JPH04268844A - Cipher using method and means therefor - Google Patents

Abstract

PURPOSE:To make a ciphering method to be used differ for every user. CONSTITUTION:When at a terminal 1A, a ciphering means 2A is given the instruction of a key sharing method, the ciphering means 2A ciphers a common key KS2 by an initial key KS1, and sends this cipher text C2 to the terminal 1A. The terminal 1A sends C2 to the terminal 1B, and the terminal 1B sends C2 to the ciphering means 2B. The ciphering means 2B decodes C2 by the initial key KS1, and obtains the common key KS2. In the terinals 1A and 1B, data is cipher-processed by the common key KS2 by each ciphering means 2A, 2B, and is sent to the terminal, and is sent to an opposite party. The ciphering means 2A, 2B can be exchanged to the terminals 1A, 1B, and another ciphering method can be used by exchanging the ciphering means. The terminal can not know what ciphering program is used.

Description

[Detailed description of the invention]

0001

[Industrial Application Field] This invention is useful for various terminals such as telephones, fax terminals, telex terminals, and car telephones that have joined a network to encrypt and transmit data in order to keep it secret, and for digital transmission of data. Concerns methods of using cryptography for signatures and for checking whether data has been tampered with.

0002

2. Description of the Related Art A conventional method of using cryptography will be explained with reference to FIG. The network (communication network) 100 includes a telephone 101, a fax terminal 102, a telex terminal 103, a car telephone 104, and a personal mobile telephone 10 that have joined the network.
5. Personal computer 106, electronic computer 107
, a data communication terminal 108, and other terminals are connected thereto. These terminals perform encrypted communication with each other, or perform highly reliable communication using encryption, that is, communication using encryption, such as digital signature and confirmation of data tampering. The network 100 is a domestic network or an international network. To perform encrypted communication between devices, the same cipher must be used. For this purpose, each terminal needs to have common encryption and decryption means.

However, there are the following problems. In other words, ■Cryptography has not been internationally standardized by ISO, etc. Therefore, there is no code that can be commonly used by all terminals on an international scale.■Depending on the terminal, it is preferable to use a code whose encryption procedure is secret. , ■ There are problems and demands regarding the use of cryptography, such as the need to immediately switch to another cipher if the cipher is broken. A cryptographic method that can answer the problems and demands of conventional cryptographic usage, i.e.
A method of using a highly secure cipher that does not require the use of a common cipher by all terminals that have joined the network, allows the encryption procedure to use a secret cipher, allows easy switching of ciphers, and is highly secure has been proposed. It wasn't.

[0004] An object of the present invention is to eliminate the need for all terminals that have joined a network to use a common cipher, and to be able to use a cipher with a secret encryption procedure as well as a cipher with a public encryption procedure. To provide a cryptographic usage method that allows easy switching and is highly secure. Prior to explaining this invention, terms related to encryption will be explained. (Encryption and decryption, encryption algorithm) Encryption refers to encrypting plaintext p using encryption algorithm E with key k1 to obtain ciphertext c. This is expressed mathematically as follows. c=E(k1,p) Decryption means decrypting ciphertext c using decryption algorithm D with key k2 to obtain plaintext p. This is expressed mathematically as follows. p=D(k2,c) Here, encryption algorithm E and decryption algorithm D
are a pair, and together they are simply called a cryptographic algorithm.

[0005] When k1=k2, the cryptographic algorithm is called a secret key cryptographic algorithm, or simply secret key cryptography; when k1≠k2, the cryptographic algorithm is called a public key cryptographic algorithm, or simply public key cryptography. . In secret key cryptography, k1 and k2 are kept secret. In public key cryptography, k1 is made public. However, k2 is kept secret. (Key sharing) The fact that terminals Ti and Tj have the same encryption key is called key sharing. There are various key sharing methods, and four key sharing methods will be explained next. This is cited in the examples of this invention.

[0006] In the first key sharing method, terminals Ti and Tj
The key to be shared is to hold the key KS1 in advance in the memory inside the terminal. This is achieved, for example, by the owner of the terminal Ti or Tj manually setting the key KS1 in the terminal without using communication means. There may be one shared key, or there may be multiple keys. If you have multiple keys, assign numbers and names to the keys to distinguish between shared keys. key KS
1 is called the initial key.

