JP3601593B2 - Mobile communication group encryption key distribution method - Google Patents

Description

【００３４】
実端末Ｍ_ｉのグループ構成情報Ｘ_ｉを、基地局１で検証する方法を説明する。基地局１は、既に記憶してあるダミー端末のグループ構成情報Ｘｄ_ｉ，Ｘｄ_ｉ＋１を計算し直し、仮グループ構成情報Ｘｄ_ｉ’，Ｘｄ_ｉ＋１’を求める。仮グループ構成情報は、以下のようになる。
【００３５】

【００３６】
グループ構成情報Ｘ_ｉが正しい場合、仮グループ鍵はすべて等しくなる。すなわち、
Ｋｄ_ｉ’＝Ｋ_ｉ’＝Ｋｄ_ｉ＋１’
となる。グループ構成情報Ｘ_ｉが正しくないと、この関係が必ずしも成り立たない。正しくない場合は、グループ構成情報Ｘ_ｉの再送を実端末Ｍ_ｉに求める。正規の端末であれば、正しいグループ構成情報Ｘ_ｉを送って来るが、不正の端末であれば、乱数が異なるため、正しいグループ構成情報Ｘ_ｉを送ることが出来ない。
【００３７】
第４に、基地局１と各実端末における準備段階の動作を説明する。図１に示す移動通信システムにおいて、基地局１は、素数ｐと基地局公開情報（整数）α（２≦α≦ｐ−１）を発生し、図２に示す基地局１の記憶部１４に記憶するとともに、全ての端末に対し同報送信する。
【００３８】
端末では、基地局１から送られた素数ｐと基地局公開情報αを、図３に示す端末の記憶部２４に記憶する。素数ｐと基地局公開情報αを受信して格納した状態で、端末Ｔ_１〜Ｔ_Ｎのうち、グループを構成する端末Ｍ_１〜Ｍ_ｎは、それぞれ乱数を発生する。例えば、端末Ｍ_１は、乱数Ｒ_１を発生する。基地局１から送られた素数ｐと基地局公開情報αおよび発生した乱数Ｒ_１を使って、
Ｚ_１＝α＾Ｒ_１ ｍｏｄｐ
を計算して、端末情報Ｚ_１を得る。端末情報Ｚ_１を基地局１へ送る。乱数は演算部２３で発生され、端末情報Ｚ_１も演算部２３で計算される。これらの乱数の発生と計算は、制御部２２の制御により行われる。演算部２３で発生した乱数Ｒ_１と端末情報Ｚ_１は、制御部２２を介して記憶部２４に記憶される。他の端末でも同様にする。
【００３９】
基地局１に送られた、各端末の端末情報Ｚ_ｉは、基地局１の記憶部１４に記憶される。基地局記憶部１４に記録された状態を、図４に示す。各端末Ｍ_ｉに対して、各端末情報Ｚ_ｉが対として記憶されている。このような状態に準備をしておく。
【００４０】
第５に、グループ構成情報の検査を行なう動作を説明する。グループの構成の要求が発生すると、基地局１は、グループメンバーの数に応じて、ダミー端末Ｄ_ｉを設定し、ダミー端末数分の乱数Ｒｄ_ｉを発生する。Ｎ台の全端末のうち、ｎ台の端末Ｍ_１〜Ｍ_ｎ（ｎ≦Ｎ）をメンバーとしてグループを作る場合、基地局１は、ｎ個のダミー端末を設定して、ダミー端末に対応した乱数をｎ個発生し、記憶部１４に記憶する。この状態を、図５に示す。これらのダミー端末Ｄ_１〜Ｄ_ｎを、実端末Ｍ_１〜Ｍ_ｎに対応させる。記憶部１４に、図６で示す内容を記憶する。
【００４１】
基地局１は、ダミー端末情報Ｚｄ_ｉ〜Ｚｄ_ｎと、実端末とダミー端末の入る位置を指定した配列情報を、同報にて各端末に送信する。基地局１は、すでに記憶部１４に記憶している各実端末の端末情報Ｚから、ダミー端末のグループ構成情報Ｘｄを計算して記憶する。各実端末は、すでに送られてきている、自分の前後のダミー端末の端末情報Ｚｄから、グループ構成情報Ｘを計算する。実端末Ｍ_ｉは、その前後のダミー端末Ｄ_ｉ，Ｄ_ｉ＋１の端末情報Ｚｄ_ｉ及びＺｄ_ｉ＋１から、グループ構成情報
Ｘ_ｉ＝（Ｚｄ_ｉ＋１／Ｚｄ_ｉ）＾Ｒ_ｉ ｍｏｄｐ
を計算して、基地局１へ送信する。
【００４２】
基地局１は、（Ｄ_ｉ，Ｍ_ｉ，Ｄ_ｉ＋１）を仮グループとして、ダミー端末Ｄ_ｉの仮グループ構成情報Ｘｄ_ｉ’と、ダミー端末Ｄ_ｉ＋１の仮グループ構成情報Ｘｄ_ｉ＋１’を計算する。この状態を、図７のＡに示す。仮グループ構成情報Ｘｄ_ｉ’とＸｄ_ｉ＋１’は、次の通り計算される。
Ｘｄ_ｉ’＝（Ｚ_ｉ／Ｚｄ_ｉ＋１）＾Ｒｄ_ｉ ｍｏｄｐ
Ｘｄ_ｉ＋１’＝（Ｚｄ_ｉ／Ｚ_ｉ）＾Ｒｄ_ｉ＋１ ｍｏｄｐ
【００４３】
仮グループ構成情報Ｘｄ_ｉ’とＸｄ_ｉ＋１’と、送られてきた実端末Ｍ_ｉのグループ構成情報Ｘ_ｉとから、ダミー端末Ｄ_ｉとＤ_ｉ＋１の仮共通鍵Ｋ３ｄ_ｉとＫ３ｄ_ｉ＋１を、以下のように計算する。なお、３台の論理端末の共通鍵Ｋ３は、
Ｋ３＝（直前のＺ）＾（３（自己のＲ））・（自己のＸ）^２・（直後のＸ） ｍｏｄｐ
で計算する。直前、直後は、サイクリックに考える。
Ｋ３ｄ_ｉ＝Ｚｄ_ｉ＋１＾（３Ｒｄ_ｉ）・Ｘｄ_ｉ’^２・Ｘ_ｉ ｍｏｄｐ
＝Ｚｄ_ｉ＋１＾（３Ｒｄ_ｉ）・（Ｚ_ｉ／Ｚｄ_ｉ＋１）＾（２Ｒｄ_ｉ）
・（Ｚｄ_ｉ＋１／Ｚｄ_ｉ）＾Ｒ_ｉ ｍｏｄｐ
＝Ｚｄ_ｉ＋１＾（３Ｒｄ_ｉ）・Ｚ_ｉ＾（２Ｒｄ_ｉ）・Ｚｄ_ｉ＋１＾（−２Ｒｄ_ｉ）
・Ｚｄ_ｉ＋１＾Ｒ_ｉ・Ｚｄ_ｉ＾（−Ｒ_ｉ） ｍｏｄｐ
＝Ｚｄ_ｉ＋１＾Ｒｄ_ｉ・Ｚ_ｉ＾（２Ｒｄ_ｉ）・Ｚｄ_ｉ＋１＾Ｒ_ｉ・Ｚｄ_ｉ＾（−Ｒ_ｉ） ｍｏｄｐ
＝α＾（Ｒｄ_ｉ＋１・Ｒｄ_ｉ）・α＾（２Ｒ_ｉ・Ｒｄ_ｉ）
・α＾（Ｒｄ_ｉ＋１・Ｒ_ｉ）・α＾（−Ｒｄ_ｉ・Ｒ_ｉ） ｍｏｄｐ
＝α＾（Ｒｄ_ｉ＋１・Ｒｄ_ｉ＋Ｒ_ｉ・Ｒｄ_ｉ＋Ｒｄ_ｉ＋１・Ｒ_ｉ） ｍｏｄｐ
Ｋ３ｄ_ｉ＋１＝Ｚ_ｉ＾（３Ｒｄ_ｉ＋１）・Ｘｄ_ｉ＋１’^２・Ｘｄ_ｉ’ ｍｏｄｐ
＝Ｚ_ｉ＾（３Ｒｄ_ｉ＋１）・（Ｚｄ_ｉ／Ｚ_ｉ）＾（２Ｒｄ_ｉ＋１）・（Ｚ_ｉ／Ｚｄ_ｉ＋１）＾Ｒｄ_ｉ ｍｏｄｐ
＝Ｚ_ｉ＾（３Ｒｄ_ｉ＋１）・Ｚｄ_ｉ＾（２Ｒｄ_ｉ＋１）・Ｚ_ｉ＾（−２Ｒｄ_ｉ＋１）
・Ｚ_ｉ＾Ｒｄ_ｉ・Ｚｄ_ｉ＋１＾（−Ｒｄ_ｉ） ｍｏｄｐ
＝Ｚ_ｉ＾Ｒｄ_ｉ＋１・Ｚｄ_ｉ＾（２Ｒｄ_ｉ＋１）・Ｚ_ｉ＾Ｒｄ_ｉ・Ｚｄ_ｉ＋１＾（−Ｒｄ_ｉ） ｍｏｄｐ
＝α＾（Ｒ_ｄｉ・Ｒｄ_ｉ＋１）・α＾（２Ｒｄ_ｉ・Ｒｄ_ｉ＋１）
・α＾（Ｒ_ｉ・Ｒｄ_ｉ）・α＾（−Ｒｄ_ｉ・Ｒｄ_ｉ＋１） ｍｏｄｐ
＝α＾（Ｒ_ｄｉ・Ｒｄ_ｉ＋１）・α＾（Ｒ_ｉ・Ｒｄ_ｉ＋１）・α＾（Ｒ_ｉ・Ｒｄ_ｉ） ｍｏｄｐ
＝α＾（Ｒ_ｄｉ・Ｒｄ_ｉ＋１＋Ｒ_ｉ・Ｒｄ_ｉ＋１＋Ｒ_ｉ・Ｒｄ_ｉ） ｍｏｄｐ
【００４４】
このように、各情報が正しい場合は、
Ｋ３ｄ_ｉ＝Ｋ３ｄ_ｉ＋１
となるので、２つの仮共通鍵が一致すれば、グループ構成情報Ｘ_ｉが正しいと判定する。もし、乱数Ｒ_ｉがＲ_ｉ’であれば、
Ｘ_ｉ’＝（Ｚｄ_ｉ＋１／Ｚｄ_ｉ）＾Ｒ_ｉ’ ｍｏｄｐ
