JP2021034979A - Key exchange system, equipment, information processor, key exchange method, and program - Google Patents

Abstract

To reduce a time required for exchanging a key with an authenticated key exchange protocol using an ID base encryption.SOLUTION: A key exchange system exchanging a common key between a first communication device and a second communication device by an authenticated key exchange using an ID base encryption achieved on asymmetric pairing groups G1 and G2, includes: first short period public key generation means of generating a short public key XA,1 of the first communication device by using a generation source and a random number of the G1; second short period public key generation means of generating a short public key XB,2 of the second communication device by using a generation source and a random number of the G2; first common key generation means of generating the common key by using a user private key DA,1 of the first communication device and the short public key XB,2; and second common key generation means of generating the common key by using a user private key DB,2 of the second communication device and the short public key XA,1.SELECTED DRAWING: Figure 1

Description

The present invention relates to key exchange systems, devices, information processing devices, key exchange methods and programs.

In recent years, with the spread of IoT (Internet of Things) devices, highly important communication has come to be performed even in IoT devices. For this reason, authentication technology for confirming whether each other is a correct device during communication is becoming important for IoT devices as well.

Passwords, digital certificates, and the like have been known as authentication technologies for IoT devices, but in recent years, the introduction of a more secure key exchange protocol with authentication has been required. The key exchange protocol with authentication is a protocol that generates a common key (shared key) when authentication is successful and enables encrypted communication with the shared key. As one of such authenticated key exchange protocols, an authenticated key exchange protocol using ID-based cryptography is known.

An authenticated key exchange protocol using ID-based cryptography is generally implemented using a bilinear group of elliptic curves on a finite field. Such a bilinear group is also called a pairing group, and can be classified into a symmetric pairing group and an asymmetric pairing group. Currently, when a pairing group is used in cryptography, an asymmetric pairing group is often used from the viewpoint of efficiency and security.

FSU (Fujioka-Suzuki-Ustaoglu), which is standardized by ISO / IEC (International Organization for Standardization / International Electrotechnical Commission), is known as a key exchange protocol with authentication using ID-based cryptography realized on asymmetric pairing groups. (See Non-Patent Document 1). FSU is known to have maximum leakage attack resistance called ID-eCK security.

NTT Secure Platform Laboratories, NTT Corporation: Specification of FSU version 1.0, <URL: https://info.isl.ntt.co.jp/crypt/eng/archive/dl/fsu/FSU.pdf>

However, in FSU, it is necessary to perform a group operation called a pairing operation four times. Since the calculation cost of pairing calculation is generally high, when a device having limited calculation resources such as an IoT device performs key exchange by FSU, it may take time for key exchange. For example, when a pairing operation on a 462-bit BN (Barret-Naehrig) curve is performed on a processor having an operating clock number of about several hundred MHz, a calculation time of about 600 msec is required for each operation.

Also, for example, the asymmetric pairing group used for FSU is G ₁ and G ₂ (where p is a prime number, G ₁ is a subgroup of the group on the elliptic curve on the finite field F _{p , and G 2} is the finite field F. If the _p subgroup of the group on the elliptic curve over finite in), towards oval scalar multiplication on G ₂ than elliptic scalar multiplication on G ₁ is, calculation cost is increased. Therefore, it is possible to reduce the time required for key exchange if it is possible to configure the protocol only elliptic scalar multiplication on G _1, 3 times ellipse scalar multiplication on G ₁ in FSU (or twice ), elliptic scalar multiplication on G ₂ 2 times (or three times) it is necessary to perform.

One embodiment of the present invention has been made in view of the above points, and an object of the present invention is to reduce the time required for key exchange in an authenticated key exchange protocol using ID-based cryptography.

To achieve the above object, a key exchange system according to an embodiment of the present invention, the first communication device by authentication-key exchange using ID-based encryption implemented on asymmetric pairing group G ₁ and G ₂ A key exchange system that exchanges a shared key between a second communication device and a second communication device, and _{generates short-term public keys X A, 1} of the first communication device using the generation source of _{G 1 and a random number.} A first short-term public key generating means for generating the short-term public key X _{B, 2 of the second communication device using the G 2} generation source and a random number, and a second short-term public key generating means for generating the short-term public key X B, 2. A first shared key generating means for generating the shared key using the short-term public keys X _{B, 2} and the user private keys DA _{, 1 of the first communication device, and the short-term public keys X A, 1} and having a second common key generation means for generating the shared key by using the user private key D _{B, 2} of the second communication device and.

The time required for key exchange can be reduced by using an authenticated key exchange protocol using ID-based cryptography.

It is a figure which shows an example of the whole structure of the key exchange system which concerns on 1st Embodiment. It is a figure which shows an example of the hardware composition of the key issuing apparatus and the server apparatus which concerns on 1st Embodiment. It is a figure which shows an example of the hardware composition of the apparatus which concerns on 1st Embodiment. It is a figure which shows an example of the functional structure of the key exchange system which concerns on 1st Embodiment. It is a flowchart which shows an example of the key issuance processing which concerns on 1st Embodiment. It is a sequence diagram which shows an example of the key exchange process which concerns on 1st Embodiment. It is a flowchart which shows an example of the key issuance processing which concerns on 2nd Embodiment. It is a sequence diagram which shows an example of the key exchange process which concerns on 2nd Embodiment. It is a flowchart which shows the other example of the key issuance processing which concerns on 2nd Embodiment. It is a figure which shows an example of the whole structure of the key exchange system which concerns on 3rd Embodiment. It is a figure which shows an example of the functional structure of the key exchange system which concerns on 3rd Embodiment. It is a flowchart which shows an example of the key issuance processing which concerns on 3rd Embodiment. It is a sequence diagram which shows an example of the key exchange process which concerns on 3rd Embodiment.

Hereinafter, each embodiment of the present invention will be described. In each embodiment of the present invention, the time required for key exchange can be reduced by reducing the number of pairing operations and the number of elliptical scalar multiplications of the authenticated key exchange protocol using ID-based cryptography. The key exchange system 1 will be described.

Here, the asymmetric pairing groups _{G 1} and _{G 2} (but for use in FSU, as prime p, _{G 1} is a subgroup of the group on an elliptic curve over a finite field _{F p, G 2} is finite _{F p} as a subgroup of the group on the elliptic curve over finite), the user _{U a} sender (i.e., the data transmission side after the encrypted communication), receiver user _{U B} (i.e., the data receiver of the encrypted communication ) as, when performing a key exchange between the user U _a and the user U _B, as described in non-Patent Document 1 above, the FSU, G ₁ of origin g ₁ and G ₂ of origin By multiplying g ₂ by a random number x _A , the short-term public keys X _{A, 1} and X _{A, 2} of the user U _A are generated. Therefore, if these short-term public key _{X A, 1} and _{X A, 2} user _{U B} which has received the these short-term public key _{X A, 1} and _{X A, 2} is the scalar multiplication with the same random number _{x A} It is necessary to confirm, and the pairing operation e (X _{A, 1} , g ₂ ) and the pairing operation e (g ₁ , X _{A, 2} ) are calculated for the confirmation. Incidentally, the short-term public key of the user _{U B X B, 1} and _{X B, 2} a as well if the user _{U A} is received, the pairing computation _{e (X B, 1, g} 2) and pairing operation e (g ₁ , X _{B, 2} ) are calculated.

