KR20010038851A - Encrytion and Decrytion Key Distribution Method of Secure Communication System - Google Patents

Abstract

PURPOSE: A method for distributing a secret key in a secret telecommunication system is provided to achieve the reliable secret telecommunication service by preventing the secret key from revealing to other person. CONSTITUTION: A user of a secret telecommunication service receives a variable secret key from a secret key managing system. The user can uses the secret telecommunication service by using the variable secret key. A terminal for the secret telecommunication has an algorithm of creating variable secret key therein. When the user is connected to a telecommunication net work, the terminal receives the user's variable secret key information from the secret key managing system. Information supplied from the user's terminal is demodulated by the algorithm of creating variable secret key.

Description

Encryption key distribution method in secure communication system {Encrytion and Decrytion Key Distribution Method of Secure Communication System}

According to the present invention, in a secure communication service, a secure communication service user has an encryption key management system in a communication network without managing an individual encryption key or secret key, and a variable encryption password for communication stored in a terminal and an encryption key management system each time the secure communication service is accessed. By providing a secure communication service by distributing keys to both parties, and managing a variable encryption key, it prevents an individual's encryption key or secret key from being exposed to others by malicious eavesdropping or a path unknown to the individual, thereby ensuring high reliability. To provide a secure communication service.

The technical field of the present invention is a security communication technology field, which is currently used in electronic mail, electronic signature, authentication service (hereinafter referred to as "security communication service") using symmetric key or asymmetric key type encryption technology. In this case, the user of the secure communication service is given the private encryption key or secret key and uses the same encryption key every time the secure communication is connected, and the private encryption key is exposed to others by malicious eavesdropping on transmission lines and communication networks. There is no measure for that.

Secure communication service technology that can prevent eavesdropping on transmission line and communication network by encrypting and transmitting information transmission contents at transmitting terminal and decrypting at receiving terminal during secure communication between secure communication terminals.

1 is a structure of a secure communication service system. A secure communication subscriber connects a secure communication terminal or a secure communication module to an existing communication network and receives a variable encryption key for communication from an encryption key management system in the communication network. Will be done.

The secure communication terminal is an all-in-one terminal with a handset, a hardware encryption chip, and a variable encryption key generation algorithm unique to the terminal.It is connected to the communication network and informed of the other party's variable encryption key value from the encryption key management system during secure communication. Encrypted and transmitted with the variable encryption key, and the communication content transmitted from the counterpart secure communication terminal is decrypted with the variable encryption key generated by the variable encryption key generation algorithm of the own terminal. The variable encryption key of the terminal itself is changed, updated and stored by the variable encryption key generation algorithm after the secure communication is terminated, and used in the next secure communication.

The secure communication module is a module designed for secure communication by connecting an existing commercial terminal. The secure communication module provides an access terminal for an existing commercial terminal instead of a handset of the secure communication terminal. The rest of the configuration and functions are the same as those of the secure communication terminal.

The encryption key management system is a system that manages the encryption key of the secure communication subscriber, the network path location number, and the secure communication terminal ID. In the encryption key management system, the same algorithm as that of the unique encryption variable encryption key generation algorithm designated for each subscriber station is embedded to generate a variable encryption key of each subscriber and distribute it to the communication targets for secure communication with the variable encryption key.

When distributing the communication encryption key, the communication variable encryption key value of the called party is the variable encryption key of the calling party, and the communication variable encryption key value of the calling party is encrypted by the variable encryption key of the called party. In addition, the calling party and the called party encrypt and transmit the information transmission content by using the notified counterpart's variable encryption key, and the communication content transmitted from the other party's secure communication terminal is transmitted to the encryption key generation algorithm embedded in the receiving party's secure communication terminal itself. Decrypt with a variable encryption key for communication.

The cryptographic key management system uses the same algorithm as the unique variable cryptographic key generation algorithm specified for each subscriber station to determine the variable encryption key of each subscriber when the secure communication party's connection is confirmed. Change and update the value and save it in the database.