Ｋ３ｄ_ｉ＝Ｚｄ_ｉ＋１＾（３Ｒｄ_ｉ）・Ｘｄ_ｉ’^２・Ｘ_ｉ’ ｍｏｄｐ
＝Ｚｄ_ｉ＋１＾（３Ｒｄ_ｉ）・（Ｚ_ｉ／Ｚｄ_ｉ＋１）＾（２Ｒｄ_ｉ）
・（Ｚｄ_ｉ＋１／Ｚｄ_ｉ）＾Ｒ_ｉ’ ｍｏｄｐ
＝Ｚｄ_ｉ＋１＾（３Ｒｄ_ｉ）・Ｚ_ｉ＾（２Ｒｄ_ｉ）・Ｚｄ_ｉ＋１＾（−２Ｒｄ_ｉ）
・Ｚｄ_ｉ＋１＾Ｒ_ｉ’・Ｚｄ_ｉ＾（−Ｒ_ｉ’） ｍｏｄｐ
＝Ｚｄ_ｉ＋１＾Ｒｄ_ｉ・Ｚ_ｉ＾（２Ｒｄ_ｉ）・Ｚｄ_ｉ＋１＾Ｒ_ｉ’・Ｚｄ_ｉ＾（−Ｒ_ｉ’） ｍｏｄｐ
＝α＾（Ｒｄ_ｉ＋１・Ｒｄ_ｉ）・α＾（２Ｒ_ｉ・Ｒｄ_ｉ）
・α＾（Ｒｄ_ｉ＋１・Ｒ_ｉ’）・α＾（−Ｒ_ｉ’・Ｒｄ_ｉ） ｍｏｄｐ
＝α＾（Ｒｄ_ｉ＋１・Ｒｄ_ｉ＋Ｒｄ_ｉ＋１・Ｒ_ｉ’＋Ｒｄ_ｉ・（２Ｒ_ｉ−Ｒ_ｉ’）） ｍｏｄｐ
となる。
【００４５】
指数部を比較すると、
Ｒｄ_ｉ＋１Ｒｄ_ｉ＋Ｒｄ_ｉ＋１Ｒ_ｉ’＋Ｒｄ_ｉ（２Ｒ_ｉ−Ｒ_ｉ’）
−（Ｒ_ｉＲｄ_ｉ＋１＋Ｒ_ｉＲｄ_ｉ＋Ｒｄ_ｉＲｄ_ｉ＋１）
＝Ｒｄ_ｉ＋１（Ｒ_ｉ’−Ｒ_ｉ）＋Ｒｄ_ｉ（２Ｒ_ｉ−Ｒ_ｉ’−Ｒ_ｉ）
＝Ｒｄ_ｉ＋１（Ｒ_ｉ’−Ｒ_ｉ）−Ｒｄ_ｉ（−Ｒ_ｉ＋Ｒ_ｉ’）
＝（Ｒ_ｉ’−Ｒ_ｉ）（Ｒｄ_ｉ＋１−Ｒｄ_ｉ）
となる。ここで、
Ｒｄ_ｉ≠Ｒｄ_ｉ＋１
であるから、
Ｒ_ｉ’＝Ｒ_ｉ
の時に、上式は０となる。実際にはｐで割った余りをとっているため、ある確率で、Ｒ_ｉ’≠Ｒ_ｉでも、仮共通鍵が一致する場合があるが、ｐが大きいときは、その確率は極めて低くなる。
【００４６】
グループ構成情報Ｘ_ｉ＋１を検証するときは、図７のＢで示すように、ダミー端末Ｄ_ｉ＋１とダミー端末Ｄ_ｉ＋２の仮グループ構成情報Ｘｄ_ｉ＋１”とＸｄ_ｉ＋２”を計算する。ダミー端末Ｄ_ｉ＋１について、ダミー端末情報Ｚｄ_ｉ＋２と、仮グループ構成情報Ｘｄ_ｉ＋１”と、グループ構成情報Ｘ_ｉ＋１”を使用して、仮共通鍵Ｋ３ｄ_ｉ＋１を求める。ダミー端末Ｄ_ｉ＋２について、端末情報Ｚ_ｉ＋１と、仮グループ構成情報Ｘｄ_ｉ＋２”とＸｄ_ｉ＋１”を使用して、仮共通鍵を求める。２つの仮共通鍵を比較してグループ構成情報Ｘ_ｉ＋１を検証する。
【００４７】
つまり、基地局１でダミー端末Ｄ_ｉの仮共通鍵Ｋ３ｄ_ｉ
Ｋ３ｄ_ｉ＝Ｚｄ_ｉ＋１＾（３Ｒ_ｉ）・Ｘｄ_ｉ’^２・Ｘ_ｉ ｍｏｄｐ
を計算する。また、ダミー端末Ｄ_ｉ＋１の仮共通鍵Ｋ３ｄ_ｉ＋１
Ｋ３ｄ_ｉ＋１＝Ｚ_ｉ＾（３Ｒ_ｉ＋１）・Ｘｄ_ｉ＋１’^２・Ｘｄ_ｉ’ ｍｏｄｐ
を計算する。２つの仮共通鍵Ｋ３ｄ_ｉとＫ３ｄ_ｉ＋１が等しいとき、送られてきたグループ構成情報Ｘ_ｉを正しいとして受け入れる。
【００４８】
もし、正しくないとすると、基地局１は、実端末Ｍ_ｉに対してグループ構成情報Ｘ_ｉの再送を要求する。再び正しくないグループ構成情報Ｘ_ｉが送られてきたときは、実端末Ｍ_ｉをグループから外す。他の実端末のグループ構成情報Ｘについても、同様の検証を行ない、これらが正しいとき、すべての実端末のグループ構成情報Ｘ及びダミー端末のグループ構成情報Ｘｄを全端末に向けて送り出す。
【００４９】
各実端末は、送られてきた自局のグループ構成情報Ｘが正しいことを確認して、自分の一つ前の端末情報ＺあるいはＺｄと、それぞれのグループ構成情報Ｘとから、共通鍵Ｋ２ｎを計算して共有する。すべての実端末のグループ構成情報Ｘ及びダミー端末のグループ構成情報Ｘｄを全端末に向けて送り出す前に、２つ以上の任意のダミー端末で仮共通鍵Ｋ３を計算し、それらが等しければ、間違いなく正しいグループ構成情報Ｘであることが確認できる。
【００５０】
第６に、グループ構成情報Ｘをまとめて検証する方法を説明する。これまでは、各実端末からグループ構成情報Ｘが送られてくるごとに、または、すべてのグループ構成情報Ｘを受信してから、グループ構成情報Ｘを１つずつ検証する方法について説明したが、すべての実端末からグループ構成情報Ｘが送られてきた時点で、まとめて検証を行なうこともできる。この場合の方が、検証回数は少ない。
【００５１】
まず、全体で少なくとも２つのダミー端末の共通鍵Ｋ２ｎを計算する。ここで、この少なくとも２つのダミー端末の共通鍵Ｋ２ｎが等しければ、全体のグループ構成情報Ｘは正しい。等しくない場合は、グループ全体をほぼ２分して２つのサブグループとし、各サブグループのダミー端末の仮共通鍵Ｋを計算する。これを繰り返すことにより、正しくないグループ構成情報Ｘを求めて、その実端末にグループ構成情報Ｘの再送を要求する。
【００５２】
図８に、ｎ台の実端末と同数のダミー端末でグループを構成し、ダミー端末の乱数と、実端末情報Ｚと、ダミー端末情報Ｚｄと、ダミー端末のグループ構成情報Ｘｄ_１と、送られて来たグループ構成情報Ｘ_１が、すべて基地局１の記憶部１４に入った状態を示す。図８に示すように、実端末とダミー端末の計２ｎ台のうち、ほぼ中心のダミー端末Ｄ_ｉで、グループを２つのサブグループに分け、それぞれのサブグループを、ＦＧ１、ＦＧ２とする。サブグループＦＧ１の両端ダミー端末のグループ構成情報Ｘｄを計算し直す。グループ構成情報Ｘｄ_１の代わりとして仮グループ構成情報Ｘｄ_１’を計算し、グループ構成情報Ｘｄ_ｉの代わりとして仮グループ構成情報Ｘｄ_ｉ’を計算する。この仮グループ構成情報Ｘｄ_１’とＸｄ_ｉ’と、残りのグループ構成情報Ｘ及び端末情報Ｚを使用して、少なくとも２つのダミー端末の仮共通鍵を計算する。
【００５３】
同様に、もう一方のサブグループＦＧ２で、両端のダミー端末のグループ構成情報Ｘｄを計算する。仮グループ構成情報Ｘｄ_ｉ”及びＸｄ_１”を計算し、この仮グループ構成情報Ｘｄ_ｉ”とＸｄ_１”と、残りのグループ構成情報Ｘ及び端末情報Ｚを使用して、少なくとも２つのダミー端末の仮共通鍵を計算する。それぞれのサブグループで計算した２つ以上の仮共通鍵が一致しないサブグループの中に、誤ったグループ構成情報Ｘが存在することになる。両方のサブグループに誤ったグループ構成情報Ｘが存在する場合と、一方のサブグループに誤ったグループ構成情報Ｘが存在する場合がある。一方のサブグループに存在する場合は、誤りのあるサブグループをさらに２分する。サブグループＦＧ２に誤りがあった場合には、図９に示すように、サブグループＦＧ２をサブグループＦＧ３とＦＧ４の２つのサブグループに分けて、前と同様に、ダミー端末Ｄ_ｉのグループ構成情報Ｘｄを仮グループ構成情報Ｘｄ_ｉ’”として計算しなおす。
【００５４】
