WO2016147340A1

WO2016147340A1 - Cryptographic communication device, cryptographic communication terminal, cryptographic communication method, and cryptographic communication program

Info

Publication number: WO2016147340A1
Application number: PCT/JP2015/058065
Authority: WO
Inventors: 陽一柴田; 忠和山中
Original assignee: 三菱電機株式会社
Priority date: 2015-03-18
Filing date: 2015-03-18
Publication date: 2016-09-22
Also published as: JPWO2016147340A1; JP6192870B2

Abstract

A cryptographic communication device (111) comprises a memory (155), a management unit (167), an encryption unit (168) and a data transmission unit (169). The encryption unit (168) acquires, upon each reception of an input of communication data, one of encryption keys stored in a buffer that is an internal area of the memory (155), uses the acquired encryption key to encrypt the communication data, thereby generating encrypted data, and deletes the acquired encryption key from the buffer. The data transmission unit (169) transmits the encrypted data generated by the encryption unit (168), thereby performing a cryptographic communication. While the cryptographic communication performed by the data transmission unit (169) continues, the management unit (167) adds new encryption keys to the buffer in accordance with a rate at which the number of encryption keys in the buffer decreases.

Description

Encryption communication apparatus, encryption communication terminal, encryption communication method, and encryption communication program

The present invention relates to an encryption communication device, an encryption communication terminal, an encryption communication method, and an encryption communication program.

One-time pad encryption is a common key encryption method in which a key is shared between a transmission side and a reception side. In the one-time pad encryption, encryption is performed using an encryption key having the same number of bits as communication data. In the one-time pad encryption, the encryption key once used for encryption is not reused. That is, the encryption key is made disposable.

A typical example of the one-time pad cipher is the Burnham cipher. In the Burnham cryptography, an exclusive OR or the like is calculated bit by bit for communication data and an encryption key, and the calculation result is transmitted as encrypted data. If even one bit is misaligned between the communication data and the encryption key, the encrypted data cannot be decrypted correctly. Therefore, what means is used to adjust which part of the encryption key is used for the communication data.

In the conventional communication system using the one-time pad encryption, the encryption keys held by the communication terminals are confirmed before the encryption communication, and the encryption keys used for encryption are adjusted. Thereby, even when there is a partial omission or deviation in the encryption key, encryption communication is possible (see, for example, Patent Document 1).

International Publication No. 2012/025987

In the conventional communication system, an encryption key capable of encrypting communication data for a certain time is prepared in advance. However, as described above, since the encryption key is disposable, the encryption key may be exhausted during the encryption communication. In this case, there is a delay from when the encryption key is exhausted until the encryption key is replenished. Note that the encryption key being “depleted” means that the remaining number of encryption keys is zero.

An object of the present invention is to eliminate a delay that occurs between the time when an encryption key is exhausted and the time when the encryption key is replenished.

An encryption communication apparatus according to one aspect of the present invention is provided.
Memory,
Each time communication data is input, one encryption key stored in a buffer that is an internal area of the memory is acquired, and the communication data is encrypted using the acquired encryption key. And generating encrypted data with the encryption unit for deleting the acquired encryption key from the buffer,
A data transmission unit that performs cryptographic communication by transmitting the encrypted data generated by the encryption unit;
A management unit that adds a new encryption key to the buffer according to a speed at which the number of encryption keys in the buffer decreases while encryption communication by the data transmission unit continues.

In the present invention, a new encryption key is added to the buffer according to the speed at which the number of encryption keys in the buffer decreases while the encrypted communication continues. For this reason, it is possible to eliminate a delay that occurs until the encryption key is replenished after the encryption key is depleted.

1 is a block diagram illustrating a configuration of a communication system according to Embodiment 1. FIG. FIG. 3 shows an operation of the communication system according to the first embodiment. 1 is a block diagram illustrating a configuration of an encryption communication device according to a first embodiment. 1 is a block diagram illustrating a configuration of an encryption communication device according to a first embodiment. 5 is a flowchart showing the operation of the cryptographic communication apparatus according to the first embodiment. 4 is a detailed flowchart showing the operation of the cryptographic communication apparatus according to the first embodiment. 4 is a detailed flowchart showing the operation of the cryptographic communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a specific example of processing of the cryptographic communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a specific example of processing of the cryptographic communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a specific example of processing of the cryptographic communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a specific example of processing of the cryptographic communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a specific example of processing of the cryptographic communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a specific example of processing of the cryptographic communication apparatus according to the first embodiment. FIG. 4 is a diagram illustrating a specific example of processing of the cryptographic communication apparatus according to the first embodiment. The figure which shows the hardware structural example of the encryption communication apparatus which concerns on embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In addition, the same code | symbol is attached | subjected to the part which is the same or it corresponds in each figure. In the description of the embodiments, the description of the same or corresponding parts will be omitted or simplified as appropriate.

Embodiment 1 FIG.
First, as an outline of the present embodiment, the configuration of the system according to the present embodiment, the operation of the system according to the present embodiment, and the effects of the present embodiment will be described in order.

*** Explanation of configuration ***
With reference to FIG. 1, the structure of the communication system 100 which is a system based on this Embodiment is demonstrated.

The communication system 100 includes a plurality of

encryption communication terminals

110 and 120.

In the present embodiment, the

encryption communication terminals

110 and 120 are mobile terminals such as smartphones, tablets, and mobile phones, respectively. The

encryption communication terminals

110 and 120 may be terminals other than mobile terminals such as personal computers.

The terminal A which is the encryption communication terminal 110 on the transmission side includes an encryption communication device 111 and a processing device 112.

The encrypted communication device 111 generates encrypted data by encrypting the communication data using a disposable encryption key every time the communication data is received. The cryptographic communication device 111 performs cryptographic communication by transmitting the generated encrypted data.

The processing device 112 executes a program 113 that inputs communication data to the encryption communication device 111. In the present embodiment, the program 113 is a plurality of applications 114. Specifically, the processing device 112 is a processor such as a CPU (Central Processing Unit).

