium 16a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), a USB (Universal Serial Bus) memory card, and the like.

The communication I / F 17 is an interface for connecting the key exchange server 10 to the communication network N. The auxiliary storage device 18 is a non-volatile storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive).

The key exchange server 10 and the communication terminal 20 according to the embodiment of the present invention can realize the setup process, the key exchange process, and the like described later by having the hardware configuration shown in FIG. Note that FIG. 2 shows a case where the key exchange server 10 and the communication terminal 20 according to the embodiment of the present invention are realized by one device (computer), but the present invention is not limited to this. The key exchange server 10 and the communication terminal 20 in the embodiment of the present invention may be realized by a plurality of devices (computers). Further, one device (computer) may include a plurality of processors 15 and a plurality of memories (for example, RAM 13, ROM 14, auxiliary storage device 18, etc.).

<Functional configuration of key exchange system 1>
Next, the functional configuration of the key exchange system 1 according to the embodiment of the present invention will be described with reference to FIG. FIG. 3 is a diagram showing an example of the functional configuration of the key exchange system 1 according to the embodiment of the present invention.

≪Key exchange server 10≫
As shown in FIG. 3, the key exchange server 10 according to the embodiment of the present invention has a communication unit 101, a key exchange processing unit 102, and a storage unit 103. The communication unit 101 and the key exchange processing unit 102 are realized, for example, by processing one or more programs installed in the key exchange server 10 to execute the processor. Further, the storage unit 103 can be realized by using a storage device such as an auxiliary storage device.

The communication unit 101 transmits and receives various data to and from the communication terminal 20. The key exchange processing unit 102 performs key exchange processing for sharing or updating the session key between the communication terminals 20. The storage unit 103 stores various data used in the key exchange process (for example, _{X i transmitted from a communication terminal U i} (i = 2, ..., N) other than the representative communication terminal).

≪Key exchange server 10≫
As shown in FIG. 3, the communication terminal 20 according to the embodiment of the present invention has a communication unit 201, a key exchange processing unit 202, and a storage unit 203. The communication unit 201 and the key exchange processing unit 202 are realized, for example, by processing one or more programs installed in the communication terminal 20 to execute the processor. Further, the storage unit 203 can be realized by using a storage device such as an auxiliary storage device.

The communication unit 201 transmits / receives various data to / from the key exchange server 10 and another communication terminal 20. The key exchange processing unit 202 performs key exchange processing for sharing or updating a session key with another communication terminal 20. Storage unit 203 stores various data used for the key exchange processing (for example, X _i, etc. generated by itself).

<Setup process>
Next, the setup process executed by the key exchange system 1 according to the embodiment of the present invention will be described with reference to FIG. FIG. 4 is a flowchart showing an example of the setup process. This setup process is a process in which the above-mentioned ID-DMKD protocol setup based on UGKE is realized by the key exchange system 1. Therefore, in the following, the flow and outline of the setup process will be described, and for details, refer to the above-mentioned setup of the ID-DMKD protocol based on UGKE.

Step S101: The key exchange processing unit 102 of the key exchange server 10 executes the Setup algorithm of the ciphertext policy attribute-based encryption to generate the public parameter Params and the master private key msk.

Step S102: Next, the key exchange processing unit 102 of the key exchange server 10 issues (Params, p, G, g, TCR, tPRF, F, F') as the static public key SPK _S.

Step S103: Next, _{the key exchange processing unit 202 of each communication terminal 20 i} (i = 1, 2, ..., N) and the key exchange processing unit 102 of the key exchange server 10 are of ciphertext policy attribute-based encryption. run the key distribution algorithm to generate the initial static key isk _i. For example, when _{the communication unit 101 of each communication terminal 20 i} (i = 1, 2, ..., N) _{transmits the identifier U i} to the key exchange server 10, the key exchange server 10 uses this identifier U. _The key distribution algorithm is executed using the attribute _{Ai including i.}

Step S104: Next, _{the key exchange processing unit 202 of each communication terminal 20 i} (i = 1, 2, ..., N) _{generates a secret string (st i} , st _i '). Similarly, the key exchange processing unit 102 of the key exchange server 10 _{generates a secret string (st S} , st _S ′).

