JP3615281B2 - Encryption key / decryption key generation method - Google Patents

Description

[0001]
[Industrial application fields]
The present invention relates to a method for generating and sharing an encryption key used for encryption and decryption of data by a symmetric encryption method using a computer system, and more particularly to encryption and decryption of data communication performed via a communication device. The present invention relates to an encryption key / decryption key generation method in a symmetric encryption system that can be suitably used.
[0002]
[Prior art]
The symmetric encryption method is an encryption method in which the encryption keys used for encryption and decryption are the same. In particular, in recent encryption systems, algorithms are generally disclosed, and ciphertext confidentiality depends on whether or not an encryption key can be kept secret.
In the case of such an encryption method, it is necessary to exchange an encryption key to be used in advance by a secure method between the sender and the receiver before the ciphertext is transmitted. Further, since it is necessary to change the encryption key for each transmission destination in order to maintain confidentiality, the number of encryption keys required for one sender is the same as the number of transmission partners.
Furthermore, if encryption communication is performed by a group of n people, it is necessary to manage N (N-1) / 2 encryption keys in the group, and management becomes complicated in a wide area network with many users. Not right.
In order to solve such problems, a key management computer (hereinafter referred to as “key distribution server”) and a data communication computer (hereinafter referred to as “client”) are connected by a communication device, and the key is distributed at the key distribution center. The key is encrypted by the request from the client at the time of communication and delivered to the destination client, the master key possessed by the key distribution server and the terminal master key possessed by each client are prepared, A method of generating a session key (encryption key used for communication) from the master key and the client terminal master key after exchanging the terminal master key between the transmission and reception clients has been proposed. As this type of technology, for example, a technology disclosed in Japanese Patent Publication No. 6-87557 is known. Japanese Patent Publication No. 6-71259 discloses a method of storing a terminal master key in an IC card owned by each person instead of a client.
[0003]
[Problems to be solved by the invention]
In the above prior art, there is a need to provide a key distribution server and register the items related to the users of cryptographic communication and the identifiers of the client computers in the key distribution server. Although it is applicable to the encryption communication, it is not suitable for encryption communication with an unspecified number of people in a wide area network environment, and the operation management (user registration, change, deletion, backup, etc.) of the key distribution server There was a problem that the cost increased as the number of users increased.
The present invention has been made in view of the above circumstances, and an object of the present invention is to solve the above-described problems in the prior art, eliminate the need for a key distribution server, and simplify the configuration. An object is to provide a method for generating and sharing an encryption key.
[0004]
[Means for Solving the Problems]
The object of the present invention is to store a data communication record between computer systems when performing data communication using symmetric encryption between computer systems, and for each communication, based on the communication record, This is achieved by a method for generating and sharing an encryption key in a symmetric encryption method, characterized in that the same encryption key is generated in the receiving computer system.
[0005]
DETAILED DESCRIPTION OF THE INVENTION
In the method for generating and sharing the encryption key according to the present invention, the past communication performance information is information that can be held in common by a plurality of independent computer systems, and is information that is held only by the computer systems involved in communication, Furthermore, since the transmission side computer system and the reception side computer system have the same amount of data and the same content, the above configuration is adopted in view of the fact that it can be used as a seed for generating an encryption key of a symmetric encryption method. Is.
Hereinafter, embodiments of the present invention will be described in more detail with reference to the drawings.
[0006]
FIG. 1 is a block diagram showing a configuration of a computer system according to an embodiment of the present invention. In the figure, 101 is a computer A that performs data communication, 102 is a record information file of a computer A that stores record information of data transmission / reception between the computer A and another computer, 103 is an encryption key generation program that runs on the computer A, 104 Is an encryption program that operates on the computer A, 111 is a computer B that receives data from the computer A, 112 is a record information file of the computer B that stores record information of data transmission / reception between the computer B and another computer, 113 is A decryption key generating program that operates on the computer B, and 114 indicates a decryption program that operates on the computer B. The decryption key generation program 113 operating on the computer B, the encryption key generation program 103 operating on the computer A, the decryption program 114 operating on the computer B, and the encryption program 104 operating on the computer A are respectively the same program. is there.
[0007]
FIG. 2 is a diagram showing the configuration of the record information file 102 of the computer A shown in FIG. In the figure, reference numeral 200 denotes a portion indicating the communication result with the computer B in the contents of the result information file 102 of the computer A. That is, 201 indicates the number of times of communication with the computer B, 202 is a distinction between transmission and reception for each communication, 203 is a transmission or reception data amount for each communication, and 204 is an error in transmission of the data amount The number of times 205 is extracted and recorded in a specific area of the content of transmission / reception data for each communication.
Reference numeral 210 denotes a portion indicating the communication result with the computer A in the contents of the result information file 112 of the computer B. In other words, 211 indicates the actual number of communication with the computer A, 212 indicates the transmission or reception for each communication, 213 indicates the transmission or reception data amount for each communication, and 214 indicates an error in the transmission of the data amount. The number of times 215 is obtained by extracting and recording a part of a specific area of the contents of transmission / reception data for each communication.
[0008]
