JPH0993243A - Data communication method and system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To decode a cipher without deterioration the quality of communication processing by applying decoding processing to ciphered information with a secret key of its own terminal equipment so as to decode the information when propriety of the communication terminal equipment is approved. SOLUTION: A communication terminal equipment A100 has a specific secret key and a public key of a communication terminal equipment B of a communication opposite party, and the terminal equipment B has a specific secret key to itself and a public key of a communication opposite party. Then a ciphering means 120 of the terminal equipment A100 applies ciphering processing to a communication message to be communicated by using a public key of the communication opposite party to generate ciphered information. The ciphered information is authenticated by the secret key of the terminal equipment A, an authentication means 130 generates authentication information, the ciphered information and the authentication information are set to a communication frame, a transmission means 140 sends the frame to the terminal equipment B. The terminal equipment B uses the public key of the terminal equipment A and a propriety discrimination means 150 verifies the frame. When the propriety of the terminal equipment A is approved, the ciphered information is decoded by a decoding means 160 by using the secret key of the terminal equipment B to decode the cipher.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data communication method and system, and in particular, in a data communication system, it is possible not only to check a communication message error but also to easily judge the validity of a communication message and maintain confidentiality. The present invention relates to a data communication method and system for high-speed execution.

[0002]

2. Description of the Related Art FIG. 13 shows the configuration of a conventional data communication system. The data communication system shown in the figure includes a communication network P and a plurality of communication terminals T connected to the communication network P. However, in the following, for simplification of description, a case will be described as an example in which communication is performed in a one-to-one manner between a transmission terminal T _i and a reception terminal T _j . The transmitting terminal T _i and the receiving terminal T _j have the same configuration.

The terminal T includes a common control section 20 for controlling each section of the system, a data storage section 30 for storing generated data and address information of a communication partner terminal, and a check section for checking a transmission error of received data. 40, a transmission unit 50 that transmits the generated communication frame, a reception unit 60 that receives data from another communication terminal, a communication frame creation unit 70 that generates a communication frame to be transmitted, and a display unit 8.
1 and an input / output unit 80 including an operation unit 82.

FIG. 14 shows the structure of a conventional communication frame. The communication frame 100 shown in the figure includes a header area 110 for setting various destination information and source information, a communication information area 120 for setting communication information, and an error check area for setting a calculation result by a communication polynomial as transmission error information. It is composed of 130.

FIG. 15 is a sequence chart showing the operation of the conventional communication system. Step 1) The operator of the transmitting terminal T _i displays the display unit 81.
while watching _i, the operation unit 81 _i to create a document or the like by using the data storage unit 30 the data created as needed _i
To be stored.

Step 2) The operator operates the operation unit 81 _i
When the transmission instruction is input, the common control unit 20 _i instructs the communication frame creation unit 70 _i to use the created data, the address information of the receiving terminal T _j , and the like.
Instruct to generate 0. As a result, the communication frame creation unit 70 _i reads out the content required for the communication frame 100 from the data storage unit 30 _i , sets it, and sets the transmission unit 50
transfer to _i .

Step 3) The transmitter 50 _i requests the communication network P to set a communication path to the receiving terminal T _j . Step 4) communication network P receives the network address of the receiving terminal T _j by the network address notified from the originating terminal T _i of the transmitting terminal T _i, performs a temporary setting of a communication path in which these network addresses can be connected, The receiving terminal T _j is notified that there is a connection request from the transmitting terminal T _i .

Step 5) Receiving the connection request from the communication network P, the receiving terminal T _j displays on the display unit 82 _j that there is a connection request addressed to its own terminal T _j, and gives the receiving operator permission to receive the information. Request or automatically perform the procedure to allow reception. When the operator permits the reception, the common control unit 20 _j is instructed to permit the reception via the operation unit 81 _j of the receiving terminal T _j . As a result, the common control unit 20 _j of the receiving terminal T _j instructs the transmitting unit 50 _j to set the communication path.

Step 6) In either case, reception is
When permitting, the common control unit 20 _jReceived instructions from
Transmitter 50_jRequests the communication network P to establish a communication path.
You. Step 7) The communication network P uses the communication packet that was in the temporary setting state.
Established and the originating terminal T_iTo establish a communication path
Notice.

Step 8) When the calling terminal T _i receives the notification from the communication network P that the communication path has been established, the receiving unit 60
_i notifies the common control unit 20 _i of that fact. As a result, the communication paths of the transmitting terminal T _i and the receiving terminal T _j are connected. In step 5, the receiving terminal T
_{If the} reception is not permitted on the _j side, the communication network P is disconnected, or the communication is performed or left unattended, and the connection request from the calling terminal T _i is rejected, or the communication path of the communication network P is temporarily set. To release.

Step 9) When the communication path is connected,
The communication frame creation unit 70 _i of the transmission terminal T _i sets, in the error check area 130, a result obtained by using a communication polynomial for a predetermined portion of the communication frame 100 including electronic document data such as an instructed document. And transfers it to the transmitter _i .

Step 10) As a result, the transmitting terminal T
The transmission unit 50 _{i of i} transmits the communication frame 100 to the communication network P according to a predetermined communication procedure between the terminals. Step 11) The transmitted communication frame 100 passes through the communication path of the communication network P and reaches the receiving terminal T _j . The check unit 40 _j of the receiving terminal T _j is the receiving unit 60 _j.
Calculates the same portion of the communication frame 100 using the communication polynomial, in the same manner as the method performed by the communication frame creation unit 70 _{i of the} transmission terminal T _i for the communication frame 100. The calculation result is compared with the value of the error check area of the communication frame 100, and if the values are the same, it is determined that there is no transmission error, and the communication information set in the communication information area 120 is acquired. To the common control unit 20 _j . If the values are not the same, the communication frame creation unit 70 _j generates the communication frame 100 containing the information for requesting the sending terminal T _i to retransmit, and the sending terminal 50 _j sends the communication frame 100.
send to _i .

As a result, the communication frame is correctly received.