Step S105: Finally, _{the key exchange processing unit 202 of each communication terminal 20 i} (i = 1, 2, ..., N) sets (isk _i , st _i , st _i ') as the static private key SSK _i. Is stored in its own storage unit 203. Similarly, the key exchange processing unit 102 of the key exchange server 10 stores (msk, st _S , st _S ′) in the storage unit 103 as a _{static private key SSK S.}

<Key exchange process (Dist phase)>
Next, the key exchange process (Dist phase) executed by the key exchange system 1 according to the embodiment of the present invention will be described with reference to FIG. FIG. 5 is a sequence diagram showing an example of the key exchange process (Dist phase). The key exchange process (Dist phase) is a process in which the Dist phase of the ID-DMKD protocol based on UGKE described above is realized by the key exchange system 1. Therefore, in the following, the flow and outline of the key exchange process (Dist phase) will be described, and for details, refer to the Dist phase of the ID-DMKD protocol based on UGKE described above.

Step S201: The key exchange server 10 and the communication terminal 20 perform "update of state information in a new time frame" in the Dist phase. That is, the key exchange processing unit 102 of the key exchange server 10, after generating the usk _i and mk _i respect communication terminal 20 _i is the first session in the time frame TF, to calculate the CT _i. Then, the communication unit 101 of the key exchange server 10 transmits the _{calculated CT i} to the communication terminal 20 _i. The key exchange processing unit 202 of the communication terminal 20 _i is from _{CT i (usk i, mk i} ) calculation (decoding), and updates the state information state _i in the storage unit 203 are stored.

Step S202: Each communication terminal 20 performs "offline calculation" of the Dist phase. That is, the key exchange processing unit 202 of the communication terminal 20 stored in the storage unit 203 to calculate the _{X i.}

Step S203: Next, the representative communication terminal other than the communication terminal 20 _{(i.e., U 2, ···, U n} ) performs the "first round of communication terminals other than the representative communication terminal" in Dist phase. That is, the key exchange processing unit 202 of each communication terminal 20 _i (however, i = 2, ..., N) generates the tag σ _{i of X i} by the tag generation algorithm of the message authentication code. Then, the communication unit 201 of each communication terminal 20 _i (however, i = 2, ..., N) _{transmits (X i} , σ _i ) to the key exchange server 10.

Step S204: The key exchange server 10 performs the “first round of the key exchange server” in the Dist phase. That is, the key exchange processing unit 102 of the key exchange server 10 performs MAC verification and then generates _{σ S by the tag generation algorithm of the message authentication code.} Then, the communication unit 101 of the key exchange server 10 transmits to the _{({X i} i∈ [2} , n], σ S) representative communication terminal (i.e., communication terminal 20 _1). Each _{X i} is stored in the storage unit 103 of the key exchange server 10.

Step S205: the representative communication terminal (i.e., communication terminal 20 ₁₎ performs a "first round of the representative communication terminal" in Dist phase. That is, the key exchange processing unit 202 of the communication terminal 20 _1, after performing the MAC verification to generate a short-term private key ESK _1, the short-term secret key ESK ₁ from _{(X 1, {Z i}} i∈ [2 _{, N]} , σ ₁ ′) is generated. The communication unit 201 of the communication terminal 20 _{1 transmits (X 1, {Z i}} i∈ [2, n], σ 1 ') to the key exchange server 10.