The key sharing device 115 can be connected to the terminal A. The cryptographic communication apparatus 111 can acquire the cryptographic key from the key sharing apparatus 115 when the key sharing apparatus 115 is connected to the terminal A. When the key sharing device 115 is not connected to the terminal A, the encryption communication device 111 stores the encryption key in advance or generates the encryption key independently.

Terminal B, which is the encryption communication terminal 120 on the receiving side, includes an encryption communication device 121 and a processing device 122.

The cryptographic communication device 121 performs cryptographic communication by receiving encrypted data. Each time the encrypted communication device 121 receives encrypted data, the encrypted communication device 121 generates communication data by decrypting the encrypted data using a disposable encryption key.

The processing device 122 executes a program 123 that receives input of communication data from the encryption communication device 121. In the present embodiment, the program 123 is a plurality of applications 124. Specifically, the processing device 122 is a processor such as a CPU.

The key sharing device 125 can be connected to the terminal B. The cryptographic communication apparatus 121 can acquire the cryptographic key from the key sharing apparatus 125 when the key sharing apparatus 125 is connected to the terminal B. When the key sharing device 125 is not connected to the terminal B, the encryption communication device 121 stores the encryption key in advance or generates the encryption key independently.

Terminal A and terminal B are connected to a network 130 such as the Internet.

In the present embodiment, cryptographic communication between the

cryptographic communication terminals

110 and 120 is performed by the

cryptographic communication devices

111 and 121 incorporated in the

cryptographic communication terminals

110 and 120 via the network 130, respectively. The

cryptographic communication devices

111 and 121 are cryptographic communication modules that are independent of the

applications

114 and 124 executed by the

cryptographic communication terminals

110 and 120, respectively. Therefore, in this embodiment, it is possible to use encrypted communication even in the

applications

114 and 124 that do not have the encrypted communication function.

The

encryption communication devices

111 and 121 have buffers for temporarily storing encryption keys for the

applications

114 and 124, as will be described later. In the encryption communication terminal 110, when each application 114 communicates with another encryption communication terminal 120, encryption communication is performed using the encryption key in the corresponding buffer. The same applies to the encryption communication terminal 120.

The

cryptographic communication devices

111 and 121 manage buffers for the

applications

114 and 124, respectively. When the encryption key in the buffer decreases due to encryption communication, the

encryption communication devices

111 and 121 need to be based on the amount of encryption key consumed by encryption communication and the remaining amount of encryption key in the buffer. Add the encryption key to the buffer.

It should be noted that both one or both of the

encryption communication terminals

110 and 120 may be equipped with both the encryption communication module on the transmission side and the encryption communication module on the reception side. That is, the encryption communication device 111 of the terminal A may have both functions of the transmission side and the reception side. In that case, the cryptographic communication device 111 may be configured by two cryptographic communication modules of the transmission side and the reception side, or may be configured by one cryptographic communication module in which the transmission side and the reception side are integrated. . The encryption communication device 121 of the terminal B is the same as the encryption communication device 111 of the terminal A.

The number of encryption communication terminals provided in the communication system 100 is not limited to two, and may be three or more. Of the three or more encryption communication terminals, at least one encryption communication terminal is equipped with a transmission-side encryption communication module, and at least one other encryption communication terminal is equipped with a reception-side encryption communication module. The remaining encrypted communication terminals only need to be equipped with at least one of the transmitting-side encrypted communication module and the receiving-side encrypted communication module.

*** Explanation of operation ***
The operation of the communication system 100 will be described with reference to FIG. Specifically, an outline of operation when communication is performed between the application 114 of the terminal A and the application 124 of the terminal B will be described. In this operation, communication data transmitted from the application 114 of the terminal A is encrypted by the encryption communication device 111 of the terminal A. The encrypted communication data is decrypted by the encryption communication device 121 of the terminal B. The decrypted communication data is received by the application 124 of the terminal B.

First, the application 114 of the terminal A sends the destination information T1 of the terminal B to the encryption communication device 111 of the terminal A. The encryption communication device 111 identifies the terminal B from the destination information T1. The encryption communication device 111 creates the key list L1 from the encryption key group G1 that it owns. The encryption key group G1 includes an encryption key K1. The encryption communication device 111 transmits the key list L1 to the encryption communication device 121 of the terminal B.

The application 124 of the terminal B sends the destination information T2 of the terminal A to the encryption communication device 121 of the terminal B. The encryption communication device 121 identifies the terminal A from the destination information T2. The encryption communication device 121 receives the key list L1 from the encryption communication device 111 of the terminal A. The encryption communication device 121 creates a key list L2 from the encryption key group G2 held by itself. The encryption key group G2 includes an encryption key K1. However, not all of the encryption keys included in the encryption key group G2 need to match the encryption keys included in the encryption key group G1. The encryption communication device 121 specifies the encryption key K1 used for encryption communication from the key list L1 and the key list L2. The encryption communication device 121 transmits key information I1 that is identification information of the encryption key K1 to the encryption communication device 111 of the terminal A.

The encryption communication device 111 of the terminal A receives the key information I1. The encryption communication device 111 expands the data of the encryption key K1 pointed to by the key information I1 in the buffer M1 assigned to the application 114 of the terminal A. Also in the encryption communication device 121 of the terminal B, the data of the encryption key K1 pointed to by the key information I1 is expanded in the buffer M2 assigned to the application 124 of the terminal B.

Thereafter, if the communication data D1 is sent from the application 114 of the terminal A to the encryption communication device 111 of the terminal A, the encryption communication device 111 encrypts the communication data D1 by using the encryption key K1 in the buffer M1, and encrypts it. Data E1 is created. The encryption communication device 111 transmits the encrypted data E1 to the encryption communication device 121 of the terminal B.