[0014]

However, in the above-mentioned conventional data communication method, although means for recovery is secured for a transmission error between communication terminals, a communication frame from a legitimate communication terminal is used. It is unknown whether or not there is,
This includes the possibility of leakage to a third party's terminal outside the data communication system including the communication terminal. This is because there is a possibility that the system will be confused by a fake communication terminal and there is a risk of leakage of communication telegrams, and information on the fake communication terminal or alteration of information such as a valuable database of a data communication system due to leaked information, Information exchange may be hindered. When such an event occurs, it is necessary to manually repair or check the contents of the information etc. that have been accumulated so far, not only spending enormous time and corresponding expenses, but in the worst case, There is a problem that the operation function of the system is completely stopped.

The present invention has been made in view of the above points, and it is possible to check an error in a communication telegram, determine whether the communication telegram is from a legitimate communication terminal, and decipher the encryption to perform a communication process. An object of the present invention is to provide a highly secure data communication method and system that can be realized without degrading performance.

[0016]

FIG. 1 shows a first embodiment of the present invention.
It is a figure for demonstrating a principle. The present invention connects to communication networks.
The secret key D unique to the continued communication terminal and the secret key D
Set the corresponding public key K so that the communication terminals can
Data communication that sends and receives communication messages by notifying the public key K
In the communication method, the communication terminal A uses a secret unique to the communication terminal A.
Dense key D_AAnd the public key K of the communication terminal B of the communication partner_BTo
Having (step 101), the communication terminal B is the communication terminal B.
Unique secret key D_BAnd the public key of the communication terminal B of the communication partner.
-K_A(Step 102), the communication terminal A sends
The communication key to be transmitted is the public key K of the communication terminal B of the communication partner._B
To generate encrypted information (step
103), the encrypted information is the secret key D of the own terminal A_AAuthenticate with
To generate authentication information (step 104), and encrypt information
And authentication information are set in the communication frame and sent to communication terminal B
(Step 105), the communication terminal B sends the communication frame.
Public key K of the communication terminal A of the transmission source_AVerify using
The validity of the communication terminal A is determined (step 106), and communication is performed.
If the validity of terminal A is recognized, the encrypted information
Secret key D of end B _BTo decrypt and decrypt (step
7).

FIG. 2 illustrates the second principle of the present invention.
It is a figure. The present invention is a communication terminal connected to a communication network.
Unique private key D and public key corresponding to the private key D
K and the public key K is mutually passed between the communication terminals.
In the data communication method to know and send and receive communication messages,
The communication terminal A has a secret key D unique to the communication terminal A._AAnd
Public key K of the communication terminal B of the recipient_B(Step 2
01), the communication terminal B has a secret key D unique to the communication terminal B.
_BAnd the public key K of the communication terminal B of the communication partner_AHave (
Step 202), the communication terminal A sends a communication message to be transmitted.
Public key K of communication terminal B of the communication partner_BEncryption process using
Generate encrypted information (step 203) and encrypt
Information is the secret key D of the terminal A_AAuthenticate with and seal information
Is generated (step 204), and the encrypted information and the seal information are
Set it in the communication frame and send it to communication terminal B (step
205), the communication terminal B uses the communication frame as a source communication
Public key K of terminal A_AOf the communication terminal A
The legitimacy of the communication terminal A is judged (step 206).
If the security is recognized, the encrypted information is sent to the secret key of the own terminal B.
-D _BIn step 207, the data is decrypted and decrypted.

FIG. 3 is a diagram for explaining the third principle of the present invention. According to the present invention, a secret key D _A unique to the communication terminal A connected to the communication network and a public key K _A corresponding to the secret key are set (step 301), and the communication terminal B sets the source communication terminal A to In the data communication method of extracting the public key K _A (step 302) and transmitting / receiving the communication message, the communication terminal A authenticates the communication message with the secret key D _A of its own terminal (step 303) and performs the authenticated communication. When the communication terminal B receives the communication message by transmitting the message to the communication terminal B (step 304), the public key K _{A of the} communication terminal A is transmitted.
To verify the validity of the communication message (step 305).

FIG. 4 is a diagram for explaining the fourth principle of the present invention. According to the present invention, the secret key D _A unique to the communication terminal A connected to the communication network and the public key K _A corresponding to the secret key D _A are set (step 401), and the communication terminal D is set.
_{In the} data communication method of extracting the public key K _A of the transmission source communication terminal A in _B (step 402) and transmitting / receiving a communication message, the communication terminal A transmits the communication information to be transmitted to the secret key D of its own terminal A. Authentication processing is performed by _A to generate seal information (step 403), and the communication information and the seal information are combined and transmitted to the communication terminal B as a communication message (step 40).
4) The communication information and the seal information of the communication message are verified with the public key K _A of the communication terminal A to determine the validity of the communication message (step 405).

Further, according to the present invention, in step 106, step 206, step 305, and step 405, the public key K _A of the communication terminal A and the identification information of the communication terminal A are recorded in the communication terminal B, and the communication terminal A is recorded. The communication terminal B notifies the communication terminal B of the identification information, and the communication terminal B records the public key K _A recorded based on the notified identification information.
And the communication terminal B verifies the communication message from the communication terminal A.

Further, according to the present invention, step 6 and step 1
6. In step 25 and step 35, the communication network notifies the network address of the communication terminal A to the communication terminal B at the time of communication, and the communication terminal B transmits the public key K _A of the communication terminal A to the network address of the communication terminal A. At the same time, the communication terminal B holds the public key K held by the network address of the communication terminal A notified from the communication network when the communication message is sent.
Extract _A and notify.