Step S206: The key exchange server 10 performs the “second round of the key exchange server” in the Dist phase. That is, the key exchange processing unit 102 of the key exchange server 10 calculates the side and the short-term secret key ESK _S after performing MAC verification. Next, the key exchange processing unit 102 of the key exchange server 10, based on the short-term secret key ESK _S, by the tag generation algorithm of the encryption algorithm and a message authentication code ciphertext policy attributes based encryption, CT 1 _'and Calculate the tag, CT _{i'and its tag.} Then, the communication unit 101 of the key exchange server 10 is

を通信端末２０_１に送信すると共に、

And transmits to the communication terminal 20 _1,

を通信端末２０_ｉ（ただし、ｉ＝２，・・・，ｎ）に送信する。

Is transmitted to the communication terminal 20 _i (where i = 2, ..., N).

Step S207: Each communication terminal 20 performs “session key generation” in the Dist phase. As a result, the session key SK is shared by each communication terminal 20.

As described above, in the key exchange system 1 according to the embodiment of the present invention, _{X i} calculated offline by _{each communication terminal 20 i} other than the representative communication terminal is stored in the key exchange server 10. Thus, it is possible to reduce the number of rounds of the respective communication terminals 20 _i other than the representative communication terminal (that is, reduce the communication cost). Therefore, for example, the communication terminal 20 that exchanges keys may include a communication terminal 20 in a narrow band communication environment, or a communication terminal 20 that cannot provide sufficient computing resources. However, if at least one communication terminal 20 is in a stable communication environment and sufficient computing resources can be provided, key exchange can be performed without causing a delay or the like.

<Key exchange process (Join phase)>
Next, the key exchange process (Join phase) executed by the key exchange system 1 according to the embodiment of the present invention will be described with reference to FIG. FIG. 6 is a sequence diagram showing an example of the key exchange process (Join phase). The key exchange process (Join phase) is a process in which the Join phase of the ID-DMKD protocol based on UGKE described above is realized by the key exchange system 1. Therefore, in the following, the flow and outline of the key exchange process (Join phase) will be described, and for details, refer to the Join phase of the ID-DMKD protocol based on UGKE described above. Further, in the following, similar to the premise in ID-DMKD protocol based on UGKE described above, groups sharing a session key _{SK (U 1, ···, U} n) with respect to the communication of the new user terminal Assuming that _{Un + 1} participates, this communication terminal _{Un + 1} is also referred to as a "participating communication terminal".

Step S301: The key exchange server 10 and the communication terminal 20 _i (however, i = 1, n + 1) perform "update of state information in a new time frame" in the Join phase. That is, the key exchange processing unit 102 of the key exchange server 10, after generating the usk _i and mk _i respect communication terminal 20 _i is the first session in the time frame TF, to calculate the CT _i. Then, the communication unit 101 of the key exchange server 10 transmits the _{calculated CT i} to the communication terminal 20 _i. The key exchange processing unit 202 of the communication terminal 20 _i is from _{CT i (usk i, mk i} ) calculation (decoding), and updates the state information state _i in the storage unit 203 are stored.

Step S302: Next, each communication terminal 20 _i (where i = 1, n + 1) performs "offline calculation" of the Join phase. That is, the key exchange processing unit 202 of each communication terminal 20 _i (however, i = 1, n + 1) _{calculates X i} and stores it in the storage unit 203.

Step S303: The participating communication terminal (that _{is, Un + 1} ) performs the "first round of the participating communication terminal" in the Join phase. That is, the key exchange processing unit 202 of the communication terminal 20 _{n + 1} generates the tag σ _{n + 1 of X n + 1} by the tag generation algorithm of the message authentication code. Then, the communication unit 201 of the communication terminal 20 _{n + 1 transmits (X n + 1} , σ _{n + 1} ) to the key exchange server 10.

Step S304: The key exchange server 10 performs the “first round of the key exchange server” in the Join phase. That is, the key exchange processing unit 102 of the key exchange server 10 performs MAC verification and then generates _{σ S by the tag generation algorithm of the message authentication code.} Then, the communication unit 101 of the key exchange server 10 transmits to the _{(sid, X n + 1,} σ S) representative communication terminal (i.e., communication terminal 20 _1). As described above, since the session key SI does not change in the Join phase, the side does not change either.

