JP4868259B2 - Network system and method for updating secret seed of terminal device in network system - Google Patents

Description

  The present invention relates to a method for realizing secret seed update of a terminal device in a network system provided with encryption key management based on attribute values.

  As a technique related to the present invention, a network system including an encryption key management method for realizing a communication message encrypted by a terminal device or a server using a key configuration based on their attributes by multicast, see FIG. To explain.

  In FIG. 7, [center], [head office], [branch office], and [group] indicate attributes. An organization composed of a network connecting these attributes has a pyramid structure in the order of attributes of [head office], [branch office], and [group] with [center] at the top.

  One or more terminal devices are connected to [Group]. The terminal devices in [Group] transmit the status information of the devices to which the terminal devices are connected to the network, and each attribute can receive the status within the range of the reception authority each has. The reception authority may be distinguished depending on, for example, whether or not decryption is possible in encryption or authentication, or whether or not authentication is possible.

  1-1-1 denotes a center server, which can manage an organization configured by a network, that is, a server of each attribute under the network and terminal devices in [Group]. Reference numerals 1-1-2 and 1-1-3 denote different head office servers, and branch office servers and group servers under the head office servers and terminal devices in [Group] can be managed. 1-1-4, 1-1-5, 1-1-6, and 1-1-7 represent different branch office servers, and manage the group servers under them and the terminal devices in [Group]. it can. Reference numerals 1-1-8 to 1-1-15 each denote a group server, which can manage terminal devices in the [group] under the group server.

  Here, a plurality of terminal devices in [Group] can be expressed by attribute values. For example, the attribute values (IDx, IDy, IDz) of the terminal devices in the group server 1-1-8 can be expressed as (001, 001, 001). Further, the attribute values (IDx, IDy, IDz) of the terminal devices in the group server 1-1-13 can be expressed as (002, 001, 002).

  As described above, a method is proposed in which an attribute value can be assigned to a terminal device by representing the structure in which each branch of the network spreads in stepwise attribute values and assigning the attribute value to the terminal device at the end of the branch structure. Has been. In addition, it has also been proposed to use the terminal device as an encryption key or an authentication key by performing a hash operation after connecting the attribute values of the terminal devices (see, for example, Patent Document 1).

JP 2008-124848 A

  In the above proposal, by using the IP multicast method, the center server that knows the attribute value simply transmits the multicast packet and uses the same encryption key for a plurality of terminal devices in a certain [group]. Proposals have been made to enable secure communication. Furthermore, in the authentication, by using the IP multicast method, it was necessary to transmit the packet by the number of times of the number of each attribute before the above proposal, whereas according to the above proposal, only the number of times of the sum of the number of each attribute was required. It only takes the number of packet transmissions. For example, in the case of FIG. 7, eight times (= 2 × 2 × 2) of packet transmissions are required before the above proposal, but according to the above proposals, six times (= 2 + 2 + 2) of packet transmissions are sufficient.

  However, considering the actual operational aspect, each attribute of the network system managed by the attribute value has the following problems.

  For example, in order to continuously maintain the security of the secret key, a secret seed s for generating a key for encryption communication provided at the end of the network system from a center that controls the entire network system for a certain period It is fully possible to set and update. At this time, even if the secret seed s can be updated for an enormous number of terminal devices, all the terminal devices are updated at the same time by using only the update function for the timing of switching to operation by the secret seed s It is difficult. For this reason, depending on the terminal device, the one that uses the former secret seed s and the one that uses the new secret seed (new secret seed s ′) will be temporarily mixed, and encryption communication will not be realized. There is a concern that it will cause great obstacles.

  The present invention is intended to enable the switching from the secret seed s to the operation by the new secret seed s' to be performed almost simultaneously on all the terminal devices.

  Based on the above problems, the present invention, as a method for updating the secret seed s of the terminal device installed in the network system, divides the new secret seed s ′ into a plurality of decomposed secret keys, and then the new secret seed s. 'New secret seed s' distribution means as means for specifying 'use start time', new secret seed s 'regenerating means for generating new secret seed s' from the decomposed secret key set in these terminal devices, and further these terminal devices By providing the new secret seed s ′ valid means for validating the use time of the new secret seed s ′ set to “3”, the timing for switching to the operation by the new secret seed s ′ can be made almost simultaneously in all terminal devices. A network system that can be used is provided.

  Specifically, according to an aspect of the present invention, encryption is performed using a hierarchical key configuration created by a terminal device or server based on an operation with those attribute values based on one secret seed s. In a hierarchical network system having an encryption key management method for distributing communication messages by multicast, a new secret seed s ′ distribution means is provided in a server located at the highest layer in the network system that can update the secret seed s. The new secret seed s ′ distributing means generates a plurality of decomposition keys, and encrypts each of the generated decomposition keys with each of a plurality of encryption keys known to the terminal device, and a new secret seed. Information on the start date and time of operation of the network system using the encryption key calculated based on s ′, and the start date and time of the operation start are referred to as the new secret seed s ′. A secret seed update information (command) obtained by concatenating authentication calculation value information calculated by MAC is generated for the terminal device and transmitted to the terminal device to update and operate the secret seed s. A system is provided.

  In this network system, the new secret seed s 'distributing means distributes the encryption key calculated based on the new secret seed s' directly or indirectly to all servers in the lower layers.

  In the present network system, the terminal device further includes a new secret seed s ′ regenerating unit, and the new secret seed s ′ regenerating unit receives the generated secret seed update information (command) and performs a plurality of encryptions. Separating into divided seeds, decrypting each of the plurality of separated encrypted divided seeds using a plurality of encryption keys known to the terminal device, and performing a predetermined operation on the decrypted encrypted divided seeds The new secret seed s ′ is reproduced by the above, and the result of MAC calculation of the operation start date and time information is compared with the authentication operation value information to update the normal operation start date and time information (command ).

