JPS61261938A - Cipher key distributing system - Google Patents

Abstract

PURPOSE:To manage easily a cipher key by providing a means for generating a variable common to a group by inputting a function generated by a cipher device which has been set to a main mode, in case when it has been set to a sub-mode. CONSTITUTION:A mode setting part sets a main mode and a sub-mode. A common key generating part 9 generates a variable common to a group by inputting a function generated by a cipher device which has been set to the main mode, in case when it has been set to the sub-mode. When a power source switch 2 provided on a power source part 1 of the cipher device, or a key generation start switch 11 is turned on, a key generating part 4 is started. When the setting part 8 is set to the sub-mode, the common key generating part 9 generates the variable common to the group, and transfers it to a cipher key operating part 5.

Description

[Detailed Description of the Invention] [Summary] In a cryptographic device that uses a public key distribution method and creates keys in two layers, a primary mode and a secondary mode are provided, and when the secondary mode is set, the primary mode is This method simplifies encrypted communication within a group by creating a common encryption key for the group from a function created by a cryptographic device.

[Industrial application field]

The present invention relates to a cryptographic key distribution method that uses a public key distribution method to create a common cryptographic key among a plurality of cryptographic devices that create keys in two layers.

In cryptographic devices, a two-layer key management system has been put into practical use in order to distribute cryptographic keys used for encryption and decryption using a public key distribution system and to improve confidentiality.

When a plurality of cryptographic devices constitute a group, it is desired to realize a means for easily delivering a cryptographic key that enables encrypted communication to each cryptographic device belonging to the group.

[Conventional technology]

FIG. 3 is a diagram showing an example of a conventional cryptographic device.

Now, when two cryptographic devices A and B, each having the configuration shown in FIG. The start of power supply to the unit 1 is detected, and the key generation unit 4 is activated. The key generation section 4 generates a variable a and transmits it to the encryption key calculation section 5. The encryption key calculation section 5 calculates a function X (=M''' (mod n)) from the variable a transmitted from the key generation section 4 and the preset primitive root M.

Similarly, in the cryptographic device B, when the power switch 2 is turned on, the power detection unit 3 detects the start of power supply from the power supply unit 1, and activates the key generation unit 4. The key generation unit 4 generates a variable and transmits it to the encryption key calculation unit 5, and the encryption key calculation unit 5 generates a variable
The variable transmitted from M is the preset primitive root M.
From this, the function X [=Mb(mod n)) is calculated.

Next, cryptographic devices A and B exchange functions X and Y after confirming each other.

In the cryptographic device A, when the function Y received from the cryptographic device B is inputted from the key operator unit 6, the cryptographic key calculation unit 5 generates the basic key Kl (=Y”(Ilod n)) in the same process as described above.
) and transmits it to the cryptographic processing unit 7.

Similarly, in cryptographic device B, when the function to communicate.

As a result of the above, cryptographic devices A and B hold 8 in the same basic key.

Afterwards, when encrypted communication is performed between cryptographic devices A and B, in cryptographic device A, the cryptographic key calculation section 5 uses the variable C automatically generated from the key generation section 4 to calculate the function Z (=M' (
+sod n)) and transmits it to the cryptographic processing unit 7.

The cryptographic processing unit 7 encrypts the transmitted function Z using the previously transmitted basic key, and transmits it to the cryptographic device B via the communication line.

On the other hand, in the cryptographic device B as well, the cryptographic key calculation unit 5 uses the variable d automatically generated from the key generation unit 4 to generate the function W (“M
d(mod n)] and transmits it to the cryptographic processing unit 7, and the cryptographic processing unit 7 encrypts the transmitted function W using the basic key Km transmitted earlier, and sends it to the cryptographic device A via the communication line. to communicate.

In the cryptographic device A, the cryptographic processing unit 7 decrypts the encryption function W transmitted from the cryptographic device B using the basic key 8,
The obtained function W is transmitted to the encryption key calculation section 5.

The cryptographic key calculation section 5 uses the function W transmitted from the cryptographic processing section 7.
An encryption key K (=W' (mod n)) is created by:

Similarly, in the cryptographic device B, the cryptographic processing unit 7 decrypts the cryptographic function Z transmitted from the cryptographic device A using the basic key, transmits the obtained function 2 to the cryptographic key calculation unit 5, and uses the cryptographic key The calculation unit 5 calculates the encryption key K (=Z' (
mod n)).