Therefore, the key exchange system 1 according to the embodiments described in the following, without the generation of both the G ₁ and G ₂ origional g ₁ and g _2, or key exchange using only one origin Configure the protocol to be possible. This makes it possible to omit the pairing operation for confirmation described above.

That, DH (Diffie-Hellman) key exchange FSU (i.e., at FSU described in Non-Patent Document 1, a user _{U A} and the user _{U B} between the processing of generating a shared value sigma ₃ and sigma ₄ in) pairs By substituting the ring operations e (x _A Z ₁ , X _{B, 2} ) and e (X _{A, 1} , x _B Z ₂ ), respectively, the user U _A can generate only the short-term public key X _{A, 1.} may be, the user U _B is well be generated only short-term public key X _{B, 2.} Thus, it is possible to reduce the number of pairing calculation, the number of elliptic scalar multiplication of the user U _B side can be made zero. Therefore, it is possible to reduce the time required for key exchange between the user U _A and the user U _B.

[First Embodiment]
Hereinafter, the first embodiment will be described. In the first embodiment, without using the G ₁ and both a generator g ₁ and g ₂ of G _2, or using only one origin basic structure of a key exchange which is capable Protocol Description To do.

<Overall configuration>
First, the overall configuration of the key exchange system 1 according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of the overall configuration of the key exchange system 1 according to the first embodiment.

As shown in FIG. 1, the key exchange system 1 according to the present embodiment includes one or more key issuing devices 10, one or more devices 20, and one or more server devices 30. The key issuing device 10, the device 20, and the server device 30 are communicably connected via a communication network N such as the Internet.

The key issuing device 10 is a computer or a computer system that functions as a KGC (Key Generation Center). The key issuing device 10 generates a master public key using the master private key, and then publishes the master public key. Further, the key issuing device 10 generates a user secret key from an identifier (ID) of the device 20 or the server device 30, and then distributes the user secret key to the device 20 or the server device 30 corresponding to the identifier.

Any identifier can be used as the identifier of the device 20 or the server device 30. For example, a manufacturing unique number, an IP (Internet Protocol) address, a physical address, or the like can be used. In addition to these, for example, the user ID, name, e-mail address, etc. of the user who uses the device 20 or the server device 30 can be used as an identifier.

The device 20 is, for example, various IoT devices such as various sensor devices, embedded devices, wearable devices, digital home appliances, surveillance cameras, lighting devices, medical devices, and industrial devices. That is, the device 20 is an IoT device having limited computing resources (for example, processor processing performance, memory capacity, etc.) as compared with a general computer or the like. However, the present invention is not limited to this, and even if the device 20 is a device other than the IoT device (PC (personal computer, smartphone, tablet terminal, etc.)), each embodiment of the present invention can be applied in the same manner.

The device 20 uses the user private key distributed from the key issuing device 10 to authenticate with another device 20 or the server device 30 by an authenticated key exchange protocol using ID-based cryptography (that is, legitimacy). Confirm) and exchange (generate) the key (shared key) for encrypted communication. In the following, when each of the plurality of devices 20 is represented separately, they are referred to as "device 20-1", "device 20-2", and the like.

The server device 30 is a computer or computer system that collects data (for example, sensing data) from the device 20. When collecting data from the device 20, the server device 30 authenticates with the device 20 by an authenticated key exchange protocol using ID-based cryptography, and exchanges a shared key for encrypted communication. ..

The configuration of the key exchange system 1 shown in FIG. 1 is an example, and may be another configuration. For example, the key exchange system 1 includes a terminal that transmits an identifier (identifier of the device 20 or an identifier of the server device 30) to the key issuing device 10 when the key issuing device 10 generates a user private key. You may. Further, when the encrypted communication is performed only between the devices 20 (that is, when the authentication by the key exchange protocol with authentication using ID-based cryptography and the exchange of the shared key are performed only between the devices 20), the key exchange system 1 is used. May not include the server device 30.

In each of the embodiments described later, as an example, the user U _A device 20, the user U _B as a server device 30, the authentication by the authentication with key exchange protocol using ID-based encryption with the device 20 and the server device 30 A case of exchanging a shared key for encrypted communication will be described. However, for example, the user _{U A} device 20-1, the user _{U B} as device 20-2, the authentication by the authentication with the key exchange protocol using ID-based encryption with the device 20-1 and device 20-2 You may go and exchange the shared key for encrypted communication. Similarly, when a plurality of server devices 30 (for example, "server device 30-1" and "server device 30-2") are included in the key exchange system 1, user U _{A is referred} to as server device 30-1 and user U _B. Is used as the server device 30-2, and authentication is performed between the server device 30-1 and the server device 30-2 by an authenticated key exchange protocol using ID-based encryption, and a shared key for encrypted communication is exchanged. You may. That is, the first communication device is either the device 20 or the server device 30, and the second communication device is either the device 20 or the server device 30, the first communication device that is a sender and the second communication device that is a receiver. The shared key for encrypted communication may be exchanged by performing authentication by an authenticated key exchange protocol using ID-based cryptography with the communication device of the above.

<Hardware configuration>
Next, the hardware configuration of the key issuing device 10, the device 20, and the server device 30 according to the present embodiment will be described.

<< Key issuing device 10 and server device 30 >>
Hereinafter, the hardware configurations of the key issuing device 10 and the server device 30 according to the present embodiment will be described with reference to FIG. FIG. 2 is a diagram showing an example of the hardware configuration of the key issuing device 10 and the server device 30 according to the first embodiment. Since the key issuing device 10 and the server device 30 can be realized with the same hardware configuration, the hardware configuration of the key issuing device 10 will be mainly described below.

As shown in FIG. 2, the key issuing device 10 according to the present embodiment includes an input device 11, a display device 12, a RAM (Random Access Memory) 13, a ROM (Read Only Memory) 14, a processor 15, and the like. It has an external I / F 16, a communication I / F 17, and an auxiliary storage device 18. Each of these hardware is connected so as to be able to communicate with each other via the bus 19.

