JP2023087337A - Authentication key exchange system, device, method, and program - Google Patents

Abstract

To provide an authentication key exchange system which executes efficient authentication key exchange between a device to be authenticated based on ID-based encryption and a device to be authenticated based on an electronic certificate, a device, a method, and a program.SOLUTION: A system for authentication key exchange between communication devices includes a server that functions as a KGC for ID-based encryption, a first communication device that executes authentication based on the ID-based encryption, and a second communication device that executes authentication based on an electronic signature. The server includes: a setup unit which generates a bilinear group to be used in the ID-based encryption, a master private key and a master public key corresponding to the private key; and a first long-term private key generation unit of the first communication device. The first communication device includes a first temporary private key and temporary key generation unit, a first temporary key transmission unit, and a first session key generation unit. The second communication device includes a second long-term private key and long-term key generation unit, a second temporary public key and temporary key generation unit, a second temporary key transmission unit, and a second session key generation unit.SELECTED DRAWING: Figure 1

Description

The present invention relates to an authentication key exchange system, equipment, method, and program.

In recent years, with the widespread use of IoT (Internet of Things) devices, communication of high importance has come to be performed even in IoT devices. For this reason, IoT devices also require an authentication technique for mutually confirming whether the devices and servers are correct when communicating.

Passwords, electronic certificates, and the like have been conventionally known as authentication techniques for IoT devices, but in recent years, there has been a demand for the introduction of a more secure authentication key exchange protocol. The authentication key exchange protocol is a protocol that generates a mutually common key (this key is also called a shared key) when authentication is successful, and enables encrypted communication using the shared key. As one of such authentication key exchange protocols, an authentication key exchange protocol using ID-based encryption is known.

Authenticated key exchange protocols using identity-based cryptography are generally implemented using bilinear groups on elliptic curves over finite fields. Such bilinear groups are also called pairing groups, and can be classified into symmetric pairing groups and asymmetric pairing groups. Currently, when pairing groups are used in cryptography, asymmetric pairing groups are often used from the viewpoint of efficiency and security.

On the other hand, in ID-based cryptography, a server called KGC (Key Generation Center) generates the private key of the terminal, so there is a possibility that the administrator of the IoT device will operate the KGC on its own rather than using an external KGC service. expensive. Therefore, when an IoT device communicates with an external edge server as in the edge computing service use case, the IoT device side performs authentication based on ID-based encryption, and the edge server side performs authentication based on an electronic certificate. Sometimes. In Non-Patent Document 1, one device is under an ID-based KGC domain, and the other device (server) is a PKI (Public Key Infrastructure) CA (Certificate Authority) domain. A cross-domain authenticated key exchange protocol is described as below.

Ustaoglu, B.: Integrating identity-based and certificate-based authenticated key exchange protocols. Int. J. Inf. Security 10(4), 201-212 (2011)

However, in Non-Patent Document 1, it is necessary to perform a group operation called a pairing operation twice. Since the pairing calculation generally has a high computational cost, when a device with limited computational resources such as an IoT device performs key exchange using the protocol described in Non-Patent Document 1, key exchange may take time. For example, when a processor with an operating clock rate of about several hundred MHz performs a pairing calculation on a 462-bit BN (Barret-Naehrig) curve, it takes about 600 msec for each calculation.

An embodiment of the present invention has been made in view of the above points, and is intended to enable efficient authentication key exchange between a device that performs authentication based on ID-based encryption and a device that performs authentication based on an electronic certificate. intended to do

In order to achieve the above object, an authentication key exchange system according to one embodiment includes a server functioning as a KGC for ID-based encryption, a first device performing authentication based on the ID-based encryption, and authentication based on an electronic signature. an authenticated key exchange system for exchanging authentication keys between the first device and the second device, wherein the server comprises a pair of keys used in the ID-based encryption; a setup unit configured to generate a linear group, a master private key for said identity-based encryption, and a master public key corresponding to said master private key; a long-term secret key generator configured to generate a first long-term secret key for an identifier, wherein the first device generates a first temporary secret key and the first a first temporary key generator configured to generate a first temporary public key from a temporary private key and said first long-term private key; said first temporary public key and said first identifier; to the second device; and at least a second temporary public key, a long-term public key of the second device and an identifier of the second device. the first temporary public key, the second temporary public key, the long-term public key of the second device, and the first temporary private key upon receiving from the second device a second identifier indicating a first session key generator configured to generate a session key from the first long-term secret key, the first identifier, and the second identifier, the second device comprising: a long-term key generator configured to generate a second long-term private key and the long-term public key corresponding to the second long-term private key; and generating a second temporary private key; a second temporary key generator configured to generate the second temporary public key from the second temporary private key and the second long-term private key; and at least the second temporary public key. a second temporary key transmitter configured to transmit the long-term public key and the second identifier to the first device; the first temporary public key and the second temporary public key; and a second session key generator configured to generate the session key from the second temporary private key, the master public key, the first identifier, and the second identifier.

Efficient authentication key exchange can be performed between a device that performs authentication based on ID-based encryption and a device that performs authentication based on an electronic certificate.