  In this network system, the server located at the highest layer in the network system further includes a new secret seed s ′ valid means, and the new secret seed s ′ valid means is distributed to the terminal device by the server. If the new secret seed s ′ and the new encryption key distributed directly or indirectly by the server to all servers are reached according to the operation start date and time information, the operation start date and time Prior permission to start the operation by switching to the new secret seed s ′ regenerated by the new secret seed s ′ regenerating means and the encryption key calculated based on the new secret seed s ′ is given to the entire operation of the network system.

  According to another aspect of the present invention, based on one secret seed s, a communication message encrypted by a terminal device or a server using a hierarchical key configuration created from operations with those attribute values is stored. A secret seed s update method for a terminal device in a hierarchical network system having an encryption key management method distributed by multicast, wherein the server located at the highest hierarchy in the network system can update only the secret seed s. A plurality of decomposition keys are generated and each of the generated decomposition keys is encrypted with each of the plurality of encryption keys known to the terminal device, and an encryption key calculated based on the new secret seed s ′ Information on the start date and time of the operation of the network system used, and an authentication performance obtained by MAC calculation of the start date and time of the operation with the new secret seed s ′ The secret seed update information by concatenating the value information (command), a secret seed s update method of a terminal device in the network system and generates the friendly the terminal device is provided.

  In this secret seed s update method, the server located in the highest hierarchy in the network system directly or indirectly transmits the encryption key calculated based on the new secret seed s ′ to all servers in the lower hierarchy. To distribute.

  In the secret seed s update method, the terminal device receives the generated secret seed update information (command), separates it into a plurality of encrypted divided seeds, and a plurality of ciphers known to the terminal device. Each of the plurality of separated encrypted divided seeds is decrypted using a key, and a new calculation is performed on the decrypted encrypted divided seeds to reproduce a new secret seed s ′. And the result of MAC calculation of the time information and the calculation value information for authentication are compared, and it is determined that it is the due date and time of the regular operation start.

  In the secret seed s update method, the server located at the highest layer in the network system further includes a new secret seed s ′ distributed to the terminal device by the server, and the server directly or indirectly to all servers. The new encryption key distributed in accordance with the operation start date and time information, and when the operation start date and time are reached, the new encryption key regenerated in the terminal device for the entire operation of the network system. Prior permission to start operation by switching to the secret seed s ′ and the encryption key calculated based on it is given.

  According to the present invention, since the server located at the highest level in the network system has the new secret seed s ′ distribution means, a plurality of new secret seeds s ′ of the terminal devices installed in the network system can be obtained. It is possible to specify the use start time of the new secret seed s ′ while maintaining confidentiality by dividing the key into the decomposition keys. As a result, the timing for switching from the secret seed s to the operation using the new secret seed s ′ can be performed almost simultaneously on all the terminal devices.

It is a figure which shows the basic composition of the network system concerning embodiment of this invention. It is the figure which showed the terminal device which comprises each of the some group shown by FIG. It is a figure for demonstrating the structure of the new secret seed s' distribution means with which the center of FIG. 1 is equipped. It is a figure for demonstrating the new secret seed s' reproduction | regeneration means with which the terminal device of FIG. 2 is equipped. It is the figure which showed the sequence for demonstrating operation | movement of the 1st Example of this invention. It is the figure which showed the sequence for demonstrating the operation | movement of the 2nd Example of this invention. It is the figure which showed the basic composition of the network system in order to demonstrate the technique relevant to this invention.

  The present invention provides a network system including an encryption key management method for realizing a multicast communication message encrypted by a terminal device or a server using a key configuration based on those attributes. In order to implement | achieve, it is characterized by providing the following means.

  That is, the network system according to the embodiment of the present invention is an implementation means that can divide the secret seed s of the terminal device installed in the network system into a plurality of decomposed secret keys and specify the use start time of the new secret seed s ′. New secret seed s ′ distribution means, new secret seed s ′ regenerating means for generating new secret seed s ′ from the decomposed secret key set in these terminal devices, use of new secret seed s ′ set in these terminal devices A new secret seed s ′ valid means for validating the time is provided as a constituent element. It should be noted that the subsequent start time includes not only the time but also the due date.

  A network system according to an embodiment of the present invention will be described with reference to FIG. In FIG. 1, the same components as those described in FIG.

  As described in FIG. 7, in FIG. 1, [center], [head office], [branch office], and [group] indicate attributes. An organization composed of a network connecting these attributes has a pyramid structure (hierarchical structure) in the order of [head office], [branch office], and [group] attributes starting with [center].

  One or more terminal devices are connected to [Group]. The terminal devices in [Group] transmit the status information of the devices to which the terminal devices are connected to the network, and each attribute can receive the status within the range of the reception authority of each. The reception authority may be distinguished depending on, for example, whether or not decryption is possible in encryption or authentication, or whether or not authentication is possible.

  The center server 1-1-1 'can manage the organization configured by the network, that is, the server of each attribute under its control and the terminal devices in [Group]. Each of the head office servers 1-1-2 and 1-1-3 can manage branch office servers and group servers under its control, and terminal devices in the [group]. Each of the branch office servers 1-1-4 to 1-1-7 can manage the group servers under its control and the terminal devices in the [group]. Each of the group servers 1-1-8 to 1-1-15 can manage terminal devices in the [group] under its control.

  A plurality of terminal devices in [Group] can be expressed by attribute values. For example, the attribute values (IDx, IDy, IDz) of the terminal devices in the group server 1-1-8 can be expressed as (001, 001, 001). Further, the attribute values (IDx, IDy, IDz) of the terminal devices in the group server 1-1-12 can be expressed as (002, 001, 001).

  Similarly, each server can also be expressed by an attribute value. For example, the attribute values (IDx, IDy, IDz) of the head office server 1-1-2 can be expressed as (001,000,000). The attribute values (IDx, IDy, IDz) of the branch office server 1-1-7 can be expressed as (002, 002,000).

