WO2023238172A1

WO2023238172A1 - Key issuing system, key issuing method, and program

Info

Publication number: WO2023238172A1
Application number: PCT/JP2022/022725
Authority: WO
Inventors: 史堯工藤; 彰永井; 悠介飯島
Original assignee: 日本電信電話株式会社
Priority date: 2022-06-06
Filing date: 2022-06-06
Publication date: 2023-12-14

Abstract

A key issuing system 1 comprises: a multifunctional communication gateway 10 including a communication unit 101 capable of performing communication via a communication network N1 and a communication network N2 that uses a bandwidth narrower than that of the communication network N1; and at least one communication device 20 capable of performing communication via the communication network N2. The multifunctional communication gateway 10 comprises a first security unit 102 in a secure environment. The first security unit 102 comprises a master key generation unit 1021 that generates a master public key, a user secret key generation unit 1022 that generates a user secret key by using the master public key and an identifier of the communication device 20, and a key distribution unit 1023 that transmits the user secret key to the communication device 20 having the received identifier.

Description

Key issuing system, key issuing method, and program

This disclosure relates to key issuance technology.

With the spread of IoT (Internet of Things) equipment, highly important communications are also being performed in IoT equipment (IoT devices). Therefore, authentication technology for confirming whether or not each other is the correct device at the time of communication is becoming important for IoT devices as well.

In IoT technology that uses a large number of devices (hereinafter also referred to as "devices"), an IoT gateway device (IoT-GW) that aggregates a large number of IoT devices may be used. In this case, from a cost perspective, a narrowband network such as LPWA (Low Power Wide Area) is used between the IoT device and the IoT gateway device, and a mobile network, for example, is used between the IoT gateway device and the server device. A configuration that utilizes a broadband network such as is often adopted.

In networks that use narrow bands such as LPWA, it is expected to use a mutual authentication method that utilizes ID-based encryption and requires less communication. The use of ID-based cryptography requires a key issuing authority because it issues a secret key corresponding to the ID of each entity such as an IoT device. However, since the ID-based encryption key issuing authority issues private keys for all entities, it is possible to decrypt ciphertext addressed to any recipient. In addition to ensuring the reliability of the key issuing authority itself, it is necessary to take strict measures to prevent leakage of the master key and parameters used to generate private keys. Based on the above background, it has been assumed that the key issuing authority is operated by a server that can take sufficient measures including physical security.

However, when ID-based encryption is used only in a local network under an IoT gateway device, there are cases in which it is desirable for the key issuing authority to be located in the local network from the viewpoint of load distribution, availability, and latency.

Conventional technology assumes that the key issuing authority is operated by the server, so the key issuing authority is constructed securely (to ensure communication security) on the IoT devices participating in the local IoT network. The problem was that there was no way to do that.

In order to solve the above problems, the present disclosure provides a technology that safely realizes key issuance in devices participating in a local network by installing a key issuing authority function in an IoT device equipped with a secure environment. It is in.

In order to solve the above problems, a key issuing system according to an aspect of the present disclosure includes a communication gateway that includes a communication unit capable of communicating through a first line and a second line that uses a narrower band than the first line; at least one communication device capable of communicating with the communication gateway using the second line, the communication gateway having a security section for a secure environment, and the security section comprising: A master key generation unit that generates a master public key using the selected master private key, the master public key generated by the master key generation unit, and the identifier of the communication device that the communication unit receives as input. a user private key generation unit that generates a user private key using the user private key generation unit; and a key distribution unit that transmits the user private key generated by the user private key generation unit to the communication device having the identifier received by the communication unit. .

Further, a key issuing system according to another aspect of the present disclosure includes a communication gateway including a communication unit capable of communicating through a first line and a second line that uses a narrower band than the first line; at least one communication device that can communicate using the second line, and k-1 (k is an integer of 2 or more) first devices, ..., (k-1) devices that can communicate using the second line. A key issuance system compatible with a hierarchical ID-based encryption system, the communication gateway having a first security unit in a first secure environment, the first security unit comprising: an intermediate key issuance device; a master key generation unit that generates a master public key and a master private key; a root private key generation unit that generates a root private key using the master private key; the master public key, the root private key; a first secret key generation unit that generates a first secret key using a first identifier of the first device of the intermediate key issuing device acquired by the communication unit; a key distribution unit that transmits the key to the first device, and the n-th (n=1, 2, ..., k-1) device of the intermediate key issuing device is a second security unit having a second secure environment. and the second security unit includes a communication device capable of communicating with the master public key and the first private key and the n+1th device of the intermediate key issuing device or the nth device of the intermediate key issuing device. an n+1 private key generation unit that generates an n+1 private key using an n+1 identifier acquired from one of the devices; and an n+1 private key generator that generates the n+1 private key using an and a key distribution unit that transmits the key to the communication device that can communicate with the n-th device of the issuing device.