FIG. 5 is a block diagram of the first principle of the present invention. The present invention sets a secret key unique to a communication terminal connected to a communication network and a public key corresponding to the secret key, notifies the public key to each other between the communication terminals, and transmits and receives a communication message. A data communication system for performing communication, comprising: a communication terminal 100
Is a key storage means 1 for storing the secret key of the terminal itself, the first public key of the terminal itself, and the second public key of the communication partner terminal.
10, an encryption means 120 for encrypting a communication message to be transmitted with a public key of a communication partner terminal, and an encryption means 12
Authentication means 130 for authenticating the communication message encrypted by 0 with the private key of the terminal itself, transmission means 140 for transmitting the encrypted communication message, and the communication message authenticated by the authentication means 130 to the communication partner terminal. And a validity determining unit 150 for verifying the validity of the received communication message by verifying it with the public key of the communication terminal of the transmission source of the received communication message, and decrypting the received communication message with the secret key of the own terminal. And a decoding means 160 for

FIG. 6 is a block diagram of the second principle of the present invention. The present invention sets a secret key unique to a communication terminal connected to a communication network and a public key corresponding to the secret key, notifies the public key to each other between the communication terminals, and transmits and receives a communication message. A data communication system for performing communication, comprising: a communication terminal 100
The key storage means 110 stores the private key of the own terminal, the public key of the own terminal, and the public key of the communication partner terminal, and the encryption means 120 that encrypts the communication message to be transmitted with the public key of the communication partner terminal. A seal information generating unit 170 that authenticates the communication message encrypted by the encrypting unit 120 with the private key of the terminal and generates seal information, an encrypted communication message, and a seal information generating unit 170. A means for sending together with the sealed information as a communication message to the communication partner terminal and a public key of the communication terminal that is the sender of the received communication message to verify the validity of the received communication message. Sex determining means 150 and decrypting means 160 for decrypting the received communication message with the private key of the terminal itself.
And

The decrypting means 160 is executed only when the validity determining means 150 confirms the validity of the received communication message. FIG. 7 is a third principle configuration diagram of the present invention. According to the present invention, a private key unique to a communication terminal connected to a communication network and a public key corresponding to the private key are set, and the public key of the source communication terminal is extracted by the destination communication terminal to obtain a communication message. The communication terminal 100 is a data communication system for transmitting and receiving data, and the communication terminal 100 authenticates a communication message by using the private key of the terminal itself and the authentication means 13.
A transmitting unit 140 for transmitting a communication message authenticated by 0 to a destination communication terminal, a receiving unit 180 for receiving the transmitted communication message, and a communication message received by the receiving unit 180 for transmitting the received communication message. The authenticity determining unit 150 verifies with the public key of the original communication terminal.

FIG. 8 is a block diagram of the fourth principle of the present invention. According to the present invention, a private key unique to a communication terminal connected to a communication network and a public key corresponding to the private key are set, and the public key of the source communication terminal is extracted by the destination communication terminal to obtain a communication message. In the data communication system for transmitting and receiving, the communication terminal 100, the communication information to be transmitted is authenticated by the secret key of its own terminal, the seal information generating means 170 for generating seal information, the communication information and the seal information. Together with the transmission means 140 for transmitting as a communication message to the destination communication terminal
And receiving means 180 for receiving the transmitted communication message,
It has a validity determination means 150 for verifying the communication information and the seal information of the communication message received from another communication terminal with the public key of the communication terminal of the transmission source to determine the validity of the communication message.

The communication terminal 100 has a storage means for storing the public key and identification information of the communication terminal of the communication partner, and an identification information notifying means for notifying the communication terminal of the communication partner of the identification information of the own terminal. When the identification information notifying means receives the identification information of the transmission source communication terminal, the storage means
A public key extracting means for extracting a public key corresponding to the identification information.

Further, the above communication network has address notifying means for notifying the network address of the communication terminal of the transmission source to the communication terminal of the transmission destination, and the communication terminal has the public key and the network address of the communication terminal of the communication partner. The communication terminal of the communication partner has public key extracting means for extracting the public key from the storage means by the network address of the communication terminal of the transmission source notified from the communication network.

According to the present invention, the private key and the public key unique to each communication terminal are held, the public key is exchanged between both the transmitting and receiving communication terminals during communication, and the communication partner is transmitted when the communication message is transmitted. Encrypt the communication message using the public key of
Sealing information is generated and transmitted using the private key of the terminal itself, and the communication terminal receiving this frame uses the public key of the communication terminal of the transmission source to authenticate the authenticity of the communication terminal of the transmission source. When the terminal is authenticated as valid, the communication message is decrypted using the secret key of the communication terminal on the receiving side. In this way, by holding the public key of the communication partner between the communicating terminals, encryption and verification can be performed using the public key of the partner terminal, so that it is possible to safely send and receive the communication message.

Further, according to the present invention, since the public key of the communication partner is held between the terminals that perform communication, even if the encryption method is not used, the communication telegram is stored as the private key of the own terminal. The terminal that has been authenticated, transmitted, and received can be verified using the public key of the partner terminal that is held.

Further, according to the present invention, the source terminal transmits the source number and the network address to the destination terminal, and the terminal on the receiving side transmits the public key of the partner terminal held in advance and the source key. It becomes possible to obtain a public key that uniquely corresponds to the original number and the network address, and verify the communication message received using the public key.

[0031]

BEST MODE FOR CARRYING OUT THE INVENTION First, a first embodiment of the present invention will be described. FIG. 9 shows the configuration of the first data communication system of the present invention. In the figure, only two communication terminals are connected to the communication network P for simplification, but in reality, n (where n> 1 integer) communication terminals are connected. The configuration is In the figure, the same components as those in FIG. 13 are designated by the same reference numerals, and the description thereof will be omitted. In the configuration shown in FIG. 13, a public key storage unit 10 for storing the public key of the partner communication terminal and the public key of the own terminal and a secret key storage unit 90 for storing the secret key of the own communication terminal are added to the configuration of FIG. This is an added configuration.

In the following description, "i" is given to each constituent element of the transmitting terminal T _i and "j" is given to each constituent element of the receiving terminal T _j . FIG. 10 shows the structure of the communication frame of the present invention. The structure of the communication frame shown in the figure is the structure shown in FIG. 14 with a seal information area 350 added. In the communication information area 340, for example, "JIS X 5738-1993" Interconnection between open systems-Directory-Part 8 Authentication framework "(ISO / IEC 9594-8)", etc., as necessary. The encrypted transmission information is set by means of the above means: In the sealed information area 350, the contents of the communication information in the communication information area 340 are calculated with the secret key D _i (for example, Japanese Patent Publication No. 3-78816, “Signed Document Communication”). Method)) is set.

The communication information set in the communication information area 340 includes the identifier (ID) of its own terminal and "JIS X 5738-1".
993 RSA by "Open Systems Interconnection-Directory-Part 8 Authentication Framework" (ISO / IEC 9594-8) "
Communication information encrypted by encryption is set. R
The SA encryption encryption key is a (e, n) pair, and the corresponding decryption key is a (d, n) pair. e and n are public keys (K), and d is a secret key (D). When the plaintext is M and the ciphertext is C, the algorithm of encryption E and decryption D is represented by C = E (M) = M ^e mod n M = D (C) = C ^d mod n. However, M and C are integers between 0 and n-1.

