JP3895243B2 - Key distribution method and key distribution system based on user identification information capable of updating key - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a key distribution method and a key distribution system based on identification information (ID) unique to a user such as an e-mail address or a telephone number.
[0002]
[Prior art]
In the key distribution method used conventionally, since the user cannot freely specify the public key value, the certificate authority guarantees the connection between the user and the public key. In addition, in such a key distribution method, if a user leaks or loses a secret key, the user applies to that authority and creates a new public / private key pair. There must be. The certificate authority issues a new key certificate after confirming the relationship between the newly issued public key and the user. In addition, the certificate authority will state in the Key Certificate Revocation List (CRL) that the key certificate of the public key previously used by the user will be revoked, and notify all users of this list. .
[0003]
In such a key distribution method, a person who performs key distribution first acquires a public key of a key distribution partner and an electronic key certificate issued by a certificate authority. Next, a person who performs key distribution verifies the validity of the key certificate and then performs key distribution. For this reason, an extra communication cost is generated between the certificate authority and the person who distributes the key, and a calculation cost such as a key certificate by the person who performs the key distribution is generated. In particular, verification of a key certificate usually has a problem that a large calculation cost is required.
[0004]
In order to solve such problems, the necessity of a method (identity-based key distribution method) in which identification information (ID) unique to a user can be used as a public key was proposed in 1984. Since then, specific implementation methods have been proposed. In the key distribution method based on ID, first, a center that issues and manages a secret key generates a master key mst and publishes public information pub corresponding to mst. Next, an arbitrary sentence string char and mst are acted on to make the secret key d for the string_char(For convenience, such a private key d_charIs called "a secret key based on char"). Usually, the user's e-mail address or the like is used as char. Next, for example, a private key d based on char_charAnd a secret key d based on char ’_{char '}When communicating with the user 2 holding the password using the common key, d_charUser 1 holding_charAnd char ’and pub, and d_{char '}User 2 holding_{char '}It is possible to generate a common key that can be used between the user 1 and the user 2 by using, char and pub. Such a key distribution method based on ID is actually a so-called “no communication required” key distribution (key sharing) method in which it is not necessary to transmit a common key to a communication partner.
[0005]
As a specific method for providing such a function, for example, the Blom method (see Non-Patent Document 1) is known. The outline of the Blom method will be described below.
[0006]
The center that issues and manages the secret key creates a two-variable symmetric polynomial f (x, y) on the finite field GF (q), and uses y as the master key. Further, the center selects a one-way hash function h that is difficult to collide and copies an arbitrary character string to GF (q). Further, the center operates the character string char and the master key y, and a secret key d based on char._char(y) is derived from f (char, y). Private key d_charThe holder of (y) is d_charUsing (y), the secret key d corresponding to char ’_{char '}The common key K with the user holding (y) is K: = d_charDerived by (char ′).
[0007]
Such an ID-based key distribution method has an advantage that no cost is required for obtaining a public key and verifying validity.
[0008]
[Non-Patent Document 1]
Proc. Of CRYPTO’82, Plenum Press, pp.231-236, 1983
[0009]
[Problems to be solved by the invention]
However, the above-described conventional key distribution method based on an ID has a problem that the key cannot be updated unless the ID is changed because the secret key is generated based on the ID unique to the user. In addition, such a conventional key distribution method based on an ID has a problem that public information paired with the secret key cannot be invalidated using a CRL as in the conventional key distribution method.
[0010]
Therefore, the present invention has been made in view of the above points, and an object of the present invention is to provide a key distribution method and key distribution system based on an ID capable of updating a key.
[0011]
[Means for Solving the Problems]
A first feature of the present invention is a key distribution method using a secret key based on identification information unique to a user, in which a center in a group to which a plurality of user terminals belong each A group of functions composed of functions uniquely associated with each other and step A in which the number of updates of the secret key issued to each user terminal by the center is disclosed to the group, and the use belonging to the group The user terminal transmits a secret key issuance request to the user terminal, step B, the center updates the secret key renewal count to the user terminal, and the center responds to the issuance request. A function associated with the number of times the secret key is updated is selected, and a secret key for the user terminal is issued by a predetermined method based on the selected function and identification information unique to the user of the user terminal. Step D, the center transmits the secret key issued in step D to the user terminal, and the user terminal is associated with the number of times the secret key is updated for other user terminals belonging to the group. Step F for generating a common key with another user terminal based on the selected function, identification information unique to the user of the other user terminal, and a secret key for the user terminal It is a summary to provide.