A public communication network means a telephone network, a data network or an intelligent network, and provides a secure communication service using an existing communication network without establishing a separate communication network for secure communication.

Fig. 2 relates to a database structure of an encryption key management system, and manages an encryption key, a network path location number, and a secure communication terminal ID (hereinafter referred to as "terminal ID") for each subscriber number.

The encryption key is divided into primary key, variable key, and public key, and the primary key is given to subscriber registration and used to change subscription, cancellation, and subscriber authentication. A variable key is a key used as a communication encryption key. A variable key value and an encryption key generated by each subscriber are generated by using a unique variable encryption key generation algorithm designated for each terminal in the secure communication terminal and the encryption key management system. The variable key value generated by the management system always matches, and this variable key is changed and updated each time the call is connected and used as the encryption key for the next call.

The public key is an encryption key for secure communication for group or group subscribers, and is used for multiple communication calls or broadcasting, and is managed only by the encryption key management system.

Network route location number consists of the country, region, city station and line number where the subscriber is located. The main location number is the main route number which is the standard of communication billing, and the temporary location number is the route number when the secure communication subscriber owns the secure communication terminal and temporarily moves to another place. In addition, the encoder management system assigns a path by giving a temporary location number first.

The terminal ID is for checking whether the caller is an authorized device and for determining and authenticating a secure communication permission.

Figure 3 relates to a secure communication encryption key distribution procedure.

① Enter the called party's subscriber number in the secure communication terminal of the calling party.

② Check the contents of the communication service in the communication network and, in the case of a secure communication service, notify the called party's subscriber number to the encryption key management system in the communication network and query the destination network path location number.

③ The encryption key management system checks whether the called party is a secure communication authorizer based on the called party subscriber number, and requests the calling party's subscriber number and terminal ID from the called party, Notify the network to configure the circuit.

④ The calling party's secure communication terminal sends the calling party's subscriber number and terminal ID to the encryption key management system, and the encryption key management system verifies whether the secure communication is authorized based on the calling party's subscriber number. The variable encryption key value of the party is encrypted with the variable encryption key of the calling party and notified to the calling party.

⑤ When the called party's line configuration is completed, the Cryptographic Key Management System encrypts the calling party's variable encryption key with the called party's variable encryption key and notifies the called party.

(6) The secure communication terminal of the calling party and the called party receiving the other party's variable encryption key encrypts the transmission with the other party's variable encryption key, and decrypts the received content with its own variable encryption key.

⑦ The encryption key management system confirms that the calling party and the called party are connected, and generates a variable encryption key of each subscriber according to the variable encryption key generation algorithm specified by each subscriber terminal and stores it in the variable encryption key database of the calling party and the called party. do.

⑧ After the end of the secure communication, the terminal of the calling party and the called party shall also update the variable encryption key using the designated unique variable encryption key algorithm and store it in the memory of the terminal and use it for the next secure communication.

The present invention provides an encryption key for generating, distributing, and managing an encryption key using the same algorithm as a secure communication terminal having a unique communication variable encryption key generation algorithm designated for each terminal and a variable encryption key generation algorithm for communication designated for each subscriber station. It consists of a management system and a database for managing secure communication subscribers.

Security encryption service for privacy protection as a security communication service system that prevents eavesdropping or misuse of information transfer due to exposure of individual encryption keys by distributing and managing encryption keys in the central encryption key management system during secure communication. It can be used for communication services that require security, such as PC communication, FAX, e-mail, e-commerce, and service user authentication.

Claims (3)

A secure communication service system having a cryptographic key management system in a communication network as shown in FIG. 1 and generating and distributing a variable encryption key for each communication connection. In generating and distributing the communication variable encryption key according to claim 1 in a central encryption key management system, the called party's variable encryption key value is the calling party's variable encryption key, and the calling party's variable encryption key value is the calling party's variable encryption key. Encryption key distribution method that encrypts and distributes to the calling party and the called party. Secure communication service designed to enable incoming and outgoing calls even after moving from any place by establishing a secure communication subscriber database and updating the temporary location protection number of the database after temporarily moving the location with a secure communication terminal. .