  FIG. 2 shows terminal devices that each of [Group] 1-1-8 to [Group] 1-1-15 shown in FIG. 1 configures. According to FIG. 2, it can be seen that each terminal device under each [group] of eight attribute values (IDx, IDy, IDz) has a unique number (unique ID). The unique number is a unique identifier and indicates, for example, a vendor name concatenated with a manufacturing number. In FIG. 2, it can be seen that four terminal devices are connected to each [group]. That is, taking the attribute value (IDx, IDy, IDz) = (001, 001, 001) as an example, the terminal devices configured therein are the terminal device (N001) 1-2-1, the terminal device ( N002) 1-2-2, terminal equipment (N003) 1-2-3, and terminal equipment (N004) 1-2-4.

  In this embodiment, in addition to the above configuration, the following means are added to each attribute. That is, the center server 1-1-1 ′ located in the highest hierarchy in FIG. 1 adds the new secret seed s ′ effective means in addition to the new secret seed s ′ distribution means 1-1-1-1 shown in FIG. 1-1-1-2. On the other hand, the terminal device 1-2-1 shown in FIG. 2 includes a new secret seed s ′ regenerating unit 1-2-1-1. In FIG. 2, for the sake of convenience, it is shown that the new secret seed s ′ regeneration means 1-2-1-1 is added only to the terminal device 1-2-1, but the new secret seed s ′ regeneration means is applied to all terminals. Added to the equipment.

  Next, with reference to FIG. 3, the new secret seed s ′ distributing unit 1-1-1-1 which is a main part of the present embodiment will be described.

  FIG. 3 is shown in FIG. 1 to deliver a new secret seed (new secret seed s ′) to all [terminal devices] 1-2-1, 1-2-2, 1-2-3, etc. 2 shows a basic configuration necessary for realizing the new secret seed s ′ distributing means 1-1-1-1 installed in the center server 1-1-1 ′.

  The basic configuration shown in FIG. 3 consists of two parts. One is a decomposition key encryption unit 1-3-20, and the other is an authentication information generation unit 1-3-21. The secret seed s update output 1-3-15 is formed by concatenating information generated in these two parts and generating a command.

  First, in the decomposition key encryption unit 1-3-20, the decomposition key generation unit 1-3-1 generates arbitrary four decomposition keys s1, s2, s3, and s4, and a new secret seed s ′ = s1 ^ s2 Let ^ s3 ^ s4. The symbol ^ indicates exclusive OR. Alternatively, the new secret seed s' may be determined first, and four decomposition keys s1, s2, s3, and s4 may be obtained so as to obtain a similar calculation solution.

  Next, four keys known by the terminal device, that is, a data key s1-3-2 (secret seed s), an authentication key asz1-3-3, an authentication key afy1-3-4, and an authentication key acx1-3-5 Are used to encrypt the four decomposition keys with the cryptographic calculators 1-3-6, 1-3-7, 1-3-8, and 1-3-9, respectively, and concatenated with the concatenator 1-3-10. Here, the secret seed s is also used as a key for data encryption.

  On the other hand, in the authentication information generating unit 1-3-21, the center server 1-1-1 ′ is correct in all [terminal devices] 1-2-1, 1-2-2, 1-2-3, etc. The following authentication information expression (1) is created by the center server 1-1-1 ′ in order to authenticate that the information is received from the center server 1-1-1 ′.

    [start_time] || MAC (s ’, [start_time]) (1)

  The symbol || indicates that the values on either side of the symbol or the value of the expression are simply concatenated. MAC means Message Authentication Code. For example, MAC (key3, ΔΔΔ) indicates a value obtained by performing a MAC operation on ΔΔΔ using the authentication key Key3. E (k, s) indicates a ciphertext obtained by encrypting the data s with the encryption key k.

  Expression (1) is obtained by using the start time [start_time] generated by the clock unit 1-3-11 that generates the start time for using the new secret seed s ′ and the new secret seed s′1− generated as the authentication key. 3-13 is subjected to MAC computation by the MAC computing unit 1-3-12. Subsequently, the MAC calculation value (authentication calculation value information) is concatenated as authentication information 1-3-14, and is concatenated with the information from the decomposition key encryption unit 1-3-20 by the concatenator 1-3-10. Finally, the following expression (2) is output as secret seed s update output {secret seed update information (command)} 1-3-15. [Chg_sk_full_z1] at the head of the formula (2) is a command for executing this function on the terminal device.

    [chg_sk_full_z1] || E (s, s1) || E (asz, s2) || E (afy, s3) || E (acx, s4) || start_time || MAC (s ’, start_time) (2)

  Next, with reference to FIG. 4, the new secret seed s ′ reproducing means that is a main part of the present embodiment and is provided in the terminal device will be described. FIG. 4 includes a new secret seed s ′ reproducing unit 1-4-20 and an authentication information confirming unit 1-4-21.

  The new secret seed s ′ regenerating unit 1-2-1-1 separates the following formulas (3) and (4) from the formula (2) to obtain the new secret seed s ′ and the new secret seed s ′. The start time used for operation is obtained at the same time, and the start time is used as authentication information. These correspond to the distribution of the secret seed information shown in FIG. 4 to the separation unit 1-4-1 and the authentication information 1-4-13.

    E (s, s1) || E (asz, s2) || E (afy, s3) || E (acx, s4) (3)

    start_time (4)

  As is apparent from the equation (3), the data key s1-4-2, the authentication key asz1-4-3, the authentication key afy1-4-4, and the authentication key acx1-4-5 are used, and each decryption operator 1- From each output of the split key decrypted by 4-6, 1-4-7, 1-4-8, and 1-4-9, a new secret seed s is obtained by using a split key reproduction computing unit 1-4-10. 'Can be obtained by the calculation of s' = s1 ^ s2 ^ s3 ^ s4.