[0012]
According to such a feature, using a family of functions configured by a function uniquely associated with each of the secret key update counts, and the secret key update count issued to each of the user terminals Since a new secret key is issued, the key can be updated in the key distribution based on the unique ID of the user.
[0013]
The second feature of the present invention is that, in the first feature of the present invention, the family of functions is capable of error correction using identification information unique to a user encoded by a predetermined error correction code and the error correction code. (N + 1) different random noises r₀, ..., r_NAnd the expression h_i(X) = x + r_i(Where x is identification information unique to the user, and i is 0 ≦ i ≦ N).
[0014]
According to such a feature, h as a function_i(X) = x + r_iAnd x and r_iSince the value expressed by a predetermined error correction code is used, the value based on the ID unique to the user generated using the function is not the same as the value used by other users Therefore, a situation in which the same secret key is issued to different users can be avoided, and higher security can be ensured.
[0015]
A third feature of the present invention is a key distribution system using a secret key based on identification information unique to a user, comprising a key management server and a user terminal, wherein the key management server includes a plurality of uses. For a group to which a user terminal belongs, a family of functions configured by a function uniquely associated with each number of times the secret key has been updated, and the number of times the secret key has been issued to each user terminal An information disclosing means for publishing, an issue request receiving means for receiving a request for issuing a secret key for the user terminal from a user terminal belonging to the group, and an updating means for updating the number of times the secret key is updated for the user terminal; In response to the issuance request, a function associated with the number of times the secret key is updated for the user terminal is selected, and a predetermined method is determined based on the selected function and identification information unique to the user of the user terminal. To the user terminal A secret key issuing means for issuing a secret key; and a secret key transmitting means for transmitting the secret key issued by the secret key issuing means to the user terminal. Issuance request transmitting means for transmitting the key to the key management server, key receiving means for receiving the secret key for the user terminal transmitted by the key management server, and the number of updates of the secret key for other user terminals belonging to the group. Select the associated function, and generate a common key with other user terminals based on the selected function, identification information unique to the user of the other user terminal, and the private key for the user terminal Common key generation means
It is a summary to provide.
[0016]
The fourth feature of the present invention is that, in the third feature of the present invention, the family of functions is capable of error correction using the identification information unique to the user encoded by the predetermined error correction code and the error correction code. (N + 1) different random noises r₀, ..., r_NAnd the expression h_i(X) = x + r_i(Where x is identification information unique to the user, and i is 0 ≦ i ≦ N).
[0017]
A fifth feature of the present invention is a key management server in a key distribution system using a secret key based on identification information unique to a user, wherein a secret key is assigned to a group to which a plurality of user terminals belong. Information disclosure means for disclosing the family of functions composed of functions uniquely associated with each of the update counts, and the update count of the secret key issued to each user terminal, and belonging to the group An issue request receiving means for receiving a request for issuing a secret key for the user terminal from the user terminal, an update means for updating the number of times the secret key is updated for the user terminal, and a secret for the user terminal in response to the issue request. A secret key that selects a function associated with the number of key updates and issues a secret key to the user terminal by a predetermined method based on the selected function and identification information unique to the user of the user terminal Issuing means , And summarized in that and a secret key transmitting means for transmitting the private key issued by the private key issuing means to the user terminal.
[0018]
According to a sixth aspect of the present invention, in the fifth aspect of the present invention, the family of functions is capable of error correction by means of identification information unique to a user encoded by a predetermined error correction code and the error correction code. (N + 1) different random noises r₀, ..., r_NAnd the expression h_i(X) = x + r_i(Where x is identification information unique to the user, and i is 0 ≦ i ≦ N).
[0019]
The seventh feature of the present invention is used in a key distribution system using a secret key issued by a predetermined method based on a function associated with the number of times the secret key is updated and identification information unique to the user. An issuance request transmitting means for transmitting a secret key issuance request for the mobile communication terminal to the key management server, and a key receiving means for receiving the secret key for the mobile communication terminal transmitted by the key management server. Selecting a function associated with the number of times the secret key has been updated for other mobile communication terminals belonging to the group, the selected function, identification information unique to the user of the other mobile communication terminal, and the secret for the mobile communication terminal The gist is provided with a common key generating means for generating a common key with another mobile communication terminal based on the key.
