Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
  • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
  • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/12—Transmitting and receiving encryption devices synchronised or initially set up in a particular manner

Definitions

• the present invention relates to a communication system and a communication device, and more particularly to a communication system and a communication device that improve communication stability and security.
• IPSec IP Security
• IKE Internet Key Exchange
• an expiration date is defined for the key in order to ensure communication security. Then, when the expiration date approaches, the communication device in communication acquires the key by requesting the device distributing the key to distribute the new key, and updates the key.
• Patent Document 1 Japanese Patent Application Laid-Open No. 2001-292135
• An object of the present invention is to provide a communication system and a communication device which can prevent a situation where a key becomes invalid in only one communication device! /, And improve the stability and security of communication. It is.
• a communication system is a communication system for performing communication using a key between a first communication device and a second communication device, wherein the first communication device is a communication system of the key Storing means for storing key information including an expiration date; and transmission means for transmitting the key information at predetermined intervals, and the second communication device is another key information including the expiration date of the key.
• the information stored in the communication device and the information stored in the other communication device are shared, and the information stored in the communication device and the other communication device is stored.
• FIG. 1 is an overall configuration diagram of a communication system according to the present embodiment.
• FIG. 3 A block diagram showing the configuration of the communication apparatus of FIG.
• FIG. 4 A diagram showing an example of the configuration of a key information database unit
• FIG. 5 A block diagram showing the configuration of another communication device of FIG.
• the communication system 100 includes a communication device 101, a communication device 102, an internet system 103, and a key distribution server device 104.
• IPSec IP Security
• IP Security IP Security
• each of the communication device 101 and the communication device 102 uses the key with an expiration date used for encryption and authentication in communication performed between the communication device 101 and the communication device 102. It is obtained from the device 104. Thus, the communication device 101 and the communication device 102 share a key used for communication between them.
• Communication device 101 and communication device 102 each manage the expiration date of the key. Specifically, the communication apparatus 101 determines, at predetermined intervals, whether or not the key has expired. As a result of the determination, if it is determined that the expiration date has expired, the communication apparatus 101 acquires, from the key distribution server apparatus 104, a new key instead of the key determined to have the expiration date. The same operation is performed in the communication apparatus 102.
• the communication apparatus 101 operates as a chatter on the side of initiating a procedure, and the communication apparatus 102 operates as a response to an initiator.
• Communication device 101 generates a keepalive message at predetermined intervals, and transmits this keepalive message to communication device 102 via Internet system 103.
• This keep alive message contains information such as key identification information, expiration date of the key, and usage status.
• Communication device 102 receives the keepalive message from communication device 101, and determines whether or not the own device holds key information corresponding to the key identification information included in the keepalive message. Search for. As a result of the search, when the own apparatus does not hold key information corresponding to the key identification information included in the keepalive message, the communication apparatus 102 acquires the key of the key information from the key distribution server apparatus 104. Run.
• the communication device 102 recognizes the keepalive message.
• the information contained in the page is used to update various information related to the key information held by the device itself. Thereby, for example, the expiration date of the key of the communication apparatus 101 and the expiration date of the key of the communication apparatus 102 can be synchronized.
• the communication device 102 generates a keep-alive reply message, and transmits the keep-alive message to the communication device 101 via the Internet system 103.
• This keepalive reply message contains information such as key identification information, expiration date of the key, and usage status.
• the communication apparatus 101 receives the keepalive reply message from the communication apparatus 102, and determines whether or not the own apparatus holds key information corresponding to the key identification information included in the keepalive reply message. Search for. As a result of the search, if the own device holds the key information corresponding to the key identification information included in the keep-alive reply message and / or the own device holds the key information, the communication apparatus 101 uses the key information key as the key. Execute the procedure to acquire from the distribution server device 104.
• the communication device 101 does not perform any special operation.
• FIG. 2 is a diagram showing an example of the configuration of the keepalive message and the keepalive reply message.
• the message includes the message type (indicating a keepalive message or keepalive reply message), message length, key identification information, expiration date, and status (usage status). .
• the numbers in parentheses indicate the number of bits of each information.
• FIG. 3 is a block diagram showing the configuration of the communication apparatus 101.
• the communication apparatus 101 includes a timer management unit 111, a message generation unit 112, a key information database unit 113, a transmission unit 114, a reception unit 115, and an information extraction unit 116.
• a key management control unit 117, a key information search unit 118, a key update unit 119, a key information update unit 120, and a lifetime determination unit 121 are provided.
• the timer management unit 111 sets a key management timer that periodically expires in order to manage the expiration date of key information. This key management timer expires Each time, the timer management unit 111 outputs, to the message generation unit 112, timer expiration information indicating that the key management timer has expired.
• Message generation section 112 generates a keep alive message based on various information related to key information stored in key information database section 113, and outputs this keep alive message to transmission section 114.