The seal information set in the seal information area 350 is a signature obtained by creating a signature s by an operation such as a quadratic congruence formula of Japanese Patent Publication No. 3-78816, “Signed Document Communication Method”. Let s be the seal information. Next, the first operation of the present invention will be described.

In the description of the conventional communication operation in the first operation of the present invention, the communication terminal (originating terminal / receiving terminal)
Since the operation until the communication path between them is established is the same,
The description is omitted below. Note that a unique secret key D is set for each terminal. In the following description, the secret key of the transmitting terminal T _i is D _i and the secret key of the receiving terminal T _j is D _j.
It will be described as.

FIG. 7 is a diagram for explaining the outline of the first operation of the present invention. Preliminary Confirmation Operation Step 501) The common control unit 20 _i of the transmitting terminal T _i that has received the notification that the communication path has been set extracts the public key K _i of the own terminal T _i from the public key storage unit 10 _i. .

Step 502) Communication frame creating section 7
0_iIs the own terminal T as communication information. _iID or own
Public key K of the terminal_iThe communication information area 3 of the communication frame A
Set to 40. Step 503) Communication frame creation unit 70_iProduces
The transmitted communication frame A is transmitted by the transmission unit 50._iTransfer to Send
Part 50_iSends the communication frame A to the communication network P.
You. As a result, the communication frame A propagates on the communication path.
And the receiving terminal T _jSent to.

[0038] Step 504) receiving section 60 _j of the receiving terminal T _j receives a communication frame A, and transfers the received frame A to the check unit 40 _j. Check section 40 _j
Checks the error check area 330 of the communication frame A by the above-described method to check the transmission error. Step 505) The common control unit 20 _j extracts the public key K _i of the calling terminal T _i from the communication information area 340 of the received communication frame A and stores it in the public key storage unit 10 _j . In addition, the communication frame creation unit 70 _j includes the common control unit 2
0 through _j from the public key storage unit 10 _j taken out the public key K _j of the terminal T _j, as the communication information together with its own terminal ID, and sets the communication information area 340 of the communication frame B.

Step 506) Communication frame creating section 7
0_jTransmits the generated communication frame B to the transmitter 50._jTurn to
To send. Transmitter 50_jIs the communication frame B
Send to P. As a result, the communication frame B is
Transmission terminal T _iSent to.

By the above steps 501 to 506, the public key K _j of the own terminal T _j is stored in the public key storage 10 _i of the transmitting terminal T _i , and the private key storage unit 90 _i.
Own terminal T _i unique secret key D _i is stored in the. Receiving the terminal T _j public key storage unit 10 _j of the public key K _i of the public key K _j and the remote terminal T _i of the terminal T _j is stored, the secret key storage unit 90 _j, the own terminal T _j The unique secret key D _j is stored.

Sending / Receiving Communication Message Step 507) The sending terminal T _i sends an electronic document such as a created document to the receiving terminal T _j . At this time, the communication frame creation unit 70 _i retrieves the public key K _j of the receiving terminal T that is the transmission destination from the public key storage unit 10 _i , and executes “JIS X 57”.
38-1993 Communication that is encrypted using the extracted public key K _j using the method of "Interconnection between open systems-Directory-Part 8 Framework for authentication" (ISO / IEC 9594-8) ". The information (C) is stored in the communication information area 340 of the communication frame C.
Set to.

[0042] Step 508) In addition, the communication frame generating section 70 _i, to the encrypted communication information (C), further, the own terminal T _i unique secret key D _i extracted from the secret key storage unit 90 _i Is used to generate the seal information, and the seal information is stored in the seal information area 35 of the communication frame C.
Set to 0.

Step 509) Communication frame creating section 7
0 _i transfers the communication frame C to the transmission unit 50 _i . The transmitting unit 50 _i transmits the communication frame C to the receiving terminal T _j via the communication path established via the communication network P. Step 510) When the reception section 60 _j of the receiving terminal T _j receives the communication frame C, and transferred to the checking section 40. The check unit 40 _j scrutinizes the error check area 330 of the communication frame C to check a transmission error.

Step 511) Also, the check unit 40
_For the communication information area 340 and the sealing information 350 of the received communication frame C, _j uses the public key K _i of the calling terminal T _i already stored in the public key storage unit 10 _j to obtain the Japanese Patent Publication No. 3-78816. The communication frame C is checked by using the “signed document communication method” or the like.

Step 512) If there is no problem in the check in Step 511, the secret key K _j of the own terminal stored in the secret key storage unit 90 _j is further used for the communication information in the communication information area 340. RSA encryption method "JIS X 5738-1993" Interconnection between open systems-Directory-Part 8 Authentication framework "(ISO / IEC 9594-
8) ”and the like, and if the terminal of the transmission source of the communication frame C is confirmed to be the correct terminal by the operation, the communication information is decoded, and if necessary, the data storage unit 30 _j Stored in the display unit 81 _j
Is displayed.

On the other hand, when the checking section 40 _{j determines} that the communication frame C is not a valid sender,
As communication from a communication terminal other than a normal communication terminal (a malicious third party), the communication network P is requested to disconnect or interrupt the communication path set in the communication network P, and the subsequent communication is rejected.

Further, receiving the terminal T _j of the communication frame generating unit 70 _j, generates a reply message if necessary, perform a procedure the message by a method similar to the originating terminal T _i is performed in step 104 , Can also be transmitted to the calling terminal T _i . Next, the second operation of the present invention will be described.

In the description of the conventional communication operation in the second operation of the present invention, the communication terminal (originating terminal / receiving terminal)
Since the operation until the communication path between them is established is the same,
The description is omitted. Note that a unique secret key D is set for each terminal, and in the following description, a secret key D _i is set for the transmitting terminal T _i and a secret key D _j is set for the receiving terminal T _j . I shall.

FIG. 12 is a diagram for explaining the outline of the second operation of the present invention. Step 601) The communication frame creation unit 7 of the transmitting terminal T _i that has received the notification from the communication network P that the communication path has been set.
0 _i sets the caller notification number of its own terminal T _i as communication information in the communication frame D as communication information.