[0007] The second key sharing method is a method in which the session key KS2 is distributed from the terminal Ti to the terminal Tj using secret key cryptography. That is, the terminal Ti uses the session key KS2 as
Encrypted with initial key KS1, that is, C2=E(KS1,K
S2), obtain the ciphertext C2 and send this C2 to the terminal Tj
send to Terminal Tj decodes C2, namely KS2
KS2 is obtained as =D(KS1, C2). The terminals Ti and Tj have previously determined an encryption algorithm E and a decryption algorithm D, and have means for implementing these encryption algorithms.

[0008] Details of the second key sharing are, for example, based on International Standard I
Specified in SO8732. The session key refers to a key that is changed each time a communication session occurs. The third key sharing method is a method of delivering session key KS3 from terminal Ti to Tj using public key cryptography. Terminal Ti encrypts session key KS3, ie C3=E(KS1X
, KS3), a ciphertext C3 is obtained and this C3 is sent to the terminal Tj. Terminal Tj decodes C3, i.e.
Session key KS3 is obtained as KS3=D(KS1Y, C3). Here, E is an encryption algorithm of public key encryption, and D is a decryption algorithm of public key encryption. KS1X is public key, KS1Y
is the private key. The details of the key sharing shown here are explained, for example, in the following document.

[0009]W. Diffie and Hellma
nn 'New direction in cryp
IEEE Transacti
-ons. Information Theory,
IT-22, 6, PP644-654, Nov
ember 1976. The fourth key sharing method is
This method calculates the session key KS4 by converting parameter values between Tj and Tj. Both have key generation means. If the functions of these key generation means are expressed by a function F, then KS4=F(G(p1), p2). Here, p1 and p2 are parameters given to the key generation means, and G(p1) and G(p2) are converted values of the parameters. The functions F and G are F(G(p1), p
2) It is a function that has the property that = F (G (p2), p1), and further, finding the value of p1 from G (p1),
Furthermore, it is virtually impossible to obtain the value of p2 from G(p2). For example, even if a large computer is operated continuously for thousands of years, p1 and p2 cannot be determined.

[0010] The terminal Ti determines the parameter Ri of the terminal Ti, and transmits the value of the parameter conversion value G(Ri) to the terminal Tj, and the terminal Tj determines the parameter Rj of the terminal Tj, and transmits the value of the parameter conversion value G(Ri). Rj) is sent to the terminal Ti. Terminals Ti and Tj use their own parameters and G(Rj) or G(Ri) sent from the other party, and terminal Ti calculates KS4=F(G(Rj), Ri), and terminal Tj calculates , KS4=F(G(Ri), Rj), the session key KS4 can be shared. There are various ways to share keys by exchanging parameters. For details, see Chapter 4 of Literature, Cryptography and Information Security (edited by Shigeo Tsujii, Shokodo, 1990).
) is explained as a key sharing method using (Authenticator generation function and authenticator confirmation function) In order to detect whether or not communication data has been tampered with, the data tampering detection function using a 32-bit authenticator uses the data tampering detection function GMAC. This is achieved by the authentication code generation function and authentication code confirmation function.

[0011] The data tampering detection function GMAC is based on the key K
S and long data DT are input, and a 32-bit long authentication code (MAC) is output. Writing this as a mathematical formula, MAC
=GMAC (KS, DT) The authentication code (MAC) has characteristics that are determined depending on the key KS and the data DT. The function GMAC is created using an encryption algorithm, and the key input to this encryption algorithm is the data tampering detection function GMAC.
The plaintext input to this encryption algorithm is the data input to the data tampering detection function GMAC. A specific method for creating the data tampering detection function GMAC is defined in, for example, the international standard ISO9797. (Data tampering detection) Terminals Ti and Tj have a key KS,
It has means for realizing the data tampering detection function GMAC. Suppose that terminal Ti sends data X to terminal Tj. Terminal T
i inputs the key KS and data X to the function GMAC and generates the authenticator MAC1. That is, MAC1=GMAC
Let it be (KS,X). Next, terminal Ti receives data X and M
AC1 is sent to the terminal Tj via the communication line. Terminal Tj receives data X and MAC1, and also generates an authentication code. If this is expressed as MAC2, MAC2=GM
AC (KS,X). Terminal Tj has MAC1 and M
If they match with AC2, that is, MAC1=MAC2, it can be confirmed that data X was not tampered with during communication. If data X changes to X', that is,
Since X≠X', MAC1≠MAC2, and it can be confirmed that the data has been tampered with during communication. (Data compression function) Long data, such as 64 x n bits or 128 x n bits, can be compressed into 64 bits or 128 x
It is a function that compresses data into bits, and is also called a hash function. For example, the data compression function is based on the international standard ISO101.
18.