The encryption communication device 121 of the terminal B receives the encrypted data E1. The encryption communication device 121 decrypts the encrypted data E1 using the encryption key K1 in the buffer M2, and obtains communication data D1. The encryption communication device 121 sends the communication data D1 to the application 124 of the terminal B.

Thereafter, the same processing is repeated until there is no communication data transmitted from the application 114 of the terminal A to the encryption communication device 111 of the terminal A. Note that “similar processing” refers to processing performed in the same procedure as described above using a different encryption key for each processing.

Here, it is assumed that the encryption keys in the buffer M1 and the buffer M2 are consumed by the encryption communication, so that the encryption key is insufficient and the encryption communication cannot be performed. Therefore, the encryption communication device 111 of the terminal A and the encryption communication device 121 of the terminal B monitor the decrease speeds of the encryption keys in the buffer M1 and the buffer M2, respectively.

The encryption communication device 111 of the terminal A and the encryption communication device 121 of the terminal B add the encryption keys to the buffer M1 and the buffer M2 before the encryption keys of the buffer M1 and the buffer M2 respectively disappear. In order to specify the encryption key to be added, the encryption communication device 111 of the terminal A creates a key list L3 from the encryption key group G3 held by itself. The encryption key group G3 includes an encryption key K3. The encryption communication device 111 transmits the key list L3 to the encryption communication device 121 of the terminal B.

The encryption communication device 121 of the terminal B receives the key list L3. The encryption communication device 121 creates a key list L4 from the encryption key group G4 that it owns. The encryption key group G4 includes an encryption key K3. However, not all of the encryption keys included in the encryption key group G4 need to match the encryption keys included in the encryption key group G3. The encryption communication device 121 specifies the encryption key K2 used for encryption communication from the key list L3 and the key list L4. The encryption communication device 121 transmits key information I2 that is identification information of the encryption key K2 to the encryption communication device 111 of the terminal A.

The encryption communication device 111 of the terminal A receives the key information I2. The encryption communication device 111 expands the data of the encryption key K2 pointed to by the key information I2 in the buffer M1 assigned to the application 114 of the terminal A. Also in the encryption communication apparatus 121 of the terminal B, the data of the encryption key K2 pointed to by the key information I2 is expanded in the buffer M2 assigned to the application 124 of the terminal B.

*** Explanation of effects ***
In the present embodiment, as described above, the encryption key is added after the encryption key is depleted by adding the encryption key before the encryption key is exhausted during the encryption communication of the

specific application

114, 124. It is possible to eliminate the delay that occurs up to.

In the present embodiment, when a plurality of

applications

114 and 124 perform one-time pad encryption communication in the same

encryption communication terminal

110 and 120, each

application

114 and 124 has a dedicated encryption key. There is no need. Therefore, the data capacity in the

encryption communication terminals

110 and 120 can be reduced.

In this embodiment, it is not necessary to prepare a communication path for acquiring the encryption key separately from a communication path for performing encryption communication.

Next, as the details of the present embodiment, the configuration of the

cryptographic communication devices

111 and 121, the operation of the

cryptographic communication devices

111 and 121, and the effects of the present embodiment will be described in order.

*** Explanation of configuration ***
With reference to FIG. 3, the structure of the encryption communication apparatus 111 of the terminal A is demonstrated.

The cryptographic communication device 111 includes a wired interface 151, an internal interface 152, a communication interface 153, a storage medium 154, and a memory 155. In addition, the encryption communication device 111 includes an acquisition unit 161, a data reception unit 162, a request reception unit 163, a list generation unit 164, a list transmission unit 165, an information reception unit 166, a management unit 167, and an encryption Unit 168 and a data transmission unit 169.

The wired interface 151 is an interface for communicating with an external device. The wired interface 151 is used to acquire an encryption key from the key sharing device 115. The wired interface 151 can be replaced with a wireless interface.

The internal interface 152 is an interface for communicating with the application 114 in the terminal A. The internal interface 152 is used for exchanging destination information and communication data with the application 114.

The communication interface 153 is an interface for communicating with other terminals. The communication interface 153 is used for communicating with the terminal B.

The storage medium 154 stores the encryption key group acquired by the acquisition unit 161.

The memory 155 has a buffer associated with the application 114 of the terminal A.

The acquisition unit 161 acquires the encryption key from the key sharing device 115 via the wired interface 151. The acquisition unit 161 stores the acquired encryption key in the storage medium 154.

The data receiving unit 162 receives communication data from the application 114 of the terminal A via the internal interface 152. The data reception unit 162 passes the received communication data to the encryption unit 168.

The request reception unit 163 receives destination information from the application 114 of the terminal A through the internal interface 152. The request reception unit 163 instructs the list generation unit 164 to generate a key list.

The list generation unit 164 receives the destination information from the request reception unit 163. The list generation unit 164 generates a key list from the encryption key group in the storage medium 154. The list generation unit 164 passes the generated key list to the list transmission unit 165 together with the destination information.

The list transmission unit 165 receives the key list and the destination information from the list generation unit 164. The list transmission unit 165 transmits the key list to the terminal B, which is the destination described in the destination information, via the communication interface 153.

The information receiving unit 166 receives key information that is identification information of an encryption key from the terminal B that is the partner to which the list transmitting unit 165 has transmitted the key list, via the communication interface 153. The information receiving unit 166 passes the received key information to the management unit 167.

The management unit 167 acquires an encryption key that matches the key information received from the information reception unit 166 from the storage medium 154. The management unit 167 sets a flag indicating that the encryption key in the storage medium 154 is being used. Then, the management unit 167 expands the encryption key in a buffer associated with the application 114 of the terminal A in the memory 155. Here, when there is no buffer associated with the application 114 of the terminal A in the memory 155, the management unit 167 sets the buffer in the memory 155. The management unit 167 deletes the encryption key expanded in the buffer from the storage medium 154.