As a result of the above, the encryption bags KA and B hold the same encryption key K.

Encryption devices A and B use encryption key K to encrypt and decrypt messages to perform encrypted communication.

Note that even when cryptographic device A performs encrypted communication with multiple cryptographic devices Bi (i=1.2,...) that belong to the same group, each cryptographic device Bi uses its own unique Create an encryption key.

[Problem that the invention seeks to solve]

As is clear from the above explanation, when a conventional cryptographic device performs encrypted communication with multiple cryptographic devices belonging to the same group, it is necessary to create a unique cryptographic key for each cryptographic device. This not only consumes a lot of time, but also may complicate the management of encryption keys.

[Means for solving problems]

The present invention solves the above problems by taking the following measures.

That is, in the present invention, there is a means for setting the primary mode and the secondary mode, and when the secondary mode is set, a function created by the cryptographic device set to the primary mode is input, and a variable common to the group is created. and create an encryption key using variables.

Note that the functions created by the cryptographic device set to the primary mode can be delivered from the cryptographic device set to the primary mode via the encrypted communication line, and the functions created by the cryptographic device set to the primary mode can be transmitted via the encrypted communication line. The device makes it possible to omit variable generation means.

[Effect]

That is, according to the present invention, the cryptographic device set to the secondary mode creates a variable common to the group based on the function created by the cryptographic device set to the primary mode, and creates an encryption key using the variable. Therefore, a common encryption key is created with any encryption device within the group, and the creation and management of encryption keys is simplified with the two-layer key management method applied, making encrypted communication within the group easier. becomes easier.

Furthermore, if necessary, the encryption key currently in common use within the group can be updated.

Furthermore, a cryptographic device that is always operated in slave mode can be configured more economically.

〔Example〕

An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing an encryption key distribution system according to an embodiment of the present invention. Note that the same reference numerals indicate the same objects throughout the figures.

In FIG. 1, a mode setting unit 8 is provided as a means for setting the main mode and the slave mode, and when the slave mode is set, the function created by the cryptographic device set to the master mode is input. A common key generation section 9 is provided as means for creating variables common to the group, and a key change setting section 10 is further provided as means for setting the encryption key change mode.

Encryption device A now has multiple encryption devices B belonging to the same group.
When performing encrypted communication with i, the cryptographic device A sets the mode setting unit 8 to the main mode, and each cryptographic device Bi sets the mode setting unit 8 to the secondary mode.

In this state, when the power switch 2 or the key generation activation switch 11 provided in the power supply section 1 of the cryptographic device A is turned on, the key generation section 4 is activated in the same process as shown in FIG. 3, and the mode setting section 8 is activated. The encryption key calculation section 5 identifies that the main mode is set and generates a variable a0, and the key generation section 4
A function Xo (=M'' (nod n)) is calculated from the variable a0 transmitted from the source and the preset primitive root M.

The calculated function X0 is calculated by checking the other party,
It is distributed to each cryptographic device Bi.

In the cryptographic device Bi, the mode setting unit 8 identifies that the slave mode is set, the key generation unit 4 does not generate any variables, and the common key generation unit 9 generates a variable common to the group. and transmits it to the encryption key calculation unit 5.

In this state, when the function X0 distributed from the cryptographic device A is input from the key input unit 6, the encryption key calculation unit 5 multiplies the function X0 by the variable Calculate the function Yo (=M” (mod n)) from b0 and the preset primitive root M, and further calculate the basic 1!Kl@ (=XO”) from the function X0 and variable b0.
(llIod n)) and transmits it to the cryptographic processing unit 7.

Note that the cryptographic device Bi distributes the function Y0 to the cryptographic device A after confirming the other party.

In cryptographic device A, function Y received from cryptographic device Bi
When 0 is input from the key input unit 6, the encryption key calculation unit 5 converts it into a basic key in the same process as described above. (-Y.” (llIod
n)) and transmits it to the cryptographic processing unit 7.

As a result of the above, the cryptographic device A and each cryptographic device Bi hold the same basic key of 8°.

Thereafter, through the same process as described above, the cryptographic device A and each cryptographic device Bi create a common encryption key Ko within the group,
Encrypted communication becomes possible.

Next, the encryption key K that is currently commonly used within the group. When it becomes necessary to update the key change setting section 10 of the cryptographic device A and each cryptographic device Bi.