Step S305: Next, the representative communication terminal (i.e., communication terminal 20 ₁₎ performs a "first round of the representative communication terminal" in the Join phase. That is, the key exchange processing unit 202 of the communication terminal 20 _1, after performing the MAC verification _to calculate the _{Z n + 1} and sigma _1. The communication unit 201 of the communication terminal 20 _{1 transmits (X 1, Z n + 1} , σ 1) a key exchange server 10.

Step S306: The key exchange server 10 performs the “second round of the key exchange server” in the Join phase. That is, the key exchange processing unit 102 of the key exchange server 10 _{calculates CT n + 1} ′ and its tag after performing MAC verification. Then, the communication unit 101 of the key exchange server 10 is

を参加通信端末（つまり、通信端末２０_ｎ＋１）に送信する。

Is transmitted to the participating communication terminal (that is, the communication terminal 20 _{n + 1} ).

Step S307: The participating communication terminal (that is, the communication terminal 20 _{n + 1} ) performs the “session key generation” of the Join phase. As a result, the session key SK is also shared with the participating communication terminals.

<Key exchange process (Leave phase)>
When a user's communication terminal U _j leaves the group sharing the session key SK (U ₁ , ..., _Un ), as described above, the group _{excluding U j} from this group (U j). for example, if a _{j ≠ 1, n, U 1} , ···, U j-1, U j + 1, ···, may execute a key exchange process (Dist phase) in _{U n).} Therefore, a detailed description of the key exchange process (Leave phase) will be omitted.

<Key exchange process (Update phase)>
Next, the key exchange process (Update phase) executed by the key exchange system 1 according to the embodiment of the present invention will be described with reference to FIG. 7. FIG. 7 is a sequence diagram showing an example of the key exchange process (Update phase). The key exchange process (Update phase) is a process in which the Update phase of the ID-DMKD protocol based on UGKE described above is realized by the key exchange system 1. Therefore, in the following, the flow and outline of the key exchange process (Update phase) will be described, and for details, refer to the Update phase of the ID-DMKD protocol based on UGKE described above. Further, in the following, similar to the premise in ID-DMKD protocol based on UGKE described above, a when a new time frame has _begun, U 1, · · ·, a session key SK shared by _{U n} new The case of updating to the session key SK'will be described.

Step S401: The key exchange server 10 and the communication terminal 20 perform "update of state information in a new time frame" in the Update phase. That is, the key exchange processing unit 102 of the key exchange server 10, after generating the usk _i and mk _i respect communication terminal 20 _i is the first session in the new time frame TF, to calculate the CT _i. Then, the communication unit 101 of the key exchange server 10 transmits the _{calculated CT i} to the communication terminal 20 _i. The key exchange processing unit 202 of the communication terminal 20 _i is from _{CT i (usk i, mk i} ) calculation (decoding), and updates the state information state _i in the storage unit 203 are stored.

Step S402: Next, the key exchange server 10 performs "information generation for updating the session key" in the Update phase. That is, the key exchange processing unit 102 of the key exchange server 10 generates _{CT i ′ by the encryption algorithm of the ciphertext policy attribute-based encryption.} And. The communication unit 101 of the key exchange server 10 transmits _{CT i} ′ to the communication terminal 20 _i.

Step S403: Each communication terminal 20 performs "update of session key" in the Update phase. As a result, the session key SK is updated to the session key SK'at each communication terminal 20.

The present invention is not limited to the above-described embodiment disclosed specifically, and various modifications and modifications can be made without departing from the scope of claims.