The encryption unit 168 receives communication data from the data reception unit 162. The encryption unit 168 acquires the bit string of the encryption key from the buffer associated with the application 114 of the terminal A in the memory 155. The encryption unit 168 encrypts the communication data with the one-time pad encryption using the acquired bit string of the encryption key, and generates encrypted data. The encryption unit 168 passes the generated encrypted data to the data transmission unit 169.

The data transmission unit 169 transmits the encrypted data received from the encryption unit 168 via the communication interface 153.

With reference to FIG. 4, the configuration of the encryption communication device 121 of the terminal B will be described.

The cryptographic communication device 121 includes a wired interface 171, an internal interface 172, a communication interface 173, a storage medium 174, and a memory 175. The encryption communication apparatus 121 includes an acquisition unit 181, a data transmission unit 182, a request reception unit 183, an information generation unit 184, a list reception unit 185, an information transmission unit 186, a management unit 187, and a decryption unit. 188 and a data receiving unit 189.

The wired interface 171 is an interface for communicating with an external device. The wired interface 171 is used to acquire an encryption key from the key sharing device 125. The wired interface 171 can be replaced with a wireless interface.

The internal interface 172 is an interface for communicating with the application 124 in the terminal B. The internal interface 172 is used to exchange destination information and communication data with the application 124.

The communication interface 173 is an interface for performing communication with other terminals. The communication interface 173 is used for communicating with the terminal A.

The storage medium 174 stores the encryption key group acquired by the acquisition unit 181.

The memory 175 has a buffer associated with the application 124 of the terminal B.

The acquisition unit 181 acquires an encryption key from the key sharing device 125 via the wired interface 171. The acquisition unit 181 stores the acquired encryption key in the storage medium 174.

The request reception unit 183 receives destination information from the application 124 of the terminal B via the internal interface 172. The request reception unit 183 instructs the list reception unit 185 to wait for reception of the key list.

The list receiving unit 185 receives the key list via the communication interface 173. The list receiving unit 185 passes the received key list to the information generating unit 184.

The information generation unit 184 receives the key list from the list reception unit 185. The information generation unit 184 generates a key list from the encryption key group in the storage medium 174. The information generation unit 184 generates key information that is identification information of the encryption key from the key list received from the list reception unit 185 and the generated key list. The information generation unit 184 passes the generated key information to the information transmission unit 186.

The information transmitting unit 186 transmits the key information received from the information generating unit 184 to the terminal A that is the partner from which the list receiving unit 185 has received the key list, via the communication interface 173. The information transmission unit 186 passes the transmitted key information to the management unit 187.

The management unit 187 acquires an encryption key that matches the key information received from the information transmission unit 186 from the storage medium 174. The management unit 187 sets a flag indicating that the encryption key in the storage medium 174 is being used. Then, the management unit 187 expands the encryption key in a buffer associated with the application 124 of the terminal B in the memory 175. Here, if there is no buffer associated with the application 124 of the terminal B in the memory 175, the management unit 187 sets the buffer in the memory 175. The management unit 187 deletes the encryption key expanded in the buffer from the storage medium 174.

The data receiving unit 189 receives the encrypted data via the communication interface 173. The data receiving unit 189 passes the received encrypted data to the decrypting unit 188.

The decryption unit 188 receives the encrypted data from the data reception unit 189. The decryption unit 188 acquires the bit string of the encryption key from the buffer associated with the application 124 of the terminal B in the memory 175. The decryption unit 188 decrypts the encrypted data using the one-time pad encryption using the acquired bit string of the encryption key, and generates communication data. The decryption unit 188 passes the generated communication data to the data transmission unit 182.

The data sending unit 182 receives the communication data from the decoding unit 188. The data transmission unit 182 passes the received communication data to the application 124 of the terminal B via the internal interface 172.

*** Explanation of operation ***
With reference to FIG. 5 to FIG. 7, operations of the encryption communication device 111 of the terminal A and the encryption communication device 121 of the terminal B will be described. Specifically, an operation from when the encryption communication apparatus 111 of the terminal A receives the encryption communication request of the application 114 of the terminal A until the communication data reaches the application 124 of the terminal B will be described. The operations of the

cryptographic communication devices

111 and 121 correspond to the cryptographic communication method according to the present embodiment. The operations of the

cryptographic communication devices

111 and 121 correspond to the processing procedure of the cryptographic communication program according to the present embodiment.

FIG. 5 shows a rough processing flow of the encryption communication device 111 of the terminal A and the encryption communication device 121 of the terminal B.

In step S11, it is determined that encryption communication is used between the application 114 of the terminal A and the application 124 of the terminal B by an arbitrary method. The encryption communication device 111 of the terminal A receives the encryption communication request from the application 114 of the terminal A. This encrypted communication request includes destination information T1 designating the terminal B. The encryption communication device 121 of the terminal B also receives the encryption communication request from the application 124 of the terminal B. This encrypted communication request includes destination information T2 for designating the terminal A.

In step S12, the encryption communication device 111 of the terminal A and the encryption communication device 121 of the terminal B perform a key confirmation process with each other.

In step S13, the encryption communication device 111 of the terminal A performs the encryption communication process on the transmission side. The encryption communication device 121 of the terminal B performs reception side encryption communication processing.

FIG. 6 shows the flow of the key confirmation process in step S12 of FIG. Note that since the key confirmation processing is not directly involved in transmission / reception of communication data, the roles of the encryption communication device 111 of the terminal A and the encryption communication device 121 of the terminal B may be switched.

In step S21, the encryption communication device 111 of the terminal A creates a key list L1 from the encryption key group G1 in the storage medium 154.

In step S22, the encryption communication device 111 of the terminal A transmits the key list L1 created in step S21 to the encryption communication device 121 of the terminal B.

In step S23, the encryption communication device 121 of the terminal B receives the key list L1 transmitted in step S22. Further, the encryption communication device 121 of the terminal B creates the key list L2 from the encryption key group G2 in the storage medium 174.

In step S24, the encryption communication device 121 of the terminal B determines the encryption key K1 used for encryption communication from the key list L1 received in step S23 and the key list L2 created in step S23.