According to the present disclosure, secure key issuance can be achieved in devices participating in a local network.

FIG. 1 is a diagram showing an example of a functional configuration of a key issuing system according to a first embodiment of the present disclosure. FIG. 2 is a diagram showing an example of the functional configuration of the multifunctional communication gateway 10 and the communication device 20. FIG. 3 is a sequence diagram showing an example of processing of the key issuing system 1. FIG. 4 is a diagram showing a functional configuration example of a modified example of the key issuing system according to the first embodiment of the present disclosure. FIG. 5 is a diagram showing an example of the functional configuration of a key issuing system according to the second embodiment of the present disclosure. FIG. 6 is a diagram showing an example of the functional configuration of the multifunctional communication gateway 10B, the intermediate key issuing device _35n , and the communication device 20. FIG. 7 is a sequence diagram showing an example of processing of the key issuing system 1B. FIG. 8 is a diagram showing a functional configuration example of a modified example of the key issuing system according to the second embodiment of the present disclosure. FIG. 9 shows a functional configuration example of another modification of the key issuing system according to the second embodiment of the present disclosure, which includes a multifunctional communication gateway 10C, an intermediate key issuing device _35Cn , and a communication device 20. FIG. FIG. 10 is a sequence diagram showing an example of processing in another modification of the key issuing system according to the second embodiment. FIG. 11 is a diagram illustrating the functional configuration of a computer.

Hereinafter, embodiments of the present disclosure will be described in detail using figures. Note that components having the same functions are given the same numbers and redundant explanations will be omitted.

<First embodiment>
<<Definition of symbols>>
The symbols used in the first embodiment are defined as follows.

ID _A : Identifier of the communication device 20A ID _B : Identifier of the communication device 20B D _A : User secret key of the communication device 20A D _B : User secret key of the communication device 20B k: Security parameter p, q: Prime number satisfying p≠q G ₁ : E ₁ is the elliptic curve on the finite field F _p , and a subgroup of the group E (F _p ) on the elliptic curve E _1. G ₂ : E ₂ is the elliptic curve on the k-th extension field of the finite field F _p . As, the group on the elliptic curve E ₂

Subgroup g1: Generator of G1 g2: Generator of G2 Zq: Coset modulo q z∈ZZq: Master private key Z=zg1: Master public key H1: From string (for example, octet string) to Zq H2: Function that generates an element on Zq from a string H3: Function that generates an element on Zq from a string H: Key derivation function K: Shared key e: Defined on G1×G2 Pairing operation Among the symbols defined above, it is assumed that the symbols other than the master secret key z, user secret keys _DA and _DB are public information. Note that G ₁ and G ₂ may be reversed. Furthermore, when inputting an element of a group or an element of _Zq to a function, a character string representing the element is input to the function.

[Key issuing system]
As shown in FIG. 1, a key issuing system 1 according to a first embodiment of the present disclosure includes a server X, a multifunctional communication gateway 10, and a plurality of communication devices 20 (20A, 20B,...). .

The server X and the multifunctional communication gateway 10 are communicably connected via a communication network N1 (first line) such as a mobile network, for example. Server X may be configured with an edge device. The server X and the communication network N1 do not have to be essential components of the key issuing system 1. That is, the server X and the communication network N1 may constitute the key issuing system 1 without being included in the key issuing system 1.

The multifunctional communication gateway 10 and each communication device 20 are communicably connected via a communication network N2 (second line), such as LPWA, which uses a narrower band than the communication network N1. The multifunctional communication gateway 10 and each communication device 20 constitute a local network.