  Also, the start time for using the new secret seed s ′ for operation can be known from the equation (4), and authentication is performed using the newly obtained new secret seed s ′ output 1-4-15 as an authentication key. An authentication result determination 1-4-14 can be obtained from the information 1-4-13 via the MAC computing unit 1-4-12 and the comparator 1-4-11.

  Next, a new secret seed s ′ validating unit 1-1-1-2 which is a main part of the present embodiment and is provided in the center server 1-1-1 ′ will be described.

  The function of the new secret seed s ′ valid means 1-1-1-2 is the following execution formula (5) for instructing that the start time start_time using the new secret seed s ′ for operation is functioned again. It is established by the commands (6) and (7).

    [enbl_full_x] || count || MAC (acx, count) (5)

    [enbl_full_y] || count || MAC (afy, count) (6)

    [enbl_full_z] || count || MAC (asz, count) (7)

  Therefore, it may be considered as a condition that it is necessary to be able to confirm that Expression (2) is distributed to all terminal devices before this command is issued. In this way, at least the new secret seed s ′ distribution means 1-1-1-1 alone cannot start the operation based on the new secret seed s ′, thereby realizing a so-called failsafe function. ing.

  The counts in the equations (5) to (7) are numerical values that are incremented each time a command is issued (or may be a random number) and are used to know which command is to be confirmed when confirming the command.

[First embodiment]
FIG. 5 shows a sequence of a first embodiment in which the secret seeds s of all terminal devices under the organization with the center at the top are updated and distributed. In the first embodiment, the attributes below [center] are defined as [head office]: IDx, [branch office]: IDy, [group]: IDz. However, in order to simplify the explanation of the operation, no server is provided in [Group] among the servers of each attribute. Instead, a subnetwork is constructed with communication devices such as gateways, and the subnetwork is set as an attribute group IDz of a terminal device. Therefore, the branch office server bears the attribute IDz of [Group] substantially.

  The sequence of the first embodiment can be described by being divided into the following sequences (1) to (7).

(1) New data key distribution
(2) Distribution of new secret seed s'
(3) Confirmation and aggregation of new secret seed s' received by terminal equipment at branch office
(4) Confirmation and aggregation of reception of new secret seed s' at the head office
(5) Confirmation of receipt of new secret seed s' at the head office at the center
(6) Operation permission for new secret seed s'
(7) Confirmation reply of operation permission
(8) Start operation with new secret seed s'

[Configuration of the first embodiment]
The basic configuration of the first embodiment is the same as FIG.

  [Center] 1-1-1 ′, [Headquarters] 1-1-2, 1-1-3, [Branch] 1-1-4 to 1-1-7, [Group] 1-1-8 to 1 The existing possession information in -1-15 is defined as follows.

[Center] Secret seed: s, attribute key: acx, afy, asz, unique number of terminal device and attribute values IDx, IDy, IDz are known.
[Head office] Data key dcx, attribute keys: acz, af0, as0
“Branch” data key dfxy, attribute keys: acx, afy, as0
[Group] Data key dsxyz, attribute keys: acx, afy, asz
[Terminal device] Secret seed: s, data keys dcx, dfxy, dsxyz, attribute keys: acx, afy, asz, own unique number and attribute values IDx, IDy, IDz are known.

  However, the branch server manages what corresponds to the attribute server of [Group].

[Operation of the first embodiment]
As described above, the sequence of the first embodiment includes (1) distribution of new data key, (2) distribution of new secret seed s ′, and (3) confirmation authentication of reception of new secret seed s ′ of the terminal device at the branch office. (4) Confirmation and aggregation of reception of new secret seed s ′ of the branch office at the head office, (5) Confirmation of reception of new secret seed s ′ of the head office at the center, (6) Operation permission of the new secret seed s ′, ( 7) The operation permission confirmation reply is divided into seven, and each will be described with reference to FIG.

(1) Distribution of New Data Key As shown in Sequence 2-1, a new data key dcx ′ for the head office is encrypted from the center with the previous data key dcx and sent to the head office.

    E (dcx, dcx ’)

  Next, as shown in sequence 2-2, the head office generates a new data key dfxy ′ for the branch office based on the received new data key dcx ′, encrypts it with the previous data key dfxy, and sends it to the branch office. .

    E (dfxy, dfxy ')

  Next, as shown in sequence 2-3, the branch office generates a new data key dsxyz 'for the group based on the received new data key dfxy', encrypts it with the previous data key dsxyz, and sends it to the group. . However, in this example, the branch office and the group are the same server.

    E (dsxyz, dsxyz ’)

  The new data keys dcx ', dfxy', and dsxyz 'are temporarily stored in each server, but are used by replacing the old data key from the operation permission timing described later.

(2) Distribution of new secret seed s' As shown in sequence 2-4, secret seed s is updated for the attribute server under the center. That is, the center distributes information obtained by encrypting start_time with the authentication key acx by multicast according to the following execution formula in order to make the time at which a series of data keys are updated known.

    [chg_sk_full_z0] || E (acx, start_time)

  Subsequently, as shown in Sequence 2-5, the center encrypts the new secret seed s ′ in the form of a decomposition key for all terminal devices, and further uses start_time as the authentication key for the new secret seed s ′. Send it with authentication information.

    [chg_sk_full_z1] || E (s, s1) || E (asz, s2) || E (afy, s3) || E (acx, s4) || start_time || MAC (s ’, start_time)

(3) Confirmation Authentication and Aggregation of New Secret Seed s ′ Reception of Terminal Device at Branch Office As shown in Sequence 2-7, if the reception authentication of the secret seed s ′ from the center is OK in the terminal device, the branch office Receives the next execution expression as a response.

    [chg_sk_full_res] || E (dsxyz, i || [auth_ok] || ni)

Where ni = count || MAC (acx ^ afy, count)
[chg_sk_full_res] indicates a response. Here, the symbol ^ indicates an exclusive OR of acx and afy.