• the key information database unit 113 associates key identification information, identification information of a device at the communication destination, expiration date (remaining time until expiration), and key usage state. I remember.
• the transmitting unit 114 transmits the keepalive message from the message generating unit 112 to the communication device 1.
• the receiving unit 115 receives the keepalive reply message from the communication apparatus 102 and outputs the message to the information extracting unit 116.
• the information extracting unit 116 receives the keepalive reply message from the receiving unit 115, extracts various information included in the keepalive reply message, and outputs the information to the key management control unit 117.
• the key management control unit 117 receives the key identification information received from the information extraction unit 116, and a search command signal instructing to search whether the key identification database is stored in the key information database unit 113 or not. Are output to the key information search unit 118.
• the key information search unit 118 receives the key identification information and the search command signal from the key management control unit 117, and searches the key information database unit 113 using the key identification information as a key. Then, when the search is completed, the key information search unit 118 outputs the search result information to the key management control unit 117.
• the key management control unit 117 When the key management control unit 117 receives the search result information from the key information search unit 118 and the search result information indicates that the key information database unit 113 has no key identification information, The key identification information and an acquisition command signal instructing acquisition of the key specified by the key identification information from the key distribution server device 104 are output to the update unit 119.
• the key update unit 119 receives the key identification information and the acquisition command signal from the key management control unit 117, and acquires the key specified by the key identification information from the key distribution server device 104. Then, the key updating unit 119 outputs the acquired key to a key storage unit (not shown) and The various information on the key is output to the key information update unit 120.
• the key information update unit 120 receives various information from the key update unit 119 as a key information database unit 11.
• the key management control unit 117 does not perform any special operation.
• timer management unit 111 transmits a validity period confirmation command signal instructing command confirmation of the validity period at every predetermined interval for checking the key validity period to the lifetime determination unit 121.
• the lifetime determination unit 121 determines, for each key identification information, whether the validity of the key information stored in the key information database unit 113 has expired or not. Then, the lifetime determination unit 121 acquires key identification information of the key determined to have expired, and outputs the key identification information to the key management control unit 117.
• the key management control unit 117 When the key management control unit 117 receives the key identification information from the lifetime determination unit 121, the key management control unit 117 sends the key identification information to the key update unit 119 and the key specified by the key identification information as the key distribution server. And an acquisition command signal for instructing acquisition from the device 104.
• the key update unit 119 receives the key identification information and the acquisition command signal from the key management control unit 117, and acquires the key specified by the key identification information from the key distribution server device 104. Then, the key updating unit 119 outputs the acquired key to a key storage unit (not shown), and outputs various information on the key to the key information updating unit 120.
• FIG. 5 is a block diagram showing the configuration of the communication apparatus 102.
• the communication apparatus 102 includes a receiving unit 151, an information extracting unit 152, a key management control unit 153, a key information database unit 154, a key information searching unit 155, and a key updating unit.
• a key information update unit 157, a timer management unit 158, a lifetime determination unit 159, a message generation unit 160, and a transmission unit 161 are provided.
• the receiving unit 151 receives the keepalive message from the communication apparatus 101, and outputs the keepalive message to the information extracting unit 152.
• Information retrieval unit 152 receives the keepalive message from reception unit 151 and The various information contained in the keepalive message of is extracted and output to the key management control unit 153.
• the key management control unit 153 receives the key identification information received from the information extraction unit 152, and a search command signal instructing to search whether the key identification information is stored in the key information database unit 154 or not. Output to key information search unit 155.
• the key information search unit 155 receives the key identification information and the search command signal from the key management control unit 153, and searches the key information database unit 154 using the key identification information as a key. Then, when the search is completed, the key information search unit 155 outputs the search result information to the key management control unit 153.
• the key management control unit 153 receives the search result information from the key information search unit 155, and when the search result information indicates that the key information database unit 154 has no key identification information, the key management control unit 153 The key identification information and an acquisition command signal instructing acquisition of the key specified by the key identification information from the key distribution server device 104 are output to the update unit 156.
• the key update unit 156 receives the key identification information and the acquisition command signal from the key management control unit 153, and acquires the key specified by the key identification information from the key distribution server device 104. Then, the key updating unit 156 outputs the acquired key to a key storage unit (not shown), and also outputs various information related to the key to the key information updating unit 157.
• the key information update unit 157 performs processing of storing various information from the key update unit 156 in the key information database unit 154.
• the key management control unit 153 determines various information from the information extraction unit 152.
• the key information update unit 157 outputs an update command signal instructing to update the key information.
• the key information updating unit 157 overwrites and updates various information stored in association with the key identification information from the key management control unit 153 with various information from the key management control unit 153. Do.