(Multifunctional communication gateway 10)
The multifunctional communication gateway 10 is a device that includes a computer or computer system that functions as a KGC (Key Generation Center) in a device that functions as a communication gateway. The multifunctional communication gateway 10 generates a master public key in advance using a master private key, and then makes the master public key public. In addition, when the multifunctional communication gateway 10 receives an identifier of a communication device 20 as a key issuance request to be described later, it generates a user secret key from this identifier and sends the user secret to the communication device 20 corresponding to the identifier. Distribute (send) the key.

As shown in FIG. 2, the multifunctional communication gateway 10 in this embodiment includes a communication section 101 that communicates with external devices, and a first security section 102 that is connected to the communication section 101.

The communication unit 101 communicates with an external device such as the server X via the communication network N1. The communication unit 101 performs various types of communication with the communication device 20 via the communication network N2.

The first security unit 102 includes a master key generation unit 1021, a user private key generation unit 1022, a key distribution unit 1023, and a storage unit 1024 that stores various data (for example, various data such as a master public key and a master private key). .

The first security unit 102 has a secure environment function. The first security unit 102 may include a secure component such as a TEE (Trusted Execution Environment) in addition to a secure element such as an eSIM (An Embedded SIM).

(Communication device 20)
The communication device 20 uses the user private key distributed from the multifunctional communication gateway 10 to perform encrypted communication using ID-based encryption and authentication (i.e., confirm validity) with other communication devices 20. .

Any identifier can be used as the identifier of the communication device 20 used in this embodiment. Examples of the identifier include the manufacturing unique number, IP (Internet Protocol) address, physical address, user ID of the user of the communication device 20, name of the user of the communication device 20, email address of the user of the communication device 20, etc. can be mentioned.

An example of the communication device 20 is an IoT device. Examples include various sensor devices, embedded equipment, wearable devices, digital home appliances, surveillance cameras, lighting equipment, medical equipment, industrial equipment, etc. When the communication device 20 is an IoT device, the computing resources of the communication device 20 are often limited. For example, many have poor processor performance and memory capacity compared to general computers. However, the communication device 20 in the present disclosure may be a device that does not fall under the category of IoT devices, such as a PC (personal computer), a server device, a smartphone, or a tablet terminal.

As shown in FIG. 2, the communication device 20 in this embodiment includes a communication unit 201 and a storage unit 202 that stores various data (for example, a user secret key, etc.).

The communication unit 201 performs various communications with other communication devices 20, the multifunctional communication gateway 10, and the like.

Hereinafter, when each of the plurality of communication devices 20 is to be expressed separately, it may be expressed as, for example, "communication device 20A", "communication device 20B", etc.

[Key issuance method]
The processing method of the key issuing system according to this embodiment is realized by the multifunctional communication gateway 10 equipped with the first security unit 102 having a secure environment function performing the processing shown in FIG. 3. As an example, two communication devices 20, a communication device 20A and a communication device 20B, request the multifunction communication gateway 10 to issue a key, and the multifunction communication gateway 10 issues a user private key D _A and a user private key D _B. The process will be explained using the case of issuing a .

The master key generation unit 1021 generates a master public key and a master private key. That is, the master key generation unit 1021 selects the master private key z, calculates the master public key Z, and stores it in the storage unit 1024 (step S1021). Note that the master public key Z may be configured to be made public to each communication device 20 during generation.

The communication unit 101 receives an identifier as input from the communication device 20 as a key issuance request for a user private key (hereinafter also simply referred to as a “key issuance request”). That is, the communication unit 101 receives as input the identifier ID _A of the communication device 20A and the identifier ID _B of the communication device 20B at an arbitrary timing (step S101). For example, the identifier of the communication device 20 may be configured to be transmitted by the communication device 20 itself having the identifier, or may be configured to be transmitted by the communication device 20 itself having the identifier, or by other devices connected to the multifunctional communication gateway 10 via the communication network N1 or the communication network N2. The configuration may be such that the terminal or the like transmits the information. If the multifunctional communication gateway 10 has an input device, it may be configured so that the identifier of the communication device 20 can be input from the input device.

When receiving the identifier of the communication device 20, the user private key generation unit 1022 generates a user private key from this identifier. That is, the user private key generation unit 1022 generates user private keys D _A and D _B according to the following formula (step S1022).