Step 602) Communication frame creating section 7
0 _i transfers the set communication frame D to the transmitter 50 _i . As a result, the transmitting unit 50 _i transmits the communication frame D to the receiving terminal T _j via the communication network P. Step 603) When receiving the communication frame D, the receiving unit 60 of the receiving terminal T _j transfers the communication frame D to the checking unit 40 _j . The check unit 40 _j examines the error check area 330 of the communication frame D to check a transmission error.

Step 604) The caller notification number sent from the calling terminal T _i is acquired from the communication frame D, and
Searches the public key K _i public key storage unit 10 _j of the calling terminal T _i corresponding to the caller notification number, is set on a public key table of public key storage unit 10 _j. Thus, at a later stage, when receiving the information for verifying the originating terminal T _i, it is possible to perform verification processing by obtaining the public key K _i of the transmitting terminal T _i from the public key table.

(Step 605) The communication frame creating section 70 _i of the transmitting terminal T _i sets the communication information, which is an electronic document such as a created document, in the communication information area 340 of the communication frame E, and further sets the communication information itself. Secret key D of terminal T _i
The calculation is performed by _i (for example, Japanese Patent Publication No. 3-78816 “Signed Document Communication System”) to generate seal information and set it in the seal information area 350 of the communication frame E.

Step 606) Communication frame creating section 7
0 _i transfers the communication frame E to the transmission unit 50 _i . As a result, the transmitter 50 _i transmits to the receiving terminal T _j via the communication network P. Step 607) The receiving unit 60 _j of the receiving terminal T _{j transfers} the received communication frame E to the checking unit 40 _j .
The check unit 40 _j first inspects the error check area 330 of the communication frame E to check a transmission error,
If normal, the communication frame E is captured.

Step 608) Further, the checking unit 40
Is the calling terminal T _i acquired in step 604.
Of the public key K _i is obtained from the public key table and calculated (for example, Japanese Patent Publication No. 3-78816) to determine whether the communication frame E is information from the correct sender.

Step 609) If this judgment is correct, the information of the communication frame E is fetched and the data storage unit 3
It is stored in 0 or displayed on the display unit 81. If necessary, a reply message is created, and the reply message sent by the receiving terminal T _j is exchanged by the same procedure performed by the sending terminal T _i . When it is determined that the communication is not correct, the communication is determined to be from a communication terminal other than a normal communication terminal (a malicious third party), the communication path set in the communication network P is disconnected, or communication to the communication terminal of the other party is performed later. Reject the notification.

As described above, according to the first and second operations, by holding the public key of the partner terminal in advance, the public key of the partner terminal is used in the communication using the encryption method. The communication information can be encrypted and transmitted, and the terminal on the receiving side can verify the communication information using the public key of the terminal of the transmission source. This makes it possible to perform the decryption process using the private key of the own terminal when the verification result shows that the information is the transmission information from the valid terminal.

Even if the encryption method is not used, if the authentication process is performed using the private key of the terminal device of the transmission source and the data is transmitted, the receiving side terminal performs the verification process using the public key of the partner terminal that is held in advance. Then, it becomes possible to determine the legitimacy of the transmission source terminal.

[0058]

Embodiments of the present invention will be described below with reference to the configuration of FIG. First, the outline of the operation will be described. In the following embodiments, each terminal first transmits the public key of its own communication terminal to the communication terminal that is a communication partner and stores it in the public key storage unit 10. Acquire the public key of the communication terminal that is the communication partner, confirm that the setting in the public key storage unit 10 is complete, and perform encryption processing using the public key of the communication terminal of the communication partner, It verifies the communication message transmitted to or received by the communication terminal of the communication partner using the public key of the communication terminal of the communication partner. Here, the former process will be described as a first embodiment, and the latter process will be described as a second embodiment.

[First Embodiment] In the present embodiment, as shown in FIG. 9, in the communication terminal T, a public key storage unit 10 for storing the public key of the communication terminal of the communication partner, and the private key of the own terminal are stored. Which has a secret key storage unit 90 for encrypting the communication information input using the public key of the destination communication terminal, and authenticates the encrypted communication information using the secret key of the own communication terminal. Then, the communication terminal that has transmitted to the communication terminal of the transmission destination and received the communication information verifies the encrypted communication information by using the public key of the communication terminal of the transmission source, and if the validity is recognized, Decrypt the communication message encrypted with the terminal's private key.

The detailed operation will be described below. First, the public key storage unit 10 _i of the transmitting terminal T _i stores the public key K _j of the receiving terminal T _j that is the communication terminal of the transmission destination, and the private key storing unit 90 _i stores the public key K _j of the own terminal T _i . The private key D _i is stored. Also, the public key storage unit 1 of the receiving terminal T _j
0 The _j, stored public key K _i of the transmission source transmitting terminal T _i is the private key of the terminal is in the secret key storage unit 90 _j D _j
Is stored. This storage method is a method of setting a public key uniquely corresponding to the in-network address of the terminal notified from the communication network P, or a communication terminal ID notified from the communication partner terminal. One of the methods for setting the public key uniquely corresponding to is used.

First, a method of setting a public key in the public key table of the public key storage unit 10 will be described. In addition,
As shown in Table 1, the public key storage unit 10 may be configured to store the in-network address in the public key storage unit 10 in association with the public key.

[0062]

[Table 1]

A. Processing of Calling Terminal (1) The operator of the calling terminal T _i inputs the document information (m) from the operating section 82 _i while looking at the display section 81 _i . (2) The document information (m) is transferred to the communication frame creation unit 70 _i via the common control unit 20 _i . Communication frame creating unit 70 _i, for the document information (m), extracts the public key K _j of the destination communication terminal T _j from the public key storage unit 10 _i, the document information by using the public key K _j ( m) is encrypted. For the encryption method,
"JIS X 5738-1993" Interconnection between open systems-Directory-Part 8 Certification framework "(ISO / IEC 9594-
8) ”or the like. The communication frame creation unit 70 _i sets the encrypted communication information (C) in the communication information area 340 of the communication frame A300.

(3) Next, the communication frame creating section 70
_iFrom the secret key storage unit 90 _iSecret key D
_iTo extract the encrypted information (C) and authenticate it
Generate information. The generated seal information is used as the communication frame A3.
00 in the sealed information area 350.

