JPH0254644A - Method for sharing key - Google Patents

Abstract

PURPOSE:To share a key used for cryptographic communication economically between a host equipment and a terminal equipment and between plural terminal equipments in a network by providing an arithmetic means for algorithm to generate a terminal key to the host, deciding a protection code corresponding to a terminal code of the terminal equipment and deciding the terminal key. CONSTITUTION:In order to allow a possessor of an IC card to subscribe the system, first a terminal code Xi and a protection code Gi are received to the IC card Ti from the host. The host uses the algorithm F to decide Ki=F{fx(P, Gi), Xi} to write the terminal key Ki and the protection code Gi to a terminal key storage means of the IC card Ti. The host 10-6 requests the protection code Gi to the IC card Ti and the IC card Ti informs the Gi to the host and after the host acquires the Gi, the host acquires the key Ki from the equation of Ki=F{fx(P, Gi), Xi}. On the other hand, the IC card Ki extracts the terminal key Ki from its own terminal key storage means.

Description

DETAILED DESCRIPTION OF THE INVENTION "Field of Industrial Application" The present invention relates to a method of sharing keys used in encrypted communications, etc., between a terminal and a host, and between a plurality of terminals.

"Prior Art J" First, the concept of a network to which the present invention is mainly applied will be explained using FIG. 1. The network is roughly divided into a host system 1 and a terminal system 2.

Host system 1 includes hosts Hh, h=L2. ... are coupled to each other directly or indirectly via a communication line. The terminal system 2 consists of terminals T i, i-1, 2+, . . . , and each terminal is coupled to a host via a communication line.

Some hosts are not connected to the terminal by a communication line. Each terminal T
i has a terminal code X11 for unique identification within the network. Xi is information that may be made public. One purpose of a network is communication between a host and a terminal, and another purpose is communication between any terminals. There may be one host or multiple hosts. A specific example of the network is shown below.

Example 1: A network in which multiple terminals are connected to a calculation center (host) via communication lines.

Example 2: A telephone network that includes automatic telephone lines. The host is a telephone station or relay station, and the terminal is a telephone installed in a car or a telephone at a subscriber's home. The terminal code is a telephone number.

Next, a conventional method in which a host and a terminal share a key using the network of Example 1 will be described. The post and terminal Ti are
Keys Ki are individually promised and determined in advance. The number of terminals is n
If so, the host needs to hold n keys Ki.

When the value of n becomes large, the host needs to hold a large number of Ki, which has the drawback of increasing the cost of holding the keys Ki.

Next, in the telephone network of Example 2, the telephone Tt installed in the car
and the telephone Tj at the subscriber's home use the key R to perform encrypted communication.
An example of the prior art will be explained as an example of how to share the information. The owners of telephones Ti and Tj exchange keys R in advance using, for example, letters, and set the key R to telephones Ti and Tj at the beginning of shared zero communication.

This method has the disadvantage that the cost of key sharing increases as the number of communication partners increases. This method is also useless if the communication partner is unspecified.

"Means for Solving the Problem" (Algorithm F and Parameter PGi) According to this invention, the host has a calculation means of algorithm F for generating a terminal key, and a protection code corresponding to the terminal code Xi of terminal T1. Determine Gi, and set the terminal key Ki=F (PC;i,
Xi) is determined. PGi is the secret parameter of F,
PGi−f x (P, Gi), f x is an internal function of F, P is a parameter of fx that is secret to the terminal, and terminal T
i has a terminal key storage means and stores the terminal key Ki and protection code G.
i and memorize it. The internal function fx of F is, for example, f x
(P, Gi)-PeGi, or fx(P.

CI)= (PIIGI)eq Ce&! b) Exclusive OR of correspondences, 11 is data concatenation, q is a secret constant)
However, the internal function fx may be arbitrarily determined as long as it is a function of P and Gi, and keeping it secret from the terminal is effective for improving security.

(Joining the network) A terminal user applies to join the network.