In step S25, the encryption communication device 121 of the terminal B sets a flag indicating that it is in use for the encryption key K1 determined in step S24 in the storage medium 174.

In step S26, the encryption communication device 121 of the terminal B transmits the key information I1 of the encryption key K1 determined in step S24 to the encryption communication device 111 of the terminal A.

In step S27, the encryption communication device 111 of the terminal A receives the key information I1 transmitted in step S26.

In step S28, the encryption communication device 111 of the terminal A sets a flag indicating that the encryption key K1 corresponding to the key information I1 received in step S27 in the storage medium 154 is in use.

In step S29, the encryption communication device 111 of the terminal A expands the encryption key K1 corresponding to the key information I1 received in step S27 in the buffer M1 in the memory 155, and deletes the original encryption key K1 from the storage medium 154. .

In step S30, the encryption communication device 111 of the terminal A notifies the start of encryption communication.

In step S31, the encryption communication device 121 of the terminal B receives a notification of the start of encryption communication.

In step S32, the encryption communication device 121 of the terminal B expands the encryption key K1 for which the flag is set in step S25 in the buffer M2 in the memory 175, and deletes the original encryption key K1 from the storage medium 174.

Note that the processing from step S24 to S29 and step S32 is performed not only for the encryption key K1, but also for all encryption keys common to the key list L1 on the transmission side and the key list L2 on the reception side.

FIG. 7 shows the flow of encryption communication processing in step S13 of FIG.

In step S41, the encryption communication device 111 of the terminal A receives the communication data D1 from the application 114 of the terminal A.

In step S42, the encryption communication device 111 of the terminal A encrypts the communication data D1 received in step S41 with the one-time pad encryption using the encryption key K1 in the buffer M1 of the memory 155 to obtain the encrypted data E1. .

In step S43, the encryption communication device 111 of the terminal A transmits the encrypted data E1 obtained in step S42 to the encryption communication device 121 of the terminal B. If the communication ends here, the encryption communication process ends.

If the communication is not finished, in step S44, the encryption communication device 111 of the terminal A checks the remaining amount of the encryption key in the buffer M1, and determines whether it is necessary to add the encryption key to the buffer M1. If it is not necessary to add an encryption key, the encryption communication apparatus 111 of the terminal A repeats the process after step S41 about the following communication data.

As a result of the determination in step S44, when an encryption key is added to the buffer M1, in step S45, the encryption communication device 111 of the terminal A performs a key confirmation process. The key confirmation process is as described with reference to FIG. 6, but the process of notifying the start of encrypted communication in steps S30 and S31 is not necessary.

In step S46, the encryption communication device 121 of the terminal B receives the encrypted data E1 transmitted in step S43 from the encryption communication device 111 of the terminal A.

In step S47, the encryption communication device 121 of the terminal B uses the encryption key K1 stored in the buffer M2 of the memory 175 to decrypt the encrypted data E1 received in step S46 using the one-time pad encryption to obtain communication data D1. . The encryption communication device 121 of the terminal B passes the communication data D1 to the application 124 of the terminal B. If the communication ends here, the encryption communication process ends.

If the communication is not finished, in step S48, the encryption communication device 121 of the terminal B checks the remaining amount of the encryption key in the buffer M2, and determines whether it is necessary to add the encryption key to the buffer M2. If it is not necessary to add an encryption key, the encryption communication apparatus 121 of the terminal B repeats the process after step S46 about the following encryption data.

If the result of determination in step S48 is that an encryption key is to be added to the buffer M2, in step S49, the encryption communication device 121 of the terminal B performs key confirmation processing. The key confirmation process is as described with reference to FIG. 6, but the process of notifying the start of encrypted communication in steps S30 and S31 is not necessary.

Here, processing performed by the management unit 167, the encryption unit 168, and the data transmission unit 169 of the encryption communication device 111 of the terminal A in the encryption communication processing will be described.

In steps S41 and S42, every time the encryption unit 168 receives input of communication data, the encryption unit 168 acquires one encryption key out of the encryption keys stored in the buffer that is an internal area of the memory 155, and the acquired encryption key The encrypted data is generated by encrypting the communication data using, and the acquired encryption key is deleted from the buffer.

In step S43, the data transmission unit 169 performs encrypted communication by transmitting the encrypted data generated by the encryption unit 168.

In steps S44 and S45, the management unit 167 adds a new encryption key to the buffer according to the speed at which the number of encryption keys in the buffer decreases while the encrypted communication by the data transmission unit 169 continues. Specifically, the management unit 167 estimates the time until the encryption key in the buffer runs out from the speed at which the number of encryption keys in the buffer decreases and the number of encryption keys remaining in the buffer. When the value falls below the threshold, a new encryption key is added to the buffer. This threshold value can be arbitrarily adjusted, but is preferably set to a time longer than the delay that occurs between the time when the encryption key in the buffer is exhausted and the time when the encryption key is replenished in the buffer. That is, it is desirable that the threshold be set longer than the time required for executing the key confirmation process in the encryption communication device 111 of the terminal A. Note that the speed at which the number of encryption keys in the buffer decreases can be measured by an arbitrary method.

Processing performed by the management unit 187, the decryption unit 188, and the data reception unit 189 of the cryptographic communication device 121 of the terminal B in the cryptographic communication processing is also described.

In step S46, the data receiving unit 189 performs encrypted communication by receiving the encrypted data.

In step S47, every time encrypted data is received by the data receiving unit 189, the decrypting unit 188 acquires one of the encryption keys stored in the buffer that is an internal area of the memory 175, and acquires it. The communication data is generated by decrypting the encrypted data using the encrypted key, and the acquired encryption key is deleted from the buffer.