[0020]
DETAILED DESCRIPTION OF THE INVENTION
(Overall configuration of key distribution system according to this embodiment)
Embodiments of the present invention will be described with reference to the drawings. FIG. 1 is an overall configuration diagram of a key distribution system according to the present embodiment.
[0021]
As shown in the figure, the key distribution system according to the present embodiment includes a communication network 1, a database 10, a key management server 20, a user terminal 30a, and a user terminal 30b.
[0022]
The communication network 1 connects the key management server 20, the database 10, the user terminal 30a, and the user terminal 30b. As the communication network 1, for example, the Internet can be used. The Internet here may be IPv4 defined in RFC 791 or the like or IPv6 defined in RFC 2460 or the like.
[0023]
In this embodiment, the database 10 stores the secret key update count and function family issued to the user terminals 30a and 30b, and stores the stored secret key update count and function family. It is disclosed to 30a and 30b.
[0024]
In this embodiment, the key management server 20 issues a secret key to the user terminals 30a and 30b, and generates the number of updates and a secret key for the secret key issued to the user terminals 30a and 30b. It manages a family of functions used for the above. Further, the key management server 20 has a function of making the database 10 disclose the secret key update count and function family.
[0025]
In the present embodiment, the database 10 and the key management server 20 are separated from each other. However, the database 10 and the key management server 20 may be realized by integrated hardware and software.
[0026]
In the present embodiment, the user terminals 30a and 30b generate a common key used between the user terminal 30a and the user terminal 30b using a secret key issued by the key management server 20. . In addition, the user terminals 30a and 30b perform encrypted communication using the generated common key.
[0027]
As the user terminals 30a and 30b, for example, a personal computer, a personal digital assistant (PDA), a mobile phone terminal, or the like can be used.
[0028]
FIG. 2 is a block configuration diagram showing configurations of the database 10, the key management server 20, and the user terminals 30a and 30b.
[0029]
In the present embodiment, the database 10 includes a group of functions configured by functions uniquely associated with the number of times of updating the secret key for the user terminals 30a and 30b, and the user terminals 30a and 30b. An information disclosing means for disclosing the number of updates of the secret key issued to each is configured.
[0030]
Specifically, as a function disclosed on the database 10, for example, h_i(X) = x + r_iCan be used. Here, x is an ID unique to the user encoded by the error correction code. r is random noise that can be corrected by the error correction code, and (N + 1) r is the maximum number N of secret key updates.₀, ..., r_NConsists of I is the number of times the secret key is updated, and 0 ≦ i ≦ N. Therefore, h_i(X) indicates a function used when updating the i-th secret key for the user terminal of the user whose ID is x.
[0031]
As the identification information unique to the user, the user's e-mail address, telephone number, or the like can be used. The above-described error correction code may be any code that can correct a bit error, and for example, a CRC, a Hamming code, or the like can be used. Moreover, you may comprise the family of functions using a function different from the function mentioned above.
[0032]
The function family table 11 includes a plurality of functions {h₀(・), H₁(・), ..., h_N(.)} Is associated with the number of times the secret key is updated. Here, (·) indicates that it corresponds to the ID of each user. By configuring the family of functions in this way, for example, when a secret key is issued for the first time to the user U of the user terminal 30a whose email address is U, the key management server 20₀Select (・) and h₀Get (U). Further, the key management server 20 determines that the i-th (1 ≦ i ≦ N) private key is issued to the user U, h_iSelect (・) and h_iGet (U).
[0033]
Further, in this embodiment, the database 10 receives update number information p indicating the number of updates of the secret key issued to the user U of the user terminal 30a from the key management server 20, and receives the update number information p. It can be disclosed to the user terminals 30a and 30b.
[0034]
The update count information table 12 shows an example of the contents of the update count information p, and the ID of each user is associated with the update count of the secret key issued to the user.
[0035]
In the present embodiment, the key management server 20 includes an issue request receiving unit 21, a secret information generating unit 22, a key issuing unit 23, a key transmitting unit 24, and an information updating unit 25.
[0036]
Hereinafter, the configuration of each unit will be described by taking as an example key distribution based on an ID unique to a user using the above-described blom method (predetermined method).
[0037]
In the present embodiment, the issue request receiving unit 21 receives a request for issuing a secret key for the user terminal 30a from the user terminal 30a. Specifically, the issue request receiving unit 21 receives a request for issuing a secret key based on the ID of the user U from the user U of the user terminal 30a, and transmits the received issue request to the key issuing unit 23. To do.