It is a figure which shows the whole structural example of the authentication key exchange system which concerns on this embodiment. It is a figure which shows the hardware structural example of the key generation apparatus which concerns on this embodiment. It is a figure which shows the hardware structural example of the 1st communication apparatus which concerns on this embodiment. It is a figure which shows the hardware structural example of the 2nd communication apparatus which concerns on this embodiment. It is a figure which shows the functional structural example of the key generation apparatus which concerns on this embodiment. 3 is a diagram illustrating an example of functional configuration of a first communication device according to the embodiment; FIG. It is a figure which shows the functional structural example of the 2nd communication apparatus which concerns on this embodiment. FIG. 5 is a diagram for explaining setup processing in the first embodiment; FIG. FIG. 10 is a diagram for explaining long-term secret key generation processing of the first communication device according to the first embodiment; FIG. 10 is a diagram for explaining long-term key generation processing of the second communication device according to the first embodiment; FIG. 10 is a diagram for explaining authentication key exchange processing according to the first embodiment; FIG. 12 is a diagram for explaining long-term key generation processing of the second communication device in the second embodiment; FIG. 10 is a diagram for explaining authentication key exchange processing in the second embodiment;

An embodiment of the present invention will be described below. In this embodiment, an authentication key exchange system 1 capable of efficiently exchanging authentication keys between a device that performs authentication based on ID-based encryption and a device that performs authentication based on an electronic certificate will be described.

<Preparation>
Symbols, concepts, algorithms, etc. used in this embodiment will be described.

Let p be a prime number, and let Z _p be the additive group formed by the remainder class modulo p in the additive group of integers.

Also, let κ be a security parameter. The security parameter κ represents the security strength (in units of bits) of the authenticated key exchange system 1, and can take, for example, κ=128, κ=256, and the like.

・Bilinear group A bilinear group G = (p, G ₁ , G ₂ , G _T , g ₁ , g ₂ , e) consists of a prime number p and cyclic groups G ₁ , G ₂ , G _T of order p. , _{G 1} , a generator g ₂ of G ₂ , and a bilinear map e: G ₁ ×G ₂ →G _T that satisfies the following bilinearity and non-degenerateness.

Bilinearity: For any h ₁ εG ₁ , h ₂ εG ₂ , a,bεZ _p , we have e(h ₁ ^a ,h ₂ ^b )=e(h ₁ ,h ₂ ) ^ab .

Non-degenerate: e(g ₁ ,g ₂ ) is the generator of G _T .

Examples of such bilinear groups include Optimal-ate paring described in Reference 1 and the like.

- Digital signature A digital signature consists of the following three algorithms {KeyGen, Sign, Ver}.

(pk, sk)←KeyGen(1 ^κ ): Take 1 ^κ as an input and generate a public/private key pair (pk, sk). Note that 1 ^κ is a κ bit string of 1s.

σ←Sign(sk, m): Generates a signature σ with a private key sk and a message m as inputs.

1/0←Ver(pk, m, σ): Outputs 1 or 0 with public key pk, message m, and signature σ as input.

Furthermore, 1=Ver(pk, m, Sign(sk, m)) shall be satisfied for any (pk, sk)←KeyGen(1 ^κ ). Examples of digital signatures include ECDSA and RSA-PSS.

<Overall composition>
FIG. 1 shows an example of the overall configuration of an authentication key exchange system 1 according to this embodiment. As shown in FIG. 1, an authentication key exchange system 1 according to this embodiment includes a key generation device 10, a first communication device 20, and a second communication device 30. FIG. Also, the key generation device 10, the first communication device 20, and the second communication device 30 are communicably connected via a communication network 40 including, for example, the Internet. Note that each of the key generation device 10, the first communication device 20, and the second communication device 30 is also called an "entity" or the like.

The key generation device 10 is a server that functions as a KGC for ID-based encryption, and executes setup processing for generating public parameters and the like, and performs the first communication in response to a request from the first communication device 20. For example, a long-term secret key for the device 20 is generated. Note that the key generation device 10 may be called, for example, a “key issuing server” or a “key generation server”.

The first communication device 20 is a device that performs authentication using ID-based encryption (for example, an IoT device or the like), and performs authentication key exchange for encrypted communication with the second communication device 30 . An identifier that uniquely identifies the first communication device 20 is hereinafter referred to as ID _C. As shown in FIG. As the identifier ID _C , for example, a manufacturing unique number, a user ID, a mail address, a telephone number, an IP address, a MAC address, etc. can be used.

The second communication device 30 is a device (for example, a server, etc.) that performs authentication using an electronic certificate (hereinafter also simply referred to as a “certificate”). perform authenticated key exchange for encrypted communication. That is, the second communication device 30 is a device that performs PKI-based authentication. Hereinafter, an identifier that uniquely identifies the second communication device 30 will be referred to as _IDS . As the identifier ID _S , for example, a manufacturing unique number, a user ID, a mail address, a telephone number, an IP address, a MAC address, etc. can be used.

Here, the second communication device 30 generates its own long-term public key and long-term private key, and externally issues a certificate for the long-term public key (more precisely, a certificate for the identifier _IDS and the long-term public key). However, in this embodiment, it is assumed that the first communication device 20, which is the communication partner of the second communication device 30, trusts the certificate authority. That is, the first communication device 20 receives the public key of the certificate authority and the certificate for the public key (the root certificate if the certificate authority is the root certificate authority, otherwise the certificate).