In steps S48 and S49, the management unit 187 adds a new encryption key to the buffer according to the speed at which the number of encryption keys in the buffer decreases while the encryption communication by the data reception unit 189 continues. Specifically, the management unit 187 estimates the time until the encryption key in the buffer runs out from the speed at which the number of encryption keys in the buffer decreases and the number of encryption keys remaining in the buffer. When the value falls below the threshold, a new encryption key is added to the buffer. This threshold value can be arbitrarily adjusted as in the case of terminal A, but is set to a time longer than the delay that occurs between the time when the encryption key in the buffer is exhausted and the time when the encryption key is replenished to the buffer. It is desirable that That is, it is desirable that the threshold is set longer than the time required for executing the key confirmation process in the encryption communication apparatus 121 of the terminal B. Note that the speed at which the number of encryption keys in the buffer decreases can be measured by an arbitrary method.

In this embodiment, the buffers of the encryption communication device 111 of the terminal A and the encryption communication device 121 of the terminal B are individually assigned to each of the plurality of

applications

114 and 124. For this reason, the

management units

167 and 187 make a new response according to the speed at which the number of encryption keys in the buffer allocated to the

applications

114 and 124 in which the encrypted communication continues among the plurality of

applications

114 and 124 decreases. The encryption key is added to the buffer assigned to the

application

114 or 124. Specifically, the

management units

167 and 187 determine whether the number of encryption keys in the buffer allocated to the

applications

114 and 124 decreases and the number of encryption keys remaining in the buffer. The time until the encryption key runs out is estimated, and when the estimated time falls below the threshold, a new encryption key is added to the buffer. This threshold value may be set uniformly, but may be set at a different time for each application 114. For example, the threshold may be set longer for an application 114 that has a relatively high degree of influence due to delay, such as a voice call, and may be set shorter for an application 114 that has a relatively low degree of influence due to delay, such as mail communication.

In the present embodiment, the encryption keys used by the encryption unit 168 of the encryption communication device 111 of the terminal A and the decryption unit 188 of the encryption communication device 121 of the terminal B are determined by communication with the respective counterparts of the encryption communication. The Specifically, which encryption key is used and in what order is determined by communication. However, which encryption key is used and in what order may be determined in advance. In that case, most of the key confirmation process can be omitted except for the process of notifying the start of encrypted communication in steps S30 and S31.

Hereinafter, specific examples of the key information, the flag, the encryption key group, the key list, the communication data, the encrypted data, and the processing related to these will be described with reference to FIGS.

FIG. 8 shows a specific example of processing performed by the list generation unit 164 of the encryption communication device 111 of the terminal A.

In the encryption key database 210 of the storage medium 154, a plurality of encryption keys included in the encryption key group G1 are recorded. Each encryption key includes key information, a flag, and key data. For example, the encryption key K1 includes key information I1 “002”, a flag “unused”, and key data “10111011010.

The list generation unit 164 extracts the key information of the encryption key whose flag is “unused” from the encryption key database 210. The list generation unit 164 generates the extracted key information list as the key list L1.

FIG. 9 shows a specific example of processing performed by the information generation unit 184 of the encryption communication device 121 of the terminal B.

In the encryption key database 220 of the storage medium 174, a plurality of encryption keys included in the encryption key group G2 are recorded. The configuration of each encryption key is the same as that of the encryption key database 210 of the terminal A.

When the information generation unit 184 receives the key list L1 from the list reception unit 185, the information generation unit 184 extracts the key information of the encryption key whose flag is “unused” from the encryption key database 220. The information generation unit 184 generates the extracted key information list as the key list L2. The information generation unit 184 compares the key list L1 and the key list L2. The information generation unit 184 selects key information in both lists as a result of comparison. For example, the key information I1 is key information in both lists. The information generation unit 184 passes the selected key information to the information transmission unit 186. At this time, the information generating unit 184 sets the encryption key flag that matches the selected key information to “in use” in the encryption key database 220. The key information selected by the information generation unit 184 corresponds to the key information generated by the information generation unit 184.

FIG. 10 shows a specific example of processing performed when the management unit 167 of the encryption communication device 111 of the terminal A receives the key information I1.

Upon receiving the key information I1 from the information receiving unit 166, the management unit 167 searches the encryption key database 210 of the storage medium 154 for the encryption key K1 having the same key information I1. The management unit 167 sets the flag of the encryption key K1 to “in use”.

FIG. 11 shows a specific example of processing performed when the management unit 167 of the encryption communication device 111 of the terminal A expands the encryption key in the buffer M1.

The management unit 167 reads the key data of the encryption key K1 having the same key information I1 received from the information receiving unit 166. The management unit 167 expands the read key data of the encryption key K1 in the buffer M1 of the memory 155. At this time, the management unit 167 deletes the encryption key K1 expanded in the buffer M1 from the encryption key database 210 of the storage medium 154.

Similarly, the management unit 187 of the encryption communication device 121 of the terminal B reads the key data of the encryption key K1 having the same key information I1 as that generated by the information generation unit 184. The management unit 187 expands the read key data of the encryption key K1 in the buffer M2 of the memory 175. At this time, the management unit 187 deletes the encryption key K1 expanded in the buffer M2 from the encryption key database 220 of the storage medium 174.

FIG. 12 shows a specific example of processing performed by the encryption unit 168 of the encryption communication device 111 of the terminal A.

When the encryption unit 168 receives the communication data D1 from the data reception unit 162, the encryption unit 168 reads the key data of the encryption key K1 from the buffer M1 of the memory 155. The encryption unit 168 calculates the exclusive OR of the read key data of the encryption key K1 and the communication data D1. The encryption unit 168 passes the calculation result to the data transmission unit 169 as encrypted data E1.

FIG. 13 shows a specific example of processing performed by the decryption unit 188 of the encryption communication device 121 of the terminal B.

When receiving the encrypted data E1 from the data receiving unit 189, the decrypting unit 188 reads the key data of the encryption key K1 from the buffer M2 of the memory 175. The decryption unit 188 calculates an exclusive OR of the read key data of the encryption key K1 and the encrypted data E1. The decryption unit 188 passes the calculation result to the data transmission unit 182 as communication data D1.