これらの仮グループ構成情報Ｘｄ_ｉ’”とＸｄ_ｊ’”を使用して、サブグループＦＧ３の中のダミー端末の仮共通鍵を計算する。これらの仮共通鍵が等しい場合、サブグループＦＧ３のグループ構成情報Ｘは正しいとする。正しくないときは、サブグループＦＧ３をさらに２分して、グループ構成情報Ｘｄを計算し直し、２つ以上のダミー端末の仮共通鍵を計算して、それらが等しいか等しくないかを見て、グループ構成情報Ｘを検証する。サブグループＦＧ４についても同様である。そして最後は、図１０に示すように、ダミー端末が実端末をはさむ形になり、正しくない実端末が検出できる。全てのグループ構成情報Ｘがそろった場合に検査する方法を説明したが、一定の数のグループ構成情報Ｘが連続してそろった時点で検査を行なう方法も可能である。
【００５５】
第７に、各端末の端末情報Ｚを安全に送る方法を説明する。各端末に公開方式鍵の鍵（ＫＰ_ｉ，ＫＳ_ｉ）を付与し、公開鍵ＫＰ_ｉを基地局１に登録しておく。また、基地局１にも公開方式鍵（ＫＰ_Ｂ，ＫＳ_Ｂ）を付与しておき、基地局公開鍵ＫＰ_Ｂをシステム内の各端末に公開しておく。端末は、自局の端末情報Ｚ_ｉを自局の秘密鍵ＫＳ_ｉで暗号化して、ＫＳ_ｉ（Ｚ_ｉ）として、これを基地局１の公開鍵ＫＰ_Ｂで暗号化して、ＫＰ_Ｂ（ＫＳ_ｉ（Ｚ_ｉ））として、基地局１へ送信する。基地局１は、自局の秘密鍵ＫＳ_Ｂでこれを復号して、ＫＳ_ｉ（Ｚ_ｉ）を得、さらに端末の公開鍵ＫＰ_ｉを用いて、これを復号して、端末情報Ｚ_ｉを得る。このようにして、端末情報Ｚ_ｉを安全に送ることができる。
【００５６】
上記のように、本発明の実施の形態では、移動通信グループ暗号鍵配送方法を、グループ編成時に、ダミー端末を実端末の間に挟んで、検証対象の実端末と前後のダミー端末とで仮グループをつくり、基地局に登録した端末情報Ｚから、仮グループでのダミー端末のグループ構成情報Ｘを計算し、仮グループのダミー端末の仮共通鍵を計算し、２つの共通鍵の一致不一致で、実端末のグループ構成情報Ｘを検証する構成としたので、グループ編成時の送受信回数を削減でき、正規の端末が生成した伝送途中での誤りがない情報であることも確認できる。
【００５７】
【発明の効果】
以上の説明から明らかなように、本発明では、基地局から複数の端末に同報送信可能な移動通信システムの移動通信グループ暗号鍵配送方法を以下のように構成した。すなわち、基地局で、素数と基地局公開情報（整数）を発生して記憶するとともに、各端末に同報送信し、各端末は、それぞれ端末乱数を発生して記憶し、端末情報を計算して記憶するとともに、あらかじめ基地局へ送信し、基地局は、各端末から送られた端末情報を記憶し、全端末のうちからグループを構成するメンバー端末を選び、メンバー端末に対して、仮想的なグループメンバーであるダミー端末を設定し、各ダミー端末に対応したダミー端末乱数を発生して記憶し、ダミー端末情報を計算して記憶するとともに、各メンバー端末に同報送信し、また、端末情報とダミー端末乱数とから、グループ構成情報を計算して記憶し、メンバー端末は、ダミー端末情報を受信して、記憶している素数と端末乱数とを使って、グループ構成情報を計算して記憶するとともに、基地局に送信し、基地局で、グループ構成情報を受信して記憶するとともに、全端末に向けてグループ構成情報を同報送信し、各メンバー端末で、すべてのグループ構成情報を受信して記憶し、共通鍵を計算する構成としたので、移動通信のグループ暗号鍵配送において、グループ編成時の送受信回数を削減でき、また、正規の端末が生成し、伝送途中での誤りがない鍵生成用情報であることを確認できるので、グループ暗号鍵を安全かつ速く配送できるという効果が得られる。
【００５８】
また、端末情報Ｚを、あらかじめ安全な方法で基地局に送っておくことにより、グループの編成を早く行なうことができる。さらに、実端末の間に挟まれたダミー端末を利用して、実端末の送ってくるグループ構成情報Ｘを検証することができる。グループ構成情報Ｘに、誤り訂正符号を付与する必要がないため、グループ構成情報Ｘの正誤を検証するための伝送量が増えることがない。これにより、伝送路上でのグループ構成情報Ｘの誤り検出や不正端末の検出が容易にできるという効果が得られる。
【図面の簡単な説明】
【図１】本発明の実施の形態における移動通信グループ暗号鍵配送方法を適用する通信システムを示す概念図、
【図２】本発明の実施の形態における移動通信グループ暗号鍵配送方法を適用する基地局のブロック図、
【図３】本発明の実施の形態における移動通信グループ暗号鍵配送方法を適用する端末のブロック図
【図４】本発明の実施の形態における移動通信グループ暗号鍵配送方法を適用する基地局記憶部に記憶された、端末とそれに対応する端末情報を示す図、
【図５】本発明の実施の形態における移動通信グループ暗号鍵配送方法を適用する基地局記憶部に記憶された、ダミー端末と乱数とダミー端末情報を示す図、
【図６】本発明の実施の形態における移動通信グループ暗号鍵配送方法を適用する基地局記憶部に記憶された、実端末とダミー端末を順次並べ、ダミー端末の乱数及びダミー端末情報と実端末情報を示す図、
【図７】本発明の実施の形態における移動通信グループ暗号鍵配送方法で、実端末のグループ構成情報Ｘの検証を１つずつ行なう方法を説明する図、
【図８】本発明の実施の形態における移動通信グループ暗号鍵配送方法で、グループを２つに分けて実端末のグループ構成情報Ｘの検証を行なう方法を説明する図、
【図９】本発明の実施の形態における移動通信グループ暗号鍵配送方法で、グループを４つに分けて実端末のグループ構成情報Ｘの検証を行なう方法を説明する図、
【図１０】本発明の実施の形態における移動通信グループ暗号鍵配送方法で、グループを最も小さく分けて、１つの実端末とそれをはさむ２つのダミー端末で仮グループをつくり、実端末のグループ構成情報Ｘの検証を行なう方法を説明する図である。
【符号の説明】
１ 基地局
１１ 送受信部
１２ 制御部
１３ 演算部
１４ 記憶部
２１ 送受信部
２２ 制御部
２３ 演算部
２４ 記憶部
Ｔ 端末
Ｍ 実端末
Ｄ ダミー端末
Ｒ 乱数
Ｚ 端末情報
Ｘ グループ構成情報[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a mobile communication group encryption key distribution method, and more particularly to a mobile communication group encryption key distribution method for safely and quickly distributing a group encryption key in mobile communication.