[0012] Although not specifically explained, there are also digital signatures that use cryptography.

[0013]

[Means for Solving the Problems] According to the present invention, an encryption means is removably attached to each terminal, each encryption means consists of a control section and a security module, the functions of the control section are standardized, and the security The module is equipped with cryptographic processing functions individually required by the terminal user, such as a secret cryptographic program whose procedures are not disclosed, a cryptographic LSI chip, a public cryptographic program and a cryptographic LSI chip, etc., determined individually in advance. It has been done. The terminal transfers the data to an encryption means, has it undergo encryption processing, and has the encrypted data returned to it.

[0014] By individualizing the encryption method of the encryption means for each terminal user, it is possible to easily switch between various codes between terminals by exchanging the encryption means, and furthermore, the encryption processing is performed by the encryption means, The device itself is highly secure, as it is unknown what kind of encryption is used.

[0015]

Embodiment FIG. 1 shows an embodiment of the present invention. Terminal 1A,
1B has joined the network 100, and in the present invention, encryption means 2A and 2B are removably attached to the terminals 1A and 1B, respectively. The terminal 1A includes a processing section 4A and an encryption means interface 5A, and the encryption means 2A includes a control section 6.
A and a security module 7A. Similarly, the terminal 1B has a processing unit 4B and a cryptographic means interface 5.
The encryption means 2B includes a control section 6B and a security module 7B. The terminals 1A and 1B are connected to a network 100 via a communication line 8. Terminal 1A,
1B are encryption means 2A, 2B and connecting lines 9A, 9B, respectively.
are combined with. Here, the connecting line 9A represents that there is a flow of data between the terminal 1A and the encryption means 2A, and the connecting line 9B represents that there is a flow of data between the terminal 1B and the encryption means 2B. The functions of the cryptographic means interfaces 5A and 5B and the control units 6A and 6B are, for example, CCIT and IS.
Standardized and used internationally, such as O.

[0016] The processing units 4A and 4B have the original function as a terminal. For example, when the terminals 1A and 1B are telephones, the processing units 4A and 4B have the original functions as telephones, and when the terminals 1A and 1B are fax terminals, they have the original functions as fax terminals. , terminal 1A or 1
When B is a personal computer, it has the original functions of a personal computer. Terminal 1A and terminal 1B communicate via communication line 8 and network 100. Encryption means 2A or 2
B is constituted by an easily portable device such as an IC card or an optical card, which is equipped with a microprocessor and one or more of a cryptographic LSI and a cryptographic program memory chip. The cryptographic means interface 5A and 5B are IC
This is an interface processing unit with encryption means such as cards or optical cards. Here, the optical card includes one in which an optical storage section and a microprocessor are mounted on one card. The control units 6A and 6B are respectively responsible for selecting functions provided by the security modules 7A and 7B and for interfacing with the cryptographic means interfaces 5A and 5B. The security module 7A or 7B is a means for realizing at least one of cryptographic processing functions, that is, encryption, decryption, authentication code generation, authentication code confirmation, digital signature, and signature verification functions. , and further includes a key sharing function, data compression function, etc. as necessary. In the control unit 6A or 6B, for example, selection number 1-1
selects the function of key sharing method 1, selection number 1-2 selects the function of key sharing method 2, ..., selection number 2
-1 selects the encryption function of the private key cipher Q; selection number 2-2 selects the encryption function of the FEAL cipher;
..., selection number 6 is determined to select the data compression function, etc., and this method of determination is standardized and used as a domestic standard, for example.