  In this state, [chg_sk_full_res] or less is sent as a response to the branch office by unicast.

  ni represents an execution command for the terminal device to have the branch office authenticate itself (terminal device). At the branch office, the MAC value of count is calculated using the authentication key acx ^ afy, and the same MAC value is obtained. That is, the authentication OK can be confirmed by having the same authentication key acx ^ afy as each terminal device.

  After that, the branch office sends back the authentication result obtained by calculating the execution command ni for having the terminal equipment authenticate itself (terminal equipment) to the branch office to the terminal equipment using the following execution formula. Is omitted.

    auth_ok ⇒ [chg_sk_full_res] || E (dsxyz, [auth_ok] || i)

  [chg_sk_full_res] indicates a response. As it is, [chg_sk_full_res] or less is unicasted to the terminal device as a response.

  [auth_ok] indicates the result of authenticating the terminal device at the branch office. I indicates the unique number of the terminal device.

(4) Confirmation and Aggregation of New Secret Seed s' Update at Branch Office at Head Office As shown in Sequence 2-8, the head office receives the authentication result of the terminal device aggregated at each branch office as a response with the following execution formula .

    [chg_sk_full_res] || E (dfxy, IDy || pi || ∀ [auth_ok] || IDx || IDy || IDz || i)

Where pi = count || MAC (acx, count)
[chg_sk_full_res] indicates a response. In this state, [chg_sk_full_res] or less is sent as a response to the head office as a response.

  ∀ means aggregation of authentication results from terminal devices collected by an expression (or a set of expressions) following ∀.

  pi indicates an execution command for the branch office to have the head office authenticate itself (branch office). At the head office, the MAC value of count is calculated using the authentication key acx, and the same MAC value is obtained. That is, the head office has the same authentication key acx as each branch office, so that the authentication OK can be confirmed.

  After that, the head office sends back the authentication result obtained by calculating the execution command pi that the branch office has to authenticate itself (branch office) to the branch office using the following execution formula, but the sequence illustration in FIG. 5 is omitted. .

    auth_ok ⇒ [chg_sk_full_res] || E (dfxy, [auth_ok] || IDy)

  [chg_sk_full_res] indicates a response. In this state, [chg_sk_full_res] or less is sent as a response to the branch office by unicast.

  [auth_ok] indicates the result of authenticating the branch office at the head office. IDy indicates the attribute of the authenticated branch office.

(5) Confirmation of renewal of new secret seed s' at the head office at the center
As shown in Sequence 2-9, the center receives the following execution formula as a response to the authentication result of the terminal device aggregated for each head office.

    [chg_sk_full_res] || E (dcx, IDx || qi || ∀ [auth_ok] || IDx || IDy || IDz || i)

However, qi = count || MAC (acx ^ af0 ^ as0, count)
[chg_sk_full_res] indicates a response. As it is, [chg_sk_full_res] or less is unicasted as a response to the center.

  qi indicates an execution command for the head office to have the center authenticate itself (head office). At the center, the MAC value of count is calculated using the authentication key acx ^ af0 ^ as0, and the same MAC value is obtained. That is, the authentication is OK because the center has the same authentication key acx ^ af0 ^ as0 as each head office. I can confirm.

  Thereafter, the center sends back the authentication result obtained by calculating the execution command qi for the head office to authenticate itself (head office) to the head office using the following execution formula, but the sequence illustration in FIG. 5 is omitted. .

    auth_ok ⇒ [chg_sk_full_res] || E (dcx, [auth_ok] || IDx)

  [chg_sk_full_res] indicates a response. In this state, [chg_sk_full_res] or less is sent as a response to the head office as a response.

  [auth_ok] indicates the result of authenticating the head office at the center. IDx indicates the attribute of the head office that has been authenticated.

(6) Operation permission of new secret seed s ′ As shown in sequence 2-10, for each attribute and all terminal devices, permission of IDx indicating the attribute of the head office is executed by the following execution formula. In the first embodiment, the [Center] sends an authentication command.

    [enbl_full_x] || count || MAC (acx, count)

  [enbl_full_x] indicates an execution command. count indicates a count value. In this state, multicast transmission is performed without encrypting [enbl_full_x] and lower.

  [enbl_full_x] The following shows an execution formula that authenticates whether or not the destination attribute IDx is correct and at the same time grants update permission for the new secret seed s'.

  That is, in the terminal device and each attribute, the MAC value of count is calculated with the authentication key acx of the attribute IDx, and the same MAC value is obtained, that is, the attribute IDx in each terminal device and attribute has the same authentication key acx as the center. After confirming this, an update permission for the new secret seed s ′ is given.

  Next, as shown in sequence 2-11, for each attribute and all terminal devices, IDy indicating the branch attribute is executed by the following execution formula.

    [enbl_full_y] || count || MAC (afy, count)

  [enbl_full_y] indicates an execution command. count indicates a count value. In this state, multicast transmission is performed without encrypting [enbl_full_y] and below.

  [enbl_full_y] The following shows an execution expression that authenticates whether or not the destination attribute IDy is correct and at the same time gives permission to update the new secret seed s'.

  That is, in the terminal device and each attribute, the MAC value of count is calculated with the authentication key afy of the attribute IDy, and the same MAC value is obtained, that is, the attribute IDy in each terminal device and attribute has the same authentication key afy as the center. After confirming this, an update permission for the new secret seed s ′ is given.

  Next, as shown in sequence 2-12, permission of IDz indicating the attribute of the group is executed with the following execution formula for each attribute and all terminal devices.

    [enbl_full_z] || (count || MAC (asz, count)

  [enbl_full_z] indicates an execution command. count indicates a count value. In this state, multicast transmission is performed without encrypting [enbl_full_z] and below.

  [enbl_full_z] The following shows an execution formula that authenticates whether or not the destination attribute IDz is correct and at the same time grants update permission for the new secret seed s'.