Here, i _A = H ₁ (ID _A ), i _B = H ₁ (ID _B ). These _iA and _iB may be configured to be generated by the communication device 20, or may be configured to be generated by the multifunctional communication gateway 10. For example, when generating the user secret key _DA , the communication device 20 may generate _iA and disclose it to the multifunction communication gateway 10, or the multifunction communication gateway 10 may be configured to generate _iA . You may do so. Similarly, for example, when generating the user secret key _DB , the communication device 20 may generate _iB and disclose it to the multifunction communication gateway 10, or the multifunction communication gateway 10 may generate _iB . It may be configured as follows.

The generation of _iA and _iB may be configured such that the communication device 20A generates _iA and the communication device 20B generates _iB . However, if predetermined conditions are met, such as when the calculation resources of the communication device 20 are limited and a large number of calculation resources are required to calculate _H1 , the multifunctional communication gateway ₁₀ It may be configured to generate one or both of _B.

The key distribution unit 1023 distributes (transmits) the user private key to the communication device 20 corresponding to the identifier. That is, the key distribution unit 1023 distributes the user private key _DA to the communication device 20A, and also distributes the user private key _DB to the communication device 20B (step S1023). As a method for distributing a user private key by the key distribution unit 1023, for example, the key distribution unit 1023 may be configured to send the generated user private key to the corresponding communication device 20 using the generation of the user private key as a trigger. Further, the key distribution unit 1023 may be configured to distribute the user private key from the communication unit 101 to the communication device 20 in response to a request for distribution of the user private key from the communication device 20.

In order to securely distribute keys, for example, the initial key written at the time of device shipment, or the key exchanged based on the initial key, is used as the encryption key ( The distribution encryption keys are shared in advance by some means, such as using them as "distribution encryption keys" (hereinafter collectively referred to as "distribution encryption keys"), and the distribution encryption keys stored in the storage unit are utilized. The user private key may be encrypted and distributed. Alternatively, the user private key may be recorded on a recording medium or the like and then distributed to the communication device 20.

By implementing the processing method described above, the communication device 20 can obtain a user secret key to be used when performing authenticated key exchange with another communication device 20. That is, by using the key issuing system 1 according to this embodiment, it is possible to realize secure key issuing in devices participating in a local network.

<Modification of the first embodiment>
The first embodiment of the present disclosure may be configured like the key issuing system 1A shown in FIG. 4. That is, the key issuing device 30 may be configured to include a key issuing device 30 that is equipped with a communication unit capable of communicating with the communication network N2 and has a key issuing authority function equivalent to that of the multifunctional communication gateway 10. In this case, the multifunctional communication gateway 10 may be configured as a communication gateway 10A that does not include the function of a key issuing authority.

<Second embodiment>
The second embodiment of the present disclosure has a configuration in which a key issuing authority function and an intermediate key issuing authority function compatible with a hierarchical ID-based encryption system are placed in a secure environment within each device. The key issuing system 1B shown in FIG. 5 differs from the key issuing system 1 shown in FIG. 1 in that the multifunctional communication gateway 10 has been changed to a multifunctional communication gateway 10B that supports the hierarchical ID encryption method. And, it has an intermediate key issuing device 35 _n (n=1, 2, . . . , k-1 (k is an integer of 2 or more)) which was not included in the key issuing system 1. Here, the intermediate key issuing device 35 _n is configured to be able to communicate via the communication network N2 like the communication device 20. The intermediate key issuing device _35n may be configured with a plurality of layers so as to support the hierarchical ID encryption method. Note that for convenience of explanation, "intermediate key issuing device 35 _n " may be referred to as "intermediate key issuing device 35."

(Multifunctional communication gateway 10B)
The multifunctional communication gateway 10B of FIG. 6 differs from the multifunctional communication gateway 10 according to the first embodiment shown in FIG. 1021-1 has been newly added, and the user secret key generation section 1022 has been changed to a first secret key generation section 1022B. Along with these changes, the name of the first security section 102 has been changed to the first security section 102B.

The first security unit 102B, like the first security unit 102, has a secure environment (first secure environment) function. Furthermore, since the processing contents are different, the name of communication section 101 has been changed to communication section 101B.

(Intermediate key issuing device 35 _n )
The newly added intermediate key issuing device _35n includes a communication section 351 and a second security section 352 connected to the communication section 351. The second security unit 352 includes an n+1 private key generation unit 3521, a key distribution unit 3522, and a storage unit 3523. The second security unit 352 has a secure environment (second secure environment) function similarly to the first security unit 102B.