[0002]
[Prior art]
In a cryptographic communication system composed of a plurality of mobile terminals capable of broadcasting from a base station, when performing group cryptographic communication between specific terminals, only the terminals constituting the group need to have a group cryptographic key in advance. Need to be delivered secretly. In a conventional cryptographic communication system, a method of distributing a group encryption key using an individual encryption key and storing the group key in a terminal from the beginning has been adopted. However, with such a group encryption key distribution method, it has been difficult to update the group key when the group members are changed.
[0003]
Several methods have been proposed to avoid such difficulties. A conventional group key distribution method for updating a group encryption key will be described below. As an encryption key sharing scheme for a group of three or more parties, there is a Burmester-Desmett method (hereinafter, referred to as a BD method). For details of the BD method, see Reference 1 [M. Burmester, Y .; Desmedt: "A secure and effective conference key distribution system" EUROCRYPT'94 May 1994. Please refer to].
[0004]
First, the base station generates and publishes a prime number p and an integer α (2 ≦ α ≦ p−1) as public information. Next, each member M of the group_i(I = 1 to n; n is the number of members) is a random number R_iAnd keep it secret,
Z_i= Α^Ri  modp
And calculate Z_iTo each member. Each member M_iIs the Z_{i + 1}, Z_i-1Based on
X_i= (Z_{i + 1}/ Z_i-1)^Ri  modp (however, Z₀= Z_n, Z_{n + 1}= Z₁)
And calculate X_iTo each member.
[0005]
Each member M_iIs a common key Kn.
Kn = Z_i-1 ^nRi・ X_i ^n-1・ X_{i + 1} ^(N-2)... X_n ^(I-1)
・ X₁ ^(I-2)... X_i-2  modp
= Α ＾ ｛R₁R₂+ R₂R₃+ ... + R_nR₁｝ Modp
To obtain a common key Kn.
[0006]
Group is M₁, ..., M_i, ..., M_nA method for obtaining a new key when the number of members newly increases when the number of members is n is as follows. Member M trying to join the group_{n + 1}Is a random number R_{n + 1}To generate
Z_{n + 1}= Α^{Rn + 1}  modp
And calculate Z_{n + 1}Deliver.
[0007]
Member M₁Is
X₁= (Z₂/ Z_{n + 1})^R1  modp
And calculate X for each member₁Deliver. Member M_nIs
X_n= (Z_{n + 1}/ Z_n-1)^Rn  modp
And calculate X for each member_nDeliver. Member M_{n + 1}Is
X_{n + 1}= (Z₁/ Z_n)^{Rn + 1}  modp
And calculate X_{n + 1}Deliver.
[0008]
Each member M_iIs
Kn + 1 = Z_i-1 ^{(N + 1) Ri}・ X_i ⁿ・ X_{i + 1} ^(N-1)... X_{n + 1} ^(I-1)
・ X₁ ^(I-2)... X_i-2  mod p
= Α ＾ ｛R₁R₂+ R₂R₃+ ... + R_nR_{n + 1}+ R_{n + 1}R₁｝ Modp
Is calculated to obtain a key Kn + 1. When the number of members decreases, the common key Kn + 1 is obtained in substantially the same manner.
[0009]
As described above, when the number of members increases or decreases, the members before and after the member to increase or decrease must calculate X using the Z of the members before and after newly, and deliver this to each member by broadcasting. No. If the transmission path does not cause an error and is not disconnected, the data to be delivered always reaches a necessary place.
[0010]
However, when the BD method is used as a group encryption key sharing scheme in a mobile communication system, when the number of members of a group increases or decreases on an unstable transmission path such as mobile communication, the terminals before and after the increase / decrease terminal are not necessarily the base stations. It is not in a state where signals from the station can be received, and the groups cannot share the same encryption key.
[0011]
In a mobile communication environment, a wireless transmission path is unstable and an error always occurs. In addition, each member may have a terminal that is not in operation because the terminal is in a place where radio waves cannot reach or the terminal is turned off. In such a state, M_{n + 1}Member joins the group and increases the number of members._{n + 1}Is Z_{n + 1}Is delivered to member M_{n + 1}Member M before and after₁And M_nIs not always possible. X that I ca n’t receive₁And X_nCannot be calculated and X₁And X_nCannot be delivered. Therefore, each terminal M_iIs X for calculating Kn + 1₁, X_nCan not get. Even if the number of terminals decreases due to withdrawal or deletion, if the terminals before and after the decreasing terminal are not operating, the terminals before and after cannot send necessary information, and the members constituting the group use the common key. Can not share.
[0012]
In order to be able to deliver a new common key when the number of members increases or decreases, even if an error occurs due to an unstable wireless transmission path or there is an inactive terminal, Japanese Patent Application No. 11-265511. Then, we proposed a mobile communication encryption key distribution method. A mobile communication encryption key distribution method for a mobile communication system capable of broadcasting from a base station to a plurality of terminals. (1) A base station generates and stores a prime number p and an integer α (2 ≦ α ≦ p−1). At the same time, broadcast to each terminal, set at least one dummy terminal that is a virtual group member for the member terminals that make up the group, and assign a serial number to the combined member terminal and dummy terminal. And terminal T_i(1 ≦ i ≦ n; n is the total number of member terminals and dummy terminals), and each dummy terminal T_iRandom number R corresponding to_iIs generated and stored, and Z of the dummy terminal is generated._i(= Α^Ri  modp) is calculated and stored, and broadcast to each terminal. (2) p and α and Z of the dummy terminal at each member terminal_iIs received and stored, and the member terminal T_iRandom number R_iIs generated and stored, and Z of the real terminal is_i(= Α^Ri  modp) is calculated and stored and transmitted to the base station._iIs received and stored, and broadcasted to all terminals. (4) Each member terminal T_iThen Z of the actual terminal_iReceived and memorized, X_i(= (Z_{i + 1}/ Z_i-1)^Ri  modp; where X₁= (Z₂/ Z_n)^R1  modp, X_n= (Z₁/ Z_n-1)^Rn  modp) is calculated and stored and transmitted to the base station._iReceived and stored, and the dummy terminal T_iX of_iIs calculated and stored, and X is directed to all terminals._i(6) At each member terminal, all X_iIs received and stored, and the common key Kn (= Z_i-1 ^{(N) Ri}・ X_i ^n-1・ X_{i + 1} ^n-2... X_i-2  modp).
[0013]
In this way, when the number of members increases or decreases, it is possible to reduce the necessity of receiving information from before or after the increasing or decreasing member terminal, and increase the possibility of updating the common key even when the transmission path is unstable. In this way, when organizing groups, Z_iTo the base station, and the base station receives Z_iIs further sent to each terminal, and the terminal receiving these further sends X_iAnd sends it back to the base station, which broadcasts it to each terminal.
[0014]
[Problems to be solved by the invention]
However, in the above-mentioned conventional method, Z starts from the start of group formation._i, X_iMust be transmitted and received twice, and the group formation time is long. Also, Z_iAnd X_iI can't check if the was generated by a legitimate device. In an unstable environment such as a mobile communication environment, it is necessary to confirm transmitted data. In order to form a group in a short time, it is necessary to verify whether data is from an authorized terminal or whether there is an error in the data by a simple method.
[0015]
SUMMARY OF THE INVENTION The present invention solves the above-mentioned conventional problem, and reduces the number of times of transmission and reception during group formation in group encryption key distribution of mobile communication, and generates a key generated by a legitimate terminal without error during transmission. The purpose is to confirm that the information is information, and to deliver the group encryption key safely and quickly.