FIG. 2 shows a slightly more detailed embodiment of the encryption means 2A. The security module 7A includes one or more of the following: an encryption implementation means, a decryption implementation means, an authentication code generation implementation means, an authentication code verification implementation means, and, depending on the case, a key sharing means and data compression. Including means etc. The key sharing implementation means includes, for example, programs for performing key sharing method 1, key sharing method 2, key sharing method 3, and key sharing method 4, and further includes programs for performing key sharing method 1, key sharing method 2, key sharing method 3, and key sharing method 4. Includes auxiliary functions, such as a random number generation function. The security module 7A stores an initial key KS1 of the key sharing method 1. In some cases, a plurality of initial keys are held, and in this case, the plurality of initial keys are distinguished by numbers or names. It also includes a memory that stores the session key KS2 of the key sharing method 2. The encryption implementation means is, for example, an encryption program for the secret code Q, an encryption program for the DES encryption, or an RSA encryption chip operating in the encryption mode. The decryption implementation means is, for example, a secret code Q decoding program, a DES code decryption program, or an RSA code chip operating in a decryption mode. In this case, the RSA chip is mounted on an IC card or an optical card, and is used for secret encryption and DE.
The S-cipher program is stored in a memory built into the processor. The means for realizing generation of an authentication code and the means for realizing authentication code confirmation are, for example, an authentication code generation program and an authentication code confirmation program, and are stored in a memory built into the processor. Here, the secret code Q means a code in which the encryption procedure independently determined by the person using the encryption means 2A or 2B is not made public. The data compression means is, for example,
It is a program for a data compression function specified by the international standard ISO 10118, etc., and is stored, for example, in a memory built into a processor. The cryptographic processing functions of the security modules 7A and 7B described above are determined individually and appropriately in advance by the users of the terminals.

Next, an explanation will be given of encrypted communication and a communication method using a cipher between the terminal 1A and the terminal 1B according to the cipher utilization method of the present invention. First, after the terminal 1A shares the session key KS2 with the terminal 1B using the second key sharing method,
An example in which plaintext data X is hidden and sent to terminal 1B will be explained. The processing unit 4A of the terminal 1A sends the information to the control unit 6A via the cryptographic means interface unit 5A using the second key sharing method.
The user is instructed to select a function to share a key with terminal 1B. The control unit 6A selects the second key sharing method within the security module 7A. Then, the security module 7A retrieves the initial key KS1, which is shared in advance with the terminal 1B, from the storage section of the security module 7A, and then generates a random number R. The security module 7A defines the random number R as the shared key KS2 for encrypted communication between the terminal 1A and the terminal 1B (hereinafter referred to as the session key K).
S2), that is, KS2=R, and this KS2 is
It is stored inside the security module 7A. Next, this session key KS2 is encrypted with the initial key KS1, that is, C2=E(KS1, KS2), to obtain the ciphertext C2 of the session key KS2, and this C2 is sent to the control unit 6.
A, the cryptographic means interface unit 5A, and the processing unit 4A.

The processing unit 4A transmits the ciphertext C2 to the terminal 1B via the communication line 8. The processing unit 4B of the terminal 1B is
Receive ciphertext C2. The processing unit 4B transmits the received ciphertext C2 to the control unit 6B via the cryptographic means interface 5B along with an instruction to select a function for key sharing using the second key sharing method. The control unit 6B transmits the key sharing selection instruction and the ciphertext C2 to the security module 7B using the second key sharing method. Then, the security module 7B first retrieves the initial key KS1 shared with the terminal 1A from the storage section of the security module 7B, and then decrypts the ciphertext C2 with the key KS1, that is, KS2=D(KS1, C2), a session key KS2 is obtained. The security module 7B stores the shared session key KS2 therein. The security module 7B notifies the processing unit 4B via the control unit 6B that the session key KS2 has been shared. The processing unit 4B notifies the processing unit 4A of the terminal 1A via the communication line 8 that the session key KS2 has been shared. This completes the sharing of the session key KS2 between the terminal 1A and the terminal 1B. Next, the processing unit 4A of the terminal 1A
However, encrypted communication in which plaintext data X is changed into encrypted text and transmitted to the processing unit 4B of the terminal 1B will be explained.