Note that the key issuing authority placed in the secure environment (for example, each element configuring the first security unit 102B and the second security unit 352) may be configured to be implemented in all devices in a hierarchical structure. , it may be configured to be implemented only in a part of it. An example of partially implementing it is, for example, implementing it only in the terminal intermediate key issuing device among the intermediate key issuing devices _35n .

[Key issuing method for key issuing system 1B]
The processing method of the key issuing system 1B according to this embodiment is realized by the multifunctional communication gateway 10B and the intermediate key issuing device _35n , each of which has a secure environment function, performing the processing shown in FIG.

In the following description, b is a random number selected according to a uniform distribution between 0 and 1. Also, x=1, 2,..., k, id ^(x) = (I ₁ , I ₂ ,..., I _x ), and b. Let id ^(x) = (b||I ₁ , I ₂ , ..., I _x ) be shown.

As shown in FIG. 7, the master key generation unit 1021 obtains the security parameter 1 ^κ , executes (mpk', msk')←SetUp'(1 ^κ ), and generates the master public key mpk' and the master private key. msk' is generated (step S1021). In this case, the generated master public key mpk' is shared (published) with each intermediate key issuing device 35 _n and the communication device 20 in order to be used for encryption when distributing the user private key. You can leave it there.

The root private key generation unit 1021-1 generates a root private key using the master private key. That is, the root private key generation unit 1021-1 generates the root private key sk[id ⁽⁰⁾ ]=(msk', msk') (step S1021-1).

The first private key generation unit 1022B sends a key issuance request via the communication unit 101B to the first (k=2) intermediate key issuing device 35 ₁ (or the communication device 20 capable of communicating with the multifunctional communication gateway 10B). If you obtain id ( ¹ ⁾ , which is ^the identifier ^of ]) (step S1022B-1).

The first private key generation unit 1022B generates a first private key using the master public key, the root private key, and the first identifier of the first intermediate key issuing device acquired by the communication unit. That is, the first secret key generation unit 1022B generates sk'[b. id ⁽¹⁾ ]←KG'(mpk', sk'[b.id ⁽⁰⁾ ], b.id ⁽¹⁾ ), and the first secret key sk[id ⁽¹⁾ ]=(sk'[ 0.id ⁽¹⁾ ], sk'[1.id ⁽¹⁾ ] are generated (step S1022B-2).

The key distribution unit 1023 transmits the first secret key sk[id ⁽¹⁾ ] generated by the first secret key generation unit 1022B to the first intermediate key issuing device 35 ₁ or a communication device capable of communicating with the multifunctional communication gateway 10B. 20 (step S1023).

When the n+1 private key generation unit 3521 of the first intermediate key issuing device 35 ₁ obtains the n+1 identifier as a key issue request via the communication unit 351, the master public key mpk received in step S1023 is ' and the first secret key sk[id ⁽¹⁾ ] = (sk'[0.id ⁽¹⁾ ], sk'[1.id ⁽¹⁾ ] to mpk=mpk', sk[id ^{(n )} ]=(sk'[0.id ⁽ⁿ⁾ ], sk'[1.id ⁽ⁿ⁾ ]) (step S3521-1). For example, if n=1, the first (k=2 ) communication unit 351 of the intermediate key issuing device 35 ₁ is a communication device capable of communicating with the second (k=3) intermediate key issuing device 35 ₂ or the first intermediate key issuing device 35 ₁ as a key issuing request. 20, the n+1 identifier id ⁽ⁿ⁺¹⁾ (in the case of n=1, id ⁽²⁾ ) is obtained from the ID (n+1). When the n+1 private key generation unit 3521 obtains the n+1 identifier, the Performs parsing process.

The n+1th private key generation unit 3521 generates the n+1th private key using the master public key, the nth private key, and the n+1 identifier. That is, the (n+1)th private key generation unit 3521 generates sk'[b. id ⁽ⁿ⁺¹⁾ ]←KG'(mpk', sk'[b.id ⁽ⁿ⁾ ], b.id ⁽ⁿ⁺¹⁾⁾ ), and the n+1th private key sk[id ⁽ⁿ⁺¹⁾ ]=(sk'[ 0.id ⁽ⁿ⁺¹⁾ ], sk'[1.id ⁽ⁿ⁺¹⁾ ] (step S3521-2).For example, in the case of n=1, the (n+1)th private key of the first intermediate key issuing device 35 ₁ is generated. The generation unit 3521 generates a second secret key.