The network sends terminal code X to terminal Ti for terminal identification.
Give i. Furthermore, after determining the protection code Gi using an appropriate method such as random number generation, the host sends + to the terminal 11 using the following formula.
decide.

Ki=F (f x (P, Ci), Xi) The host is
The protection code Ci and the terminal source Ki are set in the terminal source storage means of the terminal Ti (no communication line is used at this time). The terminal source Ki is secret information of the terminal Ti that is known only to the terminal Ti and the post. The procedures described above between the host and the terminal are procedures before communication.

(Terminal code) Typical terminal codes include the phone number for the terminal, the terminal name, terminal address, numbers and symbols representing the terminal, and combinations of these that can be identified in the network. This is determined by each case.

(How to obtain the terminal source) During communication, the host sends the protection code Ci to the terminal Ti.
to obtain Gi, then Ki=F(fx (P,
The terminal source Ki is determined from Gi) and Xi). Also, the terminal Ti
retrieves the terminal tlK+ and the protection code Gi from its own terminal source storage means.

(Protection Code) The terminal owner is in a position to know the value of his terminal source. Therefore, when the owner of a terminal changes, it is necessary to be able to change the terminal source Ki while keeping the same terminal code Xi (telephone number, etc.). Furthermore, even if the terminal source is exposed, the terminal source Ki must be able to be changed in the same way.

When the terminal owner changes without changing the terminal code Xi, or when the terminal 11Ki is exposed to a third party, the host changes the protection code Gi, and Ki = F (f x
The terminal source Ki is determined again from (P, Gi), Xi), and this new terminal source Ki and new protection code Cyi are set again in the terminal Ti.

(Changing the terminal source by changing the parameter) By changing the value of the secret parameter P of the algorithm F (f x (P, Gi), Xi), the value of the terminal source K) can be changed.

The host has a parameter P and a new parameter P'. The host queries the terminal Ti for the protection code Gi and obtains it, Ki=F (f x (P.

The terminal source Ki is calculated from Gi) and Xi). Change the protection code from Ci to Ci゛, thereby changing the terminal source to K
From i Ki′=F (fx (P′Gi′), Xi)
Change to The host is Ci'-E (Ki, Ki')
by means of determining the terminal source change communication mode and notifying the terminal source change communication mode.
The terminal source change communication mode, ciphertext Ci', and new protection code Gi' are notified to the terminal Ti. The terminal Ti detects the terminal source changed communication mode by the means for detecting the terminal source changed communication mode, takes out the terminal source Ki from the terminal source storage means, and creates a new terminal by E-' (Ki, C3')=Ki'. Obtain the source Ki′. Here E-'(k,
c) is a zero-order new terminal 1 that represents the plaintext decrypted by the ciphertext C@ in the key! Ki' and the host set the received new protection code Gi' in the terminal source storage means of the terminal Ti.

(How to create algorithm F(P, Xi)) The first method is to create algorithm F using cryptographic algorithm F. F is defined as follows.

F (P, Xl)=E (P, Xi) That is, the terminal code Xi is encrypted using the secret parameter P of algorithm F as a key, regarding it as plain text data.

Here, E(k, p) represents a ciphertext encrypted using key k and p as plaintext data.

If the terminal code X+ is long, divide the terminal code Xi into n data pieces of N bits each and encrypt them in CBC mode
The finally obtained ciphertext block Cn is defined as F (P, x+
) as the output (CBC-T-1 Doha International Standard 15O8
372).

The second method is to create an algorithm using a hash function. Here, the hash function is described below.

Hu=f (Mu, Hu-1), u-1+2s-nMu
: data block, HO = initial value (zero, etc.) where, H
u and Mu have a length of N bits.

r is a function that uses Mu and Hu −1 as input variables and outputs N-bit length data. Divide the terminal code Xi mentioned above into n pieces of data of N bits each, and write X in order from the left.
if, X i2. -, X in, Mu-
Xiu, HO are calculated sequentially using the hash function as P, and the finally obtained Hn is calculated using the algorithm F (P,
Let it be the output of i).