[0016]
[Means for Solving the Problems]
In order to solve the above-mentioned problems, in the present invention, a mobile communication group encryption key distribution method of a mobile communication system capable of broadcasting from a base station to a plurality of terminals is configured as follows. That is, the base station generates and stores a prime number and base station public information (integer) and broadcasts them to each terminal. Each terminal generates and stores a terminal random number, and calculates terminal information. In addition to transmitting the information to the base station in advance, the base station stores the terminal information sent from each terminal, selects a member terminal constituting a group from each terminal, and virtually Set dummy terminals that are group members, generate and store dummy terminal random numbers corresponding to each dummy terminal, calculate and store dummy terminal information, and broadcast to each member terminal. From the information and the dummy terminal random number, the group configuration information is calculated and stored. The member terminal receives the dummy terminal information, and uses the stored prime number and the terminal random number to generate the group configuration information. Calculate and store, transmit to the base station, receive and store the group configuration information at the base station, broadcast the group configuration information to all terminals, and, at each member terminal, The configuration information is received and stored, and a common key is calculated.
[0017]
With this configuration, the number of times of transmission / reception during group formation can be reduced in group encryption key distribution of mobile communication, and the key generation information is generated by an authorized terminal and has no error during transmission. , The group encryption key can be delivered safely and quickly.
[0018]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS.
[0019]
(Embodiment)
In the embodiment of the present invention, when forming a group, a dummy terminal is sandwiched between real terminals, a temporary group is created with the real terminal to be verified and the dummy terminals before and after the terminal, and from the terminal information Z registered in the base station, A mobile communication group that calculates the group configuration information X of the dummy terminal in the temporary group, calculates the temporary common key of the dummy terminal in the temporary group, and verifies the group configuration information X of the real terminal when the two common keys do not match. This is an encryption key distribution method.
[0020]
FIG. 1 is a diagram of a mobile communication system to which a mobile communication group encryption key distribution method according to an embodiment of the present invention is applied. In FIG. 1, a base station 1 is a fixed wireless base station. Terminal T₁~ T_NIs a mobile communication terminal. The mobile communication system shown in FIG. 1 includes a base station 1 and a plurality of terminals T.₁, T₂, ..., T_NOf N terminals.
[0021]
FIG. 2 is a block diagram showing a configuration of a base station used in a mobile communication system to which the mobile communication encryption key distribution method according to the embodiment of the present invention is applied. In FIG. 2, a transmission / reception unit 11 is a part that demodulates a received radio wave signal into a baseband signal, modulates the baseband signal, and transmits it as a radio wave signal. The control unit 12 is a device that controls devices of the entire base station. The calculation unit 13 is a device that calculates various parameters. The storage unit 14 is a device that stores various parameters.
[0022]
FIG. 3 is a block diagram showing a configuration of a terminal used in a mobile communication system to which the mobile communication encryption key distribution method according to the embodiment of the present invention is applied. In FIG. 3, the transmission / reception unit 21 is a part that demodulates a received radio wave signal into a baseband signal, modulates the baseband signal, and transmits the baseband signal as a radio wave signal.
[0023]
FIG. 4 is a diagram showing a terminal T stored in a base station storage unit to which the mobile communication group encryption key distribution method according to the embodiment of the present invention is applied.₁~ T_NAnd the corresponding terminal information Z_T1~ Z_TNFIG. FIG. 5 is a diagram illustrating dummy terminals D1 to Dn, random numbers Rd1 to Rdn, and dummy terminal information Zd1 to Zdn stored in the base station storage unit. FIG. 6 is a diagram in which real terminals and dummy terminals are alternately arranged in the base station storage unit, and random numbers of dummy terminals, dummy terminal information, and real terminal information are stored.
[0024]
FIG. 7 is a diagram illustrating a method of verifying group configuration information X of real terminals one by one in the mobile communication group encryption key distribution method. FIG. 8 is a diagram for explaining a method of verifying the group configuration information X of the real terminal by dividing the group into two by the mobile communication group encryption key distribution method. FIG. 9 is a diagram for explaining a method of verifying the group configuration information X of the real terminal by dividing the group into four groups by the mobile communication group encryption key distribution method. FIG. 10 shows a mobile communication group encryption key distribution method, in which a group is divided into the smallest groups, a temporary group is formed by one real terminal and two dummy terminals sandwiching the group, and the group configuration information X of the real terminal is verified. FIG.
[0025]
A mobile communication encryption key distribution method according to an embodiment of the present invention on the mobile communication system configured as described above will be described. First, a mobile communication system will be described. As shown in FIG. 1, the mobile communication system is a system that performs communication between the base station 1 and terminals and between terminals via the base station 1. Each terminal can receive downlink communication from the base station 1. Communication between the terminals is performed via the base station 1.
[0026]
The operation of the base station 1 will be described. As shown in FIG. 2, the transmission / reception unit 11 demodulates the received radio wave signal into a baseband signal, modulates the baseband signal, and transmits the baseband signal as a radio wave signal. The control unit 12 controls devices of the entire base station. The calculation unit 13 calculates various parameters. Various parameters are stored in the storage unit 14. Radio waves are transmitted from the transmission / reception unit 11 of the base station 1 to the terminals, and communication from the base station 1 is performed in a broadcast manner. Therefore, signals from the base station 1 can be received by any terminal. For example, terminal T₁And T_NWhen communication is performed between the terminals T,₁Is the partner's terminal T_NAnd sends a signal to the base station 1. The base station 1 broadcasts this signal to each terminal. Specified terminal T_NReceives the signal. Also, T_NOther terminals can receive the same signal.
[0027]
The base station 1 is installed so that the transmission and reception of radio waves of the terminals are performed reliably, and the majority of terminals and the base station 1 can communicate with each other. Further, even when the transmission power of the base station 1 is higher than the transmission power of the terminal and the transmission signal of the terminal does not reach the base station 1, the transmission signal of the base station 1 has a high probability of reaching the terminal. However, a transmission path between the base station 1 and the terminal is not always ensured depending on a positional relationship between the base station 1 and the terminal or an influence of an obstacle between the base station 1 and the terminal. In addition, even when the terminal is turned off or fails, the terminal cannot receive the radio wave of the base station 1.
[0028]
The operation of the terminal will be described. As shown in FIG. 3, the signal transmitted from the base station 1 is demodulated by the transmission / reception unit 21. The demodulated signal is controlled by the control unit 22 and subjected to signal processing. When it is necessary to record the signal, the signal is sent to the storage unit 24 and stored. The storage unit 24 records the signal sent from the control unit 22, and the stored contents are read out under the control of the control unit 22.
[0029]
Second, a group key sharing protocol in a mobile communication system will be described. The logical terminals constituting the group are composed of actual terminals (real terminals or member terminals) and dummy terminals virtually provided in the base station 1.
[0030]
(1) Advance preparation
(1) The base station 1 generates a prime number p and base station public information (integer) α (1 ≦ α ≦ p−1) and sends them to each terminal.
(2) Each terminal generates a terminal secret random number R, calculates terminal information Z, and transmits it to the base station 1 in a secure manner. Assuming that the terminal secret random number is R, the terminal information Z is α ＾ R modp.
(3) The terminal information Z of each terminal is stored and accumulated in the base station 1.
[0031]
(2) Group formation
(1) The base station 1 transmits an array of logical terminals and terminal information Zd of the dummy terminal D to terminals forming a group. The array of logical terminals is, for example, D₁-M₁-D₂− …… −D_i-M_i-D_{i + 1}− …… −D_n-M_nIt is. Where D₁… D_i… D_nRepresents a dummy terminal, and M₁... M_i... M_nRepresents a real terminal.
{Circle around (2)} The real terminals forming the group calculate the group configuration information X from the terminal information Zd of the dummy terminals D before and after the arrangement, and send the calculated information to the base station 1. Assuming that the terminal secret random number is R, the terminal information of the dummy terminal before the arrangement is Z−, and the terminal information of the dummy terminal after the arrangement is Z +, the group configuration information X is (Z + / Z −) ＾ R modp It is.
(3) The base station 1 verifies the group configuration information X sent from each terminal.
(4) The base station 1 transmits the group configuration information X of the real terminal and the group configuration information Xd of the dummy terminal to each terminal.
(5) Each terminal calculates a group key K common to the terminals and shares the common key K. Each member terminal M_iAnd all Xd_iAnd X_i(I = 1 to n) is received and stored, and the common key
K2n = Zd_i＾ (2nR_i) ・ X_i＾ (2n-1) · Xd_{i + 1}＾ (2n-2)
・… ・ X_i-1  modp
Is calculated.