  That is, in the terminal device and each attribute, the MAC value of count is calculated with the authentication key asz of the attribute IDz, and the same MAC value is obtained, that is, the attribute IDz in each terminal device and attribute has the same authentication key asz as the center. Make sure.

(7) Confirmation Reply for Operation Permission Operation is the same as (3), (4), and (5) above.

(8) Start of operation with new secret seed s ′ Through the above-described series of operations, the new secret seed s ′ and the new data keys dcx ′, dfxy ′, dsxyz ′ are updated and distributed at the same time to start_time for each terminal and server. The new key will be used.

[Effect of the first embodiment]
As described above, when specifically realizing a network system including an encryption key management method in which a terminal device or a server realizes a communication message encrypted using a key configuration based on those attributes by multicast, The first embodiment of the present invention has the following effects.

  The first effect is that the center 1-1-1 ′ has components such as the new secret seed s ′ distribution unit 1-1-1-1 shown in FIG. By dividing the new secret seed s ′ of the terminal device into a plurality of decomposed secret keys, the use start time of the new secret seed s ′ can be specified while maintaining confidentiality.

  The second effect is that the new secret seed s ′ reproducing means 1-2-1-1 is provided in the terminal device, so that the new secret is obtained from the decomposed secret key set in these terminal devices by the first effect. The seed s ′ can be generated.

  The third effect is that, since the center 1-1-1 ′ has components such as the new secret seed s ′ valid means 1-1-1-2, the secret secret s ′ to the new secret seed s ′. The timing for switching to operation by can be implemented almost simultaneously on all terminal devices.

[Second Embodiment]
The basic configuration of the second embodiment of the present invention is the same as that of the first embodiment. However, the second embodiment of the present invention is devised in that the update of the new secret seed s ′ of a single terminal device can be covered by the unicast method. ing.

  FIG. 6 shows a sequence of a second embodiment in which the new secret seed s ′ of one terminal device under the organization with the center at the top is updated. In the second embodiment, the attributes below [Center] are defined as [Head Office]: IDx, [Branch Office]: IDy, [Group]: IDz. However, in order to simplify the explanation of the operation, no server is provided in [Group] among the servers of each attribute. Instead, a subnetwork is constructed with communication devices such as gateways, and the subnetwork is set as an attribute group IDz of a certain terminal device. Therefore, the branch office server bears the attribute IDz of [Group] substantially.

  The sequence of the second embodiment is divided into the following seven.

(1) Distribution of new data key (2) Distribution of new secret seed s' (3) Confirmation and transfer of reception of new secret seed s' of terminal device at branch office (4) Reception of new secret seed s' of terminal device at head office (5) Confirmation of receipt of new secret seed s 'at the head office at the center (6) Permit operation of new secret seed s' (downbound)
(7) Confirmation reply of operation permission (uplink)

  With reference to FIG. 6, each of said (1)-(7) is demonstrated.

(1) Distribution of New Data Key As shown in Sequence 3-1, at the center, the data key dcx ′ for the head office is encrypted with the previous data key dcx and sent to the head office.

    E (dcx, dcx ’)

  Next, as shown in sequence 3-2, at the center, the new data key dfxy 'for the branch office is encrypted with the previous data key dfxy and sent to the branch office.

    E (dfxy, dfxy ')

  Next, as shown in sequence 3-3, in the center, the new data key dfxy 'for the group is encrypted with the previous data key dsxyz and sent to the group. However, in this example, the branch office and the group are the same server.

    E (dsxyz, dsxyz ’)

(2) Distribution of new secret seed s' (between center and head office)
As shown in sequence 3-4, the following execution formula is sent from the center to the head office. In the second embodiment, only the [center] can issue an update command for the new secret seed s ′.

    [chg_sk] || E (dcx, start_time || MAC (acx ^ af0 ^ as0, start_time) || E (s, s1) || E (asz, s2) || E (afy, s3) || E ( acx, s4))

  [chg_sk] indicates an execution command for updating the new secret seed s ′ of the single terminal device from the center. In this state, [chg_sk] and below are encrypted and unicast transmission is performed.

  [chg_sk] start_time in the first half of the following || MAC (acx ^ af0 ^ as0, start_time) is an executable expression sent to the headquarters to authenticate that the center that sent this command is indeed a legitimate center. Show. That is, in the center server, the MAC value of start_time is calculated with the authentication key acx ^ af0 ^ as0 of the head office and becomes the same MAC value, that is, the attribute key acx ^ af0 ^ as0 at the head office is the same as the authentication key acx ^ af0 ^ Make sure you have as0.

  E (s, s1) || E (asz, s2) || E (afy, s3) || E (acx, s4) after [chg_sk] An execution expression that is encrypted and concatenated is shown.

  Next, as shown in sequence 3-5, the center receives the authentication result at the head office as a response of the next execution formula.

[chg_sk_res] || E (dcx, [auth_ok] || qi)
qi = count || MAC (acx ^ af0 ^ as0, count)

  [chg_sk_res] indicates a response. In this state, [chg_sk_res] or less is unicasted to the center as a response.

  [auth_ok] indicates the result of authenticating the center at the head office. qi indicates an execution command in which the head office has the center authenticate itself (head office). At the center, the MAC value of count is calculated using the authentication key acx ^ af0 ^ as0, and the same MAC value is obtained. In other words, the authentication OK is confirmed by the center having the same authentication key acx ^ af0 ^ as0 as the head office. it can.

  Furthermore, the center sends back to the head office the authentication result obtained by calculating the pi that the head office asks the center to authenticate itself (head office). However, in order to simplify the explanation, the sequence is omitted here.

(Between head office and branch office)
As shown in sequence 3-6, the following execution formula is sent from the head office to the branch office. In the second embodiment, only the center can issue an update command for the new secret seed s ′, and the command is relayed and transmitted.