(4) Further, the communication frame creating section 70
_i acquires the in-network address of the destination communication terminal from the data storage unit 30 _i and sets it in the header area 310 of the communication frame A 300. (5) The communication frame creation unit 70 _i uses the communication frame A
A predetermined value of 300 is calculated using a communication polynomial and set in the error check area 330.

(6) The communication frame creating section 70 _i uses the communication frame A3 generated by the above (2) to (5).
00 is transferred to the transmitting unit 50 _i . (7) The transmitting unit 50 _i transmits the communication frame A300 to the receiving terminal T _j via the communication network P based on the address information of the receiving terminal T _j in the header area 310 of the communication frame A300.

[0067] - receiving portion 60 _j of the process (1) receiving terminal T _j of the receiving terminal, the transmitting terminal T _i
When the communication frame A300 is received from the communication unit A, the communication frame A300 is transferred to the check unit 40 _j .

(2) The checking unit 40 _j calculates a predetermined portion of the communication frame A300 by a communication polynomial, and if the value matches the value of the error check area 330 of the communication frame A300, the communication frame A300 is transmitted. Import as if no error occurred.

(3) Next, the checking unit 40 _j , for the communication information area 340 and the sealing information area 350 of the received communication frame A 300, of the calling terminal T _i stored in the public key storage unit 10 _j . Using the public key K _i , the validity of the communication terminal T _i that has transmitted the communication frame A300 is checked by a method such as Japanese Patent Publication No. 3-78816, “Signed Document Communication Method”. At this time,
If a public key similar to the public key K _i acquired from the public key storage unit 10 _j is used in the communication frame A300, the communication terminal T _{i that is} the transmission source of the communication frame A300 is used.
Is justified.

(4) Further, the check unit 40 _j sets the communication information in the communication information area 340 of the communication frame A 300 to the common control unit 20 only when the validity of the communication terminal T _i of the transmission source is proved. forward to _j . (5) The common control unit 20 _j acquires the secret key D _j of the own terminal T _j stored in the secret key storage unit 90 _j ,
The communication information in the communication information area 340 of the communication frame A300 is decoded. The decryption method shall be performed in accordance with "JIS X 5738-1993" Interconnection between open systems-Directory-Part 8 Authentication framework "(ISO / IEC 9594-8)", etc.

(6) Further, the common control unit 20 stores the decrypted communication information in the data storage unit 30 or displays it on the display unit 81. As described above, according to the present embodiment, it is possible to provide a data communication system having high security quality because not only the transmission error between communication terminals is checked but also the communication information is encrypted. Furthermore, the communication terminal T _i of the transmission source of the communication frame 300 is subjected to the encryption processing by the communication terminal T of the transmission destination.
Using the public key K _j of _j, at the time of decoding, in order to use the private key D _j of the received terminal T _j itself, also the communication frame as if malicious third party obtains the decoding is not possible is there.

[Second Embodiment] Next, the second embodiment of the present invention will be described.
An example will be described. In this embodiment, communication is performed on the sending terminal side.
When sending the frame 300, use the private key of the terminal itself.
Authentication, and the communication terminal of the sender is disclosed on the receiving terminal side.
The key is also used to verify the received communication frame.
Of. At this time, the public key storage unit 10 stores the above
As shown in Table 1 of the first embodiment, the public key of the communication partner and
Together, the identification information of the communication partner is added to the public key table.
It is stored and the originating terminal T _iFrom the receiving terminal T_jHas a sense
Only the other information is notified, and the receiving terminal T_jIn the identification information
Calling terminal T that supports information_iGet the public key of.

Processing of Calling Terminal (1) The operator of the calling terminal T _i inputs the document information (m) from the operating section 82 _i while looking at the display section 81 _i . (2) The document information (m) is transferred to the communication frame creation unit 70 _i via the common control unit 20 _i . The communication frame creation unit 70 _i sets the document information (m) in the communication information area 340 of the communication frame A300.

(3) Next, the communication frame creating section 70 _i
From the secret key storage unit 90 _i of the own terminal T _i The secret key D _i is acquired, the document information (m) is authenticated by the secret key D, and the seal information is generated. The generated seal information is stored in the seal information area 350 of the communication frame A300.

(4) Further, the communication frame creating section 70
_i acquires the in-network address of the communication terminal of the transmission destination from the public key storage unit 10 _i and sets it in the header area 310 of the communication frame A300. (5) The communication frame creation unit 70 _i uses the communication frame A
A predetermined value of 300 is calculated using a communication polynomial and set in the error check area 330.

(6) The communication frame creating section 70 _i uses the communication frame A3 generated by the above (2) to (5).
00 is transferred to the transmitting unit 50 _i . (7) The transmitting unit 50 _i transmits the communication frame A300 to the receiving terminal T _j via the communication network P based on the address information of the receiving terminal T _j in the header area 310 of the communication frame A300.

[0077] - receiving portion 60 _j of the process (1) receiving terminal T _j of the receiving terminal, the transmitting terminal T _i
When the communication frame A300 is received from the communication unit A, the communication frame A300 is transferred to the check unit 40 _j .

(2) The check unit 40 _j calculates a predetermined portion of the communication frame A300 by a communication polynomial. If the value matches the value of the error check area 330 of the communication frame A300, the communication frame A300 is transmitted. Import as if no error occurred.

(3) Next, the checking unit 40 _j , for the communication information area 340 and the sealing information area 350 of the received communication frame A 300, of the calling terminal T _i stored in the public key storage unit 10 _j . Using the public key K _i , the validity of the communication terminal T _i that has transmitted the communication frame A300 is checked by a method such as Japanese Patent Publication No. 3-78816, “Signed Document Communication Method”. At this time,
If a public key similar to the public key K _i acquired from the public key storage unit 10 _j is used in the communication frame A300, the communication terminal T _{i that is} the transmission source of the communication frame A300 is used.
Is justified. Regarding the method of setting the data in the public key storage unit 10, when the public keys of the other communication terminals B and C are set in the communication terminal A, for example,
The communication terminal B pairs the identification information of its own terminal and the public key,
It may be set in the communication information area 340 of the communication frame 300 and transmitted to the communication terminal A, or may be transmitted in combination with its own in-network address and public key. Of course, the identification information, the in-network address and the public key may be transmitted as one set.