(Host) An example of the elements of the host will be explained with reference to FIG. host 10
means 30 for calculating algorithm F, means 31 for detecting a communication key distribution communication request, means 32 for detecting a communication key non-distribution communication request, and means 33 for notifying communication key distribution communication mode.
, means 34 for notifying the communication key non-distribution communication mode, means 35-1 for notifying the protection code request, means 35-2 for detecting the protection code response, means 35-3 for notifying the terminal key change communication mode, and others. The processing receiver comprises means 36 for receiving the processing. Some hosts do not have any one or more of the means 31 to 35-3.

(Terminal) An example of the elements of a terminal will be explained with reference to FIG. The terminal 20 is
Terminal key storage means 37, communication disconnection storage means 38, means 39 for notifying communication key distribution communication request, means 40 for notifying communication key non-distribution communication request, means 41 for detecting communication key distribution communication mode, communication key non-distribution communication mode. means 42 for detecting communication mode;
Means 43-1 for detecting a protection code request, means 43-2 for notifying a protection code reply, means 43-3 for detecting a terminal key change communication mode, and means 44 for performing other processing.
Equipped with The means 38 maintains one or more communication interruptions. Further, a part or all of these key storage means may be separated from the terminal Ti, and may be separated from the terminal 20 using, for example, a magnetic card or an IC card. Means 3
There are also terminals that do not have any one or more of 8 to 43-3.

Other examples of elements of the terminal are shown in FIG. Parts corresponding to those in FIG. 3 are given the same reference numerals. Line terminating unit (DSU)
) 20-1, a personal computer 45-1, a facsimile transceiver 45-2. Telephone 45-3 is connected to signal line 46-1 respectively.
．． 46-2.463. The terminal 20 is connected to a host via a communication line 47. In this example, the personal computer 45-1, facsimile transmitting/receiving R45,-2, and telephone 45-3 are means 37, 38, 39, 40, 41, 42, 43-1.4 built into the line termination device 20-1.
3-2.43-3.44 are shared. Means 38-4
There are also terminals that do not have any one or more of 3-3.

(How to use the key) How to use the shared key K (communication disconnection Ki and communication disconnection R) will be explained.

The first method is to use the key K shared in this invention as an encryption key for encrypted communication.

The second method is to encrypt another encryption key KD using the shared key and deliver it to the communication partner, and the recipient obtains KD by decrypting it using the shared key.

In the third method, the key K shared in the present invention may be used as a key used in a "data integrity technique" for detecting tampering of a communication. Here, there are several techniques for data integrity, and for example, they are described in the international standard draft ISO/DIS9797.

The fourth method is to confirm the communication partner. There are several methods for this, such as the international standard draft ISO/D [39798
It is described in

``Example 1'' This will be explained with reference to FIG. 5 at a center and one terminal. One host 10-6, a plurality of IC card input/output devices 50-1 to 50-2, and a large number of IC cards 5 connected to this host through communication lines.
A system consisting of 1-1 to 51-2 will be explained as an example. The terminal is an IC card and is represented by the symbol Ti. Terminal Ti
Assume that the host 10-6 can be accessed using any of the IC card input/output devices 50-1 to 50-2. The purpose of this system is communication between the IC card and the host, and the host performs certain processing required by the IC card.

In order for an IC card owner to join this system, the host first assigns a terminal code Xi and a protection code Gi to the IC card Ti.

The host uses algorithm F to obtain Ki=F(lx
(P, Gi), Xi) are determined, and the terminal key Ki and protection code Chi are written into the terminal key storage means of the IC card Ti (no communication line is used at this time).

The procedure described above between the host and the IC card is a procedure before communication.