The input device 11 is, for example, a keyboard, a mouse, a touch panel, or the like. The display device 12 is, for example, a display or the like. The key issuing device 10 and the server device 30 do not have to have at least one of the input device 11 and the display device 12.

The RAM 13 is a volatile semiconductor memory that temporarily holds programs and data. The ROM 14 is a non-volatile semiconductor memory capable of holding programs and data even when the power is turned off. The processor 15 is, for example, a CPU (Central Processing Unit) or the like, and is an arithmetic unit that reads a program or data from a ROM 14 or an auxiliary storage device 18 or the like onto a RAM 13 and executes processing.

The external I / F 16 is an interface with an external device. The external device includes a recording medium 16a and the like. Examples of the recording medium 16a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), a USB (Universal Serial Bus) memory card, and the like.

The communication I / F 17 is an interface for connecting to the communication network N. The auxiliary storage device 18 is, for example, a non-volatile storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive). Various data, programs, and the like are stored in the auxiliary storage device 18.

By having the hardware configuration shown in FIG. 2, the key issuing device 10 according to the present embodiment can realize the key issuing process and the like described later. Similarly, the server device 30 according to the present embodiment can realize the key exchange process and the like described later by having the hardware configuration shown in FIG.

Note that FIG. 2 shows a case where the key issuing device 10 and the server device 30 according to the present embodiment are realized by one device (computer), but the present invention is not limited to this. The key issuing device 10 and the server device 30 according to the present embodiment may be realized by a plurality of devices (computers). Further, one device (computer) may include a plurality of processors 15 and a plurality of memories (for example, RAM 13, ROM 14, auxiliary storage device 18, etc.).

≪Equipment 20≫
Hereinafter, the hardware configuration of the device 20 according to the present embodiment will be described with reference to FIG. FIG. 3 is a diagram showing an example of the hardware configuration of the device 20 according to the first embodiment.

As shown in FIG. 3, the device 20 according to the present embodiment includes a processor 21, a memory device 22, and a communication I / F 23. Each of these hardware is connected so as to be able to communicate with each other via the bus 24.

The processor 21 is, for example, an MPU (Micro Processing Unit), a CPU, or the like, and is an arithmetic unit that reads a program or data from the memory device 22 and executes processing.

The memory device 22 is, for example, a RAM, a ROM, a flash memory, or the like, and stores various data, programs, and the like. The communication I / F 23 is an interface for connecting the device 20 to the communication network N.

By having the hardware configuration shown in FIG. 3, the device 20 according to the present embodiment can realize the key exchange process and the like described later.

<Functional configuration>
Next, the functional configuration of the key exchange system 1 according to the present embodiment will be described with reference to FIG. FIG. 4 is a diagram showing an example of the functional configuration of the key exchange system 1 according to the first embodiment.

≪Key issuing device 10≫
As shown in FIG. 4, the key issuing device 10 according to the present embodiment has a key issuing processing unit 101 and a storage unit 102. The key issuing processing unit 101 is realized by a process of causing a processor to execute one or more programs installed in the key issuing device 10. Further, the storage unit 102 can be realized by using, for example, an auxiliary storage device, a RAM, or the like. The storage unit 102 may be realized by using a storage device or the like connected to the key issuing device 10 via the communication network N.

The key issuance processing unit 101 generates a master private key and a master public key. Further, the key issuance processing unit 101 generates a user secret key from an identifier of the device 20 or the server device 30, and then distributes the user secret key to the device 20 or the server device 30 corresponding to the identifier. The storage unit 102 stores various data (for example, a master private key, a master public key, etc.).

≪Equipment 20≫
As shown in FIG. 4, the device 20 according to the present embodiment has a key exchange processing unit 201 and a storage unit 202. The key exchange processing unit 201 is realized by a process of causing the processor 21 to execute one or more programs installed in the device 20. Further, the storage unit 202 can be realized by using, for example, a memory device 22 or the like.

The key exchange processing unit 201 uses the user private key distributed from the key issuing device 10 to authenticate with the server device 30 and another device 20 by an authenticated key exchange protocol using ID-based cryptography. Exchange shared keys. The storage unit 202 stores various data (for example, a user private key, etc.).

<< Server device 30 >>
As shown in FIG. 4, the server device 30 according to the present embodiment has a key exchange processing unit 301 and a storage unit 302. The key exchange processing unit 301 is realized by a process of causing a processor to execute one or more programs installed in the server device 30. Further, the storage unit 302 can be realized by using, for example, an auxiliary storage device, a RAM, or the like. The storage unit 302 may be realized by using a storage device or the like connected to the server device 30 via the communication network N.

The key exchange processing unit 301 authenticates with the device 20 by an authenticated key exchange protocol using ID-based cryptography and exchanges a shared key. The storage unit 302 stores various data (for example, a user private key, etc.).

<Details of processing of key exchange system 1>
Next, the details of the processing of the key exchange system 1 according to the present embodiment will be described.

≪Definition of symbols≫
First, the symbols used in this embodiment are defined as follows. Unless otherwise specified, the symbols defined in the present embodiment shall be used in the second embodiment and the third embodiment as well.

_{ID A} : Identifier of device 20 (that is, user U _A ) ID _B : Identifier of server device 30 (that is, user U _B ) DA _{, 1} : User private key of device 20 D _{B, 2} : User of server device 30 Private key k: A prime number that satisfies the security parameters p, q: p ≠ q G ₁ : A subgroup of the group E (F _p ) on the elliptic curve E ₁ with the elliptic curve on the finite field F _{p as E 1 G 2} : _{Let E 2 be} the elliptic curve on the k-th order extension field of the finite field F p, and the subgroup on the elliptic curve E _2.

の部分群
ｇ_１：Ｇ_１の生成元
ｇ_２：Ｇ_２の生成元
ｅ：Ｇ_１×Ｇ_２上で定義されたペアリング
Ｚ_ｑ：ｑを法とする剰余類
ｚ，ｙ∈Ｚ_ｑ：マスター秘密鍵
Ｚ_ｖ＝ｚｇ_ｖ∈Ｇ_ｖ（ｖ＝１，２）：マスター公開鍵
Ｙ_ｖ＝ｙｇ_ｖ∈Ｇ_ｖ（ｖ＝１，２）：マスター公開鍵
Ｈ_１：文字列（識別子）からＧ_１上の元を生成する関数
Ｈ_２：文字列（識別子）からＧ_２上の元を生成する関数
Ｈ：鍵導出関数
Ｋ：共有鍵
||：文字列の連結
また、任意の形式のデータを文字列に変換したものをハット「＾」を付与して表すものとする。例えば、短期公開鍵Ｘを文字列に変換したものを

Subgroups of g ₁ : G ₁ generator g ₂ : G ₂ generator e: G ₁ × G ₂ Coset defined above Z _q : q modulo coset z, y ∈ Z _q : Master private key Z _v = zg _v ∈ G _v (v = 1, 2): Master public key Y _v = yg _v ∈ G _v (v = 1, 2): Master public key H ₁ : From character string (identifier) Function that generates an element on G _{1 H 2 : Function that generates an element on G 2} from a character string (identifier) H: Key derivation function K: Shared key
||: Concatenation of character strings In addition, the data in any format converted into a character string shall be represented by adding a hat "^". For example, the short-term public key X converted into a character string

と表す。同様に、例えば、共有値σを文字列に変換したものを

It is expressed as. Similarly, for example, the shared value σ converted into a character string

と表す。

It is expressed as.