When transmitting an address in the network,
As described below, the in-network address of the own terminal may be acquired in advance from the communication network P and transmitted to the terminal that is a communication partner, or directly from the terminal that sets the public key in the public key storage unit 10. The communication network P may be accessed and acquired.

As a network function, the communication network P notifies the receiving terminal T _j of the network address or the like relating to the transmitting terminal T _i .
When a so-called caller number notification service can be provided, the public key K _i corresponding to the calling terminal T _i can be extracted from the notified caller notification number from the set of public keys of the storage means included in the communication network P. Therefore, the information exchange such as the terminal ID described in the above embodiment can be omitted, and the communication cost can be further reduced.

Further, the receiving terminal T_jIs the sending terminal T_iIn the terminal
When transmitting the ID etc., the receiving terminal T _jFor the information
The originating terminal T_iPublic key K_iCryptographically processed by the receiving terminal
T_jSecret key D_jSeal with and send terminal T_iReturn to
You may make it. In this case, the originating terminal T_iso
Is a legitimate receiving terminal T_jAt the same time as determining whether or not the receiving end
End T_jIt is possible to quickly maintain confidentiality such as the terminal ID of
It works.

In the above description, as a method for checking the transmission error of the communication frame, Japanese Patent Publication No. 3-7
Although an example using the "signed document communication method" of Japanese Patent No. 8816 is shown, the method is not limited to this method, and any method capable of checking a transmission error may be used.

In the above description, as the encryption method, "JIS X 5738-1993" Interconnection between open systems-Directory-Part 8 Authentication framework "(ISO / IEC 95
94-8) ”is shown, but the present invention is not limited to this method, and other encryption methods may be used.

Further, in the above-mentioned embodiment, the communication frame applied between the plurality of communication terminals T is explained on the premise of the connection type communication, but the connectionless type communication frame applied to the LAN or the like is used. Having a destination address and a sending address does not change the essential effect of the present invention. This is the reason that this operation is only changed to the one that scrutinizes the communication information area and the seal information area of the communication frame with the public key T _i corresponding to the communication terminal T _i by the information of the source address.

The present invention is not limited to the above-mentioned embodiments, and various applications and modifications are possible within the scope of the claims.

[0087]

As described above, according to the present invention, the public key of the communication partner is acquired, encrypted using the public key, transmitted to the partner terminal, and when this is received, the partner terminal is published. Verify with the key to confirm the legitimacy of the other terminal. Then, when the correctness is confirmed, decryption is performed using the private key of the terminal itself, so that an error check in the communication between the communication terminals in the data communication system and the exclusion of communication terminals other than the authorized communication terminal are eliminated. And communication terminals with high confidentiality can be simultaneously performed, and high-speed and extremely high security capability can be obtained without lowering the communication processing capability.

Further, according to the present invention, the communication information is authenticated by using the public key of the communication partner terminal and transmitted, and the receiving terminal verifies the received communication frame by using the partner terminal, thereby performing encryption. Even when the encryption method is not used, it is possible to prevent information leakage and various tampering by terminals other than the authorized communication terminal.

[Brief description of drawings]

FIG. 1 is a diagram for explaining a first principle of the present invention.

FIG. 2 is a diagram for explaining the second principle of the present invention.

FIG. 3 is a diagram for explaining the third principle of the present invention.

FIG. 4 is a diagram for explaining a fourth principle of the present invention.

FIG. 5 is a first principle configuration diagram of the present invention.

FIG. 6 is a second principle configuration diagram of the present invention.

FIG. 7 is a third principle configuration diagram of the present invention.

FIG. 8 is a fourth principle configuration diagram of the present invention.

FIG. 9 is a configuration diagram of a first data communication system of the present invention.

FIG. 10 is a diagram showing a configuration of a communication frame of the present invention.

FIG. 11 is a diagram for explaining the outline of the first operation of the present invention.

FIG. 12 is a diagram for explaining the outline of the second operation of the present invention.

FIG. 13 is a configuration diagram of a conventional communication system.

FIG. 14 is a diagram showing a configuration of a conventional communication frame.

FIG. 15 is a sequence chart showing an operation of a conventional communication system.

[Explanation of symbols]

 10 public key storage unit 20 common control unit 30 data storage unit 40 check unit 50 transmission unit 60 reception unit 70 communication frame creation unit 81 display unit 82 operation unit 100 communication terminal 110 key storage unit 120 encryption unit 130 authentication unit 140 transmission unit 150 Validity judging means 160 Decoding means 170 Seal information generating means 180 Receiving means 300 Communication frame 310 Header area 330 Error check area 340 Communication information area 350 Seal information area

Claims (13)