The key distribution unit 3522 sends the n+1st private key sk [id ⁽ⁿ⁺¹⁾ ] generated by the n+1th private key generation unit 3521 to the lower intermediate key issuing device 35 (the n+1st device of the intermediate key issuing devices) or to the communication device 20. (the communication device capable of communicating with the n-th device of the intermediate key issuing device) (step S3522). For example, when n=1, the key distribution unit 3522 of the first intermediate key issuing device 35 ₁ is connected to the second (k=3) intermediate key issuing device 35 ₂ or the first intermediate key issuing device 35 ₁ . The second secret key is distributed to communication devices 20 that can communicate.

Hereinafter, when an intermediate key issuing device 35 in a lower hierarchy or a communication device 20 that can communicate with them is provided, the above steps (step S3521-1, step S3521-2, step S3522) are performed. repeat.

By implementing the processing method described above, the communication device 20 can obtain a user secret key to be used when performing authenticated key exchange with another communication device 20. That is, by using the key issuing system 1B according to this embodiment, it is possible to realize secure key issuing in devices participating in the local network.

<Modified example of second embodiment>
The second embodiment of the present disclosure may be configured like the key issuing system 1C shown in FIG. 8. In the key issuing system 1C, the key issuing authority function that the multifunctional communication gateway 10B had is provided so that it can communicate on the communication network N1 as a key issuing device 30 having that function. Along with this, the multifunctional communication gateway 10B has been changed to a communication gateway 10C that does not have an intermediate key issuing authority function. Here, the intermediate key issuing device 35 corresponds to a lower layer of the key issuing device 30.

Note that since it is sufficient that any of the devices communicating with the communication network N2 has an intermediate key issuing authority function, even in the case of the key issuing system 1C, the intermediate key issuing authority function is provided in the communication gateway 10C. It may have. Furthermore, in the key issuing system 1C, the intermediate key issuing apparatus _35n may be configured in a plurality of layers, like the intermediate key issuing apparatus _35n provided in the key issuing system 1B shown in FIG.

<Other modifications of the second embodiment>
The second embodiment described above may have a configuration as shown in FIG. The configuration shown in FIG. 9 differs from the configuration shown in FIG. 6 in that the multifunctional communication gateway 10B is changed to a communication gateway 10C, and the intermediate key issuing device 35 _n is changed to an intermediate key issuing device 35 C _n . This is something that has changed.

In the multifunctional communication gateway 10C, a device authentication section 1025 is newly provided in the first security section, and the name has been changed from the first security section 102B to the first security section 102C. In the intermediate key issuing device 35C _n , a device authentication section 3524 is provided in the second security section, and the name has been changed from the second security section 352 to the second security section 352C.

The processing method of this modification is realized by the multifunctional communication gateway 10C equipped with the device authentication section 1025 and the intermediate key issuing device _35Cn equipped with the device authentication section 3524 performing the processing shown in FIG. . The processing method in FIG. 10 differs from the processing method in FIG. 7 in that step S1025 and step S3524 for device authentication processing are added, and step S1022B-2 is changed to step S1022C. The difference is that step S3521-2 is changed to step S3521C.

In this modification, the multifunctional communication gateway 10C stores in advance a list of information on one or more terminals (devices) capable of issuing keys in the storage unit 1024, for example, as data in a table format. When an identifier is received from the intermediate key issuing device 35C _n , the device information of the intermediate key issuing device 35C _n is also received along with the identifier.

The device authentication unit 1025 performs an authentication check to determine whether the device information of the intermediate key issuing device _35Cn that has requested the key issuance request exists in the list of key issuing terminals stored in the storage unit 1024. If there is a match, it is determined to be "permitted", and if there is no match, it is determined to be "not permitted" (step S1025).

If "permission" is determined in step S1025, the first private key generation unit 1022B performs a first private key generation process. At this time, a key is generated using a predetermined flag so that permission can be identified (step S1022C).

Similarly, the intermediate key issuing device 35C _n stores in advance a list of information on one or more terminals (devices) capable of issuing keys in the storage unit 3523, for example, as data in a table format. When an identifier is received from the (n+1)th device of the intermediate key issuing device, the device information of the (n+1)th device of the intermediate key issuing device is also received along with the identifier.