≪Key issuance process≫
Hereinafter, the key issuance process according to the present embodiment will be described with reference to FIG. FIG. 5 is a flowchart showing an example of the key issuance process according to the first embodiment.

The key issuance processing unit 101 of the key issuing device 10 _{generates the master private key z and the master public key Z 1} = zg ₁ and Z ₂ = zg ₂ (step S101). These master private keys z and master public keys Z ₁ and Z ₂ are stored in, for example, a storage unit 102. In addition, the master public keys Z ₁ and Z ₂ are made public. The master secret key z is generated, for example, by randomly selecting an element from _{Z q.}

Here, the above step S101 is executed, for example, at the time of system construction of the key exchange system 1. On the other hand, steps S102 to S103, which will be described later, are repeatedly executed each time it becomes necessary to generate a user private key. For example, steps S102 to S103 are executed when the key exchange system 1 is constructed, or when the device 20 or the server device 30 is added after the system is constructed. In the following, as an example, a user private key of the device 20 (user U _A), the case of generating the user private key of the server 30 (user U _B) will be described.

The key issuance processing unit 101 of the key issuing device 10 _{calculates the Q A, 1} = H ₁ (ID _A ), generates the user private key DA _{, 1} = zQ _{A, 1 , and Q B, 2} =. After _{calculating H 2} (ID _B ), the user private key _{DB, 2} = zQ _{B, 2} is generated (step S102). Thus, the user's private key _{D B,} the user private key _{D A, 1} and the server apparatus 30 of the device 20 ₂ and is generated. Note that ID _A , ID _B , H ₁ and H ₂ are public information.

Next, the key issuance processing unit 101 of the key issuing device 10 _{distributes the user private keys DA, 1} and DB _{, 2} generated in step S102 above (step S103). That is, the key issue processing unit 101 distributes the user's private key _{D A, 1} to the device 20 (user _{U A),} to distribute the user's private key _{D B, 2} to the server apparatus 30 (user _{U B).} As a result, the user private keys DA _{and 1} are stored in the storage unit 202 of the device 20, and the user private keys _{DB and 2} are stored in the storage unit 302 of the server device 30.

The user private key may be distributed by any method. For example, the key issuing device 10 may transmit the user private key to the device 20 or the server device 30, or the device 20 or the server device 30 may access the key issuing device 10 to acquire the user private key. , The user private key may be stored in a recording medium and distributed.

≪Key exchange process≫
In the following, the case of performing the key exchange process between the device 20 (user U _A) and the server apparatus 30 (user U _B), will be described with reference to FIG. FIG. 6 is a sequence diagram showing an example of the key exchange process according to the first embodiment. _{It is assumed that the user private keys DA and 1} are stored in the storage unit 202 of the device 20 and the user private keys _{DB and 2} are stored in the storage unit 302 of the server device 30.

Key exchange processing unit 201 of the device 20, the short-term private key _{x A} ∈ Z _q on randomly selected, to produce a short-term public key _{X A, 1 = x A g} 1 ( step S201). The short-term private key x _A and the short-term public key X _{A, 1} are stored in, for example, the storage unit 202.

The key exchange processing unit 301 of the server device 30 _{randomly selects the short-term private key x B} ∈ Z _q , and then generates the short-term public key X _{B, 2} = x _B g ₂ (step S202). The short-term private key x _B and the short-term public key X _{B, 2} are stored in, for example, the storage unit 302.

Next, the key exchange processing unit 201 of the device 20 _{transmits the short-term public keys XA and 1} to the server device 30 (step S203). Similarly, the key exchange processing unit 301 of the server device 30 _{transmits the short-term public keys XB and 2} to the device 20 (step S204).

The key exchange processing unit 201 of the device 20 _{calculates the shared values σ 1} , σ ₂ , and σ ₃ as follows (step S205).

σ ₁ = e (DA _{, 1} , QB _{, 2} )
σ ₂ = e (DA _{, 1} + x _A Z ₁ , Q _{B, 2} + X _{B, 2} )
σ ₃ = e (x _A Z ₁ , X _{B, 2} )
Note that Q _{B, 2} = H ₂ (ID _B ) may be calculated by the key exchange processing unit 201, or Q _{B, 2} disclosed by the key issuing device 10 may be used.

Further, the key exchange processing unit 301 of the server device 30 _{calculates the shared values σ 1} , σ ₂ , and σ ₃ as follows (step S206).

σ ₁ = e (Q _{A, 1} , DB _{, 2} )
σ ₂ = e (Q _{A, 1} + X _{A, 1} , DB _{, 2} + x _B Z ₂ )
σ ₃ = e (X _{A, 1} , x _B Z ₂ )
Note that Q _{A, 1} = H ₁ (ID _A ) may be calculated by the key exchange processing unit 301, or Q _{A, 1} disclosed by the key issuing device 10 may be used.

Next, the key exchange processing unit 201 of the device 20 calculates the sid as follows (step S207). In addition, side means a session ID.

同様に、サーバ装置３０の鍵交換処理部３０１は、以下によりｓｉｄを計算する（ステップＳ２０８）。

Similarly, the key exchange processing unit 301 of the server device 30 calculates the side according to the following (step S208).

そして、機器２０の鍵交換処理部２０１は、以下により共有鍵Ｋを生成する（ステップＳ２０９）。

Then, the key exchange processing unit 201 of the device 20 generates the shared key K by the following (step S209).

なお、共有鍵Ｋは、例えば、記憶部２０２に保存される。

The shared key K is stored in, for example, the storage unit 202.

Similarly, the key exchange processing unit 301 of the server device 30 generates the shared key K by the following (step S210).

なお、共有鍵Ｋは、例えば、記憶部３０２に保存される。

The shared key K is stored in, for example, the storage unit 302.

As a result, the shared key K is shared between the device 20 and the server device 30. Therefore, the device 20 and the server device 30 can perform encrypted communication using the shared key K. When the shared key K is generated in step S209 and step S210, arbitrary data (for example, master public keys Z ₁ and Z ₂ and protocol name) predetermined between the device 20 and the server device 30 are generated. (Algorithm name), etc.) may be converted into a character string. For example, when the master public keys Z ₁ and Z ₂ and the protocol name "FSU" are converted into character strings, the shared key K may be generated by the following.