[Claims] 1. A secret unique to a communication terminal connected to a communication network.
Set a secret key D and a public key K corresponding to the secret key D
Communication between the communication terminals by notifying the public key K to each other.
In the data communication method of transmitting and receiving a message, the communication terminal A is configured to use the secret key D unique to the communication terminal A._AOver
And the public key K of the communication terminal B of the communication partner_BThe communication terminal B has the secret key D unique to the communication terminal B.
_BAnd the public key K of the communication terminal B of the communication partner_AAnd the communication terminal A sends a communication message to be transmitted to the communication partner.
Public key K of communication terminal B of_BEncryption by using
Encryption information is generated, and the encrypted information is supplied to the secret key D of the own terminal A._AAuthenticate with
Generate the authentication information by setting the encrypted information and the authentication information in the communication frame.
To the communication terminal B, and the communication terminal B transmits the communication frame to the communication terminal of the transmission source.
The public key K of the end A _AVerify using the communication end
If the validity of the communication terminal A is recognized and the validity of the terminal A is determined, the encryption
The encrypted information is sent to the secret key D of the own terminal B._BDecrypt it with
A data communication method characterized by decoding. 2. A secret unique to a communication terminal connected to a communication network.
Set a secret key D and a public key K corresponding to the secret key D
Communication between the communication terminals by notifying the public key K to each other.
In the data communication method of transmitting and receiving a message, the communication terminal A is configured to use the secret key D unique to the communication terminal A._AOver
And the public key K of the communication terminal B of the communication partner_BThe communication terminal B has the secret key D unique to the communication terminal B.
_BAnd the public key K of the communication terminal B of the communication partner_AAnd the communication terminal A sends a communication message to be transmitted to the communication partner.
Public key K of communication terminal B of_BEncryption by using
Encryption information is generated, and the encrypted information is supplied to the secret key D of the own terminal A._ACertified by
To generate the seal information, and set the encrypted information and the seal information in the communication frame.
To the communication terminal B, and the communication terminal B transmits the communication frame to the communication terminal of the transmission source.
The public key K of the end A _AVerify using the communication end
If the validity of the communication terminal A is recognized and the validity of the terminal A is determined, the encryption
The encrypted information is sent to the secret key D of the own terminal B._BDecrypt it with
A data communication method characterized by decoding. 3. A secret key D unique to a communication terminal connected to a communication network and a public key K corresponding to the secret key are set, and the public key K _A of the source communication terminal _A is extracted for communication. a data communication method for transmitting and receiving message, the communication terminal a, the communication message is authenticated by the private key D _a of the terminal, and transmits the communication message that authenticated the communication terminal B, the communication terminal B is the communication message Is received, the validity of the communication telegram is determined by verifying the public key K _A of the communication terminal A. 4. A private key D unique to a communication terminal connected to a communication network and a public key K corresponding to the private key are set, and the public key K _A of the source communication terminal _A is extracted for communication. In a data communication method of transmitting and receiving a telegram, communication information to be transmitted to a communication terminal B is authenticated by a secret key D _A of the own terminal B to generate seal information, and communication is performed by combining the communication information and the seal information. It is transmitted as a telegram to the communication terminal B, and the communication information and the sealing information of the communication telegram are subjected to a verification process with the public key K _A of the communication terminal A to determine the validity of the communication telegram. Data communication method. 5. The communication terminal B is recorded together with the public key K _A of the communication terminal A and the identification information of the communication terminal A, and the communication terminal A notifies the communication terminal B of the identification information, The communication terminal B extracts the public key K _A recorded based on the notified identification information, and the communication terminal B verifies the communication message from the communication terminal A. The data communication method according to 2, 3, or 4. 6. The communication network notifies the communication terminal B of the network address of the communication terminal A when communicating, and in the communication terminal B, the public key of the communication terminal A is combined with the network address of the communication terminal A. The communication terminal B holds the network address of the communication terminal A notified from the communication network at the time of sending the communication telegram,
2. Extracting the held public key K _A.
The data communication method according to 2, 3, or 4. 7. A private key unique to a communication terminal connected to a communication network and a public key corresponding to the private key are set, and the public key is mutually notified between the communication terminals to send and receive a communication message. And a key storage unit for storing a private key of the own terminal, a public key of the own terminal, and a public key of the communication partner terminal, and a communication message to be transmitted, to the communication partner terminal. Encryption means for encrypting with the public key of, an authentication means for authenticating the communication telegram encrypted by the encryption means with the private key of the own terminal, the encrypted communication telegram, and authentication with the authentication means A transmitting means for transmitting the communication message to the communication partner terminal, and a validity determining means for verifying the validity of the received communication message by verifying with the public key of the communication terminal of the transmission source of the received communication message, Said reception Data communication system characterized by having a decoding means for decoding the communication message with the secret key of the terminal has. 8. A private key unique to a communication terminal connected to a communication network and a public key corresponding to the private key are set, and the public key is mutually notified between the communication terminals to send and receive a communication message. In the data communication system, the communication terminal is a key storage unit that stores a secret key of the own terminal, a public key of the own terminal, and a public key of the communication partner terminal, and a communication message to be transmitted of the communication partner terminal. Encrypting means for encrypting with a public key; seal information generating means for authenticating the communication message encrypted by the encrypting means with the secret key of the own terminal to generate seal information; and the encrypted communication. A transmission means for transmitting the message and the seal information generated by the seal information generating means to the communication partner terminal as a communication message and a public key of the communication terminal that is the sender of the received communication message to verify and receive the message. Shi A data communication system, comprising: a legitimacy determining unit that determines the legitimacy of the communication message, and a decrypting unit that decrypts the received communication message with a secret key of the terminal itself. 9. The decryption means executes only when the validity determination means confirms the validity of the received communication message.
A data communication system as described. 10. A private key unique to a communication terminal connected to a communication network and a public key corresponding to the private key are set,
A data communication system for transmitting and receiving a communication message by extracting the public key of a source communication terminal in a destination communication terminal, wherein the communication terminal is an authentication unit that authenticates the communication message with a secret key of the own terminal. A transmitting means for transmitting the communication message authenticated by the authenticating means to the destination communication terminal; a receiving means for receiving the transmitted communication message; and a communication message received by the receiving means for receiving the communication message. A data communication system, comprising: a validity determining unit that verifies with a public key of a communication terminal that is a transmission source of. 11. A secret key unique to a communication terminal connected to a communication network and a public key corresponding to the secret key are set,
A data communication system for transmitting / receiving a communication message by extracting the public key of a transmission source communication terminal at a transmission destination communication terminal, wherein the communication terminal performs authentication processing of communication information to be transmitted using a secret key of its own terminal. Information generating means for generating sealing information by means of a transmission means, a transmission means for transmitting the communication information and the sealing information together as a communication message to a destination communication terminal, and communication information of a communication message received from another communication terminal. And a legitimacy determining unit that verifies the seal information with the public key of the communication terminal that is the transmission source and determines the legitimacy of the communication message. 12. The communication terminal, storage means for storing a public key and identification information of the communication terminal of the communication partner, identification information notifying means for notifying the communication terminal of the communication partner of the identification information of the own terminal, The public key extracting means for extracting the public key corresponding to the identification information from the storage means when the identification information notifying means receives the identification information of the transmission source communication terminal. Alternatively, the data communication system according to item 11. 13. The communication network includes address notifying means for notifying a communication terminal of a transmission destination of a network address of a communication terminal of a transmission source, and the communication terminal has a public key and a network address of a communication terminal of a communication partner. The communication terminal of the communication partner has public key extraction means for extracting the public key from the storage means by the network address of the communication terminal of the transmission source notified from the communication network. The data communication system according to claim 7, 8, 9, 10, or 11.