The method by which the host shares the IC card Ti and the terminal key Ki during communication is as follows. The host i sends the protection code Gi to the IC card Ti by means of notifying the protection code request.
, the IC card Ti learns that the protection code G1 is requested by the means for detecting the protection code request, and then notifies the host of G1 by the means for notifying the protection code reply, and the host sends the protection code reply. Knowing that Gi is being conveyed by the means of detection, and after acquiring Gi,
From Ki=F (f x (P, Gi), Xi), the key K
Get i. On the other hand, the IC card Ti retrieves the terminal key Ki from its own terminal key storage means. Further, in order to notify the host from the IC card that the key Ki is to be shared based on a trigger from the IC card side, this is done by following the latter half of the procedure described above, that is, by transmitting the protection code Gi from the IC card Ti to the host.

When the terminal key Ki of the IC card Ti is exposed or when the IC card owner changes, the IC card owner reports this situation to the host. The host determines a new protection code Gl and sets the terminal key Ki as Ki=F (f x (P,
Gi) and Xi) are determined again, and a new terminal key Ki and a new protection code G; are reset in the terminal key storage means of the IC card.

Even if you replace the IC card and IG card human ratio output device with a PC or data communication terminal with communication function,
This embodiment can be applied as is.

In the case of the conventional method (common key method) that uses a common terminal key for IC cards, if the common key from one IC card is exposed, the common keys of other IC cards will also be exposed. The security of all IC cards is compromised. In the case of this embodiment, even if the terminal key is exposed from one IC card, the damage can be limited to this IC card, and the security of all IC cards is not compromised.

“Example 2” An example will be explained in which when a car phone Ti calls a car phone Tj, the phone Ti and Tj coexist with the communication key R. Here, both telephones have terminal key storage means for simultaneously storing a terminal key and a protection code.

A user purchases a car phone Ti and has the telephone office give him a car phone number Xi and a protection code Gi.
The station i uses the algorithm F to calculate Ki=F (f
x (P, Gi), Xi), determine the terminal key Kt. The telephone office receives the terminal key Ki and protection code Gi of the telephone Ti.
is set in the terminal key storage means of the car phone Ti.

Other users similarly purchase a car phone Tj and have the telephone office give them a car phone number Xj and a protection code Gj. The telephone office uses the algorithm F to calculate Kj
=F (f x (P, Gj).

Xj), the terminal key Kj is determined. The telephone office is telephone m
Terminal key Kj and protection code Gj of Tj are set in the terminal key storage means of car telephone Tj.

The procedures of the host and telephones Ti and Tj described above are procedures before communication.

The telephone Ti first determines the communication key R by generating a random number, and then uses its own terminal key Ki to obtain Ci=E (K
i, R) and notifies the telephone office of the ciphertext Ci, the terminal code Xi, the protection code Gi, and the terminal code Xj of the communication partner using means for notifying a communication key distribution communication request. This telephone office uses means for detecting communication key distribution communication requests.
It acquires Ci, Xi, Gi, and Xj sent from telephone Ti, and learns that it is a communication request from telephone Ti to Tj.

The telephone office inquires about the protection code Gj from the telephone Tj by means of notifying the protection code request.

The telephone TJ, by means of detecting the protection code request,
Knowing that the protection code Gj is requested, the terminal retrieves the protection code Gj held in its own terminal key storage means. Next, the telephone Tj notifies the central office of this Gj by means of notifying the protection code response. The telephone office learns that the protection code Gj has been notified by the means for detecting the protection code reply, and obtains the protection code Cj. Next, this telephone office uses algorithm F to create a terminal image K in the following way.
i and Kj are generated.

Ki=F (fx (P, Gi), Xl) Kj=F H
x (P, Gj), Xj) The telephone office decrypts the ng ciphertext Cj received from the telephone Ti using Ki as a key to obtain the communication disconnection R, and then uses Kj as the key to encrypt the communication disconnection R. to obtain Cj. That is, R=E-' (Ki, Ci) Cj=E (Kj, R) Here, E(k, p) is the ciphertext that is encrypted using key k and p as plaintext data, and E'' (k , c) represents the plaintext obtained by decrypting the ciphertext C using the key.The telephone office transmits the ciphertext Cj to the telephone mTj by means of notifying the communication key distribution communication mode.The telephone Tj uses the communication key distribution communication mode. It learns that the cipher text Cj has been sent by means for detecting the mode, and receives the cipher text Cj.Next, 2. Decrypts the cipher text Cj using the terminal image Kj held in its own terminal image storage means. , a communication disconnection R is obtained. That is, R=E-' (Kj, Cj) With the above procedure, the telephone office does not need to hold the terminal images Ki and Kj in advance. This will be explained in conjunction with Fig. 6. However, the telephone is represented as a terminal, and the central office is represented as a host.

