WO2003101040A1

WO2003101040A1 - Secret key manager

Info

Publication number: WO2003101040A1
Application number: PCT/JP2002/005025
Authority: WO
Inventors: Kiyohito Kaneko
Original assignee: Allied Telesis K.K.
Priority date: 2002-05-23
Filing date: 2002-05-23
Publication date: 2003-12-04
Also published as: JPWO2003101040A1; AU2002308882A1

Abstract

A secret key manager, which manages a secret key for a communication device to carry out encrypting communication in an encrypting communication system, comprises an encrypting section which encrypts a secret key on the basis of device identifying information for identifying the communication device and a transmitting section which transmits the secret key encrypted by the encrypting section to the communication device.

Description

PC leak 2/05025

Technical field

The present invention relates to a secret key management device, a secret key management method, a secret key management program, and a secret key management program.

The present invention relates to an encryption communication system.

Field background technology

In recent years, with the development of wireless communication technologies such as wireless LAN, it has become essential to implement an encryption function for communication devices that perform wireless communication. However, in a conventional encrypted communication system, a character string or a secret key that is a source of a secret key must be set for a communication device. For this reason, in a large-scale encrypted communication system, it takes a long time for an administrator to input a character string or a secret key that is a source of a secret key to a communication device. In addition, the character string and the secret key that are the source of the secret key must be visible text data because the administrator inputs it directly to the communication device, and there is a problem that the secret key may be stolen.

Therefore, an object of the present invention is to provide a secret key management device, a secret key management method, a secret key management program, and an encryption communication system that can solve the above-mentioned problems. This object is achieved by a combination of features described in the independent claims. The dependent claims define further advantageous embodiments of the present invention.

Disclosure of the invention

In order to achieve such an object, according to a first aspect of the present invention, there is provided a secret key management device that manages a secret key for a communication device to perform encrypted communication in an encrypted communication system, A secret key based on the device identification information that identifies the communication device. PC leak 25

2 It has an encryption unit for encryption and a transmission unit for transmitting the secret key encrypted by the encryption unit to the communication device.

A device information storage unit that stores the device identification information of the communication device and the address information in association with each other; the encryption unit encrypts a secret key based on the device identification information stored in the device information storage unit; The transmitting unit may transmit the secret key to the communication device based on the address information stored in the device information storage unit.

The device information storage unit stores information indicating whether or not the transmission unit has transmitted the secret key to the communication device in association with the device identification information.The transmission unit refers to the device information storage unit, and the transmission unit The secret key may be transmitted to a communication device that has not transmitted the secret key.

The encryption unit may encrypt the secret key based on the MAC address that is the device identification information of the communication device.

The apparatus may further include a key generation unit that generates a secret key, and the encryption unit may encrypt the secret key generated by the key generation unit.

The key generation unit may further include a random number generation unit that generates a random number, and the key generation unit may generate the secret chain using the random number when the transmission unit does not transmit the secret key to the communication device.

The key generation unit further generates another secret key different from the secret key when a predetermined time has elapsed after generating the secret key, and the encryption unit further generates another secret key based on the device identification information. The encryption unit may further transmit another secret key encrypted by the encryption unit to the communication device.

The key generation unit further generates another secret key different from the secret key when a predetermined time has elapsed after the generation of the secret key, and the encryption unit encrypts the other secret key using the secret key. The transmission unit may further transmit another secret key encrypted by the encryption unit to the communication device.

The key generation unit may generate a secret key of a common key cryptosystem.

The key generation unit may generate a secret key and a public key of the public key cryptosystem, and the transmission unit may further transmit the public key generated by the key generation unit to the communication device.

According to the second aspect of the present invention, in the encrypted communication system, A secret key management method in a secret key management device that manages a secret key for performing encrypted communication, comprising: an encryption step of encrypting a secret key based on device identification information for identifying a communication device; Transmitting the secret key to the communication device. According to a third aspect of the present invention, there is provided a secret key management program for a secret key management device for managing a secret key for a communication device to perform encrypted communication in an encryption communication system, comprising: The device functions as encryption means for encrypting a secret key based on device identification information for identifying the communication device, and as transmission means for transmitting the encrypted secret key to the communication device.