The device authentication unit 3524 authenticates whether the device information of the (n+1)th device of the intermediate key issuing device that has requested the key issuance request exists in the list of key issuing terminals stored in the storage unit 3523. If there is a match, it is determined to be "permitted", and if there is no match, it is determined to be "not permitted" (step S3524).

In the determination of step S3524, if "permission" is determined, the (n+1)th private key generation unit 3521 performs the process of generating the (n+1)th private key. At this time, a key is generated using a predetermined flag so that permission can be identified (step S3521C).

Note that the device authentication unit 3524 may be configured to be installed in all intermediate key issuing devices _35Cn . If device authentication is not required, the key issuing system may be constructed using intermediate key issuing apparatuses that do not include the device authentication section 3524 as part or all of the intermediate key issuing apparatuses.

[Program, recording medium]
The various processes described above are performed by causing the recording unit 2020 of the computer 2000 shown in FIG. This can be done by letting

A program that describes this processing content can be recorded on a computer-readable recording medium. The computer-readable recording medium may be of any type, such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory.

Further, distribution of this program is performed, for example, by selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, this program may be distributed by storing the program in the storage device of the server computer and transferring the program from the server computer to another computer via a network.

A computer that executes such a program, for example, first stores a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing a process, this computer reads a program stored in its own recording medium and executes a process according to the read program. In addition, as another form of execution of this program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and furthermore, the program may be transferred to this computer from the server computer. The process may be executed in accordance with the received program each time. In addition, the above-mentioned processing is executed by a so-called ASP (Application Service Provider) service, which does not transfer programs from the server computer to this computer, but only realizes processing functions by issuing execution instructions and obtaining results. You can also use it as Note that the program in this embodiment includes information that is used for processing by an electronic computer and that is similar to a program (data that is not a direct command to the computer but has a property that defines the processing of the computer, etc.).

Furthermore, in this embodiment, the present apparatus is configured by executing a predetermined program on a computer, but at least a part of these processing contents may be implemented in hardware.

Note that various forms of the program can be considered, but for example, in addition to programs for devices that can control the entire key issuing system, various types of devices shown in this disclosure (for example, multifunctional communication gateways 1, 1B, Examples include a program used by the intermediate key issuing device 35 _n , the communication device 20, the key issuing device 30, and modifications thereof), or a program that collectively executes the processes of two or more devices.