FIG. 14 shows a specific example of processing performed when the management unit 167 of the encryption communication device 111 of the terminal A detects that the key data of the encryption key in the buffer M1 has decreased.

The management unit 167 monitors the buffer M1 used in the encrypted communication while the encrypted communication is continued. The management unit 167 estimates the time until the key data of the encryption key is exhausted from the speed at which the key data of the encryption key decreases and the remaining amount of the key data of the encryption key. When the estimated time falls below a certain value, the management unit 167 calls a key confirmation process to maintain a state where the encryption key of the buffer M1 is not exhausted.

Similarly, the management unit 187 of the encryption communication device 121 of the terminal B monitors the buffer M2 used in the encryption communication while the encryption communication is continued. The management unit 187 estimates the time until the key data of the encryption key is exhausted from the speed at which the key data of the encryption key decreases and the remaining amount of key data of the current encryption key. The management unit 187 maintains a state where the encryption key of the buffer M2 is not depleted by calling the key confirmation process when the estimated time is less than a certain value.

*** Explanation of effects ***
In the terminal A and the terminal B configured as described above, the encryption communication device 111 and the encryption communication device 121 manage the encryption key, so that each of the

applications

114 and 124 individually manages the encryption key. An increase in capacity can be avoided. In addition, by providing a separate buffer for each of the

applications

114 and 124 and supplying an encryption key before the buffer runs out, a system that does not cause a delay during encryption communication can be realized.

That is, in the present embodiment, when it is assumed that a plurality of

applications

114 and 124 simultaneously use the one-time pad encryption communication, the data capacity in the

encryption communication terminals

110 and 120 is reduced, and the encryption communication is performed. It is possible to achieve both a delay and no delay.

As described above, in this embodiment, a new encryption key is added to the buffer according to the speed at which the number of encryption keys in the buffer decreases while the encryption communication continues. For this reason, it is possible to eliminate a delay that occurs until the encryption key is replenished after the encryption key is depleted.

Hereinafter, a hardware configuration example of the

cryptographic communication apparatuses

111 and 121 according to the embodiment of the present invention will be described with reference to FIG.

Each of the

cryptographic communication devices

111 and 121 is a computer. The

cryptographic communication devices

111 and 121 include hardware such as a processor 901, an auxiliary storage device 902, a memory 903, a communication device 904, an input interface 905, and a display interface 906, respectively. The processor 901 is connected to other hardware via the signal line 910, and controls these other hardware. The input interface 905 is connected to the input device 907. The display interface 906 is connected to the display 908.

The processor 901 is an IC (Integrated Circuit) that performs processing. The processor 901 is, for example, a CPU, a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit).

The auxiliary storage device 902 is, for example, a ROM (Read / Only / Memory), a flash memory, or an HDD (Hard / Disk / Drive). The storage medium 154 of the encryption communication device 111 and the storage medium 174 of the encryption communication device 121 correspond to the auxiliary storage device 902, respectively.

The memory 903 is, for example, a RAM (Random Access Memory). The memory 155 of the cryptographic communication device 111 and the memory 175 of the cryptographic communication device 121 correspond to the memory 903, respectively.

The communication device 904 includes a receiver 921 that receives data and a transmitter 922 that transmits data. The communication device 904 is, for example, a communication chip or a NIC (Network, Interface, Card). The wired interface 151 and the communication interface 153 of the cryptographic communication device 111 and the wired interface 171 and the communication interface 173 of the cryptographic communication device 121 correspond to the communication device 904, respectively. The internal interface 152 of the cryptographic communication device 111 and the internal interface 172 of the cryptographic communication device 121 are each a bus interface or the like.

The input interface 905 is a port to which the cable 911 of the input device 907 is connected. The input interface 905 is, for example, a USB (Universal / Serial / Bus) terminal.

The display interface 906 is a port to which the cable 912 of the display 908 is connected. The display interface 906 is, for example, a USB terminal or an HDMI (registered trademark) (High Definition, Multimedia, Interface) terminal.

The input device 907 is, for example, a mouse, a touch pen, a keyboard, or a touch panel.

The display 908 is, for example, an LCD (Liquid / Crystal / Display).

The auxiliary storage device 902 includes an acquisition unit 161, a data reception unit 162, a request reception unit 163, a list generation unit 164, a list transmission unit 165, an information reception unit 166, a management unit 167, an encryption unit 168, Data transmission unit 169 or acquisition unit 181, data transmission unit 182, request reception unit 183, information generation unit 184, list reception unit 185, information transmission unit 186, management unit 187, decryption unit 188, data A program for realizing the function of “unit” such as the receiving unit 189 is stored. This program is loaded into the memory 903, read into the processor 901, and executed by the processor 901. The auxiliary storage device 902 also stores an OS (Operating System). At least a part of the OS is loaded into the memory 903, and the processor 901 executes a program that realizes the function of “unit” while executing the OS.

In FIG. 15, one processor 901 is shown, but the

cryptographic communication apparatuses

111 and 121 may each include a plurality of processors 901. A plurality of processors 901 may execute a program for realizing the function of “unit” in cooperation with each other.

Information, data, signal values, and variable values indicating the processing results of “unit” are stored in the auxiliary storage device 902, the memory 903, or a register or cache memory in the processor 901.

“Parts” may be provided on “Circuits”. Further, “part” may be read as “circuit”, “process”, “procedure”, or “processing”. "Circuit" and "Circuitry" include not only the processor 901 but also other logic ICs, GA (Gate-Array), ASIC (Application-Specific-Integrated-Circuit), FPGA (Field-Programmable-Gate-Array), etc. It is a concept that includes various types of processing circuits.

As mentioned above, although embodiment of this invention was described, you may implement this embodiment partially. For example, only one of those described as “parts” in the description of this embodiment may be adopted, or some arbitrary combinations may be adopted. In addition, this invention is not limited to this embodiment, A various change is possible as needed.