これにより、安全性をより向上させることができる。

Thereby, the safety can be further improved.

As described above, in the key exchange system 1 according to the present embodiment, the device 20 generates only the short-term public keys X _{A and 1 using the G 1} generator g ₁ , and the server device 30 generates the _{G 2 generator.} Only short-term public keys X _{B, 2} are generated using g _2. As a result, the number of pairing operations in the entire key exchange system 1 can be reduced twice as compared with the FSU (that is, the number of pairing operations in each of the device 20 and the server device 30 can be reduced by one. it together can) be the number of times of elliptic scalar multiplication of on G ₂ in device 20 can be zero. Therefore, according to the key exchange system 1 according to the present embodiment, the time required for key exchange can be reduced.

[Second Embodiment]
Hereinafter, the second embodiment will be described. In the second embodiment, the case where the security of the protocol described in the first embodiment is further improved and configured to have the same security as the ID-eCK security will be described. In the second embodiment, the differences from the first embodiment will be mainly described, and the description of the same components as those in the first embodiment will be omitted.

<Details of processing of key exchange system 1>
Details of the processing of the key exchange system 1 according to the present embodiment will be described.

≪Key issuance process≫
Hereinafter, the key issuance process according to the present embodiment will be described with reference to FIG. 7. FIG. 7 is a flowchart showing an example of the key issuance process according to the second embodiment.

The key issuance processing unit 101 of the key issuing device 10 _{generates the master private keys z and y and the master public keys Y 1} = yg ₁ and Y ₂ = yg ₂ (step S301). These master private keys z and y and master public keys Y ₁ and Y ₂ are stored in, for example, a storage unit 102. In addition, the master public keys Y ₁ and Y ₂ are made public. The master secret key y is generated, for example, by randomly selecting an element from _{Z q.}

Next, the key issuing processing unit 101 of the key issuing device 10 deletes the master secret key y stored in the storage unit 102 (step S302). Although this step does not necessarily have to be executed, by deleting the master private key y from the storage unit 102, it is possible to prevent the master private key y from being leaked thereafter.

Next, the key issuing processing unit 101 of the key issuing device 10 _{generates the master public key Z 1} = zg ₁ and Z ₂ = zg ₂ (step S303). These master public keys Z ₁ and Z ₂ are stored in, for example, a storage unit 102. In addition, the master public keys Z ₁ and Z ₂ are made public.

Here, the above steps S301 to S303 are executed, for example, when the system of the key exchange system 1 is constructed. On the other hand, steps S304 to S305 are repeatedly executed each time it becomes necessary to generate a user private key. Since steps S304 to S305 are the same as steps S102 to S103 of FIG. 5, the description thereof will be omitted.

≪Key exchange process≫
In the following, the case of performing the key exchange process between the device 20 (user U _A) and the server apparatus 30 (user U _B), will be described with reference to FIG. FIG. 8 is a sequence diagram showing an example of the key exchange process according to the second embodiment. Since steps S401 to S404 are the same as steps S201 to S204 of FIG. 6, the description thereof will be omitted.

The key exchange processing unit 201 of the device 20 _{calculates the shared values σ 1} , σ ₂ , and σ ₃ as follows (step S405).

σ ₁ = e (DA _{, 1} , QB _{, 2} )
σ ₂ = e (DA _{, 1} + x _A Z ₁ , Q _{B, 2} + X _{B, 2} )
σ ₃ = e (x _A (Z ₁ + Y ₁ ), X _{B, 2} )
Note that Q _{B, 2} = H ₂ (ID _B ) may be calculated by the key exchange processing unit 201, or Q _{B, 2} disclosed by the key issuing device 10 may be used.

Further, the key exchange processing unit 301 of the server device 30 _{calculates the shared values σ 1} , σ ₂ , and σ ₃ as follows (step S406).

σ ₁ = e (Q _{A, 1} , DB _{, 2} )
σ ₂ = e (Q _{A, 1} + X _{A, 1} , DB _{, 2} + x _B Z ₂ )
σ ₃ = e (X _{A, 1} , x _B (Z ₂ + Y ₂ ))
Note that Q _{A, 1} = H ₁ (ID _A ) may be calculated by the key exchange processing unit 301, or Q _{A, 1} disclosed by the key issuing device 10 may be used.

Subsequent steps S407 to S410 are the same as steps S207 to S210 of FIG. 6, and thus the description thereof will be omitted.

As described above, in the key exchange system 1 according to the present embodiment, the shared value σ ₃ is calculated _{using the master public keys Y 1} = yg ₁ and Y ₂ = yg _2. Further, after the master public keys Y ₁ and Y ₂ are generated, unlike the master private key z, the key issuing device 10 does not need to hold the master private key y, so the master private key y is deleted. It is possible to do. Therefore, in the key exchange system 1 according to the present embodiment, it is possible to prevent the leakage of the master private key y, and it is possible to further enhance the security.

In the above description, it is assumed that the key issuing device 10 included in the key exchange system 1 is one, but when a plurality of key issuing devices 10 are included in the key exchange system 1 (for example, the device 20 and the server device 30). The master private key may be distributed to a plurality of key issuing devices 10 in cases where a key issuing device 10 exists for each service used by the user. That is, for example, when the key issuing device 10-1 and the key issuing device 10-2 are included in the key exchange system 1, the key issuing device 10-1 uses the master private key z and the master public keys Z ₁ and Z ₂ . In addition to generating and holding, the key issuing device 10-2 may generate and hold the master private key y and the master public keys Y ₁ and Y ₂ .

Further, for example, when the key issuing device 10-1 and the key issuing device 10-2 and the key issuing device 10-3 are included in the key exchange system 1, the key issuing device 10-1 is the master private key z and the master public key. Z ₁ and Z ₂ are generated and held, the key issuing device 10-2 generates and holds the master private key y and the master public keys Y ₁ and Y _2, and the key issuing device 10-3 generates and holds the master private key w. And the master public key W ₁ = wg ₁ and W ₂ = wg ₂ may be generated and retained. In this case, in step S405 described above, σ _{3 is calculated by σ 3} = e (x _A (Z ₁ + Y ₁ + W ₁ ), X _{B, 2} ), and in step S406, σ ₃ = e (X _{A, 1} , x). Calculate _{σ 3 by B} (Z ₂ + Y ₂ + W ₂ )). As a result, for example, it becomes difficult for an attacker or the like to obtain all the master private keys, and it becomes possible to further improve the security. More generally, when N key issuing devices 10 are included in the key exchange system 1, N master private keys can be distributed to N key issuing devices 10.