[0032]
Third, a method of verifying the group configuration information X will be described. A verification method when n actual terminals form a group will be described. The random number R, terminal information Z, and group configuration information X of each logical terminal are as follows.
[0033]

[0034]
Real terminal M_iGroup configuration information X_iWill be described in the base station 1. The base station 1 transmits the group configuration information Xd of the dummy terminal that has already been stored._i, Xd_{i + 1}Is calculated again and the temporary group configuration information Xd is calculated._i’, Xd_{i + 1}’. The temporary group configuration information is as follows.
[0035]

[0036]
Group configuration information X_iAre correct, the temporary group keys are all equal. That is,
Kd_i’= K_i’= Kd_{i + 1}’
It becomes. Group configuration information X_iIf is not correct, this relationship does not always hold. If not correct, group configuration information X_iRetransmission of actual terminal M_iAsk for. If it is a legitimate terminal, correct group configuration information X_i, But if the terminal is an unauthorized terminal, the random number is different, so the correct group configuration information X_iCan not send.
[0037]
Fourth, the operation of the base station 1 and each real terminal in the preparation stage will be described. In the mobile communication system shown in FIG. 1, the base station 1 generates a prime number p and base station public information (integer) α (2 ≦ α ≦ p−1), and stores it in the storage unit 14 of the base station 1 shown in FIG. The information is stored and broadcast to all terminals.
[0038]
In the terminal, the prime number p and the base station public information α sent from the base station 1 are stored in the storage unit 24 of the terminal shown in FIG. The terminal T receives and stores the prime number p and the base station public information α.₁~ T_NOf the terminals M forming a group₁~ M_nGenerate random numbers, respectively. For example, terminal M₁Is a random number R₁To occur. The prime number p sent from the base station 1, the base station public information α, and the generated random number R₁Using
Z₁= Α ＾ R₁  modp
To calculate the terminal information Z₁Get. Terminal information Z₁To the base station 1. The random number is generated by the operation unit 23 and the terminal information Z₁Is also calculated by the arithmetic unit 23. The generation and calculation of these random numbers are performed under the control of the control unit 22. Random number R generated by arithmetic unit 23₁And terminal information Z₁Are stored in the storage unit 24 via the control unit 22. Do the same for other terminals.
[0039]
Terminal information Z of each terminal sent to base station 1_iAre stored in the storage unit 14 of the base station 1. The state recorded in the base station storage unit 14 is shown in FIG. Each terminal M_iFor each terminal information Z_iAre stored as a pair. Prepare for such a state.
[0040]
Fifth, an operation for checking the group configuration information will be described. When a request for group configuration occurs, the base station 1 sets the dummy terminal D according to the number of group members._iAnd a random number Rd for the number of dummy terminals_iTo occur. N terminals M out of all N terminals₁~ M_nWhen forming a group with (n ≦ N) as members, the base station 1 sets n dummy terminals, generates n random numbers corresponding to the dummy terminals, and stores the random number in the storage unit 14. This state is shown in FIG. These dummy terminals D₁~ D_nIs the actual terminal M₁~ M_nTo correspond to. The contents shown in FIG. 6 are stored in the storage unit 14.
[0041]
The base station 1 has dummy terminal information Zd._i~ Zd_nThen, array information designating the positions where the real terminal and the dummy terminal enter is transmitted to each terminal by broadcast. The base station 1 calculates and stores the group configuration information Xd of the dummy terminals from the terminal information Z of each real terminal already stored in the storage unit 14. Each real terminal calculates the group configuration information X from the terminal information Zd of the dummy terminals before and after the real terminal which have already been transmitted. Real terminal M_iIs the dummy terminal D before and after it_i, D_{i + 1}Terminal information Zd_iAnd Zd_{i + 1}From, group configuration information
X_i= (Zd_{i + 1}/ Zd_i) ＾ R_i  modp
Is calculated and transmitted to the base station 1.
[0042]
The base station 1 (D_i, M_i, D_{i + 1}) As a temporary group and the dummy terminal D_iTemporary group configuration information Xd_i’And the dummy terminal D_{i + 1}Temporary group configuration information Xd_{i + 1}’. This state is shown in FIG. Temporary group configuration information Xd_i’And Xd_{i + 1}'Is calculated as follows.
Xd_i’= (Z_i/ Zd_{i + 1}) ＾ Rd_i  modp
Xd_{i + 1}’= (Zd_i/ Z_i) ＾ Rd_{i + 1}  modp
[0043]
Temporary group configuration information Xd_i’And Xd_{i + 1}’And the real terminal M that was sent_iGroup configuration information X_iFrom, dummy terminal D_iAnd D_{i + 1}Temporary common key K3d_iAnd K3d_{i + 1}Is calculated as follows. Note that the common key K3 of the three logical terminals is
K3 = (previous Z) ＾ (3 (own R)) · (own X)²・ (X immediately after) modp
Calculate with Just before and after, think cyclically.
K3d_i= Zd_{i + 1}＾ (3Rd_i) ・ Xd_i’²・ X_i  modp
= Zd_{i + 1}＾ (3Rd_i) ・ (Z_i/ Zd_{i + 1}) ＾ (2Rd_i)
・ (Zd_{i + 1}/ Zd_i) ＾ R_i  modp
= Zd_{i + 1}＾ (3Rd_i) ・ Z_i＾ (2Rd_i) ・ Zd_{i + 1}＾ (-2Rd_i)
・ Zd_{i + 1}＾ R_i・ Zd_i＾ (-R_i) Modp
= Zd_{i + 1}＾ Rd_i・ Z_i＾ (2Rd_i) ・ Zd_{i + 1}＾ R_i・ Zd_i＾ (-R_i) Modp
= Α ＾ (Rd_{i + 1}・ Rd_i) ・ Α ＾ (2R_i・ Rd_i)
・ Α ＾ (Rd_{i + 1}・ R_i) · Α ＾ (-Rd_i・ R_i) Modp
= Α ＾ (Rd_{i + 1}・ Rd_i+ R_i・ Rd_i+ Rd_{i + 1}・ R_i) Modp
K3d_{i + 1}= Z_i＾ (3Rd_{i + 1}) ・ Xd_{i + 1}’²・ Xd_i’Modp
= Z_i＾ (3Rd_{i + 1}) ・ (Zd_i/ Z_i) ＾ (2Rd_{i + 1}) ・ (Z_i/ Zd_{i + 1}) ＾ Rd_i  modp
= Z_i＾ (3Rd_{i + 1}) ・ Zd_i＾ (2Rd_{i + 1}) ・ Z_i＾ (-2Rd_{i + 1})
・ Z_i＾ Rd_i・ Zd_{i + 1}＾ (-Rd_i) Modp
= Z_i＾ Rd_{i + 1}・ Zd_i＾ (2Rd_{i + 1}) ・ Z_i＾ Rd_i・ Zd_{i + 1}＾ (-Rd_i) Modp
= Α ＾ (R_di・ Rd_{i + 1}) · Α ＾ (2Rd_i・ Rd_{i + 1})
・ Α ＾ (R_i・ Rd_i) · Α ＾ (-Rd_i・ Rd_{i + 1}) Modp
= Α ＾ (R_di・ Rd_{i + 1}) ・ Α ＾ (R_i・ Rd_{i + 1}) ・ Α ＾ (R_i・ Rd_i) Modp
= Α ＾ (R_di・ Rd_{i + 1}+ R_i・ Rd_{i + 1}+ R_i・ Rd_i) Modp
[0044]
If each piece of information is correct,
K3d_i= K3d_{i + 1}
Therefore, if the two temporary common keys match, the group configuration information X_iIs determined to be correct. If the random number R_iIs R_i'If,
X_i’= (Zd_{i + 1}/ Zd_i) ＾ R_i’Modp
K3d_i= Zd_{i + 1}＾ (3Rd_i) ・ Xd_i’²・ X_i’Modp
= Zd_{i + 1}＾ (3Rd_i) ・ (Z_i/ Zd_{i + 1}) ＾ (2Rd_i)
・ (Zd_{i + 1}/ Zd_i) ＾ R_i’Modp
= Zd_{i + 1}＾ (3Rd_i) ・ Z_i＾ (2Rd_i) ・ Zd_{i + 1}＾ (-2Rd_i)
・ Zd_{i + 1}＾ R_i’· Zd_i＾ (-R_i’) Modp
= Zd_{i + 1}＾ Rd_i・ Z_i＾ (2Rd_i) ・ Zd_{i + 1}＾ R_i’· Zd_i＾ (-R_i’) Modp
= Α ＾ (Rd_{i + 1}・ Rd_i) ・ Α ＾ (2R_i・ Rd_i)
・ Α ＾ (Rd_{i + 1}・ R_i′) · Α ＾ (-R_i’· Rd_i) Modp
= Α ＾ (Rd_{i + 1}・ Rd_i+ Rd_{i + 1}・ R_i’+ Rd_i・ (2R_i-R_i’)) Modp
It becomes.