According to a fourth aspect of the present invention, there is provided an encrypted communication system for performing encrypted communication, wherein a plurality of communication devices performing encrypted communication in the encrypted communication system and a plurality of communication devices encrypt each other. A secret key management device for managing a secret key for performing communication, the secret key management device comprising: an encryption unit for encrypting the secret key based on device identification information for identifying the communication device; and an encryption unit. A transmission unit that transmits the encrypted secret key to the communication device.

The encryption communication system includes, as a plurality of communication devices, a wireless access point that performs wired communication with the secret key management device, and a wireless communication terminal that performs wireless communication with the wireless access point. The secret key management device includes an encryption unit. The wireless communication terminal further includes a key recording unit that records the encrypted secret key on a removable external recording medium, the transmitting unit transmits the secret key to a wireless access point, and the wireless communication terminal transmits the secret key from the external recording medium. Reading The summary of the invention described above does not list all necessary features of the present invention, and sub-combinations of these features may also constitute the invention. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 shows an example of a configuration of an encrypted communication system 10 according to the first embodiment. FIG. 2 shows an example of the configuration of the secret key management device 100.

FIG. 3 shows an example of the data format of the device information storage unit 104. FIG. 4 shows an example of an operation flow of the secret key management device 100.

FIG. 5 shows an example of a hardware configuration of the secret key management device 100.

FIG. 6 shows an example of a configuration of an encrypted communication system 20 according to the second embodiment. BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, the present invention will be described through embodiments of the present invention. However, the following embodiments do not limit the invention according to the claims, and all combinations of the features described in the embodiments are all aspects of the present invention. It is not always necessary for the solution. FIG. 1 shows an example of a configuration of an encrypted communication system 10 according to the first embodiment of the present invention. The encryption communication system 10 includes a secret key management device 100 that manages a secret key used in the encryption communication system 10, and a wireless access point (AP) that performs wired communication with the secret key management device 100. 200 a and 200 b, and wireless communication terminals 300 a to 300 d that perform wireless communication with the wireless access points 200 a and 200 b. The wireless access points 200a and 200b and the wireless communication terminals 300a to 300d are examples of the communication device of the present invention. The communication device of the present invention may be a wireless device such as a wireless router, a wireless switch, a wireless media converter, etc., in addition to the wireless access point.

The wireless communication terminals 300 a to 300 d perform encrypted communication with the wireless access point 200 a or 200 b using the secret key generated by the secret key management device 100, and the wireless access points 200 a and 200 b To send and receive data to and from each other. This can prevent communication data between the wireless access points 200a and 200b and the wireless communication terminals 300a to 300d from being stolen. FIG. 2 shows an example of the configuration of the secret chain management device 100. The secret key management device 100 includes a random number generation unit 101 that generates a random number, and a random number generated by the random number generation unit 101. Five

A key generation unit 102 that generates a secret key using the device information; a device information storage unit 104 that stores device identification information and address information for identifying a communication device; and a device identification stored in the device information storage unit 104. The encryption unit 106 encrypts the secret key generated by the key generation unit 102 based on the information, and the encryption unit 106 encrypts based on the address information stored in the device information storage unit 104. A transmission unit 108 that transmits the secret key to the wireless access points 200a and 200b, and a key record that records the secret key encrypted by the sign unit 106 on a removable external recording medium. And a timer unit 103 that notifies the key generation unit 102 and the device information storage unit 104 of the timing at which the key generation unit 102 generates a secret key.

For example, the key recording unit 110 is a floppy disk drive, and records a secret key on a floppy disk that is an external recording medium. Then, the wireless communication terminals 300a to 300d read the encrypted secret key from the pop-up disk provided by the administrator of the encrypted communication system 10, and read the device identification information of each wireless communication terminal. , Respectively. The wireless access points 2000a and 2000b respectively decrypt the secret key received from the secret key management device 100 using the device identification information of each wireless access point. Then, the wireless access points 200a and 200b and the wireless communication terminals 300a to 300d perform encrypted communication using the distributed secret key.