Note that the configuration of the authentication key exchange system 1 shown in FIG. 1 is an example, and is not limited to this. For example, although only one first communication device 20 and one second communication device 30 are illustrated in the example shown in FIG. A plurality of second communication devices 30 may exist. Moreover, although it is assumed below that the first communication device 20 is an IoT device and the second communication device 30 is a server, the present invention is not limited to this.

<Hardware configuration>
A hardware configuration example of the key generation device 10, the first communication device 20, and the second communication device 30 included in the authentication key exchange system 1 according to this embodiment will be described.

<<Key generation device 10>>
FIG. 2 shows a hardware configuration example of the key generation device 10 according to this embodiment. As shown in FIG. 2, the key generation device 10 according to this embodiment includes an input device 11, a display device 12, an external I/F 13, a communication I/F 14, a RAM (random access memory) 15, a ROM (Read Only Memory) 16 , an auxiliary storage device 17 and a processor 18 . Each of these pieces of hardware is communicably connected via a bus 19 .

The input device 11 is, for example, a keyboard, mouse, touch panel, various physical buttons, and the like. The display device 12 is, for example, a display, a display panel, or the like. Note that the key generation device 10 may not have at least one of the input device 11 and the display device 12, for example.

The external I/F 13 is an interface with an external device such as the recording medium 13a. Examples of the recording medium 13a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), a USB (Universal Serial Bus) memory card, and the like.

Communication I/F 14 is an interface for connecting key generation device 10 to communication network 40 . The RAM 15 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 16 is a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 17 is, for example, a non-volatile storage device such as a HDD (Hard Disk Drive) or SSD (Solid State Drive), and stores programs and data. The processor 18 is, for example, various arithmetic devices such as a CPU (Central Processing Unit).

Note that the hardware configuration shown in FIG. 2 is an example, and the key generation device 10 may have other hardware configurations. For example, the key generation device 10 may have multiple auxiliary storage devices 17 and multiple processors 18, and may have various hardware other than the illustrated hardware.

<<First communication device 20>>
FIG. 3 shows a hardware configuration example of the first communication device 20 according to this embodiment. As shown in FIG. 3 , the first communication device 20 according to this embodiment has an external I/F 21 , a communication I/F 22 , a memory device 23 and a processor 24 . Each of these pieces of hardware is communicably connected via a bus 25 .

The external I/F 21 is an interface with an external device such as the recording medium 21a. Examples of the recording medium 21a include an SD memory card, a USB memory card, and the like.

Communication I/F 22 is an interface for connecting first communication device 20 to communication network 40 . The memory device 23 is, for example, various storage devices such as flash memory. The processor 24 is, for example, various arithmetic devices such as a CPU and an MPU (Micro-Processing Unit).

Note that the hardware configuration shown in FIG. 3 is an example, and the first communication device 20 may have other hardware configurations. For example, the first communication device 20 may have multiple memory devices 23 and multiple processors 24, and may have various hardware other than those shown.

<<Second communication device 30>>
FIG. 4 shows a hardware configuration example of the second communication device 30 according to this embodiment. As shown in FIG. 4, the second communication device 30 according to the present embodiment includes an input device 31, a display device 32, an external I/F 33, a communication I/F 34, a RAM 35, a ROM 36, an auxiliary storage It has a device 37 and a processor 38 . Each of these pieces of hardware is communicably connected via a bus 39 .

The input device 31 is, for example, a keyboard, mouse, touch panel, various physical buttons, and the like. The display device 32 is, for example, a display, a display panel, or the like. Note that the second communication device 30 may not have at least one of the input device 31 and the display device 32, for example.

The external I/F 33 is an interface with an external device such as a recording medium 33a. Examples of the recording medium 33a include CDs, DVDs, SD memory cards, USB memory cards, and the like.

Communication I/F 34 is an interface for connecting second communication device 30 to communication network 40 . The RAM 35 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 36 is a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 37 is, for example, a non-volatile storage device such as an HDD or SSD, and stores programs and data. The processor 38 is, for example, various arithmetic devices such as a CPU.

Note that the hardware configuration shown in FIG. 4 is an example, and the second communication device 30 may have another hardware configuration. For example, the second communication device 30 may have multiple auxiliary storage devices 37 and multiple processors 38, and may have various hardware other than the illustrated hardware.

<Functional configuration>
A functional configuration example of the key generation device 10, the first communication device 20, and the second communication device 30 included in the authentication key exchange system 1 according to this embodiment will be described.

<<Key generation device 10>>
FIG. 5 shows an example of the functional configuration of the key generation device 10 according to this embodiment. As shown in FIG. 5, the key generation device 10 according to this embodiment has a setup processing unit 101 and a long-term secret key generation unit 102 . These units are implemented by, for example, processing that one or more programs installed in the key generation device 10 cause the processor 18 to execute. Further, the key generation device 10 according to this embodiment has a storage unit 103 . The storage unit 103 is realized by the auxiliary storage device 17, for example.

The setup processing unit 101 executes setup processing for generating a master secret key, public parameters, and the like.

The long-term secret key generation unit 102 generates a long-term secret key for the identifier of the first communication device 20 in response to a request from the first communication device 20 .

The storage unit 103 stores various information (for example, a master secret key, public parameters, etc.).