In such a case, in the cryptographic device A, the key change setting section 10
starts the key generation unit 4 and generates a variable a. The encryption key calculation unit 5 calculates a function The function Xl transmitted from the unit 5 is encrypted with 0 in the encryption key currently in use, and transmitted to the encryption device Bi via the communication line.

In the cryptographic device Bi, the cryptographic processing unit 7 decrypts the cryptographic function
to communicate.

The encryption key calculation section 5 uses the function X transmitted from the encryption processing section 7.
1, variables are created in the same process as above.

After creating (-bx+), function Y+ (=M'' (n.

dn)), and further creates an encryption key Kl (=X+'' (sod n)) from the function X and variable b1, and transmits it to the cryptographic processing unit 7.

Note that the encryption key calculation section 5 also transmits the function Y to the encryption processing section 7. The cryptographic processing unit 7 encrypts the function Y1 transmitted from the cryptographic key calculation unit 5 using the currently used encryption key, and transmits it to the cryptographic device A via the communication line.

In the cryptographic device A, the cryptographic processing unit 7 uses the encryption function Y transmitted from the cryptographic device Bi as the encryption key K currently in use.
. The function Y1 is decrypted by the encryption key calculation unit 5.
to communicate.

The encryption key calculation section 5 uses the function Y transmitted from the encryption processing section 7.
, the encryption key is + (=y+ al (modn
)) and transmits it to the cryptographic processing unit 7.

As described above, the encryption device A and each encryption device Bi use the encryption key K that is currently commonly used within the group. has been updated to a common encryption key.

From now on, the encryption device A and each encryption bag WBi will use 1 for the encryption key.
Encrypted communication becomes possible using .

As is clear from the above description, according to this embodiment, the cryptographic device A can perform encrypted communication with each cryptographic device Bi in the group using 0 as a common encryption key, and It is also possible to update the encryption key to 1 with a new encryption key.

Note that FIG. 1 is only one embodiment of the present invention, and for example, the configuration of the cryptographic device Bi is not limited to that shown in the figure, and many other modifications may be considered. In this case, the effects of the present invention remain the same.

FIG. 2 is a diagram showing an encryption key distribution system according to another embodiment of the present invention.

In FIG. 2, the target is a cryptographic device that is always operated in slave mode, and in such a case, the key generation section 4, mode setting section 8, and key change setting section 10 are unnecessary, making the cryptographic device economical. can be achieved.

〔Effect of the invention〕

As described above, according to the present invention, in the cryptographic device, the cryptographic device set to the secondary mode creates a variable common to the group based on the function created by the cryptographic device set to the primary mode, and uses the variable. Since a common encryption key is created with any encryption device in the group, the creation and management of encryption keys is simplified when the two-layer key management method is applied. , Encrypted communication within the group becomes easy.

Furthermore, if necessary, the encryption key currently in common use within the group can be updated.

Furthermore, a cryptographic device that is always operated in slave mode can be configured more economically.

[Brief explanation of drawings]

FIG. 1 is a diagram showing an encryption key distribution method according to an embodiment of the present invention, FIG. 2 is a diagram showing an encryption key distribution method according to another embodiment of the invention, and FIG. 3 is a diagram showing an example of a conventional cryptographic device. FIG. In the figure, ■ is a power supply unit, 2 is a power switch, 3 is a power supply detection unit, 4 is a key generation unit, 5 is an encryption key calculation unit, 6 is a key input unit, 7 is an encryption processing unit, 8 is a mode setting unit, Reference numeral 9 indicates a common key generation section, 1o indicates a key change setting section, and 11 indicates a key generation activation switch. Ho Climb Moon's Fruits Promotion】J Shows σ Mouth Leather 1 Mouth Month ＼ Pouse 3 Days) 1 Nono Sera Φ Smell Clamp] Lili Dono Misu Acid 0 Chia 2 Figure Conventional A 3 Smooth Shell IH?] Office, Igencha 3 figure

Claims (3)

[Claims] (1) In a cryptographic device that uses a public key distribution method and creates keys in two layers, means for setting a primary mode and a secondary mode, and the cryptographic device that is set to the primary mode when the secondary mode is set. 1. A cryptographic key distribution system, comprising means for creating a variable common to a group by receiving a function created by the group as input, and creating a cryptographic key using the variable. (2) The function created by the cryptographic device set to the main mode is delivered from the cryptographic device set to the main mode via an encrypted communication line. Encryption key distribution method described in section. (3) The encryption key distribution system according to claim 1, wherein the encryption device that is always set to the slave mode omits variable generation means.