• the key management control unit 153 When the key information control unit 157 completes the process of storing the key information database unit 154 or the process of overwriting and updating the key information update unit 157, the key management control unit 153 sends a message to the message generation unit 160. In response, it outputs a signal instructing generation of a message.
• message generation unit 160 When receiving an instruction signal from key management control unit 153, message generation unit 160 generates a keep alive reply message based on various information related to key information stored in key information database unit 154. , This keepalive reply message is output to the transmitter section 61.
• the key information database unit 154 stores the key identification information, the identification information of the device at the communication destination, the expiration date (the remaining time until the expiration date), and the state of the key, as shown in FIG. It is.
• timer management unit 158 has a lifetime confirmation command signal instructing command confirmation of the expiration date at predetermined intervals for checking the expiration date of the key.
• the lifetime determination unit 159 determines, for each key identification information, whether the validity period of the key information stored in the key information database unit 154 has expired or not. Then, the lifetime determination unit 159 acquires key identification information of the key determined to have expired, and outputs the key identification information to the key management control unit 153.
• the key management control unit 153 When the key management control unit 153 receives the key identification information from the lifetime determination unit 159, the key management control unit 153 instructs the key updating unit 156 to identify the key identification information and the key identified by the key identification information as a key distribution server. And an acquisition command signal for instructing acquisition from the device 104.
• the key update unit 156 receives the key identification information and the acquisition command signal from the key management control unit 153, and acquires the key specified by the key identification information from the key distribution server device 104. Then, the key updating unit 156 outputs the acquired key to a key storage unit (not shown), and also outputs various information related to the key to the key information updating unit 157.
• the keep alive message and the keep alive reply message can also include the current time that is managed by the timer management unit 111 and the timer management unit 158. In this way, it is possible to adjust the deviation of the current time managed by the timer management unit between the communication apparatus 101 and the communication apparatus 102.
• the message generation unit 112 of the communication apparatus 101 acquires the current time from the timer management unit 111, and includes the current time information and the keepalive message It is generated and output to the transmission unit 114.
• the information extraction unit 152 of the communication apparatus 102 extracts current time information from the keepalive message from the communication apparatus 101, and outputs the current time information to the timer management unit 158.
• the timer management unit 158 manages and adjusts the current time based on the current time information from the information extraction unit 152.
• the message generation unit 160 acquires the current time from the timer management unit 158, generates a keep-alive reply message including the current time information, and transmits the transmission unit 161. Output to
• the message generation unit 112 generates the keepalive message using the information stored in the key information database unit 113 as it is, but the expiration date is If it is less than the threshold, it may generate a keep-alive message with its expiration date as zero.
• the communication apparatus 102 receives this keepalive message, and overwrites the information of the key information database unit 154 with various information included in the keepalive message, and then the lifetime determination unit 159 is effective.
• the key whose expiration date is zero is always the target of acquisition (key update) from the key distribution server device 104 by the key updating unit 156.
• the key acquisition (key update) is performed substantially simultaneously with the key acquisition from the key distribution server apparatus 104 in the communication apparatus 102. Therefore, the key expiration date of the communication device 101 and the key expiration date of the communication device 102 can be synchronized.
• the message generation unit 112 of the communication device 101 instead of generating the keepalive message with the expiration date being zero, the message generation unit 112 of the communication device 101 generates a command signal for updating the key in the communication device 102 together with the keepalive message, It may be configured to output to the transmitter 114. This also synchronizes the expiration date of the key of the communication device 101 with the expiration date of the key of the communication device 102.
• Communication between the devices that are components of the communication system 100 may be performed wirelessly or may be performed wired.
• communication device 101 generates a keepalive message based on key information stored in key information database unit 113 at predetermined intervals, and communication is performed.
• the communication device 102 is connected from the communication device 101
• the Eve message is received, and the key information update unit 157 stores the data (such as correction) stored in the key information database unit 154 based on the keepalive message.
• the information stored in the communication device and the information stored in the other communication device are shared, whereby the information stored in the communication device and the other communication device is stored.
• Inconsistencies in information It is possible to eliminate problems such as communication disconnection that occur, so the stability and security of communication performed between both devices can be improved.
• the present invention is useful as a communication system and communication apparatus that improve communication stability and security.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Mobile Radio Communication Systems (AREA)

Priority Applications (2)

Applications Claiming Priority (2)

Publications (1)

Family

ID=35510090

Family Applications (1)

Country Status (5)

Cited By (2)

Families Citing this family (2)

Citations (3)

Family Cites Families (11)

• 2004
  • 2004-06-22 JP JP2004184165A patent/JP4365733B2/ja not_active Expired - Fee Related
• 2005
  • 2005-06-03 US US11/630,143 patent/US7954154B2/en not_active Expired - Fee Related
  • 2005-06-03 EP EP05750802A patent/EP1758291A4/en not_active Withdrawn
  • 2005-06-03 WO PCT/JP2005/010262 patent/WO2005125082A1/ja not_active Ceased
  • 2005-06-17 TW TW094120226A patent/TW200618573A/zh not_active IP Right Cessation

Patent Citations (3)

Also Published As

Similar Documents

Legal Events