<<First communication device 20>>
FIG. 6 shows a functional configuration example of the first communication device 20 according to this embodiment. As shown in FIG. 6, the first communication device 20 according to the present embodiment includes a long-term secret key requesting unit 201, a long-term secret key receiving unit 202, a temporary key generating unit 203, a temporary key transmitting unit 204, It has a temporary key reception unit 205 and a session key generation unit 206 . These units are implemented by, for example, processing that one or more programs installed in the first communication device 20 cause the processor 24 to execute. Also, the first communication device 20 according to this embodiment has a storage unit 207 . The storage unit 207 is realized by the memory device 23, for example.

The long-term secret key requesting unit 201 requests the key generation device 10 to generate a long-term secret key for its own identifier ID _C. FIG. Let ssk _C be the long-term secret key for identifier ID _C hereinafter.

The long-term secret key receiving unit 202 receives the long-term secret key ssk _C from the key generation device 10 .

The temporary key generator 203 uses its own long-term secret key ssk _C to generate a temporary secret key esk _C and a temporary public key X _C .

The temporary key transmission unit 204 transmits the temporary public key X _C and its own identifier ID _C to the second communication device 30 .

The temporary key receiving unit 205 receives the temporary public key _XS and the like of the second communication device 30 from the second communication device 30 .

The session key generation unit 206 generates key elements using its own long-term secret key ssk _C and the temporary public key _XS received from the second communication device 30, and then generates a session key from these key elements. do. Note that this session key is a shared key shared with the second communication device 30 .

The storage unit 207 stores various information (for example, public parameters, own long-term secret key ssk _C , etc.).

<<Second communication device 30>>
FIG. 7 shows a functional configuration example of the second communication device 30 according to this embodiment. As shown in FIG. 7, the second communication device 30 according to the present embodiment includes a long-term key generation unit 301, a certificate issuance request unit 302, a temporary key reception unit 303, a temporary key generation unit 304, and a temporary key generation unit 304. It has a key transmission unit 305 and a session key generation unit 306 . These units are implemented by, for example, processing that one or more programs installed in the second communication device 30 cause the processor 38 to execute. Also, the second communication device 30 according to this embodiment has a storage unit 307 . The storage unit 307 is realized by the auxiliary storage device 37, for example.

A long-term key generation unit 301 generates a long-term private key and a long-term public key. Hereinafter, the long-term secret key of the second communication device 30 is ssk _S and the long-term public key is spk _S .

The certificate issuance requesting unit 302 requests an external certificate authority to issue a certificate cert _S for its own identifier ID _S and long-term public key spk _S.

The temporary key receiving unit 303 receives the temporary public key X _C and the identifier ID _C from the first communication device 20 .

The temporary key generation unit 304 uses its own long-term secret key ssk _S to generate a temporary secret key esk _S and a temporary public key _XS .

Temporary key transmission unit 305 transmits temporary public key X _S , its own long-term public key spk _S , its own identifier ID _S , certificate cert _S, and the like to first communication device 20 .

The session key generation unit 306 generates key elements using the master public key, the temporary public key _XC received from the first communication device 20, and the like, and then generates a session key from these key elements.

The storage unit 307 stores various information (for example, public parameters, own long-term secret key ssk _S , etc.).

[Example 1]
Example 1 of the present embodiment will be described below. In this embodiment, each entity holds the following hash functions H ₁ , H ₂ , H as parameters common to the system.

H ₁ : A hash function that takes an identifier as an input and outputs an element of G ₂ H ₂ : A hash function that takes a bit string of κ bits and an element of G ₂ as an input and outputs an element of Z _p H: of variable length A hash function that takes a character string as input and outputs a κ-bit bit string <Setup processing>
A setup process in the first embodiment will be described with reference to FIG.

The setup processing unit 101 of the key generation device 10 generates a bilinear group G=(p, G ₁ , G ₂ , _GT , g ₁ , g ₂ , e) (step S101).

Next, the setup processing unit 101 of the key generation device 10 uniformly and randomly generates a master secret key _wεZp (step S102).

Next, the setup processing unit 101 of the key generation device 10 generates a master public key W=g ₁ ^w (step S103).

Then, the setup processing unit 101 of the key generation device 10 stores the bilinear group G, the master secret key w, and the master public key W in the storage unit 103 (step S104). Here, the public parameter is (G, W), and this public parameter (G, W) is made public to the first communication device 20 and the second communication device 30 . In the following, it is assumed that the first communication device 20 and the second communication device 30 hold public parameters (G, W).

<Long-Term Private Key Generation Processing of First Communication Device 20>
A long-term secret key generation process of the first communication device 20 according to the first embodiment will be described with reference to FIG.

The long-term secret key requesting unit 201 of the first communication device 20 requests the key generation device 10 to generate a long-term secret key for its own identifier ID _C (step S201). Note that at least the identifier ID _C is specified in this request.

Upon receiving the long-term secret key generation request, the long-term secret key generation unit 102 of the key generation device 10 generates a long-term secret key ssk _C =H ₁ (ID _C ) ^w εG ₂ (step S202).

Next, the long-term secret key generation unit 102 of the key generation device 10 transmits the long-term secret key ssk _C to the first communication device 20 (step S203).

Then, the long-term secret key receiving unit 202 of the first communication device 20 receives the long-term secret key ssk _C and stores the long-term secret key ssk _C in the storage unit 207 (step S204). It is assumed that the long-term secret key ssk _C is transmitted from the key generation device 10 to the first communication device 20 via a secure communication path.