[0038]
In the present embodiment, the secret information generation unit 22 generates secret information based on a predetermined method.
[0039]
Specifically, the secret information generation unit 22 generates a two-variable symmetric polynomial f (x, y) on GF (q) over a finite field. In addition, a one-way hash function h that is difficult to collide and copies an arbitrary character string to GF (q) is selected. The secret information generation unit 22 uses the generated y (master key) as secret information and transmits it to the key issuing unit 23.
[0040]
In this embodiment, the key issuing unit 23, in response to a request for issuing a secret key from the user terminal 30a, displays a function associated with update number information p indicating the number of updates of the secret key for the user terminal 30a { h₀(・), H₁(・),…, H_N(•)}, and a secret key issuance for issuing a secret key to the user terminal 30a by a predetermined method based on the selected function and the email address U of the user U of the user terminal 30a Configure the means.
[0041]
The key issuing unit 23 according to the present embodiment receives the issue request from the user terminal 30a received by the issue request receiving unit 21. Further, the key issuing unit 23 refers to the update number information p published on the database 10, and determines the update number of the secret key for the user terminal 30a and the function associated with the update number {h₀(・), H₁(・),…, H_NSelect from (•)}. Specifically, for example, when the user terminal 30a requests the issuance of a secret key for the first time, the key issuing unit 23 stores the secret for the user terminal 30a in the update count information p published on the database 10. Because there is no key update record, h₀Select (・) and email address U from user U to h₀Get (U).
[0042]
Furthermore, the key issuing unit 23 according to the present embodiment includes a secret key d_charIs generated by f (char, y). Where char is the acquired h₀(U) is used. y is a master key (secret information) generated by the secret information generation unit 22. In this way, the key issuing unit 23 can issue the first secret key based on the user ID.
[0043]
For example, when the user terminal 30a requests the i-th (1 ≦ i ≦ N) update of the secret key, the key issuing unit 23 uses the update number information p published on the database 10. Referring to the number of times the private key has been updated for the user terminal 30a_iSelect (・) and email address U from user U to h_i(U) can be acquired. Further, the key issuing unit 23 can issue the i-th secret key corresponding to the electronic mail address U of the user U, similarly to the above-described secret key.
[0044]
The key issuing unit 23 can transmit the secret key issued based on the issuance request from the user U to the key transmitting unit 24 and can notify the information updating unit 25 that the secret key has been issued.
[0045]
In this embodiment, the key transmitting unit 24 constitutes a secret key transmitting unit that transmits the secret key issued by the key issuing unit 23 to the user terminal 30a.
[0046]
In this embodiment, the information update unit 25 constitutes update means for updating the update number information p indicating the number of updates of the secret key for the user terminal 30a.
[0047]
Specifically, the information update unit 25 can acquire the update count of the secret key notified from the key issuing unit 23 and update the update count information p of the user U disclosed by the database 10.
[0048]
The issue request receiving unit 21, the secret information generating unit 22, the key issuing unit 23, the key transmitting unit 24, and the information transmitting unit 25 can perform the same process on the user terminal 30b. For example, when issuing a j-th (1 ≦ i ≦ N) private key update request to the user S of the user terminal 30b whose e-mail address is S, the key issuing unit 23 sets the function h_jBased on (S), the private key d for the user terminal 30b_{char '}Can be generated by f (char ′, y). Where char ’is the acquired h_j(S) is used. y is a master key (secret information) generated by the secret information generation unit 22.
[0049]
In this embodiment, the user terminal 30a includes an issue request transmission unit 31a, a key reception unit 32a, a common key generation unit 33a, an information transmission unit 34a, and an information reception unit 35a.
[0050]
In the present embodiment, the issue request transmission unit 31 a transmits a secret key issue request to the user terminal 30 a to the key management server 20.
[0051]
In this embodiment, the key receiving unit 32a receives a secret key for the user terminal 30a from the key management server 20. Specifically, the key receiving unit 32a can receive a secret key from the key management server 20 and store the received secret key. The key receiving unit 32a is connected to the common key generating unit 33a.
[0052]
The common key generation unit 33a calculates a function associated with the number of updates of the secret key for the user terminal 30b {h₀(・), H₁(・),…, H_N(.)} Is selected, and a common key for the user terminal 30b is generated based on the selected function and an ID unique to the user of the user terminal 30b.