Claims

a communication gateway including a communication unit capable of communicating via a first line and a second line using a narrower band than the first line; and at least one communication device capable of communicating with the communication gateway using the second line. A key issuance system having the following:
the communication gateway has a security section for a secure environment;
The security department is
a master key generation unit that generates a master public key using the selected master private key;
a user private key generation unit that generates a user private key using the master public key generated by the master key generation unit and the identifier of the communication device accepted as input by the communication unit;
a key distribution unit that transmits the user private key generated by the user private key generation unit to the communication device having the identifier received by the communication unit;
A key issuing system with
a communication gateway equipped with a communication unit capable of communicating using a first line and a second line using a narrower band than the first line; and a key issuing device equipped with a communication unit capable of communicating using the second line. , at least one communication device capable of communicating using the second line,
The key issuing device has a security section for a secure environment,
The security department is
a master key generation unit that generates a master public key using the selected master private key;
a user private key generation unit that generates a user private key using the master public key generated by the master key generation unit and the identifier of the communication device accepted as input by the communication unit;
a key distribution unit that transmits the user private key generated by the user private key generation unit to the communication device having the identifier received by the communication unit;
A key issuing system with
a communication gateway including a communication unit capable of communicating via a first line and a second line using a narrower band than the first line; at least one communication device capable of communicating using the second line; A hierarchical ID-based encryption system comprising k-1 first devices (k is an integer of 2 or more) capable of communicating using two lines, ..., an intermediate key issuing device consisting of the (k-1)th device A key issuing system compatible with the method,
the communication gateway has a first security part of a first secure environment;
The first security department includes:
a master key generation unit that generates a master public key and a master private key;
a root private key generation unit that generates a root private key using the master private key;
a first private key generation unit that generates a first private key using the master public key, the root private key, and a first identifier of a first device of the intermediate key issuing device acquired by the communication unit;
a key distribution unit that transmits the first private key to a first device of the intermediate key issuing device;
The n-th (n=1, 2, ..., k-1) device of the intermediate key issuing device has a second security section having a second secure environment,
The second security department includes:
the master public key, the first private key, and an n+1 identifier obtained from either the n+1st device of the intermediate key issuing device or a communication device capable of communicating with the nth device of the intermediate key issuing device; an (n+1)-th private key generation unit that generates the (n+1)-th private key using the
a key distribution unit that transmits the n+1 private key to the n+1 device of the intermediate key issuing device or the communication device capable of communicating with the n device of the intermediate key issuing device;
A key issuing system with
a key issuing device that communicates using a first line; a communication gateway that includes a communication unit capable of communicating via a first line and a second line that uses a narrower band than the first line; and a lower layer of the key issuing device. an intermediate key issuing device consisting of k-1 (k-1) first devices (k is an integer of 2 or more) corresponding to the second line and capable of communicating using the second line; A key issuance system compatible with a hierarchical ID-based cryptosystem, comprising: at least one communication device capable of communicating using two lines;
The key issuing device has a first security unit in a first secure environment,
The first security department includes:
a master key generation unit that generates a master public key and a master private key;
a root private key generation unit that generates a root private key using the master private key;
a first private key generation unit that generates a first private key using the master public key, the root private key, and a first identifier of a first device of the intermediate key issuing device acquired by the communication unit;
a key distribution unit that transmits the first private key to a first device of the intermediate key issuing device;
The n-th (n=1, 2, ..., k-1) device of the intermediate key issuing device has a second security section having a second secure environment,
The n-th (n=1, 2, ..., k-1) device of the intermediate key issuing device has a second security section having a second secure environment,
The second security department includes:
the master public key, the first private key, and an n+1 identifier obtained from either the n+1st device of the intermediate key issuing device or a communication device capable of communicating with the nth device of the intermediate key issuing device; an (n+1)-th private key generation unit that generates the (n+1)-th private key using the
a key distribution unit that transmits the n+1 private key to an n+1 device of the intermediate key issuing device or a communication device capable of communicating with the n device of the intermediate key issuing device;
A key issuing system with
The first security section further includes a device authentication section,
The device authentication unit is configured to determine that when the communication gateway receives the device information together with the first identifier from the first device of the intermediate key issuing device, the device information is a plurality of information stored in advance in the communication gateway. 4. The key issuing system according to claim 3, wherein if the device information matches any of the device information, the first private key generation unit generates the first private key.
A communication unit capable of communicating through a first line and a second line using a narrower band than the first line, and a secure environment including a master key generation unit, a user private key generation unit, and a key distribution unit. A key issuance method using a key issuance system comprising: a communication gateway having a security unit configured to provide a security unit; and at least one communication device capable of communicating with the communication gateway using the second line,
The master key generation unit selects a master private key and generates a master public key using the master private key,
a user private key generation unit generates a user private key using the master public key generated by the master key generation unit and the identifier of the communication device accepted as input by the communication unit;
a key distribution unit transmits the user private key generated by the user private key generation unit to a communication device having an identifier received by the communication unit;
Key issuance method.
A communication gateway including a communication unit capable of communicating via a first line and a second line using a narrower band than the first line, and having a first security unit, and at least one communication unit capable of communicating using a second line. An intermediate key issuing device comprising a device, k-1 first devices (k is an integer of 2 or more), ..., (k-1)th devices capable of communicating using the second line, The n-th (n=1, 2,..., k-1) device is an intermediate key issuing device having a second security part, and key issuing using a key issuing system compatible with a hierarchical ID-based cryptosystem. A method,
The first security department includes:
Select a master secret, use this master private key to generate a master public key,
generating a root private key using the master private key;
generating a first private key using the master public key, the root private key, and a first identifier of the first intermediate key issuing device acquired by the communication unit;
transmitting the first private key to a first device of the intermediate key issuing device;
The second security department includes:
the master public key, the first private key, and an (n+1)th identifier obtained from either the n+1st device of the intermediate key issuing device or a communication device capable of communicating with the nth device of the intermediate key issuing device; Generate the n+1 private key using
transmitting the n+1 private key to an n+1 device of the intermediate key issuing device or a communication device capable of communicating with the n device of the intermediate key issuing device;
Key issuance method.
Any one of the communication gateway according to claim 1, claim 3, or claim 5, the key issuing device according to claim 2 or claim 4, or the intermediate key issuing device according to claims 3 to 5. A program that allows the device to function on a computer.