<Long-Term Key Generation Processing of Second Communication Device 30>
A long-term key generation process of the second communication device 30 according to the first embodiment will be described with reference to FIG.

The long-term key generator 301 of the second communication device 30 uniformly and randomly generates a long-term secret key ssk _S ∈Z _p (step S301).

Next, the long-term key generator 301 of the second communication device 30 generates a long-term public key spk _S =g ₁ ^ssk_S (step S302). Note that "ssk_S" represents ssk _S.

Next, the certificate issuance requesting unit 302 of the second communication device 30 requests an external certificate authority to issue a certificate cert _S for its own identifier ID _S and long-term public key spk _S (step S303). As a result, the certificate cert _S is returned from the certificate authority.

Then, the long-term key generation unit 301 of the second communication device 30 stores the long-term secret key ssk _S , the long-term public key spk _S , and the certificate cert _S in the storage unit 307 (step S304).

<Authentication key exchange processing>
Authentication key exchange processing in the first embodiment will be described with reference to FIG. In the following, it is assumed that the first communication device 20 issues a start request to the second communication device 30 . That is, it is assumed that the first communication device 20 is the initiator and the second communication device 30 is the responder. Also, it is assumed that the first communication device 20 has already obtained the communication destination information (for example, IP address, MAC address, etc.) of the second communication device 30 .

The temporary key generation unit 203 of the first communication device 20 uniformly randomly generates a temporary secret key esk _C ε{0, 1} ^κ , and then calculates x _C =H ₂ (esk _C , ssk _C ). to generate a temporary public key X _C =g ₁ ^x_C (step S401). Temporary secret key esk _C is stored in storage unit 207 . Note that "x_C" represents _xC .

Next, the temporary key transmission unit 204 of the first communication device 20 transmits the temporary public key X _C and its own identifier ID _C to the second communication device 30 (step S402).

When the temporary key receiving unit 303 receives the temporary public key X _C and the identifier ID _C , the temporary key generating unit 304 of the second communication device 30 uniformly randomly generates the temporary secret key esk _S ∈{0,1} ^κ . After generating, x _S =H ₂ (esk _S , ssk _S ) is calculated to generate a temporary public key X _S =g ₁ ^x_S (step S403). The temporary secret key esk _S is stored in the storage unit 307 . Note that "x_S" represents _xS .

Next, the temporary key transmission unit 305 of the second communication device 30 _transmits the temporary public key XS, its own long-term public key spk _S , its certificate cert _S , and its own identifier ID _S to the first communication device 20. Send (step S404).

When the temporary key reception unit 205 receives the temporary public key _XS , the long-term public key spk _S , the certificate cert _S , and the identifier ID _S , the session key generation unit 206 of the first communication device 20 generates the long-term public key spk _S. and verify that the identifier ID _S is as described in the certificate cert _S , and verify that the certificate cert _S is correct by a predetermined certificate authority using the public key of the certificate authority (step S405). ). Note that if any verification fails, the first communication device 20 terminates the authentication key exchange process. On the other hand, if both verifications are successful, the first communication device 20 executes the next step S406.

The session key generation unit 206 of the first communication device 20 generates the key elements σ ₁ =e(X _S , ssk _C ), σ ₂ =spk _S ^x_C and σ ₃ =X _S ^x_C , and then session key SK =H(σ ₁ , σ ₂ , σ ₃ , ID _C , ID _S , X _C , _XS , spk _S , cert _S ) is generated (step S406). Note that x _C is calculated from the long-term secret key ssk _C and the temporary secret key esk _C stored in the storage unit 207 by x _C =H ₂ (esk _C , ssk _C ).

The session key generation unit 306 of the second communication device 30 generates key elements σ ₁ =e(W ^x_S , H ₁ (ID _C )), σ ₂ =X _C ^{ssk — S} , σ ₃ =X _C ^x_S , and , session key SK=H (σ ₁ , σ ₂ , σ ₃ , ID _C , ID _S , X _C , XS , spk _S , cert _{S )} (step S407). Note that x _S is calculated from the long-term secret key ssk _S and the temporary secret key esk _S stored in the storage unit 307 by x _S =H ₂ (esk _S , ssk _S ). Also, this step may be executed immediately after the end of step S404.

<Summary>
As described above, in this embodiment, the first communication device 20 and the second communication device 30 can share the session key SK. As a result, the first communication device 20 and the second communication device 30 can thereafter perform encrypted communication using the session key SK.

At this time, in this embodiment, each of the first communication device 20 and the second communication device 30 needs to calculate the pairing calculation only once. Therefore, since the number of pairing operations is reduced compared to the protocol described in Non-Patent Document 1, for example, efficient authentication key exchange can be realized.

Also, in this embodiment, each of the first communication device 20 and the second communication device 30 needs to calculate scalar multiplication on _G1 only three times. In contrast, for example, the protocol described in Non-Patent Document 1 requires four (or five) scalar multiplications on _G1 and two scalar multiplications on _G2 . . Therefore, since the number of scalar multiplications is reduced compared to the protocol described in Non-Patent Document 1, for example, efficient authentication key exchange can be realized.

In this embodiment, the first communication device 20 is authenticated with the key factor _σ1 , and the second communication device ₃₀ is authenticated with the key factor σ2. In addition, the key element _σ3 guarantees essential security (forward secrecy) in authenticated key exchange.