[0045]
Comparing the exponents,
Rd_{i + 1}Rd_i+ Rd_{i + 1}R_i’+ Rd_i(2R_i-R_i’)
− (R_iRd_{i + 1}+ R_iRd_i+ Rd_iRd_{i + 1})
= Rd_{i + 1}(R_i'-R_i) + Rd_i(2R_i-R_i'-R_i)
= Rd_{i + 1}(R_i'-R_i) -Rd_i(-R_i+ R_i’)
= (R_i'-R_i) (Rd_{i + 1}-Rd_i)
It becomes. here,
Rd_i≠ Rd_{i + 1}
Because
R_i’= R_i
At this time, the above equation becomes 0. Actually, the remainder is divided by p._i’≠ R_iHowever, the temporary common key may match, but when p is large, the probability is extremely low.
[0046]
Group configuration information X_{i + 1}When verifying the dummy terminal D, as shown in FIG._{i + 1}And dummy terminal D_{i + 2}Temporary group configuration information Xd_{i + 1}"And Xd_{i + 2}Is calculated. Dummy terminal D_{i + 1}About the dummy terminal information Zd_{i + 2}And temporary group configuration information Xd_{i + 1}"And group configuration information X_{i + 1}To use the temporary common key K3d._{i + 1}Ask for. Dummy terminal D_{i + 2}About terminal information Z_{i + 1}And temporary group configuration information Xd_{i + 2}"And Xd_{i + 1}Is used to obtain a temporary common key. The two temporary common keys are compared to obtain group configuration information X._{i + 1}Verify
[0047]
That is, the dummy terminal D_iTemporary common key K3d_i
K3d_i= Zd_{i + 1}＾ (3R_i) ・ Xd_i’²・ X_i  modp
Is calculated. Dummy terminal D_{i + 1}Temporary common key K3d_{i + 1}
K3d_{i + 1}= Z_i＾ (3R_{i + 1}) ・ Xd_{i + 1}’²・ Xd_i’Modp
Is calculated. Two temporary common keys K3d_iAnd K3d_{i + 1}Are equal to each other, the transmitted group configuration information X_iAccept as correct.
[0048]
If it is not correct, the base station 1_iGroup information X_iRequest retransmission of Incorrect group configuration information X again_iIs sent, the actual terminal M_iRemove from the group. The same verification is performed for the group configuration information X of other real terminals, and when they are correct, the group configuration information X of all real terminals and the group configuration information Xd of dummy terminals are sent out to all terminals.
[0049]
Each real terminal confirms that the transmitted group configuration information X of its own station is correct, and obtains a common key K2n from the immediately preceding terminal information Z or Zd and the respective group configuration information X. Calculate and share. Before sending out the group configuration information X of all the real terminals and the group configuration information Xd of the dummy terminals to all the terminals, the temporary common key K3 is calculated by two or more arbitrary dummy terminals. Can be confirmed to be correct group configuration information X.
[0050]
Sixth, a method for collectively verifying the group configuration information X will be described. Until now, the method of verifying the group configuration information X one by one every time the group configuration information X is transmitted from each real terminal or after receiving all the group configuration information X has been described. When the group configuration information X is transmitted from all the real terminals, the verification can be performed collectively. In this case, the number of verifications is smaller.
[0051]
First, the common key K2n of at least two dummy terminals is calculated. Here, if the common keys K2n of the at least two dummy terminals are equal, the entire group configuration information X is correct. If they are not the same, the entire group is divided into approximately two subgroups, and the temporary common key K of the dummy terminal in each subgroup is calculated. By repeating this, incorrect group configuration information X is obtained, and the real terminal is requested to retransmit the group configuration information X.
[0052]
In FIG. 8, a group is composed of the same number of dummy terminals as n real terminals, the random number of the dummy terminal, real terminal information Z, dummy terminal information Zd, and group configuration information Xd of the dummy terminal.₁And the sent group configuration information X₁Indicate a state in which all of them have entered the storage unit 14 of the base station 1. As shown in FIG. 8, the dummy terminal D, which is almost the center of the 2n actual terminals and the dummy terminals, is used._iThen, the group is divided into two subgroups, and each subgroup is defined as FG1 and FG2. Recalculate the group configuration information Xd of the dummy terminals at both ends of the subgroup FG1. Group configuration information Xd₁Group composition information Xd instead of₁′, And group configuration information Xd_iGroup composition information Xd instead of_i’. This provisional group configuration information Xd₁’And Xd_i, And the remaining group configuration information X and terminal information Z, the temporary common keys of at least two dummy terminals are calculated.
[0053]
Similarly, the other subgroup FG2 calculates the group configuration information Xd of the dummy terminals at both ends. Temporary group configuration information Xd_i"And Xd₁Is calculated and the temporary group configuration information Xd_i"And Xd₁And the remaining group configuration information X and the terminal information Z to calculate the temporary common keys of at least two dummy terminals. A subgroup in which two or more temporary common keys calculated in each subgroup do not match In this case, the wrong group configuration information X exists in the subgroups. The case where the wrong group configuration information X exists in both subgroups and the case where the wrong group configuration information X exists in one of the subgroups. If the subgroup FG2 exists in one of the subgroups, the erroneous subgroup is further divided into two.If the subgroup FG2 has an error, as shown in FIG. Divided into two subgroups of FG4 and, as before, dummy terminal D_iOf the temporary group configuration information Xd_i””.
[0054]
These temporary group configuration information Xd_i’” And Xd_jThe temporary common key of the dummy terminal in the subgroup FG3 is calculated using “”. When these temporary common keys are equal, the group configuration information X of the subgroup FG3 is assumed to be correct. The subgroup FG3 is further divided into two, the group configuration information Xd is recalculated, the temporary common keys of two or more dummy terminals are calculated, and whether or not they are equal or not is equal. The same is true for the subgroup FG4, and finally, the dummy terminal is sandwiched between the real terminals, and an incorrect real terminal can be detected, as shown in Fig. 10. All the group configuration information X is complete. In the above, a method of performing an inspection is described, but a method of performing an inspection when a certain number of group configuration information X are continuously obtained is also possible.
[0055]
Seventh, a method for securely transmitting terminal information Z of each terminal will be described. Each terminal has a public method key (KP_i, KS_i) And the public key KP_iIs registered in the base station 1. The base station 1 also has a public scheme key (KP_B, KS_B), And the base station public key KP_BIs disclosed to each terminal in the system. The terminal has its own terminal information Z_iIs the private key KS of the own station._iEncrypted with KS_i(Z_i) As the public key KP of the base station 1._BWith KP_B(KS_i(Z_i)) To the base station 1. The base station 1 uses its own secret key KS_BDecrypts this with KS_i(Z_i) And the terminal's public key KP_iTo decrypt the terminal information Z_iGet. Thus, the terminal information Z_iCan be sent safely.
[0056]
As described above, in the embodiment of the present invention, the mobile communication group encryption key distribution method is configured such that the dummy terminal is interposed between the real terminals during group formation, and the dummy terminal is temporarily interposed between the real terminal to be verified and the front and rear dummy terminals. A group is created, the group configuration information X of the dummy terminal in the temporary group is calculated from the terminal information Z registered in the base station, the temporary common key of the dummy terminal in the temporary group is calculated, and if the two common keys do not match, Since the configuration is such that the group configuration information X of the actual terminal is verified, it is possible to reduce the number of transmissions / receptions at the time of group formation and to confirm that there is no error generated during transmission by a legitimate terminal during transmission.
[0057]
【The invention's effect】
As is apparent from the above description, in the present invention, a mobile communication group encryption key distribution method of a mobile communication system capable of broadcasting from a base station to a plurality of terminals is configured as follows. That is, the base station generates and stores a prime number and base station public information (integer) and broadcasts them to each terminal. Each terminal generates and stores a terminal random number, and calculates terminal information. And transmits the information to the base station in advance.The base station stores the terminal information sent from each terminal, selects a member terminal constituting a group from all terminals, and virtually transmits the member terminal to the member terminal. Set dummy terminals that are group members, generate and store dummy terminal random numbers corresponding to each dummy terminal, calculate and store dummy terminal information, and broadcast to each member terminal. From the information and the dummy terminal random number, the group configuration information is calculated and stored. The member terminal receives the dummy terminal information, and uses the stored prime number and the terminal random number to generate the group configuration information. Calculate and store, transmit to the base station, receive and store the group configuration information at the base station, broadcast the group configuration information to all terminals, and, at each member terminal, Since the configuration information is received and stored, and the common key is calculated, the number of times of transmission and reception at the time of group formation can be reduced in the distribution of the group encryption key for mobile communication. Since it can be confirmed that the key generation information has no error, the effect that the group encryption key can be delivered safely and quickly is obtained.