(2) Terminal Ti determines communication interruption R by, for example, generating a random number.

(2) Terminal Ti determines Ci from Ci=E (Ki, R).

(2) Terminal Ti informs the host of Ci, Xi, Gi, and Xj, and requests the host to communicate with terminal Tj.

(2) The host requests the protection code Gj from the terminal Tj.

■The terminal Ti transmits the protection code Gj to the host.

■The host is Ki = F (fx (P, Gi), Xi
), find Ki.

■The host is Kj=F (fx (P, Gj), Xj)
Then, find Kj.

(2) The host determines the communication interruption R from R=E-' (Ki, Ci).

(2) The host determines Cj from Cj=E (Kj, R). (From now on, Ki and Kj are no longer needed, so they will be deleted.

) [Phase] The host transmits the ciphertext Cj to the terminal Tj.

(2) Terminal Ti obtains communication disconnection R from R=E-' (Kj, Cj).

In this embodiment, the terminal is a telephone, but the present invention can be applied to a communication terminal connected to a network, such as an I5DN (Integrated Digital Communication Network) terminal, a FAX terminal, a TV conference communication terminal, etc., instead of a telephone. Can be applied.

A key sharing method that does not use a protection code may be adopted. In this case, it corresponds to keeping the protection codes Gi and Gj constant, so in Fig. 6, the GiJ knowledge of ■ is omitted, and
and ■ are canceled, and in ■ and ■, f x (P, Gi) = f
x (P, Gj)=f x (P.

(fixed value).

"Example-3" Example-2 and l'l (U).The difference is that the telephone l'l
Each of Ti and the telephone Tj reads the communication disconnection R from its own communication disconnection storage means and uses it. Telephone Ti
At the start of communication, the communication key non-distribution communication request notifying means notifies the telephone office of the communication key non-distribution communication request, and retrieves the communication disconnection R from its own communication disconnection storage means. The telephone office is
The means for detecting the communication key non-distribution communication request detects that it is not necessary to generate terminal images Kr and Kj, unlike the communication key distribution communication, and then the means for notifying the communication key non-distribution communication request mode detects that the telephone Tj Notify that the communication disconnection R will not be delivered. After detecting the communication key distribution communication mode by the means for detecting the communication key non-distribution communication request, the telephone Tj retrieves the communication disconnection R from its own communication disconnection storage means. Communication disconnection R
may be changed upon agreement between both terminals Ti and Tj and stored in the communication disconnection storage means. The change method is, for example, a new communication key R'=Re9a (a is the change value agreed upon by Ti and TJ)! Note that the communication key R is stored in the communication key storage means by key sharing based on the communication key distribution communication request of the second embodiment.

"Example-4" This is a system configuration similar to that of Example-1. In this embodiment, the protection code is not used, and the terminal key mountain part name is used instead. The terminal code of the IC card Ti (terminal Ti) is assumed to be Xi, and the terminal source storage means inside the IC card Ti stores eight pairs of the terminal key mountain part name Kin-N and the terminal source Kin (however, , n=1.2.・
..., s). For example, the terminal key part name K11-N and the terminal source Kil, the terminal key part name K12-N and the terminal source Ki2,
The terminal key mountain part name K13-N and the terminal source Ki3 are each stored in pairs in the terminal source storage means of the IC card Ti. Here, the key Kin is determined by the host Kin=F (P
, gx (Xi, Kin-N)), where n = 1.2.
. . , S, and stored in the terminal source storage means. Here, the function gx(Xi, Kin-N) is, for example, gx(Xi, KinN)=XillKin-N(
allb is the concatenation of data a and b), or g x (
This is a function that is made public to the terminal. The above is the preparation procedure before communication.