When the encrypted communication system 10 is constructed so that encrypted communication is performed by the common key encryption method, the key generation unit 110 generates a secret key of the common key encryption method. Further, when the encrypted communication system 10 is constructed so that the encrypted communication is performed by the public key encryption method, the key generation unit 110 generates a secret key and a public key of the secret key encryption method. . In this case, transmitting section 108 transmits the secret key and public key generated by key generating section 102 to radio access points 200a and 200b. Further, the key recording unit 110 records the secret key and the public key on an external recording medium. Then, the wireless communication terminals 300a to 300d read the secret key and the public key from the external recording medium. According to the secret key management apparatus 100 according to the present embodiment, the secret key is encrypted and distributed based on the device identification information. it can. In addition, wireless access point via network

Since the secret key is distributed to 200a and 200b, the administrator inputs the character string or the secret key that is the source of the secret key to the wireless access points 200a and 200b. You can save time and effort. Further, since the key generation unit 102 automatically generates a secret key and distributes the secret key via a network or an external recording medium, the secret key can be converted into binary data. FIG. 3 shows an example of the data format of the device information storage unit 104. The device information storage unit 104 includes an IP address, which is address information of the communication device, a MAC address, which is device identification information of the communication device, and information indicating whether or not a secret key has been transmitted to each of the communication devices. Is stored in association with the distribution history.

For example, the device information storage unit 104 stores the date and time when the transmission unit 10'8 or the key recording unit 110 distributed the secret key to the communication device as a distribution history. Therefore, the date and time are not stored in the distribution history corresponding to the communication device to which the private key has not been distributed. According to the secret key management device 100 according to the present embodiment, the IP address and the MAC address of the communication device to which the secret key for performing the encrypted communication in the encryption communication system 10 is to be sent are stored in the device information storage unit. By registering in 104 and distributing the secret key to the registered communication device, it is possible to prevent the secret key from being leaked to communication devices other than the registered communication device. Also, by storing the distribution history, it is possible to automatically distribute a secret key to communication devices newly connected to the encrypted communication system 10 and registered in the device information storage unit 104. . FIG. 4 shows an example of the operation flow of the secret key management device 100. The encrypted communication system 10 is started (S100). When the encryption communication system 10 starts, the key generation unit 102 generates a random number because the secret key has not been transmitted to the communication device. The secret key is generated using the random number generated by the unit 101 (S102). Then, the encryption unit 106 refers to the distribution history of the device information storage unit 104 (S104), and encrypts the secret key based on the MAC address of the communication device to which the secret key has not been distributed (S104). 1 06). Then, the transmitting unit 108 or the key recording unit 110 distributes the secret {encrypted by the No. unit 106} to the communication device identified by the MAC address (S108). Then, the device information storage unit 104 stores the date and time as the distribution history in association with the MAC address of the communication device to which the secret key has been distributed (S110). Next, the timer unit 103 determines whether or not a predetermined time has elapsed since the key generation unit 102 generated the secret key (S112). If the timer unit 103 determines in S112 that the predetermined time has elapsed, the device information storage unit 104 deletes the distribution history (S114).

Then, returning to S 102, the key generation unit 102 generates another secret key different from the previously generated secret key using the random number generated by the random number generation unit 101 (S 102). Then, the encryption unit 106 refers to the distribution history of the device information storage unit 104 (S 104), and determines the MAC address of the communication device to which the secret key has not been distributed, or the secret generated by the key generation unit 102 last time. The other secret key is encrypted based on the key (S106). Then, the transmitting unit 108 or the key recording unit 110 distributes another secret key encrypted by the encrypting unit 106 to the communication device identified by the MAC address (S108). When another secret key is encrypted based on the secret key generated last time, the transmitting unit 108 sends the wireless communication terminal 300a to 300d by wireless communication via the wireless access point 200a or 200b. It is preferable to distribute by sending another secret key. If communication cannot be performed because the power of the wireless communication terminals 300a to 300d is turned off or the like, the administrator later uses the external recording medium to connect the wireless communication terminals 300a to 300d to other wireless communication terminals 300a to 300d. A private key may be distributed. Then, the device information storage unit 104 stores the date and time as the distribution history in association with the MAC address of the communication device to which the other secret key has been distributed (S110).