[0058]
In addition, by transmitting the terminal information Z to the base station in a secure manner in advance, the group can be formed quickly. Further, the group configuration information X sent from the real terminal can be verified using the dummy terminal sandwiched between the real terminals. Since it is not necessary to add an error correction code to the group configuration information X, the transmission amount for verifying the correctness of the group configuration information X does not increase. As a result, an effect is obtained that the error detection of the group configuration information X and the detection of the unauthorized terminal on the transmission path can be easily performed.
[Brief description of the drawings]
FIG. 1 is a conceptual diagram showing a communication system to which a mobile communication group encryption key distribution method according to an embodiment of the present invention is applied;
FIG. 2 is a block diagram of a base station to which the mobile communication group encryption key distribution method according to the embodiment of the present invention is applied;
FIG. 3 is a block diagram of a terminal to which the mobile communication group encryption key distribution method according to the embodiment of the present invention is applied.
FIG. 4 is a diagram showing terminals and corresponding terminal information stored in a base station storage unit to which the mobile communication group encryption key distribution method according to the embodiment of the present invention is applied;
FIG. 5 is a diagram showing a dummy terminal, a random number, and dummy terminal information stored in a base station storage unit to which the mobile communication group encryption key distribution method according to the embodiment of the present invention is applied;
FIG. 6 shows an arrangement of real terminals and dummy terminals sequentially stored in a base station storage unit to which the mobile communication group encryption key distribution method according to the embodiment of the present invention is applied, and a random number of dummy terminals, dummy terminal information, and real terminals. A diagram showing information,
FIG. 7 is a view for explaining a method of verifying group configuration information X of real terminals one by one in the mobile communication group encryption key distribution method according to the embodiment of the present invention;
FIG. 8 is a view for explaining a method of verifying group configuration information X of a real terminal by dividing the group into two groups in the mobile communication group encryption key distribution method according to the embodiment of the present invention;
FIG. 9 is a diagram illustrating a method of verifying group configuration information X of a real terminal by dividing the group into four groups in the mobile communication group encryption key distribution method according to the embodiment of the present invention;
FIG. 10 shows a mobile communication group encryption key distribution method according to an embodiment of the present invention, in which a group is divided into the smallest and a temporary group is formed by one real terminal and two dummy terminals sandwiching the group, and the group configuration of the real terminals FIG. 6 is a diagram illustrating a method for verifying information X.
[Explanation of symbols]
1 base station
11 Transceiver
12 control unit
13 Arithmetic unit
14 Storage unit
21 Transceiver
22 Control part
23 Calculation section
24 storage unit
T terminal
M real terminal
D Dummy terminal
R random number
Z terminal information
X group configuration information

Claims (4)

In a mobile communication group encryption key distribution method of a mobile communication system capable of broadcasting from a base station to a plurality of terminals T _j (j = 1 to N; N is an integer of 2 or more),
The base station includes a transmission / reception unit, a control unit, a calculation unit, and a storage unit. Under the control of the control unit, the calculation unit includes a prime p and base station public information (integer) α (2 ≦ α <p−1). The storage unit stores the base station public information , the transmitting and receiving unit converts the prime number p and the base station public information α into a radio wave signal and broadcasts them to each terminal,
Each terminal T _j are transmitting and receiving unit, the control unit, an arithmetic unit and memory unit, the control of the control unit, generates a terminal random number R _Tj stored in the storage unit in the arithmetic unit, the arithmetic In the section , the terminal information Z _Tj = α ＾ R _Tj modp
The storage unit stores the terminal information , the transmitting and receiving unit converts the terminal information into a radio signal and transmits it to the base station,
The transmitting and receiving unit of the base station demodulates terminal information _Ztj sent from the terminal and stores the demodulated terminal information _Ztj in the storage unit, and the control unit controls the member terminals M _i (i = 1~n; n ≦ n) to select said relative member terminal M _i, sets the dummy terminal D _i (i = 1 to n) is a virtual group members, corresponding to each of dummy terminals D _i and a dummy terminal Rd _i generated by the arithmetic unit stored in the storage unit has dummy terminal information Zdi a (= α ^ Rdimodp) calculated by the arithmetic unit stores in the storage unit, the broadcasts transmitted as a radio wave signal at the transmitting and receiving unit under control of the control unit for each member terminal, also, the arithmetic unit includes: a terminal information Z _i of the member terminals M _i stored in the storage unit from said dummy terminal information Zd _i-1 and the dummy terminal random number Rd _i, guru Loop configuration information Xd _i = (Z _i / Z _i-1 ) ＾ R d _i modp
The group configuration information is sent to the storage unit by the control unit, and the storage unit stores the
The member terminal M _i receives the dummy terminal information Zd _i and Zd _{i + 1} by receiving and demodulating a radio signal transmitted from the transmission / reception unit of the base station at the transmission / reception unit , and stores the received radio signal. using a terminal random number R _i prime numbers p and the member terminal M _i stored in the part, the group configuration information
X _i = (Zd _{i + 1} / Zd _i ) ＾ R _i modp
Is calculated by the arithmetic unit, and the control unit stores the group configuration information in the storage unit, and transmits the group configuration information to the base station through the transmission / reception unit .
The base station receives the group configuration information Xi by the transmission / reception unit , stores the group configuration information Xi in the storage unit, and broadcasts the group configuration information Xi, Xdi to all terminals by the transmission / reception unit ,
Each of the member terminals Mi receives all the group configuration information Xdi and Xi (i = 1 to n) by the transmission / reception unit and stores the information in the storage unit ;
In the respective operation units of the base station and each member terminal, a common key K2n = Zd _i (2nR _i ) · X _i (2n−1) · Xd _{i + 1} ＾ (2n−2)... X _{i− 1} modp
The mobile communication group encryption key distribution method characterized by calculating To test the member terminal M _i groups sent from the configuration information X _i, the temporary common key K3 shared by the front and rear of the dummy terminal D _i and D _{i + 1} and the terminal M _i of member terminals M _i for the case of the dummy terminal D _i and D _{i + 1,} calculated in the calculating portion of the base station, said base temporary common key calculation results and the key common key calculation result of the dummy terminal D _{i + 1} of the dummy terminal D _i when these values are equal when compared with the control unit of the station, characterized in that the group configuration information X _i is a correct, transmits the group configuration information X _i from the transceiver through the control unit of the base station to each terminal The mobile communication group encryption key distribution method according to claim 1, wherein In the base station receives the group configuration information X _i of all the member terminals, stored in the storage unit, two or more common key dummy terminal D _i calculated by the arithmetic unit, wherein the control unit, the common key and the correct overall group configuration information X _i when equal, if the calculated result of the common key of the two or more dummy terminals D _i calculated by the arithmetic unit is not achieved, the entire group dummy terminals on both sides select two dummy terminals D _i to divide substantially equally so as to sandwich the calculation produces two groups made by these two or more common key with dummy terminal D _i of each group by the arithmetic unit Then, it is assumed that the group configuration information X _i having the same common key is correct, and two dummy terminals D _i that further divide the group having the unmatched common key into substantially equal parts are selected, and two groups are formed by these. Two groups In the loop, at least two dummy terminals D _i calculate the common key in the arithmetic unit, and the group configuration information X _i having the same common key is determined to be correct. claims found incorrect group configuration information X _i by equally dividing, characterized in that the retransmission request via the transceiver with respect to the member which sent the incorrect group configuration information X _i terminal 2. The mobile communication group encryption key distribution method according to 1. Each terminal stores the assigned public scheme key in the storage unit of the terminal, the storage unit of the base station stores the public key of the terminal, and the base station stores the assigned public scheme key in the storage unit of the base station. And the storage unit of each terminal stores the public key of the base station in the storage unit of the terminal ,
If the terminal sends a terminal information Z _i of the own station to the base station encrypts the terminal information Z _i in the calculating portion with the secret key of its own station stored in the storage unit of the terminal, further, in the storage unit of the terminal Using the stored public key of the base station, the arithmetic unit encrypts it and transmits it to the base station as a radio signal in the transmission / reception unit under the control of the control unit .
The base station decrypts with the operation unit using the secret key of the own station stored in the storage unit of the base station , and further decrypts with the operation unit using the public key of the terminal stored in the storage unit of the base station. Te, mobile communication group encryption key distribution method according to any one of claims 1 to 3, wherein the obtaining the terminal information Z _i of the terminal.

Images