During communication, when the host and the IC card share a key or when the terminal key mountain part name is not obvious, either the host or the IC card notifies the terminal key mountain part name to the other, and the host sets Kin=F. (P, gx (Xi,
Kin-N)) determines the terminal source Kin, and the IC card Ti is the terminal source K corresponding to the terminal key mountain part name Kin-N.
in from its own terminal source storage means.

"Embodiment 5" Network Aggregate The present invention can be applied to a network aggregate formed by connecting networks through communication lines. An example in which the present invention is applied to two networks A and B will be explained with reference to FIG. The names of networks A and B are represented by IDA and IDB. Network A uses algorithm FA (
fxa (PA + Gi), Xi) and an encryption algorithm Ea (k, p). Similarly, network B uses algorithm Fa (fxs (Pg
, Gj), Xj) and the cryptographic algorithm Ha (
k, P), where k represents the key and p represents the plaintext. f
xA, PA, ,Gi are of network A and fxII
, P, , Gj are internal functions and parameters of network B. Networks A and B use encryption algorithm EA
, (k, p) and the secret parameters P of A and B
Share All in advance. Here, k is the key, p is the plaintext,
c=EAm(k, p) represents the ciphertext, Ea-'
(kc), El-' (k, c), Fism-
'(k, C) represents a plaintext decrypted using k as a key and C as a ciphertext.

The procedure for sharing the communication key R between the terminal Ti in network A and the terminal TJ in network B via host HA in A and host HB in B is as follows.

The terminal Ti determines a communication key R, and generates a ciphertext Ci by encrypting R with the terminal source Ki. That is, Ci engineering 11! A(Ki
, R) The terminal Ti receives the ciphertext Ci, the terminal code Xi, the protection code Gi, and the name ID of the network B to which the communication partner belongs.
B and the terminal code Xj of terminal Tj are sent to the host HA. The host HA learns that the terminal Ti requests sharing of the communication key R with the terminal Tj belonging to the network B, and
After decrypting the ciphertext Ci to obtain the communication key R using the following means, the ciphertext C□ to be sent to the network B is determined. That is, K
i=FA(fxA(PA,Gi),Xl)R=
EA-' (Ki, Ci) Random number rn generation: KAl=EAI (FAI, IDB) ■rnCAm=
EAm (Ka□R) Here, the random number rn is used to make the value of K□ irregular.

The host HA uses the ciphertext CA lr terminal code Xj.

Send random number rn to host HB in network B.

Host HB sees terminal code Xj and requests protection code Gj from terminal Tj. Terminal Tj conveys protection code Gj to host HB. The host HB calculates □ to the shared key of A and B, and after acquiring the communication source R from the ciphertext CAN transmitted from the network A, the host HB generates the ciphertext C using the same procedure.
Decide on j.

That is, KAI=EAL (Paw, IDB) ■rnR=
EAi-' (Kam, C□) Kj ≧Fn (fxa (PBIGj) + Xj)
Cj=E++ (Kj, R) Next, HB transmits the ciphertext Cj to the terminal Tj. Terminal Tj decrypts ciphertext Cj at terminal source Kj and obtains communication source R.

R=E++-' (Xj, Cj) Through the procedure described above, the terminal Ti and the terminal Tj can share the communication source R. In addition to the method described above, the secret key KA11 used between networks A and B can be obtained by using KAIl-EAIl (
PAs, ■rn, IDB) or KAl=
[! It may be generated as A8 (PAIl, IDBωrn) (rn is a random number). Both networks A and B may agree on this KAll generation rule in advance. In the above explanation, two examples of networks A and B have been explained, but the same applies to three or more networks.

According to the procedure described in Example-5, each host does not need to have a key file, and each network has terminal code assignment rules (Fa, FIl) and encryption algorithm E.
There is the convenience of being able to independently determine A and E for each network.