The processing section 4A of the terminal 1A instructs the control section 6A to select a function for encrypting plaintext X via the cryptographic means interface section 5A. The control unit 6A transmits the plaintext X to the security module 7A according to the instructions from the processing unit 4A. Then, the security module 7A retrieves the session key KS2 shared in the above method from the storage section of the security module 7A, and encrypts the plaintext X with the session key KS2, that is, C3=E(KS
As 2, The processing unit 4A converts the ciphertext C3 into
It is transmitted to the terminal 1B via the communication line 8. The processing unit 4B of the terminal 1B receives the ciphertext C3. The processing unit 4B sends the received ciphertext C3 to the control unit 6B via the cryptographic means interface unit 5B along with an instruction to select the decryption function.
convey. The control unit 6B is a security module 7B.
, to decrypt the ciphertext C3. Then, the security module 7B retrieves the session key KS2 shared by the method described above from the storage section of the security module 7B, and then decrypts the ciphertext C3 with the session key KS2, that is, X=D(KS2,C3
), the ciphertext C3 is decrypted to obtain the plaintext X. The security module 7B notifies the processing unit 4B of the decrypted plaintext X via the control unit 6B.

The above explanation is an example in which key sharing, encryption, and decryption are selected. In the above description, when the processing unit 4A instructs the authentication code generation function after sharing the session key KS2, the authentication code generation means of the security module 7A is selected and the authentication code MA is sent to the plaintext X.
C1, i.e., MAC1=GMAC (KS2,
X), plaintext X and MAC1 are sent from terminal 1A to terminal 1B. Next, the authentication code confirmation means of the terminal 1B is selected, and it is checked whether the authentication code MAC1 is correct.

[0022] Person A (B) who uses this encryption method carries his own encryption means 2A (2B), and stores, for example, a secret encryption QAB program and RSA inside the security module 7A (7B). Incorporate a cryptographic program. Furthermore, the user A of this encryption method has his own other encryption means 2A', and has the means he needs, for example, inside the security module 7A'.
Incorporate the secret code QAX program. The other user BX of this encryption method has his own encryption means 2B' and has the secret encryption QAX program installed therein. Here, the secret code QAB is a secret code used between users A and B, and the secret code QAX is a secret code used between users A and BX.
It is a secret code used between In this way, user A and user B can perform encrypted communication using the cryptographic means that contains the secret code QAB and RSA code, and user A and user BX can use the cryptographic means that contains the secret code QAX. Encrypted communication is possible using cryptographic means. Here, the RSA encryption is a encryption whose encryption algorithm and decryption algorithm are made public, that is, whose encryption procedure is made public.

[0023] As described above, each user of a terminal that joins the network has the cryptographic functions that he or she needs (for example, key sharing function, encryption function, decryption function, and authentication code generation). function, authentication code confirmation function, and data compression function (the functions can be specified by the user).
In other words, each user has an individualized encryption means 2A (2B). In addition, since the cryptographic means interfaces 5A and 5B are standardized, the cryptographic means 2A can be customized for each user.
or 2B can be used in conjunction with any terminal 1A or 1B. Cipher switching can be accomplished by exchanging personalized cryptographic means.

[0024]

[Effects of the Invention] As is clear from the above embodiments, according to the present invention, a cryptographic user can obtain the cryptographic information he or she needs by using a cryptographic means personalized for his or her own use. Available. For this reason, all terminals that have joined the network do not need to use a common cipher; they can use a cipher with a secret encryption procedure, or a cipher with a public encryption procedure, making it easy to switch ciphers. It is possible to use any cipher that can be used. Moreover, the encryption process is performed by each encryption method, and this cannot be known on the terminal.
High safety can be obtained.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an embodiment of the invention.

FIG. 2 is a block diagram showing a specific example of encryption means 2A.

FIG. 3 is a block diagram showing a general configuration of communication between terminals via a network.

Claims (2)

[Claims] Claim 1: In a cryptography system in which a terminal user uses cryptography between terminals, a cryptographic means is removably connected to each terminal, each cryptographic means consists of a control unit and a security module, and The security module includes one or more cryptographic processing functions that are installed and determined in advance by the terminal user, and the terminal transfers data to an encryption means, performs cryptographic processing, and returns the cryptographically processed data. A method of using cryptography that is characterized by asking people to do something. 2. The cryptographic method according to claim 1, wherein the cryptographic means comprises an IC card or an optical card equipped with a microprocessor, one or more of a cryptographic LSI and a cryptographic program. means.