1 Key exchange system 10 Key exchange server 20 Communication terminal 101 Communication unit 102 Key exchange processing unit 103 Storage unit 201 Communication unit 202 Key exchange processing unit 203 Storage unit

Claims (7)

A key exchange system that exchanges keys between a plurality of communication terminals _Ui (i = 1, ..., N).
_{Using the information X i} (i = 2, ..., N) pre-calculated by some of the communication terminals U _i (i = 2, ..., N) among the plurality of communication terminals U _i. , The first key generation means for generating the key K on the communication terminal U _{1 and}
Using the key K and the information X _i (i = 2, ..., N), the communication terminal U ₁ uses the partial communication terminal U _i (i = 2, ..., N). _{), And a calculation means for calculating the information Z i} (i = 2, ..., N) for generating the key K.
_{Using the information X 1} calculated in advance by the communication terminal U ₁ and each of the information Z _i (i = 2, ..., N), some of the communication terminals U _i (i = 2, n) are used. ..., N), the second key generation means for generating the key K, and
A key exchange system characterized by having. The key exchange system includes a key exchange server.
Wherein the key exchange server, the information _{X i (i = 2, ···} , n) are stored,
The first key generation means is
Using the information in the key exchange server stored _{X i (i = 2, ···} , n), wherein the communication terminal U _1, to generate a key K, it claim 1, wherein Key exchange system. The key K is a session key and
A session ID generation means for generating a session ID by a predetermined hash function using the information X ₁ and the information X _{i (i = 2, ..., N).}
Using the session ID, the in the communication terminal U _1, the third key generating means for generating a session key,
Using said session ID, the said information _{Z i (i = 2, ···} , n) and each of said communication terminal _{U i (i = 2, ···} , n) in each of said session key The key exchange system according to claim 1 or 2, further comprising a fourth key generation means for generating a key. The communication terminal U ₁ is a communication terminal that is in a stable communication environment and can sufficiently provide computing resources for the key exchange, and is the communication terminal U _i (i = 2, ..., N). 1 to 1, wherein at least a part of the communication terminals is a communication terminal in a communication environment having a narrow band or a communication terminal that cannot sufficiently provide computing resources for the key exchange. The key exchange system according to any one of 3. A key exchange device for exchanging keys between a plurality of communication terminals _Ui (i = 1, ..., N).
_{Information X i} (i = 2, ..., N) calculated in advance by some of the communication terminals U _i (i = 2, ..., N) among the plurality of communication terminals U _{i is stored in the storage unit.} And the storage method to save to
A first transmission means for transmitting _{information X i} (i = 2, ..., N) stored in the storage unit to the _{communication terminal U 1 and}
The information for generating the generated key K and the same key K in the communication terminal _{U 1 Z i (i = 2} , ···, n) the communication terminal _{U i (i = 2, ···} , A second transmission means to transmit to each of n) and
A key exchange device characterized by having. A key exchange method used in a key exchange system for exchanging keys between a plurality of communication terminals _{Ui (i = 1, ..., N).
Using the information X i} (i = 2, ..., N) pre-calculated by some of the communication terminals U _i (i = 2, ..., N) among the plurality of communication terminals U _i. , The first key generation procedure for generating the key K on the communication terminal U _{1 and}
Using the key K and the information X _i (i = 2, ..., N), the communication terminal U ₁ uses the partial communication terminal U _i (i = 2, ..., N). _{), And the calculation procedure for calculating the information Z i} (i = 2, ..., N) for generating the key K.
_{Using the information X 1} calculated in advance by the communication terminal U ₁ and each of the information Z _i (i = 2, ..., N), some of the communication terminals U _i (i = 2, n) are used. ..., N), the second key generation procedure for generating the key K, and
A key exchange method characterized by having. A computer for exchanging keys between a plurality of communication terminals _Ui (i = 1, ..., N).
_{Information X i} (i = 2, ..., N) calculated in advance by some of the communication terminals U _i (i = 2, ..., N) among the plurality of communication terminals U _{i is stored in the storage unit.} Preservation means to save to
A first transmission means for transmitting _{information X i} (i = 2, ..., N) stored in the storage unit to the _{communication terminal U 1.}
The information for generating the generated key K and the same key K in the communication terminal _{U 1 Z i (i = 2} , ···, n) the communication terminal _{U i (i = 2, ···} , A second transmission means for transmitting to each of n),
A program to function as.

Images