"Embodiment 6" (Method of coexisting keys among three or more terminals) A communication source R can be shared among three or more terminals. The host is a central office,
The terminal will be described as a fax terminal. The fax terminal Ti first determines the communication source R, uses the terminal source Ki, and then
i = E (Ki.

R), and using a means for notifying a communication key distribution communication request, the ciphertext Ci, the terminal code Xi, the protection code Gi, and the communication partner's terminal code Xj-LXj-2゜..., Xj-m
Notify the telephone office. This telephone office uses the means for detecting the communication key distribution communication request to detect Ci, Xi, Gi and X J-1,...X sent from the fax terminal Tt.
Tj LT from the fax terminal Tt.
j2+..., knows that it is a communication request to Tj-m.

The central office then, by means of notification of the protection code request,
The protection codes Cj-1, . . . +Gj m are queried from m fax terminals T j-L . . . , Tj m.

m fax terminals Tj-k (where = 1...,
m) learns from the means for detecting a protection code request that the protection code Cj-k is requested, and retrieves the protection code Gj-k held in its own terminal source storage means. Next, each fax terminal TJ- notifies the telephone office of this Gj-k by means of notifying the protection code reply. The telephone office learns that the protection code Gj-k has been notified by the means for detecting the protection code reply, and obtains the protection code Gj-k. Next, this central office uses algorithm F to generate terminal sources Ki and Kj-k (where =1.., m) in the following manner.

Ki=F (f x (P, Gi), Xl)Kj-=
F (f x (P, Gj-k), Xj-k
), provided that =1. ...1m The telephone office decrypts the ciphertext Ci received from the fax terminal Ti using Ki as a key to obtain the communication source R, and then Kj
-k as a key, the communication source R is encrypted to obtain Cj-k. That is, R=E-' (Ki, Ci) CJ-K = E (+1 to Kj-), where k = l, ・
..., the m telephone office sends the ciphertext Cj-k to the m fax terminals Tj by means of notifying the communication key distribution communication mode.
−k (however, = 1. . . , m). The fax terminal Tj- learns that the cipher text Cj-k has been sent by the means for detecting the communication key distribution communication mode, and accepts the cipher text Cj-k. Next, the ciphertext Cj-k is written using the terminal source Kj-k held in its own terminal source storage means.
is decoded to obtain the communication source R. That is, R=I! -' (Kj-, cj-k), however -1
,...,m The key generated by the terminal Ti according to the procedure explained above is transmitted to m fax terminals Tj-k (k=1.
...m). In addition, the shared communication source R can be used for broadcast communication, etc. in fax communication.

"Example 7" (Another method for sharing keys in broadcast Urashin) This is a key sharing method similar to Example 6. The main difference is that m terminal codes Xj-k (where = 1.2...
, m) are registered in advance at the telephone office, and the registered m terminal codes are used during communication. Here, the m terminal codes Xj- registered by the terminal Ti at the central office are as follows:
It can be called by the registered name (represented by CAT-m) assigned by the terminal Ti.

The fax terminal Ti first determines the communication key R, and then uses the terminal key K.
Determine Ci=E (Ki, R) using i, and notify the telephone office of the ciphertext Ci-, terminal code Xi, protection code Gi, and CAT-m using a means for notifying a communication key distribution communication request. This telephone office uses the means to detect the communication key distribution communication request to receive the C sent from the fax terminal Ti.
Obtain i, Xi, Gi, and CAT-m. The central office learns from CAT-m that the fax terminal Ti is requesting communication to the fax terminals Tj1, Tj-2, . . . , Tj-m.

The subsequent key sharing method is the method described in Example-6, that is,
“The central office may, by means of notification of a protection code request,
The protection codes G j-1, . . . , Gj-m are queried from m fax terminals T j-1, .・・・・・・・・・・・・°The same as below.

"Example-8" Similar to Example-2. The difference is that the network is composed of loop-shaped communication lines as shown in FIG. Each terminal is connected to a communication line. The host is also connected to the communication line. In the second embodiment, the telephone office is replaced with a host, the telephone Ti is replaced with a terminal Ti, the telephone aTj is replaced with a terminal Tj, and the communication key R is shared between the terminals Ti and Tj. As shown in Example-3, the shared key is
Both terminals are each provided with a communication key storage means to store and utilize the communication key.