[0053]
Specifically, the common key generation unit 33a refers to the update count information p published on the database 10, and determines a function associated with the update count of the secret key for the user terminal 30b {h₀(・), H₁(・),…, H_NSelect from (•)}. For example, when the user S of the user terminal 30b whose e-mail address is S has updated the secret key j times from the update count information p, the common key generation unit 33a_jSelect (・) and h based on email address S_jGet (S).
[0054]
The common key generation unit 33a generates a common key for the user terminal 30b with K: = d_char(char '). Where char ’is the acquired h_j(S) is used. d_charIs a secret key for the user terminal 30 a generated by the key issuing unit 23. In this way, the common key generation unit 33a can generate a common key that can be used for communication with the user S of the user terminal 30b. The common key generation unit 33a is connected to the information transmission unit 34a and the information reception unit 35a.
[0055]
In the present embodiment, the information transmission unit 34a transmits encrypted information to the user terminal 30b using a common key with the user terminal 30b generated by the common key generation unit 33a. .
[0056]
In this embodiment, the information receiving unit 35a receives the encrypted information from the user terminal 30b, and uses the common key with the user terminal 30b generated by the common key generating unit 33a to receive the received information. Decrypt.
[0057]
In the present embodiment, the user terminal 30b has the same functions as the user terminal 30a. The issue request transmission unit 31b, the key reception unit 32b, the common key generation unit 33b, the information transmission unit 34b, And an information receiving unit 35b. In this embodiment, the common key generation unit 33b provided in the user terminal 30b uses the common key for the user terminal 30a as K: = d._{char '}Generate by (char). Where char is the acquired h_i(U) is used. d_{char '}Is a secret key for the user terminal 30b generated by the key issuing unit 23.
[0058]
(Key distribution method by the key distribution system according to the present embodiment)
Next, a key distribution method by the key distribution system according to the present embodiment will be described. 3 to 5 show a sequence of the key distribution method according to the present embodiment.
[0059]
First, the key management server 20 generates secret information (y) based on a predetermined method (such as generating a two-variable symmetric polynomial f (x, y) on GF (q) over a finite field) (S1). ).
[0060]
Further, the key management server 20 publishes update number information p indicating the number of times the secret key is updated for the user terminals 30a and 30b on the database 10 (S2). Further, the key management server 20 may, for example, use a predetermined formula (h_i(X) = x + r_i) Family of functions {h₀(・), H₁(・), ..., h_N(.)} Is published on the database 10 (S3).
[0061]
The user terminal 30a transmits a private key issuance request to the key management server 20 (S4).
[0062]
The key management server 20 receives the first private key issuance request from the user terminal 30a (S5). Next, the key management server 20 selects h from the family of functions disclosed by the database 10 based on the email address U of the user U.₀Select (・) and h₀(U) is acquired (S6).
[0063]
Furthermore, the key management server 20 uses the secret information (d) generated in step S1 and h₀(U) is used to determine the predetermined formula (d_char= f (char, y)) The first secret key (d_charOr g_{0, U}) Is issued (S7).
[0064]
The key management server 20 sends the secret key (g_{0, U}) Is transmitted to the user terminal 30a (S8).
[0065]
The user terminal 30a uses the secret key r issued in step S7._{0, U}Is received (S9).
[0066]
Next, the user terminal 30a transmits an i-th private key issuance request to the key management server 20 (S10). Note that the reason why the user terminal 30a updates the secret key is, for example, leakage or loss of the secret key.
[0067]
The key management server 20 receives the i-th private key issuance request from the user terminal 30a (S11). Next, the key management server 20 updates the update count information p of the user U as the user U of the user terminal 30a updates the i-th secret key (S12).
[0068]
Next, the key management server 20 discloses the update number information p updated in step S12 on the database 10 (S13). Further, the key management server 20 refers to the update count information p published on the database 10 and refers to the function h associated with the update count of the private key for the user U._iSelect (・) and h based on email address U_i(U) is acquired (S14).
[0069]
Furthermore, the key management server 20 uses the secret information (y) generated in step S1 and h_i(U) and the predetermined formula (d_char= f (char, y)) i-th secret key (d_charOr g_{i, u}) Is issued (S15).
[0070]
The key management server 20 sends the secret key (g_{i, u}) Is transmitted to the user terminal 30a (S16).