If the timer unit 103 determines in S111 that the predetermined time has not elapsed, PC Lankan 25

8

In this case, it is determined whether or not the secret key has been transmitted to all the communication devices registered in the device information storage unit 104 (S116). If it is determined in S116 that the secret key has not been transmitted to all communication devices, the process returns to S104.

If it is determined in S116 that the secret key has been distributed to all communication devices, the process proceeds to S118, and it is determined whether or not the encryption communication system 10 has been stopped (S118).

If it is determined in S118 that the encryption communication system 10 has not been stopped, the process proceeds to S120, and the timer unit 103 determines that the key generation unit 102 has generated the secret key. It is determined whether or not a predetermined time has elapsed (S120). If the timer unit 103 determines in S120 that the predetermined time has elapsed, the device information storage unit 104 deletes the distribution history (S114), and returns to S102.

If the timer unit 103 determines in S120 that the predetermined time has not elapsed, the process returns to S118, and determines whether the encryption communication system 10 has been stopped (S111). 8). If it is determined in S118 that the encryption communication system 100 has been stopped, the operation flow of the secret key management device 100 ends.

This operation flow has been described using an example in which a new secret key is generated and distributed every time a predetermined time elapses.However, the timer unit 103 sets the key generation unit 102 next to the secret key. You can arbitrarily vary the time until the key is generated, and distribute the secret key at any time.

According to the secret key management device 100 according to the present embodiment, every time a predetermined time elapses, a new secret chain is generated and distributed to communication devices, so even if the secret key is leaked, Leakage of communication data over a long period can be prevented. FIG. 5 shows an example of a hardware configuration of the secret key management device 100. The functions of the secret key management device 100 are as follows: CPU 810, ROM 820, RAM 830, communication interface 840, and computer 800 equipped with hard disk drive 850. This is realized in cooperation with a program executed on the computer 800. PC Ranko 25

9

The computer 800 may further include a floppy disk drive 860 and a Z or CD-ROM drive 870.

The program for realizing the function of the secret key management device 100 includes a random number generation module, a key generation module, a timer module, an encryption module, a device information storage module, a transmission module, and a key recording module. These modules include a computer 800, a random number generation unit 101, a key generation unit 102, a timer unit 103, an encryption unit 106, a device information storage unit 104, and a transmission unit 108. , And a program that operates as the key recording unit 110.

The programs or modules described above may be stored in an external storage medium. Examples of storage media include floppy disk 880, CD-ROM 890, optical recording media such as $ 0.00, magneto-optical recording media such as MD, tape media, semiconductor memory such as IC cards, etc. Can be used. Also, a storage device such as a hard disk or RAM provided in a server system connected to the dedicated communication network Internet is used as a recording medium, and an external network or a network connected to the computer 800 is used. FIG. 6 shows an example of the configuration of an encrypted communication system 20 according to the second embodiment of the present invention. In the second embodiment, the same components as those in the encrypted communication system 10 of the first embodiment are denoted by the same reference numerals as in the first embodiment. In the second embodiment, the description of the same configuration and operation as in the first embodiment will be partially omitted, and the configuration and operation different from the first embodiment will be particularly described.

The encryption communication system 200 includes a secret key management device 100 connected to the Internet network 400 and managing a secret key used in the encryption communication system 100, and an Internet network 400. Wireless access points (APs) 200a and 200 that perform wired communication with the secret key management device 100 via the router 500 connected to the Internet, the Internet network 400 and the router 500. 0 b and wireless access point 2 0 0 a And wireless communication terminals 300a to 300d that perform wireless communication with the device 200b. The secret key management device 100 is an M of the wireless access point 200a or 200b.

The secret key is encrypted based on the AC address, and transmitted to the wireless access point 200a or 200b via the Internet network 400.