"Effects of the Invention" Since the configuration is as described above, the host
There is no need to always hold the terminal key Ki of i.
When the key is exposed, the damage can be limited to the terminal Ti, and the terminal key Ki can be easily changed when the owner of the terminal Ti changes. As a result, it is economically possible to share keys used in encrypted communications between a host terminal and between multiple terminals within a network.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing an example of a network mainly targeted by this invention, FIG. 2 is a block diagram showing an example of elements of a host, and FIGS. 3 and 4 are block diagrams showing examples of elements of a terminal, respectively. Figure 5 is a diagram explaining key sharing between a host and a terminal, Figure 6 is a diagram explaining key sharing between multiple terminals via a network, Figure 7 is a diagram explaining key sharing in a network aggregate, and Figure 8 is a diagram explaining key sharing between multiple terminals via a network. The figure is a diagram showing an example of another network targeted by the present invention. Patent applicant: Nippon Telegraph and Telephone Corporation

Claims (5)

[Claims] (1) The host has a calculation means of algorithm F, and determines the terminal key Ki = F (PGi, Xi) from the terminal code Xi and protection code Gi of the terminal Ti, where PGi is P
Gi = fx (P, Gi), where fx is an internal function of F, P is a secret parameter of fx, Gi is a protection code compatible with Xi, the terminal Ti has a terminal key storage means, and the terminal key Ki and the above A key sharing method in which a protection code Gi is stored in the terminal key storage means. (2) The terminal Ti determines a ciphertext Ci by encrypting the communication key R using the terminal key Ki as a key and regarding it as plaintext data, and uses the ciphertext Ci, the terminal code Xi, the protection code Gi, and m pieces of data. Terminal code of the communication partner Xj-k (k=1
, ..., m; m is 1 or more), and the host first sends m protection codes G to m terminals Tj-k.
j-k, the m terminals Tj-k convey the protection code Gj-k to the host, which then receives the terminal code Xi and m Xj-k obtained from multiple terminals. From the protection code Gi and m Gj−k, Ki=F(f
x(P, Gi), Xi), Kj=F(fx(P, Gj-
k), The communication key R is regarded as plaintext data and is encrypted to produce m ciphertexts Cj-k.
is determined, and these m ciphertexts Cj-k are sent to the m terminals T
The key according to claim 1, wherein the m terminals Tj-k decrypt the m ciphertexts Cj-k using the m terminal keys Kj-k to obtain the communication key R. How to share. (3) The key sharing method according to claim 2, wherein the terminal has communication key storage means and stores the acquired communication key R in the communication key storage means. (4) The host has a calculation means of algorithm F, and from the terminal code Xi of terminal Ti and the terminal internal key name Kin-N, s terminal keys Kin=F(P, gx(Xi, Kin
-N)), where n=1, 2, ..., s, and gx is F
, P is a secret parameter of F, the terminal Ti has a terminal key storage means, and the terminal internal key name Ki of the s group is
A key sharing method in which n-N and a terminal key Kin are stored in the terminal key storage means. (5) The above host changes the parameter from P to a new value of P.
', determine a new Gi', and find the corresponding terminal key Ki'=F(fx(P', Gi'), Xi),
Query the terminal Ti for the protection code Gi and get Ki=F(f
After finding x(P, Gi), Xi), let K be the key
i' is regarded as plaintext data and encrypted to obtain a ciphertext Ci', and the ciphertext Ci' and Gi' are sent to a terminal Ti, which receives the ciphertext Ci' and Gi' from the host and uses the key The above ciphertext Ci' is decrypted using Ki, and the terminal key Ki' is obtained, and this new terminal key Ki' and the new Gi
5. The key sharing method according to claim 1, 2, 3, or 4, wherein ' is set in the terminal key storage means.