[Example 2]
Example 2 of the present embodiment will be described below. In this embodiment, each entity holds a hash function _H3 below in addition to the above hash functions _H1 , _H2 , and H as parameters common to the system.

H ₃ : A hash function that takes as input a bit string of κ bits and a private key of a digital signature and outputs an element of Z _p . The description of the constituent elements is omitted.

<Setup processing>
Since it is the same as the first embodiment, its explanation is omitted.

<Long-Term Private Key Generation Processing of First Communication Device 20>
Since it is the same as the first embodiment, its explanation is omitted.

<Long-Term Key Generation Processing of Second Communication Device 30>
A long-term key generation process of the second communication device 30 according to the second embodiment will be described with reference to FIG.

The long-term key generation unit 301 of the second communication device 30 generates a key pair (spk _S , ssk _S )←KeyGen(1 ^κ ) of a long-term public key spk _S and a long-term secret key ssk _S (step S501). The long-term public key spk _S is a public key for digital signatures, and the long-term private key ssk _S is a private key for digital signatures.

Next, the certificate issuance requesting unit 302 of the second communication device 30 requests an external certificate authority to issue a certificate cert _S for its own identifier ID _S and long-term public key spk _S (step S502). As a result, the certificate cert _S is returned from the certificate authority.

Then, the long-term key generation unit 301 of the second communication device 30 stores the long-term secret key ssk _S , the long-term public key spk _S , and the certificate cert _S in the storage unit 307 (step S503).

<Authentication key exchange processing>
Authentication key exchange processing in the second embodiment will be described with reference to FIG. In the following, it is assumed that the first communication device 20 issues a start request to the second communication device 30 . That is, it is assumed that the first communication device 20 is the initiator and the second communication device 30 is the responder. Also, it is assumed that the first communication device 20 has already obtained the communication destination information (for example, IP address, MAC address, etc.) of the second communication device 30 .

The temporary key generation unit 203 of the first communication device 20 uniformly randomly generates a temporary secret key esk _C ε{0, 1} ^κ , and then calculates x _C =H ₂ (esk _C , ssk _C ). to generate a temporary public key X _C =g ₁ ^x_C (step S601). Temporary secret key esk _C is stored in storage unit 207 .

Next, the temporary key transmission unit 204 of the first communication device 20 transmits the temporary public key X _C and its own identifier ID _C to the second communication device 30 (step S602).

When the temporary key receiving unit 303 receives the temporary public key X _C and the identifier ID _C , the temporary key generating unit 304 of the second communication device 30 uniformly randomly generates the temporary secret key esk _S ∈{0,1} ^κ . After generating, x _S =H ₃ (esk _S , ssk _S ) is calculated to generate a temporary public key X _S =g ₁ ^x_S (step S603). The temporary secret key esk _S is stored in the storage unit 307 .

Next, the temporary key generation unit 304 of the second communication device 30 generates a signature sign _S ←Sign(ssk _S , m) for the message m including the temporary public key _XS , the identifier ID _C , and the identifier ID _S. (step S604).

Next, temporary key transmission section 305 of second communication device 30 transmits temporary public key _XS , signature sign _S , own long-term public key spk _S , certificate cert _S , and own identifier ID _S to the first It is transmitted to the communication device 20 (step S605).

The session key generating unit 206 of the first communication device 20 receives the temporary public key XS, the signature sign _S , its own long-term public key spk _S , the certificate cert _S , and its own identifier _{ID S from} the temporary key receiving unit 205. Upon receipt, verifying that the long-term public key spk _S and the identifier ID _S are as described in the certificate cert _S , and verifying that the certificate cert _S has been validated by a given certificate authority's public key and further verifies whether 1=Ver(spk _S , m, sign _S ) holds (step S606). Note that if any verification fails, the first communication device 20 terminates the authentication key exchange process. On the other hand, if both verifications are successful, the first communication device 20 executes the next step S607.

The session key generation unit 206 of the first communication device 20 generates key elements σ ₁ =e(X _S , ssk _C ) and σ ₂ =X _S ^x_C , and session key SK=H(σ ₁ , σ ₂ , ID _C , ID _S , X _{C ,} XS , sign _S , spk _S , cert _S ) are generated (step S607). Note that x _C is calculated from the long-term secret key ssk _C and the temporary secret key esk _C stored in the storage unit 207 by x _C =H ₂ (esk _C , ssk _C ).

The session key generation unit 306 of the second communication device 30 generates key elements σ ₁ =e(W ^x_S , H ₁ (ID _C )) and σ ₂ =X _C ^x_S , and session key SK=H( σ ₁ , σ ₂ , ID _C , ID _S , X _C , X _S , sign _S , spk _S , cert _S ) are generated (step S608). Note that x _S is calculated from the long-term secret key ssk _S and the temporary secret key esk _S stored in the storage unit 307 by x _S =H ₃ (esk _S , ssk _S ). Also, this step may be executed immediately after the end of step S605.

<Summary>
As described above, in this embodiment, the first communication device 20 and the second communication device 30 can share the session key SK. As a result, the first communication device 20 and the second communication device 30 can thereafter perform encrypted communication using the session key SK.