[0071]
The user terminal 30a receives the secret key (g_{i, u}) Is received (S17).
[0072]
Next, in order to generate a common key with the user terminal 30a, the user terminal 30b obtains the update count information p published on the database 10 (S18), and the user terminal 30b performs step S18. The update count i of the decryption key performed so far by the user U is acquired from the update count information p acquired in step S19 (S19). Furthermore, the user terminal 30b calculates the value h from the email address U of the user U and the acquired number of updates i._i(U) is acquired (S20).
[0073]
Next, the user terminal 30b obtains the value h acquired in step S20._i(U) is used to determine the predetermined formula (K: = d_{char '}(char)), a value (k) that becomes a common key with the user terminal 30a_{s, u}) Is calculated (S21). Note that the private key d for the user terminal 30b_{char '}Can use the secret key received from the key management server by the user terminal 30b by the same method as described in steps S4 to S9 or steps S10 to S17.
[0074]
The user terminal 30b uses a predetermined formula (K: = d_{char '}(char)) is generated as a common key with the user terminal 30a (S22).
[0075]
The user terminal 30a can generate a common key with the user terminal 30b by the same method as described in steps S18 to S22. The user terminal 30a and the user terminal 30b each generate a common key by the above-described method, thereby performing encrypted communication between the user terminal 30a and the user terminal 30b using the common key. be able to.
[0076]
The key distribution system and the key distribution method according to this embodiment have been described above by taking, as an example, the key distribution based on the ID unique to the user using the bolm method (predetermined method). The key distribution method that can be used in the system and the key distribution method is not limited to the blom method, and of course, other methods can be used to distribute the key based on the user-specific ID described in this embodiment. It can also be done.
[0077]
(Operations and effects of key distribution system and key distribution method)
According to the key distribution system and the key distribution method according to the present embodiment, a family of functions {h₀(・), H₁(・), ..., h_N(·)} Value obtained from (eg h_iSince the secret key is generated and issued based on (U)), it is possible to update the key, which was difficult in the conventional key distribution based on the ID.
[0078]
According to the present embodiment, since the key management server 20 updates the secret key corresponding to the ID unique to the user in response to the issuance request from the user U, the user U of the user terminal 30a Without changing the ID, it is possible to update the secret key as soon as the secret key is leaked or lost.
[0079]
Further, according to the present embodiment, as a function for generating a secret key published on the database 10, h_i(X) = x + r_iAnd x (user-specific ID) and r_iThe value h based on the email address U of the user U by using the value represented by (random noise) by a predetermined error correction code_iSince (U) and the value used by other users are not the same, it is possible to avoid the situation where the same secret key is issued to different users, and higher security Can be secured.
[0080]
【The invention's effect】
As described above, according to the present invention, it is possible to provide a key distribution method and a key distribution system based on an ID that can update a key.
[Brief description of the drawings]
FIG. 1 is an overall configuration diagram of a key distribution system according to an embodiment of the present invention.
FIG. 2 is a diagram showing a block configuration of a database, a key management server, and a user terminal according to the embodiment of the present invention.
FIG. 3 is a sequence diagram showing a key distribution method according to the present embodiment.
FIG. 4 is a sequence diagram showing a key distribution method according to the present embodiment.