    [chg_sk] || E (dfxy, start_time || MAC (acx ^ af0 ^ as0, start_time) || E (s, s1) || E (asz, s2) || E (afy, s3) || E ( acx, s4))

  [chg_sk] indicates an execution command for updating the new secret seed s ′ of the single terminal device from the center. In this state, [chg_sk] and below are encrypted and unicast transmission is performed.

  [chg_sk] start_time in the first half of the following || MAC (acx ^ af0 ^ as0, start_time) is an execution formula that is sent to authenticate that the head office that sent this command at the branch office is indeed a regular head office. Show.

  That is, the head office server calculates the MAC value of count with the branch office authentication key acx, and confirms that the MAC value is the same, that is, the attribute key acx at the branch office has the same authentication key acx as the head office.

  In addition, E (s, s1) || E (asz, s2) || E (afy, s3) || E (acx, s4) below [chg_sk] Each execution expression is encrypted.

  Next, as shown in sequence 3-7, the head office receives the authentication result at the branch office as a response of the next execution formula.

[chg_sk_res] || E (dfxy, [auth_ok] || pi)
pi = count || MAC (acx ^ as0, count)

  [chg_sk_res] indicates a response. In this state, [chg_sk_res] or less is sent as a response to the head office.

  [auth_ok] indicates the result of authenticating the head office at the branch office. qi indicates an execution command for the branch office to have the head office authenticate itself (branch office). At the head office, the MAC value of count is calculated using the authentication key acx, and the same MAC value is obtained, that is, the authentication OK can be confirmed by the head office having the same authentication key acx as the branch office.

  Further, the head office sends back to the branch the authentication result obtained by calculating qi that the branch office authenticates itself (branch office), but the sequence is omitted here for the sake of simplicity.

(3) Confirmation and transfer of reception of new secret seed s' of terminal device at branch office
(Between branch office and terminal equipment)
As shown in sequence 3-8, the following execution formula is sent from the branch office to the terminal device. In the second embodiment, it is the [center] that can issue an update command for the new secret seed s ′, and the command is relayed and transmitted.

    [chg_sk] || E (dfxy, start_time || MAC (acx ^ afy ^ asz, start_time) || E (s, s1) || E (asz, s2) || E (afy, s3) || E ( acx, s4))

  [chg_sk] indicates an execution command for updating the new secret seed s ′ of the single terminal device from the branch office. In this state, [chg_sk] and below are encrypted and unicast transmission is performed.

  [chg_sk] start_time in the first half of the following || MAC (acx ^ afy ^ asz, start_time) is an execution formula that is sent to have the branch office that sent this command on the terminal device authenticate that it is a legitimate branch office. Indicates. That is, in the branch office server, the MAC value of count is calculated with the authentication key acx ^ afy ^ asz of the terminal device and becomes the same MAC value, that is, the attribute key acx ^ afy ^ asz in the terminal device is the same as the authentication key acx ^ Make sure you have afy ^ asz.

  E (s, s1) || E (asz, s2) || E (afy, s3) || E (acx, s4) after [chg_sk] Indicates an encrypted execution expression.

Next, as shown in sequence 3-9, the branch office receives the authentication result in the terminal device as a response of the next execution formula.
[chg_sk_res] || E (dsxyz, i || [auth_ok] || ni)
ni = count || MAC (acx ^ afy, count)

  [chg_sk_res] indicates a response. As it is, [chg_sk_res] or less is sent as a response to the branch office by unicast.

  [auth_ok] indicates the result of authenticating the branch office in the terminal device. ni indicates an execution command for the terminal device to have the branch office authenticate itself (terminal device). At the branch office, the MAC value of count is calculated using the authentication key acx ^ afy, and the same MAC value is obtained, that is, the authentication OK can be confirmed by having the same authentication key acx ^ afy as the terminal device.

  Further, the branch office sends back the authentication result obtained by calculating qi, which allows the terminal apparatus to authenticate itself (terminal apparatus) to the branch office, but the sequence is omitted here for the sake of simplicity.

(4) Confirmation and transfer of new secret seed s' received by terminal equipment at head office (between branch office and head office)
As shown in sequence 3-10, the following execution formula is sent from the branch office to the head office. In the second embodiment, it is [Center] that can issue a command to update the new secret seed s ′, and relays and transmits a confirmation report that the command has been executed.

[chg_sk_res] || E (dfxy, IDy || pi || [auth_ok] || IDx || IDy || IDz || i)
pi = count || MAC (acx, count)

  [chg_sk_res] indicates a response that relays and returns a confirmation report on the update of the new secret seed s ′ from the branch office to the head office. In this state, [chg_sk_res] and below are encrypted and unicast transmission is performed.

  [auth_ctr_res] The following shows an execution formula for authenticating that the branch office that sent this command at the head office is indeed a legitimate branch office and sending the terminal device confirmation result to the head office. That is, the branch office server calculates the MAC value of count with the authentication key acx of the head office, and confirms that the MAC value is the same, that is, the attribute key acx at the head office has the same authentication key acx as the branch office. [Auth_ok] || IDx || IDy || IDz || i indicates a confirmation report of the terminal device.

  Further, the head office sends back the authentication result obtained by calculating qi that the branch office has authenticated itself (branch office) to the branch office using an execution formula. However, in order to simplify the explanation, the sequence is omitted here.

(5) Confirmation of receipt of new secret seed s' at the head office at the center
(Between head office and center)
As shown in sequence 3-11, the following execution formula is sent from the head office to the center. In the second embodiment, it is [Center] that can issue a command to update the new secret seed s ′, and relays and transmits a confirmation report that the command has been executed.

[chg_sk_res] || E (dcx, IDx || qi || [auth_ok] || IDx || IDy || IDz || i)
qi = count || MAC (acx ^ af0 ^ as0, count)

  [chg_sk_res] indicates a response that returns a confirmation report of the new secret seed s ′ update from the head office to the center. In this state, [chg_sk_res] and below are encrypted and unicast transmission is performed.