At this time, in this embodiment, as in the first embodiment, each of the first communication device 20 and the second communication device 30 needs to calculate the pairing calculation only once. Therefore, since the number of pairing operations is reduced compared to the protocol described in Non-Patent Document 1, for example, efficient authentication key exchange can be realized.

Further, in this embodiment, by authenticating the second communication device 30 with a digital signature, a key element for authenticating the second communication device 30 becomes unnecessary, and the first communication device 20 and the second communication Only two scalar multiplications on G ₁ need to be computed in each of the devices 30 . Therefore, as compared with the first embodiment, more efficient authentication key exchange can be realized.

In this embodiment, the first communication device 20 is authenticated by the key element _σ1 , and the second communication device 30 is authenticated by the digital signature. In addition, the key element _σ2 guarantees essential security (forward secrecy) in authenticated key exchange.

The present invention is not limited to the specifically disclosed embodiments described above, and various variations, modifications, combinations with known techniques, etc. are possible without departing from the scope of the claims. be.

[References]
Reference 1: Vercauteren, F.: Optimal pairings. IEEE Trans. Inf. Theory 56, 455-461 (2010)

1 Authentication Key Exchange System 10 Key Generation Device 11 Input Device 12 Display Device 13 External I/F
13a recording medium 14 communication I/F
15 RAM
16 ROMs
17 auxiliary storage device 18 processor 19 bus 20 first communication device 21 external I/F
21a recording medium 22 communication I/F
23 memory device 24 processor 25 bus 30 second communication device 31 input device 32 display device 33 external I/F
33a recording medium 34 communication I/F
35 RAMs
36 ROMs
37 Auxiliary storage device 38 Processor 39 Bus 101 Setup processing unit 102 Long-term secret key generation unit 103 Storage unit 201 Long-term secret key request unit 202 Long-term secret key reception unit 203 Temporary key generation unit 204 Temporary key transmission unit 205 Temporary key reception unit 206 Session Key generation unit 207 Storage unit 301 Long-term key generation unit 302 Certificate issuance request unit 303 Temporary key reception unit 304 Temporary key generation unit 305 Temporary key transmission unit 306 Session key generation unit 307 Storage unit

Claims (7)