Further, in the above it has been generated the master public key Y ₁ and Y ₂ from the master secret key y, the master public key Y ₁ and Y ₂ may be generated in a different manner. For example, since the master private key y can be generated by the device 20 and the server device 30 by using the multi-party protocol, it is possible to generate the _{master public keys Y 1} and Y _2. In this case, since the device 20 and the server device 30 generate the master private key y by the multi-party protocol, the key issuing device 10 does not need to generate and hold the master private key y (that is, the key issuing device 10 does not need to generate and hold the master private key y. As in the first embodiment, only the master private key z needs to be generated and retained).

<< Other examples of key issuance processing >>
Here, although the key issuing process shown in FIG. 7 and the master public key _{Y 1} and _{Y 2,} the _{Y 1} and _{Y 2} as the user's private key, device 20 (user _{U A)} and the server apparatus 30 (user _{U B} ) May be distributed respectively. The key issuance process in this case will be described with reference to FIG. FIG. 9 is a flowchart showing another example of the key issuance process according to the second embodiment. The same key issuing device 10 may generate and hold the master secret key z and y, but in FIG. 9, as an example, the key issuing device 10-1 generates and holds the master secret key z, and the key. A case where the issuing device 10-2 generates and holds the master private key y will be described.

The key issuing processing unit 101 of the key issuing device 10-1 _{generates a master private key z and a master public key Z 1} = zg ₁ and Z ₂ = zg _{2 in the same} manner as in step S101 of FIG. 5 (step S501). ..

Here, the above step S501 is executed, for example, at the time of system construction of the key exchange system 1. On the other hand, steps S502 to S505, which will be described later, are repeatedly executed each time it becomes necessary to generate a user private key. In the following, as an example, a user private key of the device 20 (user U _A), the case of generating the user private key of the server 30 (user U _B) will be described.

The key issuance processing unit 101 of the key issuing device 10-1 _{generates the user private keys DA, 1} and DB _{, 2} in the same manner as in step S102 of FIG. 5 (step S502).

Next, the key issuance processing unit 101 of the key issuing device 10-1 distributes _{the user private keys DA, 1} and DB _{, 2} generated in the above step S502 in the same manner as in step S103 of FIG. Step S503). That is, the key issue processing unit 101 distributes the user's private key _{D A, 1} to the device 20 (user _{U A),} to distribute the user's private key _{D B, 2} to the server apparatus 30 (user _{U B).}

On the other hand, the key issuance processing unit 101 of the key issuing device 10-2 _{generates the master secret key y and the user secret key Y 1} = yg ₁ and Y ₂ = yg ₂ (step S504). The master private key y may be deleted after _{the user private keys Y 1} and Y _{2 are generated.}

Next, the key issuing processing unit 101 of the key issuing device 10-2 _{distributes the user private keys Y 1} and Y ₂ (step S505). That is, the key issuance processing unit 101 _{distributes the user private key Y 1} to the device 20 and the user private key Y ₂ to the server device 30.

As described above, the _{key issuing device 10-1 distributes the user private keys DA, 1} and DB _{, 2} to the device 20 and the server device 30, respectively, and the key issuing device uses Y ₁ and Y ₂ as the user private keys. By distributing 10-2 to the device 20 and the server device 30, respectively, it is possible to further improve the safety. That is, since the device 20 (and the server device 30) needs to acquire the user private key from both the key issuing device 10-1 and the key issuing device 10-2, double authentication is required, which is inappropriate. It is possible to prevent the distribution of keys to devices.

Further, for example, when a key issuing device 10 exists for each service used by the device 20 or the server device 30, the device 20 and the server device 30 do not have to issue a user private key from all the services. It is possible to prevent communication (encrypted communication) from being started.

[Third Embodiment]
Hereinafter, the third embodiment will be described. In the third embodiment, a plurality of user private keys are used to improve security, and some shared values are calculated by the device 20 in order to reduce the calculation load of the device 20 (described later). The case of outsourcing to the outsourced calculation device 40) will be described. In the third embodiment, the differences from the first embodiment will be mainly described, and the description of the same components as those in the first embodiment will be omitted.

<Overall configuration>
First, the overall configuration of the key exchange system 1 according to the present embodiment will be described with reference to FIG. FIG. 10 is a diagram showing an example of the overall configuration of the key exchange system 1 according to the third embodiment.

As shown in FIG. 10, the key exchange system 1 according to the present embodiment further includes one or more consignment calculation devices 40. The consignment calculation device 40 is communicably connected to the device 20 via a communication network N such as the Internet.

The consignment calculation device 40 is, for example, an edge computer or a fog computer installed at a location physically close to the device 20. The consignment computing device 40 uses this authenticated key exchange protocol when the device 20 authenticates with the server device 30 or another device 20 by an authenticated key exchange protocol using ID-based cryptography and generates a shared key. The shared value is calculated using some of the user private keys used in the above. That is, the device 20 outsources the calculation of a part of the shared values to the consignment calculation device 40, and the consignment calculation device 40 calculates the part of the shared values in response to the consignment. The consignment calculation device 40 can be realized by, for example, the same hardware configuration as the key issuing device 10 and the server device 30.

<Functional configuration>
Next, the functional configuration of the key exchange system 1 according to the present embodiment will be described with reference to FIG. FIG. 11 is a diagram showing an example of the functional configuration of the key exchange system 1 according to the third embodiment.

≪Equipment 20≫
As shown in FIG. 11, the device 20 according to the present embodiment further has a mutual authentication unit 203. The mutual authentication unit 203 is realized by a process of causing the processor 21 to execute one or more programs installed in the device 20.

The mutual authentication unit 203 entrusts the consignment calculation device 40 with the calculation of the shared value using some of the user secret keys among the plurality of user secret keys used in the key exchange protocol with authentication using ID-based cryptography. Previously, using the common key stored in advance in the storage unit 202, mutual authentication is performed with the consignment computing device 40.

≪Consignment calculation device 40≫
As shown in FIG. 11, the consignment calculation device 40 according to the present embodiment includes a mutual authentication unit 401, a consignment calculation unit 402, and a storage unit 403. The mutual authentication unit 401 and the consignment calculation unit 402 are realized by a process of causing the processor to execute one or more programs installed in the consignment calculation device 40. Further, the storage unit 403 can be realized by using, for example, an auxiliary storage device, a RAM, or the like. The storage unit 403 may be realized by using a storage device or the like connected to the consignment calculation device 40 via the communication network N.

Before the mutual authentication unit 401 entrusts the device 20 with the calculation of the shared value using some of the user private keys among the plurality of user private keys used in the key exchange protocol with authentication using ID-based cryptography. , The shared key stored in advance in the storage unit 403 is used to mutually authenticate with the device 20.