  [chg_sk_res] The following shows an execution formula for authenticating that the head office that sent this command at the center is indeed a regular head office and sending the terminal device confirmation result to the center. That is, in the head office server, the MAC value of count is calculated with the authentication key acx ^ af0 ^ as0 of the center and becomes the same MAC value, that is, the attribute key acx ^ af0 ^ as0 at the center is the same as the authentication key acx ^ af0 ^ Make sure you have as0.

  [Auth_ok] || IDx || IDy || IDz || i indicates a confirmation report of the terminal device. Further, the center sends back the authentication result obtained by calculating ni that the head office has authenticated itself (head office) to the branch office using an execution formula, but the sequence is omitted here for the sake of simplicity.

(6) Operation permission for new secret seed s' (down)
The sequence is basically the same as the sequence 3-4, 3-5, 3-6, 3-7, 3-8 except that the command and response headers are different.

  Of course, it is not necessary to transmit concatenated secret seeds s divided into four. For authentication, count is used instead of start_time.

(7) Confirmation reply of operation permission (uplink)
The sequence is basically the same as the sequences 3-9, 3-10, and 3-11 except that the command and response headers are different.

1-1-1-1 New secret seed s' distribution means
1-1-1-2 New secret seed s' effective means
1-2-1-1 New secret seed s' regeneration means
1-3-20 Decomposed key encryption unit
1-3-21 Authentication information generation unit
1-4-20 New Secret Seed's Reproduction Unit
1-4-21 Authentication Information Confirmation Unit

Claims (9)

Based on one secret seed, it has a cryptographic key management method that distributes multicast communication messages by using a hierarchical key configuration created by terminal devices and servers based on operations with their attribute values. In a hierarchical network system,
A new secret seed distribution means is provided on the server located at the highest level in the network system that can update the secret seed.
The new secret seed distribution means generates a plurality of decomposition keys and based on the information obtained by encrypting each of the generated decomposition keys with each of a plurality of encryption keys known to the terminal device and the new secret seed Secret seed update information obtained by concatenating information on the start date and time of the operation of the network system using the calculated encryption key, and authentication calculation value information obtained by performing MAC operation on the start date and time of the operation using the new secret seed Is generated for the terminal device. The network system according to claim 1,
The network system characterized in that the new secret seed distribution means distributes an encryption key calculated based on the new secret seed directly or indirectly to all servers in a lower hierarchy. The network system according to claim 2,
The terminal device comprises a new secret seed regeneration means,
The new secret seed reproduction means receives the generated secret seed update information, separates it into a plurality of encrypted divided seeds, and uses the plurality of separated ciphers using a plurality of encryption keys known to the terminal device. Each of the encrypted division seeds is decrypted, and a new secret seed is reproduced by performing a predetermined calculation on the decrypted encrypted divided seeds, and the result of the MAC calculation of the operation start date and time information, and A network system characterized in that it compares the operation value information for authentication and determines that it is a due date and time for a regular operation start. The network system according to claim 3,
The server located at the highest layer in the network system further comprises a new secret seed validating means,
The new secret seed validating means includes a new secret seed distributed by the server to the terminal device and a new encryption key distributed directly or indirectly by the server to all servers. Accordingly, if the date and time of the operation start are reached, the operation is performed by switching to the new secret seed regenerated by the new secret seed regenerating means and the encryption key calculated based on the new secret seed regenerating means for the entire operation of the network system. A network system characterized by giving prior permission to start. In the network system according to any one of claims 1 to 4,
The new secret seed distribution means is:
A decomposition key encryption unit that generates a plurality of decomposition keys and encrypts each of the generated decomposition keys with each of a plurality of encryption keys known to the terminal device;
Information on the start date and time of the operation of the network system using the encryption key calculated based on the new secret seed, and calculated value information for authentication obtained by MAC calculation of the start date and time of the operation using the new secret seed An authentication information generation unit that generates the authentication information by concatenating;
A concatenator that concatenates the information encrypted by the decomposition key encryption unit and the authentication information and outputs the information as the secret seed update information;
A network system comprising: Based on one secret seed, it has a cryptographic key management method that distributes multicast communication messages by using a hierarchical key configuration created by terminal devices and servers based on operations with their attribute values. A method for updating a secret seed of a terminal device in a hierarchical network system,
In the server located at the highest hierarchy in the network system that can only update the secret seed, a plurality of decomposition keys are generated and each of the generated decomposition keys is replaced with each of a plurality of encryption keys known to the terminal device. Information on the start date and time of operation of the network system using the encrypted information and the encryption key calculated based on the new secret seed, and authentication obtained by performing MAC operation on the start date and time of the operation using the new secret seed A secret seed update method for a terminal device in a network system, wherein secret seed update information concatenated with operation value information for the device is generated for the terminal device. The secret seed update method according to claim 6,
The server in the network system, wherein the server located in the highest hierarchy in the network system distributes the encryption key calculated based on the new secret seed directly or indirectly to all servers in the lower hierarchy How to update the device secret seed. The secret seed update method according to claim 7,
In the terminal device, the generated secret seed update information is received and separated into a plurality of encrypted divided seeds, and the plurality of separated divided encryption seeds using a plurality of encryption keys known to the terminal device And the new secret seed is reproduced by performing a predetermined operation on the decrypted encrypted divided seed, and the result of the MAC operation of the start date and time information of the operation start and the authentication operation A secret seed update method for a terminal device in a network system, characterized in that value information is compared to determine that the date and time of regular operation start are determined. The secret seed update method according to claim 8,
The server located at the highest hierarchy in the network system further uses the new secret seed distributed by the server to the terminal device and the new encryption key distributed directly or indirectly by the server to all servers. According to the start date and time information, if the operation start date and time are reached, the new secret seed reproduced in the terminal device for the entire operation of the network system and the encryption key calculated based thereon A secret seed update method for a terminal device in a network system, characterized in that prior permission to start operation by switching is given.

Images