[Explanation of symbols]
1. Communication network
10 ... Database
20 ... Key management server
21 ... Issuance request receiving part
22 ... Secret information generator
23 ... Key issuing department
24: Key transmission unit
25. Information update part
30a, 30b ... User terminal
31a, 31b ... Issuance request transmitter
32a, 32b ... key receiving unit
33a, 33b ... Common key generation unit
34a, 34b ... information transmission unit
35a, 35b ... Information receiver

Claims (7)

A key distribution method comprising a key management server, a first user terminal, and a second user terminal, and using a secret key based on identification information unique to the user,
The key management server uses a database for a group to which a plurality of user terminals belong, and a group of functions configured by functions uniquely associated with each of the number of updates of the secret key, and the use A step A for releasing the number of updates of the secret key issued to each of the subscriber terminals to the group;
Step B in which the first user terminal belonging to the group transmits a request for issuing a secret key for the user terminal to the key management server using an issue request transmission unit ;
Step C where the key management server updates the number of updates of the secret key for the first user terminal using an information update unit ;
Wherein the key management server, using the key issuing unit to select the function associated with the number of updates of the secret key for the first user terminal in response to the issue request, and the function that the selected Issuing a secret key to the user terminal by a predetermined method capable of performing key distribution based on the individual identification information to the user based on the identification information unique to the user of the first user terminal D,
Step E in which the key management server transmits the secret key issued in Step D to the first user terminal using a key transmission unit ;
It said first user terminal, using the common key generation unit, the second selecting the function associated with the number of updates of the private key to the user terminal, the function and the second was the selected And a step F of generating a common key with the second user terminal based on identification information unique to the user of the user terminal and a secret key for the first user terminal. Key distribution method to be used. The family of functions includes identification information unique to the user encoded by a predetermined error correction code and (N + 1) different random noises r ₀ ,..., R that can be corrected by the error correction code. _{And N} is an expression h _i (x) = x + r _i (where x is identification information unique to the user and i is 0 ≦ i ≦ N). The key distribution method according to 1. A key distribution system comprising a key management server, a first user terminal, and a second user terminal, and using a secret key based on identification information unique to the user,
The key management server
For a group to which a plurality of user terminals belong, a family of functions configured by a function uniquely associated with each of the number of times of update of the secret key, and the issued to each of the user terminals An information disclosing means for disclosing the number of updates of the private key;
Issuance request receiving means for receiving a secret key issuance request for the first user terminal from the first user terminal belonging to the group;
Updating means for updating the number of updates of the secret key for the first user terminal;
In response to the issuance request, the first select the function associated with the number of updates of the private key to the user terminal, the selected said function and said first and user terminal user to the specific A secret key issuing means for issuing a secret key for the first user terminal by a predetermined method capable of performing key distribution based on the individual identification information based on the identification information ;
A secret key transmitting means for transmitting the secret key issued by the secret key issuing means to the first user terminal,
The first user terminal is
An issuance request transmitting means for transmitting a secret key issuance request for the first user terminal to the key management server;
A key receiving means for receiving a secret key for the first user terminal transmitted by the key management server; and the function associated with the number of updates of the secret key for the second user terminal belonging to the group. select, based on the secret key for said unique identification information to the user of the said function to said selected second user terminal the first user terminal, the common and the second user terminal A key distribution system comprising: a common key generation unit that generates a key. The family of functions includes identification information unique to the user encoded by a predetermined error correction code and (N + 1) different random noises r ₀ ,..., R that can be corrected by the error correction code. _{And N} is an expression h _i (x) = x + r _i (where x is identification information unique to the user and i is 0 ≦ i ≦ N). 3. The key distribution system according to 3. A key management server in a key distribution system using a secret key based on identification information unique to a user of a first user terminal ,
For a group to which a plurality of user terminals belong, a family of functions configured by a function uniquely associated with each of the number of times the secret key is updated, and a secret issued to each of the user terminals An information disclosing means for disclosing the number of key updates;
Issuance request receiving means for receiving a secret key issuance request for the first user terminal from the first user terminal belonging to the group;
Updating means for updating the number of updates of the secret key for the first user terminal;
In response to the issuance request, the first select the function associated with the number of updates of the private key to the user terminal, the selected said function and said first and user terminal user to the specific A secret key issuing means for issuing a secret key for the user terminal by a predetermined method capable of performing key distribution based on the individual identification information to the user based on the identification information ;
A key management server, comprising: a secret key transmitting unit configured to transmit the secret key issued by the secret key issuing unit to the first user terminal. The function family includes identification information unique to the user encoded by a predetermined error correction code and (N + 1) different random noises r ₀ ,..., R _N that can be corrected by the error correction code. The expression h _i (x) = x + r _i (where x is identification information unique to the user and i is 0 ≦ i ≦ N). The key management server described. A secret issued by a predetermined method capable of performing key distribution based on individual identification information to the user based on a function associated with the number of times the secret key is updated and identification information unique to the user A mobile communication terminal used in a key distribution system using a key,
An issuance request sending means for sending a secret key issuance request to the mobile communication terminal to the key management server;
Key receiving means for receiving a secret key for the mobile communication terminal transmitted by the key management server;
Unique to the mobile communication terminal selects the function associated with the number of updates of the private key to other mobile communication terminals belonging to a group belonging user with the function that the selected said another mobile communication terminal And a common key generating means for generating a common key with the other mobile communication terminal based on the identification information of the mobile communication terminal and a secret key for the mobile communication terminal.

Images