The consignment calculation unit 402 calculates the shared value using the user private key entrusted by the device 20. The storage unit 403 stores a part of the user private keys among the plurality of user private keys used in the key exchange protocol with authentication using ID-based cryptography, the common key used for mutual authentication with the device 20, and the like. ..

<Details of processing of key exchange system 1>
Details of the processing of the key exchange system 1 according to the present embodiment will be described.

≪Key issuance process≫
Hereinafter, the key issuance process according to the present embodiment will be described with reference to FIG. FIG. 12 is a flowchart showing an example of the key issuance process according to the third embodiment.

The key issuing processing unit 101 of the key issuing device 10 _{generates a master private key z and a master public key Z 1} = zg ₁ and Z ₂ = zg _{2 in the same} manner as in step S101 of FIG. 5 (step S601). These master private keys z and master public keys Z ₁ and Z ₂ are stored in, for example, a storage unit 102. In addition, the master public keys Z ₁ and Z ₂ are made public.

Here, the above step S601 is executed, for example, at the time of system construction of the key exchange system 1. On the other hand, steps S602 to S603, which will be described later, are repeatedly executed each time it becomes necessary to generate a user private key. For example, steps S602 to S603 are executed when the system of the key exchange system 1 is constructed, or when the device 20 or the server device 30 is added after the system is constructed. In the following, as an example, a user private key of the device 20 (user U _A), the case of generating the user private key of the server 30 (user U _B) will be described.

The key issuance processing unit 101 of the key issuing device 10 calculates the user private key DA _{, 1} = zQ _{A after calculating QA, 1} = H ₁ (ID _A ) and Q _{A, 2} = H ₂ (ID _{A). ,} to generate a ₁ and _{D a, 2 = zQ a,} 2, Q B, 1 = H 1 (ID B) and _Q B, _{2 =} H ₂ user private key in terms of calculating the (ID _{B) D B , 1} = zQ _{B, 1} and _{DB, 2} = zQ _{B, 2} are generated (step S602). Thus, a user private key _{D A, 1} and _{D A, 2} of the device 20, user private key _{D B} of the server device _{30, 1} and _{D B, 2} and is generated.

Next, the key issuance processing unit 101 of the key issuing device 10 uses the user secret keys DA _{, 1} and DA _{, 2} generated in step S602 above, and the user secret keys DB _{, 1} and DB _{, 2} . Distribute (step S603). That is, the key issue processing unit 101, a user private key _{D A, 1} and _{D A, 2} and distributed to the device 20 (user _{U A),} user private key _{D B, 1} and _{D B, 2} a server device 30 ( and distributed to users _{U B).} As a result, the user private keys DA _{, 1} and DA _{, 2} are stored in the storage unit 202 of the device 20, and the user private keys DB _{, 1} and _{DB, 2} are stored in the storage unit 302 of the server device 30. Will be done.

≪Key exchange process≫
In the following, the case of performing the key exchange process between the device 20 (user U _A) and the server apparatus 30 (user U _B), will be described with reference to FIG. FIG. 13 is a sequence diagram showing an example of the key exchange process according to the third embodiment. Incidentally, together with the user's private key _{D A, 1} and _{D A, 2} is stored in the storage unit 202 of the device 20, the user's private key in the storage unit 302 of the server apparatus 30 _{D B, 1} and _{D B, 2} Suppose that is saved.

The key exchange processing unit 201 of the device 20 _{transmits the user private keys DA and 1} to the consignment calculation device 40 (step S701).

When the consignment calculation unit 402 of the consignment calculation device 40 receives the user secret keys DA _{, 1 , the consignment calculation unit 402 stores the user secret keys DA, 1} in the storage unit 403 (step S702).

The key exchange processing unit 201 of the device 20 _{deletes the user private keys DA and 1} stored in the storage unit 202 (step S703). As a result, of the user private keys DA _{, 1} and DA _{, 2 , only the user private keys DA, 2} are stored in the storage unit 202 of the device 20, and the storage unit of the consignment calculation device 40. Only the user private keys DA _{and 1} are stored in the 403.

It should be noted that the above steps S701 to S703 may be performed once before the device 20 first outsources the calculation of a part of the shared values to the outsourced calculation device 40. That is, when the device 20 outsources the calculation of a part of the shared values to the outsourced calculation device 40 for the second time or later, the above steps S701 to S703 are not executed. _{Hereinafter, it is assumed that only the user private keys DA and 2} are stored in the storage unit 202 of the device 20, and _{only the user private keys DA and 1} are stored in the storage unit 403 of the consignment computing device 40. To do. The server device 30 stores the user private keys _{DB, 1} and the user private keys _{DB, 2} in the storage unit 302.

Since steps S704 to S707 are the same as steps S201 to S204 of FIG. 6, the description thereof will be omitted.

The mutual authentication unit 203 of the device 20 and the mutual authentication unit 401 of the consignment computing device 40 perform mutual authentication using a common key (step S708). That is, the mutual authentication unit 203 of the device 20 authenticates the consignment calculation device 40 using the common key stored in advance in the storage unit 202, and the mutual authentication unit 401 of the consignment calculation device 40 is stored in the storage unit 403. The device 20 is authenticated using the common key stored in advance. As a result, the legitimacy of each other is confirmed between the device 20 and the consignment calculation device 40. By using the common key in this way, it is possible to reduce the processing time for mutual authentication between the device 20 and the consignment calculation device 40.

In the following, it is assumed that the mutual authentication in step S708 is successful. If the mutual authentication is successful, the device 20 and the consignment computing device 40 generate a session key, and the subsequent communication is encrypted using this session key. Therefore, it is assumed that the subsequent communication in step S710 and step S716 is encrypted by this session key.

Key exchange processing unit 201 of the device ₂₀ calculates the x A _{Z 1} (step S709). Next, the key exchange processing unit 201 of the apparatus 20, the identifier ID _B, a short-term public key _{X B, 2,} and transmits the calculated value _x A _{Z 1} commissioned computing device 40 (step S710).

When the consignment calculation unit 402 of the consignment calculation device 40 receives the identifier ID _B , the short-term public keys X _{B, 2,} and the calculated value x _A Z ₁ , the consignment calculation unit 402 calculates the shared values σ ₂ and σ ₃ as follows (step). S711).

σ ₂ = e (DA _{, 1} + x _A Z ₁ , Q _{B, 2} + X _{B, 2} )
σ ₃ = e (x _A Z ₁ , X _{B, 2} )
Note that Q _{B, 2} = H ₂ (ID _B ) may be calculated by the consignment calculation unit 402, or Q _{B, 2} disclosed by the key issuing device 10 may be used.