100 communication system, 110 encryption communication terminal, 111 encryption communication device, 112 processing device, 113 program, 114 application, 115 key sharing device, 120 encryption communication terminal, 121 encryption communication device, 122 processing device, 123 program, 124 application, 125 Key sharing device, 130 network, 151 wired interface, 152 internal interface, 153 communication interface, 154 storage medium, 155 memory, 161 acquisition unit, 162 data reception unit, 163 request reception unit, 164 list generation unit, 165 list transmission unit, 166 Information reception unit, 167 management unit, 168 encryption unit, 169 data transmission unit, 171 wired interface, 172 internal interface, 17 Communication interface, 174 storage medium, 175 memory, 181 acquisition unit, 182 data transmission unit, 183 request reception unit, 184 information generation unit, 185 list reception unit, 186 information transmission unit, 187 management unit, 188 decoding unit, 189 data reception Part, 210 encryption key database, 220 encryption key database, 901 processor, 902 auxiliary storage device, 903 memory, 904 communication device, 905 input interface, 906 display interface, 907 input device, 908 display, 910 signal line, 911 cable, 912 Cable, 921 receiver, 922 transmitter.

Claims

Memory,
Each time communication data is input, one encryption key stored in a buffer that is an internal area of the memory is acquired, and the communication data is encrypted using the acquired encryption key. And generating encrypted data with the encryption unit for deleting the acquired encryption key from the buffer,
A data transmission unit that performs cryptographic communication by transmitting the encrypted data generated by the encryption unit;
An encryption communication apparatus comprising: a management unit that adds a new encryption key to the buffer according to a speed at which the number of encryption keys in the buffer decreases while encryption communication by the data transmission unit continues.
The management unit estimates the time until the encryption key in the buffer runs out from the speed at which the number of encryption keys in the buffer decreases and the number of encryption keys remaining in the buffer, and the estimated time is a threshold value. The cryptographic communication device according to claim 1, wherein the new cryptographic key is added to the buffer when the number of the cryptographic key is lower than the threshold.
The encryption communication device according to claim 1 or 2, wherein the encryption key used by the encryption unit is determined by communication with the other party of the encryption communication.
The encryption communication device according to any one of claims 1 to 3,
A cryptographic communication terminal comprising: a processing device that executes a program for inputting the communication data to the cryptographic communication device.
The buffer is individually assigned to each of a plurality of applications that are the programs,
The management unit assigns the new encryption key to the application in accordance with a speed at which the number of encryption keys in the buffer allocated to the application in which the encrypted communication is continued among the plurality of applications. The encryption communication terminal according to claim 4, wherein the encryption communication terminal is added to the allocated buffer.
Memory,
A data receiver that performs encrypted communication by receiving encrypted data;
Each time the encrypted data is received by the data receiving unit, one encryption key stored in a buffer that is an internal area of the memory is obtained, and the obtained encryption key is used to obtain the encryption key. A communication unit for generating communication data by decrypting the encrypted data, and a decrypting unit for deleting the obtained encryption key from the buffer;
An encryption communication apparatus comprising: a management unit that adds a new encryption key to the buffer according to a speed at which the number of encryption keys in the buffer decreases while encryption communication by the data reception unit continues.
The management unit estimates the time until the encryption key in the buffer runs out from the speed at which the number of encryption keys in the buffer decreases and the number of encryption keys remaining in the buffer, and the estimated time is a threshold value. The encryption communication device according to claim 6, wherein the new encryption key is added to the buffer when the value is less than.
The encryption communication device according to claim 6 or 7, wherein an encryption key used by the decryption unit is determined by communication with the other party of the encryption communication.
The cryptographic communication device according to any one of claims 6 to 8,
A cryptographic communication terminal comprising: a processing device that executes a program that receives input of the communication data from the cryptographic communication device.
The buffer is individually assigned to each of a plurality of applications that are the programs,
The management unit assigns the new encryption key to the application in accordance with a speed at which the number of encryption keys in the buffer allocated to the application in which the encrypted communication is continued among the plurality of applications. The encryption communication terminal according to claim 9, wherein the encryption communication terminal is added to the allocated buffer.
Each time a computer including a memory receives input of communication data, the computer acquires one encryption key among the encryption keys stored in a buffer that is an internal area of the memory, and uses the acquired encryption key to perform the communication Generate encrypted data by encrypting the data, delete the acquired encryption key from the buffer,
The computer performs encrypted communication by transmitting the encrypted data,
An encryption communication method in which the computer adds a new encryption key to the buffer according to a speed at which the number of encryption keys in the buffer decreases while the encryption communication continues.
A computer equipped with a memory performs encrypted communication by receiving encrypted data,
Each time the encrypted data is received, the computer acquires one encryption key stored in a buffer, which is an internal area of the memory, and uses the acquired encryption key to acquire the encryption key. And generating communication data by decrypting the encrypted data, deleting the acquired encryption key from the buffer,
An encryption communication method in which the computer adds a new encryption key to the buffer according to a speed at which the number of encryption keys in the buffer decreases while the encryption communication continues.
To a computer with memory,
Each time communication data is input, one encryption key stored in a buffer that is an internal area of the memory is acquired, and the communication data is encrypted using the acquired encryption key. A process for generating encrypted data at, and deleting the obtained encryption key from the buffer;
Processing for performing encrypted communication by transmitting the encrypted data;
An encryption communication program for executing a process of adding a new encryption key to the buffer according to a speed at which the number of encryption keys in the buffer decreases while the encryption communication is continued.
To a computer with memory,
A process of performing encrypted communication by receiving encrypted data;
Each time the encrypted data is received, an encryption key stored in a buffer that is an internal area of the memory is acquired, and the encrypted data is decrypted using the acquired encryption key. Processing to generate communication data and delete the acquired encryption key from the buffer;
An encryption communication program for executing a process of adding a new encryption key to the buffer according to a speed at which the number of encryption keys in the buffer decreases while the encryption communication is continued.