A server that functions as a KGC for ID-based encryption, a first device that performs authentication based on the ID-based encryption, and a second device that performs authentication based on an electronic signature, wherein the first device and the second device are included. An authentication key exchange system for exchanging authentication keys with the device of 2,
The server is
a setup unit configured to generate a bilinear group used in the identity-based cipher, a master private key for the identity-based cipher, and a master public key corresponding to the master private key;
a long-term private key generator configured to generate a first long-term private key for a first identifier indicative of the identifier of the first device;
The first device is
a first temporary key generator configured to generate a first temporary private key and to generate a first temporary public key from said first temporary private key and said first long-term private key; ,
a first temporary key transmitter configured to transmit the first temporary public key and the first identifier to the second device;
receiving from the second device at least a second temporary public key, a long-term public key of the second device, and a second identifier indicative of an identifier of the second device, the first temporary public key and A session key is generated from the second temporary public key, the long-term public key of the second device, the first temporary secret key, the first long-term secret key, the first identifier, and the second identifier. a first session key generator configured to
The second device is
a long-term key generator configured to generate a second long-term private key and the long-term public key corresponding to the second long-term private key;
A second temporary key generator configured to generate a second temporary private key and to generate the second temporary public key from the second temporary private key and the second long-term private key. and,
a second temporary key transmitter configured to transmit at least the second temporary public key, the long-term public key and the second identifier to the first device;
configured to generate the session key from the first temporary public key, the second temporary public key, the second temporary secret key, the master public key, the first identifier, and the second identifier a second session key generator, comprising:
An authenticated key exchange system. The first temporary key generation unit
A hash function H ₂ whose base is the generator of the cyclic group, which is the domain of the first argument side of the pairing operation in the bilinear group, and whose input is the first temporary secret key and the first long-term secret key. is configured to generate, as the first temporary public key, a power exponent that is a first value that is the output value of
The first session key generation unit
further receiving a certificate for the long-term public key and verifying whether the certificate was issued by a predetermined certificate authority;
if the verification is successful, calculating as a first key element the result of a pairing operation in which the second temporary public key is the first argument and the first long-term secret key is the second argument;
calculating a power of the long-term public key as a base and the first value as a power exponent as a second key element;
calculating a power of the second temporary public key as a base and the first value as a power exponent as a third key element;
said first key element, said second key element, said third key element, said first temporary public key, said second temporary public key, said first identifier, said second identifier, and said configured to generate as the session key an output value of a hash function H with the long-term public key and the certificate as inputs;
The second temporary key transmission unit
configured to further transmit the certificate to the first device;
The second temporary key generation unit
The hash function H having the base as the generator of the cyclic group, which is the domain of the first argument side of the pairing operation in the bilinear group, and the input of the second temporary secret key and the second long-term secret key. The second temporary public key is configured to generate a power with a _second value, which is an output value of 2, as the power exponent,
The second session key generation unit
A pairing operation with the base being the master public key and the exponent being the second value as the first argument and the output value of the hash function _H1 having the first identifier as the input as the second argument calculating the result as the first key element;
calculating a power of the first temporary public key as the base and the second long-term secret key as the exponent as the second key element;
calculating a power with the first temporary public key as the base and the second value as the power exponent as the third key element;
said first key element, said second key element, said third key element, said first temporary public key, said second temporary public key, said first identifier, said second identifier, and said configured to generate as the session key an output value of the hash function H with the long-term public key and the certificate as inputs;
The authentication key exchange system according to claim 1. The first temporary key generation unit
A hash function H ₂ whose base is the generator of the cyclic group, which is the domain of the first argument side of the pairing operation in the bilinear group, and whose input is the first temporary secret key and the first long-term secret key. is configured to generate, as the first temporary public key, a power exponent that is a first value that is the output value of
The first session key generation unit
further receiving a certificate for the long-term public key and the signature of the second device, and performing a first verification indicating whether or not the certificate is issued by a predetermined certificate authority; perform a second verification indicating verification of the signature;
If the first verification and the second verification are successful, the calculation result of the pairing calculation with the second temporary public key as the first argument and the first long-term secret key as the second argument is the first calculated as the key elements of
calculating a power of the second temporary public key as a base and the first value as a power exponent as a second key element;
said first key element, said second key element, said first temporary public key, said second temporary public key, said first identifier, said second identifier, said long-term public key, and said certificate and the signature are configured to generate an output value of a hash function H as the session key,
The second temporary key transmission unit
configured to further transmit the certificate and the signature to the first device;
The second temporary key generation unit
Hash function H ₃ whose base is the generator of the cyclic group, which is the domain of the first argument side of the pairing operation in the bilinear group, and whose input is the second temporary secret key and the second long-term secret key is configured to generate, as the second temporary public key, a power exponent that is a second value that is the output value of
The second session key generation unit
A pairing operation with the base being the master public key and the exponent being the second value as the first argument, and the output value of the hash function _H1 having the first identifier as the input as the second argument. calculating the result as the first key element;
calculating a power with the first temporary public key as the base and the second value as the power exponent as the second key element;
said first key element, said second key element, said first temporary public key, said second temporary public key, said first identifier, said second identifier, said long-term public key, and said certificate and the signature are configured to generate the output value of the hash function H as the session key,
The authentication key exchange system according to claim 1. A device that is communicatively connected to a server that functions as a KGC for ID-based encryption and another device that performs authentication based on an electronic signature, and that performs authentication based on the ID-based encryption,
A temporary key generator configured to generate a first temporary private key and to generate a first temporary public key from said first temporary private key and a first long-term private key generated at said server. Department and
a temporary key transmission unit configured to transmit the first temporary public key and a first identifier indicating an identifier of the device to the other device;
receiving from the other device at least a second temporary public key, a long-term public key of the other device, and a second identifier indicating an identifier of the other device, the first temporary public key and the second and the long-term public key of the other device, the first temporary secret key, the first long-term secret key, the first identifier, and the second identifier, from the other device a session key generator configured to generate a session key shared with
device. A device that performs authentication based on an electronic signature and is communicatively connected to a server that functions as a KGC for ID-based encryption and another device that performs authentication based on the ID-based encryption,
a long-term key generator configured to generate a long-term private key for the device and a long-term public key corresponding to the long-term private key;
a temporary key generator configured to generate a first temporary private key and to generate a first temporary public key from the first temporary private key and the long-term private key;
a temporary key transmission unit configured to transmit at least the first temporary public key, the long-term public key, and a first identifier indicating an identifier of the device to the other device;
when a second temporary public key and a second identifier indicating the identifier of the other device are received from the other device, the first temporary public key, the second temporary public key, and the first temporary A session key generator configured to generate a session key shared with the other device from a secret key, a master public key generated by the server, the first identifier, and the second identifier. part and have
device. A server that functions as a KGC for ID-based encryption, a first device that performs authentication based on the ID-based encryption, and a second device that performs authentication based on an electronic signature, wherein the first device and the second device are included. A method used in an authentication key exchange system that performs authentication key exchange with the device of 2,
the server
a setup procedure for generating a bilinear group used in the identity-based cipher, a master private key for the identity-based cipher, and a master public key corresponding to the master private key;
a long-term private key generation procedure for generating a first long-term private key for a first identifier that indicates the identifier of the first device;
The first device is
a first temporary key generation procedure for generating a first temporary private key and generating a first temporary public key from said first temporary private key and said first long-term private key;
a first temporary key transmission procedure for transmitting the first temporary public key and the first identifier to the second device;
receiving from the second device at least a second temporary public key, a long-term public key of the second device, and a second identifier indicative of an identifier of the second device, the first temporary public key and A session key is generated from the second temporary public key, the long-term public key of the second device, the first temporary secret key, the first long-term secret key, the first identifier, and the second identifier. and a first session key generation procedure to
The second device is
a long-term key generation procedure for generating a second long-term private key and the long-term public key corresponding to the second long-term private key;
a second temporary key generation procedure for generating a second temporary private key and generating the second temporary public key from the second temporary private key and the second long-term private key;
a second temporary key transmission procedure for transmitting at least the second temporary public key, the long-term public key and the second identifier to the first device;
a second temporary public key for generating the session key from the first temporary public key, the second temporary public key, the second temporary secret key, the master public key, the first identifier, and the second identifier; perform session key generation and
Method. A program that causes a computer to function as a server, first device, or second device included in the authentication key exchange system according to any one of claims 1 to 3.

Images