The key exchange processing unit 201 of the device 20 _{calculates the shared value σ 1} as follows (step S712).

σ ₁ = e (QB _{, 1} , DA _{, 2} )
Note that Q _{B, 1} = H ₁ (ID _B ) may be calculated by the key exchange processing unit 201, or Q _{B, 1} disclosed by the key issuing device 10 may be used.

Further, the key exchange processing unit 301 of the server device 30 _{calculates the shared values σ 1} , σ ₂ , and σ ₃ as follows (step S713).

σ ₁ = e (DB _{, 1} , Q _{A, 2} )
σ ₂ = e (Q _{A, 1} + X _{A, 1} , DB _{, 2} + x _B Z ₂ )
σ ₃ = e (X _{A, 1} , x _B Z ₂ )
Note that Q _{A, 2} = H ₂ (ID _A ) may be calculated by the key exchange processing unit 301, or Q _{A, 2} disclosed by the key issuing device 10 may be used.

Next, the key exchange processing unit 201 of the device 20 calculates the side in the same manner as in step S207 of FIG. 6 (step S714). Further, the key exchange processing unit 301 of the server device 30 calculates the side in the same manner as in step S208 of FIG. 6 (step S715).

The consignment calculation unit 402 of the consignment calculation device 40 _{transmits the shared values σ 2} and σ ₃ calculated in step S711 to the device 20 (step S716).

_{When the key exchange processing unit 201 of the device 20 receives the shared values σ 2} and σ ₃ from the consignment computing device 40, the key exchange processing unit 201 generates the shared key K in the same manner as in step S209 of FIG. 6 (step S717).

Further, the key exchange processing unit 301 of the server device 30 generates the shared key K in the same manner as in step S210 of FIG. 6 (step S718). As a result, the shared key K is shared between the device 20 and the server device 30.

As described above, in the key exchange system 1 according to this embodiment, device 20 was stored the user private key D _{A, 1} of the user private key D _{A, 1} and D _{A, 2} consignment computing device 40 Above, the calculation of the shared values σ ₂ and σ ₃ is outsourced to the outsourced calculation device 40. As a result, the processing load on the device 20 can be reduced, and the time required for key exchange can be reduced. Further, since the user private keys DA _{, 1} and DA _{, 2} are distributed and held in the device 20 and the consignment computing device 40, respectively, security is ensured even if one of the user private keys is leaked. It becomes possible to do.

In the present _{embodiment, σ 3 = e (x A} Z 1, X B, 2) in the above step S711 and step S713 has been calculated, for example, in combination with a second embodiment, sigma ₃ = E (x _A (Z ₁ + Y ₁ ), X _{B, 2} ) may be calculated. In this case, the device 20 in the above step _S709, x instead of A _{Z 1,} calculate the _{x A (Z 1 + Y 1} ) , entrusted computing device this _{x A (Z 1 + Y 1} ) at step S710 described above It may be transmitted to 40.

The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations, and the like can be made without departing from the scope of claims.

1 Key exchange system 10 Key issuer 20 Equipment 30 Server device 101 Key issue processing unit 102 Storage unit 201 Key exchange processing unit 202 Storage unit 301 Key exchange processing unit 302 Storage unit

Claims (8)

There the key exchange system for exchanging shared key between a first communication apparatus and the second communication device by authentication-key exchange using ID-based encryption implemented on asymmetric pairing group G ₁ and G ₂ hand,
A first short-term public key generating means for generating the short-term public keys XA _{, 1} of the first communication device using the generator of G _{1 and a random number,}
A second short-term public key generation means for generating a short-term public key X _{B, 2} of the second communication device by using the origin and the random number of the G _2,
A first shared key generation means for generating the shared key using the short-term public keys X _{B, 2} and the user private keys DA _{, 1 of the first communication device.}
A second shared key generation means for generating the shared key using the short-term public keys XA _{, 1} and the user private keys DB _{, 2 of the second communication device.}
A key exchange system characterized by having. The key exchange system includes a key generator.
The first shared key generation means is
_{The master public key Z 1} generated from the master secret key z and the generation source of the _{G 1 by} the key generator, and the master generated from the master secret key y and the generation source of the _{G 1 by the key generation device.} further by using the public key Y ₁ generates the shared key,
The second shared key generation means is
_{The master public key Z 2} generated from the master secret key z and the generation source of the _{G 2 by} the key generator, and the master generated from the master secret key y and the generation source of the _{G 2 by the key generation device.} The key exchange system according to claim 1, wherein the shared key is further used with the public key Y _2. The key exchange system includes a plurality of key generators.
The key exchange system according to claim 2, wherein the master public keys Z ₁ and Z ₂ and the master public keys Y ₁ and Y _{2 are generated by different key generators, respectively.} The key exchange system according to claim 2 or 3, wherein the master private key y is _{deleted from the key generator after the master public keys Y 1} and Y _{2 are generated.} A device for exchanging shared keys with other devices or the server device by the authentication with key exchange using the ID-based cryptographic implemented on asymmetric pairing groups G ₁ and G _2,
And short-term public key generation means for generating a short-term public key X _{A, 1} by using the origin and the random number of the G _1,
The shared key is obtained by using the short-term public keys X _{B and 2} generated by the other device or server device _{using the generator of G 2} and a random number, and the user private keys DA _{and 1 of the device.} The shared key generation method to be generated and
Equipment with. An information processing apparatus for exchanging shared keys between the authentication with key exchange by the device or another information processing apparatus using the ID-based cryptographic implemented on asymmetric pairing groups G ₁ and G _2,
A short-term public key generating means for generating short- _{term public keys X B and 2} using the G ₂ generator and a random number, and
Above using a short-term public key X _{A, 1} generated by using the origin and the random number of the G ₁ in the device, or other information processing apparatus, and a user private key D _{B, 2} of the information processing apparatus A shared key generation method for generating a shared key,
An information processing device characterized by having. Key in the key exchange system for exchanging shared key between a first communication apparatus and the second communication device by authentication-key exchange using ID-based encryption implemented on asymmetric pairing group G ₁ and G ₂ It ’s a replacement method,
A first short-term public key generation step of generating a short-term public key X _{A, 1} of the first communication device by using the origin and the random number of the G _1,
A second short-term public key generation step of generating a short-term public key X _{B, 2} of the second communication device by using the origin and the random number of the G _2,
A first shared key generation procedure for generating the shared key using the short-term public keys X _{B, 2} and the user private keys DA _{, 1 of the first communication device.}
A second shared key generation procedure for generating the shared key using the short-term public keys X _{A, 1} and the user private keys DB _{, 2 of the second communication device, and}
A key exchange method characterized by having. A program for causing a computer to function as each means in the device according to claim 5 or as each means in the information processing device according to claim 6.

Images