According to the encrypted communication system 20 according to the present embodiment, the wireless access point

Since the secret key is encrypted based on the MAC address of 200a or 200b, the Internet network where the MA address of 200a or 200b is not readily available It is possible to prevent the secret key from being stolen in 0 0. Although the embodiments of the present invention have been described above, the technical scope of the present invention according to the present application is not limited to the above embodiments. The invention described in the claims can be implemented by adding various changes to the above embodiment. It is also apparent from the description of the claims that such an invention belongs to the technical scope of the invention of the present application. Industrial applicability

As is apparent from the above description, according to the present invention, it is possible to provide a secret key management device, a secret key management method, a secret key management program, and an encryption communication system that realize encrypted communication with high security. .

Claims

The scope of the claims

1. A secret key management device that manages a secret key for a communication device to perform encrypted communication in an encrypted communication system,

An encryption unit that encrypts the secret key based on device identification information for identifying the communication device;

A transmission unit that transmits the encrypted secret key to the communication device.

2. It further includes a device information storage unit that stores the device identification information and the address information of the communication device in association with each other,

The encryption unit encrypts the secret key based on the device identification information stored in the device information storage unit,

2. The secret according to claim 1, wherein the transmission unit transmits the secret key to the communication device based on the address information stored in the device information storage unit.

3. The device information storage unit stores information indicating whether or not the transmitting unit has transmitted the secret key to the communication device, in association with the device identification information,

The secret key according to claim 2, wherein the transmitting unit refers to the device information storage unit, and transmits the secret key to the communication device to which the transmitting unit has not transmitted the secret key. Management device.

4. The secret according to claim 1, wherein the encryption unit encrypts the secret key based on a MAC address, which is the device identification information of the communication device.

5. It further comprises a key generator for generating the secret chain,

The secret key management device according to claim 1, wherein the encryption unit encrypts the secret key generated by the key generation unit.

6. It further comprises a random number generation unit for generating random numbers, The secret key management according to claim 5, wherein the key generation unit generates the secret key using the random number when the transmission unit does not transmit the secret key to the communication device. apparatus.

7. The key generator further generates another secret key different from the secret key when a predetermined time has elapsed after the secret key was generated,

The encryption unit further encrypts the other secret key based on the device identification information,

6. The secret key management device according to claim 5, wherein the transmission unit further transmits the another secret key encrypted by the symbol unit to the communication device.

8. The key generation unit further generates another secret key different from the secret key when a predetermined time has elapsed after generating the secret key,

The encryption unit encrypts the other secret key using the secret key,

6. The secret key management device according to claim 5, wherein the transmission unit further transmits the another secret key encrypted by the encryption unit to the communication device.

9. The secret key management device according to claim 5, wherein the key generation unit generates the secret key of a common key cryptosystem.

10. The key generation unit generates the secret key and the public key of a public key cryptosystem, and the transmission unit further transmits the public key generated by the key generation unit to the communication device. 6. The secret key management device according to claim 5, wherein

11. A secret key management method in a secret chain management device for managing a secret key for a communication device to perform encrypted communication in an encrypted communication system,

Encrypting the secret key based on device identification information for identifying the communication device;

Transmitting the encrypted secret key to the communication device;

A secret key management method comprising:

12. A secret key management program for a secret key management device that manages a secret key for a communication device to perform encrypted communication in an encrypted communication system, wherein the secret key is Management device,

Encrypting means for encrypting the secret key based on device identification information for identifying the communication device;

Transmission means for transmitting the encrypted secret key to the communication device

Secret chain management program to function as a.

1 3. An encrypted communication system that performs encrypted communication,

A plurality of communication devices that perform encrypted communication in the encrypted communication system, and a secret key management device that manages a secret key for the plurality of communication devices to perform encrypted communication with each other,

The secret key management device,

A transmission unit for transmitting the secret key encrypted by the encryption unit to the communication device.

14. The encrypted communication system, as the plurality of communication devices,

A wireless access point for performing wired communication with the secret key management device;

A wireless communication terminal that performs wireless communication with the wireless access point;

With

The secret key management device,

A key recording unit that records the secret key encrypted by the encryption unit on a removable external recording medium,

The transmitting unit transmits the secret key to the wireless access point,

The wireless communication terminal,

The encrypted communication according to claim 13, wherein the secret key is read from the external recording medium.