Of the contents of the record information file 112 of the computer B described above, the portion 210 indicating the communication record with the computer A and the part 200 indicating the communication record with the computer B out of the contents of the record information file 102 of the computer A are as follows. , Have the same or corresponding content. That is, the actual communication number 211 of the computer B with the computer A includes the actual communication number 201 of the computer A with the computer B, the transmission or reception data amounts 213 and 203 for each communication, and the occurrence number 214 of reception errors for each communication. 204 are the same contents. Also, the transmission or reception distinction 212 for each communication is the same as 202. For example, when 202 is “transmission”, 212 is “reception”, and when 202 is “reception”, 212 is “transmission”. Yes. Needless to say, 215 and 205, which are part of the contents of transmission / reception data for each communication, are extracted and recorded.
[0009]
FIG. 3A is a flowchart showing operations of the encryption key generation program 103 and the encryption program 104 operating on the computer A, and FIG. 3B is a decryption key generation program 113 and a decryption program 114 operating on the computer B. It is a flowchart which shows this operation | movement.
3A and 3B, 301 is a communication result information acquisition processing step, 302 is a random number generation processing step, 303 is an encryption key generation processing step, 304 is a plaintext encryption processing step, and 305 is a ciphertext transmission. 311 is a ciphertext reception processing step, 312 is a communication performance information acquisition processing step, 313 is a random number generation processing step, 314 is a decryption key generation processing step, and 315 is a ciphertext decryption processing. Steps are shown.
Hereinafter, the operation of the present embodiment will be described based on FIGS. 3 (a) and 3 (b).
[0010]
In the computer A, first, in step 301, the communication result information with the computer B in the result information file 102 of the computer A is input, and the data amount 203, the error occurrence number 204, and the contents of the transmitted / received data at the time of specific communication are entered. Data used for random number generation is obtained using any of the units 205. Next, in step 302, random numbers are generated from these data.
In step 303, an encryption key is generated based on the random number generated above. In step 304, the target plaintext message is encrypted. In step 305, past performance information (number of times and (Data type) is attached to the above ciphertext and transmitted to the computer B.
[0011]
In step 311, the computer B receives the ciphertext transmitted from the computer A, and extracts the number of times and the data type from the past communication record information used for random number generation attached to the ciphertext. In step 312, the communication result file 112 of the computer B is searched based on the information extracted above, and data used for random number generation is obtained. Next, in step 313, random numbers are generated from these data. This random number is the same value as the random number generated in step 302 on the computer A side.
In step 314, a decryption key is generated based on the random number generated above. In step 315, the ciphertext received in step 311 is decrypted using the decryption key generated above.
[0012]
According to the above embodiment, since the transmission side computer system and the reception side computer system have the same amount of data and the same content, they can be used as seeds for generating a cryptographic key of a symmetric encryption method. An encryption key generation and sharing method that does not require a server and can simplify the configuration can be realized.
In addition, the said embodiment shows an example of this invention, and it cannot be overemphasized that this invention should not be limited to this. For example, in the above-described embodiment, the case where the data amount, the number of error occurrences, and part of the contents of transmission / reception data are used as past communication performance information between the computer A and the computer B is exemplified. The invention is not limited to these. For example, any information that can be shared between the computer A and the computer B, such as the number of bits of “1” or “0” in a specific area, can be used. .
[0013]
【The invention's effect】
As described above in detail, according to the present invention, a key distribution server is not required, and an encryption key generation and sharing method that can simplify the configuration can be realized. is there.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a computer system according to an embodiment of the present invention.
FIG. 2 is a diagram showing a configuration of a record information file 102 of the computer A according to the embodiment shown in FIG.
FIG. 3 is a flowchart showing an operation of the computer system according to the embodiment.
[Explanation of symbols]
101 Computer A
102 Performance information file 103 of computer A 103 Encryption key generation program 104 operating on computer A Encryption program 111 operating on computer A Computer B
112 Performance information file 113 of computer B 113 Decryption key generation program that operates on computer B 114 Decryption program that operates on computer B

Claims (1)

An encryption key / decryption key generation method in a system for performing data communication by symmetric encryption between computer devices,
For each communication between the sending computer device and the receiving computer device , the same number of both computers, showing the performance of each communication between the two computers, the number of transmission / reception, the amount of communication data in the communication of the transmission / reception number, and error occurrence The number and at least one type of data of the contents of the transmitted / received data are stored as communication performance information,
When communicating with the receiving computer apparatus B, the transmitting computer apparatus A searches for the communication result information stored in the past communication with the receiving computer apparatus B to specify a specific number of times of transmission / reception . Reads the communication result information of the data type, generates an encryption key based on the read communication result information, encrypts the communication target data using the encryption key, and generates the encryption key in the encrypted communication target data. The number of transmissions / receptions specifying the used communication performance information and the data type are attached as search information and transmitted to the receiving-side computer apparatus B,
The receiving side computer apparatus B searches for past communication result information with the transmitting side computer apparatus A stored in the receiving side computer apparatus B based on the search information attached to the received communication target data. The transmission side computer device A reads the same communication performance information used for generating the encryption key and generates a decryption key used for decrypting the received communication target data. Decryption key generation method.

Images